auto-permission-system 3.17.0 → 3.19.0

package/extensions/guard.ts

@@ -323,7 +323,7 @@ export default function (pi: ExtensionAPI) {
 			return;
 		}
 		audit({ layer: 2, tool: event.toolName, decision: "no", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-		ctx.ui.notify(`Sensitive data protected: withheld ${event.toolName} output from the AI (potential secrets detected).`, "warning");
+		ctx.ui.notify(`Sensitive data protected: ${event.toolName} output was hidden from the AI (potential secrets detected).`, "warning");
 		return { content: [{ type: "text", text: withheldNotice(subject) }] };
 	});
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-permission-system",
-  "version": "3.17.0",
+  "version": "3.19.0",
   "description": "Claude auto mode for Pi & security for Pi. A zero-trust permission system for Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
   "type": "module",
   "author": "Navin Kumar",

package/skills/auto-permission-system/SKILL.md

@@ -123,7 +123,7 @@ The same options apply to a bash command whose network request reaches a host ou
 - **`advanced-secure`** (recommended) — adds secret/credential detection, and **only adds asks or blocks** (never loosens):
   - file reads whose name looks like a credential store ask before the read;
   - risky `mcp__<server>__<tool>` calls ask before they run. The gate ignores the `mcp__<server>__` namespace, takes the operation from the head verb of the name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`/`UPDATE` without `WHERE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with **no description** counts as opaque and does. Tune it under `mcp` in `sandbox.json` (ADR-032): `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` lets a server's `readOnlyHint` allow the call, `askThreshold` moves the score line (default 30). An untrusted project file may only tighten it (add `askTools`, lower `askThreshold`, turn `allowSimpleUpdates`/`trustAnnotations` off).
-  - before any tool/command/file output reaches the model, a secret-like hit shows the tool and each detected line as `Finding  <lineNo>: <complete line>` — one `Finding` row per match, no truncation — plus `Question Should the AI be allowed to see it?`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
+  - before any tool/command/file output reaches the model, a secret-like hit shows the tool and each detected line as `Finding  <lineNo>: <complete line>` — one `Finding` row per match, no truncation — plus `Question Should the AI be allowed to see it?`, with two choices — **No, keep private** or **Yes, allow**. No, keep private hides the output and tells the model it was hidden because it may contain sensitive credentials (not a failure, not an empty result).
 
 Switch with `/permission-mode`; all three modes are saved to the global `sandbox.json` and reflected in the footer's sandbox chip (`Sandbox: 🧠 N domains, M paths` for advanced-secure, `Sandbox: 🔒 …` for default). An untrusted project may move the mode **up** (toward stricter), never down: it cannot turn on YOLO or turn off Advanced Secure. The third choice, **YOLO**, disables every layer; the chip reads `⚠️ YOLO — all security layers disabled` until you pick another mode (ADR-020).
 

package/src/l1-sandbox/bash-ops.ts

@@ -93,7 +93,7 @@ async function preflightSensitiveCommands(
 		return undefined;
 	}
 	auditL1({ subject, decision: "no", note: "sensitive-command", cwd });
-	onData(Buffer.from(`\n[Security Block] pi-sandbox: command blocked — it can print secrets: ${subject}. Nothing was run — ask the user.\n`));
+	onData(Buffer.from(`\n[Security Block] sandbox: command execution was denied by user: ${subject}. Command was not executed.\n`));
 	return { exitCode: 1 };
 }
 
@@ -109,14 +109,15 @@ async function preflightAskReads(
 ): Promise<{ exitCode: number } | undefined> {
 	const cfg = loadConfig(cwd).filesystem;
 	if (!cfg?.askRead?.length) return undefined;
-	const paths = askReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
-	if (!paths.length) return undefined;
+	const rawPaths = askReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
+	if (!rawPaths.length) return undefined;
+	const paths = Array.from(new Set(rawPaths.map((p) => canonicalize(p, cwd))));
 	const ui = opts?.ctx as AskCtx | undefined;
 	for (const absPath of paths) {
 		if (sessionAskReadGrants.includes(absPath)) continue;
 		if (!ui?.hasUI || !ui.ui?.select) {
 			auditL1({ subject: absPath, decision: "no", note: "ask-read-headless", cwd });
-			onData(Buffer.from(`\n[Security Block] pi-sandbox: sensitive file read blocked: ${absPath}. Nothing was run — ask the user.\n`));
+			onData(Buffer.from(`\n[Security Block] sandbox: read access to ${absPath} was blocked (automated environment). Command was not executed.\n`));
 			return { exitCode: 1 };
 		}
 		const choice = await askMain(ui, "Let this command read your .env file?", [`File     ${absPath}`, `Why      .env files usually hold passwords and API keys`, `Risk     the AI will see any keys in it`, `Note     can't be saved as a permanent rule (it holds secrets)`].join("\n"), { session: true, remember: false, icon: "cred" });
@@ -126,7 +127,7 @@ async function preflightAskReads(
 			continue;
 		}
 		auditL1({ subject: absPath, decision: "no", note: "ask-read", cwd });
-		onData(Buffer.from(`\n[Security Block] pi-sandbox: sensitive file read blocked: ${absPath}. Nothing was run — ask the user.\n`));
+		onData(Buffer.from(`\n[Security Block] sandbox: read access to ${absPath} was denied by user. Command was not executed.\n`));
 		return { exitCode: 1 };
 	}
 	return undefined;
@@ -143,7 +144,9 @@ async function preflightOutsideReads(
 		return undefined;
 	}
 	const once: string[] = [];
-	for (const absPath of outsideProjectReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd))) {
+	const rawCandidates = outsideProjectReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
+	const candidates = Array.from(new Set(rawCandidates.map((p) => canonicalize(p, cwd))));
+	for (const absPath of candidates) {
 		if (sessionReadGrants.includes(absPath)) continue;
 		const ui = opts.ctx as AskCtx;
 		const parent = dirname(absPath);
@@ -163,7 +166,7 @@ async function preflightOutsideReads(
 		if (choice === MainChoice.Session) {
 			sessionReadGrants.push(absPath);
 			auditL1({ subject: absPath, decision: "session", scope: "session", reason: "outside-project-read", note: "preflight", cwd });
-			opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} for this conversation (not saved)`, "info");
+			opts.ctx.ui?.notify?.(`sandbox: allowed read of ${absPath} for this conversation (not saved)`, "info");
 			continue;
 		}
 		if (choice !== MainChoice.Remember || !grant) {
@@ -176,10 +179,10 @@ async function preflightOutsideReads(
 		try {
 			const persistedTo = await opts.onAlwaysRead(subject, scope);
 			auditL1({ subject, decision: scope === "cwd" ? "always-cwd" : "always-global", scope, cwd, persisted_to: persistedTo, note: "preflight" });
-			opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${subject} (${scope})`, "warning");
+			opts.ctx.ui?.notify?.(`sandbox: allowed read of ${subject} (${scope})`, "warning");
 		} catch (e) {
 			auditL1({ subject, scope, cwd, error: String(e), note: "preflight" });
-			onData(Buffer.from(`\n❌ pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`));
+			onData(Buffer.from(`\n❌ sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`));
 			return { blocked: { exitCode: 1 } };
 		}
 	}
@@ -370,7 +373,7 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							blockedHint = "";
 							auditL1({ subject: offending ?? spelledOffending, decision: "write-denied", reason: "the OS sandbox could not start (bwrap mount setup)", cwd: opts?.ctx?.cwd, note: "sandbox-setup-error" });
 							opts?.ctx?.ui?.notify?.(`Sandbox setup notice: could not prepare folder isolation for ${offending ?? spelledOffending ?? "the sandbox"}. System defaults will be used.`, "warning");
-							decisionHint = `\n[System Error] pi-sandbox: the OS sandbox could not start (bwrap could not create a protected mount point), so nothing was permission-prompted. This is a sandbox setup problem, not a policy denial.\n`;
+							decisionHint = `\n[System Error] sandbox: the OS sandbox could not start (bwrap could not create a protected mount point), so nothing was permission-prompted. This is a sandbox setup problem, not a policy denial.\n`;
 							onData(Buffer.from(decisionHint));
 						} else if (offending && outsideDenied && !hardDenied && outsideMode === "ask" && opts?.ctx?.hasUI && opts.ctx.ui?.select && opts.onAlwaysRead) {
 							const absPath = offending;
@@ -390,8 +393,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									if (choice === MainChoice.Once) readOnce.push(absPath);
 									else sessionReadGrants.push(absPath);
 									auditL1({ subject: absPath, decision: choice, scope: choice === MainChoice.Once ? "invocation" : "session", cwd: opts.ctx.cwd, note: "outside-project-read" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this conversation"}`, "info");
-									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this conversation"}. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this conversation"}`, "info");
+									onData(Buffer.from(`\n[Permission Granted] sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this conversation"}. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}
@@ -400,13 +403,13 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									try {
 										const persistedTo = await opts.onAlwaysRead(subject, grant.scope);
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, decision: grant.scope === "cwd" ? "always-cwd" : "always-global", scope: grant.scope, cwd: opts.ctx.cwd, persisted_to: persistedTo, note: "outside-project-read" });
-										opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
-										onData(Buffer.from(`\n[Permission Granted] pi-sandbox: read of ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
+										opts.ctx.ui?.notify?.(`sandbox: allowed read of ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
+										onData(Buffer.from(`\n[Permission Granted] sandbox: read of ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
 										resolve(attempt([]));
 										return;
 									} catch (e) {
 										auditL1({ subject, scope: grant.scope, cwd: opts.ctx.cwd, error: String(e), note: "outside-project-read" });
-										decisionHint = `\n[Security Notice] pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
+										decisionHint = `\n[Security Notice] sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
 									}
 								}
 							} catch (e) {
@@ -456,8 +459,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 								if (choice === MainChoice.Once) {
 									grantedWriteFolders.add(parentDir);
 									auditL1({ subject: absPath, granularity: "folder", original: absPath, decision: "once", scope: "invocation", cwd: opts.ctx.cwd, note: "write-once" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${absPath} once`, "info");
-									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${absPath} allowed once. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`sandbox: allowed write to ${absPath} once`, "info");
+									onData(Buffer.from(`\n[Permission Granted] sandbox: write to ${absPath} allowed once. Command output with the new permission follows.\n`));
 									resolve(attempt([...writeOnce, parentDir]));
 									return;
 								}
@@ -466,8 +469,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									sessionWriteGrants.push(value);
 									(value === parentDir ? grantedWriteFolders : grantedWriteFiles).add(value);
 									auditL1({ subject: value, granularity: value === parentDir ? "folder" : "file", original: absPath, decision: "session", scope: "session", cwd: opts.ctx.cwd, note: "write-session" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${value} for this conversation`, "info");
-									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${value} allowed for this conversation. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`sandbox: allowed write to ${value} for this conversation`, "info");
+									onData(Buffer.from(`\n[Permission Granted] sandbox: write to ${value} allowed for this conversation. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}
@@ -477,14 +480,14 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 										const persistedTo = await opts.onAlways(subject, grant.scope);
 										(grant.folder ? grantedWriteFolders : grantedWriteFiles).add(subject);
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, decision: grant.scope === "cwd" ? "always-cwd" : "always-global", scope: grant.scope, cwd: opts.ctx.cwd, persisted_to: persistedTo });
-										opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
-										onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
+										opts.ctx.ui?.notify?.(`sandbox: allowed write to ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
+										onData(Buffer.from(`\n[Permission Granted] sandbox: write to ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
 										resolve(attempt([]));
 										return;
 									} catch (e) {
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, scope: grant.scope, cwd: opts.ctx.cwd, error: String(e) });
-										opts.ctx.ui?.notify?.(`pi-sandbox: could not save the permission (${e})`, "error");
-										decisionHint = `\n[Security Notice] pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
+										opts.ctx.ui?.notify?.(`sandbox: could not save the permission (${e})`, "error");
+										decisionHint = `\n[Security Notice] sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
 									}
 								}
 							} catch (e) {

package/src/ui/ask-flow.ts

@@ -482,7 +482,7 @@ export async function askExposure(ctx: AskCtx, hits: string[], programId?: strin
  */
 export function withheldNotice(subject: string): string {
 	return [
-		`[Security Policy Notice] Output from \`${subject}\` was withheld because it contains sensitive credentials.`,
+		`[Security Policy Notice] Output from \`${subject}\` was hidden because it contains sensitive credentials.`,
 		"",
 		"The tool completed successfully, but the output is unavailable.",
 		"Continue with the available information, or ask the user to allow access if the output is needed.",