auto-permission-system 3.6.0 → 3.8.0

package/README.md

@@ -1,13 +1,15 @@
-# auto-permission-system
+# Auto Permission System: Cloud Auto Mode & Security for Pi Coding Agent
 
 [![npm version](https://img.shields.io/npm/v/auto-permission-system.svg)](https://www.npmjs.com/package/auto-permission-system)
 [![npm downloads](https://img.shields.io/npm/dm/auto-permission-system.svg)](https://www.npmjs.com/package/auto-permission-system)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Pi package](https://img.shields.io/badge/pi--package-gallery-blueviolet)](https://pi.dev/packages)
 [![CI](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml/badge.svg)](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml)
+[![Cloud Auto Mode for Pi](https://img.shields.io/badge/Pi-Cloud_Auto_Mode-blue.svg)](#cloud-auto-mode-for-pi)
+[![Security for Pi](https://img.shields.io/badge/Security-for_Pi-green.svg)](#security-for-pi--how-to-secure-pi)
+[![Permission System for Pi](https://img.shields.io/badge/Permission_System-for_Pi-orange.svg)](#permission-system-for-pi-pi-permission-system)
 
-**A security sandbox, permission system and tool guard for the [Pi coding agent](https://pi.dev).**
-It puts allow/deny rules, interactive ask prompts, secret detection and an audit log around every tool the agent can call — file reads and writes, shell commands, searches and network access — so the agent can work in your repository without reaching your credentials or the wider internet by accident.
+**Auto Permission System** is the comprehensive toolkit providing **cloud auto mode for Pi**, **security for Pi**, and a zero-trust **permission system for Pi** ([pi.dev](https://pi.dev)). Whether you need an interactive **Pi permission system** with real-time ask prompts, an automated **PyPI permission system** to guard `.pypirc` and `pip install` commands, or a hardened **cloud auto mode** to **secure Pi** in headless CI/CD environments, this extension enforces multi-layer boundaries across filesystem access, network egress, shell commands, and MCP tools.
 
 Enforcement happens in three layers:
 
@@ -22,6 +24,10 @@ When a tool call is blocked you get an interactive prompt — no need to leave p
 - [Install](#install)
 - [Requirements](#requirements)
 - [Configuration](#configuration)
+- [Cloud Auto Mode for Pi](#cloud-auto-mode-for-pi)
+- [Security for Pi & How to Secure Pi](#security-for-pi--how-to-secure-pi)
+- [Permission System for Pi (Pi Permission System)](#permission-system-for-pi-pi-permission-system)
+- [PyPI & Python Ecosystem Security](#pypi--python-ecosystem-security)
 - [Commands](#commands)
 - [Escape hatches](#escape-hatches)
 - [FAQ](#faq)
@@ -89,6 +95,14 @@ A higher layer only states what it changes; absent keys keep the layer below. A
   "subagent": {
     "network": "allow"                  // "allow" | "deny" | "research-only"
   },
+  "mcp": {                              // Advanced Secure MCP gate tuning (ADR-032)
+    "allowTools": ["mcp__diffusion_studio__context"],  // exact names that never ask
+    "allowPrefixes": ["mcp__ticktick__get_"],          // name prefixes that never ask
+    "askTools": [],                    // exact names that always ask
+    "trustAnnotations": false,         // true = a server's readOnlyHint allows without asking
+    "allowSimpleUpdates": true,        // narrow field updates skip the ask
+    "askThreshold": 30                 // risk score at which a call asks (lower = stricter)
+  },
   "commands": {
     "ask": ["printenv", "env", "/proc/*/environ"]  // bash: ask before these (they can print env tokens)
   }
@@ -124,7 +138,7 @@ Never asked about: the project itself, your `allowWrite` roots, pi's own package
 
 ### Ask-tier prompt
 
-`no — block` is pre-selected, so Enter alone blocks. **Network (domain) asks are the exception** (ADR-024): the countdown default is `Allow once` — the footer reads `Default: Yes, just this once (15s)` — so an unanswered countdown counts as allow-once for that bash command, while Enter and Esc still block/deny. Once you press ↑/↓ the `Default:` line disappears and the 15s activity timer restarts (ADR-031). Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). A bash command that reaches a domain outside `allowedDomains` gets the same prompt (ADR-023); because the sandbox proxy asks per connection, `yes — this once` covers that command's connections to the host, and a remembered host is written to `overrides.allowDomains` and applies immediately. Hosts in `deniedDomains`, or with `strictAllowlist: true`, are blocked without a prompt. Prompts are shown one at a time: the extension serializes them, because pi's selector is a singleton and two overlapping prompts can orphan each other and hang the waiting connection. For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins. The refusal is read from the command's own error text — `EPERM` / `Operation not permitted` on macOS, `EROFS` / `Read-only file system` on Linux (ADR-022) — so a Linux EROFS gets the same prompt instead of a silent read-only failure; a refused write is never mistaken for an outside-project read.
+`no — block` is pre-selected, so Enter alone blocks. **Network (domain) asks are the exception** (ADR-024): the countdown default is `Allow once` — the footer reads `Default: Yes, just this once (15s)` — so an unanswered countdown counts as allow-once for that bash command, while Enter and Esc still block/deny. Once you press ↑/↓ the `Default:` line disappears and the 15s activity timer restarts (ADR-031). The prompt is keyboard-only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels — a mouse click or wheel over the prompt does nothing. Besides `yes — this once` and the persistent `always` options there is `yes — for this session` (this file, its folder, or this domain), kept in memory until the session ends and never saved (ADR-010). A bash command that reaches a domain outside `allowedDomains` gets the same prompt (ADR-023); because the sandbox proxy asks per connection, `yes — this once` covers that command's connections to the host, and a remembered host is written to `overrides.allowDomains` and applies immediately. Hosts in `deniedDomains`, or with `strictAllowlist: true`, are blocked without a prompt. Prompts are shown one at a time: the extension serializes them, because pi's selector is a singleton and two overlapping prompts can orphan each other and hang the waiting connection. For a bash write that the sandbox refused after the command already ran, `yes — this once` re-runs the command once with that folder allowed for the one invocation only (never saved), and `denyWrite` still wins. The refusal is read from the command's own error text — `EPERM` / `Operation not permitted` on macOS, `EROFS` / `Read-only file system` on Linux (ADR-022) — so a Linux EROFS gets the same prompt instead of a silent read-only failure; a refused write is never mistaken for an outside-project read.
 
 Every prompt waits **10 seconds** by default. For file reads and writes, no answer resolves to the safe default: **block / deny**. For a network ask, no answer resolves to **allow once** (ADR-024); Esc still denies.
 
@@ -139,7 +153,7 @@ An entry without `/` or `~` (`.env`, `*.key`) is a file name. pi's own tools (La
 - **`default`** (shipped) — rules only: sandbox.json paths, domains, and commands. Nothing inspects file contents.
 - **`advanced-secure`** (recommended) — adds secret/credential detection:
   - **File reads:** a filename that looks like a credential store asks before the read.
-  - **MCP calls:** `mcp__<server>__<tool>` calls are classified; a risky (mutating/destructive) call asks before it runs.
+  - **MCP calls:** `mcp__<server>__<tool>` calls are classified; a risky call asks before it runs. The gate ignores the server namespace, reads the operation from the head verb of the tool name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with no description counts as opaque and does. Tune it under `mcp` in `sandbox.json` — `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` trusts a server's `readOnlyHint`, `askThreshold` moves the score line (ADR-032).
   - **Tool/command/file output:** before any output reaches the model, a secret-like hit shows `⚠ Sensitive information detected`, the file, and each detected line as `lineNo: text`, and the question **Should the AI be allowed to see it?** with two choices — **No, keep private** or **Yes, allow**. A bare `key` counts only when the value looks machine-generated: `key=<random>` asks, while `key=value`, `key=subagent.network`, and code such as `const key = x` stay clean. No, keep private withholds the output and tells the model plainly that the output was withheld because it may contain sensitive information, so the model does not mistake it for a failure or an empty result. Esc or timeout keeps it private.
 
 Detection can only **add** asks or blocks; it never loosens a rule. The mode is layered like every other key: an untrusted project may opt *in* to `advanced-secure`, but only a trusted project (or the global file) may turn it off.
@@ -164,6 +178,72 @@ Access to `~/.ssh`, `~/.gnupg`, `~/.aws`, `*.pem`, `*.key` and pi's own `~/.pi/a
 
 `sandbox.json` is strict JSON: no comments, no trailing commas. If a file does not parse, both layers skip it and use the built-in defaults for it. Layer 2 then shows an error at session start and writes `policy-parse-error` to the audit log. The "always" prompts refuse to write to a file they cannot parse, so a hand-written policy is never replaced.
 
+## Cloud Auto Mode for Pi
+
+When running the Pi coding agent autonomously in the cloud, CI/CD pipelines, Docker containers, remote devboxes (GitHub Codespaces, Gitpod, Daytona), or headless subagents (`pi -p`, JSON mode), interactive terminal ask prompts cannot be answered by a human.
+
+**Cloud Auto Mode for Pi** provides a deterministic, zero-trust security configuration engineered for autonomous execution:
+
+- **Fail-Closed by Design:** Any tool call or bash command requesting an unlisted domain, credential path, or unapproved write fails closed immediately with an informative audit reason, preventing unmonitored agent deviations.
+- **Pre-Configured Cloud Preset (`sandbox.cloud.json`):** Shipped directly in this package, `sandbox.cloud.json` sets `strictAllowlist: true`, locks `outsideProject.read: "deny"`, restricts subagent network egress, and denies read/write access to cloud credentials (`~/.aws`, `~/.azure`, `~/.config/gcloud`).
+- **Subagent Posture Control (`subagent.network`):** Prevents subagents from opening external network sockets or exfiltrating private codebase data (`"deny"` or `"research-only"`).
+
+### Activating Cloud Auto Mode in Your Repository or CI:
+
+```bash
+# 1. Copy the shipped Cloud Auto Mode template to your repository:
+cp node_modules/auto-permission-system/sandbox.cloud.json .pi/sandbox.json
+
+# 2. Run Pi headlessly with complete automated protection:
+pi -p "Review pull request changes and execute test suite"
+```
+
+---
+
+## Security for Pi & How to Secure Pi
+
+AI coding agents are granted powerful system tools—arbitrary bash command execution, filesystem reads and edits, URL fetching, and MCP integration. Without guardrails, prompt injections or untrusted code can compromise developer environments.
+
+### The 3-Layer Defense in Depth:
+
+1. **OS-Level Kernel Sandbox (Layer 1):** Uses `bubblewrap` (Linux) or `sandbox-exec` (macOS) to confine bash processes at the OS kernel boundary. Bash subprocesses cannot write outside designated directories or read forbidden directories even if child processes are spawned.
+2. **In-Process Tool Guard (Layer 2):** Guards the agent's internal tools (`read`, `write`, `edit`, `grep`, `find`, `ls`, `fetch_content`, `web_search`). Denied files are filtered out of directory listings and search outputs before the LLM can observe them.
+3. **Secret Detection & Output Redactor (Auto Secure):** Analyzes tool outputs and bash output streams in real time. Credentials, private keys, API tokens, and environment secrets are masked before reaching the model context window.
+
+### Quick Checklist: How to Secure Pi in 3 Steps
+- **Step 1:** Install `auto-permission-system` (`pi install npm:auto-permission-system`).
+- **Step 2:** Ensure `/permission-mode` is set to **Advanced Secure** (Auto Secure).
+- **Step 3:** For CI/CD and cloud runs, adopt `sandbox.cloud.json` to enforce strict domain and path boundaries.
+
+---
+
+## Permission System for Pi (Pi Permission System)
+
+The **Pi permission system** in `auto-permission-system` offers granular allow/ask/deny control with session memory and repository-level persistence:
+
+| Policy Tier | Behavior | Example Subjects |
+|---|---|---|
+| **Absolute Deny** | Always blocked. Never prompts. | `~/.ssh`, `~/.aws`, `auth.json`, `*.pem`, `*.key` |
+| **Ask (Interactive)** | Prompts user with 10s countdown timer (`Allow once`, `Always for project`, `Always global`). | `.env`, unlisted domains (`api.example.com`), bash `printenv` |
+| **Allowed Roots** | Allowed transparently without prompting. | Project root `.`, `/tmp`, trusted package registries |
+| **Cloud Auto Mode** | In headless runs (`-p`), unapproved operations fail closed without blocking execution. | Headless subagents, Docker containers, GitHub Actions |
+
+### Permission Modes Available:
+- **`advanced-secure` (Auto Secure / Recommended):** Full rule engine + real-time AST/regex secret detection + MCP tool risk scoring.
+- **`default`:** Rule-based sandbox without inspecting payload content.
+- **`yolo`:** Emergency escape hatch that temporarily bypasses all security layers.
+
+---
+
+## PyPI & Python Ecosystem Security
+
+`auto-permission-system` includes dedicated, out-of-the-box safeguards for Python developers and PyPI packaging workflows:
+
+- **PyPI Token Protection:** Scans all tool outputs and bash streams in real time for exposed PyPI API tokens (matching `pypi-AgEI...` token signatures) and redacts them before the language model can read or exfiltrate them.
+- **Sensitive Credentials Guard (`.pypirc`):** `~/.pypirc` and package registry credentials are gated under strict deny-read rules, preventing AI coding agents from accessing PyPI deployment credentials.
+- **Governed `pip install` Network Egress:** Outgoing requests to `pypi.org` and `*.pypi.org` are pre-configured in the baseline domain allowlist (`sandbox.default.json`), allowing standard package resolution while blocking unvetted third-party download mirrors or suspicious domains.
+- **Shield Against Malicious Package Setup Scripts:** When installing unfamiliar dependencies or running untrusted Python code, Layer 1 OS-level sandboxing (`bubblewrap` / `sandbox-exec`) confines `python setup.py` and bash commands within the project root, stopping arbitrary filesystem tampering outside allowed directories.
+
 ## Commands
 
 | Command | Description |
@@ -200,6 +280,12 @@ Every block/allow/always decision is appended to `~/.pi/agent/audit.log` as a JS
 
 ## FAQ
 
+### How does Cloud Auto Mode secure unattended or headless runs?
+In headless mode (`pi -p` or subagent executions), interactive ask prompts cannot be presented to a human. Auto Permission System operates in a fail-closed posture: any tool call or bash command targeting an unlisted domain, credential file, or outside-project path is automatically blocked, and the refusal reason is provided to the agent and recorded in the audit log.
+
+### How does this package secure PyPI tokens and Python packages?
+Auto Permission System includes native pattern recognizers for PyPI API tokens (`pypi-*`), hard-blocks model access to `~/.pypirc`, and gates `pip install` network requests to trusted hosts (`pypi.org`, `*.pypi.org`), preventing AI agents from leaking deployment secrets or pulling unvetted dependencies.
+
 ### How do I allow the agent to reach a new domain?
 Add it to `network.allowedDomains` in a policy file (global `~/.pi/agent/extensions/sandbox.json` or project `<cwd>/.pi/sandbox.json`), or just run the tool (or a bash `curl`) once and pick an **always** option in the ask prompt — that writes the domain to the project file for you.
 

package/extensions/guard.ts

@@ -11,7 +11,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { isToolCallEventType, getAgentDir } from "@earendil-works/pi-coding-agent";
 import { filterGrepOutput, policyFileError, forgetProjectTrust, isProjectFileDeclined, recordProjectDeclined, recordProjectTrust } from "../src/core/index";
-import { classifyFilename, evaluateMcpCall, type JsonSchemaLike, type McpToolAnnotations } from "../src/detect/index";
+import { classifyFilename, evaluateMcpCall, type JsonSchemaLike, type McpPolicy, type McpToolAnnotations } from "../src/detect/index";
 import { collectExposure } from "../src/l2-guard/exposure";
 import { askExposure, askMain, withheldNotice } from "../src/ui/ask-flow";
 import { loadPolicy, projectPolicyPath, projectTrusted, setPiDeclinedTrust, untrustedProjectChanges, bullets, TRUST_STORE } from "../src/l2-guard/policy";
@@ -77,6 +77,7 @@ async function detectMcpAsk(
 	toolName: string,
 	input: Record<string, unknown>,
 	ctx: UICtx,
+	mcpPolicy?: McpPolicy,
 ): Promise<{ block: true; reason: string } | null> {
 	const info = pi.getAllTools().find((t) => t.name === toolName);
 	const result = evaluateMcpCall({
@@ -87,6 +88,7 @@ async function detectMcpAsk(
 			annotations: /* SAFETY: pi's ToolAnnotations mirrors the MCP hints McpToolAnnotations names. */ info?.annotations as McpToolAnnotations | undefined,
 		},
 		call: { name: toolName, arguments: input },
+		policy: mcpPolicy,
 	});
 	if (result.decision !== "ask") return null;
 	return askDetection(ctx, "tool", toolName, result.summary);
@@ -101,10 +103,6 @@ export default function (pi: ExtensionAPI) {
 		active = policyEnabled && !runtimeYolo;
 	};
 
-	// `--yolo` and the `/permission-mode` toggle both arrive on pi's process-wide
-	// bus; `sandbox.ts` is the only extension that registers the CLI flags and
-	// broadcasts the state (ADR-020). The entrypoints share no memory, so this is
-	// the only channel that reaches Layer 2.
 	onYolo(pi.events, (enabled) => {
 		runtimeYolo = enabled;
 		applyActive();
@@ -112,8 +110,6 @@ export default function (pi: ExtensionAPI) {
 	});
 
 	pi.on("session_start", (_event, ctx) => {
-		// A policy file that does not parse is skipped and the defaults apply.
-		// Say so loudly: otherwise one trailing comma silently disables the whole file.
 		for (const p of [`${getAgentDir()}/extensions/sandbox.json`, `${ctx.cwd}/.pi/sandbox.json`]) {
 			const err = policyFileError(p);
 			if (!err) continue;
@@ -151,14 +147,9 @@ export default function (pi: ExtensionAPI) {
 		if (!active) return;
 		const policy = loadPolicy(ctx.cwd);
 
-		// Capture the program id (binary for bash, MCP server for mcp__ tools) so the
-		// Advanced Secure output gate can label the prompt and honor a session grant
-		// keyed by that program. Falls back to the tool name when nothing else fits.
 		const programId = programIdForToolCall(event.toolName, event.input);
 		if (event.toolCallId && programId) programIdByCallId.set(event.toolCallId, programId);
 
-		// --- Path-based gates (with ask-tier prompt) ---
-		// One gate for every read: the read policy first, then the project boundary.
 		const gateRead = async (rawPath: string, tool: string) => {
 			const abs = canonicalize(rawPath, ctx.cwd);
 			let reason = isDeniedRead(rawPath, ctx.cwd, policy);
@@ -190,10 +181,6 @@ export default function (pi: ExtensionAPI) {
 				}
 			}
 		}
-		// Read-only search tools. grep returns file contents and runs ripgrep in
-		// process, so neither the bash sandbox nor the read gate saw it before.
-		// Gate the search root here; tool_result below drops output lines from
-		// denied files beneath the root.
 		const searchRoot = isToolCallEventType("grep", event) || isToolCallEventType("find", event) || isToolCallEventType("ls", event)
 			? (event.input.path ?? ".")
 			: null;
@@ -218,7 +205,6 @@ export default function (pi: ExtensionAPI) {
 			}
 		}
 
-		// --- URL/domain gates (best-effort by tool name; tools are extension-defined) ---
 		const input = event.input as Record<string, unknown> | undefined;
 		const collectUrls = (): string[] => {
 			if (!input) return [];
@@ -234,8 +220,6 @@ export default function (pi: ExtensionAPI) {
 			const saReason = subagentNetworkBlock(ctx as { hasUI?: boolean; sessionManager?: unknown }, policy);
 			if (saReason) return { block: true, reason: saReason };
 			for (const u of collectUrls()) {
-				// deniedDomains is the hard-deny tier: the bash proxy refuses it before
-				// any ask, so Layer 2 must not offer to override it either.
 				const denied = deniedUrlReason(u, policy);
 				if (denied) {
 					audit({ layer: 2, tool: event.toolName, subject: u, reason: denied, decision: "no", note: "denied-domain", cwd: ctx.cwd });
@@ -245,7 +229,6 @@ export default function (pi: ExtensionAPI) {
 				if (!reason) continue;
 				const host = hostnameOf(u) ?? u;
 				const result = await askOrBlock(/* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx, { layer: 2, tool: event.toolName, subject: u, reason, overrideKind: "allowDomains", overrideValue: host }, null, (kind, value) => {
-					// Layer 1's proxy does not re-read the file: apply the remembered host live (ADR-023).
 					if (kind === "allowDomains") emitDomainGrant(pi.events, value);
 				});
 				if (result) return result;
@@ -255,22 +238,14 @@ export default function (pi: ExtensionAPI) {
 		if (event.toolName === "web_search") {
 			const saReason = subagentNetworkBlock(ctx as { hasUI?: boolean; sessionManager?: unknown }, policy);
 			if (saReason) return { block: true, reason: saReason };
-			// web_search itself goes to the search provider (out of scope for v1
-			// allowlist). The follow-on fetch_content for individual results is
-			// the catchable surface.
 		}
 
-		// Advanced Secure (ADR-018): classify MCP tool calls before they run.
 		if (policy.mode === "advanced-secure" && event.toolName.startsWith("mcp__")) {
-			const det = await detectMcpAsk(pi, event.toolName, (event.input ?? {}) as Record<string, unknown>, /* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx);
+			const det = await detectMcpAsk(pi, event.toolName, (event.input ?? {}) as Record<string, unknown>, /* SAFETY: pi's ctx carries cwd/UI at runtime. */ ctx as unknown as UICtx, policy.mcp);
 			if (det) return det;
 		}
 	});
 
-	// grep output filter. A root that passed the gate can still contain denied
-	// files (`.env`, `*.pem`, `~/.ssh` under a search of `~`). Approving the
-	// root does not approve the denied files beneath it. Runs before the
-	// result reaches the model.
 	pi.on("tool_result", (event, ctx) => {
 		if (!active || event.toolName !== "grep" || event.isError) return;
 		const input = event.input as { path?: string } | undefined;
@@ -282,7 +257,6 @@ export default function (pi: ExtensionAPI) {
 		} catch {
 			return;
 		}
-		// A single-file search prints only the basename; its root gate already decided.
 		if (!rootIsDir) return;
 		let removedLines = 0;
 		const removedFiles = new Set<string>();
@@ -299,10 +273,6 @@ export default function (pi: ExtensionAPI) {
 		return { content };
 	});
 
-	// Advanced Secure (ADR-018): before any tool output reaches the model, ask
-	// the user when it looks like it carries a secret. Block withholds it and
-	// tells the model plainly, so the model does not read it as a failure or an
-	// empty result; Allow send passes the real values through.
 	pi.on("tool_result", async (event, ctx) => {
 		if (!active || event.isError) return;
 		const policy = loadPolicy(ctx.cwd);
@@ -415,6 +385,19 @@ export default function (pi: ExtensionAPI) {
 				`  allowWrite:   ${(overrides.allowWrite ?? []).join(", ") || "(none)"}`,
 				`  allowDomains: ${(overrides.allowDomains ?? []).join(", ") || "(none)"}`,
 			];
+			if (policy.mode === "advanced-secure") {
+				const mcp = policy.mcp ?? {};
+				lines.push(
+					"",
+					"Advanced Secure (MCP gate, ADR-032):",
+					`  allowTools:       ${(mcp.allowTools ?? []).join(", ") || "(none)"}`,
+					`  allowPrefixes:    ${(mcp.allowPrefixes ?? []).join(", ") || "(none)"}`,
+					`  askTools:         ${(mcp.askTools ?? []).join(", ") || "(none)"}`,
+					`  trustAnnotations: ${mcp.trustAnnotations === true}`,
+					`  allowSimpleUpdates: ${mcp.allowSimpleUpdates !== false}`,
+					`  askThreshold:     ${mcp.askThreshold ?? 30}`,
+				);
+			}
 			try {
 				const tail = readFileSync(AUDIT_PATH, "utf-8").trim().split("\n").slice(-10);
 				if (tail.length && tail[0]) {
@@ -422,7 +405,6 @@ export default function (pi: ExtensionAPI) {
 					for (const l of tail) lines.push(`  ${l}`);
 				}
 			} catch {
-				/* no audit log yet */
 			}
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/extensions/permission-mode.ts

@@ -84,9 +84,17 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 		MODES.map((m) => m.label),
 		{ timeout: 120_000 },
 	);
-	if (picked === undefined) return; // Esc / timeout → keep the current mode
+	if (picked === undefined) return;
 	const next = MODES.find((m) => m.label === picked)?.value ?? current;
 	if (next === current) {
+		if (next === "yolo" && !yolo.active) {
+			yolo.active = true;
+			emitYolo(pi.events, true);
+			audit({ layer: 0, event: "permission-mode", mode: "yolo", cwd: ctx.cwd, note: "runtime-sync" });
+			renderSandboxChip(ctx);
+			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this session.", "warning");
+			return;
+		}
 		ctx.ui.notify(`Permission mode is already ${modeLabel(next)}.`, "info");
 		return;
 	}
@@ -98,8 +106,6 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 		return;
 	}
 	yolo.active = next === "yolo";
-	// Layers off/on in place, without a restart. `--yolo` keeps its own flag
-	// value; this only flips the runtime state.
 	emitYolo(pi.events, yolo.active);
 	audit({ layer: 0, event: "permission-mode", mode: next, cwd: ctx.cwd });
 	renderSandboxChip(ctx);
@@ -109,8 +115,6 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 
 export default function (pi: ExtensionAPI) {
 	const yolo = { active: false };
-	// `sandbox.ts` owns the CLI flags and broadcasts the startup state, so the
-	// menu shows the truth even when `--yolo` was passed for this run only.
 	onYolo(pi.events, (enabled) => {
 		yolo.active = enabled;
 	});

package/extensions/sandbox.ts

@@ -30,21 +30,17 @@
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { createBashTool } from "@earendil-works/pi-coding-agent";
-import { createSandboxedBashOps } from "../src/l1-sandbox/bash-ops";
+import { clearFilesystemSessionGrants, createSandboxedBashOps, filesystemSessionGrantSummary } from "../src/l1-sandbox/bash-ops";
 import { applyNetworkGrant, initSandbox, persistLayer1Override, reloadSandbox, resetSandbox, writeNetworkOverride } from "../src/l1-sandbox/manager";
 import { clearNetworkSessionGrants, type NetworkAskCtx, type NetworkAskDeps } from "../src/l1-sandbox/network-ask";
-import { loadConfig, setPiDeclinedTrust } from "../src/l1-sandbox/config";
+import { loadConfig, projectTrusted, setPiDeclinedTrust } from "../src/l1-sandbox/config";
 import { audit } from "../src/shared/audit";
 import { onDomainGrant } from "../src/shared/network-grants";
 import { emitYolo, onYolo, registerYoloFlags, yoloFromFlags, YOLO_STATUS } from "../src/shared/yolo";
 
 export default function (pi: ExtensionAPI) {
-	// pi scopes flags per extension (ADR-020); registering here makes
-	// `yoloFromFlags(pi)` below read the real CLI value.
 	registerYoloFlags(pi);
 
-	// A domain remembered from the Layer 2 guard prompt is written to
-	// sandbox.json by the guard; apply it to the running proxy here (ADR-023).
 	onDomainGrant(pi.events, applyNetworkGrant);
 
 	const localCwd = process.cwd();
@@ -68,10 +64,7 @@ export default function (pi: ExtensionAPI) {
 		persist: (host, scope) => writeNetworkOverride(cwd, host, scope),
 		applyLive: applyNetworkGrant,
 		audit,
-		// Lazy getters so each proxy ask reads the live trust state and the most
-		// recent bash command. Without these, the values captured at initSandbox()
-		// would be stale.
-		get projectTrusted() { return latestCtx?.isProjectTrusted?.(); },
+		get projectTrusted() { return projectTrusted(cwd); },
 		get command() { return latestBashCommand; },
 	});
 
@@ -119,17 +112,12 @@ export default function (pi: ExtensionAPI) {
 		}
 	};
 
-	// Runtime YOLO from `/permission-mode` (ADR-020): stop or restart the
-	// sandbox in place, without a session restart.
 	onYolo(pi.events, (enabled) => {
-		// The startup broadcast originates here; ignore our own echo.
 		if (enabled === runtimeYolo) return;
 		runtimeYolo = enabled;
 		const ctx = latestCtx;
 		if (!ctx) return;
 		if (!enabled) {
-			// Gate bash until the sandbox is back up, so turning YOLO off cannot
-			// leave a window where a command runs unfenced (ADR-020 follow-up).
 			sandboxStarting = startSandbox(ctx).finally(() => {
 				sandboxStarting = null;
 			});
@@ -162,7 +150,6 @@ export default function (pi: ExtensionAPI) {
 		return { operations: createSandboxedBashOps({ ctx: activeCtx, onAlways: persistAndReload, onAlwaysRead: persistAndReloadRead }) };
 	});
 
-	// Capture the latest bash command so the network ask body can show it.
 	pi.on("tool_call", (event, _ctx) => {
 		if (event.toolName === "bash") {
 			const input = event.input as { command?: string };
@@ -174,10 +161,9 @@ export default function (pi: ExtensionAPI) {
 		latestCtx = ctx;
 		activeCtx = /* SAFETY: pi's runtime ctx carries cwd/hasUI/ui; the local type only names the fields we use. */ ctx as unknown as typeof activeCtx;
 		clearNetworkSessionGrants();
+		clearFilesystemSessionGrants();
 		setPiDeclinedTrust((ctx as { isProjectTrusted?: () => boolean }).isProjectTrusted?.() === false);
 		runtimeYolo = yoloFromFlags(pi) || loadConfig(ctx.cwd).mode === "yolo";
-		// Broadcast before any await: guard.ts consumes this on the same bus to
-		// learn YOLO is on (ADR-020).
 		emitYolo(pi.events, runtimeYolo);
 
 		if (runtimeYolo) {
@@ -232,6 +218,7 @@ export default function (pi: ExtensionAPI) {
 				`  Allow Write: ${config.filesystem?.allowWrite?.join(", ") || "(none)"}`,
 				`  Deny Write: ${config.filesystem?.denyWrite?.join(", ") || "(none)"}`,
 				`  Outside project reads: ${config.filesystem?.outsideProject?.read ?? "allow"}`,
+				`  Session grants: ${filesystemSessionGrantSummary() || "(none)"}`,
 			];
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "auto-permission-system",
-  "version": "3.6.0",
-  "description": "Security sandbox, permission system and tool guard for the Pi coding agent (pi): enforce filesystem allow/deny lists and network domain allowlists on read, write, edit, bash, grep, find, ls, fetch_content and web_search, with interactive ask prompts, secret detection and an audit log.",
+  "version": "3.8.0",
+  "description": "Cloud auto mode for Pi & security for Pi. A zero-trust permission system for Pi to secure Pi coding agent workflows with tool guard, sandbox, and PyPI security.",
   "type": "module",
   "author": "Navin Kumar",
   "keywords": [
@@ -9,18 +9,40 @@
     "pi",
     "pi-coding-agent",
     "pi-extension",
+    "pi-permission",
+    "pi-permissions",
+    "pi-permission-system",
+    "pi-security",
+    "cloud-auto-mode-for-pi",
+    "security-for-pi",
+    "permission-system-for-pi",
+    "secure-pi",
+    "cloud-auto-mode",
+    "pi-cloud-auto-mode",
+    "auto-permission-system",
+    "auto-secure",
+    "secure",
+    "secure-it",
+    "pypi",
+    "pypi-security",
+    "pypi-secure-it",
+    "pypi-permission-system",
+    "cloud",
+    "cloud-security",
+    "auto-mode",
+    "permission",
+    "permissions",
+    "permission-system",
     "security",
     "sandbox",
-    "permission-system",
     "tool-guard",
-    "allowlist",
-    "access-control",
     "secret-detection",
     "audit-log",
     "bubblewrap",
     "sandbox-exec",
     "ai-agent",
-    "ai-coding-agent"
+    "ai-coding-agent",
+    "zero-trust"
   ],
   "license": "MIT",
   "repository": {
@@ -67,6 +89,7 @@
     "skills/",
     "sandbox.example.json",
     "sandbox.default.json",
+    "sandbox.cloud.json",
     "banner.png",
     "README.md",
     "CHANGELOG.md",

package/sandbox.cloud.json

@@ -0,0 +1,62 @@
+{
+  "enabled": true,
+  "mode": "advanced-secure",
+  "network": {
+    "strictAllowlist": true,
+    "allowedDomains": [
+      "registry.npmjs.org",
+      "registry.yarnpkg.com",
+      "npmjs.org",
+      "*.npmjs.org",
+      "pypi.org",
+      "*.pypi.org",
+      "files.pythonhosted.org",
+      "github.com",
+      "*.github.com",
+      "api.github.com",
+      "raw.githubusercontent.com",
+      "objects.githubusercontent.com",
+      "codeload.github.com",
+      "crates.io",
+      "proxy.golang.org",
+      "repo.maven.apache.org",
+      "rubygems.org"
+    ],
+    "deniedDomains": []
+  },
+  "filesystem": {
+    "outsideProject": {
+      "read": "deny"
+    },
+    "allowWrite": [
+      ".",
+      "/tmp"
+    ],
+    "denyRead": [
+      "~/.ssh",
+      "~/.aws",
+      "~/.azure",
+      "~/.config/gcloud",
+      "~/.gnupg",
+      "~/.pi/agent/auth.json"
+    ],
+    "denyWrite": [
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      ".pypirc",
+      ".npmrc"
+    ]
+  },
+  "subagent": {
+    "network": "deny"
+  },
+  "commands": {
+    "ask": [
+      "printenv",
+      "env",
+      "/proc/*/environ"
+    ]
+  }
+}

package/sandbox.example.json

@@ -119,6 +119,16 @@
     "network": "allow"
   },
 
+  "_comment_mcp": "Advanced Secure only. Tune the MCP tool-call gate (ADR-032). allowTools = exact tool names that never ask; allowPrefixes = name prefixes that never ask (e.g. 'mcp__ticktick__get_'); askTools = tool names that always ask; trustAnnotations = a server's readOnlyHint allows the call without asking; allowSimpleUpdates = narrow field updates skip the ask (default true); askThreshold = risk score at which calls ask (default 30, lower = stricter). Detected destructive calls always ask, unless an allowTools/allowPrefixes entry covers them (an explicit override). Unclassified names with a real description start at 25; a tool with no description counts as opaque and still asks. An untrusted project file may only tighten: it may add askTools, lower askThreshold, and turn allowSimpleUpdates/trustAnnotations off; allow lists need /security trust.",
+  "mcp": {
+    "allowTools": [],
+    "allowPrefixes": [],
+    "askTools": [],
+    "trustAnnotations": false,
+    "allowSimpleUpdates": true,
+    "askThreshold": 30
+  },
+
   "_comment_overrides": "Additive overrides written by ask-tier prompts. You can also edit by hand. These are merged on top of the main policy.",
   "overrides": {
     "allowRead": [],