auto-permission-system 3.9.0 → 3.12.0

package/CHANGELOG.md

@@ -3,15 +3,6 @@
 All notable changes to this project will be documented in this file.
 Entries below [1.0.0] are generated automatically by [semantic-release](https://semantic-release.gitbook.io/) from [Conventional Commits](https://www.conventionalcommits.org/) — do not edit by hand.
 
-# [3.9.0](https://github.com/Navin009/auto-permission-system/compare/v3.8.0...v3.9.0) (2026-10-13)
-
-### Features
-
-* **demo:** crisp widescreen HD terminal recording (`demo.mp4`, `demo.gif`) demonstrating Cloud Auto Mode and Advanced Secure Mode
-* **branding:** official security shield logo and banner in documentation and package
-* **docs:** comprehensive FAQ, Cloud Auto Mode architecture, interactive prompt guides, and zero-trust documentation
-* **metadata:** package keywords, clean npm manifest, and remove legacy PyPI references
-
 # [2.0.0](https://github.com/Navin009/auto-permission-system/compare/v1.2.0...v2.0.0) (2026-10-02)
 
 

package/README.md

@@ -11,11 +11,11 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 [![Pi package](https://img.shields.io/badge/pi--package-gallery-blueviolet)](https://pi.dev/packages)
 [![CI](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml/badge.svg)](https://github.com/Navin009/auto-permission-system/actions/workflows/ci.yml)
-[![Cloud Auto Mode for Pi](https://img.shields.io/badge/Pi-Cloud_Auto_Mode-blue.svg)](#secure-auto-mode--cloud-auto-mode)
+[![Claude Auto Mode for Pi](https://img.shields.io/badge/Pi-Claude_Auto_Mode-blue.svg)](#secure-auto-mode--claude-auto-mode)
 [![Security for Pi](https://img.shields.io/badge/Security-for_Pi-green.svg)](#security-for-pi-how-it-works)
 [![Permission System for Pi](https://img.shields.io/badge/Permission_System-for_Pi-orange.svg)](#permission-system--modes)
 
-**Auto Permission System** is a zero-trust permission architecture and **Secure Auto Mode / Cloud Auto Mode for the [Pi coding agent](https://pi.dev)**. It brings the confidence of **Claude's auto mode** to Pi—enabling autonomous agent workflows while actively scanning files, shell commands, and tool content to **prevent data breaches and credential exfiltration**.
+**Auto Permission System** is a zero-trust permission architecture and **Secure Auto Mode / Claude Auto Mode for the [Pi coding agent](https://pi.dev)**. It brings the confidence of **Claude's auto mode** to Pi—enabling autonomous agent workflows while actively scanning files, shell commands, and tool content to **prevent data breaches and credential exfiltration**.
 
 Whether running interactively with keyboard-driven ask prompts or running headlessly in CI/CD pipelines, this package enforces multi-layer boundaries across filesystem access, network egress, shell commands, and MCP tools.
 
@@ -25,14 +25,12 @@ Whether running interactively with keyboard-driven ask prompts or running headle
 
 ![Auto Permission System Demo](https://raw.githubusercontent.com/Navin009/auto-permission-system/main/assets/demo.gif)
 
-> **High-Definition Video:** Watch or download the full-resolution recording at [assets/demo.mp4](https://raw.githubusercontent.com/Navin009/auto-permission-system/main/assets/demo.mp4) (H.264, 60fps). Run `./demo/run-demo.sh` locally to reproduce this live simulation.
-
 ### Demonstrated Moments in the Recording:
 1. **Interactive `.env` Read Guard:** Intercepts `read(".env")` before the AI can see secrets. Displays a 10s countdown prompt defaulting to `No` (Block).
 2. **Kernel OS Sandbox Confinement:** Prevents bash commands from writing to system paths outside allowed roots (`EROFS: Read-only file system`).
 3. **Governed Network Egress:** Catches unknown outbound connections (`curl`) with an interactive domain ask prompt and a 15s countdown timer.
 4. **Real-Time API Key & Secret Redaction:** Automatically detects exposed API tokens (`sk-proj-...`, `ghp_...`) in command output and replaces them with `***REDACTED***` before reaching the LLM context.
-5. **Autonomous Cloud Auto Mode:** Demonstrates headless, fail-closed CI execution (`pi -p`) with zero deadlocks and zero hangs.
+5. **Autonomous Claude Auto Mode:** Demonstrates headless, fail-closed CI execution (`pi -p`) with zero deadlocks and zero hangs.
 
 ---
 
@@ -43,7 +41,7 @@ Whether running interactively with keyboard-driven ask prompts or running headle
 - [Key Features at a Glance](#key-features-at-a-glance)
 - [Security for Pi: How It Works](#security-for-pi-how-it-works)
 - [Interactive Ask Prompts](#interactive-ask-prompts)
-- [Secure Auto Mode & Cloud Auto Mode](#secure-auto-mode--cloud-auto-mode)
+- [Secure Auto Mode & Claude Auto Mode](#secure-auto-mode--claude-auto-mode)
 - [Real-Time Secret Detection & Content Scanning](#real-time-secret-detection--content-scanning)
 - [Permission System & Modes](#permission-system--modes)
 - [Configuration Reference](#configuration-reference)
@@ -100,7 +98,7 @@ Once installed, the extension automatically loads whenever you launch `pi`. Chec
 | Feature | Description | Protection Level |
 |---|---|---|
 | 🛡️ **3-Layer Defense** | OS Kernel sandbox (`bubblewrap`/`sandbox-exec`) + in-process tool guard + real-time content redactor. | Zero-Trust |
-| ⚡ **Secure Auto Mode** | Autonomous execution inspired by Claude's auto mode; scans files and output to prevent data breaches. | Autonomous / Cloud |
+| ⚡ **Secure Auto Mode** | Autonomous execution inspired by Claude's auto mode; scans files and output to prevent data breaches. | Autonomous / Claude |
 | 🔑 **Interactive Ask Prompts** | Real-time terminal prompts with 10s countdowns (`Once`, `Session`, `Project`, `Global`). | Interactive Human-in-the-Loop |
 | 🔍 **AST & Regex Secret Scanner** | Scans tool stdout/stderr for API keys, private keys, and tokens, redacting them before model context. | Data Breach Prevention |
 | 🌐 **Network Egress Gate** | Intercepts unapproved network connections and prompts for confirmation with wildcards. | Data Leak Prevention |
@@ -162,7 +160,7 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 
   > No
     Yes, just this once
-    Yes, for this session
+    Yes, for this conversation
 
   Default: No (10s)
 ```
@@ -179,7 +177,7 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 
   > No
     Yes, just this once
-    Yes, all in group for this session
+    Yes, all in group for this conversation
     Yes, always…
 
   Default: Yes, just this once (15s)
@@ -191,33 +189,34 @@ When an unlisted domain, `.env` file, or directory write is requested during an
 ⚠  Sensitive information detected: API Secret Key
 
     Tool     bash (node verify_service.js)
-    Finding  sk-(?!ant-)[A-Za-z0-9_-] (score: 90 / CRITICAL)
+    Finding  23: sk-(?!ant-)[A-Za-z0-9_-]
     Question Should the AI be allowed to see it?
 
   > No, keep private  (recommended)
     Yes, allow
 ```
+- `Finding` prints the **complete** detected line and its line number — one `Finding` row per match when several secrets appear, with no truncation.
 - Choosing **No, keep private** replaces the token with `***REDACTED***` in the model's context window, preventing credentials from leaking to LLM providers.
 
 ---
 
-## Secure Auto Mode & Cloud Auto Mode
+## Secure Auto Mode & Claude Auto Mode
 
 In modern AI coding tools like Claude Code, developers love **auto mode** because the agent can execute tasks autonomously without constantly prompting for confirmation on trivial, harmless steps.
 
 However, unconstrained auto mode is a significant data breach risk. If an autonomous agent reads credentials, runs unvetted scripts, or sends code to third-party endpoints, the entire developer environment can be compromised.
 
-**Cloud Auto Mode for Pi** delivers **Claude-style auto mode with zero-trust security**:
+**Claude Auto Mode for Pi** delivers **Claude-style auto mode with zero-trust security**:
 - **Autonomous Execution with Real-Time Guardrails:** The agent operates autonomously within approved boundaries, allowing rapid development while guarding sensitive resources.
 - **Advanced Secure Scanning:** Uses `advanced-secure` mode to scan files, commands, and content to stop data breaches before they can occur.
 - **Fail-Closed in Headless CI/CD:** When running unattended (`pi -p`, GitHub Actions, Docker, remote devboxes), unapproved operations fail closed immediately with a structured reason instead of hanging or deadlocking the pipeline.
 
-### Activating Cloud Auto Mode in CI/CD:
+### Activating Claude Auto Mode in CI/CD:
 
 ```bash
-# 1. Copy the shipped Cloud Auto Mode template to your repository:
+# 1. Copy the shipped Claude Auto Mode template to your repository:
 mkdir -p .pi
-cp node_modules/auto-permission-system/sandbox.cloud.json .pi/sandbox.json
+cp node_modules/auto-permission-system/sandbox.claude.json .pi/sandbox.json
 
 # 2. Run Pi headlessly with complete automated protection:
 pi -p "Review pull request changes, verify dependencies, and execute test suite"
@@ -240,10 +239,10 @@ jobs:
         run: |
           npm install -g @earendil-works/pi-coding-agent
           pi install npm:auto-permission-system
-      - name: Activate Cloud Auto Mode Preset
+      - name: Activate Claude Auto Mode Preset
         run: |
           mkdir -p .pi
-          cp node_modules/auto-permission-system/sandbox.cloud.json .pi/sandbox.json
+          cp node_modules/auto-permission-system/sandbox.claude.json .pi/sandbox.json
       - name: Run Autonomous Review in Auto Mode
         run: |
           pi -p "Verify changes, run npm test, and flag security issues"
@@ -394,11 +393,11 @@ grep '"finding"' ~/.pi/agent/audit.log | tail -n 10
 
 A selection of common questions is below. For the complete, detailed guide, read **[docs/FAQ.md](docs/FAQ.md)**.
 
-### How does Cloud Auto Mode secure unattended runs?
+### How does Claude Auto Mode secure unattended runs?
 In headless mode (`pi -p` or subagent executions), interactive ask prompts cannot be presented to a human. Auto Permission System operates in a fail-closed posture: any tool call or bash command targeting an unlisted domain, credential file, or outside-project path is automatically blocked, and the refusal reason is provided to the agent and recorded in the audit log.
 
-### What is the relationship between Cloud Auto Mode and Claude's auto mode?
-Claude Code popularized autonomous "auto mode", allowing developers to let AI code without stopping for confirmation on harmless steps. Cloud Auto Mode brings this exact convenience to the Pi coding agent, but adds essential zero-trust boundaries: using Advanced Secure Mode to scan files, shell commands, and content to guarantee that autonomous execution never leads to data breaches or leaked API tokens.
+### What is the relationship between Claude Auto Mode and Claude's auto mode?
+Claude Code popularized autonomous "auto mode", allowing developers to let AI code without stopping for confirmation on harmless steps. Claude Auto Mode brings this exact convenience to the Pi coding agent, but adds essential zero-trust boundaries: using Advanced Secure Mode to scan files, shell commands, and content to guarantee that autonomous execution never leads to data breaches or leaked API tokens.
 
 ### How do I allow the agent to reach a new domain?
 Add it to `network.allowedDomains` in `<cwd>/.pi/sandbox.json` or `~/.pi/agent/extensions/sandbox.json`, or run a curl command once and select **Yes, always… → All in group in this project**.

package/extensions/guard.ts

@@ -65,7 +65,7 @@ async function askDetection(
 	if (choice === "session") {
 		detectionGrants.add(key);
 		audit({ layer: 2, tool: kind, subject, reason, decision: "session", note: "advanced-secure", cwd: ctx.cwd });
-		ctx.ui.notify(`security-guard: allowed for this session (not saved) → ${subject}`, "info");
+		ctx.ui.notify(`security-guard: allowed for this conversation (not saved) → ${subject}`, "info");
 		return null;
 	}
 	audit({ layer: 2, tool: kind, subject, reason, decision: "no", note: "advanced-secure", cwd: ctx.cwd });
@@ -91,7 +91,22 @@ async function detectMcpAsk(
 		policy: mcpPolicy,
 	});
 	if (result.decision !== "ask") return null;
-	return askDetection(ctx, "tool", toolName, result.summary);
+
+	// Include detailed call parameters or script preview if present
+	let detailedSummary = result.summary;
+	if (input && Object.keys(input).length > 0) {
+		const rawScript = input.code ?? input.script ?? input.command ?? input.query;
+		if (typeof rawScript === "string" && rawScript.includes("\n")) {
+			detailedSummary += `\n\n${rawScript}`;
+		} else {
+			const formattedArgs = JSON.stringify(input, null, 2);
+			if (formattedArgs.includes("\n")) {
+				detailedSummary += `\n\nArguments:\n${formattedArgs}`;
+			}
+		}
+	}
+
+	return askDetection(ctx, "tool", toolName, detailedSummary);
 }
 
 export default function (pi: ExtensionAPI) {
@@ -288,7 +303,7 @@ export default function (pi: ExtensionAPI) {
 			if (typeof rawPath === "string" && rawPath) return rawPath;
 			if (event.toolName === "bash") {
 				const cmd = (event.input as { command?: string } | undefined)?.command;
-				return cmd ? `bash: ${cmd}` : "bash";
+				return cmd ? `bash (${cmd})` : "bash";
 			}
 			return event.toolName;
 		})();
@@ -301,15 +316,15 @@ export default function (pi: ExtensionAPI) {
 			if (choice === "program-session" && programId) {
 				grantProgramOutputSession(programId);
 				audit({ layer: 2, tool: event.toolName, decision: "session", grant: programId, note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🛡 Advanced Secure: you allowed all ${programId} output for the rest of this session.`, "info");
+				ctx.ui.notify(`🧠 Advanced Secure: you allowed all ${programId} output for the rest of this conversation.`, "info");
 			} else {
 				audit({ layer: 2, tool: event.toolName, decision: "yes", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🛡 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
+				ctx.ui.notify(`🧠 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
 			}
 			return;
 		}
 		audit({ layer: 2, tool: event.toolName, decision: "no", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-		ctx.ui.notify(`🛡 Advanced Secure: blocked ${event.toolName} output — it may contain sensitive information. Nothing was sent to the model.`, "warning");
+		ctx.ui.notify(`🧠 Advanced Secure: blocked ${event.toolName} output — it may contain sensitive information. Nothing was sent to the model.`, "warning");
 		return { content: [{ type: "text", text: withheldNotice(subject) }] };
 	});
 
@@ -349,7 +364,7 @@ export default function (pi: ExtensionAPI) {
 				}
 				recordProjectTrust(file, TRUST_STORE);
 				audit({ layer: 2, event: "project-trusted", file, applied: changes, cwd: ctx.cwd });
-				ctx.ui.notify("Done. The file applies now. Start a new session so the bash sandbox uses it too.", "info");
+				ctx.ui.notify("Done. The file applies now. Start a new conversation so the bash sandbox uses it too.", "info");
 				return;
 			}
 			if (!active) {
@@ -367,7 +382,7 @@ export default function (pi: ExtensionAPI) {
 				`  cwd:               ${ctx.cwd}`,
 				`  hasUI:             ${(ctx as { hasUI?: boolean }).hasUI !== false}`,
 				`  subagent.network:  ${policy.subagent?.network ?? "allow"}`,
-				`  session grants:    ${sessionGrantSummary() || "(none)"}`,
+				`  conversation grants:    ${sessionGrantSummary() || "(none)"}`,
 				`  project file:      ${!existsSync(projectPolicyPath(ctx.cwd)) ? "none" : projectTrusted(ctx.cwd) ? "trusted" : untrustedProjectChanges(ctx.cwd).length ? `not trusted, its weaker settings are ignored (/security trust)` : "only block rules, they apply"}`,
 				`  outside project:   read ${policy.filesystem.outsideProject?.read ?? "allow"}${(policy.filesystem.outsideProject?.allowRead ?? []).length ? `, allowRead ${policy.filesystem.outsideProject?.allowRead?.join(", ")}` : ""}`,
 				"",

package/extensions/permission-mode.ts

@@ -46,7 +46,7 @@ const EXPLANATION = [
 	"  No file contents are inspected.",
 	"",
 	"YOLO",
-	"  Turns every layer off. Saved like the other modes, so new sessions",
+	"  Turns every layer off. Saved like the other modes, so new conversations",
 	"  start with it too until you pick Default or Advanced Secure again.",
 ].join("\n");
 
@@ -72,8 +72,8 @@ function renderSandboxChip(ctx: ExtensionContext): void {
 }
 
 function modeNotice(mode: PermissionMode): { text: string; level: "info" | "warning" } {
-	if (mode === "yolo") return { text: "⚠️  YOLO — all security layers disabled. Saved; new sessions start this way too.", level: "warning" };
-	if (mode === "advanced-secure") return { text: "🛡 Advanced Secure on. File reads, MCP calls, and tool output are checked for secrets.", level: "info" };
+	if (mode === "yolo") return { text: "⚠️  YOLO — all security layers disabled. Saved; new conversations start this way too.", level: "warning" };
+	if (mode === "advanced-secure") return { text: "🧠 Advanced Secure on. File reads, MCP calls, and tool output are checked for secrets.", level: "info" };
 	return { text: "🛡 Default mode. Rule-based policy only.", level: "info" };
 }
 
@@ -92,7 +92,7 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 			emitYolo(pi.events, true);
 			audit({ layer: 0, event: "permission-mode", mode: "yolo", cwd: ctx.cwd, note: "runtime-sync" });
 			renderSandboxChip(ctx);
-			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this session.", "warning");
+			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this conversation.", "warning");
 			return;
 		}
 		ctx.ui.notify(`Permission mode is already ${modeLabel(next)}.`, "info");

package/extensions/sandbox.ts

@@ -218,7 +218,7 @@ export default function (pi: ExtensionAPI) {
 				`  Allow Write: ${config.filesystem?.allowWrite?.join(", ") || "(none)"}`,
 				`  Deny Write: ${config.filesystem?.denyWrite?.join(", ") || "(none)"}`,
 				`  Outside project reads: ${config.filesystem?.outsideProject?.read ?? "allow"}`,
-				`  Session grants: ${filesystemSessionGrantSummary() || "(none)"}`,
+				`  Conversation grants: ${filesystemSessionGrantSummary() || "(none)"}`,
 			];
 			ctx.ui.notify(lines.join("\n"), "info");
 		},

package/package.json

@@ -1,36 +1,34 @@
 {
   "name": "auto-permission-system",
-  "version": "3.9.0",
-  "description": "Secure auto mode & cloud auto mode for Pi. A zero-trust permission system for the Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
+  "version": "3.12.0",
+  "description": "Claude auto mode for Pi & security for Pi. A zero-trust permission system for Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
   "type": "module",
   "author": "Navin Kumar",
   "keywords": [
     "pi-package",
     "pi",
     "pi-coding-agent",
+    "claude-auto-mode-for-pi",
     "pi-extension",
     "pi-permission",
     "pi-permissions",
     "pi-permission-system",
     "pi-security",
-    "cloud-auto-mode-for-pi",
     "security-for-pi",
     "permission-system-for-pi",
     "secure-pi",
-    "cloud-auto-mode",
-    "pi-cloud-auto-mode",
+    "claude-auto-mode",
+    "pi-claude-auto-mode",
     "auto-permission-system",
     "auto-secure",
     "secure",
     "secure-it",
     "auto-mode",
     "safe-auto-mode",
-    "claude-auto-mode",
     "data-breach-prevention",
     "content-scan",
-    "cloud",
-    "cloud-security",
-    "auto-mode",
+    "claude",
+    "claude-security",
     "permission",
     "permissions",
     "permission-system",
@@ -91,7 +89,7 @@
     "assets/",
     "sandbox.example.json",
     "sandbox.default.json",
-    "sandbox.cloud.json",
+    "sandbox.claude.json",
     "banner.png",
     "README.md",
     "CHANGELOG.md",

package/{sandbox.cloud.json → sandbox.claude.json}

@@ -2,6 +2,7 @@
   "enabled": true,
   "mode": "advanced-secure",
   "network": {
+    "allowLocalhost": false,
     "strictAllowlist": true,
     "allowedDomains": [
       "registry.npmjs.org",

package/sandbox.default.json

@@ -2,6 +2,7 @@
   "enabled": true,
   "mode": "advanced-secure",
   "network": {
+    "allowLocalhost": true,
     "allowedDomains": [
       "registry.npmjs.org",
       "registry.yarnpkg.com",
@@ -24,13 +25,22 @@
       "rubygems.org",
       "api.nuget.org",
       "deno.land",
-      "jsr.io"
+      "jsr.io",
+      "api.openai.com",
+      "huggingface.co",
+      "*.huggingface.co",
+      "cdn-lfs.huggingface.co",
+      "*.diffusion.studio",
+      "diffusion.studio"
     ]
   },
   "filesystem": {
     "outsideProject": {
       "read": "allow",
-      "allowRead": []
+      "allowRead": [
+        "~/Downloads",
+        "~/.cache"
+      ]
     },
     "denyRead": [],
     "askRead": [

package/skills/auto-permission-system/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: auto-permission-system
-description: Use this skill when the user asks about auto-permission-system, security for Pi, permission system for Pi, how to secure Pi, Cloud auto mode for Pi, security policy configuration, why a tool call was blocked, how to add an allow-list entry, or how to configure sandbox behavior. Covers the two-layer sandbox (OS-level bash sandbox and in-process tool guard), policy file locations and fields, Cloud auto mode preset (sandbox.cloud.json), ask-tier prompt options, absolute-deny paths, escape hatches (--yolo, --no-sandbox, /permission-mode → YOLO), the audit log, and common tasks like allowing a new domain or write path.
+description: Use this skill when the user asks about auto-permission-system, security for Pi, permission system for Pi, how to secure Pi, Claude auto mode for Pi, security policy configuration, why a tool call was blocked, how to add an allow-list entry, or how to configure sandbox behavior. Covers the two-layer sandbox (OS-level bash sandbox and in-process tool guard), policy file locations and fields, Claude auto mode preset (sandbox.claude.json), ask-tier prompt options, absolute-deny paths, escape hatches (--yolo, --no-sandbox, /permission-mode → YOLO), the audit log, and common tasks like allowing a new domain or write path.
 ---
 
 # Security for Pi (Pi Permission System) — Skill
 
-Use this skill when the user asks about the auto-permission-system extension, security for Pi, permission system for Pi, how to secure Pi, or configuring Cloud auto mode for Pi.
+Use this skill when the user asks about the auto-permission-system extension, security for Pi, permission system for Pi, how to secure Pi, or configuring Claude auto mode for Pi.
 
 ## What this extension does
 
@@ -14,19 +14,19 @@ Wraps the `bash` tool with `sandbox-exec` (macOS) or `bubblewrap` (Linux). Block
 - Filesystem writes outside `allowWrite`
 - Filesystem reads of `denyRead` paths (defaults include `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.pi/agent`)
 - Filesystem reads outside the project when `outsideProject.read` is `"ask"` or `"deny"` — when set, the home dir (and the project's parent) is fenced with `denyRead` and the project plus `allowWrite`/`outsideProject.allowRead` are re-exposed (ADR-014). With `"ask"`, a bash command that *plainly* names an outside path is confirmed with you **before it runs** (ADR-015): allow (`yes — this once`, or a persistent `always` grant) → the real, complete output; deny → the command is not run at all (no silently trimmed output). `install`/`npm` under `~/.pi/agent` are pre-allowed via `outsideProject.allowRead`, so they never prompt. Obfuscated reads still hit the fence and stay masked.
-- Network egress to domains not in `allowedDomains`: a host in neither list asks before the proxy decides (ADR-023) — `yes — this once` covers that bash command's connections to the host, `yes — for this session` lasts until the session ends, and `always` writes `overrides.allowDomains` and applies live. A host in `deniedDomains`, or `network.strictAllowlist: true`, is a hard deny that is never ask-able; headless blocks.
+- Network egress to domains not in `allowedDomains`: a host in neither list asks before the proxy decides (ADR-023) — `yes — this once` covers that bash command's connections to the host, `yes — for this conversation` lasts until the conversation ends, and `always` writes `overrides.allowDomains` and applies live. A host in `deniedDomains`, or `network.strictAllowlist: true`, is a hard deny that is never ask-able; headless blocks.
 
 **Layer 2 — In-process tool guard**
 Hooks `tool_call` for `read`, `grep`, `find`, `ls`, `write`, `edit`, `fetch_content`, `web_search`, `get_search_content`. Applies the same policy file as Layer 1. For `grep`, `find` and `ls` the search root is checked like a `read` path. A `tool_result` hook also removes `grep` output lines from denied files beneath an allowed root (for example a `.env` deep in the tree); approving the root does not approve those files. When a call is blocked, shows an interactive prompt with persistence options.
 
-**Layer 3 — Subagent posture & Cloud Auto Mode**
-When `ctx.hasUI === false` (subagents, `-p`, JSON mode, CI/CD runs), applies the `subagent.network` policy: `allow` (default) | `deny` | `research-only`. In Cloud Auto Mode, unapproved prompts fail closed.
+**Layer 3 — Subagent posture & Claude Auto Mode**
+When `ctx.hasUI === false` (subagents, `-p`, JSON mode, CI/CD runs), applies the `subagent.network` policy: `allow` (default) | `deny` | `research-only`. In Claude Auto Mode, unapproved prompts fail closed.
 
 ## Policy files
 
 Merged in order (later wins):
 1. `sandbox.default.json` — shipped baseline (`outsideProject.read: "ask"`, full `denyRead`/`denyWrite`, `modelDenyRead`)
-2. `sandbox.cloud.json` — shipped Cloud Auto Mode preset for headless, Docker, and CI/CD runs (`strictAllowlist: true`, `outsideProject.read: "deny"`)
+2. `sandbox.claude.json` — shipped Claude Auto Mode preset for headless, Docker, and CI/CD runs (`strictAllowlist: true`, `outsideProject.read: "deny"`)
 3. `~/.pi/agent/extensions/sandbox.json` — global user policy
 4. `<cwd>/.pi/sandbox.json` — project-local overrides (also written by ask-tier prompts)
 
@@ -39,6 +39,7 @@ A higher layer only states what it changes; absent keys keep the layer below. A
   "enabled": true,
   "mode": "default",                     // "default" (rules) | "advanced-secure" (secret detection, ADR-018)
   "network": {
+    "allowLocalhost": true,                // true (default): localhost on all ports allowed; false: strict network isolation
     "allowedDomains": ["github.com", "*.github.com"],  // empty = allow all
     "deniedDomains": [],                   // hard deny, never ask-able
     "strictAllowlist": false               // true = deny unknown hosts instead of asking
@@ -87,7 +88,7 @@ A project `.pi/sandbox.json` applies in full only after the user trusted its exa
 When a normal (non-absolute-deny) call is blocked:
 - **no — block** — hard deny (default, pre-selected)
 - **yes — this once** — allow just this call
-- **yes — for this session** — this file, its parent folder, or this domain until the session ends; not saved
+- **yes — for this conversation** — this file, its parent folder, or this domain until the conversation ends; not saved
 - **always for CURRENT project** — whitelist this file in `<cwd>/.pi/sandbox.json`
 - **always for CURRENT project (folder)** — whitelist the parent directory
 - **always for ALL projects** — whitelist in `~/.pi/agent/extensions/sandbox.json`
@@ -99,7 +100,7 @@ For a Layer 1 bash **write** blocked after the command already ran, `yes — thi
 
 Every prompt waits **15 seconds** by default and shows it live as `Default: … (Ns)` under the body. For file reads/writes no answer means the safe default: **block / deny**, and Esc blocks. For a network ask, an unanswered countdown means **allow once** (Esc still denies) — ADR-024. In the TUI the `Default:` line disappears as soon as you press ↑/↓ and the timer restarts, so the hint never competes with an active choice (ADR-031). The prompt is keyboard-only (ADR-036): ↑/↓ move the highlight, Enter selects, Esc cancels — a mouse click or wheel over the prompt does nothing.
 
-The same options apply to a bash command whose network request reaches a host outside `allowedDomains` (ADR-023), with the countdown default and live footer from ADR-024/ADR-031: `No` / `Yes, just this once` / `Yes, all in group for this session` / `Yes, always…`, and an untouched countdown counts as allow-once. Because the sandbox proxy asks per connection, `Allow (default)` covers that bash command rather than one connection — redirects and parallel connections to the same host do not re-prompt. A host in `deniedDomains`, or `network.strictAllowlist: true`, is blocked outright: the prompt never appears. A remembered host is written to `overrides.allowDomains` and takes effect immediately, so the waiting request completes without a retry. Prompts from both layers are serialized through one queue (`src/ui/ask-flow.ts`), so two unknown hosts cannot replace each other's selector and hang the waiting connection.
+The same options apply to a bash command whose network request reaches a host outside `allowedDomains` (ADR-023), with the countdown default and live footer from ADR-024/ADR-031: `No` / `Yes, just this once` / `Yes, all in group for this conversation` / `Yes, always…`, and an untouched countdown counts as allow-once. Because the sandbox proxy asks per connection, `Allow (default)` covers that bash command rather than one connection — redirects and parallel connections to the same host do not re-prompt. A host in `deniedDomains`, or `network.strictAllowlist: true`, is blocked outright: the prompt never appears. A remembered host is written to `overrides.allowDomains` and takes effect immediately, so the waiting request completes without a retry. Prompts from both layers are serialized through one queue (`src/ui/ask-flow.ts`), so two unknown hosts cannot replace each other's selector and hang the waiting connection.
 
 ## Sensitive reads ask
 
@@ -113,7 +114,7 @@ The same options apply to a bash command whose network request reaches a host ou
 - **`advanced-secure`** (recommended) — adds secret/credential detection, and **only adds asks or blocks** (never loosens):
   - file reads whose name looks like a credential store ask before the read;
   - risky `mcp__<server>__<tool>` calls ask before they run. The gate ignores the `mcp__<server>__` namespace, takes the operation from the head verb of the name (or the first verb of the description), and asks for destructive names, mutating names (`update_*`, `create_*`, `run_*`, `evaluate_*`), and destructive arguments (SQL `DELETE`/`UPDATE` without `WHERE`, `rm -rf`, `*` targets, HTTP `DELETE`, production targets). A documented tool with an unclassified name (`context`, `capture`, `logs`) does not ask; a tool with **no description** counts as opaque and does. Tune it under `mcp` in `sandbox.json` (ADR-032): `allowTools` / `allowPrefixes` skip asks, `askTools` forces them, `trustAnnotations` lets a server's `readOnlyHint` allow the call, `askThreshold` moves the score line (default 30). An untrusted project file may only tighten it (add `askTools`, lower `askThreshold`, turn `allowSimpleUpdates`/`trustAnnotations` off).
-  - before any tool/command/file output reaches the model, a secret-like hit shows the file and each detected line as `lineNo: text`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
+  - before any tool/command/file output reaches the model, a secret-like hit shows the tool and each detected line as `Finding  <lineNo>: <complete line>` — one `Finding` row per match, no truncation — plus `Question Should the AI be allowed to see it?`, with two choices — **No, keep private** or **Yes, allow**. No, keep private withholds the output and tells the model it was withheld because it may contain sensitive information (not a failure, not an empty result).
 
 Switch with `/permission-mode`; all three modes are saved to the global `sandbox.json` and reflected in the footer's sandbox chip (`Sandbox: 🧠 N domains, M paths` for advanced-secure, `Sandbox: 🔒 …` for default). An untrusted project may move the mode **up** (toward stricter), never down: it cannot turn on YOLO or turn off Advanced Secure. The third choice, **YOLO**, disables every layer; the chip reads `⚠️ YOLO — all security layers disabled` until you pick another mode (ADR-020).
 

package/src/core/policy/patterns.ts

@@ -31,6 +31,63 @@ export function isWriteBlockError(output: string): boolean {
 	return WRITE_BLOCK_RE.test(output);
 }
 
+/**
+ * Loopback / localhost connection refusal evidence in a sandboxed command's output.
+ * On Linux, bubblewrap runs with --unshare-net which isolates network namespaces.
+ * Host services listening on 127.0.0.1/localhost (like Diffusion Studio on port 3274,
+ * or local dev servers) are not reachable from inside the container namespace.
+ */
+const LOOPBACK_REFUSAL_RE =
+	/(?:Failed to connect to (?:127\.0\.0\.1|localhost|::1)|(?:connect|connection refused).*?(?:127\.0\.0\.1|localhost|::1)|(?:127\.0\.0\.1|localhost|::1).*?(?:connection refused|ECONNREFUSED)|ECONNREFUSED.*?(?:127\.0\.0\.1|localhost|::1)|Diffusion Studio is not running)/i;
+
+/** True when the command failed due to connecting to a loopback/localhost address in the sandbox. */
+export function isLoopbackConnectionRefused(output: string): boolean {
+	return LOOPBACK_REFUSAL_RE.test(output);
+}
+
+export interface LoopbackEndpointInfo {
+	host: string;
+	port?: string;
+	service?: string;
+}
+
+/**
+ * Extract endpoint metadata (host, port, service name) from a loopback connection failure.
+ */
+export function extractLoopbackEndpoint(output: string, command?: string): LoopbackEndpointInfo | undefined {
+	if (!isLoopbackConnectionRefused(output)) return undefined;
+
+	// Check for Diffusion Studio specific error or command
+	const isDiffusion = /diffusion studio is not running/i.test(output) || (command && /\b(?:dapi|diffusion)\b/i.test(command));
+	if (isDiffusion) {
+		return { host: "127.0.0.1", port: "3274", service: "Diffusion Studio" };
+	}
+
+	// Match "Failed to connect to 127.0.0.1 port 3274" or "localhost port 8080"
+	const curlMatch = output.match(/Failed to connect to (127\.0\.0\.1|localhost|::1) port (\d+)/i);
+	if (curlMatch) {
+		return {
+			host: curlMatch[1],
+			port: curlMatch[2],
+			service: curlMatch[2] === "3274" ? "Diffusion Studio" : undefined,
+		};
+	}
+
+	// Match "connect ECONNREFUSED 127.0.0.1:3274"
+	const nodeMatch = output.match(/(?:ECONNREFUSED|connect to)\s+(127\.0\.0\.1|localhost|::1)(?::| port )(\d+)/i);
+	if (nodeMatch) {
+		return {
+			host: nodeMatch[1],
+			port: nodeMatch[2],
+			service: nodeMatch[2] === "3274" ? "Diffusion Studio" : undefined,
+		};
+	}
+
+	// Generic host match
+	const hostMatch = output.match(/(127\.0\.0\.1|localhost|::1)/i);
+	return { host: hostMatch ? hostMatch[1] : "127.0.0.1" };
+}
+
 /** A shell-name/empty token is not a path; everything else resolves against cwd unless absolute. */
 function toAbsolutePath(rawToken: string, cwd: string, home: string): string | undefined {
 	let token = rawToken.trim().replace(/[.,;]+$/, "");

package/src/core/trust.ts

@@ -67,7 +67,7 @@ export function isProjectFileDeclined(projectPath: string, storePath: string): b
  * and share only the store file (ADR-018/ADR-020).
  */
 export interface ProjectTrust {
-	/** Record pi's own project-trust answer for this session. Declined is never trusted. */
+	/** Record pi's own project-trust answer for this conversation. Declined is never trusted. */
 	setDeclined(value: boolean): void;
 	/** The project file applies in full only when its current hash is recorded and pi did not decline. */
 	isTrusted(cwd: string): boolean;

package/src/detect/sensitive-file-scanner/patterns.ts

@@ -181,6 +181,33 @@ export const COMMON_NON_SECRET_VALUES = new Set([
   "secretvalue",
   "somevalue",
   "myvalue",
+  // Common keyboard keys / UI events (e.g. `Successfully pressed key: Backspace`)
+  "backspace",
+  "tab",
+  "enter",
+  "return",
+  "escape",
+  "esc",
+  "space",
+  "pageup",
+  "pagedown",
+  "end",
+  "home",
+  "arrowleft",
+  "arrowup",
+  "arrowright",
+  "arrowdown",
+  "left",
+  "up",
+  "right",
+  "down",
+  "delete",
+  "insert",
+  "capslock",
+  "numlock",
+  "scrolllock",
+  "printscreen",
+  "pause",
 ]);
 
 /**