pi-git-commit 1.0.1 → 1.0.3

package/README.md

@@ -4,9 +4,9 @@ Keeps mutative git operations out of the agent's bash and provides a safe, revie
 
 ## What you get
 
-- **Bash git guard.** Mutative git commands are blocked in the agent's bash tool — `add`, `commit`, `push`, `pull`, `merge`, `rebase`, `reset`, `clean`, `rm`, `restore`, `switch`, `cherry-pick`, `revert`, `mv`, `init`, `clone`, plus destructive forms of `branch`, `tag`, `checkout`, `stash`, `submodule`, `worktree`, `config`, `remote`, `apply`, `notes`, `update-ref`, `gc` and more. Read-only commands (`status`, `diff`, `log`, `fetch`, `branch`, `tag`, `stash list`, ...) stay allowed.
-- **`git_commit` tool.** The agent stages everything and commits with a `FIX` / `IMPROVE` / `NEW` type prefix. Enabled automatically on session start.
-- **`/commit` command.** Waits for queued messages to finish, stages all changes, shows the staged diff, and asks the agent to review it and commit via `git_commit` — never via bash.
+- **Bash git guard.** Mutative git commands are blocked in the agent's bash tool — `add`, `stage`, `commit`, `push`, `pull`, `merge`, `rebase`, `reset`, `clean`, `rm`, `restore`, `switch`, `cherry-pick`, `revert`, `mv`, `init`, `clone`, index/object plumbing (`read-tree`, `checkout-index`, `merge-file`, `prune-packed`), plus mutative forms of `branch` (including creation, `-u`, `-f`, `-c`/`-C`/`--copy`, `-D`/`-M`, `--force`, `-t`/`--track`), `tag` (including creation), `checkout` (including whole-tree restores like `checkout -- .`), `stash`, `submodule`, `worktree`, `config`, `remote`, `apply`, `notes`, `update-ref`, `gc` and more. Read-only commands (`status`, `diff`, `log`, `fetch`, `branch`, `tag`, `stash list`, ...) stay allowed.
+- **`git_commit` tool.** The agent stages everything and commits with a `FIX` / `IMPROVE` / `NEW` type prefix. Inactive by default: `/commit` activates it for the commit flow and it is disabled again after use, so the agent cannot commit on its own at other times.
+- **`/commit` command.** Waits for queued messages to finish, stages all changes, shows the staged diff, activates the `git_commit` tool, and asks the agent to review it and commit via `git_commit` — never via bash.
 - **`/toggle-allow-git` command.** Temporarily allows mutative git commands in bash for the current session. The guard re-arms on the next session.
 
 ## Quick start
@@ -53,12 +53,14 @@ pi install /path/to/pi-git-commit
 | `type` | `FIX` (bug fix), `IMPROVE` (improvement), or `NEW` (new feature). |
 | `message` | Commit message in imperative mood. Multi-line allowed for detailed changes. |
 
-The tool runs `git add .` followed by `git commit -m "<TYPE>: <message>"` and reports staging or commit failures as tool errors. The agent is instructed to only use it after you run `/commit`.
+The tool runs `git add .` followed by `git commit -m "<TYPE>: <message>"` and reports staging or commit failures as tool errors. The tool is inactive by default and only becomes available when you run `/commit`; it is deactivated again after a single use (success or failure), so the agent cannot commit at arbitrary points in the conversation. If a commit fails, run `/commit` again to retry.
 
 ## The bash guard
 
 The guard intercepts `tool_call` events for the bash tool and blocks commands that match mutative git forms. The block list is a conservative superset: anything that can change repository state is blocked, while a curated set of read-only forms is explicitly allowed (for example `git fetch`, `git stash list`, `git remote -v`, `git config --get`, `git apply --check`, `git checkout -- <file>`, `git submodule status`, `git worktree list`).
 
+The guard parses the command into segments (pipelines, `&&`, `||`, `;`, `&`, command and process substitution, newlines) and inspects only segments that actually invoke `git` — including path-qualified invocations (`/usr/bin/git`), wrapper prefixes with their flags (`sudo -u root`, `nice -n 5`, `timeout 5`), environment-assignment prefixes (`VAR=1 git ...`, `env VAR=1 git ...`), control constructs (`{ ...; }`, `!`, `if`, `while`), and `sh -c`/`su -c` wrappers — while skipping git's global options such as `-C`, `-c`, `--git-dir`, and `--work-tree`. Commands nested more than four wrapper levels deep are blocked outright (fail closed), even when no git command is visible. Git commands mentioned inside strings or heredocs are not blocked. Plain `git fetch` stays allowed, but `git fetch --prune`/`-p`/`--prune-tags` is blocked. Indirect invocation (aliases, variables, `find -exec`) cannot be detected reliably and is best-effort; likewise a directory passed to `git checkout --` without a trailing slash is indistinguishable from a file, so `git checkout -- src` (restoring the whole `src` tree) is not caught.
+
 A blocked command returns:
 
 ```text

package/index.ts

@@ -6,58 +6,221 @@ const COMMIT_TYPES = ["FIX", "IMPROVE", "NEW"] as const;
 export default function (pi: ExtensionAPI) {
   let gitBlocked = true;
 
-  const containsBlockedGitCommand = (command: string): boolean => {
-    const alwaysBlocked = /\bgit\s+(add|commit|push|pull|merge|rebase|reset|clean|rm|restore|switch|cherry-pick|revert|mv|init|clone)\b/;
-    if (alwaysBlocked.test(command)) return true;
-
-    const readOnlyForms = [
-      /\bgit\s+fetch\b/,
-      /\bgit\s+stash\s+(list|show)\b/,
-      /\bgit\s+remote\s*$/,
-      /\bgit\s+config\s+(--list|-l|--get|--get-all|--get-regexp|--show-origin|--show-scope)\b/,
-      /\bgit\s+remote\s+(-v|show|get-url)\b/,
-      /\bgit\s+apply\s+--(check|stat)\b/,
-      /\bgit\s+notes\s+(list|show)\b/,
-      /\bgit\s+lfs\s+(ls-files|status)\b/,
-      /\bgit\s+sparse-checkout\s+list\b/,
-    ];
-    if (readOnlyForms.some((re) => re.test(command))) return false;
-
-    if (/\bgit\s+(config|remote|apply|am|notes|replace|update-ref|symbolic-ref|update-index|gc|maintenance|sparse-checkout|lfs)\b/.test(command)) return true;
-
-    if (/\bgit\s+branch\b/.test(command)) {
-      if (/\bgit\s+branch\s+(-d|-D|-m|-M|--delete|--move)\b/.test(command)) return true;
-      return false;
-    }
+  const PREFIXES = new Set(["sudo", "env", "command", "nohup", "nice", "time", "exec", "builtin", "doas", "eval", "timeout", "runuser", "pkexec"]);
+  const CONTROL_KEYWORDS = new Set(["if", "then", "else", "elif", "while", "until", "do", "case", "select"]);
+
+  const GIT_META_OPTS = new Set(["--help", "-h", "--version"]);
+  const GIT_OPTS_BARE = new Set(["--bare", "-p", "--paginate", "--no-pager", "--no-replace-objects", "--literal-pathspecs", "--glob-pathspecs", "--noglob-pathspecs", "--icase-pathspecs", "--no-optional-locks", "--html-path", "--man-path", "--info-path"]);
+  const GIT_OPTS_WITH_ARG = new Set(["-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--super-prefix", "--shallow-file", "--template", "--upload-pack"]);
+
+  const blockAll = () => true;
+  const hasAny = (args: string[], values: string[]) => values.some((value) => args.includes(value));
+  const allowOnly = (values: string[]) => (args: string[]) => !hasAny(args, values);
+  const hasShortFlag = (args: string[], flags: string) => args.some((arg) => arg.startsWith("-") && !arg.startsWith("--") && arg.length > 1 && [...arg.slice(1)].some((flag) => flags.includes(flag)));
+
+  const GIT_RULES: Record<string, (args: string[]) => boolean> = {
+    add: blockAll,
+    stage: blockAll,
+    commit: blockAll,
+    push: blockAll,
+    pull: blockAll,
+    merge: blockAll,
+    rebase: blockAll,
+    reset: blockAll,
+    clean: blockAll,
+    rm: blockAll,
+    restore: blockAll,
+    switch: blockAll,
+    "cherry-pick": blockAll,
+    revert: blockAll,
+    mv: blockAll,
+    init: blockAll,
+    clone: blockAll,
+    am: blockAll,
+    replace: blockAll,
+    "update-ref": blockAll,
+    "symbolic-ref": blockAll,
+    "update-index": blockAll,
+    "read-tree": blockAll,
+    "checkout-index": blockAll,
+    "merge-file": blockAll,
+    "prune-packed": blockAll,
+    gc: blockAll,
+    maintenance: blockAll,
+    "filter-branch": blockAll,
+    "filter-repo": blockAll,
+    "fast-import": blockAll,
+    prune: blockAll,
+    repack: blockAll,
+    "pack-refs": blockAll,
+    mergetool: blockAll,
+    bisect: blockAll,
+    subtree: blockAll,
+    fetch: (args) => hasAny(args, ["--prune", "-p", "-P", "--prune-tags"]),
+    config: (args) => {
+      if (hasAny(args, ["--add", "--unset", "--unset-all", "--replace-all", "--remove-section", "--rename-section", "--edit", "-e"])) return true;
+      return !hasAny(args, ["--list", "-l", "--get", "--get-all", "--get-regexp", "--show-origin", "--show-scope"]);
+    },
+    remote: (args) => !(args.length === 0 || args.includes("-v") || hasAny(args, ["show", "get-url"])),
+    apply: allowOnly(["--check", "--stat"]),
+    notes: allowOnly(["list", "show"]),
+    lfs: allowOnly(["ls-files", "status"]),
+    "sparse-checkout": allowOnly(["list"]),
+    stash: allowOnly(["list", "show"]),
+    submodule: allowOnly(["status", "init", "summary"]),
+    worktree: allowOnly(["list"]),
+    reflog: (args) => !(args.length === 0 || hasAny(args, ["show"])),
+    branch: (args) => {
+      if (args.includes("--")) return true;
+      if (hasAny(args, ["--delete", "--move", "--copy", "--force", "--track", "--prune", "--unset-upstream", "--edit-description"]) || args.some((arg) => arg.startsWith("--set-upstream-to"))) return true;
+      if (hasShortFlag(args, "dmufcCDMt")) return true;
+      if (!args.some((arg) => !arg.startsWith("-"))) return false;
+      return !(hasAny(args, ["--list", "--merged", "--no-merged", "--contains", "--no-contains", "--points-at", "--show-current"]) || hasShortFlag(args, "lar"));
+    },
+    tag: (args) => {
+      if (args.length === 0) return false;
+      const first = args[0];
+      if (first === "-l" || first === "--list" || first.startsWith("-n")) return false;
+      return !["--contains", "--merged", "--no-merged", "--points-at", "--sort", "--format", "--column", "--no-column", "--color", "--ignore-case", "--verbose", "-v"].some((flag) => first.startsWith(flag));
+    },
+    checkout: (args) => {
+      if (args[0] !== "--") return true;
+      const path = args[1];
+      if (path === undefined) return true;
+      if (args.length > 2) return true;
+      return path === "." || path === ".." || path.endsWith("/");
+    },
+  };
 
-    if (/\bgit\s+tag\b/.test(command)) {
-      if (/\bgit\s+tag\s+(-d|-a|-s|-f|--delete|--annotate|--sign|--force)\b/.test(command)) return true;
-      return false;
+  const maskHeredocBodies = (command: string): string => {
+    let masked = "";
+    let cursor = 0;
+    const heredocRe = /<<-?\s*['"]?([A-Za-z_][A-Za-z0-9_]*)['"]?/g;
+    let match: RegExpExecArray | null;
+    while ((match = heredocRe.exec(command)) !== null) {
+      const current = match;
+      if (current.index < cursor) continue;
+      const tail = command.slice(current.index + current[0].length);
+      const lines = tail.split("\n");
+      const end = lines.findIndex((line) => line.trim() === current[1]);
+      if (end === -1) continue;
+      const body = lines.slice(0, end + 1);
+      masked += command.slice(cursor, current.index) + current[0] + body.map((line) => " ".repeat(line.length)).join("\n");
+      cursor = current.index + current[0].length + body.join("\n").length;
     }
+    return masked + command.slice(cursor);
+  };
 
-    if (/\bgit\s+checkout\s+--\s/.test(command)) return false;
-    if (/\bgit\s+checkout\b/.test(command)) return true;
+  const stripSurrounding = (segment: string): string => segment.replace(/^[\s'"(){}!]+/, "").replace(/[\s'"()!}]+$/, "");
+  const stripQuotes = (value: string): string => value.trim().replace(/^['"]/, "").replace(/['"]$/, "");
 
-    if (/\bgit\s+submodule\s+(status|init|summary)\b/.test(command)) return false;
-    if (/\bgit\s+submodule\b/.test(command)) return true;
+  const stripEnvAssignments = (segment: string): string => {
+    let rest = segment;
+    for (;;) {
+      const match = rest.match(/^[A-Za-z_][A-Za-z0-9_]*=(?:(?:[^'"\s])|(?:'[^']*')|(?:"[^"]*"))*(?:\s|$)/);
+      if (!match) break;
+      rest = rest.slice(match[0].length).trimStart();
+      if (!rest) break;
+    }
+    return rest;
+  };
 
-    if (/\bgit\s+worktree\s+list\b/.test(command)) return false;
-    if (/\bgit\s+worktree\b/.test(command)) return true;
+  const stripPrefixes = (segment: string): string => {
+    let rest = segment;
+    for (;;) {
+      rest = stripEnvAssignments(rest);
+      if (!rest) break;
+      const match = rest.match(/^([A-Za-z_][A-Za-z0-9_]*)\b(?:\s|$)/);
+      if (!match) break;
+      const word = match[1].toLowerCase();
+      if (!PREFIXES.has(word) && !CONTROL_KEYWORDS.has(word)) break;
+      rest = rest.slice(match[0].length).trimStart();
+      if (!rest) break;
+      rest = rest.replace(/^\d+(?:\.\d+)?[a-z]*\s+/, "");
+      while (rest.startsWith("-")) {
+        const flag = rest.match(/^(\S+)(?:\s|$)/);
+        if (!flag) break;
+        rest = rest.slice(flag[0].length).trimStart();
+        if (!rest) break;
+        const next = rest.match(/^([^\s-][^\s]*)(?:\s|$)/);
+        if (!next) break;
+        const nextWord = next[1].toLowerCase();
+        if (nextWord === "git" || nextWord === "git.exe" || PREFIXES.has(nextWord) || CONTROL_KEYWORDS.has(nextWord)) break;
+        rest = rest.slice(next[0].length).trimStart();
+      }
+    }
+    return rest;
+  };
 
-    if (/\bgit\s+stash\b/.test(command)) return true;
+  const classifyGitCommand = (rest: string): boolean => {
+    const tokens = rest.toLowerCase().split(/\s+/).filter(Boolean);
+    let subcommand: string | undefined;
+    let subcommandIndex = -1;
+    for (let i = 0; i < tokens.length; i++) {
+      const token = tokens[i];
+      if (GIT_META_OPTS.has(token)) return false;
+      if (GIT_OPTS_BARE.has(token)) continue;
+      if (GIT_OPTS_WITH_ARG.has(token)) {
+        i++;
+        continue;
+      }
+      if (token.startsWith("-")) continue;
+      subcommand = token;
+      subcommandIndex = i;
+      break;
+    }
+    if (subcommand === undefined) return false;
+    const rule = GIT_RULES[subcommand];
+    if (!rule) return false;
+    return rule(tokens.slice(subcommandIndex + 1));
+  };
 
-    return false;
+  const containsBlockedGitCommand = (command: string, depth = 0): boolean => {
+    if (depth > 4) return true;
+    const masked = maskHeredocBodies(command);
+    return masked.split(/\n|;|\|\||&&|\||&|`|\$\(|<\(|>\(/).some((segment) => {
+      let rest = stripSurrounding(segment.trim());
+      if (!rest) return false;
+      rest = stripPrefixes(rest);
+      rest = stripSurrounding(rest);
+      if (!rest) return false;
+      const shell = rest.match(/^(sh|bash|zsh|dash|ksh|ash|fish)\s+-[a-zA-Z]*c[a-zA-Z]*\s+(.+)$/i);
+      if (shell) return containsBlockedGitCommand(stripQuotes(shell[2]), depth + 1);
+      const su = rest.match(/^su\b(.*?)\s+-c\s+(.+)$/i);
+      if (su) return containsBlockedGitCommand(stripQuotes(su[2]), depth + 1);
+      const pwsh = rest.match(/^(pwsh|powershell)\s+(-Command|-c)\s+(.+)$/i);
+      if (pwsh) return containsBlockedGitCommand(stripQuotes(pwsh[3]), depth + 1);
+      const git = rest.match(/^(?:.*\/)?git(\.exe)?\b(.*)$/i);
+      if (!git) return false;
+      return classifyGitCommand(git[2]);
+    });
   };
 
   pi.on("tool_call", async (event) => {
     if (event.toolName !== "bash") return undefined;
-    const command = (event.input.command as string).trim();
-    if (gitBlocked && containsBlockedGitCommand(command)) {
+    const command = event.input.command;
+    if (typeof command !== "string") return undefined;
+    const trimmed = command.trim();
+    if (gitBlocked && containsBlockedGitCommand(trimmed)) {
       return { block: true, reason: "Mutative git commands are blocked. Use /toggle-allow-git to allow for this session." };
     }
     return undefined;
   });
 
+  const activateGitCommit = () => {
+    const activeTools = pi.getActiveTools();
+    if (!activeTools.includes("git_commit")) {
+      pi.setActiveTools([...activeTools, "git_commit"]);
+    }
+  };
+
+  const deactivateGitCommit = () => {
+    const activeTools = pi.getActiveTools();
+    if (activeTools.includes("git_commit")) {
+      pi.setActiveTools(activeTools.filter((tool) => tool !== "git_commit"));
+    }
+  };
+
   pi.registerTool({
     name: "git_commit",
     label: "Git Commit",
@@ -70,33 +233,38 @@ export default function (pi: ExtensionAPI) {
     parameters: Type.Object({
       type: Type.Union(COMMIT_TYPES.map((t) => Type.Literal(t))),
       message: Type.String({
+        minLength: 1,
         description: "Commit message (imperative mood). Multi-line allowed for detailed changes.",
       }),
     }),
     async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
+      try {
+        const { type, message } = params;
+        const trimmedMessage = message.trim();
+        if (!trimmedMessage) {
+          return { content: [{ type: "text", text: "Commit message must not be empty." }], details: {}, isError: true };
+        }
+        const fullMessage = `${type}: ${trimmedMessage}`;
+        const addResult = await pi.exec("git", ["add", "."], { signal });
+        if (addResult.code !== 0) {
+          return { content: [{ type: "text", text: `Staging failed: ${addResult.stderr}` }], details: {}, isError: true };
+        }
 
-      const { type, message } = params;
-      const fullMessage = `${type}: ${message}`;
-      const addResult = await pi.exec("git", ["add", "."], { signal });
-      if (addResult.code !== 0) {
-        return { content: [{ type: "text", text: `Staging failed: ${addResult.stderr}` }], details: {}, isError: true };
-      }
+        const result = await pi.exec("git", ["commit", "-m", fullMessage], { signal });
+        if (result.code !== 0) {
+          return { content: [{ type: "text", text: `Commit failed: ${result.stderr}` }], details: {}, isError: true };
+        }
 
-      const result = await pi.exec("git", ["commit", "-m", fullMessage], { signal });
-      if (result.code !== 0) {
-        return { content: [{ type: "text", text: `Commit failed: ${result.stderr}` }], details: {}, isError: true };
+        return { content: [{ type: "text", text: `✓ Committed: ${fullMessage}` }], details: {} };
+      } finally {
+        deactivateGitCommit();
       }
-
-      return { content: [{ type: "text", text: `✓ Committed: ${fullMessage}` }], details: {} };
     },
   });
 
   pi.on("session_start", () => {
     gitBlocked = true;
-    const activeTools = pi.getActiveTools();
-    if (!activeTools.includes("git_commit")) {
-      pi.setActiveTools([...activeTools, "git_commit"]);
-    }
+    deactivateGitCommit();
   });
 
   pi.registerCommand("commit", {
@@ -133,6 +301,7 @@ export default function (pi: ExtensionAPI) {
         const diff = diffResult.stdout || "(no changes staged)";
 
         const prompt = `DO NOT use bash for git. Use ONLY the \`git_commit\` tool.\n\nReview staged changes:\n\`\`\`diff\n${diff}\`\`\`\n\nUse \`git_commit\` tool with:\n- type: FIX (bug fix), IMPROVE (improvement), or NEW (new feature)\n- message: brief description (imperative mood). Multi-line allowed for detailed changes.`;
+        activateGitCommit();
         pi.sendUserMessage(prompt, { deliverAs: "followUp" });
       } finally {
         ctx.ui.setWorkingMessage();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-git-commit",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "type": "module",
   "description": "Pi extension: block mutative git commands in bash and provide a git_commit tool plus /commit and /toggle-allow-git commands",
   "main": "index.ts",
@@ -21,7 +21,6 @@
   "license": "MIT",
   "files": [
     "index.ts",
-    "src",
     "README.md",
     "LICENSE"
   ],