pi-git-commit 1.0.2 → 1.0.4

package/README.md

@@ -4,9 +4,9 @@ Keeps mutative git operations out of the agent's bash and provides a safe, revie
 
 ## What you get
 
-- **Bash git guard.** Mutative git commands are blocked in the agent's bash tool — `add`, `commit`, `push`, `pull`, `merge`, `rebase`, `reset`, `clean`, `rm`, `restore`, `switch`, `cherry-pick`, `revert`, `mv`, `init`, `clone`, plus mutative forms of `branch`, `tag` (including creation), `checkout` (including whole-tree restores like `checkout -- .`), `stash`, `submodule`, `worktree`, `config`, `remote`, `apply`, `notes`, `update-ref`, `gc` and more. Read-only commands (`status`, `diff`, `log`, `fetch`, `branch`, `tag`, `stash list`, ...) stay allowed.
-- **`git_commit` tool.** The agent stages everything and commits with a `FIX` / `IMPROVE` / `NEW` type prefix. Enabled automatically on session start.
-- **`/commit` command.** Waits for queued messages to finish, stages all changes, shows the staged diff, and asks the agent to review it and commit via `git_commit` — never via bash.
+- **Bash git guard.** Mutative git commands are blocked in the agent's bash tool — `add`, `stage`, `commit`, `push`, `pull`, `merge`, `rebase`, `reset`, `clean`, `rm`, `restore`, `switch`, `cherry-pick`, `revert`, `mv`, `init`, `clone`, index/object plumbing (`read-tree`, `checkout-index`, `merge-file`, `prune-packed`), plus mutative forms of `branch` (including creation, `-u`, `-f`, `-c`/`-C`/`--copy`, `-D`/`-M`, `--force`, `-t`/`--track`), `tag` (including creation), `checkout` (including whole-tree restores like `checkout -- .`), `stash`, `submodule`, `worktree`, `config`, `remote`, `apply`, `notes`, `update-ref`, `gc` and more. Read-only commands (`status`, `diff`, `log`, `fetch`, `branch`, `tag`, `stash list`, ...) stay allowed.
+- **`git_commit` tool.** The agent stages everything and commits with a `FIX` / `IMPROVE` / `NEW` type prefix. Inactive by default: `/commit` activates it for the commit flow and it is disabled again after use, so the agent cannot commit on its own at other times.
+- **`/commit` command.** Waits for queued messages to finish, stages all changes, shows the staged diff, activates the `git_commit` tool, and asks the agent to review it and commit via `git_commit` — never via bash.
 - **`/toggle-allow-git` command.** Temporarily allows mutative git commands in bash for the current session. The guard re-arms on the next session.
 
 ## Quick start
@@ -53,13 +53,13 @@ pi install /path/to/pi-git-commit
 | `type` | `FIX` (bug fix), `IMPROVE` (improvement), or `NEW` (new feature). |
 | `message` | Commit message in imperative mood. Multi-line allowed for detailed changes. |
 
-The tool runs `git add .` followed by `git commit -m "<TYPE>: <message>"` and reports staging or commit failures as tool errors. The agent is instructed to only use it after you run `/commit`.
+The tool runs `git add .` followed by `git commit -m "<TYPE>: <message>"` and reports staging or commit failures as tool errors. The tool is inactive by default and only becomes available when you run `/commit`; it is deactivated again after a single use (success or failure), so the agent cannot commit at arbitrary points in the conversation. If a commit fails, run `/commit` again to retry.
 
 ## The bash guard
 
 The guard intercepts `tool_call` events for the bash tool and blocks commands that match mutative git forms. The block list is a conservative superset: anything that can change repository state is blocked, while a curated set of read-only forms is explicitly allowed (for example `git fetch`, `git stash list`, `git remote -v`, `git config --get`, `git apply --check`, `git checkout -- <file>`, `git submodule status`, `git worktree list`).
 
-The guard parses the command into segments (pipelines, `&&`, `||`, `;`, `&`, command and process substitution, newlines) and inspects only segments that actually invoke `git` — including path-qualified invocations (`/usr/bin/git`), wrapper prefixes with their flags (`sudo -u root`, `nice -n 5`, `timeout 5`), environment-assignment prefixes (`VAR=1 git ...`, `env VAR=1 git ...`), control constructs (`{ ...; }`, `!`, `if`, `while`), and `sh -c`/`su -c` wrappers — while skipping git's global options such as `-C`, `-c`, `--git-dir`, and `--work-tree`. Git commands mentioned inside strings or heredocs are not blocked. Plain `git fetch` stays allowed, but `git fetch --prune`/`-p`/`--prune-tags` is blocked. Indirect invocation (aliases, variables, `find -exec`) cannot be detected reliably and is best-effort; likewise a directory passed to `git checkout --` without a trailing slash is indistinguishable from a file, so `git checkout -- src` (restoring the whole `src` tree) is not caught.
+The guard parses the command into segments (pipelines, `&&`, `||`, `;`, `&`, command and process substitution, newlines) and inspects only segments that actually invoke `git` — including path-qualified invocations (`/usr/bin/git`), wrapper prefixes with their flags (`sudo -u root`, `nice -n 5`, `timeout 5`), environment-assignment prefixes (`VAR=1 git ...`, `env VAR=1 git ...`), control constructs (`{ ...; }`, `!`, `if`, `while`), and `sh -c`/`su -c` wrappers — while skipping git's global options such as `-C`, `-c`, `--git-dir`, and `--work-tree`. Commands nested more than four wrapper levels deep are blocked outright (fail closed), even when no git command is visible. Git commands mentioned inside strings or heredocs are not blocked. Plain `git fetch` stays allowed, but `git fetch --prune`/`-p`/`--prune-tags` is blocked. Indirect invocation (aliases, variables, `find -exec`) cannot be detected reliably and is best-effort; likewise a directory passed to `git checkout --` without a trailing slash is indistinguishable from a file, so `git checkout -- src` (restoring the whole `src` tree) is not caught.
 
 A blocked command returns:
 

package/index.ts

@@ -16,9 +16,11 @@ export default function (pi: ExtensionAPI) {
   const blockAll = () => true;
   const hasAny = (args: string[], values: string[]) => values.some((value) => args.includes(value));
   const allowOnly = (values: string[]) => (args: string[]) => !hasAny(args, values);
+  const hasShortFlag = (args: string[], flags: string) => args.some((arg) => arg.startsWith("-") && !arg.startsWith("--") && arg.length > 1 && [...arg.slice(1)].some((flag) => flags.includes(flag)));
 
   const GIT_RULES: Record<string, (args: string[]) => boolean> = {
     add: blockAll,
+    stage: blockAll,
     commit: blockAll,
     push: blockAll,
     pull: blockAll,
@@ -39,6 +41,10 @@ export default function (pi: ExtensionAPI) {
     "update-ref": blockAll,
     "symbolic-ref": blockAll,
     "update-index": blockAll,
+    "read-tree": blockAll,
+    "checkout-index": blockAll,
+    "merge-file": blockAll,
+    "prune-packed": blockAll,
     gc: blockAll,
     maintenance: blockAll,
     "filter-branch": blockAll,
@@ -64,7 +70,13 @@ export default function (pi: ExtensionAPI) {
     submodule: allowOnly(["status", "init", "summary"]),
     worktree: allowOnly(["list"]),
     reflog: (args) => !(args.length === 0 || hasAny(args, ["show"])),
-    branch: (args) => args.some((arg) => ["-d", "-m", "--delete", "--move", "--prune", "--unset-upstream", "--edit-description"].includes(arg) || arg.startsWith("--set-upstream-to")),
+    branch: (args) => {
+      if (args.includes("--")) return true;
+      if (hasAny(args, ["--delete", "--move", "--copy", "--force", "--track", "--prune", "--unset-upstream", "--edit-description"]) || args.some((arg) => arg.startsWith("--set-upstream-to"))) return true;
+      if (hasShortFlag(args, "dmufcCDMt")) return true;
+      if (!args.some((arg) => !arg.startsWith("-"))) return false;
+      return !(hasAny(args, ["--list", "--merged", "--no-merged", "--contains", "--no-contains", "--points-at", "--show-current"]) || hasShortFlag(args, "lar"));
+    },
     tag: (args) => {
       if (args.length === 0) return false;
       const first = args[0];
@@ -115,7 +127,7 @@ export default function (pi: ExtensionAPI) {
 
   const stripPrefixes = (segment: string): string => {
     let rest = segment;
-    for (let i = 0; i < 5; i++) {
+    for (;;) {
       rest = stripEnvAssignments(rest);
       if (!rest) break;
       const match = rest.match(/^([A-Za-z_][A-Za-z0-9_]*)\b(?:\s|$)/);
@@ -164,7 +176,7 @@ export default function (pi: ExtensionAPI) {
   };
 
   const containsBlockedGitCommand = (command: string, depth = 0): boolean => {
-    if (depth > 4) return false;
+    if (depth > 4) return true;
     const masked = maskHeredocBodies(command);
     return masked.split(/\n|;|\|\||&&|\||&|`|\$\(|<\(|>\(/).some((segment) => {
       let rest = stripSurrounding(segment.trim());
@@ -186,13 +198,29 @@ export default function (pi: ExtensionAPI) {
 
   pi.on("tool_call", async (event) => {
     if (event.toolName !== "bash") return undefined;
-    const command = (event.input.command as string).trim();
-    if (gitBlocked && containsBlockedGitCommand(command)) {
+    const command = event.input.command;
+    if (typeof command !== "string") return undefined;
+    const trimmed = command.trim();
+    if (gitBlocked && containsBlockedGitCommand(trimmed)) {
       return { block: true, reason: "Mutative git commands are blocked. Use /toggle-allow-git to allow for this session." };
     }
     return undefined;
   });
 
+  const activateGitCommit = () => {
+    const activeTools = pi.getActiveTools();
+    if (!activeTools.includes("git_commit")) {
+      pi.setActiveTools([...activeTools, "git_commit"]);
+    }
+  };
+
+  const deactivateGitCommit = () => {
+    const activeTools = pi.getActiveTools();
+    if (activeTools.includes("git_commit")) {
+      pi.setActiveTools(activeTools.filter((tool) => tool !== "git_commit"));
+    }
+  };
+
   pi.registerTool({
     name: "git_commit",
     label: "Git Commit",
@@ -210,33 +238,37 @@ export default function (pi: ExtensionAPI) {
       }),
     }),
     async execute(_toolCallId, params, signal, _onUpdate, _ctx) {
+      try {
+        const { type, message } = params;
+        const trimmedMessage = message.trim();
+        if (!trimmedMessage) {
+          return { content: [{ type: "text", text: "Commit message must not be empty." }], details: {}, isError: true };
+        }
+        const fullMessage = `${type}: ${trimmedMessage}`;
+        const addResult = await pi.exec("git", ["add", "."], { signal });
+        if (addResult.code !== 0) {
+          return { content: [{ type: "text", text: `Staging failed: ${addResult.stderr}` }], details: {}, isError: true };
+        }
 
-      const { type, message } = params;
-      const trimmedMessage = message.trim();
-      if (!trimmedMessage) {
-        return { content: [{ type: "text", text: "Commit message must not be empty." }], details: {}, isError: true };
-      }
-      const fullMessage = `${type}: ${trimmedMessage}`;
-      const addResult = await pi.exec("git", ["add", "."], { signal });
-      if (addResult.code !== 0) {
-        return { content: [{ type: "text", text: `Staging failed: ${addResult.stderr}` }], details: {}, isError: true };
-      }
+        const result = await pi.exec("git", ["commit", "-m", fullMessage], { signal });
+        if (result.code !== 0) {
+          return { content: [{ type: "text", text: `Commit failed: ${result.stderr}` }], details: {}, isError: true };
+        }
 
-      const result = await pi.exec("git", ["commit", "-m", fullMessage], { signal });
-      if (result.code !== 0) {
-        return { content: [{ type: "text", text: `Commit failed: ${result.stderr}` }], details: {}, isError: true };
+        pi.sendMessage(
+          { customType: "git-commit-deactivated", content: "The git_commit tool is now deactivated. It cannot be used again until the user runs /commit to re-enable it.", display: false },
+          { deliverAs: "steer" },
+        );
+        return { content: [{ type: "text", text: `✓ Committed: ${fullMessage}` }], details: {} };
+      } finally {
+        deactivateGitCommit();
       }
-
-      return { content: [{ type: "text", text: `✓ Committed: ${fullMessage}` }], details: {} };
     },
   });
 
   pi.on("session_start", () => {
     gitBlocked = true;
-    const activeTools = pi.getActiveTools();
-    if (!activeTools.includes("git_commit")) {
-      pi.setActiveTools([...activeTools, "git_commit"]);
-    }
+    deactivateGitCommit();
   });
 
   pi.registerCommand("commit", {
@@ -273,6 +305,7 @@ export default function (pi: ExtensionAPI) {
         const diff = diffResult.stdout || "(no changes staged)";
 
         const prompt = `DO NOT use bash for git. Use ONLY the \`git_commit\` tool.\n\nReview staged changes:\n\`\`\`diff\n${diff}\`\`\`\n\nUse \`git_commit\` tool with:\n- type: FIX (bug fix), IMPROVE (improvement), or NEW (new feature)\n- message: brief description (imperative mood). Multi-line allowed for detailed changes.`;
+        activateGitCommit();
         pi.sendUserMessage(prompt, { deliverAs: "followUp" });
       } finally {
         ctx.ui.setWorkingMessage();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-git-commit",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "description": "Pi extension: block mutative git commands in bash and provide a git_commit tool plus /commit and /toggle-allow-git commands",
   "main": "index.ts",