pi-minimal-permission-system 1.3.0 → 1.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +31 -0
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -8,6 +8,10 @@ unrestricted, built-in tool calls (`read`, `edit`, `write`, and `bash`) are
|
|
|
8
8
|
checked against a simple policy that you control. MCP tools and other
|
|
9
9
|
extensions are intentionally out of scope.
|
|
10
10
|
|
|
11
|
+
Pi's `codemode` tool (0.99.1+) does **not** bypass the policy: any `read`,
|
|
12
|
+
`edit`, `write`, or `bash` call a codemode script makes is still checked by
|
|
13
|
+
this extension, just like a call from the model.
|
|
14
|
+
|
|
11
15
|
## Philosophy
|
|
12
16
|
|
|
13
17
|
Pi is designed to be minimal. This extension follows the same approach:
|
|
@@ -150,6 +154,33 @@ allowed without loading policy, checking rules, prompting, or honoring global
|
|
|
150
154
|
}
|
|
151
155
|
```
|
|
152
156
|
|
|
157
|
+
### Allow `rm -r`/`rm -f` in temp paths, ask elsewhere
|
|
158
|
+
|
|
159
|
+
Bash rules are evaluated against the whole command string and the **last**
|
|
160
|
+
matching rule wins, so put the permissive temp-path rule before the catch-all
|
|
161
|
+
`ask` rules:
|
|
162
|
+
|
|
163
|
+
```jsonc
|
|
164
|
+
{
|
|
165
|
+
"bash": {
|
|
166
|
+
".*": "allow",
|
|
167
|
+
// Ask for any rm with -r/-R/-f style flags.
|
|
168
|
+
"rm\\s+-[rRf]+": "ask",
|
|
169
|
+
// Allow it on a single temp target: /tmp/<name>, or a shell variable whose
|
|
170
|
+
// name contains tmp/temp, e.g. "$tmp" or "${tempdir}".
|
|
171
|
+
"rm\\s+-[rRf]+\\s+(\"?/tmp/[\\w.-][\\w./-]*\"?|\"?\\$\\{?\\w*(tmp|TMP|temp|TEMP)\\w*\\}?\"?)": "allow",
|
|
172
|
+
// Ask again if such an rm has a target that is not a single temp path.
|
|
173
|
+
"rm\\s+-[rRf]+\\s+(?!(\"?/tmp/[\\w.-][\\w./-]*\"?|\"?\\$\\{?\\w*(tmp|TMP|temp|TEMP)\\w*\\}?\"?)\\s*([;&|)'\\n]|$))": "ask",
|
|
174
|
+
// Ask ".." targets, even under /tmp.
|
|
175
|
+
"rm\\s+-[rRf]+\\s+.*\\.\\.": "ask",
|
|
176
|
+
},
|
|
177
|
+
}
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
`rm -rf /tmp/build`, `rm -f /tmp/x.log`, and `rm -rf "$tmp"` run without
|
|
181
|
+
prompting. `rm -rf ./build`, `rm -rf /tmp/a /tmp/b`, and `rm -rf /tmp/../etc`
|
|
182
|
+
ask for confirmation.
|
|
183
|
+
|
|
153
184
|
### Per-project override
|
|
154
185
|
|
|
155
186
|
Global `~/.pi/agent/permissions.jsonc`:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pi-minimal-permission-system",
|
|
3
|
-
"version": "1.3.
|
|
3
|
+
"version": "1.3.2",
|
|
4
4
|
"description": "Minimal permission enforcement extension for the Pi coding agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./index.ts",
|
|
@@ -40,14 +40,14 @@
|
|
|
40
40
|
]
|
|
41
41
|
},
|
|
42
42
|
"peerDependencies": {
|
|
43
|
-
"@earendil-works/pi-coding-agent": ">=0.86.0
|
|
43
|
+
"@earendil-works/pi-coding-agent": ">=0.86.0 <2.0.0"
|
|
44
44
|
},
|
|
45
45
|
"dependencies": {
|
|
46
46
|
"jsonc-parser": "^3.3.1",
|
|
47
47
|
"picomatch": "^4.0.2"
|
|
48
48
|
},
|
|
49
49
|
"devDependencies": {
|
|
50
|
-
"@earendil-works/pi-coding-agent": ">=0.86.0
|
|
50
|
+
"@earendil-works/pi-coding-agent": ">=0.86.0 <2.0.0",
|
|
51
51
|
"@types/node": "^22.10.5",
|
|
52
52
|
"@types/picomatch": "^4.0.3",
|
|
53
53
|
"tsx": "^4.19.2",
|