pi-opa-net 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.2] - 2026-07-23
+
+### Fixed
+
+- CRITICAL: compound commands (e.g. `export FOO=bar; git stash pop`) now have EACH segment evaluated against the OPA policy. Previously the parser only saw the first command (`export`), which is always allowed, so dangerous commands after `;` were silently evaluated. This was the root cause of pi-opa-net appearing to never block commands in live pi sessions (pi-bash-guard prepends env exports to every command).
+
 ## [0.3.1] - 2026-07-23
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-opa-net",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "OPA-backed bash command guard for the pi ecosystem — structured decision-output.v1 JSON, fail-open default, Claude Code hook protocol compatible. Agent-agnostic engine + CLI.",
   "type": "module",
   "main": "src/index.ts",

package/src/cli/run.ts

@@ -1,8 +1,14 @@
 import { resolve } from 'node:path';
-import { configFromEnv } from '../config/Config.ts';
-import { OpaCliEngine, probeOpaVersion } from '../engine/index.ts';
+import { type EngineConfig, configFromEnv } from '../config/Config.ts';
+import {
+  type DecisionEngine,
+  type EngineDecision,
+  OpaCliEngine,
+  probeOpaVersion,
+} from '../engine/index.ts';
 import { DecisionBuilder, type DecisionOutput } from '../output/DecisionBuilder.ts';
 import { OutputFormatter, validateDecision } from '../output/OutputFormatter.ts';
+import type { CommandParser, ParsedCommand } from '../parser/index.ts';
 import { CommandParserCoordinator } from '../parser/index.ts';
 import { RULES, RuleRegistry } from '../rules/index.ts';
 import { SaltResolver } from '../unlock/SaltResolver.ts';
@@ -63,11 +69,8 @@ export async function runCli(opts: CliOptions): Promise<CliResult> {
   const hasKeys = unlockKeys.length > 0;
 
   const parser = new CommandParserCoordinator();
-  const parsed = parser.parse(raw);
-
   const opaVersion = await probeOpaVersion(config.opaBinary ?? 'opa');
   const engine = new OpaCliEngine(config, opaVersion);
-  const engineDecision = await engine.evaluate(parsed);
 
   const builder = new DecisionBuilder({
     config,
@@ -75,6 +78,98 @@ export async function runCli(opts: CliOptions): Promise<CliResult> {
     digest: engine.rulebookDigest(),
   });
 
+  // Compound commands (joined by ';'): split and evaluate EACH segment.
+  // If ANY segment is denied, the whole command is denied. This catches
+  // env-prefixed commands like `export FOO=bar; git stash pop` where
+  // pi-bash-guard prepends env exports to every bash invocation.
+  const output = await evaluatePossiblyCompound(raw, {
+    parser,
+    engine,
+    config,
+    builder,
+    unlockKeys,
+    hasKeys,
+  });
+
+  // Hard internal gate: the record MUST validate against the schema before emit.
+  validateDecision(output);
+
+  const formatter = new OutputFormatter();
+  const { stdout, exitCode } = formatter.format(output, opts.mode);
+  return { stdout, exitCode };
+}
+
+/**
+ * Evaluate a possibly-compound raw command string. If it contains ';',
+ * evaluate each segment and return deny if ANY segment is denied.
+ * Single commands (no ';') take the existing fast path unchanged.
+ */
+async function evaluatePossiblyCompound(
+  raw: string,
+  deps: {
+    parser: CommandParser;
+    engine: DecisionEngine;
+    config: EngineConfig;
+    builder: DecisionBuilder;
+    unlockKeys: readonly string[];
+    hasKeys: boolean;
+  },
+): Promise<DecisionOutput> {
+  const { parser, engine, config, builder, unlockKeys, hasKeys } = deps;
+
+  // Split on ';' but only treat as compound if more than one non-empty segment.
+  const segments = raw
+    .split(';')
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0);
+
+  if (segments.length <= 1) {
+    // Single command path — unchanged behavior.
+    const parsed = parser.parse(raw);
+    const engineDecision = await engine.evaluate(parsed);
+    return buildDecision(parsed, engineDecision, { config, builder, unlockKeys, hasKeys });
+  }
+
+  // Compound path: evaluate each segment, deny wins.
+  let denyOutput: DecisionOutput | undefined;
+  for (const segment of segments) {
+    const parsed = parser.parse(segment);
+    const engineDecision = await engine.evaluate(parsed);
+    const output = buildDecision(parsed, engineDecision, { config, builder, unlockKeys, hasKeys });
+    if (output.decision === 'deny' && output.action === 'block') {
+      denyOutput = output;
+      break; // first deny wins
+    }
+  }
+
+  if (denyOutput) {
+    return denyOutput;
+  }
+
+  // All segments allowed — return an allow decision based on the first segment.
+  const firstParsed = parser.parse(segments[0] ?? '');
+  const firstEngineDecision = await engine.evaluate(firstParsed);
+  return buildDecision(firstParsed, firstEngineDecision, {
+    config,
+    builder,
+    unlockKeys,
+    hasKeys,
+  });
+}
+
+/** Build a DecisionOutput from a parsed command + engine decision, applying unlock keys. */
+function buildDecision(
+  parsed: ParsedCommand,
+  engineDecision: EngineDecision,
+  deps: {
+    config: EngineConfig;
+    builder: DecisionBuilder;
+    unlockKeys: readonly string[];
+    hasKeys: boolean;
+  },
+): DecisionOutput {
+  const { config, builder, unlockKeys, hasKeys } = deps;
+
   let output: DecisionOutput;
 
   if (engineDecision.source === 'fail-open' && hasKeys) {
@@ -111,12 +206,7 @@ export async function runCli(opts: CliOptions): Promise<CliResult> {
     }
   }
 
-  // Hard internal gate: the record MUST validate against the schema before emit.
-  validateDecision(output);
-
-  const formatter = new OutputFormatter();
-  const { stdout, exitCode } = formatter.format(output, opts.mode);
-  return { stdout, exitCode };
+  return output;
 }
 
 function resolveRaw(opts: CliOptions): string {