pi-task-tracker 0.2.0 → 0.2.1

package/README.md

@@ -75,7 +75,7 @@ Optional `taskTracker` key in `~/.pi/agent/settings.json` (all default to `true`
 - `todo` — maintain `TODO.md`
 - `readme` — maintain the `README.md` project-structure section
 - `autoCommit` — per-task commits; these are the `/rollback` checkpoints, so disabling this also disables rollback targets
-- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked.
+- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd`/`Set-Location` are disabled outright** (sandbox design: pi's bash tool runs each command in a fresh child process pinned to the session directory anyway, so a `cd` can never move the session — denying it keeps the analysis simple and the writable scope exactly the trackable scope).
 
 ## Requirements
 

package/index.ts

@@ -144,15 +144,15 @@ const GUARD_PS_WRITE_CMDS = new Set([
 
 // Resolve a shell token to an absolute path; unresolvable tokens (env vars,
 // command substitution) are treated as external - conservative by design.
-function guardResolve(effCwd: string, sessionCwd: string, token: string): { abs: string; external: boolean } {
+function guardResolve(sessionCwd: string, token: string): { abs: string; external: boolean } {
   let t = token.replace(/^["']|["']$/g, "").trim();
-  if (!t) return { abs: effCwd, external: false };
+  if (!t) return { abs: sessionCwd, external: false };
   if (t.startsWith("~")) return { abs: t, external: true };
   if (/[\$`]/.test(t)) return { abs: t, external: true };
   if (/^[A-Za-z]:[\\/]/.test(t) || t.startsWith("/")) {
     return { abs: t, external: isExternalAbs(t, sessionCwd) };
   }
-  const abs = path.resolve(effCwd, t);
+  const abs = path.resolve(sessionCwd, t);
   return { abs, external: isExternalAbs(abs, sessionCwd) };
 }
 
@@ -172,30 +172,31 @@ function guardIsDevNull(t: string): boolean {
 // write-command arguments (copy-like: destination only), interpreter payloads
 // mentioning external absolute paths, cd tracking. Git arguments are NOT
 // analyzed (inherited protection: only history-rewriting git asks).
+// Analyze one shell command. cd/Set-Location are DISABLED outright (sandbox
+// design: the process cwd is pinned to the session directory, which also
+// removes any need for cd-tracking in this analysis). Returns
+// { block, ask, notify } hits. External-write analysis is best effort:
+// redirect targets, write-command arguments (copy-like: destination only),
+// interpreter payloads mentioning external absolute paths. Git arguments are
+// NOT analyzed (inherited protection: only history-rewriting git asks).
 function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: string; ask?: string; notify?: string } | null {
   const segments = cmd.split(/\n|&&|\|\||;|\|/).map((s) => s.trim()).filter(Boolean);
-  let effCwd = sessionCwd;
   const out: { block?: string; ask?: string; notify?: string } = {};
   for (const seg of segments) {
-    const cd = seg.match(/^cd\s+(.+)$/i) || seg.match(/^sl\s+(.+)$/i) || seg.match(/^set-location\s+(.+)$/i);
-    if (cd) {
-      const r = guardResolve(effCwd, sessionCwd, cd[1]);
-      // switch to the real effective cwd even when external: only WRITE ops
-      // are analyzed below, so `cd elsewhere && cat f` still passes while
-      // `cd elsewhere && touch a.txt` is correctly judged external.
-      effCwd = r.abs;
-      continue;
+    if (/^(cd|sl|set-location)\s/i.test(seg)) {
+      out.block = "cd is disabled in this sandbox; run commands from the session directory";
+      return out;
     }
     // 2. redirects: > >> 2> 2>> &> &>> >| (not heredocs, not fd dups like 2>&1)
     for (const m of seg.matchAll(/(?:^|[^<>&=(])(?:\d?>{1,2}|&>>?|>\|)\s*([^\s;&|]+)/g)) {
       const tgt = m[1];
       if (/^&?\d+$/.test(tgt) || guardIsDevNull(tgt)) continue;
-      const r = guardResolve(effCwd, sessionCwd, tgt);
+      const r = guardResolve(sessionCwd, tgt);
       if (r.external) out.block = r.abs;
     }
     const isGit = /^git(\s|$)/.test(seg);
     // 1. inherited git protection: history-rewriting git asks (matches
-    //    pi-permissions.jsonc bash patterns; prefix match like "git rebase*")
+    //    the old pi-permissions.jsonc bash patterns; prefix match)
     if (isGit) {
       const low = seg.toLowerCase();
       if (GUARD_GIT_ASK.some((p) => low.startsWith(p))) {
@@ -203,7 +204,8 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
         continue;
       }
       if (/^git\s+(init|clone)/.test(low)) {
-        const r = guardResolve(effCwd, sessionCwd, seg.split(/\s+/)[1] === "clone" ? (seg.match(/\s+(\S+)\s+\S+$/) || [])[1] || "." : ".");
+        const target = (seg.split(/\s+/).filter((x) => x && !x.startsWith("-")).pop()) || ".";
+        const r = guardResolve(sessionCwd, target);
         if (r.external) {
           out.notify = `git ${seg.startsWith("git clone") ? "clone" : "init"} outside the session directory (${r.abs}). pi-task-tracker does NOT track that directory; start a separate pi session there if you want it tracked.`;
         }
@@ -211,7 +213,7 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
       // external -C destination on any git command
       const c = seg.match(/\s-C\s+(\S+)/);
       if (c) {
-        const r = guardResolve(effCwd, sessionCwd, c[1]);
+        const r = guardResolve(sessionCwd, c[1]);
         if (r.external) out.block = r.abs;
       }
       continue;
@@ -241,13 +243,13 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
     }
     const checkList = isCopy ? pathArgs.slice(-1) : pathArgs;
     for (const t of checkList) {
-      if (/^[A-Za-z]:[\{1,2}]/.test(t) || t.startsWith("/")) { // absolute
+      if (/^[A-Za-z]:[\\{1,2}]/.test(t) || t.startsWith("/")) { // absolute
         if (guardIsDevNull(t)) continue;
         if (isExternalAbs(t, sessionCwd)) out.block = t;
       } else if (/[\$`~]/.test(t)) {
         out.block = t; // unresolvable -> conservative
       } else {
-        const abs = path.resolve(effCwd, t);
+        const abs = path.resolve(sessionCwd, t);
         if (isExternalAbs(abs, sessionCwd)) out.block = t;
       }
       if (out.block) break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-task-tracker",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Task workflow tracking for the pi coding agent: TODO/README maintenance, per-task git auto-commits as checkpoints, and an interactive /rollback. Hashline-aware, nested-repo aware, subagent-artifact-safe.",
   "keywords": [
     "pi-package",