pi-task-tracker 0.2.0 → 0.2.2

package/README.md

@@ -75,7 +75,8 @@ Optional `taskTracker` key in `~/.pi/agent/settings.json` (all default to `true`
 - `todo` — maintain `TODO.md`
 - `readme` — maintain the `README.md` project-structure section
 - `autoCommit` — per-task commits; these are the `/rollback` checkpoints, so disabling this also disables rollback targets
-- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked.
+- `guard` — master switch for the built-in permission layer (default `true`). Set `false` to defer permission decisions entirely to another extension (e.g. `pi-permission-system`): no external-write checks, no git-ask prompts, no cd sandbox.
+- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Everything INSIDE the session directory passes by default — the only sandbox-internal intervention is the `cd` disable. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd`/`Set-Location` are disabled outright** (sandbox design: pi's bash tool runs each command in a fresh child process pinned to the session directory anyway, so a `cd` can never move the session — denying it keeps the analysis simple and the writable scope exactly the trackable scope).
 
 ## Requirements
 

package/index.ts

@@ -144,15 +144,15 @@ const GUARD_PS_WRITE_CMDS = new Set([
 
 // Resolve a shell token to an absolute path; unresolvable tokens (env vars,
 // command substitution) are treated as external - conservative by design.
-function guardResolve(effCwd: string, sessionCwd: string, token: string): { abs: string; external: boolean } {
+function guardResolve(sessionCwd: string, token: string): { abs: string; external: boolean } {
   let t = token.replace(/^["']|["']$/g, "").trim();
-  if (!t) return { abs: effCwd, external: false };
+  if (!t) return { abs: sessionCwd, external: false };
   if (t.startsWith("~")) return { abs: t, external: true };
   if (/[\$`]/.test(t)) return { abs: t, external: true };
   if (/^[A-Za-z]:[\\/]/.test(t) || t.startsWith("/")) {
     return { abs: t, external: isExternalAbs(t, sessionCwd) };
   }
-  const abs = path.resolve(effCwd, t);
+  const abs = path.resolve(sessionCwd, t);
   return { abs, external: isExternalAbs(abs, sessionCwd) };
 }
 
@@ -172,30 +172,31 @@ function guardIsDevNull(t: string): boolean {
 // write-command arguments (copy-like: destination only), interpreter payloads
 // mentioning external absolute paths, cd tracking. Git arguments are NOT
 // analyzed (inherited protection: only history-rewriting git asks).
+// Analyze one shell command. cd/Set-Location are DISABLED outright (sandbox
+// design: the process cwd is pinned to the session directory, which also
+// removes any need for cd-tracking in this analysis). Returns
+// { block, ask, notify } hits. External-write analysis is best effort:
+// redirect targets, write-command arguments (copy-like: destination only),
+// interpreter payloads mentioning external absolute paths. Git arguments are
+// NOT analyzed (inherited protection: only history-rewriting git asks).
 function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: string; ask?: string; notify?: string } | null {
   const segments = cmd.split(/\n|&&|\|\||;|\|/).map((s) => s.trim()).filter(Boolean);
-  let effCwd = sessionCwd;
   const out: { block?: string; ask?: string; notify?: string } = {};
   for (const seg of segments) {
-    const cd = seg.match(/^cd\s+(.+)$/i) || seg.match(/^sl\s+(.+)$/i) || seg.match(/^set-location\s+(.+)$/i);
-    if (cd) {
-      const r = guardResolve(effCwd, sessionCwd, cd[1]);
-      // switch to the real effective cwd even when external: only WRITE ops
-      // are analyzed below, so `cd elsewhere && cat f` still passes while
-      // `cd elsewhere && touch a.txt` is correctly judged external.
-      effCwd = r.abs;
-      continue;
+    if (/^(cd|sl|set-location)\s/i.test(seg)) {
+      out.block = "cd is disabled in this sandbox; run commands from the session directory";
+      return out;
     }
     // 2. redirects: > >> 2> 2>> &> &>> >| (not heredocs, not fd dups like 2>&1)
     for (const m of seg.matchAll(/(?:^|[^<>&=(])(?:\d?>{1,2}|&>>?|>\|)\s*([^\s;&|]+)/g)) {
       const tgt = m[1];
       if (/^&?\d+$/.test(tgt) || guardIsDevNull(tgt)) continue;
-      const r = guardResolve(effCwd, sessionCwd, tgt);
+      const r = guardResolve(sessionCwd, tgt);
       if (r.external) out.block = r.abs;
     }
     const isGit = /^git(\s|$)/.test(seg);
     // 1. inherited git protection: history-rewriting git asks (matches
-    //    pi-permissions.jsonc bash patterns; prefix match like "git rebase*")
+    //    the old pi-permissions.jsonc bash patterns; prefix match)
     if (isGit) {
       const low = seg.toLowerCase();
       if (GUARD_GIT_ASK.some((p) => low.startsWith(p))) {
@@ -203,7 +204,8 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
         continue;
       }
       if (/^git\s+(init|clone)/.test(low)) {
-        const r = guardResolve(effCwd, sessionCwd, seg.split(/\s+/)[1] === "clone" ? (seg.match(/\s+(\S+)\s+\S+$/) || [])[1] || "." : ".");
+        const target = (seg.split(/\s+/).filter((x) => x && !x.startsWith("-")).pop()) || ".";
+        const r = guardResolve(sessionCwd, target);
         if (r.external) {
           out.notify = `git ${seg.startsWith("git clone") ? "clone" : "init"} outside the session directory (${r.abs}). pi-task-tracker does NOT track that directory; start a separate pi session there if you want it tracked.`;
         }
@@ -211,7 +213,7 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
       // external -C destination on any git command
       const c = seg.match(/\s-C\s+(\S+)/);
       if (c) {
-        const r = guardResolve(effCwd, sessionCwd, c[1]);
+        const r = guardResolve(sessionCwd, c[1]);
         if (r.external) out.block = r.abs;
       }
       continue;
@@ -241,13 +243,13 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
     }
     const checkList = isCopy ? pathArgs.slice(-1) : pathArgs;
     for (const t of checkList) {
-      if (/^[A-Za-z]:[\{1,2}]/.test(t) || t.startsWith("/")) { // absolute
+      if (/^[A-Za-z]:[\\{1,2}]/.test(t) || t.startsWith("/")) { // absolute
         if (guardIsDevNull(t)) continue;
         if (isExternalAbs(t, sessionCwd)) out.block = t;
       } else if (/[\$`~]/.test(t)) {
         out.block = t; // unresolvable -> conservative
       } else {
-        const abs = path.resolve(effCwd, t);
+        const abs = path.resolve(sessionCwd, t);
         if (isExternalAbs(abs, sessionCwd)) out.block = t;
       }
       if (out.block) break;
@@ -567,12 +569,15 @@ interface TrackerConfig {
   todo: boolean;
   readme: boolean;
   autoCommit: boolean;
+  /** master switch for the built-in permission layer (external-write guard,
+   *  git-ask inheritance, cd disable). false = defer entirely to other extensions */
+  guard: boolean;
   /** Writes outside the session directory: "block" (default) | "ask" | "off" */
   externalWrite: "block" | "ask" | "off";
 }
 
 function readConfig(): TrackerConfig {
-  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "block" };
+  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "block", guard: true };
   try {
     const dir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent");
     const file = process.env.PI_TRACKER_SETTINGS || path.join(dir, "settings.json");
@@ -582,6 +587,7 @@ function readConfig(): TrackerConfig {
       todo: t.todo !== false,
       readme: t.readme !== false,
       autoCommit: t.autoCommit !== false,
+      guard: t.guard !== false,
       externalWrite: t.externalWrite === "ask" || t.externalWrite === "off" ? t.externalWrite : "block",
     };
   } catch {
@@ -669,7 +675,7 @@ export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
     // External-write guard: keep the writable scope equal to the trackable
     // scope. See the "External-write guard" block above for the policy.
-    if (config.externalWrite !== "off") {
+    if (config.guard && config.externalWrite !== "off") {
       const hit = await guardExternalWriteHit(event, cwd, config.externalWrite === "off" ? "block" : config.externalWrite, ctx);
       if (hit) {
         if (hit === "__ask__") return; // ask mode: user approved in guardExternalWriteHit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-task-tracker",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Task workflow tracking for the pi coding agent: TODO/README maintenance, per-task git auto-commits as checkpoints, and an interactive /rollback. Hashline-aware, nested-repo aware, subagent-artifact-safe.",
   "keywords": [
     "pi-package",