pi-task-tracker 0.2.1 → 0.2.2

package/README.md

@@ -75,7 +75,8 @@ Optional `taskTracker` key in `~/.pi/agent/settings.json` (all default to `true`
 - `todo` — maintain `TODO.md`
 - `readme` — maintain the `README.md` project-structure section
 - `autoCommit` — per-task commits; these are the `/rollback` checkpoints, so disabling this also disables rollback targets
-- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd`/`Set-Location` are disabled outright** (sandbox design: pi's bash tool runs each command in a fresh child process pinned to the session directory anyway, so a `cd` can never move the session — denying it keeps the analysis simple and the writable scope exactly the trackable scope).
+- `guard` — master switch for the built-in permission layer (default `true`). Set `false` to defer permission decisions entirely to another extension (e.g. `pi-permission-system`): no external-write checks, no git-ask prompts, no cd sandbox.
+- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Everything INSIDE the session directory passes by default — the only sandbox-internal intervention is the `cd` disable. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd`/`Set-Location` are disabled outright** (sandbox design: pi's bash tool runs each command in a fresh child process pinned to the session directory anyway, so a `cd` can never move the session — denying it keeps the analysis simple and the writable scope exactly the trackable scope).
 
 ## Requirements
 

package/index.ts

@@ -569,12 +569,15 @@ interface TrackerConfig {
   todo: boolean;
   readme: boolean;
   autoCommit: boolean;
+  /** master switch for the built-in permission layer (external-write guard,
+   *  git-ask inheritance, cd disable). false = defer entirely to other extensions */
+  guard: boolean;
   /** Writes outside the session directory: "block" (default) | "ask" | "off" */
   externalWrite: "block" | "ask" | "off";
 }
 
 function readConfig(): TrackerConfig {
-  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "block" };
+  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "block", guard: true };
   try {
     const dir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent");
     const file = process.env.PI_TRACKER_SETTINGS || path.join(dir, "settings.json");
@@ -584,6 +587,7 @@ function readConfig(): TrackerConfig {
       todo: t.todo !== false,
       readme: t.readme !== false,
       autoCommit: t.autoCommit !== false,
+      guard: t.guard !== false,
       externalWrite: t.externalWrite === "ask" || t.externalWrite === "off" ? t.externalWrite : "block",
     };
   } catch {
@@ -671,7 +675,7 @@ export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
     // External-write guard: keep the writable scope equal to the trackable
     // scope. See the "External-write guard" block above for the policy.
-    if (config.externalWrite !== "off") {
+    if (config.guard && config.externalWrite !== "off") {
       const hit = await guardExternalWriteHit(event, cwd, config.externalWrite === "off" ? "block" : config.externalWrite, ctx);
       if (hit) {
         if (hit === "__ask__") return; // ask mode: user approved in guardExternalWriteHit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-task-tracker",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Task workflow tracking for the pi coding agent: TODO/README maintenance, per-task git auto-commits as checkpoints, and an interactive /rollback. Hashline-aware, nested-repo aware, subagent-artifact-safe.",
   "keywords": [
     "pi-package",