pi-task-tracker 0.2.3 → 0.2.5

package/README.md

@@ -76,7 +76,7 @@ Optional `taskTracker` key in `~/.pi/agent/settings.json` (all default to `true`
 - `readme` — maintain the `README.md` project-structure section
 - `autoCommit` — per-task commits; these are the `/rollback` checkpoints, so disabling this also disables rollback targets
 - `guard` — master switch for the built-in permission layer (default `true`). Set `false` to defer permission decisions entirely to another extension (e.g. `pi-permission-system`): no external-write checks, no git-ask prompts, no cd sandbox.
-- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Everything INSIDE the session directory passes by default — the only sandbox-internal intervention is the `cd` disable. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd` is free inside the session directory; a `cd` that would move the working directory outside it is blocked** (that is the one operation that changes pi's effective scope). No cd-tracking is performed — resolution baseline stays the session root, so a deep in-session `cd` followed by enough `../` levels to escape may over-block, which is the fail-safe direction.
+- `externalWrite` — policy for tool calls that would create/modify files OUTSIDE the session directory: `"block"` (default, hard deny — external changes cannot be tracked or rolled back), `"ask"` (per-attempt confirmation), `"off"` (no enforcement; `pi-permission-system` rules still apply). Reads stay free. Copying files FROM outside INTO the session is allowed (`cp` checks only its destination); moving/deleting external paths is blocked. Everything INSIDE the session directory passes by default — the only sandbox-internal intervention is the `cd` disable. Git history protection is **inherited**: history-rewriting git (rebase/reset/amend/force-push/clean/...) prompts for confirmation right here, so `pi-permission-system` can be uninstalled without losing that layer; routine git passes untouched, an external `git init`/`clone` is allowed with a heads-up that the new repo is not tracked. Git-Bash/MSYS paths (`/c/Users/...`, `/cygdrive/c/...`) are normalized before evaluation, so drive-absolute forms do not false-positive as external; `/tmp` and other non-drive names stay external (they resolve outside the session on Windows). Shell commands are analyzed statically (redirects, `rm/mv/cp/touch/...`, `cd` tracking, PowerShell equivalents); git protection is inherited from `pi-permission-system` — routine git passes untouched and history-rewriting git still prompts there; only redirect targets and `-C` destinations on git segments are checked. **`cd` is free inside the session directory; a `cd` that would move the working directory outside it is blocked** (that is the one operation that changes pi's effective scope). No cd-tracking is performed — resolution baseline stays the session root, so a deep in-session `cd` followed by enough `../` levels to escape may over-block, which is the fail-safe direction.
 
 ## Requirements
 

package/index.ts

@@ -110,7 +110,7 @@ function findEnclosingRepo(dir: string): string | null {
 // ---- External-write guard ----
 // Enforces the tracking boundary as a write boundary: pi-task-tracker can
 // only track (and therefore only roll back) the session directory, so by
-// default (config taskTracker.externalWrite="block") tool calls that would
+// default (config taskTracker.externalWrite="ask") tool calls that would
 // create/modify files OUTSIDE it are denied. Reads stay free. Git command
 // protection is inherited from pi-permission-system's bash rules (rebase/
 // reset/amend/force-push/... ask there): this guard never inspects git
@@ -142,10 +142,22 @@ const GUARD_PS_WRITE_CMDS = new Set([
   "copy-item", "move-item", "clear-content", "ni", "ri", "mi", "ac", "sc", "sp",
 ]);
 
+// Normalize a Git-Bash/MSYS style path before resolution. On Windows,
+// path.resolve("/c/Users/x") yields the drive-relative "C:\c\Users\x", which
+// which breaks the external check. "/c/Users/x" and "/cygdrive/c/Users/x"
+// become "C:\Users\x"-style drive paths. Names longer than one letter (/tmp,
+// /usr, ...) are NOT drive mappings and stay untouched (outside the session
+// on Windows anyway).
+function normalizeShellPath(t: string): string {
+  const m = /^\/(?:cygdrive\/)?([a-zA-Z])\/(.*)$/.exec(t);
+  if (!m) return t;
+  const BS = String.fromCharCode(92);
+  return m[1].toUpperCase() + ":" + BS + m[2].split("/").join(BS);
+}
 // Resolve a shell token to an absolute path; unresolvable tokens (env vars,
 // command substitution) are treated as external - conservative by design.
 function guardResolve(sessionCwd: string, token: string): { abs: string; external: boolean } {
-  let t = token.replace(/^["']|["']$/g, "").trim();
+  let t = normalizeShellPath(token.replace(/^["']|["']$/g, "").trim());
   if (!t) return { abs: sessionCwd, external: false };
   if (t.startsWith("~")) return { abs: t, external: true };
   if (/[\$`]/.test(t)) return { abs: t, external: true };
@@ -244,7 +256,8 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
       // interpreter: block only if the command TEXT names an external path
       for (const m of seg.matchAll(/[A-Za-z]:[\/]\S*|\/(?:[\w.-]+\/)+[\w.-]+/g)) {
         if (guardIsDevNull(m[0])) continue;
-        if (isExternalAbs(m[0], sessionCwd)) { out.block = m[0]; break; }
+        const np = normalizeShellPath(m[0]);
+        if (isExternalAbs(np, sessionCwd)) { out.block = np; break; }
       }
       continue;
     }
@@ -254,7 +267,8 @@ function guardShellExternalWrite(cmd: string, sessionCwd: string): { block?: str
       pathArgs.push(tokens[k]);
     }
     const checkList = isCopy ? pathArgs.slice(-1) : pathArgs;
-    for (const t of checkList) {
+    for (const raw of checkList) {
+      const t = normalizeShellPath(raw);
       if (/^[A-Za-z]:[\\{1,2}]/.test(t) || t.startsWith("/")) { // absolute
         if (guardIsDevNull(t)) continue;
         if (isExternalAbs(t, sessionCwd)) out.block = t;
@@ -308,7 +322,7 @@ async function guardExternalWriteHit(
         if (ok) return null;
         return `pi-task-tracker scope guard: user denied external write to '${hit.block}'. Do not retry or bypass.`;
       }
-      return `pi-task-tracker scope guard (externalWrite=block): this command writes to '${hit.block}' outside the session directory. ${why} Stay inside the session directory, or have the user adjust taskTracker.externalWrite / run it manually.`;
+      return `pi-task-tracker scope guard (externalWrite=${mode}): this command writes to '${hit.block}' outside the session directory. ${why} Stay inside the session directory, or have the user adjust taskTracker.externalWrite / run it manually.`;
     }
     return null;
   }
@@ -330,10 +344,11 @@ async function guardExternalWriteHit(
     if (ok) return "__ask__";
     return `pi-task-tracker scope guard: user denied external write to '${p}'. Do not retry or bypass.`;
   }
-  return `pi-task-tracker scope guard (externalWrite=block): tool '${toolName}' targets '${p}' outside the session directory. ${why} Ask the user to adjust taskTracker.externalWrite or perform the change manually.`;
+  return `pi-task-tracker scope guard (externalWrite=${mode}): tool '${toolName}' targets '${p}' outside the session directory. ${why} Ask the user to adjust taskTracker.externalWrite or perform the change manually.`;
 }
 
 function isExternalAbs2(base: string, p: string): boolean {
+  p = normalizeShellPath(p);
   const abs = path.isAbsolute(p) ? p : path.resolve(base, p);
   const rel = path.relative(base, abs);
   return rel.startsWith("..") || path.isAbsolute(rel);
@@ -589,7 +604,7 @@ interface TrackerConfig {
 }
 
 function readConfig(): TrackerConfig {
-  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "block", guard: true };
+  const fallback: TrackerConfig = { todo: true, readme: true, autoCommit: true, externalWrite: "ask", guard: true };
   try {
     const dir = process.env.PI_CODING_AGENT_DIR || path.join(os.homedir(), ".pi", "agent");
     const file = process.env.PI_TRACKER_SETTINGS || path.join(dir, "settings.json");
@@ -600,7 +615,7 @@ function readConfig(): TrackerConfig {
       readme: t.readme !== false,
       autoCommit: t.autoCommit !== false,
       guard: t.guard !== false,
-      externalWrite: t.externalWrite === "ask" || t.externalWrite === "off" ? t.externalWrite : "block",
+      externalWrite: t.externalWrite === "block" || t.externalWrite === "off" ? t.externalWrite : "ask",
     };
   } catch {
     return fallback;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-task-tracker",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Task workflow tracking for the pi coding agent: TODO/README maintenance, per-task git auto-commits as checkpoints, and an interactive /rollback. Hashline-aware, nested-repo aware, subagent-artifact-safe.",
   "keywords": [
     "pi-package",