pi-verdict 0.5.1 → 0.5.2

package/README.md

@@ -121,7 +121,7 @@ tool_call
   │         config changed + interactive → one keep/restore confirm
   │
   ├─ 1. Rule layer (deterministic, zero latency)
-  │     ├─ built-in deny floor: bash danger regexes (full-string) +
+  │     ├─ built-in deny floor: bash danger regexes (full-string, capped at 8192 chars) +
   │     │   path sensitivity S0–S5 (secrets/system/.git meta → deny;
   │     │   dual-form matching — lexical + realpath, symlink aliases resolve)
   │     ├─ your rules: user deny beats user allow (regex, see below)

package/README.zh-CN.md

@@ -121,7 +121,7 @@ tool_call
   │         仅配置被改且有 UI → 一次保留/还原确认
   │
   ├─ 1. 规则层(确定性,零延迟)
-  │     ├─ 内置 deny floor:bash 危险正则(完整命令串)+ 路径敏感度 S0–S5
+  │     ├─ 内置 deny floor:bash 危险正则(完整命令串,截断上限 8192 字符)+ 路径敏感度 S0–S5
   │     │   (双形匹配 —— 词法 + realpath,符号链接别名会被解析)
   │     ├─ 用户规则:deny 优先于 allow(正则,见下)
   │     ├─ denyPaths(ADR-0002):用户声明的受保护路径,工具负责归一化

package/extensions/auto-mode.ts

@@ -118,11 +118,17 @@ interface RuleResult {
 	detail?: string;
 }
 
+/** Cap the danger-regex matching input (#25): the prefix-consuming character
+ *  classes plus nested alternations can backtrack quadratically on very long
+ *  separator-free strings. Beyond the cap, rule matching is lost and the call
+ *  falls to the classifier (fail-closed direction). */
+export const BASH_MAX_MATCH_LEN = 8192;
+
 function classifyBash(command: string, floorOn: boolean): RuleResult {
-	// 内置 deny floor:危险正则对完整命令串匹配;可经 builtinDenyFloor 整体关闭
 	if (floorOn) {
+		const capped = command.length > BASH_MAX_MATCH_LEN ? command.slice(0, BASH_MAX_MATCH_LEN) : command;
 		for (const rule of BASH_DANGER_RULES) {
-			if (rule.pattern.test(command)) return { verdict: "deny", reason: `rule ${rule.id}: ${rule.reason}` };
+			if (rule.pattern.test(capped)) return { verdict: "deny", reason: `rule ${rule.id}: ${rule.reason}` };
 		}
 	}
 	if (!command.trim()) return { verdict: "allow", reason: "empty command" };
@@ -231,7 +237,15 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		const raw = JSON.parse(fs.readFileSync(p, "utf8")) as { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown };
+		try {
+			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
+		} catch (err) {
+			// Invalid config never silently disables the gate (#25): a parse failure
+			// loads empty user rules (the floor and self-protection layer stay on)
+			// and reports through the session_start skip channel, same as invalid regexes
+			return { rules: EMPTY_RULES, skipped: [`config parse failed: ${err instanceof Error ? err.message : String(err)} — user rules not loaded (${p})`], shortcutWarning: null };
+		}
 		const skipped: string[] = [];
 		const compile = (list: unknown): RegExp[] =>
 			(Array.isArray(list) ? list : []).filter((x): x is string => typeof x === "string").flatMap((src) => {
@@ -516,9 +530,48 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 	// 安装副本目标:单文件形态 → 文件本体(exact);npm 目录形态 → 包根目录(prefix)。
 	// extRoot 与 ownFile 各取词法/realpath 双形交叉判定,集合同样双形收录——
 	// 避免符号链接目录(如 macOS /var → /private/var)导致传入词法路径与集合错位。
+	/** List every file under a package root (npm dir install form) for the tamper
+	 *  baseline (#26): write protection covers the whole package dir, so the watch
+	 *  scope must not lag behind it — a planted manifest entry must not survive to
+	 *  the next session undetected. node_modules/.git are skipped; depth and file
+	 *  count are bounded so a planted oversized tree cannot blow up the next
+	 *  session's baseline build (defense in depth, requires a prior bypass). */
+	const listPackageFiles = (root: string): string[] => {
+		const out: string[] = [];
+		const walk = (dir: string, depth: number): void => {
+			if (depth > 16 || out.length >= 500) return;
+			let names: string[];
+			try {
+				names = fs.readdirSync(dir);
+			} catch {
+				return;
+			}
+			for (const name of names) {
+				if (name === "node_modules" || name === ".git") continue;
+				const full = path.join(dir, name);
+				// stat (not lstat) follows symlinks: a package file replaced by a
+				// symlink to outside content must not silently drop out of the
+				// baseline — the watched path stays the lexical entry; a symlink
+				// cycle (ELOOP) throws and is skipped (#26 review)
+				let st: fs.Stats;
+				try {
+					st = fs.statSync(full);
+				} catch {
+					continue;
+				}
+				if (st.isDirectory()) walk(full, depth + 1);
+				else if (st.isFile() && out.length < 500) out.push(full);
+			}
+		};
+		walk(root, 0);
+		return out;
+	};
+
 	const extTargets = new Set<string>();
 	if (ownFile) {
 		watchBases.push({ file: ownFile, kind: "extension" });
+		const seenWatch = new Set<string>([ownFile]);
+		let pkgRoot: string | null = null;
 		const extRoots = new Set([path.join(agentDir, "extensions"), tryRealpath(path.join(agentDir, "extensions"))]);
 		const ownForms = new Set([ownFile, tryRealpath(ownFile)]);
 		for (const extRoot of extRoots) {
@@ -531,6 +584,16 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 					(singleFile ? exact : prefixes).add(f);
 					extTargets.add(f);
 				}
+				if (!singleFile && pkgRoot === null) pkgRoot = target;
+			}
+		}
+		// one walk of the package root (lexical form; takeSnapshots' pathForms
+		// expansion picks up real forms per file) — no duplicate entries
+		if (pkgRoot !== null) {
+			for (const f of listPackageFiles(pkgRoot)) {
+				if (seenWatch.has(f)) continue;
+				seenWatch.add(f);
+				watchBases.push({ file: f, kind: "extension" });
 			}
 		}
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.5.1",
+	"version": "0.5.2",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",