pi-verdict 0.6.0 → 0.6.1

package/README.md

@@ -8,7 +8,7 @@
 
 **pi-verdict is a minimal permission gate for [pi](https://pi.dev) in the style of Claude Code's auto mode: every tool call gets checked before it runs — allow, deny, or ask you first.**
 
-- Minimal — just a few hundred lines of code
+- Minimal — just 1k+ lines of code
 - Built-in danger rules and your own allow/deny rules settle the clear cases first, at zero latency
 - Everything else goes to a model classifier that sees the conversation context
 - Any uncertainty or failure fails closed; nothing ever runs silently
@@ -26,19 +26,21 @@ pi-verdict adds the missing gate: a model decides whether each call should run,
 
 ## Design principles
 
-A small set of security principles shapes the whole gate — the full statement, with the honest edges, lives in [docs/security-principles.md](docs/security-principles.md):
-
 - **Fail closed** — uncertainty produces friction, never permission.
 - **Deterministic floor before AI** — hard denies are never overridden by the classifier or user allow rules.
-- **Semantics over syntax** — a long read-only pipeline may auto-allow while a short destructive one still denies; the classifier judges what an action *does*, not how long it is.
+- **Semantics over syntax** — the classifier judges what an action *does*, not how long it is.
 - **Judgments, not proofs** — a classifier `allow` is an informed opinion; the floor exists because that is all it is.
 - **Minimal trusted input** — no tool results in the transcript (#22), zero path plaintext to the classifier (ADR-0002).
 - **Canonical identity** — lexical + realpath dual-form matching; a workspace-*looking* path is not trusted as one (#20/#21).
 - **The gate guards itself** — self-protection that no configuration can disable (ADR-0001).
 - **A permission gate, not a sandbox** — stack OS isolation on top; this gate never replaces it.
 
+Full statement in [docs/security-principles.md](docs/security-principles.md).
+
 ## Screenshots
 
+![Demo: protected-path ask declined](docs/demo.gif)
+
 ![Automode Status](docs/images/status.png)
 ![Ask Permission](docs/images/asked.png)
 
@@ -63,7 +65,7 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
 | | pi | omp |
 |---|---|---|
 | install | `pi install npm:pi-verdict` | `omp plugin install npm:pi-verdict` |
-| extension copy | `~/.pi/agent/extensions/` | `~/.omp/agent/plugins/node_modules/pi-verdict/` |
+| extension copy | `~/.pi/agent/extensions/` | `~/.omp/plugins/node_modules/pi-verdict/` (omp 18.1+; ≤18.0: under `agent/`) |
 | user rules | `~/.pi/agent/config/pi-verdict.json` | `~/.omp/agent/config/pi-verdict.json` |
 | credential file (S0 hard deny) | `~/.pi/agent/auth.json` | `~/.omp/agent/auth.json` |
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 **pi-verdict 是 [pi](https://pi.dev) 的 Claude Code 风格的 Auto mode 式的极简权限门禁:每次工具调用执行前先过检查——放行、拦截,或先问你。**
 
-- 只有几百行的极简代码
+- 只有1k行左右的极简代码
 - 内置危险规则与你的 allow/deny 规则以零延迟先行裁决明确情形
 - 其余交给携带会话上下文的模型分类器
 - 任何不确定或失败一律 fail-closed, 绝不静默放行
@@ -22,23 +22,26 @@ pi-verdict 补上这道缺失的门禁, 由模型基于上下文和你的意图
 
 ## 为什么是三态
 
-**verdict 是裁决,不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在:`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`),「不确定」永远不会静默变成「放行」——目标是安全的自动化而非最大的自动化:审批疲劳与静默危险执行都是输家。
+**verdict 是裁决,不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在:`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`),「不确定」永远不会静默变成「放行」——目标是安全的自动化而非最大的自动化:审批疲劳与静默危险执行都是危险。
 
 ## 设计原则
 
-一小组安全设计原则塑形了整个门禁——完整表述(含诚实的边界说明)见 [docs/security-principles.md](docs/security-principles.md):
-
 - **Fail closed**——不确定产生摩擦,绝不产生许可。
 - **确定性 floor 先于 AI**——硬 deny 永不被分类器或用户 allow 规则覆盖。
-- **语义优先于语法**——长而只读的管道可以自动放行,短而具破坏性的照样拦下;分类器判定的是动作**做什么**,而不是命令有多长。
+- **语义优先于语法**——分类器判定的是动作**做什么可能会产生什么安全影响**,而不是命令有多长。
 - **是判断,不是证明**——分类器的 `allow` 是有依据的判断;floor 的存在正因为它仅此而已。
 - **最小化可信输入**——transcript 不含工具结果(#22),分类器零路径明文(ADR-0002)。
 - **规范化身份**——词法 + realpath 双形匹配;「看起来在项目内」的路径不因此被信任(#20/#21)。
 - **门禁守护自身**——任何配置都关不掉的自保护层(ADR-0001)。
 - **是权限门禁,不是沙箱**——请在上面叠加 OS 级隔离;本门禁不替代它。
 
+完整表述见 [docs/security-principles.md](docs/security-principles.md):
+
+
 ## 截图
 
+![演示:受保护路径 ask 被拒绝](docs/demo.gif)
+
 ![Automode Status](docs/images/status.png)
 ![Ask Permission](docs/images/asked.png)
 
@@ -63,7 +66,7 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 | | pi | omp |
 |---|---|---|
 | 安装 | `pi install npm:pi-verdict` | `omp plugin install npm:pi-verdict` |
-| 扩展副本 | `~/.pi/agent/extensions/` | `~/.omp/agent/plugins/node_modules/pi-verdict/` |
+| 扩展副本 | `~/.pi/agent/extensions/` | `~/.omp/plugins/node_modules/pi-verdict/`(omp 18.1+;≤18.0 在 `agent/` 下) |
 | 用户规则 | `~/.pi/agent/config/pi-verdict.json` | `~/.omp/agent/config/pi-verdict.json` |
 | 凭据文件(S0 硬 deny) | `~/.pi/agent/auth.json` | `~/.omp/agent/auth.json` |
 

package/extensions/auto-mode.ts

@@ -217,11 +217,12 @@ const OWN_FILE_PATH: string | null = (() => {
  * Resolve the agent directory the gate is anchored to (#35, dual-host):
  *   1. PI_CODING_AGENT_DIR — explicit user override, always wins.
  *   2. Self-anchoring from the extension's own installed path: a copy at
- *      <home>/<dot-dir>/agent/(plugins/node_modules/<pkg>/)?extensions/…
+ *      <home>/<dot-dir>/(agent/)?(plugins/node_modules/<pkg>/)?extensions/…
  *      anchors to <home>/<dot-dir>/agent. Covers the pi forms
- *      (~/.pi/agent/extensions[/pkg]/…) and the omp npm form
- *      (~/.omp/agent/plugins/node_modules/<pkg>/extensions/…); XDG-style
- *      ~/.config/pi trees match too because the anchor accepts any dot-dir.
+ *      (~/.pi/agent/extensions[/pkg]/…) and the two omp npm layouts:
+ *      under the agent dir (~/.omp/agent/plugins/node_modules/<pkg>/…) and,
+ *      since omp 18.1, next to it (~/.omp/plugins/node_modules/<pkg>/…) —
+ *      omp keeps its config tree under <dot-dir>/agent in both layouts.
  *      Deliberately NO host-tree existence probing: on a dual-install machine
  *      running under pi, a present ~/.omp must not misroute the gate.
  *   3. Fallback: today's default (~/.pi/agent) — dev checkouts and any
@@ -232,7 +233,7 @@ const OWN_FILE_PATH: string | null = (() => {
 export function resolveAgentDir(ownFile: string | null, home: string, envAgentDir: string | undefined): string {
 	if (envAgentDir) return envAgentDir;
 	if (ownFile) {
-		const anchor = new RegExp(`^${escapeRegExp(home)}(/(\\.[^/]+)/agent/(?:plugins/node_modules/(?:@[^/]+/)?[^/]+/)?extensions/)`);
+		const anchor = new RegExp(`^${escapeRegExp(home)}(/(\\.[^/]+)/(?:agent/)?(?:plugins/node_modules/(?:@[^/]+/)?[^/]+/)?extensions/)`);
 		for (const f of [ownFile, tryRealpath(ownFile)]) {
 			const m = f.match(anchor);
 			if (m) return path.join(home, m[2], "agent");
@@ -506,10 +507,9 @@ function hitDenyPaths(toolName: string, input: Record<string, unknown>, cwd: str
 // 门禁自身的完整性不受任何配置豁免:builtinDenyFloor:false 只关危险正则与路径
 // 敏感度,关不掉本层;用户 allow 规则亦不可越过。保护对象:
 //   - <agentDir>/config/pi-verdict.json(用户规则 = 门禁的判定输入)
-//   - 本扩展的安装副本(pi installs under <agentDir>/extensions/, omp under
-//     <agentDir>/plugins/node_modules/<pkg>/; self-anchored via import.meta.url,
-//     covering the single-file and npm package-dir install forms; dev
-//     checkouts are not in scope)
+//   - 本扩展的安装副本(pi under <agentDir>/extensions/, omp under
+//     plugins/node_modules/<pkg>/ in its config root — install forms listed
+//     with resolveAgentDir; dev checkouts are not in scope)
 // 语义:门禁内一切写入按定义均由 agent 发起 → 恒 deny(reason 指引手工编辑);
 // 读放行(读门禁文件无害);用户经编辑器的修改不经门禁,不受影响。
 // bash 侧:命令串正则覆盖字面量/~/\$HOME/\$PI_CODING_AGENT_DIR 变体,可被混淆
@@ -556,10 +556,10 @@ function escapeRegExp(s: string): string {
 /**
  * 构建受保护集合。
  * ownFile:本模块文件路径(import.meta.url 解析;null = 不可解析,仅保护配置)。
- * The installed copy is protected only when ownFile sits under
- * <agentDir>/extensions/ (pi) or <agentDir>/plugins/node_modules/<pkg>/
- * (omp npm form, #35). Dev checkouts (source inside the cwd) are NOT
- * protected — in-project development writes are legitimate daily work (ADR-0001).
+ * The installed copy is protected only when ownFile sits under one of the
+ * install roots (forms listed with resolveAgentDir; #35). Dev checkouts
+ * (source inside the cwd) are NOT protected — in-project development writes
+ * are legitimate daily work (ADR-0001).
  */
 export function buildProtectedSet(agentDir: string, ownFile: string | null): ProtectedSet {
 	const exact = new Set<string>();
@@ -613,15 +613,18 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 		watchBases.push({ file: ownFile, kind: "extension" });
 		const seenWatch = new Set<string>([ownFile]);
 		let pkgRoot: string | null = null;
-		// Install roots, lexical + realpath forms (#35): pi installs under
-		// <agentDir>/extensions/, omp installs npm plugins under
-		// <agentDir>/plugins/node_modules/. First path segment under the matched
-		// root is the install target (single file → exact, package dir → prefix),
-		// so the omp form gets whole-package-dir protection exactly like the pi
-		// npm-dir form (#26).
+		// Install roots, lexical + realpath forms (#35): <agentDir>/extensions
+		// (pi) and plugins/node_modules under agentDir or its parent dir (the
+		// two omp layouts — see resolveAgentDir for the layout history). The
+		// path segments under the matched root name the install target: a file
+		// → exact, a package dir (`@scope/pkg` or `pkg`) → prefix, so every
+		// npm form gets whole-package-dir protection (#26).
 		const extRoots = new Set<string>();
+		const agentBases = new Set([agentDir, tryRealpath(agentDir)]);
+		const configRootBases = new Set([...agentBases].map((b) => path.dirname(b)));
 		for (const seg of [["extensions"], ["plugins", "node_modules"]]) {
-			for (const base of new Set([agentDir, tryRealpath(agentDir)])) {
+			const bases = seg.length === 2 ? new Set([...agentBases, ...configRootBases]) : agentBases;
+			for (const base of bases) {
 				const root = path.join(base, ...seg);
 				extRoots.add(root);
 				extRoots.add(tryRealpath(root));
@@ -631,9 +634,11 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 		for (const extRoot of extRoots) {
 			for (const own of ownForms) {
 				if (!own.startsWith(extRoot + path.sep)) continue;
-				const rel = path.relative(extRoot, own);
-				const singleFile = !rel.includes(path.sep);
-				const target = singleFile ? own : path.join(extRoot, rel.split(path.sep)[0]);
+				const segs = path.relative(extRoot, own).split(path.sep);
+				const singleFile = segs.length === 1;
+				// npm scopes are two-segment dirs (@scope/pkg): the install
+				// target is the package, not the whole scope dir
+				const target = singleFile ? own : path.join(extRoot, ...segs.slice(0, segs[0].startsWith("@") ? 2 : 1));
 				for (const f of pathForms(target)) {
 					(singleFile ? exact : prefixes).add(f);
 					extTargets.add(f);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.6.0",
+	"version": "0.6.1",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",