Minor Changes 8d38528: Add terminate pattern option for permission-gate auto-deny rules (pi >= 0.84.1). Patterns can set terminate: true so a blocked call ends the agent's turn instead of yielding back to the model, preventing retry loops (e.g. sleep-polling). The turn only ends…
Minor Changes b9871b8: Add pathAccess.alwaysScope option ("local" | "global", default "local") controlling where "Allow … always" grants from the path-access prompt are persisted. The default keeps the current behavior of writing grants to the project config; set it to "global"…
Minor Changes ef9db31: Merge Permission Gate pattern arrays (patterns, allowedPatterns, autoDenyPatterns) across config scopes instead of a project config replacing global entries. Previously, defining one of these arrays in .pi/extensions/guardrails.json silently dropped every…
Patch Changes c6a7be7: Treat >& file as a file redirect instead of file-descriptor duplication. 101d143: Match session command grants against the exact command that was approved.
Minor Changes 92efa3d: Upgrade @aliou/sh to 0.3.1 and adapt the AST walker to its compound-redirect model. Fixed Heredoc command evasion (permission gate): a dangerous command placed after a heredoc body (cat <<EOF\n…\nEOF\nrm -rf …) was folded into the heredoc command's words b…
Minor Changes ffc7ca7: path-access: filter non-path bash arguments by shape and filesystem plausibility instead of per-command allow-lists. Arguments that look like paths but are not (Context7 library IDs such as /websites/apisix, Go package patterns like ./..., URLs, user@host:…
Minor Changes fff80de: Add correlated prompt lifecycle events and report active approval prompts to Herdr.
Minor Changes 9f0d736: Add a "decline and stop" option to the permission-gate prompt. Choosing it (press s, or select "Decline and stop" in the RPC fallback) blocks the dangerous command, emits a guardrails:action:blocked event with the new user-stop block source, and aborts the…
Minor Changes e012ea0: Migrate pathAccess.allowedPaths from a flat string[] (trailing-slash convention) to an explicit { kind, path } discriminated array. file grants match the exact path; directory grants match the directory and its descendants. Removes the implicit trailing-sl…
Minor Changes 0f4f478: Add guardrails:action:prompted event that fires when guardrails shows an interactive prompt to the user, before the user has responded. This complements the existing guardrails:action:blocked (post-decision) and guardrails:risk:detected events.
Minor Changes bd90cdf: Remove the permission gate command explainer and its subagent runtime. 5cef4eb: Split Guardrails into separate policy, path-access, and permission-gate extensions backed by shared config, generated JSON schema support, and refreshed README documentation. B…
Minor Changes 11e88c0: Fix dd pattern (if= to of=) and expand dangerous command detection Fixed the dd pattern to check for of= (output file) instead of if= (input file), as of= is the actual dangerous write operation. Also extracted dangerous command matchers to a separate modu…
Minor Changes 6356335: Add command-based onboarding for new users. add /guardrails:onboarding command and session-start hint when setup is pending replace auto-open onboarding with explicit overlay flow add onboarding completion marker for config compatibility and first-run stat…
Minor Changes 78f640d: Improve settings UX with guided policy creation and top-level examples tab. Add a real wizard flow for creating a new policy in settings (name, protection, patterns, review), then open the policy editor. Move policy examples into a dedicated top-level Exam…
Minor Changes e8eea2f: Redesign file protection from legacy envFiles to a new policies system with per-rule protection levels (noAccess, readOnly, none), add migration from old config fields, and replace the old env hook with a general policies hook. e762afc: Add opt-in LLM comm…