fix(pi): tune command footgun policy

Author: edmundmiller

config/pi/pi-permissions.jsonc

@@ -45,6 +45,11 @@
     "*deploy-rs*": "deny",
     "*nix run .#deploy-rs*": "deny",
 
+    // Dangerous commands are hard blocks: they bypass safety rails, mutate host
+    // state, or weaken repo integrity in ways an agent should not choose.
+    // Foot-guns are also hard blocks, but for a different reason: they are
+    // likely to hang, open an interactive editor, or leave the session wedged.
+
     // Keep hook/signing enforcement in the same command policy system.
     "*--no-verify*": "deny",
     "*--no-gpg-sign*": "deny",
@@ -60,6 +65,22 @@
     "*HUSKY=0*": "deny",
     "*PRE_COMMIT_ALLOW_NO_CONFIG=*": "deny",
 
+    // VCS foot-guns: these commonly open an editor or require an interactive
+    // terminal. Agents should use non-interactive forms (`jj describe -m`,
+    // `git commit -m`, explicit sequence-editor/editor env) or ask in chat.
+    "*git rebase -i*": "deny",
+    "*git rebase --interactive*": "deny",
+    "*git -c sequence.editor=: rebase -i*": "allow",
+    "*git -c sequence.editor=true rebase -i*": "allow",
+    "*GIT_SEQUENCE_EDITOR=:*git rebase -i*": "allow",
+    "*GIT_SEQUENCE_EDITOR=true*git rebase -i*": "allow",
+    "*GIT_EDITOR=vim*git rebase*": "deny",
+    "*GIT_EDITOR=nvim*git rebase*": "deny",
+    "*GIT_SEQUENCE_EDITOR=vim*git rebase*": "deny",
+    "*GIT_SEQUENCE_EDITOR=nvim*git rebase*": "deny",
+    "git commit": "deny",
+    "*&& git commit": "deny",
+
     // Never let an agent reboot/power off a host directly. Require the human to do it
     // or use a guarded deployment workflow that owns rollback semantics.
     "*sudo reboot*": "deny",

packages/pi-packages/pi-command-policy-bridge/README.md

@@ -17,4 +17,9 @@ For supported tool calls, the extension extracts the embedded command and evalua
 - `allow` lets the tool call proceed
 - no matching rule allows the tool call
 
-This package is intentionally a deny-list guardrail, not an approval system or LLM danger classifier.
+This package is intentionally a deny-list guardrail, not an approval system or LLM danger classifier. If a command is not explicitly denied, it runs without prompting.
+
+The deny list can include both:
+
+- dangerous commands: bypass safety rails, mutate host state, or weaken repo integrity
+- foot-guns: likely to hang, open an interactive editor, or wedge the agent session

packages/pi-packages/pi-command-policy-bridge/index.test.ts

@@ -89,4 +89,29 @@ describe("pi-command-policy-bridge", () => {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  it("treats foot-gun rules as explicit denies, not prompts", () => {
+    const dir = mkdtempSync(join(tmpdir(), "pi-footgun-policy-test-"));
+    const previous = process.env.PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR;
+    process.env.PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR = dir;
+    writeFileSync(
+      join(dir, "pi-permissions.jsonc"),
+      '{ "bash": { "*": "allow", "*git rebase -i*": "deny" } }'
+    );
+
+    try {
+      const decision = evaluateToolGuard({
+        toolName: "bash",
+        input: { command: "git rebase -i HEAD~3" },
+      });
+      expect(decision.kind).toBe("deny");
+    } finally {
+      if (previous === undefined) {
+        delete process.env.PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR;
+      } else {
+        process.env.PI_PERMISSION_SYSTEM_POLICY_AGENT_DIR = previous;
+      }
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });