[Update] bulk update

common/.pi/agent/extensions/protected-paths.ts

@@ -0,0 +1,58 @@
+/**
+ * Protected Paths Extension
+ *
+ * Blocks write and edit operations to protected paths.
+ *
+ * Adapted from pi's bundled `examples/extensions/protected-paths.ts`. Upstream ships a
+ * three-entry demo list (.env, .git/, node_modules/); the list below names the files
+ * that actually matter in this dotfiles tree — the ones holding secrets, and the git
+ * metadata the agent has no business rewriting.
+ *
+ * Scope, so this isn't over-trusted: it guards against the *model* calling write/edit.
+ * It cannot stop pi's own `/login`, which rewrites auth.json with the literal key —
+ * that is why auth.json is gitignored and auth.json.example is the tracked copy.
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+
+export default function (pi: ExtensionAPI) {
+	const protectedPaths = [
+		// Secrets. `secrets.fish` holds $DUSKADIY_API_KEY; auth.json is pi's own
+		// credential map and must keep $VAR references rather than literals.
+		"secrets.fish",
+		"auth.json",
+		".env",
+		"fish_variables",
+
+		// Credentials outside the repo.
+		".ssh/",
+		".gnupg/",
+		".aws/",
+		".netrc",
+
+		// Repo plumbing and vendored trees — never hand-edited.
+		".git/",
+		"node_modules/",
+	];
+
+	pi.on("tool_call", async (event, ctx) => {
+		if (event.toolName !== "write" && event.toolName !== "edit") {
+			return undefined;
+		}
+
+		const path = event.input.path as string;
+		// Substring match, like upstream: cheap, and these names are distinctive enough.
+		// Note `auth.json.example` is intentionally caught too — it is a tracked file
+		// whose whole job is to contain no secret, so an agent rewrite is worth a look.
+		const isProtected = protectedPaths.some((p) => path.includes(p));
+
+		if (isProtected) {
+			if (ctx.hasUI) {
+				ctx.ui.notify(`Blocked write to protected path: ${path}`, "warning");
+			}
+			return { block: true, reason: `Path "${path}" is protected` };
+		}
+
+		return undefined;
+	});
+}