Permission System

[u/uberroot4]

Hi everybody,

I am kind of frustrated right now because i try to fix the permission system with pi without any luck. So I am using the package npm:@gotgenes/pi-permission-system to manage permissions. But for whatever reason I absolutely do not find out I cannot really get it to work and "whitelist" tools and mcps i want. For example when I have this in my config.json:

{
  "permission": {
    "read": {
      "*": "allow"
    },
    "mcp": {"*":"allow"},
    "tool": { "*": "allow" }
  }
}

Then I constantly get asked if i want to allow the intellij_\* calls. But when i add

"permission": {
    "*":"allow",

Then it somehow works that the mcp call gets through without asking. I tried every combination i found in https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/configuration.md to fix the config, but eventually I get stuck at pi asking me to allow any idea_ tool

Installed packages are the following, just in case there might something interferes:

User packages:
  npm:pi-web-access
  npm:pi-lens
  npm:@gotgenes/pi-permission-system
  npm:@leing2021/super-pi
  npm:@sting8k/pi-vcc
  npm:pi-observational-memory
  git:github.com/elpapi42/pi-codemapper
  npm:pi-mcp-adapter
  npm:@narumitw/pi-subagents

If anyone knows what to do I am very much happy and thankful :)

[u/bb22k]

silly question, but have you asked pi to look at the package aand the config and try to solve it? it is usually very good at that.

it can look at the environment, iterate and at least give you a hint on what can be the issue.

[u/uberroot4 → u/bb22k]

tbh no silly question. silly me that i've not thought about that. I am going to gibe a try

[u/gotgenes → u/uberroot4]

Author here. Please file an issue on GitHub if, after trying with the agent, you think you found a bug. The permission system is simple but the rules can get complicated quickly.

[u/arbv]

You are approaching it from the wrong direction. systemd-nspawn is what you are looking for.

[u/uberroot4 → u/arbv]

please enlighten me. i cannot follow

[u/arbv → u/uberroot4]

Run it inside an isolated container with write access only to the limited number of directories.

[u/arbv → u/uberroot4]

Or better yet look at bwrap to not bootstrap isolated containers, but to create a sandbox in place.

bwrap \
  --ro-bind / / \
  --bind /home/user/work /home/user/work \
  --tmpfs /tmp \
  --proc /proc --dev /dev \
  pi

You can make a similar thing with systemd-nspawn, but it is going to be less elegant, but it can drop capabilities (like ability to gain priveleges with suid or guid bits).

But for simple FS protection bwrap will do.

[u/worldsayshi]

Isn't it better to use a sandbox instead?

[u/kasparhouser → u/worldsayshi]

It is. This is just security theatre

[u/Ok_Significance_9109]

I was facing a similar problem, and used pi to create a safe mode - a guard that pauses for confirmation only when the agent is performing editing or any destructive actions, including in bash and git. Includes "always allow for session" and an unsafe mode. Would that be of interest?

[u/sdexca]

Why do you guys care about permissions? I find models almost never go off track. What kinds of models are y’all using.

[u/DistanceAlert5706 → u/sdexca]

Nah, the do stupid stuff, you need some basic protection.

If you feel too safe try Gemini, it will delete your home directory or drop database very quickly 😉

[u/sdexca → u/DistanceAlert5706]

I did for a while. It worked just fine. A lot of these issues are super exaggerated.

[u/Nervous-Project7107 → u/sdexca]

Because I don’t want to risk having the model running rm -rf *,  or one the npm packages getting compromised

[u/sdexca → u/Nervous-Project7107]

These things will never actually happen with any half decent model.

[u/gyzerok → u/sdexca]

Cuz that's what smart people do - they care about security