@erichll/pi-auto-review 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.13.0 - 2026-08-28
+
+- Add compatibility with `@gotgenes/pi-permission-system` 27.1 directional
+  `path_*` and `external_directory_*` surfaces while retaining the original
+  surface in authorization evidence, UI binding, logs, and policy audits.
+- Keep the permission-system peer range at `^27.0.0` so existing 27.x bare
+  `path` and `external_directory` integrations remain supported.
+
 ## 0.12.0 - 2026-08-27
 
 - Add the private policy audit

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
@@ -54,7 +54,7 @@
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.1",
     "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@gotgenes/pi-permission-system": "^27.0.0",
+    "@gotgenes/pi-permission-system": "27.1.0",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }

package/src/index.ts

@@ -72,6 +72,7 @@ import {
   type PolicyAuditArguments,
   type PolicyAuditConfig,
 } from "./policy-audit/index.ts";
+import { isPathSurface, pathSurfaceInfo } from "./path-surfaces.ts";
 export { parseHostPort };
 
 type ReasoningLevel =
@@ -697,6 +698,7 @@ function protectedWriteHardDeny(
 ): { rule: string; reason: string } | undefined {
   const isWrite =
     request.surface === "filesystem-write" ||
+    pathSurfaceInfo(request.surface)?.effect === "write" ||
     /\b(?:write|create|delete|rename|chmod|chown)\b/i.test(
       request.operation,
     );
@@ -773,7 +775,7 @@ function sessionConfig(
 }
 
 function boundedRequest(surface: string): boolean {
-  return BOUNDED_SURFACES.has(surface);
+  return isPathSurface(surface);
 }
 
 type PermissionsService = {
@@ -796,7 +798,7 @@ function boundaryRequest(
   const surface = evidence.surface;
   const value =
     evidence.resolvedPath ??
-    (surface === "path" || surface === "external_directory"
+    (isPathSurface(surface)
       ? evidence.path
       : evidence.command ?? evidence.value ?? evidence.destination) ??
     details.skillName ??

package/src/path-surfaces.ts

@@ -0,0 +1,31 @@
+export type PathSurfaceFamily = "path" | "external_directory";
+export type PathSurfaceEffect = "read" | "write";
+
+export type PathSurfaceInfo = {
+  family: PathSurfaceFamily;
+  effect?: PathSurfaceEffect;
+};
+
+const PATH_SURFACES: Readonly<Record<string, PathSurfaceInfo>> = Object.freeze({
+  path: Object.freeze({ family: "path" }),
+  path_read: Object.freeze({ family: "path", effect: "read" }),
+  path_write: Object.freeze({ family: "path", effect: "write" }),
+  external_directory: Object.freeze({ family: "external_directory" }),
+  external_directory_read: Object.freeze({
+    family: "external_directory",
+    effect: "read",
+  }),
+  external_directory_write: Object.freeze({
+    family: "external_directory",
+    effect: "write",
+  }),
+});
+
+/** Return metadata only for permission-system's six explicit path surfaces. */
+export function pathSurfaceInfo(surface: unknown): PathSurfaceInfo | undefined {
+  return typeof surface === "string" ? PATH_SURFACES[surface] : undefined;
+}
+
+export function isPathSurface(surface: unknown): boolean {
+  return pathSurfaceInfo(surface) !== undefined;
+}

package/src/policy-audit/classifier.ts

@@ -1,5 +1,6 @@
 import { homedir, tmpdir } from "node:os";
 import { isAbsolute, relative, resolve } from "node:path";
+import { pathSurfaceInfo } from "../path-surfaces.ts";
 
 export type PolicyAuditRisk =
   | "read_only"
@@ -44,6 +45,10 @@ const KNOWN_SURFACES = new Set([
   "ls",
   "path",
   "external_directory",
+  "path_read",
+  "path_write",
+  "external_directory_read",
+  "external_directory_write",
   "skill",
   "mcp",
   "network",
@@ -208,11 +213,12 @@ export function classifyPermission(surfaceValue: unknown, value: unknown, cwd: s
     return { ...classified, surface: rawSurface || "bash" };
   }
   const surface = KNOWN_SURFACES.has(rawSurface) ? rawSurface : "custom_tool";
-  if (["path", "external_directory", "read", "write", "edit"].includes(surface)) {
+  const pathSurface = pathSurfaceInfo(surface);
+  if (pathSurface || ["read", "write", "edit"].includes(surface)) {
     const pathClass = classifyPath(value, cwd);
-    const risk = surface === "read"
+    const risk = pathSurface?.effect === "read" || surface === "read"
       ? "read_only"
-      : surface === "write" || surface === "edit"
+      : pathSurface?.effect === "write" || surface === "write" || surface === "edit"
         ? "workspace_mutation"
         : "unknown";
     return { surface, signature: `<${surface}>`, bashCategory: "not_bash", risk, pathClass, features: [] };

package/src/policy.ts

@@ -1,3 +1,5 @@
+import { isPathSurface } from "./path-surfaces.ts";
+
 export type RiskLevel = "low" | "medium" | "high" | "critical";
 
 export type ModelDecision = {
@@ -327,7 +329,7 @@ export function normalizePermissionEvidence(
     "unknown";
   const value = nonEmptyString(details.value);
   const isBash = surface === "bash" || surface === "bash_escalated";
-  const isPath = surface === "path" || surface === "external_directory";
+  const isPath = isPathSurface(surface);
   const command =
     nonEmptyString(details.command) ??
     parsedPreviewCommand(details.toolInputPreview) ??

package/src/ui-auto-confirm.ts

@@ -2,6 +2,7 @@ import type {
   ExtensionContext,
   ExtensionUIContext,
 } from "@earendil-works/pi-coding-agent";
+import { pathSurfaceInfo } from "./path-surfaces.ts";
 
 type UiCustom = ExtensionUIContext["custom"];
 
@@ -61,7 +62,8 @@ export class PermissionUiAutoConfirmer {
 
   stage(requestId: string, surface: string): boolean {
     this.pruneExpired();
-    if (!this.enabledSurfaces().includes(surface)) return false;
+    const info = pathSurfaceInfo(surface);
+    if (!info || !this.enabledSurfaces().includes(info.family)) return false;
     this.pending.set(requestId, {
       surface,
       expiresAt: Date.now() + this.pendingTtlMs,
@@ -84,10 +86,14 @@ export class PermissionUiAutoConfirmer {
     }
     this.pending.delete(event.requestId);
 
-    if (!this.enabledSurfaces().includes(pending.surface)) return;
+    const info = pathSurfaceInfo(pending.surface);
+    if (!info || !this.enabledSurfaces().includes(info.family)) return;
     // Top-level event.surface is the display tool name (e.g. bash), not the
     // gate. Only request.surface is comparable to the staged allow.
     if (event.gateSurface && event.gateSurface !== pending.surface) return;
+    // Directional approvals cannot safely fall back to a legacy payload that
+    // omits request.surface: read and write members share the same family.
+    if (!event.gateSurface && info.effect) return;
     this.settleActiveForConflict();
 
     const attempt: PromptAttempt = {