@erichll/pi-auto-review 0.15.2 → 0.15.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.15.3 - 2026-09-03
+
+- Tolerate a single enclosing ```` ```json ```` or bare Markdown code fence
+  around reviewer decisions while preserving strict decision-schema
+  validation (fixes reviewer models that fence JSON despite the prompt,
+  notably when routed through Claude Code).
+- Verify compatibility with `@gotgenes/pi-permission-system` 30.2.0 and
+  31.0.0, widen the peer range through 31.x, and move the development baseline
+  to 31.0.0.
+- Keep permission-system 31 statement-operand audit classification aligned for
+  `for`/`select` word lists and `case` subjects without treating case patterns
+  as accessed paths.
+- Confirm that model auto-confirm stays one-shot and cannot select
+  permission-system 30.2's wider both-directions session grant.
+
 ## 0.15.2 - 2026-09-02
 
 - No behavior changes. Verified against `@gotgenes/pi-permission-system`

package/README.md

@@ -31,7 +31,8 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
 > **Prerequisite:** pi-auto-review is an authorizer inside
 > `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
 > install the permission system separately (once per machine) before this
-> extension. This release line supports permission-system 28.x and 29.x:
+> extension. This release line supports permission-system 29.3.0 through the
+> latest 31.x release:
 
 Node.js 22.13.0 or newer is required. Permission auditing uses Node's built-in
 `node:sqlite`; it does not require a SQLite CLI, system SQLite library, or npm
@@ -76,6 +77,12 @@ following recognized permission dialog. The bridge is request-ID-bound,
 expires after ten seconds, and is consumed once. Mode, component, request, or
 event-order mismatches leave the original human dialog in place.
 
+Permission-system 31.x also projects paths named directly by `for`/`select`
+word lists and `case` subjects onto the existing `path` and
+`external_directory` surfaces. Those additional requests follow the same
+bounded review and one-shot auto-confirm rules; no new surface is implicitly
+trusted.
+
 Automatic review stops for the current turn after three consecutive denials or
 ten denials in the last fifty reviews. An explicit denial tells the agent that
 automatic policy denied the request (not a human click), not to rephrase or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.15.2",
+  "version": "0.15.3",
   "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
@@ -49,12 +49,12 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.84.4",
     "@earendil-works/pi-coding-agent": "^0.84.4",
-    "@gotgenes/pi-permission-system": ">=28.0.0 <30.0.0"
+    "@gotgenes/pi-permission-system": ">=29.3.0 <32.0.0"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.4",
     "@earendil-works/pi-coding-agent": "^0.84.4",
-    "@gotgenes/pi-permission-system": "29.3.0",
+    "@gotgenes/pi-permission-system": "31.0.0",
     "@types/node": "^26.2.0",
     "typescript": "^6.0.3"
   }

package/src/policy-audit/classifier.ts

@@ -75,6 +75,62 @@ function shellTokens(command: string): string[] {
   return command.trim().split(/\s+/u);
 }
 
+function normalizedPathToken(token: string): string {
+  let value = token.replace(/^@/, "").replace(/[;)]+$/u, "");
+  if (
+    value.length >= 2 &&
+    ((value.startsWith("\"") && value.endsWith("\"")) ||
+      (value.startsWith("'") && value.endsWith("'")))
+  ) {
+    value = value.slice(1, -1);
+  }
+  return value;
+}
+
+function firstExplicitPathToken(tokens: readonly string[]): string | undefined {
+  return tokens
+    .map(normalizedPathToken)
+    .find((token) =>
+      token.startsWith("/") ||
+      token.startsWith("./") ||
+      token.startsWith("../") ||
+      token.startsWith("~/")
+    );
+}
+
+/**
+ * Recover the path-bearing statement operands added to permission-system 31.
+ * This remains deliberately conservative rather than pretending to be a shell
+ * parser: case-arm patterns are excluded, while the actual path gate's
+ * separate decision event still records paths found in arm/body commands.
+ */
+function statementOperandPathToken(
+  tokens: readonly string[],
+  index: number,
+): { handled: boolean; token?: string } {
+  const statement = tokens[index]?.replace(/^["']|["']$/gu, "");
+  if (statement !== "for" && statement !== "select" && statement !== "case") {
+    return { handled: false };
+  }
+  const inIndex = tokens.findIndex((token, tokenIndex) =>
+    tokenIndex > index && token === "in"
+  );
+  if (inIndex < 0) return { handled: true };
+  if (statement === "case") {
+    return {
+      handled: true,
+      token: firstExplicitPathToken(tokens.slice(index + 1, inIndex)),
+    };
+  }
+  const operands: string[] = [];
+  for (const token of tokens.slice(inIndex + 1)) {
+    if (token === "do") break;
+    operands.push(token);
+    if (/[;]$/u.test(token)) break;
+  }
+  return { handled: true, token: firstExplicitPathToken(operands) };
+}
+
 function executableIndex(tokens: readonly string[]): number {
   let index = 0;
   if (tokens[index] === "env") index++;
@@ -161,9 +217,10 @@ export function classifyBash(command: unknown, cwd: string): ClassifiedPermissio
     eligible: blocker === undefined,
     ...(blocker ? { blocker } : {}),
   } : undefined;
-  const pathToken = tokens.slice(index + 1)
-    .map((token) => token.replace(/^@/, ""))
-    .find((token) => token.startsWith("/") || token.startsWith("./") || token.startsWith("../") || token.startsWith("~/"));
+  const statementOperand = statementOperandPathToken(tokens, index);
+  const pathToken = statementOperand.handled
+    ? statementOperand.token
+    : firstExplicitPathToken(tokens.slice(index + 1));
   return {
     surface: "bash",
     signature: template ?? "<command>",

package/src/policy.ts

@@ -202,10 +202,20 @@ function exactKeys(
   );
 }
 
+// Some reviewer models (notably any routed through Claude Code, which always
+// markdown-fences JSON) wrap the decision object in a ```json ... ``` block
+// despite the prompt forbidding markdown. Strip a single enclosing fence before
+// parsing; the strict shape validation below is unchanged.
+function stripReviewerFence(text: string): string {
+  const t = text.trim();
+  const fenced = t.match(/^```(?:json)?\s*\n?([\s\S]*?)\n?```$/i);
+  return (fenced ? fenced[1] : t).trim();
+}
+
 export function parseDecision(text: string): ModelDecision {
   let value: unknown;
   try {
-    value = JSON.parse(text.trim());
+    value = JSON.parse(stripReviewerFence(text));
   } catch {
     throw new Error("reviewer returned non-JSON output");
   }