@gotgenes/pi-permission-model-judge 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [1.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-model-judge-v1.1.1...pi-permission-model-judge-v1.1.2) (2026-07-22)
+
+
+### Bug Fixes
+
+* **pi-permission-model-judge:** review typo paths embedded in bash commands ([#630](https://github.com/gotgenes/pi-packages/issues/630)) ([782c83d](https://github.com/gotgenes/pi-packages/commit/782c83d36d5d279c4932be315b9e78aae43ccb26))
+
+
+### Documentation
+
+* **pi-permission-model-judge:** note bash-command paths are reviewed ([58a82e8](https://github.com/gotgenes/pi-packages/commit/58a82e8ca7a0df5552b767099004afc83e53be55))
+
 ## [1.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-model-judge-v1.1.0...pi-permission-model-judge-v1.1.1) (2026-07-22)
 
 

package/README.md

@@ -20,6 +20,8 @@ The reviewer runs a short, cheap decision on each ask and defers at the first mi
 3. The path matches one of your `typoPatterns` (otherwise defer — no model call).
 4. The model confirms the typo and returns a teaching reason (`deny`), or is unsure (`defer`).
 
+The candidate path comes from a file tool's path argument (`read`/`edit`/`write`) or from an external path referenced inside a `bash` command — a typo path in `cat …/pi-permission-system/packages/pi-permission-system/README.md` is reviewed the same way as one passed to `read`.
+
 It is fail-safe by construction: a missing model, invalid config, model timeout, unparseable reply, or an unsure verdict all resolve to `defer`.
 Deferring means the ask falls through to the normal permission prompt — this extension only ever *removes* a hand-denial, never grants access (it emits no `allow`).
 

package/docs/configuration.md

@@ -55,6 +55,7 @@ The reviewer forces the model to call a single `report_verdict` tool, so the ver
 ### `typoPatterns`
 
 Each string is compiled with `new RegExp(pattern)` (no flags) and tested against the candidate path.
+The candidate path is a file tool's path argument (`read`/`edit`/`write`) or an external path referenced inside a `bash` command — both surfaces are matched the same way.
 Only a path that matches at least one pattern is sent to the model — this is the cost gate that keeps the reviewer from calling the model on every ask.
 An invalid regular expression is skipped and recorded in the debug log (`model_judge.invalid_patterns`).
 An empty list (the default) matches nothing, so the reviewer defers everything.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-model-judge",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Deny-first typo-path model judge — a pi-permission-system Authorizer chain link",
   "type": "module",
   "imports": {

package/src/typo-reviewer.ts

@@ -91,20 +91,29 @@ export function createTypoReviewer(
       return { kind: "defer" };
     }
     const { requestId } = details;
-    const path = pathOf(details);
-    if (path === undefined) {
+    const candidates = candidatePathsOf(details);
+    if (candidates.length === 0) {
       log.debug(SHORT_CIRCUIT_EVENT, { requestId, reason: "no-path" });
       return { kind: "defer" };
     }
-    const matchedPattern = matchTypoPattern(path, compiledFor(config, log));
-    if (matchedPattern === undefined) {
+    const compiled = compiledFor(config, log);
+    let matched: { path: string; matchedPattern: string } | undefined;
+    for (const candidate of candidates) {
+      const pattern = matchTypoPattern(candidate, compiled);
+      if (pattern !== undefined) {
+        matched = { path: candidate, matchedPattern: pattern };
+        break;
+      }
+    }
+    if (matched === undefined) {
       log.debug(SHORT_CIRCUIT_EVENT, {
         requestId,
-        path,
+        path: candidates[0],
         reason: "pattern-miss",
       });
       return { kind: "defer" };
     }
+    const { path, matchedPattern } = matched;
 
     const modelId = `${config.provider}/${config.model}`;
     const base: DecisionBase = { requestId, path, matchedPattern, modelId };
@@ -177,9 +186,29 @@ function surfaceOf(details: PromptPermissionDetails): string | undefined {
   return details.accessIntent?.surface ?? details.surface ?? undefined;
 }
 
-/** The candidate path — `path` for a local ask, `value` for a forwarded one. */
-function pathOf(details: PromptPermissionDetails): string | undefined {
-  return details.path ?? details.value ?? undefined;
+/**
+ * Candidate paths to test against the typo patterns, most authoritative first.
+ *
+ * `accessIntent.matchValues` is the raising gate's authoritative path alias set
+ * (absolute ∪ cwd-relative ∪ canonical) — present for both file-tool and
+ * `bash` external_directory asks, and the only place a `bash`-surfaced path
+ * appears (the gate sets `command`/`accessIntent`, never `path`). `path` and
+ * `value` are fallbacks for a details bag without `accessIntent` (an older
+ * forwarded request or a hand-built local ask). `value` is last because a
+ * forwarded `bash` ask's display value is the command string, not a path.
+ */
+function candidatePathsOf(details: PromptPermissionDetails): string[] {
+  const seen = new Set<string>();
+  for (const value of details.accessIntent?.matchValues ?? []) {
+    seen.add(value);
+  }
+  if (details.path !== undefined) {
+    seen.add(details.path);
+  }
+  if (details.value != null) {
+    seen.add(details.value);
+  }
+  return [...seen];
 }
 
 /**