@gotgenes/pi-permission-system 14.0.0 → 14.0.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [14.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v14.0.0...pi-permission-system-v14.0.1) (2026-06-19)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** strip shell comment lines from bash commands before matching ([d045591](https://github.com/gotgenes/pi-packages/commit/d0455915d6d4ce50534884639e516a9e1ef38976))
+
 ## [14.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v13.2.0...pi-permission-system-v14.0.0) (2026-06-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "14.0.0",
+  "version": "14.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/bash-arity.ts

@@ -184,3 +184,27 @@ export function prefix(tokens: string[]): string[] {
   // Unknown command — default arity 1.
   return [tokens[0]];
 }
+
+/**
+ * Remove shell comment lines from a bash command string.
+ *
+ * A comment line is one whose first non-whitespace character is `#`. Agents
+ * frequently prepend descriptive comments before the real command
+ * (e.g. `"# Check debug logs\nfind ..."`); such prefixes defeat wildcard
+ * pattern matching and session-approval suggestions, which tokenize the
+ * leading text. Stripping comment lines lets matching operate on the actual
+ * command.
+ *
+ * The original command is never returned: when every line is a comment (or
+ * the input is blank) an empty string is returned, and each caller applies
+ * its own fallback.
+ *
+ * @param command - Raw bash command, possibly multi-line.
+ * @returns The command with comment lines removed and surrounding whitespace
+ *   trimmed, or an empty string when nothing meaningful remains.
+ */
+export function stripBashCommentLines(command: string): string {
+  const lines = command.split("\n");
+  const meaningful = lines.filter((line) => !/^\s*#/.test(line));
+  return meaningful.join("\n").trim();
+}

package/src/input-normalizer.ts

@@ -1,3 +1,4 @@
+import { stripBashCommentLines } from "./bash-arity";
 import { getNonEmptyString, toRecord } from "./common";
 import { createMcpPermissionTargets } from "./mcp-targets";
 import { getPathPolicyValues, PATH_BEARING_TOOLS } from "./path-utils";
@@ -92,9 +93,14 @@ export function normalizeInput(
   if (toolName === "bash") {
     const record = toRecord(input);
     const command = typeof record.command === "string" ? record.command : "";
+    // Strip leading shell comment lines so pattern matching operates on the
+    // actual command, not a `# description` prefix agents often prepend.
+    // Fall back to the raw command when stripping leaves nothing, so an
+    // all-comment command still evaluates against its literal text.
+    const matchValue = stripBashCommentLines(command) || command;
     return {
       surface: "bash",
-      values: [command],
+      values: [matchValue],
       resultExtras: { command },
     };
   }

package/src/pattern-suggest.ts

@@ -1,4 +1,4 @@
-import { prefix } from "./bash-arity";
+import { prefix, stripBashCommentLines } from "./bash-arity";
 import { PATH_BEARING_TOOLS } from "./path-utils";
 import { deriveApprovalPattern } from "./session-rules";
 
@@ -26,11 +26,15 @@ export interface SessionApprovalSuggestion {
 export function suggestBashPattern(command: string): string {
   const trimmed = command.trim();
   if (!trimmed) return "";
-  const tokens = trimmed.split(/\s+/);
-  if (tokens.length === 1) return trimmed;
+  // Strip leading shell comment lines so the suggestion is based on the
+  // actual command, not a `# description` prefix agents often prepend.
+  const stripped = stripBashCommentLines(trimmed);
+  if (!stripped) return "";
+  const tokens = stripped.split(/\s+/);
+  if (tokens.length === 1) return stripped;
   const meaningful = prefix(tokens);
   if (meaningful.length >= tokens.length) {
-    return `${trimmed}*`;
+    return `${stripped}*`;
   }
   return `${meaningful.join(" ")} *`;
 }

package/test/bash-arity.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { ARITY, prefix } from "#src/bash-arity";
+import { ARITY, prefix, stripBashCommentLines } from "#src/bash-arity";
 
 describe("ARITY dictionary", () => {
   it("is exported as a plain object", () => {
@@ -104,3 +104,41 @@ describe("prefix", () => {
     expect(prefix(["ls", "-la", "/tmp"])).toEqual(["ls"]);
   });
 });
+
+describe("stripBashCommentLines", () => {
+  it("removes a single leading comment line", () => {
+    expect(
+      stripBashCommentLines("# Check debug logs\nfind /home -type f"),
+    ).toBe("find /home -type f");
+  });
+
+  it("removes multiple leading comment lines", () => {
+    expect(
+      stripBashCommentLines("# Step 1\n# Step 2\ngit status --short"),
+    ).toBe("git status --short");
+  });
+
+  it("returns empty string when all lines are comments", () => {
+    expect(stripBashCommentLines("# just a comment")).toBe("");
+  });
+
+  it("returns empty string for blank input", () => {
+    expect(stripBashCommentLines("")).toBe("");
+  });
+
+  it("returns the command unchanged when no comment lines are present", () => {
+    expect(stripBashCommentLines("grep -rn foo src/")).toBe(
+      "grep -rn foo src/",
+    );
+  });
+
+  it("trims surrounding whitespace from the result", () => {
+    expect(stripBashCommentLines("\n\n  ls -la  \n")).toBe("ls -la");
+  });
+
+  it("treats indented comment lines as comments", () => {
+    expect(stripBashCommentLines("    # indented comment\necho hi")).toBe(
+      "echo hi",
+    );
+  });
+});

package/test/input-normalizer.test.ts

@@ -198,6 +198,34 @@ describe("normalizeInput — non-MCP surfaces", () => {
       expect(result.values).toEqual([""]);
       expect(result.resultExtras).toEqual({ command: "" });
     });
+
+    it("strips leading comment lines from values but keeps original in resultExtras", () => {
+      const cmd = "# Check debug logs\nfind /home -path '*debug*' -type f";
+      const result = normalizeInput("bash", { command: cmd }, []);
+      expect(result.values).toEqual(["find /home -path '*debug*' -type f"]);
+      expect(result.resultExtras).toEqual({ command: cmd });
+    });
+
+    it("strips multiple comment lines", () => {
+      const cmd = "# Step 1\n# Step 2\ngit status --short";
+      const result = normalizeInput("bash", { command: cmd }, []);
+      expect(result.values).toEqual(["git status --short"]);
+    });
+
+    it("preserves command when no comment lines present", () => {
+      const result = normalizeInput(
+        "bash",
+        { command: "grep -rn foo src/" },
+        [],
+      );
+      expect(result.values).toEqual(["grep -rn foo src/"]);
+    });
+
+    it("falls back to original when all lines are comments", () => {
+      const cmd = "# just a comment";
+      const result = normalizeInput("bash", { command: cmd }, []);
+      expect(result.values).toEqual(["# just a comment"]);
+    });
   });
 
   describe("path-bearing tools (read, write, edit, grep, find, ls)", () => {

package/test/pattern-suggest.test.ts

@@ -42,6 +42,30 @@ describe("suggestBashPattern", () => {
       "docker compose up *",
     );
   });
+
+  it("strips leading comment lines and suggests based on the actual command", () => {
+    expect(
+      suggestBashPattern(
+        "# Check debug logs\nfind /home -path '*debug*' -type f",
+      ),
+    ).toBe("find *");
+  });
+
+  it("strips multiple leading comment lines", () => {
+    expect(suggestBashPattern("# Step 1\n# Step 2\ngit status --short")).toBe(
+      "git status *",
+    );
+  });
+
+  it("returns empty for comment-only input", () => {
+    expect(suggestBashPattern("# just a comment")).toBe("");
+  });
+
+  it("handles mixed comment and command lines", () => {
+    expect(suggestBashPattern("# description\nrm -rf ./build; echo done")).toBe(
+      "rm *",
+    );
+  });
 });
 
 describe("suggestMcpPattern", () => {