@gotgenes/pi-permission-system 20.5.0 → 20.7.0

package/src/handlers/gates/bash-path.ts

@@ -4,7 +4,6 @@ import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
-import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
 import { formatPathAskPrompt } from "./path";
@@ -20,22 +19,22 @@ import type { ToolCallContext } from "./types";
  * restrictive result, while prompts, logs, and session approvals use the raw
  * token.
  *
- * Returns `null` when the gate does not apply (tool is not bash, no command,
- * no tokens extracted, or all tokens evaluate to `allow`).
+ * Returns `null` when the gate does not apply (not a shell invocation, no
+ * command, no tokens extracted, or all tokens evaluate to `allow`).
  * Returns a `GateBypass` when all tokens are session-covered.
  * Returns a `GateDescriptor` for the most restrictive token needing a check.
+ *
+ * The shell command (native `bash` or an aliased shell tool) is read from the
+ * injected `BashProgram`, which owns the source text it was parsed from, so
+ * this gate does not re-derive the input field name (#574).
  */
 export function describeBashPathGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
 ): GateResult {
-  if (tcc.toolName !== "bash") return null;
-
-  const command = getNonEmptyString(toRecord(tcc.input).command);
-  if (!command) return null;
-
   if (!bashProgram) return null;
+  const command = bashProgram.commandText();
 
   const candidates = bashProgram.pathRuleCandidates();
   if (candidates.length === 0) return null;

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,7 +1,11 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { getPathBearingToolPath } from "#src/access-intent/tool-input-path";
-import { classifyToolKind } from "#src/access-intent/tool-kind";
+import {
+  resolveShellInvocation,
+  type ShellInvocation,
+} from "#src/access-intent/tool-kind";
+import type { ShellToolsConfig } from "#src/config-schema";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
@@ -12,7 +16,6 @@ import {
   type ToolPreviewFormatterOptions,
 } from "#src/tool-preview-formatter";
 import type { PathRuleTokenMatcher, PermissionCheckResult } from "#src/types";
-import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { resolveBashCommandCheck } from "./bash-command";
 import { describeBashExternalDirectoryGate } from "./bash-external-directory";
 import { describeBashPathGate } from "./bash-path";
@@ -43,6 +46,12 @@ export interface ToolCallGateInputs {
   getToolPreviewLimits(): ToolPreviewFormatterOptions;
   /** The session's path normalizer (platform + cwd baked in). */
   getPathNormalizer(): PathNormalizer;
+  /**
+   * The configured shell-tool aliases (`shellTools`), or `undefined` when none
+   * are set. Consulted by {@link resolveShellInvocation} so an aliased shell
+   * tool is gated through the bash stack at parity with native `bash` (#574).
+   */
+  getShellToolAliases(): ShellToolsConfig | undefined;
   /**
    * Predicate deciding whether a bare bash token should be promoted into the
    * `path` rule-candidate surface (#509), scoped to the given agent.
@@ -73,20 +82,24 @@ export class ToolCallGatePipeline {
     tcc: ToolCallContext,
     runner: GateRunner,
   ): Promise<GateOutcome> {
-    // Parse the bash command exactly once per evaluate; the three bash gates
-    // share this single BashProgram instead of each re-parsing (#308).
-    const command = getNonEmptyString(toRecord(tcc.input).command);
+    // Resolve the shell invocation once: native `bash` and any tool recorded in
+    // `shellTools` both yield a command (+ optional workdir); every other tool
+    // yields null (#574). The three bash gates then share the single BashProgram
+    // parsed from that command instead of each re-parsing (#308).
+    const shell = resolveShellInvocation(
+      tcc.toolName,
+      tcc.input,
+      this.inputs.getShellToolAliases(),
+    );
     const normalizer = this.inputs.getPathNormalizer();
-    const bashProgram =
-      classifyToolKind(tcc.toolName) === "bash" && command
-        ? await BashProgram.parse(
-            command,
-            normalizer,
-            this.inputs.getPromotablePathTokenMatcher(
-              tcc.agentName ?? undefined,
-            ),
-          )
-        : null;
+    const bashProgram = shell?.command
+      ? await BashProgram.parse(
+          shell.command,
+          normalizer,
+          this.inputs.getPromotablePathTokenMatcher(tcc.agentName ?? undefined),
+          { workdir: shell.workdir },
+        )
+      : null;
 
     const formatter = new ToolPreviewFormatter(
       this.inputs.getToolPreviewLimits(),
@@ -115,8 +128,8 @@ export class ToolCallGatePipeline {
       () => {
         const { toolCheck, accessPath } = this.resolvePerToolCheck(
           tcc,
+          shell,
           bashProgram,
-          command,
           normalizer,
         );
         const toolDescriptor = describeToolGate(
@@ -124,6 +137,7 @@ export class ToolCallGatePipeline {
           toolCheck,
           formatter,
           accessPath,
+          shell,
         );
         toolDescriptor.preCheck = toolCheck;
         return toolDescriptor;
@@ -156,18 +170,31 @@ export class ToolCallGatePipeline {
    */
   private resolvePerToolCheck(
     tcc: ToolCallContext,
+    shell: ShellInvocation | null,
     bashProgram: BashProgram | null,
-    command: string | null,
     normalizer: PathNormalizer,
   ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
-    if (classifyToolKind(tcc.toolName) === "bash" && bashProgram) {
+    if (shell) {
+      if (bashProgram) {
+        return {
+          toolCheck: resolveBashCommandCheck(
+            bashProgram.commandText(),
+            bashProgram.commands(),
+            tcc.agentName ?? undefined,
+            this.resolver,
+          ),
+        };
+      }
+      // A shell invocation whose command did not parse (e.g. empty) still
+      // resolves on the `bash` surface, so an aliased tool never falls through
+      // to its own extension-tool surface.
       return {
-        toolCheck: resolveBashCommandCheck(
-          command ?? "",
-          bashProgram.commands(),
-          tcc.agentName ?? undefined,
-          this.resolver,
-        ),
+        toolCheck: this.resolver.resolve({
+          kind: "tool",
+          surface: "bash",
+          input: { command: shell.command },
+          agentName: tcc.agentName ?? undefined,
+        }),
       };
     }
 

package/src/handlers/gates/tool.ts

@@ -1,7 +1,10 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import { PATH_BEARING_TOOLS } from "#src/access-intent/path-surfaces";
 import { getPathBearingToolPath } from "#src/access-intent/tool-input-path";
-import { classifyToolKind } from "#src/access-intent/tool-kind";
+import {
+  classifyToolKind,
+  type ShellInvocation,
+} from "#src/access-intent/tool-kind";
 import { suggestSessionPattern } from "#src/pattern-suggest";
 import { formatAskPrompt } from "#src/permission-prompts";
 import { SessionApproval } from "#src/session-approval";
@@ -20,11 +23,11 @@ import type { ToolCallContext } from "./types";
  * others (or a path-bearing tool with no path) → catch-all wildcard.
  */
 function deriveSuggestionValue(
-  tcc: ToolCallContext,
+  toolName: string,
   check: PermissionCheckResult,
   accessPath?: AccessPath,
 ): string {
-  switch (classifyToolKind(tcc.toolName)) {
+  switch (classifyToolKind(toolName)) {
     case "bash":
       return check.command ?? "";
     case "mcp":
@@ -45,7 +48,14 @@ export function describeToolGate(
   check: PermissionCheckResult,
   formatter: ToolPreviewFormatter,
   accessPath?: AccessPath,
+  shell?: ShellInvocation | null,
 ): GateDescriptor {
+  // A shell invocation (native `bash` or an aliased shell tool) is gated on the
+  // `bash` surface — its session rule, decision value, and suggestion are
+  // bash-shaped — while the invoked tool name is preserved in the prompt and
+  // review log so a user sees which tool actually ran (#574).
+  const gateSurface = shell ? "bash" : tcc.toolName;
+
   const permissionLogContext = formatter.getPermissionLogContext(
     check,
     tcc.input,
@@ -54,8 +64,8 @@ export function describeToolGate(
 
   // Compute session approval suggestion for the "for this session" option.
   const suggestion = suggestSessionPattern(
-    tcc.toolName,
-    deriveSuggestionValue(tcc, check, accessPath),
+    gateSurface,
+    deriveSuggestionValue(gateSurface, check, accessPath),
   );
 
   const askMessage = formatAskPrompt(
@@ -66,7 +76,7 @@ export function describeToolGate(
   );
 
   return {
-    surface: tcc.toolName,
+    surface: gateSurface,
     input: tcc.input,
     denialContext: {
       kind: "tool",
@@ -95,9 +105,9 @@ export function describeToolGate(
       ...permissionLogContext,
     },
     decision: {
-      surface: tcc.toolName,
+      surface: gateSurface,
       value: deriveDecisionValue(
-        tcc.toolName,
+        gateSurface,
         check,
         getPathBearingToolPath(tcc.toolName, tcc.input) ?? undefined,
       ),

package/src/index.ts

@@ -8,7 +8,7 @@ import {
   type ServingPolicy,
 } from "./authority/forwarded-request-server";
 import { ForwardingManager } from "./authority/forwarding-manager";
-import { requestPermissionDecisionFromUi } from "./authority/permission-dialog";
+import { requestPermissionDecision } from "./authority/permission-prompt-component";
 import { PermissionPrompter } from "./authority/permission-prompter";
 import { SubagentDetection } from "./authority/subagent-detection";
 import { subscribeSubagentLifecycle } from "./authority/subagent-lifecycle-events";
@@ -100,7 +100,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const authorizerSelection = new AuthorizerSelection({
     detection: subagentDetection,
     events: pi.events,
-    requestPermissionDecisionFromUi,
+    getPromptPreferences: () => ({
+      doublePressToConfirm: configStore.current().doublePressToConfirm,
+    }),
+    requestPermissionDecision,
     forwardingDir: paths.forwardingDir,
     registry: subagentRegistry,
     logger,

package/src/permission-session.ts

@@ -5,6 +5,7 @@ import {
   getActiveAgentNameFromSystemPrompt,
 } from "./active-agent";
 import type { AuthorizerSelectionLifecycle } from "./authority/authorizer-selection";
+import type { ShellToolsConfig } from "./config-schema";
 import type { SessionConfigStore } from "./config-store";
 import type { PermissionSystemExtensionConfig } from "./extension-config";
 import type { ExtensionPaths } from "./extension-paths";
@@ -205,6 +206,16 @@ export class PermissionSession implements ToolCallGateInputs {
     return resolveToolPreviewLimits(this.config);
   }
 
+  /**
+   * The configured shell-tool aliases (`shellTools`), mapping a non-`bash` tool
+   * name to the input arguments holding its command and optional working
+   * directory. `undefined` when no aliases are configured. Consumed by the
+   * gate pipeline's {@link resolveShellInvocation} consult (#574).
+   */
+  getShellToolAliases(): ShellToolsConfig | undefined {
+    return this.config.shellTools;
+  }
+
   // ── Path normalization ────────────────────────────────────────────────
 
   /**