@gotgenes/pi-permission-system 27.1.0 → 27.1.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [27.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v27.1.0...pi-permission-system-v27.1.1) (2026-08-28)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** project glob-bearing bash path tokens to the path surfaces ([706c75d](https://github.com/gotgenes/pi-packages/commit/706c75da10d03c61ef0d53f9571d249b91986db5)), closes [#821](https://github.com/gotgenes/pi-packages/issues/821)
+
 ## [27.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v27.0.1...pi-permission-system-v27.1.0) (2026-08-27)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "27.1.0",
+  "version": "27.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/token-classification.ts

@@ -16,9 +16,17 @@
  * `docs/decisions/0009-bash-path-projection-completeness-contract.md`.
  *
  * All three classifiers share the private `rejectNonPathToken` predicate that
- * captures the six rejection cases common to them (the production clone this
+ * captures the five rejection cases common to them (the production clone this
  * module was extracted to eliminate).
  *
+ * None of them reads a token's glob or regex metacharacters. A shell bracket
+ * glob and a regex character class are spelled identically, so "contains a
+ * metacharacter" cannot decide path-hood — and it silently dropped tokens the
+ * shell really does expand into filesystem paths (`/etc/[p]asswd`,
+ * `rm -rf /tmp/tmp.*`, #821). What a pattern argument is instead settled by
+ * *position*: `PATTERN_FIRST_COMMANDS` in `token-collection.ts` skips a
+ * pattern-first command's inline pattern positional at collection time.
+ *
  * Both `classifyTokenAsPathCandidate` and `classifyTokenAsRuleCandidate` recognize
  * Windows drive-letter absolute paths (`C:/…`, `C:\…`) unconditionally on all
  * platforms. On POSIX the token resolves as a real in-CWD relative path and is
@@ -106,8 +114,8 @@ export function classifyTokenAsRuleCandidate(
  * *shape* name a path at all?
  *
  * It runs only the shared `rejectNonPathToken` prelude, so a flag,
- * env-assignment, URL, `@scope` token, or regex-shaped token is never a
- * candidate. Everything else is returned for the caller to probe.
+ * env-assignment, URL, or `@scope` token is never a candidate. Everything else
+ * is returned for the caller to probe.
  *
  * Deliberately consults no policy: candidacy is settled by the filesystem and
  * the decision by the ruleset, which keeps this module a pure shape function
@@ -137,19 +145,14 @@ const WINDOWS_DRIVE_PATH_PATTERN = /^[a-zA-Z]:[/\\]/;
  */
 const URL_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
 
-/**
- * Regex metacharacter sequences that are never found in real filesystem paths.
- * If a token contains any of these, it is almost certainly a regex pattern
- * (e.g. a grep argument) rather than a path.
- */
-const REGEX_METACHAR_PATTERN = /\.\*|\.\+|\\\||\\\(|\\\)|\[.*?\]|\^\//;
-
 /**
  * Shared rejection prelude: returns `true` when a token can never be a
  * filesystem path, regardless of which classifier is asking.
  *
  * Rejects: empty tokens, flags (leading `-`), env assignments (`FOO=/bar`),
- * URLs, `@scope/package` patterns, and regex metacharacter sequences.
+ * URLs, and `@scope/package` patterns. Each rules a token out by syntax; a
+ * glob or regex metacharacter does not, since the two are indistinguishable
+ * and the shell expands the former into real paths (#821).
  *
  * A bare `/` (or `//`, `///`) is NOT rejected: it denotes the filesystem root,
  * a deliberate external-directory access (`find /`, `ls /`), so it must reach
@@ -172,7 +175,5 @@ function rejectNonPathToken(token: string): boolean {
   // since it looks like an absolute-rooted path, not an npm scope.
   if (token.startsWith("@") && !token.startsWith("@/")) return true;
 
-  if (REGEX_METACHAR_PATTERN.test(token)) return true;
-
   return false;
 }