@gotgenes/pi-permission-system 32.0.0 → 32.0.1

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [32.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.0...pi-permission-system-v32.0.1) (2026-09-11)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** deny a forbidden command without prompting first ([b840196](https://github.com/gotgenes/pi-packages/commit/b8401962a9eeb012317771fc204c3fde8aa8a9a2)), closes [#899](https://github.com/gotgenes/pi-packages/issues/899)
+
+### Documentation
+
+* **pi-permission-system:** document that a deny on any layer needs no prompt ([e526e95](https://github.com/gotgenes/pi-packages/commit/e526e950ab6d957e6b5bc4d6f7740bcce2e35dca)), closes [#899](https://github.com/gotgenes/pi-packages/issues/899)
+
 ## [32.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v31.1.4...pi-permission-system-v32.0.0) (2026-09-11)
 
 

package/README.md

@@ -97,6 +97,7 @@ The trailing `*` is greedy and crosses subdirectory boundaries, so it allows eve
 
 Four layers compose with most-restrictive-wins: `path` (cross-cutting) → `external_directory` (CWD boundary) → per-tool patterns → `bash` command patterns.
 Because `ask` is more restrictive than `allow`, a `path` allow cannot loosen an `external_directory: ask` boundary — allow outside-CWD directories on `external_directory`.
+And because `deny` is more restrictive than `ask`, a `deny` on any layer refuses the call without prompting, naming the rule that decided.
 See [docs/configuration.md](docs/configuration.md) for the full recipe.
 
 Both path surfaces also carry a **direction**, so you can permit reading somewhere without permitting writing there: `path_read`, `path_write`, `external_directory_read`, and `external_directory_write`.

package/docs/configuration.md

@@ -559,6 +559,10 @@ Use `path` to **deny** sensitive files everywhere (`.env`, `~/.ssh/*`); use `ext
 Because the layers compose with most-restrictive-wins, a `path` allow cannot loosen an `external_directory: ask` boundary — `ask` is more restrictive than `allow`, so the prompt still fires.
 Adding `"~/.cargo/registry": "allow"` to the `path` surface therefore does **not** stop the outside-CWD prompt; put the rule on `external_directory` instead (see below).
 
+The same ordering runs the other way at the top of the scale.
+`deny` is more restrictive than `ask`, so a `deny` on any layer refuses the call **without prompting**, whichever layer carries the rule.
+A `bash: {"find / *": "deny"}` rule therefore suppresses the outside-CWD prompt that `find /` would otherwise raise, and the refusal names the `bash` rule that decided rather than the boundary that asked.
+
 Configs without a `path` key behave identically to before — the gate does not fire.
 When no `path` key is present, the universal fallback (`permission["*"]`) applies: `"*": "allow"` keeps the gate transparent, while `"*": "deny"` would deny all file access via every surface including `path`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "32.0.0",
+  "version": "32.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/handlers/gates/descriptor.ts

@@ -97,6 +97,81 @@ export interface GateBypass {
 /** Union of possible gate function return values. */
 export type GateResult = GateDescriptor | GateBypass | null;
 
+// ── Resolved-state readers ─────────────────────────────────────────────────
+
+/**
+ * The permission check a descriptor already carries, or `null` when it
+ * resolves nothing of its own.
+ *
+ * Every tool-call gate resolves its own state before the runner sees it —
+ * five of the six stamp a full `preCheck`, and the skill-read gate stamps the
+ * `preResolved` state it read off the matched skill entry. This is the one
+ * place that precedence is expressed, so the runner and the pre-emption
+ * predicate cannot answer it differently.
+ *
+ * A `null` answer is not "allow": it means the caller must resolve the
+ * descriptor itself.
+ */
+export function preResolvedCheckOf(
+  descriptor: GateDescriptor,
+): PermissionCheckResult | null {
+  if (descriptor.preCheck) {
+    return descriptor.preCheck;
+  }
+  if (descriptor.preResolved) {
+    return {
+      state: descriptor.preResolved.state,
+      toolName: descriptor.surface,
+      source: "tool",
+      origin: "builtin",
+    };
+  }
+  return null;
+}
+
+/**
+ * Whether this gate blocks without escalating, whatever the other gates say.
+ *
+ * A `deny` is absorbing: wherever it sits in the pipeline's order, the call is
+ * refused, so no other gate's answer — and no human's — can change the
+ * outcome. That is what makes running it first an ordering change rather than
+ * a semantic one, and it is why the same treatment is *not* extended to `ask`
+ * (#915): two asking gates ask two different questions.
+ *
+ * Subordinate to {@link GateRunner.runDescriptor}'s own precedence, which
+ * tests `source === "session"` before the deny/ask/allow gate is reached — a
+ * session-sourced check is allowed there, so it is not pre-emptive here.
+ * `SessionRules` records only allows, so that combination is unreachable
+ * today; the clause is kept so the predicate is correct on its own terms
+ * rather than by way of a distant invariant, and it errs toward today's
+ * behavior by declining to pre-empt.
+ *
+ * Yolo needs no clause: `resolveYoloGrant` matches an `allow` of origin
+ * `yolo` and an `ask`, never a `deny`.
+ */
+export function isUnconditionalDeny(gate: GateResult): boolean {
+  if (!isGateDescriptor(gate)) {
+    return false;
+  }
+  const check = preResolvedCheckOf(gate);
+  return check !== null && check.state === "deny" && check.source !== "session";
+}
+
+/**
+ * The gates in run order, with any unconditional deny moved to the front.
+ *
+ * A stable partition, so two denying gates keep their relative order (the
+ * earlier one still decides, exactly as before) and the remainder keeps its
+ * own. With no deny present the array is returned unchanged.
+ */
+export function orderDenyFirst(gates: GateResult[]): GateResult[] {
+  const denying = gates.filter((gate) => isUnconditionalDeny(gate));
+  if (denying.length === 0) {
+    return gates;
+  }
+  return [...denying, ...gates.filter((gate) => !isUnconditionalDeny(gate))];
+}
+
 // ── Type guard helpers ─────────────────────────────────────────────────────
 
 /** Check whether a GateResult is a GateBypass (early allow). */

package/src/handlers/gates/runner.ts

@@ -12,13 +12,12 @@ import {
 } from "#src/presentation/agent-renderer";
 import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
 import type { SessionApprovalRecorder } from "#src/session/session-approval-recorder";
-import type { PermissionCheckResult } from "#src/types";
 import type {
   DecisionEventFacts,
   GateDescriptor,
   GateResult,
 } from "./descriptor";
-import { isGateBypass } from "./descriptor";
+import { isGateBypass, preResolvedCheckOf } from "./descriptor";
 import { buildDecisionEvent, resolveYoloGrant } from "./helpers";
 import type { GateOutcome } from "./types";
 
@@ -89,25 +88,16 @@ export class GateRunner {
     agentName: string | null,
     requestId: string,
   ): Promise<GateOutcome> {
-    // 1. Resolve permission state — pre-check, pre-resolved, or via resolver
-    let check: PermissionCheckResult;
-    if (descriptor.preCheck) {
-      check = descriptor.preCheck;
-    } else if (descriptor.preResolved) {
-      check = {
-        state: descriptor.preResolved.state,
-        toolName: descriptor.surface,
-        source: "tool",
-        origin: "builtin",
-      };
-    } else {
-      check = this.resolver.resolve({
+    // 1. Resolve permission state — what the descriptor already carries, or
+    // via the resolver when it carries nothing.
+    const check =
+      preResolvedCheckOf(descriptor) ??
+      this.resolver.resolve({
         kind: "tool",
         surface: descriptor.surface,
         input: descriptor.input,
         agentName: agentName ?? undefined,
       });
-    }
 
     // The fields every review-log write for this gate shares, whatever the
     // resolution — built once so a field added here reaches all of them. The

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -18,7 +18,7 @@ import type { PermissionCheckResult } from "#src/types";
 import { resolveBashCommandCheck } from "./bash-command";
 import { describeBashExternalDirectoryGate } from "./bash-external-directory";
 import { describeBashPathGate } from "./bash-path";
-import type { GateResult } from "./descriptor";
+import { type GateResult, orderDenyFirst } from "./descriptor";
 import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
 import type { GateRunner } from "./runner";
@@ -62,7 +62,8 @@ export interface ToolCallGateInputs {
  * - `ToolPreviewFormatter` construction from `getToolPreviewLimits()`
  * - infrastructure-dir list from `getInfrastructureReadDirs()`
  * - all six gate producers in their prescribed order
- * - the run loop that returns the first block outcome, or allow
+ * - the run loop, which runs an unconditionally denying gate ahead of the
+ *   rest and returns the first block outcome, or allow
  */
 export class ToolCallGatePipeline {
   constructor(
@@ -141,8 +142,18 @@ export class ToolCallGatePipeline {
       },
     ];
 
+    // Produce every gate before running any of them, so an unconditional deny
+    // on a later gate is known before an earlier one suspends the call on an
+    // `ask` nobody's answer could change (#899). Producing is side-effect-free
+    // — all logging and event emission happens inside `runner.run` — and the
+    // loop below already produced every gate on any call it did not block.
+    const gates: GateResult[] = [];
     for (const produce of gateProducers) {
-      const outcome = await runner.run(await produce(), tcc.agentName);
+      gates.push(await produce());
+    }
+
+    for (const gate of orderDenyFirst(gates)) {
+      const outcome = await runner.run(gate, tcc.agentName);
       if (outcome.action === "block") {
         return outcome;
       }