@gotgenes/pi-permission-system 32.0.5 → 32.0.6

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [32.0.6](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.5...pi-permission-system-v32.0.6) (2026-09-16)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** stop a removed prompt section from swallowing the prose after it ([af79199](https://github.com/gotgenes/pi-packages/commit/af79199ac42e6b09587bf0cbb256435a176660ab))
+* **pi-permission-system:** keep a custom system prompt's own tool and guideline sections ([7cce96a](https://github.com/gotgenes/pi-packages/commit/7cce96af106d4822799b4728ecf1432526a79ba1))
+* **pi-permission-system:** leave an unedited prompt region byte-identical ([1f1ce66](https://github.com/gotgenes/pi-packages/commit/1f1ce669d6d19d591da1262e89b3c919300b0f75))
+
+### Documentation
+
+* **pi-permission-system:** record the tool-surface removal boundary ([ebbb8f0](https://github.com/gotgenes/pi-packages/commit/ebbb8f07c77eaa22c45b83e2d43397770dde1054))
+* **pi-permission-system:** record the footerless-prompt edge in the tool-surface pass ([2aa7435](https://github.com/gotgenes/pi-packages/commit/2aa74353864cf648f802a8a63cbe5b1b141c27af))
+
 ## [32.0.5](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.4...pi-permission-system-v32.0.5) (2026-09-16)
 
 

package/docs/configuration.md

@@ -1178,7 +1178,8 @@ Additional behaviors:
 - On the turn a tool is restored, it is callable immediately but its `Available tools:` line reappears one turn later: pi builds the prompt parts an extension receives before the extension runs, so the restored tool has no one-line description to render until it is already active
 - A tool is removed only when every value under its surface resolves to `deny`; a surface with any reachable `allow` or `ask` pattern stays available (see [Tool Surfaces](#tool-surfaces))
 - The `Available tools:` and `Guidelines:` sections are **relocated** rather than edited in place: the copies pi wrote are removed, and this session's own are rendered at the end of the system prompt, after pi's `Current working directory:` footer.
-  Each session states its own tool surface, which is what keeps a subagent child's inherited prompt byte-identical to its parent's (see [ADR 0014](decisions/0014-tool-surface-is-node-local-prose.md)); the tool list moves to the end of the prompt for every session, whether or not anything is denied
+  Each session states its own tool surface, which is what keeps a subagent child's inherited prompt byte-identical to its parent's (see [ADR 0014](decisions/0014-tool-surface-is-node-local-prose.md)); the tool list moves to the end of the prompt for every session, whether or not anything is denied.
+  Only the copies pi wrote are removed: a custom system prompt (`.pi/SYSTEM.md`, `~/.pi/agent/SYSTEM.md`, `--system-prompt`) keeps its own text untouched, sections and all, because pi writes no tool surface of its own under one — so a prompt that lists tools itself is shown alongside this session's block rather than replaced by it.
 - The rendered sections follow pi's own rules: a tool is listed only when pi supplied a one-line description for it, and the guideline bullets are the allowed tools' own contributions around pi's built-in ones
 - The prompt is recomputed and returned on every turn but is stable across turns for a stable policy/agent, so the provider's prompt cache (tools + system prefix) is preserved rather than rewritten each turn.
   A policy change is an intentional cache transition, as a mid-session agent switch already is.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "32.0.5",
+  "version": "32.0.6",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/exposure/tool-surface-prompt.ts

@@ -10,9 +10,17 @@
  * differs from its parent's (#890).
  *
  * So the region is *relocated* rather than narrowed: the sections Pi wrote are
- * removed wherever they sit, and this node's own are rendered at the end of
- * the prompt, past everything a child inherits. Each session then states its
- * own tool surface and no session edits another's bytes.
+ * removed, and this node's own are rendered at the end of the prompt, past
+ * everything a child inherits. Each session then states its own tool surface
+ * and no session edits another's bytes.
+ *
+ * Removal is bounded to the text this package or Pi wrote. The prompt is split
+ * at Pi's `Current working directory:` footer, which it writes last and
+ * unconditionally: everything after it was appended by an extension, and
+ * everything before it is Pi's own preamble only when Pi did not build the
+ * prompt from a `customPrompt`. Under a custom prompt Pi writes no tool
+ * surface at all, so a section matched above the footer is a user's or another
+ * extension's — removing it destroyed their text (#919, #932).
  *
  * Rendering follows `buildSystemPrompt`'s own rules — a tool is listed only
  * when it has a snippet, and the guideline bullets are the allowed tools' own
@@ -28,6 +36,15 @@ export interface ToolSurfaceInputs {
   readonly toolSnippets: Readonly<Record<string, string>>;
   /** Guideline bullets each tool contributes, keyed by tool name. */
   readonly guidelinesByTool: ReadonlyMap<string, readonly string[]>;
+  /**
+   * Whether Pi wrote the prompt's preamble itself.
+   *
+   * False when Pi assembled the prompt from `customPrompt` — a user's
+   * SYSTEM.md, or a subagent child's assembled prompt — in which case Pi wrote
+   * no tool-surface sections and every line above its footer belongs to
+   * somebody else.
+   */
+  readonly piAuthoredPreamble: boolean;
 }
 
 type LineSection = {
@@ -46,6 +63,18 @@ const GUIDELINES_SECTION_HEADER = "Guidelines:";
  */
 const CUSTOM_TOOLS_FILLER_PREFIX = "In addition to the tools above";
 
+/** What Pi writes under `Available tools:` when no selected tool has a snippet. */
+const EMPTY_LIST_PLACEHOLDER = "(none)";
+
+/**
+ * The first line of the footer Pi writes last, in both of its branches.
+ *
+ * It is the boundary between what Pi assembled and what extensions appended
+ * after it — the same anchor `@gotgenes/pi-subagents` uses to find Pi's
+ * session-resolved tail.
+ */
+const PROMPT_FOOTER_PREFIX = "Current working directory: ";
+
 /** Pi's two unconditional guideline bullets, in the order it writes them. */
 const UNIVERSAL_GUIDELINES: readonly string[] = [
   "Be concise in your responses",
@@ -63,23 +92,69 @@ export function renderToolSurface(
   systemPrompt: string,
   inputs: ToolSurfaceInputs,
 ): string {
-  const lines = removeToolSurfaceSections(
-    normalizePrompt(systemPrompt).split("\n"),
-  );
-  const body = collapseExtraBlankLines(lines.join("\n"));
+  const lines = normalizePrompt(systemPrompt).split("\n");
+  const tailStart = extensionTailStart(lines);
+  const body = [
+    settleRegion(lines.slice(0, tailStart), inputs.piAuthoredPreamble),
+    settleRegion(lines.slice(tailStart), true),
+  ]
+    .filter((region) => region.length > 0)
+    .join("\n")
+    .trimEnd();
   const block = renderToolSurfaceBlock(inputs);
 
   return body.length > 0 ? `${body}\n\n${block}` : block;
 }
 
+/**
+ * Where the text extensions appended begins: the line after Pi's footer, or
+ * the end of the prompt when nothing downstream left one.
+ *
+ * The last footer is Pi's own — it appends one after everything it assembled,
+ * so a line of the same shape in a custom prompt is always above it.
+ *
+ * Accepted edge: a prompt carrying no footer at all is treated as all head, so
+ * a block appended to *that* prompt cannot be found and replaced, and a custom
+ * preamble would collect a second one. Pi writes the footer last and in both
+ * branches, so reaching this needs a downstream rewrite of Pi's whole output —
+ * which has already broken `@gotgenes/pi-subagents`' identity anchor, since it
+ * reads the same line.
+ */
+function extensionTailStart(lines: readonly string[]): number {
+  const footerAt = lines.findLastIndex((line) =>
+    line.startsWith(PROMPT_FOOTER_PREFIX),
+  );
+  return footerAt === -1 ? lines.length : footerAt + 1;
+}
+
+/**
+ * One region's surviving text: its sections removed, when they are ours to
+ * remove.
+ *
+ * Blank runs are collapsed only where a removal opened one, so a region this
+ * pass took nothing out of is returned exactly as it arrived rather than
+ * reflowed by a pass that had nothing to do with it.
+ */
+function settleRegion(
+  lines: readonly string[],
+  removalAllowed: boolean,
+): string {
+  if (!removalAllowed) {
+    return lines.join("\n");
+  }
+  const kept = removeToolSurfaceSections(lines);
+  const text = kept.join("\n");
+  return kept.length === lines.length ? text : collapseExtraBlankLines(text);
+}
+
 /**
  * Remove the `Available tools:` and `Guidelines:` sections, and the filler
- * sentence between them.
+ * sentence between them, from one region.
  *
  * Each section is located by its own header, so the two are removed whether
- * they sit adjacent in Pi's preamble or alone in a prompt something downstream
- * rewrote — including a prompt this function already produced, which is what
- * makes it safe to apply to its own output.
+ * they sit adjacent in Pi's preamble or alone in the tail — including a block
+ * this function already produced, which is what makes it safe to apply to its
+ * own output, and what keeps it order-independent with a second writer.
  */
 function removeToolSurfaceSections(lines: readonly string[]): string[] {
   let remaining = [...lines];
@@ -209,21 +284,26 @@ function collapseExtraBlankLines(text: string): string {
   return text.replace(/\n{3,}/g, "\n\n").trimEnd();
 }
 
-function isTopLevelSectionHeader(line: string): boolean {
-  const trimmed = line.trim();
-  return (
-    trimmed.length > 0 && trimmed.endsWith(":") && !trimmed.startsWith("-")
-  );
-}
-
+/**
+ * Whether the line belongs to the body of the section above it.
+ *
+ * Pi writes a section as its header, then bullets — or the `(none)` placeholder
+ * when the list is empty — and separates it from what follows with a blank
+ * line. Anything else is already outside the section, however it is punctuated:
+ * a section that ran on to "the next line ending in a colon" swallowed the
+ * prose in between, which is somebody else's text whenever the match was not
+ * Pi's own (#919, #932).
+ */
 function isSectionBodyLine(line: string): boolean {
   const trimmed = line.trim();
   if (trimmed.length === 0) return true; // blank line
   if (trimmed.startsWith("- ")) return true; // bullet
+  if (trimmed === EMPTY_LIST_PLACEHOLDER) return true; // Pi's empty list
   if (line !== line.trimStart()) return true; // indented
   return false;
 }
 
+/** The header line plus its own body, or `null` when the header is absent. */
 function findSection(
   lines: readonly string[],
   header: string,
@@ -233,25 +313,9 @@ function findSection(
     return null;
   }
 
-  // If a subsequent recognised section header exists, use it as the boundary.
-  // This preserves the original behaviour for the common case where sections
-  // are adjacent (e.g. "Available tools:" followed by "Guidelines:") and
-  // ensures any prose continuation between the two headers is also removed.
-  for (let index = start + 1; index < lines.length; index += 1) {
-    if (isTopLevelSectionHeader(lines[index])) {
-      return { start, end: index };
-    }
-  }
-
-  // No subsequent section header — stop at the first non-body line so that
-  // content after the section (e.g. custom user notes) is not silently deleted.
   let end = start + 1;
-  for (let index = start + 1; index < lines.length; index += 1) {
-    if (!isSectionBodyLine(lines[index])) {
-      end = index;
-      break;
-    }
-    end = index + 1;
+  while (end < lines.length && isSectionBodyLine(lines[end])) {
+    end += 1;
   }
 
   return { start, end };

package/src/handlers/before-agent-start.ts

@@ -22,8 +22,11 @@ interface BeforeAgentStartPayload {
    * The parts Pi assembled the prompt from. `toolSnippets` is what lets this
    * handler render the session's own tool list instead of editing the one Pi
    * wrote — including in a child, whose inherited identity carries none.
+   * `customPrompt` says whether Pi wrote a preamble at all: under one, it
+   * writes no tool surface, so there is nothing of Pi's to remove.
    */
   systemPromptOptions?: {
+    customPrompt?: string;
     toolSnippets?: Record<string, string>;
   };
 }
@@ -106,6 +109,9 @@ export class AgentPrepHandler {
       allowedTools,
       toolSnippets: event.systemPromptOptions?.toolSnippets ?? {},
       guidelinesByTool: registered.guidelinesByTool,
+      // Pi's own `if (customPrompt)` test, so an empty string reads here the
+      // way it reads there: as no custom prompt at all.
+      piAuthoredPreamble: !event.systemPromptOptions?.customPrompt,
     });
     const skillPromptResult = resolveSkillPromptEntries(
       toolSurfacePrompt,