@gotgenes/pi-permission-system 33.0.2 → 33.0.3

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [33.0.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.2...pi-permission-system-v33.0.3) (2026-09-19)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** project the operands of a command hosted in a quoted argument ([3da8a63](https://github.com/gotgenes/pi-packages/commit/3da8a63b0f4f4f234c1dfdf2196a83f4f62940e8)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+* **pi-permission-system:** project the operands of a command hosted in a generic command's quoted argument ([9eeece0](https://github.com/gotgenes/pi-packages/commit/9eeece05789fab4fe44b71f98cd3179e838a5def)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+
+### Documentation
+
+* **pi-permission-system:** record the widened hosted-argument projection ([c9b277a](https://github.com/gotgenes/pi-packages/commit/c9b277a495dad8fde7fe4d18536aae9ee384fee3)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+
 ## [33.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.1...pi-permission-system-v33.0.2) (2026-09-19)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "33.0.2",
+  "version": "33.0.3",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/token-collection.ts

@@ -129,7 +129,9 @@ export function collectRedirectTokens(node: TSNode): PathToken[] {
  * execution contexts, reading none of the host subtree's own text.
  *
  * This is what lets a heredoc body contribute its substitution's operands while
- * its prose stays out of the path surface entirely.
+ * its prose stays out of the path surface entirely, and an argument node
+ * contribute its quoted substitution's operands while its own text is judged
+ * by whatever role its walker gave it (#945).
  *
  * `node` may be a context outright (`> $(cmd)`) or merely contain one
  * (`> ${DIR}/$(cmd)`), so the traversal is the root-inclusive
@@ -617,6 +619,15 @@ function collectPatternCommandTokens(
     const isArgNode = ARG_NODE_TYPES.has(child.type);
     const text = resolveNodeText(child);
 
+    // An argument is read for its text below, and its text alone — but a
+    // quoted substitution sitting there really runs, and its own operands are
+    // candidates wherever it sits (ADR 0009's positional invariance). The
+    // unquoted spelling reaches the nested command through the `!isArgNode`
+    // recursions below; the quoted one parses as a `string` and would
+    // otherwise stop here, whichever role the argument turns out to have
+    // (#945).
+    if (isArgNode) tokens.push(...collectHostedExecutionTokens(child));
+
     // Handle the argument a previous flag consumed. The consumption discharges
     // on whatever node type follows, not only on an ARG_NODE_TYPES one: a bare
     // number (`-A 3`), an expansion (`-A $N`), and a substitution
@@ -772,6 +783,13 @@ function collectGenericCommandTokens(
       continue;
     }
 
+    // Read for its text below — but a quoted substitution among these
+    // arguments really runs, and its own operands are candidates wherever it
+    // sits (ADR 0009's positional invariance, #945). The unquoted spelling
+    // reaches the nested command through the trailing recursion.
+    if (ARG_NODE_TYPES.has(child.type))
+      tokens.push(...collectHostedExecutionTokens(child));
+
     // If there was no explicit command_name node, the first word-like
     // child is the command name itself — skip it.
     if (!seenCommandName && ARG_NODE_TYPES.has(child.type)) {