@gotgenes/pi-permission-system 33.0.2 → 33.0.4

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [33.0.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.3...pi-permission-system-v33.0.4) (2026-09-20)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** show a config warning present at session start ([65a59f7](https://github.com/gotgenes/pi-packages/commit/65a59f717fba9823cde171c9fbfdcd322dcc6ec7)), closes [#933](https://github.com/gotgenes/pi-packages/issues/933)
+
+### Documentation
+
+* **pi-permission-system:** declare non-Pi hosts a conditional non-goal ([b9d645c](https://github.com/gotgenes/pi-packages/commit/b9d645cdf39df10afe5493ca1817df3a1c99c527)), closes [#922](https://github.com/gotgenes/pi-packages/issues/922)
+* **pi-permission-system:** describe the config warning's delivery ([6a9024f](https://github.com/gotgenes/pi-packages/commit/6a9024f4db193f592a321a32c45979dedc2985e8)), closes [#933](https://github.com/gotgenes/pi-packages/issues/933)
+
+## [33.0.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.2...pi-permission-system-v33.0.3) (2026-09-19)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** project the operands of a command hosted in a quoted argument ([3da8a63](https://github.com/gotgenes/pi-packages/commit/3da8a63b0f4f4f234c1dfdf2196a83f4f62940e8)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+* **pi-permission-system:** project the operands of a command hosted in a generic command's quoted argument ([9eeece0](https://github.com/gotgenes/pi-packages/commit/9eeece05789fab4fe44b71f98cd3179e838a5def)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+
+### Documentation
+
+* **pi-permission-system:** record the widened hosted-argument projection ([c9b277a](https://github.com/gotgenes/pi-packages/commit/c9b277a495dad8fde7fe4d18536aae9ee384fee3)), closes [#945](https://github.com/gotgenes/pi-packages/issues/945)
+
 ## [33.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.1...pi-permission-system-v33.0.2) (2026-09-19)
 
 

package/README.md

@@ -183,6 +183,11 @@ Hardening the gates against bypass, fail-closed corrections (breaking ones inclu
 - _Model judgment in the core._
   This package makes no LLM call and holds no model config; model-assisted judging attaches as a chain link over the authorizer seam instead.
   A link decides nothing until you name it in `authorizerChain`, and its `allow` on an excluded surface is downgraded to `defer`.
+- _Supporting a non-Pi host._
+  Built and validated against Pi's extension API and no other: a fork that loads Pi extensions — [Oh My Pi](https://github.com/can1357/oh-my-pi) among them — diverges in payload shape, tool vocabulary, and approval authority, on its own release schedule.
+  Input that violates a contract this package already reads is hardened against anyway, because defensive normalization is correct whoever sent it.
+  Modeling a foreign host's semantics is not, because a guarantee that cannot be executed against is worse than a declined one.
+  This one is conditional rather than permanent — the architecture doc names the five conditions that would make a second host a goal.
 
 The [architecture doc](https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/architecture/architecture.md#scope-and-non-goals) carries the full inventory, with the decision record behind each entry.
 
@@ -194,6 +199,7 @@ The companion question — whether a capability model replaces the actor-keyed s
 **Where adjacent requests belong.**
 True isolation of a permitted action → an agent sandbox, which this package's scope decisions are exported to rather than duplicated in.
 Model-assisted judging of an `ask` → a chain link over the authorizer seam; [@gotgenes/pi-permission-model-judge](https://www.npmjs.com/package/@gotgenes/pi-permission-model-judge) is the first-party one, and judges mistyped paths.
+A non-Pi host's own payload shapes and tool formats → that host's Pi-compatibility layer, where one fix reaches every Pi extension at once instead of one.
 Approve-and-steer, edit diffs, and risk explanations → a downstream package over the `permissions:decision` event and the presentation seams.
 
 ## Documentation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "33.0.2",
+  "version": "33.0.4",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/token-collection.ts

@@ -129,7 +129,9 @@ export function collectRedirectTokens(node: TSNode): PathToken[] {
  * execution contexts, reading none of the host subtree's own text.
  *
  * This is what lets a heredoc body contribute its substitution's operands while
- * its prose stays out of the path surface entirely.
+ * its prose stays out of the path surface entirely, and an argument node
+ * contribute its quoted substitution's operands while its own text is judged
+ * by whatever role its walker gave it (#945).
  *
  * `node` may be a context outright (`> $(cmd)`) or merely contain one
  * (`> ${DIR}/$(cmd)`), so the traversal is the root-inclusive
@@ -617,6 +619,15 @@ function collectPatternCommandTokens(
     const isArgNode = ARG_NODE_TYPES.has(child.type);
     const text = resolveNodeText(child);
 
+    // An argument is read for its text below, and its text alone — but a
+    // quoted substitution sitting there really runs, and its own operands are
+    // candidates wherever it sits (ADR 0009's positional invariance). The
+    // unquoted spelling reaches the nested command through the `!isArgNode`
+    // recursions below; the quoted one parses as a `string` and would
+    // otherwise stop here, whichever role the argument turns out to have
+    // (#945).
+    if (isArgNode) tokens.push(...collectHostedExecutionTokens(child));
+
     // Handle the argument a previous flag consumed. The consumption discharges
     // on whatever node type follows, not only on an ARG_NODE_TYPES one: a bare
     // number (`-A 3`), an expansion (`-A $N`), and a substitution
@@ -772,6 +783,13 @@ function collectGenericCommandTokens(
       continue;
     }
 
+    // Read for its text below — but a quoted substitution among these
+    // arguments really runs, and its own operands are candidates wherever it
+    // sits (ADR 0009's positional invariance, #945). The unquoted spelling
+    // reaches the nested command through the trailing recursion.
+    if (ARG_NODE_TYPES.has(child.type))
+      tokens.push(...collectHostedExecutionTokens(child));
+
     // If there was no explicit command_name node, the first word-like
     // child is the command name itself — skip it.
     if (!seenCommandName && ARG_NODE_TYPES.has(child.type)) {

package/src/config/config-issue-reporter.ts

@@ -0,0 +1,60 @@
+/**
+ * config-issue-reporter.ts — Tell the operator what is wrong with their config,
+ * once per issue, for as long as it is wrong.
+ *
+ * `ConfigStore` loads and answers; this decides whether the operator has
+ * already heard it. Splitting the two is what fixes #933: the store was primed
+ * at factory time, with no context to notify through, and recorded the warning
+ * as delivered anyway — so the identical warning at `session_start` was deduped
+ * away and every config issue reached the debug log alone.
+ *
+ * Delivery goes through the injected `warn` seam rather than a ctx parameter.
+ * That seam is `SessionLogger.warn`, which reaches the operator through
+ * `PermissionSession.notify` and the context the session owns — the same path
+ * every other session-lifecycle warning in this package takes. A reporter
+ * cannot be handed a context that does not exist, which is the whole point.
+ *
+ * The latch is per issue and the delivery is per report: a config with three
+ * detector hits produces one notification, and a later report announces only
+ * what is new. `reported` is *replaced* on every report rather than added to,
+ * so an issue the operator fixed and then reintroduced is announced again —
+ * which preserves the clearing behavior the store's single-string dedupe had,
+ * at per-issue granularity.
+ *
+ * Driven at both moments the operator is reachable: `session_start`, and every
+ * `before_agent_start` (the config is re-read there, so an issue created
+ * mid-session is caught on the next turn).
+ */
+
+/** The config seam this reads (ISP): the issues current as of the last load. */
+export interface ConfigIssueSource {
+  getConfigIssues(): readonly string[];
+}
+
+/** The log seam this writes (ISP): one operator-facing warning. */
+export interface ConfigIssueWarner {
+  warn(message: string): void;
+}
+
+/** The seam the session-start and turn-prep handlers drive. */
+export interface ConfigIssueReporting {
+  report(): void;
+}
+
+export class ConfigIssueReporter implements ConfigIssueReporting {
+  private reported: ReadonlySet<string> = new Set();
+
+  constructor(
+    private readonly source: ConfigIssueSource,
+    private readonly log: ConfigIssueWarner,
+  ) {}
+
+  report(): void {
+    const current = this.source.getConfigIssues();
+    const unreported = current.filter((issue) => !this.reported.has(issue));
+    if (unreported.length > 0) {
+      this.log.warn(unreported.join("\n"));
+    }
+    this.reported = new Set(current);
+  }
+}

package/src/config/config-loader.ts

@@ -468,11 +468,9 @@ export function detectDeprecatedPreviewCaps(
  * make a display preference a policy event. The decision keeps its default
  * letter, and the message names the entry, the reason, and the letter kept.
  *
- * Where that message surfaces is the caller's problem and is currently a narrow
- * one: `ConfigStore` dedupes against a warning recorded by a factory-time
- * refresh with no ctx to notify, so an issue already on disk reaches the debug
- * log alone. That predates this detector and swallows its two siblings the same
- * way (#933).
+ * Where that message surfaces is the caller's problem: `ConfigIssueReporter`
+ * warns it at session start and on any turn whose refresh first finds it,
+ * latched per issue so a persisting one is not repeated (#933).
  *
  * Pure, following {@link detectPermissiveBashFallback}: it takes the merged
  * config and returns a message; the caller owns pushing it onto the issue list.

package/src/config/config-store.ts

@@ -6,11 +6,9 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, normalize } from "node:path";
-import type {
-  ExtensionCommandContext,
-  ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import type { DebugReviewLogger } from "#src/logging/session-logger";
+import type { ConfigIssueSource } from "./config-issue-reporter";
 import { loadAndMergeConfigs, loadUnifiedConfig } from "./config-loader";
 import {
   getGlobalConfigPath,
@@ -40,7 +38,7 @@ export interface ConfigReader {
  * coupling between the class and test doubles.
  */
 export interface SessionConfigStore extends ConfigReader {
-  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void;
+  refresh(cwd: string | undefined, projectTrusted: boolean): void;
   logResolvedPaths(cwd?: string): void;
 }
 
@@ -73,14 +71,17 @@ export interface ConfigStoreDeps {
  *
  * Replaces the three `(runtime, …)` config free functions
  * (`refreshExtensionConfig`, `saveExtensionConfig`, `logResolvedConfigPaths`)
- * with methods that privately own `config` and `lastConfigWarning`.
+ * with methods that privately own `config` and the issue list the last load
+ * produced.
  *
  * Implements {@link ConfigReader} so consumers that only read the current config
  * can depend on the narrow interface rather than the full class.
  */
-export class ConfigStore implements SessionConfigStore, CommandConfigStore {
+export class ConfigStore
+  implements SessionConfigStore, CommandConfigStore, ConfigIssueSource
+{
   private config: PermissionSystemExtensionConfig;
-  private lastConfigWarning: string | null = null;
+  private configIssues: readonly string[] = [];
 
   constructor(private readonly deps: ConfigStoreDeps) {
     this.config = { ...DEFAULT_EXTENSION_CONFIG };
@@ -91,16 +92,39 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
     return this.config;
   }
 
+  /**
+   * What is wrong with the config as of the last {@link refresh}.
+   *
+   * Every issue `loadAndMergeConfigs` collects: a legacy-file notice, a zod
+   * field violation, and the cross-cutting detectors (a permissive bash
+   * fallback, a deprecated preview cap, a refused dialog-key binding).
+   *
+   * This store answers; `ConfigIssueReporter` decides whether the operator has
+   * heard it yet (#933). Not to be confused with
+   * `PermissionResolver.getConfigIssues(agentName?)`, which answers for the
+   * *policy* files rather than the extension config.
+   */
+  getConfigIssues(): readonly string[] {
+    return this.configIssues;
+  }
+
   /**
    * Reload merged config from disk.
    *
-   * If `ctx` is provided, uses it to derive the cwd and sync UI status.
+   * `cwd` scopes the project-level lookup; omit it when no session cwd is
+   * known yet (the factory-time priming load).
    * When `projectTrusted` is `false`, the project scope is withheld so an
    * untrusted repository's runtime config (`yoloMode`, `permissionReviewLog`,
    * …) cannot loosen the operator's global config (#644).
+   *
+   * Takes no `ExtensionContext` on purpose: a load that holds one acquires UI
+   * side effects it cannot honor when there is no session yet, which is how a
+   * config warning came to be recorded as delivered without being shown
+   * (#933). `PermissionSession.refreshConfig` syncs the status bar and
+   * `ConfigIssueReporter` tells the operator; this reads files and answers
+   * questions about them.
    */
-  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void {
-    const cwd = ctx?.cwd ?? null;
+  refresh(cwd: string | undefined, projectTrusted: boolean): void {
     const mergeResult = loadAndMergeConfigs(
       this.deps.agentDir,
       cwd ?? "",
@@ -110,20 +134,11 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
     const runtimeConfig = normalizePermissionSystemConfig(mergeResult.merged);
     this.config = runtimeConfig;
 
-    if (ctx?.hasUI) {
-      syncPermissionSystemStatus(ctx, runtimeConfig);
-    }
+    this.configIssues = mergeResult.issues;
 
     const warning =
       mergeResult.issues.length > 0 ? mergeResult.issues.join("\n") : undefined;
 
-    if (warning && warning !== this.lastConfigWarning) {
-      this.lastConfigWarning = warning;
-      ctx?.ui.notify(warning, "warning");
-    } else if (!warning) {
-      this.lastConfigWarning = null;
-    }
-
     this.deps.logger.debug("config.loaded", {
       warning: warning ?? null,
       debugLog: runtimeConfig.debugLog,
@@ -177,7 +192,6 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
 
     this.config = normalized;
     syncPermissionSystemStatus(ctx, normalized);
-    this.lastConfigWarning = null;
 
     this.deps.logger.debug("config.saved", {
       debugLog: normalized.debugLog,

package/src/handlers/lifecycle.ts

@@ -1,4 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ConfigIssueReporting } from "#src/config/config-issue-reporter";
 import { PERMISSION_SYSTEM_STATUS_KEY } from "#src/config/status";
 import type { DecisionSummaryWriter } from "#src/logging/decision-audit";
 import type { SessionLogger } from "#src/logging/session-logger";
@@ -36,6 +37,9 @@ export const UNTRUSTED_PROJECT_MESSAGE =
  *   the ready event; `teardown` unsubscribes all session listeners and unpublishes
  * - `logger` — injected directly; replaces the former `session.logger` reach-through
  * - `audit` — per-session decision counters; its summary is written on shutdown
+ * - `configIssues` — reports what is wrong with the extension config, latched
+ *   per issue; driven here and on every turn, so an issue already on disk when
+ *   the session opens is shown rather than swallowed (#933)
  */
 export class SessionLifecycleHandler {
   constructor(
@@ -44,6 +48,7 @@ export class SessionLifecycleHandler {
     private readonly serviceLifecycle: ServiceLifecycle,
     private readonly logger: SessionLogger,
     private readonly audit: DecisionSummaryWriter,
+    private readonly configIssues: ConfigIssueReporting,
   ) {}
 
   handleSessionStart(
@@ -51,9 +56,16 @@ export class SessionLifecycleHandler {
     ctx: ExtensionContext,
   ): Promise<void> {
     const projectTrusted = ctx.isProjectTrusted();
-    this.session.refreshConfig(ctx, projectTrusted);
+    // Reset first: it activates the session, binding the context that
+    // `PermissionSession.notify` — and therefore `logger.warn` — delivers
+    // through. A refresh before activation has no UI to report into, which is
+    // how a config warning present at session start went unseen (#933).
     this.session.resetForNewSession(ctx, projectTrusted);
+    this.session.refreshConfig(ctx, projectTrusted);
     this.session.logResolvedConfigPaths();
+    // The config was just re-read above, and the session is activated, so a
+    // warning has a UI to reach.
+    this.configIssues.report();
     if (!projectTrusted) {
       this.warnProjectUntrusted(ctx, "session_start");
     }

package/src/handlers/session-turn-prep.ts

@@ -1,4 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ConfigIssueReporting } from "#src/config/config-issue-reporter";
 import type { ReadyAnnouncer } from "#src/service/service-lifecycle";
 
 /** The session surface the turn-prep routine drives. */
@@ -27,6 +28,9 @@ export interface TurnPreparation {
  * - `warmParser` — warms the tree-sitter parser so the synchronous advisory
  *   bash path can decompose at gate parity; `before_agent_start` precedes any
  *   tool call, so triggering it here closes the pre-warm window (#309)
+ * - `configIssues` — reports what the config refresh found, latched per issue,
+ *   so an issue the operator created mid-session is shown on the next turn
+ *   without an unchanged one being repeated every turn (#933)
  * - `readyAnnouncer` — re-announces `permissions:ready` once per session
  *   (ADR 0012 decision 3); `before_agent_start` runs after every extension's
  *   `session_start` and before any ask, so a consumer that registers from the
@@ -37,6 +41,7 @@ export class SessionTurnPrep implements TurnPreparation {
     private readonly session: TurnPrepSession,
     private readonly warmParser: () => void,
     private readonly readyAnnouncer: ReadyAnnouncer,
+    private readonly configIssues: ConfigIssueReporting,
   ) {}
 
   prepare(ctx: ExtensionContext): void {
@@ -50,6 +55,10 @@ export class SessionTurnPrep implements TurnPreparation {
     // right before agent start after session_start withheld it (#644). The
     // session_start handler already warned; do not re-warn on every start.
     this.session.refreshConfig(ctx, ctx.isProjectTrusted());
+    // Say what that refresh found, before the announce below hands this node
+    // to a consumer: the operator hears about a config they just broke on the
+    // next turn, and hears an unchanged issue only once.
+    this.configIssues.report();
     // Announce last: the node is up to date for the turn, so a consumer that
     // resolves the service in its ready handler queries current policy. The
     // once-per-session guard lives in the announcer, not here.

package/src/index.ts

@@ -33,6 +33,7 @@ import {
 import { SubagentDetection } from "#src/authority/subagent-detection";
 import { subscribeSubagentLifecycle } from "#src/authority/subagent-lifecycle-events";
 import { getSubagentSessionRegistry } from "#src/authority/subagent-registry";
+import { ConfigIssueReporter } from "#src/config/config-issue-reporter";
 import { registerPermissionSystemCommand } from "#src/config/config-modal";
 import { getGlobalConfigPath } from "#src/config/config-paths";
 import { ConfigStore } from "#src/config/config-store";
@@ -236,8 +237,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // refresh() must run after `session` is assigned: a debug-write IO failure
   // triggers the logger's notify sink — `session.notify(m)` — which no-ops
   // on the null context but requires `session` to be bound.
-  // No ctx/trust decision exists at factory init, so withhold the project
-  // scope (fail closed); session_start reloads with the real trust decision.
+  // No cwd or trust decision exists at factory init, so there is no project
+  // scope to withhold from (fail closed); session_start reloads with the real
+  // cwd and trust decision. This load reports nothing to the operator: it
+  // cannot, and it used to consume the warning by pretending it had (#933).
   configStore.refresh(undefined, false);
 
   const configPath = getGlobalConfigPath(agentDir);
@@ -305,12 +308,19 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   };
 
   const audit = new DecisionAudit();
+  // Reads the store's issue list and tells the operator what is new, through
+  // the logger's warn sink rather than a ctx parameter — which is what the
+  // factory-time priming refresh lacked, so every config issue already on disk
+  // was recorded as delivered and never shown (#933). Driven at session_start
+  // and on every turn; the latch keeps an unchanged issue quiet.
+  const configIssueReporter = new ConfigIssueReporter(configStore, logger);
   const lifecycle = new SessionLifecycleHandler(
     session,
     resolver,
     serviceLifecycle,
     logger,
     audit,
+    configIssueReporter,
   );
   const turnPrep = new SessionTurnPrep(
     session,
@@ -318,6 +328,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       void warmBashParser();
     },
     serviceLifecycle,
+    configIssueReporter,
   );
   const agentPrep = new AgentPrepHandler(
     turnPrep,

package/src/session/permission-session.ts

@@ -5,6 +5,7 @@ import type { ShellToolsConfig } from "#src/config/config-schema";
 import type { SessionConfigStore } from "#src/config/config-store";
 import type { PermissionSystemExtensionConfig } from "#src/config/extension-config";
 import type { ExtensionPaths } from "#src/config/extension-paths";
+import { syncPermissionSystemStatus } from "#src/config/status";
 import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
 import {
   ToolSurfaceBaseline,
@@ -202,15 +203,25 @@ export class PermissionSession implements ToolCallGateInputs {
   // ── Config ─────────────────────────────────────────────────────────────
 
   /**
-   * Reload merged config from disk; optionally update the stored runtime
-   * context. When `projectTrusted` is `false`, the project scope is withheld
-   * so an untrusted project's runtime config is not merged (#644).
+   * Reload merged config from disk, then bring the status bar in step with it.
+   *
+   * When `projectTrusted` is `false`, the project scope is withheld so an
+   * untrusted project's runtime config is not merged (#644).
+   *
+   * The status sync lives here rather than in `ConfigStore` because it is a UI
+   * side effect of the session, keyed on the session's context: the store
+   * loads and answers, and needs no ctx to do it (#933). Both drivers
+   * (`session_start` and every `before_agent_start`) call this one method, so
+   * the sync has a single home rather than one copy per handler.
    */
   refreshConfig(
     ctx: ExtensionContext | undefined,
     projectTrusted: boolean,
   ): void {
-    this.configStore.refresh(ctx, projectTrusted);
+    this.configStore.refresh(ctx?.cwd, projectTrusted);
+    if (ctx?.hasUI) {
+      syncPermissionSystemStatus(ctx, this.configStore.current());
+    }
   }
 
   /** Write the resolved config path set to the review and debug logs. */