@gotgenes/pi-permission-system 39.0.4 → 39.1.1

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [39.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.0...pi-permission-system-v39.1.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a subagent's floored bash ask prompts on the parent instead of riding its allow rule ([b33d6df](https://github.com/gotgenes/pi-packages/commit/b33d6df6e7bf430d5df898e190394c2d5d3ac9b7)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
+### Documentation
+
+* **pi-permission-system:** a forwarded ask keeps its floor ([0db97e4](https://github.com/gotgenes/pi-packages/commit/0db97e48bf6deea75bba36212e62d3c12502c43c)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
+## [39.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.0.4...pi-permission-system-v39.1.0) (2026-10-05)
+
+
+### Features
+
+* **pi-permission-system:** time, timeout, nice, stdbuf, and setsid resolve by the command they run ([8cf8fb0](https://github.com/gotgenes/pi-packages/commit/8cf8fb0e62681f49059f093bd1a1ff4d7fa78ece)), closes [#963](https://github.com/gotgenes/pi-packages/issues/963)
+* **pi-permission-system:** time -p and timeout -v keep the execution-modifier exemption ([#963](https://github.com/gotgenes/pi-packages/issues/963)) ([98157a3](https://github.com/gotgenes/pi-packages/commit/98157a3f1a9033172618a40738ad671a0f5d8604))
+
+### Documentation
+
+* **pi-permission-system:** measure the execution-modifier exemption ([#963](https://github.com/gotgenes/pi-packages/issues/963)) ([157f07a](https://github.com/gotgenes/pi-packages/commit/157f07a69c1f7f8103482ae7d8b6c15116970579))
+* **pi-permission-system:** document the execution-modifier exemption and mark Phase 15's #963 step complete ([03017b3](https://github.com/gotgenes/pi-packages/commit/03017b3422b412fc94afc8fe77d6126889bb4903))
+* **pi-permission-system:** measure the literal-word rule on execution modifiers ([#963](https://github.com/gotgenes/pi-packages/issues/963)) ([1c61a2a](https://github.com/gotgenes/pi-packages/commit/1c61a2a3b4707dc873b927ca84bed4c1a611b97a))
+* **pi-permission-system:** document the literal-word and -- rules for execution modifiers ([#963](https://github.com/gotgenes/pi-packages/issues/963)) ([17270c3](https://github.com/gotgenes/pi-packages/commit/17270c36b40debbddcc04fe3752a760dae62bb94))
+* **pi-permission-system:** note that a modifier's environment assignment may be computed ([#963](https://github.com/gotgenes/pi-packages/issues/963)) ([1ed420e](https://github.com/gotgenes/pi-packages/commit/1ed420e0095e37e76660583db42c6d5c11993103))
+
 ## [39.0.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.0.3...pi-permission-system-v39.0.4) (2026-10-05)
 
 

package/dist/public.d.ts

@@ -29,12 +29,16 @@ type BashCommandContext = "command_substitution" | "process_substitution" | "sub
  * core, so it is read-only for any argument feed and the floor's reason (an
  * unknown direction behind the wrapper) does not hold.
  *
+ * `"execution-modifier"` — every wrapper layer (`time`, `timeout`, `nice`,
+ * `stdbuf`, `setsid`) changes only how the visible inner command runs, so the
+ * unit is decided by that command's own rule whatever it does (#963).
+ *
  * A named reason rather than a boolean, so the review log states *why* a
  * wrapper was let through, and so a later source (a chain verdict, a user
  * declaration) is an added member rather than a second flag. ADR 0013 §11
- * keeps v1 at the audited core alone.
+ * keeps both reasons package-audited; user declarations do not lift the floor.
  */
-type FloorExemption = "core-reader";
+type FloorExemption = "core-reader" | "execution-modifier";
 interface PermissionCheckResult {
     toolName: string;
     state: PermissionState;
@@ -56,15 +60,22 @@ interface PermissionCheckResult {
      * The command the winning bash unit actually runs, when it is a wrapper whose
      * inner command differs from the unit text (#713). Display-only: the gate
      * decides on `command`, and on `executedUnit`'s rules only when
-     * {@link floorExemption} says the inner command is a proven pure reader.
+     * {@link floorExemption} says the wrapper's floor has no reason to hold.
      */
     executedUnit?: string;
     /**
      * Set when the winning bash unit is a wrapper the floor no longer covers,
-     * naming why (#803). Recorded in the review log so an allow the floor would
+     * naming why (#803, #963). Recorded in the review log so an allow the floor would
      * once have prompted for is auditable to the reason that let it through.
      */
     floorExemption?: FloorExemption;
+    /**
+     * The synthetic pattern of a floor that raised this ask on the bash chain —
+     * on the deciding unit, or on another asking unit of the same command. Only
+     * the child's parse knows it, so a forwarded ask carries it for the serving
+     * node to clamp its own `allow` with.
+     */
+    floor?: string;
 }
 
 /**
@@ -366,6 +377,14 @@ interface ForwardedAccessFacts {
     matchValues: string[];
     /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
     boundaryValue: string | null;
+    /**
+     * The synthetic pattern of a floor that raised a bash ask on the child
+     * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+     * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+     * parse knows it, so the serving node clamps its own `allow` with it rather
+     * than recomputing it. Absent when no floor was raised.
+     */
+    floor?: string;
 }
 
 type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";

package/docs/configuration.md

@@ -532,12 +532,16 @@ The bash gate fails closed: when in doubt it blocks or prompts, never silently a
 - An indirection wrapper — `sudo`, `env`, `xargs`, `time`, `nohup`, `timeout`, `nice`, `parallel`, `rust-parallel`, `rush`, `doas`, `setsid`, `stdbuf`, `watch`, `flock`, or `find`/`fd` carrying a per-result exec flag (`find` with `-exec`/`-execdir`/`-ok`/`-okdir`, `fd` with `-x`/`--exec`/`-X`/`--exec-batch`) — runs a following command that a rule on the wrapper text would otherwise never gate, so its decision is floored the same way (the synthetic `<indirection-bash-wrapper>` pattern in the review log).
   So `sudo aws s3 rm s3://bucket` prompts rather than riding an `aws *: allow`, while a bare `find . -name '*.py'` search (no exec flag) is unaffected.
   An `allow` is clamped to `ask`, and an explicit `deny` still denies.
-  The one exception is a wrapper running a [pure-reader command](#wrapper-transparency), whose direction is provable however unknown its argument feed is.
+  The [two exceptions](#wrapper-transparency) are a wrapper running a pure-reader command, whose direction is provable however unknown its argument feed is, and a wrapper that only modifies how a command runs (`time`, `timeout`, `nice`, `stdbuf`, `setsid`), which is decided exactly as the command it runs.
 
 Every synthetic `ask` above — the two parse sentinels and both wrapper floors — is auto-approved under `yoloMode: true`, which is an explicit full-permissive opt-in rather than a rule that could ride through.
 An explicit `deny` still denies under yolo, and with yolo off the floors are unaffected.
 Approving one for the session works normally: the floors clamp the decision and leave the grant's provenance intact, so a command you have already approved does not prompt again.
 
+A subagent's floored ask keeps its floor when it is forwarded to the parent session.
+The parent's `allow` rule does not answer it, so `sudo rm x` from a subagent prompts in the parent even under a parent `bash: *` allow.
+The parent's `deny` still denies, and a grant for the whole parent session or the parent's `yoloMode` still approves.
+
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.
 To gate bash commands, add `"bash": { "*": "ask" }` (or `"deny"`).
@@ -1018,7 +1022,12 @@ Two more shapes withdraw the claim:
 #### Wrapper transparency
 
 The [indirection-wrapper floor](#fail-closed-behavior) exists because a wrapper hides the command that should be gated.
-For one class the hiding is immaterial: a pure-reader command is read-only for **any** arguments, so `xargs grep -l foo` is provably a read even though what `xargs` feeds it is unknowable.
+Two kinds of wrapper unit have no reason to be floored: one running a [pure reader](#a-wrapper-running-a-pure-reader), and one that only [modifies how a command runs](#a-wrapper-that-only-modifies-execution).
+Each resolves by the inner command's own `bash` rules, and the review log records which reason applied as `floorExemption`.
+
+##### A wrapper running a pure reader
+
+For this class the hiding is immaterial: a pure-reader command is read-only for **any** arguments, so `xargs grep -l foo` is provably a read even though what `xargs` feeds it is unknowable.
 The floor guards unknowability of *scope*, and scope stays the path surfaces' job — for a wrapped command exactly as for a bare one.
 
 Such a unit is therefore **not** floored.
@@ -1034,7 +1043,7 @@ All four of these must hold, and each is a way the floor's reason could still ap
 4. The enclosing statement provably writes no file through a redirect.
    A destination the parse cannot resolve — `> $OUT`, `> $(mktemp)` — counts against the exemption rather than for it.
 
-So `xargs grep -l foo`, `xargs wc -l`, `xargs sed -n 1p`, and `find . -name '*.ts' -exec cat {} +` stop prompting under a matching `bash` allow, while `xargs rm`, `xargs sed -i`, `time pnpm test`, and `find . -exec sh -c '…' \;` still prompt.
+So `xargs grep -l foo`, `xargs wc -l`, `xargs sed -n 1p`, and `find . -name '*.ts' -exec cat {} +` stop prompting under a matching `bash` allow, while `xargs rm`, `xargs sed -i`, and `find . -exec sh -c '…' \;` still prompt.
 
 Three things this does **not** change:
 
@@ -1046,10 +1055,35 @@ Three things this does **not** change:
   The exemption decides the `bash` surface only, and every path token the command projects still goes through `path` and `external_directory` with the direction its command proved.
   Clause 4 is what keeps that from being a weaker promise than it sounds: a redirect destination the parse cannot resolve (`> $OUT`, `> $(mktemp)`) is not projected onto those surfaces either, so the wrapper keeps its floor rather than relying on a gate that would not see the write.
 
+##### A wrapper that only modifies execution
+
+`time`, `timeout`, `nice`, `stdbuf`, and `setsid` change only *how* the same visible command runs: its timing, kill deadline, scheduling, buffering, or session.
+Every operand is on the command line, and the wrapper adds no privilege, environment, or argument feed, so the floor's reason does not hold whatever the inner command does.
+Such a unit resolves exactly as the command it runs, and the review log records `floorExemption: "execution-modifier"`.
+
+All four of these must hold, and each keeps the decision about the command that really runs:
+
+1. **Every** wrapper layer is one of the five.
+   `time sudo rm -rf x` and `sudo time pnpm test` stay floored, as do `nohup` (it may write `nohup.out`) and `flock` (it creates its lock file).
+2. Every option on each layer is one that wrapper is known to take, spelled in full, and every option, value, and operand is written literally (an environment assignment, which the shell does not split, may be computed).
+   A word the shell rewrites (`timeout $D …`, `timeout {5,sudo} …`) may become several, one of them a wrapper, so it keeps the floor.
+   So `timeout --sig KILL 5 …` (an abbreviation) and `nice -5 …` stay floored, and so do `time`'s file-writing `-o`, `--output`, and `-a`.
+   The admitted options are `time -p`/`-l`/`-h`/`-f`; `timeout -s`/`-k`/`-f`/`-p`/`-v` and their long forms; `nice -n`/`--adjustment`; and `stdbuf -i`/`-o`/`-e` and their long forms.
+3. The command it runs is not itself a wrapper or an inline shell, so `timeout 5 bash -c '…'` stays floored.
+4. The command it runs is named literally.
+   `time ( … )` and `time { …; }` stay floored: the parser reads the group as `time`'s arguments, so the commands inside are not yet gated on their own rules.
+
+So under `bash: {"*": "allow", "git push *": "deny"}`, `time pnpm run lint >/tmp/lint.txt 2>&1` is allowed and `timeout 60 git push --force` is denied, exactly as without the wrapper.
+No redirect refusal applies here: the redirect destination goes through `path` and `external_directory` as it does for the bare command, and a destination the parse cannot resolve (`> $OUT`) is unprojected for both forms alike.
+When a unit qualifies for both exemptions (`time grep foo`), the review log records `core-reader`.
+
+##### Declarations and privilege
+
+Neither exemption is extended by configuration.
 A user `commandEffects` declaration participates in effect classification but does **not** lift the floor.
 The core's argument-independence is audited here; a claim about a wrapped command is not, and a wrong claim behind a wrapper fails open.
 
-`sudo` and `doas` are ordinary wrappers to this rule.
+`sudo` and `doas` are ordinary wrappers to the pure-reader rule, and never execution modifiers.
 The path surfaces gate `sudo cat /etc/shadow` exactly as they gate `cat /etc/shadow`, so nothing about the *file set* changes — what `sudo` adds is that the operating system would have refused, which this extension has never modelled.
 If you run a permissive `bash` policy and want privilege elevation to prompt regardless, say so directly:
 

package/docs/subagent-integration.md

@@ -148,6 +148,7 @@ When `@gotgenes/pi-permission-system` is not installed, an implementation emits
 When a delegated or routed subagent cannot decide an `ask` where it runs — because it has no UI of its own, or because it names a parent session that is answering for it — the confirmation request is forwarded through Pi session directories instead.
 The main interactive session polls for forwarded requests, shows the confirmation prompt, writes the response, and the subagent resumes once that decision is available.
 A parent `allow`/`deny` rule governs a child's escalation directly (the serving node resolves it as recorded authority before prompting), and a "whole session" grant recorded on the parent auto-approves later forwards of the same pattern.
+The exception is a bash ask the child raised through a [synthetic floor](configuration.md#fail-closed-behavior) (a wrapper such as `sudo` or `bash -c`, or a command the parser could not resolve): the child forwards the floor with the ask, and a parent `allow` rule escalates it to the parent's prompt instead of approving it.
 
 This keeps `ask` policies usable even when the original permission check happens inside a non-UI execution context.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "39.0.4",
+  "version": "39.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/command-enumeration.ts

@@ -8,8 +8,8 @@ import {
   type CommandWord,
   classifyWrapperWords,
   executedUnitOf,
+  floorExemptionOf,
   inlineShellPayloadIndex,
-  isTransparentWrapper,
   type WrapperKind,
 } from "./wrapper-analysis";
 
@@ -468,9 +468,7 @@ function makeCommandUnit(node: TSNode, scope: UnitScope): BashCommand {
     spellings: homeSpelling === undefined ? undefined : [homeSpelling],
     wrapperKind: classifyWrapperWords(words),
     executedUnit: executedUnitOf(text, words) ?? undefined,
-    floorExemption: isTransparentWrapper(words, redirectedScope(node, scope))
-      ? "core-reader"
-      : undefined,
+    floorExemption: floorExemptionOf(words, redirectedScope(node, scope)),
   });
 }
 

package/src/access-intent/bash/wrapper-analysis.ts

@@ -9,6 +9,7 @@
  * classifiers over the same vocabulary would drift.
  */
 
+import type { FloorExemption } from "#src/types";
 import { proveCommandEffect } from "./command-effects";
 import type { ArgWord } from "./node-text";
 
@@ -143,9 +144,12 @@ export function executedUnitOf(
 }
 
 /**
- * True when a wrapper unit's floor has no reason left to hold: the command it
- * runs is in the pure-reader core, so its *direction* is provable however
- * unknown its argument feed is (ADR 0013 §11, #803).
+ * Why a wrapper unit's floor has no reason left to hold, or `undefined` when it
+ * still does.
+ *
+ * `"core-reader"`: the command it runs is in the pure-reader core, so its
+ * *direction* is provable however unknown its argument feed is (ADR 0013 §11,
+ * #803).
  *
  * The floor exists because a wrapper hides the command that should be gated,
  * and the unknowability it guards is unknowability of scope — which stays the
@@ -153,7 +157,7 @@ export function executedUnitOf(
  * alike. Argument-independence is the core's admission bar, so there are no
  * arguments that make `grep` write a file.
  *
- * Four things must hold, and each is a way the reason could still hold:
+ * Four things must hold for it, and each is a way the reason could still hold:
  *
  * 1. The unit is an indirection wrapper — an ordinary command has no floor.
  * 2. Unwrapping reached the inner command without passing through an opaque
@@ -165,21 +169,128 @@ export function executedUnitOf(
  *    not transparent.
  * 4. The unit writes no file through a redirect, which the caller reads off
  *    the parse tree and this module never sees.
+ *
+ * `"execution-modifier"`: every wrapper layer only changes *how* the visible
+ * inner command runs, so the unit resolves by that command's own rule whatever
+ * it does (see {@link onlyModifiesExecution}). The first two conditions above
+ * hold for it too; the core-reader reason is preferred when both apply.
  */
-export function isTransparentWrapper(
+export function floorExemptionOf(
   words: readonly CommandWord[],
   statement: { readonly writesViaRedirect: boolean },
-): boolean {
-  if (statement.writesViaRedirect) return false;
-  if (classifyWrapperWords(words) !== "indirection") return false;
+): FloorExemption | undefined {
+  if (classifyWrapperWords(words) !== "indirection") return undefined;
 
   // Only the peeled words matter here, so the walk is handed no source span to
   // cut from — the text slice is `executedUnitOf`'s product, not this one's.
   const unwrapped = unwrapIndirection(words, "");
-  if (unwrapped.kind === "opaque" || unwrapped.layers === 0) return false;
+  if (unwrapped.kind === "opaque" || unwrapped.peeled.length === 0) {
+    return undefined;
+  }
 
   const head = unwrapped.words.at(0)?.text ?? "";
-  return proveCommandEffect(head, unwrapped.words.slice(1)).effect === "read";
+  const provesRead =
+    proveCommandEffect(head, unwrapped.words.slice(1)).effect === "read";
+  if (provesRead && !statement.writesViaRedirect) return "core-reader";
+  return onlyModifiesExecution(unwrapped.peeled, unwrapped.words)
+    ? "execution-modifier"
+    : undefined;
+}
+
+/**
+ * True when every peeled layer only changes *how* the inner command runs, and
+ * that command is a literal name the gate can resolve by its own rule.
+ *
+ * The floor's reason (a wrapper hides the command that should be gated) is
+ * false for an execution modifier whatever the inner command does: every
+ * operand is on the command line, and the wrapper adds no privilege,
+ * environment, or argument feed. So the unit inherits the inner verdict rather
+ * than being classified a read, which is why no redirect refusal applies —
+ * the destination is gated by the path surfaces exactly as for the bare
+ * command.
+ *
+ * Each condition is a way the inherited verdict could name the wrong command:
+ *
+ * 1. Every layer is a modifier. The peel looks through `sudo` and `env` too,
+ *    so `time sudo rm` would otherwise inherit `rm`'s verdict.
+ * 2. Every option in every layer is on that modifier's allowlist. The real
+ *    tools accept abbreviations (`timeout --sig KILL 5 rm`) the inner-command
+ *    search does not know, and one of them misplaces where the command starts.
+ *    Each option, value, and operand must also be literal: the shell splits
+ *    `timeout $D pnpm` or expands `timeout {5,sudo} rm` into extra words before
+ *    the modifier runs, and one of those may be a wrapper or the real command.
+ * 3. The peel ended at an ordinary command, not a wrapper it could not see
+ *    past.
+ * 4. The inner head is a literal command name. The grammar has no `time`
+ *    keyword, so `time { …; }` and `time ( … )` reach here with shell syntax
+ *    where the command name should be.
+ */
+function onlyModifiesExecution(
+  peeled: readonly (readonly CommandWord[])[],
+  inner: readonly CommandWord[],
+): boolean {
+  return (
+    peeled.every(isAdmittedModifierLayer) &&
+    classifyWrapperWords(inner) === undefined &&
+    isLiteralCommandName(inner.at(0)?.text ?? "")
+  );
+}
+
+/**
+ * True when a peeled layer is an execution modifier whose every word before
+ * the inner command is one it admits.
+ *
+ * Walks the words with the same value-taking table {@link innerCommandIndex}
+ * skips by, so an admitted option's value can never be taken for the command.
+ */
+function isAdmittedModifierLayer(layer: readonly CommandWord[]): boolean {
+  const name = wrapperName(layer);
+  const flags =
+    name === undefined ? undefined : EXECUTION_MODIFIER_FLAGS.get(name);
+  if (name === undefined || flags === undefined) return false;
+
+  const valueTaking = admittedValueTaking(name);
+  for (let index = 1; index < layer.length; index++) {
+    const word = layer[index].text;
+    if (isEnvironmentAssignment(word)) continue;
+    // A word the shell rewrites (`$D`, `{5,sudo}`, `*`) may become several, one
+    // of them a wrapper or the real command, so only a literal word is admitted.
+    if (layer[index].computed) return false;
+    if (word === "--") continue;
+    if (!word.startsWith("-")) continue;
+    if (flags.has(word)) continue;
+    if (valueTaking.has(word)) {
+      index++;
+      if (layer[index]?.computed) return false;
+      continue;
+    }
+    if (!hasAttachedValue(word, valueTaking)) return false;
+  }
+  return true;
+}
+
+/** A modifier's value-taking options, less any that write a file. */
+function admittedValueTaking(name: string): ReadonlySet<string> {
+  const valueTaking = VALUE_TAKING_FLAGS.get(name) ?? EMPTY_FLAGS;
+  const writing = WRITING_OPTIONS.get(name) ?? EMPTY_FLAGS;
+  return new Set([...valueTaking].filter((flag) => !writing.has(flag)));
+}
+
+/** `--long=value`, or a short option with its value attached (`-sKILL`). */
+function hasAttachedValue(
+  word: string,
+  valueTaking: ReadonlySet<string>,
+): boolean {
+  if (word.startsWith("--")) {
+    const equals = word.indexOf("=");
+    return equals !== -1 && valueTaking.has(word.slice(0, equals));
+  }
+  return word.length > 2 && valueTaking.has(word.slice(0, 2));
+}
+
+/** A command name spelled literally: no quoting, expansion, or shell syntax. */
+function isLiteralCommandName(text: string): boolean {
+  return LITERAL_COMMAND_NAME.test(text) && !RESERVED_WORDS.has(text);
 }
 
 // ── Unwrapping ───────────────────────────────────────────────────────────────
@@ -200,8 +311,11 @@ type UnwrapResult =
       readonly kind: "peeled";
       readonly text: string;
       readonly words: readonly CommandWord[];
-      /** How many indirection layers came off; `0` means none did. */
-      readonly layers: number;
+      /**
+       * Each peeled layer's words before its inner command: the wrapper name,
+       * its options, and any leading operand. Empty when none came off.
+       */
+      readonly peeled: readonly (readonly CommandWord[])[];
     };
 
 /**
@@ -210,7 +324,7 @@ type UnwrapResult =
  *
  * Stopping early is not an error: the words peeled so far are returned, and
  * each caller decides what an incomplete peel is worth — `executedUnitOf`
- * shows it, {@link isTransparentWrapper} declines it because the head word it
+ * shows it, {@link floorExemptionOf} declines it because the head word it
  * would judge is the wrapper's own.
  *
  * `unitText` is the span the peeled `text` is cut from; a caller that wants
@@ -222,7 +336,7 @@ function unwrapIndirection(
 ): UnwrapResult {
   let text = unitText;
   let current = words;
-  let layers = 0;
+  const peeled: (readonly CommandWord[])[] = [];
 
   for (let depth = 0; depth < MAX_UNWRAP_DEPTH; depth++) {
     const kind = classifyWrapperWords(current);
@@ -238,11 +352,11 @@ function unwrapIndirection(
     if (start === -1 || start >= current.length) break;
     const end = execTerminatorIndex(current, start);
     text = sliceWords(text, current, start, end).trimEnd();
+    peeled.push(current.slice(0, start));
     current = rebase(current, start, end);
-    layers++;
   }
 
-  return { kind: "peeled", text, words: current, layers };
+  return { kind: "peeled", text, words: current, peeled };
 }
 
 /** How many wrapper layers to unwrap before giving up. */
@@ -304,7 +418,11 @@ function innerCommandIndex(words: readonly CommandWord[]): number {
 
   while (index < words.length) {
     const word = words[index].text;
-    if (word === "--") return index + 1;
+    if (word === "--") {
+      // The end of options, not of operands: `timeout -- 5 cmd` still takes
+      // its duration before the command.
+      return operandPending ? index + 2 : index + 1;
+    }
     if (isEnvironmentAssignment(word)) {
       index++;
       continue;
@@ -435,6 +553,78 @@ const VALUE_TAKING_FLAGS = new Map<string, ReadonlySet<string>>([
 
 const EMPTY_FLAGS: ReadonlySet<string> = new Set<string>();
 
+/**
+ * Wrappers that change only *how* the same visible command runs — timing, kill
+ * deadline, scheduling, buffering, session — each with the flags (options
+ * taking no value) it admits. Value-taking options are admitted from
+ * {@link VALUE_TAKING_FLAGS}, less {@link WRITING_OPTIONS}, so the two tables
+ * cannot disagree about where the inner command starts. Any other option
+ * refuses the exemption.
+ */
+const EXECUTION_MODIFIER_FLAGS = new Map<string, ReadonlySet<string>>([
+  // BSD `man 1 time`: `time [-al] [-h | -p] [-o file]`; `-p` is also the bash
+  // keyword's only option. `-a` appends to the `-o` file, so it is not listed.
+  ["time", new Set(["-p", "-l", "-h"])],
+  // GNU coreutils `timeout --help`.
+  [
+    "timeout",
+    new Set([
+      "-f",
+      "--foreground",
+      "-p",
+      "--preserve-status",
+      "-v",
+      "--verbose",
+    ]),
+  ],
+  // `nice` and `stdbuf` take only value options; util-linux `setsid`'s flags
+  // are unverified on this host, so none is admitted.
+  ["nice", EMPTY_FLAGS],
+  ["stdbuf", EMPTY_FLAGS],
+  ["setsid", EMPTY_FLAGS],
+]);
+
+/**
+ * Each modifier's value-taking options that write a file, never admitted.
+ * Per wrapper: `time -o` names an output file, while `stdbuf -o` sets a mode.
+ */
+const WRITING_OPTIONS = new Map<string, ReadonlySet<string>>([
+  ["time", new Set(["-o", "--output"])],
+]);
+
+/**
+ * A command name with no quoting, expansion, glob, or grouping character, and
+ * not an option: a name led by `-` is one {@link executedUnitOf} declines to
+ * name, so it could never be resolved.
+ */
+const LITERAL_COMMAND_NAME = /^[A-Za-z0-9_./+@%,:][A-Za-z0-9_./+@%,:-]*$/;
+
+/** Bash reserved words, which open syntax rather than name a command. */
+const RESERVED_WORDS: ReadonlySet<string> = new Set([
+  "!",
+  "{",
+  "}",
+  "[[",
+  "]]",
+  "case",
+  "coproc",
+  "do",
+  "done",
+  "elif",
+  "else",
+  "esac",
+  "fi",
+  "for",
+  "function",
+  "if",
+  "in",
+  "select",
+  "then",
+  "time",
+  "until",
+  "while",
+]);
+
 /**
  * Wrappers whose first bare word is an operand (a duration, a lock file) rather
  * than the start of the inner command.

package/src/authority/forwarded-request-server.ts

@@ -56,10 +56,13 @@ export interface InboxProcessor {
  * (`principal.agentName`, ADR 0008 §3) — the child-fixed `matchValues` are
  * used as-is, never re-derived through this session's `PathNormalizer`/cwd.
  *
+ * The answer honors the floor the child raised (`intent.floor`): a serving
+ * `allow` rule does not answer an ask the child's own gate floored.
+ *
  * Narrow by design (ISP): the server needs one decision, not the whole
- * resolver. The composition root satisfies it with
- * `buildResolvedIntentFromMatchValues` plus `resolver.resolve`, the same
- * `resolve` entry point `LocalPermissionsService` composes.
+ * resolver. The composition root satisfies it with `ResolverServingPolicy`
+ * (`src/policy/serving-policy.ts`), over the same `resolve` entry point
+ * `LocalPermissionsService` composes.
  */
 export interface ServingPolicy {
   resolve(intent: ForwardedAccessIntent): PermissionCheckResult;
@@ -151,6 +154,7 @@ function toAccessFacts(intent: ForwardedAccessIntent): ForwardedAccessFacts {
     surface: intent.surface,
     matchValues: intent.matchValues,
     boundaryValue: intent.boundaryValue,
+    ...(intent.floor === undefined ? {} : { floor: intent.floor }),
   };
 }
 
@@ -465,7 +469,13 @@ export class ForwardedRequestServer implements InboxProcessor {
         : { ...createDeniedPermissionDecision(check.reason), decidedBy };
     }
 
-    this.logger.review("forwarded_permission.prompted", logDetails);
+    // The child's floor is why an ask this node's `allow` would once have
+    // answered reached a human instead, so the entry says so.
+    const floor = request.accessIntent?.floor;
+    this.logger.review(
+      "forwarded_permission.prompted",
+      floor === undefined ? logDetails : { ...logDetails, floor },
+    );
     const details = buildForwardedAskDetails(request);
     const decision = await this.escalateAsk(details);
     // Announced before the grant-scope translation and before the response is

package/src/authority/forwarding-io.ts

@@ -124,6 +124,7 @@ function asForwardedAccessIntent(
     surface?: unknown;
     matchValues?: unknown;
     boundaryValue?: unknown;
+    floor?: unknown;
     requesterCwd?: unknown;
     principal?: unknown;
   };
@@ -135,6 +136,9 @@ function asForwardedAccessIntent(
       candidate.boundaryValue === null ||
       typeof candidate.boundaryValue === "string"
     ) ||
+    // A malformed floor drops the whole intent, which escalates: it must
+    // never read as "no floor".
+    !(candidate.floor === undefined || typeof candidate.floor === "string") ||
     typeof candidate.requesterCwd !== "string" ||
     typeof candidate.principal !== "object" ||
     candidate.principal === null
@@ -155,6 +159,7 @@ function asForwardedAccessIntent(
     surface: candidate.surface,
     matchValues: [...candidate.matchValues],
     boundaryValue: candidate.boundaryValue,
+    ...(candidate.floor === undefined ? {} : { floor: candidate.floor }),
     requesterCwd: candidate.requesterCwd,
     principal: {
       sessionId: principal.sessionId,

package/src/authority/permission-forwarding.ts

@@ -123,6 +123,14 @@ export interface ForwardedAccessFacts {
   matchValues: string[];
   /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
   boundaryValue: string | null;
+  /**
+   * The synthetic pattern of a floor that raised a bash ask on the child
+   * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+   * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+   * parse knows it, so the serving node clamps its own `allow` with it rather
+   * than recomputing it. Absent when no floor was raised.
+   */
+  floor?: string;
 }
 
 /**

package/src/handlers/gates/bash-command.ts

@@ -68,6 +68,12 @@ const WRAPPER_SENTINEL: Record<WrapperKind, string> = {
  */
 const UNPARSED_SUBTREE_SENTINEL = "<unparsed-bash-subtree>";
 
+/**
+ * The synthetic `matchedPattern` recorded when a command the parse matched
+ * nothing in is floored to `ask` (#452).
+ */
+const UNPARSEABLE_COMMAND_SENTINEL = "<unparseable-bash-command>";
+
 export function resolveBashCommandCheck(
   command: string,
   commands: BashCommand[],
@@ -97,7 +103,8 @@ export function resolveBashCommandCheck(
         source: "bash",
         origin: "builtin",
         command,
-        matchedPattern: "<unparseable-bash-command>",
+        matchedPattern: UNPARSEABLE_COMMAND_SENTINEL,
+        floor: UNPARSEABLE_COMMAND_SENTINEL,
       };
     }
   }
@@ -105,10 +112,32 @@ export function resolveBashCommandCheck(
   const results = commands.map((cmd) =>
     resolveCommandUnit(cmd, command, agentName, resolver),
   );
-  return (
+  const winner =
     pickMostRestrictive(results) ??
-    resolveOnBashSurface(command, [], agentName, resolver)
+    resolveOnBashSurface(command, [], agentName, resolver);
+  return withChainFloor(winner, results);
+}
+
+/**
+ * Carry onto an asking winner the floor another asking unit of the chain
+ * raised.
+ *
+ * The winner is the first of the most restrictive units, so in
+ * `git push x && sudo rm y` a `git push *: ask` rule wins the tie and the
+ * wrapper's floor would otherwise go unrecorded. A forwarded ask is judged on
+ * the winner's value alone, so the floor has to ride the result for the
+ * serving node to keep it (#1029). A unit the session already granted is left
+ * out: the user approved exactly that command.
+ */
+function withChainFloor(
+  winner: PermissionCheckResult,
+  results: readonly PermissionCheckResult[],
+): PermissionCheckResult {
+  if (winner.state !== "ask" || winner.floor !== undefined) return winner;
+  const floored = results.find(
+    (result) => result.floor !== undefined && result.source !== "session",
   );
+  return floored ? { ...winner, floor: floored.floor } : winner;
 }
 
 /**
@@ -168,11 +197,25 @@ function floorUnparsedUnit(
   resolved: PermissionCheckResult,
 ): PermissionCheckResult {
   if (!cmd.parseUnresolved || resolved.state !== "allow") return resolved;
+  return { ...floorToAsk(resolved, UNPARSED_SUBTREE_SENTINEL), command };
+}
+
+/**
+ * Clamp a resolved check up to a synthetic `ask` naming the floor that raised
+ * it.
+ *
+ * Spreads `resolved`, so a `source: "session"` grant survives to `GateRunner`'s
+ * session fast path.
+ */
+function floorToAsk(
+  resolved: PermissionCheckResult,
+  sentinel: string,
+): PermissionCheckResult {
   return {
     ...resolved,
     state: "ask",
-    command,
-    matchedPattern: UNPARSED_SUBTREE_SENTINEL,
+    matchedPattern: sentinel,
+    floor: sentinel,
   };
 }
 
@@ -183,7 +226,8 @@ function floorUnparsedUnit(
  * is clamped up to a synthetic `ask` naming the kind that caused it — unless
  * the enumerator established that the floor has no reason left to hold, in
  * which case the unit is resolved by the rules of the command it runs (ADR 0013
- * §11, #803).
+ * §11): its inner command is a proven pure reader (#803), or every wrapper
+ * layer only modifies how that command runs (#963).
  *
  * Only an `allow` reaches here, which is what makes the exemption unable to
  * weaken anything: an explicit `deny` or `ask` on the wrapper is decided before
@@ -198,11 +242,7 @@ function resolveWrapperUnit(
 ): PermissionCheckResult {
   const inner = cmd.floorExemption && cmd.executedUnit;
   if (!inner) {
-    return {
-      ...base,
-      state: "ask",
-      matchedPattern: WRAPPER_SENTINEL[wrapperKind],
-    };
+    return floorToAsk(base, WRAPPER_SENTINEL[wrapperKind]);
   }
   // The inner command's rule decides, but the unit is still what runs: the
   // prompt, the decision value, and the session-approval suggestion all read

package/src/handlers/gates/tool.ts

@@ -173,10 +173,14 @@ export function describeToolGate(
   );
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
-  // (bash command, MCP target, plain tool) carries its already-portable value.
+  // (bash command, MCP target, plain tool) carries its already-portable value,
+  // and a bash ask the floor that raised it.
   const accessIntent = pathAccess
     ? accessFactsFromPath(gateSurface, pathAccess.path)
-    : accessFactsFromValue(gateSurface, decisionValue);
+    : {
+        ...accessFactsFromValue(gateSurface, decisionValue),
+        ...floorFact(check),
+      };
 
   return {
     surface: gateSurface,
@@ -226,3 +230,14 @@ function floorExemptionFact(
     ? {}
     : { floorExemption: check.floorExemption };
 }
+
+/**
+ * The floor that raised a bash ask, as a child-fixed fact for the wire.
+ *
+ * Only the child's parse knows a unit was a wrapper or failed to parse, so the
+ * serving node of a forwarded ask cannot recompute it (ADR 0008). Absent when
+ * no floor was raised, so every other ask's facts keep their exact shape.
+ */
+function floorFact(check: PermissionCheckResult): { floor?: string } {
+  return check.floor === undefined ? {} : { floor: check.floor };
+}

package/src/index.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { warmBashParser } from "#src/access-intent/bash/parser";
-import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
 import { AskDialogQueue } from "#src/authority/ask-dialog-queue";
 import { AuthorizerChainAudit } from "#src/authority/authorizer-chain-audit";
 import {
@@ -10,10 +9,7 @@ import {
 } from "#src/authority/authorizer-registry";
 import { AuthorizerSelection } from "#src/authority/authorizer-selection";
 import { ChildNodeAudit } from "#src/authority/child-node-audit";
-import {
-  ForwardedRequestServer,
-  type ServingPolicy,
-} from "#src/authority/forwarded-request-server";
+import { ForwardedRequestServer } from "#src/authority/forwarded-request-server";
 import {
   ForwardingLivenessJudge,
   ServingHeartbeatStore,
@@ -52,6 +48,7 @@ import { PermissionSessionLogger } from "#src/logging/session-logger";
 import { pathFlavorForPlatform } from "#src/path/path-flavor";
 import { PermissionManager } from "#src/policy/permission-manager";
 import { PermissionResolver } from "#src/policy/permission-resolver";
+import { ResolverServingPolicy } from "#src/policy/serving-policy";
 import { resolveRenderBudget } from "#src/presentation/dialog-renderer";
 import { LocalPermissionsService } from "#src/service/permissions-service";
 import { PermissionServiceLifecycle } from "#src/service/service-lifecycle";
@@ -198,16 +195,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // composed ruleset, agent-scoped to the requester (§3) — the match values
   // are used as fixed by the child, never re-derived through this session's
   // PathNormalizer/cwd (#597).
-  const servingPolicy: ServingPolicy = {
-    resolve: (intent) =>
-      resolver.resolve(
-        buildResolvedIntentFromMatchValues(
-          intent.surface,
-          intent.matchValues,
-          intent.principal.agentName,
-        ),
-      ),
-  };
+  const servingPolicy = new ResolverServingPolicy(resolver, isYoloEnabled);
 
   // Constructed here rather than beside the gate runner below: the serving
   // side broadcasts its own decisions, so both readers share one reporter over

package/src/policy/serving-policy.ts

@@ -0,0 +1,63 @@
+import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
+import type { ServingPolicy } from "#src/authority/forwarded-request-server";
+import type { ForwardedAccessIntent } from "#src/authority/permission-forwarding";
+import type { PermissionCheckResult } from "#src/types";
+import type { PermissionResolver } from "./permission-resolver";
+
+/**
+ * The serving node's recorded authority over a forwarded request: the
+ * child-fixed facts (ADR 0008) resolved against this node's composed ruleset,
+ * agent-scoped to the requester (`principal.agentName`, §3), with the floor the
+ * child raised honored.
+ *
+ * The `matchValues` are used as the child fixed them, never re-derived through
+ * this session's `PathNormalizer`/cwd. The resolver's surface-family fold is
+ * what keeps a parent's bare `path` deny answering a child's request, which is
+ * why this goes through `resolve` rather than the manager directly (#712, #806).
+ */
+export class ResolverServingPolicy implements ServingPolicy {
+  constructor(
+    private readonly resolver: Pick<PermissionResolver, "resolve">,
+    private readonly isYoloEnabled: () => boolean,
+  ) {}
+
+  resolve(intent: ForwardedAccessIntent): PermissionCheckResult {
+    const check = this.resolver.resolve(
+      buildResolvedIntentFromMatchValues(
+        intent.surface,
+        intent.matchValues,
+        intent.principal.agentName,
+      ),
+    );
+    return honorChildFloor(check, intent.floor, this.isYoloEnabled());
+  }
+}
+
+/**
+ * Clamp this node's `allow` with the floor the child raised, as the child's
+ * own gate clamped its own (#1029).
+ *
+ * Only the child's parse knows a bash unit was a wrapper or failed to parse,
+ * so without this a permissive serving rule answers exactly the ask the floor
+ * exists to raise. The floor leaves three answers standing, each for the
+ * reason it stands locally: a `deny` or `ask` decides before any floor is
+ * consulted; a session grant names a command the user already approved, which
+ * the local gate honors through its session fast path; and yolo approves every
+ * synthetic ask, keeping the floor's sentinel as the reported pattern.
+ */
+function honorChildFloor(
+  check: PermissionCheckResult,
+  floor: string | undefined,
+  yoloEnabled: boolean,
+): PermissionCheckResult {
+  if (
+    floor === undefined ||
+    check.state !== "allow" ||
+    check.source === "session"
+  ) {
+    return check;
+  }
+  return yoloEnabled
+    ? { ...check, origin: "yolo", matchedPattern: floor }
+    : { ...check, state: "ask", matchedPattern: floor };
+}

package/src/types.ts

@@ -48,12 +48,16 @@ export type BashCommandContext =
  * core, so it is read-only for any argument feed and the floor's reason (an
  * unknown direction behind the wrapper) does not hold.
  *
+ * `"execution-modifier"` — every wrapper layer (`time`, `timeout`, `nice`,
+ * `stdbuf`, `setsid`) changes only how the visible inner command runs, so the
+ * unit is decided by that command's own rule whatever it does (#963).
+ *
  * A named reason rather than a boolean, so the review log states *why* a
  * wrapper was let through, and so a later source (a chain verdict, a user
  * declaration) is an added member rather than a second flag. ADR 0013 §11
- * keeps v1 at the audited core alone.
+ * keeps both reasons package-audited; user declarations do not lift the floor.
  */
-export type FloorExemption = "core-reader";
+export type FloorExemption = "core-reader" | "execution-modifier";
 
 export interface PermissionCheckResult {
   toolName: string;
@@ -76,15 +80,22 @@ export interface PermissionCheckResult {
    * The command the winning bash unit actually runs, when it is a wrapper whose
    * inner command differs from the unit text (#713). Display-only: the gate
    * decides on `command`, and on `executedUnit`'s rules only when
-   * {@link floorExemption} says the inner command is a proven pure reader.
+   * {@link floorExemption} says the wrapper's floor has no reason to hold.
    */
   executedUnit?: string;
   /**
    * Set when the winning bash unit is a wrapper the floor no longer covers,
-   * naming why (#803). Recorded in the review log so an allow the floor would
+   * naming why (#803, #963). Recorded in the review log so an allow the floor would
    * once have prompted for is auditable to the reason that let it through.
    */
   floorExemption?: FloorExemption;
+  /**
+   * The synthetic pattern of a floor that raised this ask on the bash chain —
+   * on the deciding unit, or on another asking unit of the same command. Only
+   * the child's parse knows it, so a forwarded ask carries it for the serving
+   * node to clamp its own `allow` with.
+   */
+  floor?: string;
 }
 
 export function isPermissionState(value: unknown): value is PermissionState {