@gotgenes/pi-permission-system 39.1.0 → 39.1.1

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [39.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.0...pi-permission-system-v39.1.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a subagent's floored bash ask prompts on the parent instead of riding its allow rule ([b33d6df](https://github.com/gotgenes/pi-packages/commit/b33d6df6e7bf430d5df898e190394c2d5d3ac9b7)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
+### Documentation
+
+* **pi-permission-system:** a forwarded ask keeps its floor ([0db97e4](https://github.com/gotgenes/pi-packages/commit/0db97e48bf6deea75bba36212e62d3c12502c43c)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
 ## [39.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.0.4...pi-permission-system-v39.1.0) (2026-10-05)
 
 

package/dist/public.d.ts

@@ -69,6 +69,13 @@ interface PermissionCheckResult {
      * once have prompted for is auditable to the reason that let it through.
      */
     floorExemption?: FloorExemption;
+    /**
+     * The synthetic pattern of a floor that raised this ask on the bash chain —
+     * on the deciding unit, or on another asking unit of the same command. Only
+     * the child's parse knows it, so a forwarded ask carries it for the serving
+     * node to clamp its own `allow` with.
+     */
+    floor?: string;
 }
 
 /**
@@ -370,6 +377,14 @@ interface ForwardedAccessFacts {
     matchValues: string[];
     /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
     boundaryValue: string | null;
+    /**
+     * The synthetic pattern of a floor that raised a bash ask on the child
+     * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+     * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+     * parse knows it, so the serving node clamps its own `allow` with it rather
+     * than recomputing it. Absent when no floor was raised.
+     */
+    floor?: string;
 }
 
 type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";

package/docs/configuration.md

@@ -538,6 +538,10 @@ Every synthetic `ask` above — the two parse sentinels and both wrapper floors
 An explicit `deny` still denies under yolo, and with yolo off the floors are unaffected.
 Approving one for the session works normally: the floors clamp the decision and leave the grant's provenance intact, so a command you have already approved does not prompt again.
 
+A subagent's floored ask keeps its floor when it is forwarded to the parent session.
+The parent's `allow` rule does not answer it, so `sudo rm x` from a subagent prompts in the parent even under a parent `bash: *` allow.
+The parent's `deny` still denies, and a grant for the whole parent session or the parent's `yoloMode` still approves.
+
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.
 To gate bash commands, add `"bash": { "*": "ask" }` (or `"deny"`).

package/docs/subagent-integration.md

@@ -148,6 +148,7 @@ When `@gotgenes/pi-permission-system` is not installed, an implementation emits
 When a delegated or routed subagent cannot decide an `ask` where it runs — because it has no UI of its own, or because it names a parent session that is answering for it — the confirmation request is forwarded through Pi session directories instead.
 The main interactive session polls for forwarded requests, shows the confirmation prompt, writes the response, and the subagent resumes once that decision is available.
 A parent `allow`/`deny` rule governs a child's escalation directly (the serving node resolves it as recorded authority before prompting), and a "whole session" grant recorded on the parent auto-approves later forwards of the same pattern.
+The exception is a bash ask the child raised through a [synthetic floor](configuration.md#fail-closed-behavior) (a wrapper such as `sudo` or `bash -c`, or a command the parser could not resolve): the child forwards the floor with the ask, and a parent `allow` rule escalates it to the parent's prompt instead of approving it.
 
 This keeps `ask` policies usable even when the original permission check happens inside a non-UI execution context.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "39.1.0",
+  "version": "39.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/forwarded-request-server.ts

@@ -56,10 +56,13 @@ export interface InboxProcessor {
  * (`principal.agentName`, ADR 0008 §3) — the child-fixed `matchValues` are
  * used as-is, never re-derived through this session's `PathNormalizer`/cwd.
  *
+ * The answer honors the floor the child raised (`intent.floor`): a serving
+ * `allow` rule does not answer an ask the child's own gate floored.
+ *
  * Narrow by design (ISP): the server needs one decision, not the whole
- * resolver. The composition root satisfies it with
- * `buildResolvedIntentFromMatchValues` plus `resolver.resolve`, the same
- * `resolve` entry point `LocalPermissionsService` composes.
+ * resolver. The composition root satisfies it with `ResolverServingPolicy`
+ * (`src/policy/serving-policy.ts`), over the same `resolve` entry point
+ * `LocalPermissionsService` composes.
  */
 export interface ServingPolicy {
   resolve(intent: ForwardedAccessIntent): PermissionCheckResult;
@@ -151,6 +154,7 @@ function toAccessFacts(intent: ForwardedAccessIntent): ForwardedAccessFacts {
     surface: intent.surface,
     matchValues: intent.matchValues,
     boundaryValue: intent.boundaryValue,
+    ...(intent.floor === undefined ? {} : { floor: intent.floor }),
   };
 }
 
@@ -465,7 +469,13 @@ export class ForwardedRequestServer implements InboxProcessor {
         : { ...createDeniedPermissionDecision(check.reason), decidedBy };
     }
 
-    this.logger.review("forwarded_permission.prompted", logDetails);
+    // The child's floor is why an ask this node's `allow` would once have
+    // answered reached a human instead, so the entry says so.
+    const floor = request.accessIntent?.floor;
+    this.logger.review(
+      "forwarded_permission.prompted",
+      floor === undefined ? logDetails : { ...logDetails, floor },
+    );
     const details = buildForwardedAskDetails(request);
     const decision = await this.escalateAsk(details);
     // Announced before the grant-scope translation and before the response is

package/src/authority/forwarding-io.ts

@@ -124,6 +124,7 @@ function asForwardedAccessIntent(
     surface?: unknown;
     matchValues?: unknown;
     boundaryValue?: unknown;
+    floor?: unknown;
     requesterCwd?: unknown;
     principal?: unknown;
   };
@@ -135,6 +136,9 @@ function asForwardedAccessIntent(
       candidate.boundaryValue === null ||
       typeof candidate.boundaryValue === "string"
     ) ||
+    // A malformed floor drops the whole intent, which escalates: it must
+    // never read as "no floor".
+    !(candidate.floor === undefined || typeof candidate.floor === "string") ||
     typeof candidate.requesterCwd !== "string" ||
     typeof candidate.principal !== "object" ||
     candidate.principal === null
@@ -155,6 +159,7 @@ function asForwardedAccessIntent(
     surface: candidate.surface,
     matchValues: [...candidate.matchValues],
     boundaryValue: candidate.boundaryValue,
+    ...(candidate.floor === undefined ? {} : { floor: candidate.floor }),
     requesterCwd: candidate.requesterCwd,
     principal: {
       sessionId: principal.sessionId,

package/src/authority/permission-forwarding.ts

@@ -123,6 +123,14 @@ export interface ForwardedAccessFacts {
   matchValues: string[];
   /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
   boundaryValue: string | null;
+  /**
+   * The synthetic pattern of a floor that raised a bash ask on the child
+   * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+   * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+   * parse knows it, so the serving node clamps its own `allow` with it rather
+   * than recomputing it. Absent when no floor was raised.
+   */
+  floor?: string;
 }
 
 /**

package/src/handlers/gates/bash-command.ts

@@ -68,6 +68,12 @@ const WRAPPER_SENTINEL: Record<WrapperKind, string> = {
  */
 const UNPARSED_SUBTREE_SENTINEL = "<unparsed-bash-subtree>";
 
+/**
+ * The synthetic `matchedPattern` recorded when a command the parse matched
+ * nothing in is floored to `ask` (#452).
+ */
+const UNPARSEABLE_COMMAND_SENTINEL = "<unparseable-bash-command>";
+
 export function resolveBashCommandCheck(
   command: string,
   commands: BashCommand[],
@@ -97,7 +103,8 @@ export function resolveBashCommandCheck(
         source: "bash",
         origin: "builtin",
         command,
-        matchedPattern: "<unparseable-bash-command>",
+        matchedPattern: UNPARSEABLE_COMMAND_SENTINEL,
+        floor: UNPARSEABLE_COMMAND_SENTINEL,
       };
     }
   }
@@ -105,10 +112,32 @@ export function resolveBashCommandCheck(
   const results = commands.map((cmd) =>
     resolveCommandUnit(cmd, command, agentName, resolver),
   );
-  return (
+  const winner =
     pickMostRestrictive(results) ??
-    resolveOnBashSurface(command, [], agentName, resolver)
+    resolveOnBashSurface(command, [], agentName, resolver);
+  return withChainFloor(winner, results);
+}
+
+/**
+ * Carry onto an asking winner the floor another asking unit of the chain
+ * raised.
+ *
+ * The winner is the first of the most restrictive units, so in
+ * `git push x && sudo rm y` a `git push *: ask` rule wins the tie and the
+ * wrapper's floor would otherwise go unrecorded. A forwarded ask is judged on
+ * the winner's value alone, so the floor has to ride the result for the
+ * serving node to keep it (#1029). A unit the session already granted is left
+ * out: the user approved exactly that command.
+ */
+function withChainFloor(
+  winner: PermissionCheckResult,
+  results: readonly PermissionCheckResult[],
+): PermissionCheckResult {
+  if (winner.state !== "ask" || winner.floor !== undefined) return winner;
+  const floored = results.find(
+    (result) => result.floor !== undefined && result.source !== "session",
   );
+  return floored ? { ...winner, floor: floored.floor } : winner;
 }
 
 /**
@@ -168,11 +197,25 @@ function floorUnparsedUnit(
   resolved: PermissionCheckResult,
 ): PermissionCheckResult {
   if (!cmd.parseUnresolved || resolved.state !== "allow") return resolved;
+  return { ...floorToAsk(resolved, UNPARSED_SUBTREE_SENTINEL), command };
+}
+
+/**
+ * Clamp a resolved check up to a synthetic `ask` naming the floor that raised
+ * it.
+ *
+ * Spreads `resolved`, so a `source: "session"` grant survives to `GateRunner`'s
+ * session fast path.
+ */
+function floorToAsk(
+  resolved: PermissionCheckResult,
+  sentinel: string,
+): PermissionCheckResult {
   return {
     ...resolved,
     state: "ask",
-    command,
-    matchedPattern: UNPARSED_SUBTREE_SENTINEL,
+    matchedPattern: sentinel,
+    floor: sentinel,
   };
 }
 
@@ -199,11 +242,7 @@ function resolveWrapperUnit(
 ): PermissionCheckResult {
   const inner = cmd.floorExemption && cmd.executedUnit;
   if (!inner) {
-    return {
-      ...base,
-      state: "ask",
-      matchedPattern: WRAPPER_SENTINEL[wrapperKind],
-    };
+    return floorToAsk(base, WRAPPER_SENTINEL[wrapperKind]);
   }
   // The inner command's rule decides, but the unit is still what runs: the
   // prompt, the decision value, and the session-approval suggestion all read

package/src/handlers/gates/tool.ts

@@ -173,10 +173,14 @@ export function describeToolGate(
   );
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
-  // (bash command, MCP target, plain tool) carries its already-portable value.
+  // (bash command, MCP target, plain tool) carries its already-portable value,
+  // and a bash ask the floor that raised it.
   const accessIntent = pathAccess
     ? accessFactsFromPath(gateSurface, pathAccess.path)
-    : accessFactsFromValue(gateSurface, decisionValue);
+    : {
+        ...accessFactsFromValue(gateSurface, decisionValue),
+        ...floorFact(check),
+      };
 
   return {
     surface: gateSurface,
@@ -226,3 +230,14 @@ function floorExemptionFact(
     ? {}
     : { floorExemption: check.floorExemption };
 }
+
+/**
+ * The floor that raised a bash ask, as a child-fixed fact for the wire.
+ *
+ * Only the child's parse knows a unit was a wrapper or failed to parse, so the
+ * serving node of a forwarded ask cannot recompute it (ADR 0008). Absent when
+ * no floor was raised, so every other ask's facts keep their exact shape.
+ */
+function floorFact(check: PermissionCheckResult): { floor?: string } {
+  return check.floor === undefined ? {} : { floor: check.floor };
+}

package/src/index.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { warmBashParser } from "#src/access-intent/bash/parser";
-import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
 import { AskDialogQueue } from "#src/authority/ask-dialog-queue";
 import { AuthorizerChainAudit } from "#src/authority/authorizer-chain-audit";
 import {
@@ -10,10 +9,7 @@ import {
 } from "#src/authority/authorizer-registry";
 import { AuthorizerSelection } from "#src/authority/authorizer-selection";
 import { ChildNodeAudit } from "#src/authority/child-node-audit";
-import {
-  ForwardedRequestServer,
-  type ServingPolicy,
-} from "#src/authority/forwarded-request-server";
+import { ForwardedRequestServer } from "#src/authority/forwarded-request-server";
 import {
   ForwardingLivenessJudge,
   ServingHeartbeatStore,
@@ -52,6 +48,7 @@ import { PermissionSessionLogger } from "#src/logging/session-logger";
 import { pathFlavorForPlatform } from "#src/path/path-flavor";
 import { PermissionManager } from "#src/policy/permission-manager";
 import { PermissionResolver } from "#src/policy/permission-resolver";
+import { ResolverServingPolicy } from "#src/policy/serving-policy";
 import { resolveRenderBudget } from "#src/presentation/dialog-renderer";
 import { LocalPermissionsService } from "#src/service/permissions-service";
 import { PermissionServiceLifecycle } from "#src/service/service-lifecycle";
@@ -198,16 +195,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // composed ruleset, agent-scoped to the requester (§3) — the match values
   // are used as fixed by the child, never re-derived through this session's
   // PathNormalizer/cwd (#597).
-  const servingPolicy: ServingPolicy = {
-    resolve: (intent) =>
-      resolver.resolve(
-        buildResolvedIntentFromMatchValues(
-          intent.surface,
-          intent.matchValues,
-          intent.principal.agentName,
-        ),
-      ),
-  };
+  const servingPolicy = new ResolverServingPolicy(resolver, isYoloEnabled);
 
   // Constructed here rather than beside the gate runner below: the serving
   // side broadcasts its own decisions, so both readers share one reporter over

package/src/policy/serving-policy.ts

@@ -0,0 +1,63 @@
+import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
+import type { ServingPolicy } from "#src/authority/forwarded-request-server";
+import type { ForwardedAccessIntent } from "#src/authority/permission-forwarding";
+import type { PermissionCheckResult } from "#src/types";
+import type { PermissionResolver } from "./permission-resolver";
+
+/**
+ * The serving node's recorded authority over a forwarded request: the
+ * child-fixed facts (ADR 0008) resolved against this node's composed ruleset,
+ * agent-scoped to the requester (`principal.agentName`, §3), with the floor the
+ * child raised honored.
+ *
+ * The `matchValues` are used as the child fixed them, never re-derived through
+ * this session's `PathNormalizer`/cwd. The resolver's surface-family fold is
+ * what keeps a parent's bare `path` deny answering a child's request, which is
+ * why this goes through `resolve` rather than the manager directly (#712, #806).
+ */
+export class ResolverServingPolicy implements ServingPolicy {
+  constructor(
+    private readonly resolver: Pick<PermissionResolver, "resolve">,
+    private readonly isYoloEnabled: () => boolean,
+  ) {}
+
+  resolve(intent: ForwardedAccessIntent): PermissionCheckResult {
+    const check = this.resolver.resolve(
+      buildResolvedIntentFromMatchValues(
+        intent.surface,
+        intent.matchValues,
+        intent.principal.agentName,
+      ),
+    );
+    return honorChildFloor(check, intent.floor, this.isYoloEnabled());
+  }
+}
+
+/**
+ * Clamp this node's `allow` with the floor the child raised, as the child's
+ * own gate clamped its own (#1029).
+ *
+ * Only the child's parse knows a bash unit was a wrapper or failed to parse,
+ * so without this a permissive serving rule answers exactly the ask the floor
+ * exists to raise. The floor leaves three answers standing, each for the
+ * reason it stands locally: a `deny` or `ask` decides before any floor is
+ * consulted; a session grant names a command the user already approved, which
+ * the local gate honors through its session fast path; and yolo approves every
+ * synthetic ask, keeping the floor's sentinel as the reported pattern.
+ */
+function honorChildFloor(
+  check: PermissionCheckResult,
+  floor: string | undefined,
+  yoloEnabled: boolean,
+): PermissionCheckResult {
+  if (
+    floor === undefined ||
+    check.state !== "allow" ||
+    check.source === "session"
+  ) {
+    return check;
+  }
+  return yoloEnabled
+    ? { ...check, origin: "yolo", matchedPattern: floor }
+    : { ...check, state: "ask", matchedPattern: floor };
+}

package/src/types.ts

@@ -89,6 +89,13 @@ export interface PermissionCheckResult {
    * once have prompted for is auditable to the reason that let it through.
    */
   floorExemption?: FloorExemption;
+  /**
+   * The synthetic pattern of a floor that raised this ask on the bash chain —
+   * on the deciding unit, or on another asking unit of the same command. Only
+   * the child's parse knows it, so a forwarded ask carries it for the serving
+   * node to clamp its own `allow` with.
+   */
+  floor?: string;
 }
 
 export function isPermissionState(value: unknown): value is PermissionState {