@gotgenes/pi-permission-system 39.1.0 → 39.1.2

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [39.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.1...pi-permission-system-v39.1.2) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a subagent's forwarded bash line is judged command by command on the parent ([0990e92](https://github.com/gotgenes/pi-packages/commit/0990e921868d077868b007682ffbaacc3a00cbc8)), closes [#1030](https://github.com/gotgenes/pi-packages/issues/1030)
+
+### Documentation
+
+* **pi-permission-system:** a forwarded bash line carries every asking command ([5cb6696](https://github.com/gotgenes/pi-packages/commit/5cb6696feb8572247dd6d09d4eb980292c0510f1))
+
+## [39.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.0...pi-permission-system-v39.1.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a subagent's floored bash ask prompts on the parent instead of riding its allow rule ([b33d6df](https://github.com/gotgenes/pi-packages/commit/b33d6df6e7bf430d5df898e190394c2d5d3ac9b7)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
+### Documentation
+
+* **pi-permission-system:** a forwarded ask keeps its floor ([0db97e4](https://github.com/gotgenes/pi-packages/commit/0db97e48bf6deea75bba36212e62d3c12502c43c)), closes [#1029](https://github.com/gotgenes/pi-packages/issues/1029)
+
 ## [39.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.0.4...pi-permission-system-v39.1.0) (2026-10-05)
 
 

package/dist/public.d.ts

@@ -69,6 +69,28 @@ interface PermissionCheckResult {
      * once have prompted for is auditable to the reason that let it through.
      */
     floorExemption?: FloorExemption;
+    /**
+     * The synthetic pattern of a floor that raised this ask on the bash chain —
+     * on the deciding unit, or on another asking unit of the same command. Only
+     * the child's parse knows it, so a forwarded ask carries it for the serving
+     * node to clamp its own `allow` with.
+     */
+    floor?: string;
+    /**
+     * Every unit of the bash chain that resolved to `ask` and was not
+     * session-granted, in chain order, each with its own floor. Set only on an
+     * asking chain winner: the serving node of a forwarded ask judges each one,
+     * since the winner alone would approve commands it never saw.
+     */
+    askingUnits?: readonly AskingBashUnit[];
+}
+/**
+ * One unit of a bash chain the gate left asking, as the serving node of a
+ * forwarded ask needs it: the unit as typed, and the floor that raised it.
+ */
+interface AskingBashUnit {
+    command: string;
+    floor?: string;
 }
 
 /**
@@ -370,6 +392,22 @@ interface ForwardedAccessFacts {
     matchValues: string[];
     /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
     boundaryValue: string | null;
+    /**
+     * The synthetic pattern of a floor that raised a bash ask on the child
+     * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+     * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+     * parse knows it, so the serving node clamps its own `allow` with it rather
+     * than recomputing it. Absent when no floor was raised.
+     */
+    floor?: string;
+    /**
+     * Every unit of a bash chain the child left asking, each with its own floor.
+     * `matchValues` names only the chain's winner, and the serving node's answer
+     * approves the whole tool call, so it judges each of these instead. Absent
+     * for a non-bash ask and for a bash ask raised without a chain (the empty
+     * parse), where `matchValues` is the whole command.
+     */
+    askingUnits?: AskingBashUnit[];
 }
 
 type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";

package/docs/configuration.md

@@ -538,6 +538,11 @@ Every synthetic `ask` above — the two parse sentinels and both wrapper floors
 An explicit `deny` still denies under yolo, and with yolo off the floors are unaffected.
 Approving one for the session works normally: the floors clamp the decision and leave the grant's provenance intact, so a command you have already approved does not prompt again.
 
+A subagent's floored ask keeps its floor when it is forwarded to the parent session.
+The parent's `allow` rule does not answer it, so `sudo rm x` from a subagent prompts in the parent even under a parent `bash: *` allow.
+The parent's `deny` still denies, and a grant for the whole parent session or the parent's `yoloMode` still approves.
+A subagent's chained command (`ls && rm -rf /tmp/x`) is judged by the parent command by command: every command the subagent's own policy left asking is forwarded with its floor, and the parent's `deny` or `ask` on any one of them decides, not only on the first.
+
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.
 To gate bash commands, add `"bash": { "*": "ask" }` (or `"deny"`).

package/docs/subagent-integration.md

@@ -148,6 +148,8 @@ When `@gotgenes/pi-permission-system` is not installed, an implementation emits
 When a delegated or routed subagent cannot decide an `ask` where it runs — because it has no UI of its own, or because it names a parent session that is answering for it — the confirmation request is forwarded through Pi session directories instead.
 The main interactive session polls for forwarded requests, shows the confirmation prompt, writes the response, and the subagent resumes once that decision is available.
 A parent `allow`/`deny` rule governs a child's escalation directly (the serving node resolves it as recorded authority before prompting), and a "whole session" grant recorded on the parent auto-approves later forwards of the same pattern.
+For a chained bash command, the parent judges every command the child left asking, not only the first, and the most restrictive answer decides.
+The exception is a bash ask the child raised through a [synthetic floor](configuration.md#fail-closed-behavior) (a wrapper such as `sudo` or `bash -c`, or a command the parser could not resolve): the child forwards the floor with the ask, and a parent `allow` rule escalates it to the parent's prompt instead of approving it.
 
 This keeps `ask` policies usable even when the original permission check happens inside a non-UI execution context.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "39.1.0",
+  "version": "39.1.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/forwarded-request-server.ts

@@ -56,10 +56,15 @@ export interface InboxProcessor {
  * (`principal.agentName`, ADR 0008 §3) — the child-fixed `matchValues` are
  * used as-is, never re-derived through this session's `PathNormalizer`/cwd.
  *
+ * The answer honors the floor the child raised (`intent.floor`): a serving
+ * `allow` rule does not answer an ask the child's own gate floored. A bash
+ * chain is judged on every unit the child left asking (`intent.askingUnits`),
+ * each with its own floor, since this answer approves the whole tool call.
+ *
  * Narrow by design (ISP): the server needs one decision, not the whole
- * resolver. The composition root satisfies it with
- * `buildResolvedIntentFromMatchValues` plus `resolver.resolve`, the same
- * `resolve` entry point `LocalPermissionsService` composes.
+ * resolver. The composition root satisfies it with `ResolverServingPolicy`
+ * (`src/policy/serving-policy.ts`), over the same `resolve` entry point
+ * `LocalPermissionsService` composes.
  */
 export interface ServingPolicy {
   resolve(intent: ForwardedAccessIntent): PermissionCheckResult;
@@ -151,6 +156,10 @@ function toAccessFacts(intent: ForwardedAccessIntent): ForwardedAccessFacts {
     surface: intent.surface,
     matchValues: intent.matchValues,
     boundaryValue: intent.boundaryValue,
+    ...(intent.floor === undefined ? {} : { floor: intent.floor }),
+    ...(intent.askingUnits === undefined
+      ? {}
+      : { askingUnits: intent.askingUnits }),
   };
 }
 
@@ -465,7 +474,13 @@ export class ForwardedRequestServer implements InboxProcessor {
         : { ...createDeniedPermissionDecision(check.reason), decidedBy };
     }
 
-    this.logger.review("forwarded_permission.prompted", logDetails);
+    // The child's floor is why an ask this node's `allow` would once have
+    // answered reached a human instead, so the entry says so.
+    const floor = request.accessIntent?.floor;
+    this.logger.review(
+      "forwarded_permission.prompted",
+      floor === undefined ? logDetails : { ...logDetails, floor },
+    );
     const details = buildForwardedAskDetails(request);
     const decision = await this.escalateAsk(details);
     // Announced before the grant-scope translation and before the response is

package/src/authority/forwarding-io.ts

@@ -19,6 +19,7 @@ import {
   type ApprovalGrant,
   isSessionGrantWidth,
 } from "#src/session/approval-grant";
+import type { AskingBashUnit } from "#src/types";
 import { asDecisionSource } from "./decision-source";
 import { isPermissionDecisionState } from "./permission-dialog";
 import {
@@ -124,6 +125,8 @@ function asForwardedAccessIntent(
     surface?: unknown;
     matchValues?: unknown;
     boundaryValue?: unknown;
+    floor?: unknown;
+    askingUnits?: unknown;
     requesterCwd?: unknown;
     principal?: unknown;
   };
@@ -135,6 +138,15 @@ function asForwardedAccessIntent(
       candidate.boundaryValue === null ||
       typeof candidate.boundaryValue === "string"
     ) ||
+    // A malformed floor drops the whole intent, which escalates: it must
+    // never read as "no floor".
+    !(candidate.floor === undefined || typeof candidate.floor === "string") ||
+    // Likewise a malformed unit list: it must never read as "no units", which
+    // would judge the chain's winner alone.
+    !(
+      candidate.askingUnits === undefined ||
+      isWellFormedAskingUnits(candidate.askingUnits)
+    ) ||
     typeof candidate.requesterCwd !== "string" ||
     typeof candidate.principal !== "object" ||
     candidate.principal === null
@@ -155,6 +167,10 @@ function asForwardedAccessIntent(
     surface: candidate.surface,
     matchValues: [...candidate.matchValues],
     boundaryValue: candidate.boundaryValue,
+    ...(candidate.floor === undefined ? {} : { floor: candidate.floor }),
+    ...(isWellFormedAskingUnits(candidate.askingUnits)
+      ? { askingUnits: copyAskingUnits(candidate.askingUnits) }
+      : {}),
     requesterCwd: candidate.requesterCwd,
     principal: {
       sessionId: principal.sessionId,
@@ -163,6 +179,39 @@ function asForwardedAccessIntent(
   };
 }
 
+/**
+ * True for a non-empty list of `{ command: string, floor?: string }` units.
+ *
+ * Empty is malformed: a child stamps the list only when it holds a unit, so an
+ * empty one says nothing a well-formed request would.
+ */
+function isWellFormedAskingUnits(
+  value: unknown,
+): value is readonly { command: string; floor?: string }[] {
+  return (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every(
+      (unit: unknown) =>
+        typeof unit === "object" &&
+        unit !== null &&
+        typeof (unit as { command?: unknown }).command === "string" &&
+        ((unit as { floor?: unknown }).floor === undefined ||
+          typeof (unit as { floor?: unknown }).floor === "string"),
+    )
+  );
+}
+
+/** Rebuild each unit field by field, so no unread key rides through. */
+function copyAskingUnits(
+  units: readonly { command: string; floor?: string }[],
+): AskingBashUnit[] {
+  return units.map((unit) => ({
+    command: unit.command,
+    ...(unit.floor === undefined ? {} : { floor: unit.floor }),
+  }));
+}
+
 export function formatUnknownErrorMessage(error: unknown): string {
   if (error instanceof Error && error.message) {
     return error.message;

package/src/authority/permission-forwarding.ts

@@ -5,6 +5,7 @@ import type {
   ApprovalGrant,
   SessionGrantWidth,
 } from "#src/session/approval-grant";
+import type { AskingBashUnit } from "#src/types";
 import type { DecisionSource } from "./decision-source";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
@@ -123,6 +124,22 @@ export interface ForwardedAccessFacts {
   matchValues: string[];
   /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
   boundaryValue: string | null;
+  /**
+   * The synthetic pattern of a floor that raised a bash ask on the child
+   * (`<indirection-bash-wrapper>`, `<opaque-bash-wrapper>`,
+   * `<unparsed-bash-subtree>`, `<unparseable-bash-command>`). Only the child's
+   * parse knows it, so the serving node clamps its own `allow` with it rather
+   * than recomputing it. Absent when no floor was raised.
+   */
+  floor?: string;
+  /**
+   * Every unit of a bash chain the child left asking, each with its own floor.
+   * `matchValues` names only the chain's winner, and the serving node's answer
+   * approves the whole tool call, so it judges each of these instead. Absent
+   * for a non-bash ask and for a bash ask raised without a chain (the empty
+   * parse), where `matchValues` is the whole command.
+   */
+  askingUnits?: AskingBashUnit[];
 }
 
 /**

package/src/handlers/gates/bash-command.ts

@@ -68,6 +68,12 @@ const WRAPPER_SENTINEL: Record<WrapperKind, string> = {
  */
 const UNPARSED_SUBTREE_SENTINEL = "<unparsed-bash-subtree>";
 
+/**
+ * The synthetic `matchedPattern` recorded when a command the parse matched
+ * nothing in is floored to `ask` (#452).
+ */
+const UNPARSEABLE_COMMAND_SENTINEL = "<unparseable-bash-command>";
+
 export function resolveBashCommandCheck(
   command: string,
   commands: BashCommand[],
@@ -97,7 +103,8 @@ export function resolveBashCommandCheck(
         source: "bash",
         origin: "builtin",
         command,
-        matchedPattern: "<unparseable-bash-command>",
+        matchedPattern: UNPARSEABLE_COMMAND_SENTINEL,
+        floor: UNPARSEABLE_COMMAND_SENTINEL,
       };
     }
   }
@@ -105,10 +112,55 @@ export function resolveBashCommandCheck(
   const results = commands.map((cmd) =>
     resolveCommandUnit(cmd, command, agentName, resolver),
   );
-  return (
+  const winner =
     pickMostRestrictive(results) ??
-    resolveOnBashSurface(command, [], agentName, resolver)
+    resolveOnBashSurface(command, [], agentName, resolver);
+  return withAskingUnits(withChainFloor(winner, results), results);
+}
+
+/**
+ * List on an asking winner every unit of the chain the gate left asking.
+ *
+ * The winner names one command, but a forwarded ask's answer approves the
+ * whole tool call, so the serving node has to judge every unit the child could
+ * not resolve, each with its own floor (#1030). A unit the child's rules
+ * allowed stays home, and so does one the session already granted: the user
+ * approved exactly that command.
+ */
+function withAskingUnits(
+  winner: PermissionCheckResult,
+  results: readonly PermissionCheckResult[],
+): PermissionCheckResult {
+  if (winner.state !== "ask") return winner;
+  const askingUnits = results
+    .filter((result) => result.state === "ask" && result.source !== "session")
+    .map((result) => ({
+      command: result.command ?? "",
+      ...(result.floor === undefined ? {} : { floor: result.floor }),
+    }));
+  return askingUnits.length === 0 ? winner : { ...winner, askingUnits };
+}
+
+/**
+ * Carry onto an asking winner the floor another asking unit of the chain
+ * raised.
+ *
+ * The winner is the first of the most restrictive units, so in
+ * `git push x && sudo rm y` a `git push *: ask` rule wins the tie and the
+ * wrapper's floor would otherwise go unrecorded. A forwarded ask is judged on
+ * the winner's value alone, so the floor has to ride the result for the
+ * serving node to keep it (#1029). A unit the session already granted is left
+ * out: the user approved exactly that command.
+ */
+function withChainFloor(
+  winner: PermissionCheckResult,
+  results: readonly PermissionCheckResult[],
+): PermissionCheckResult {
+  if (winner.state !== "ask" || winner.floor !== undefined) return winner;
+  const floored = results.find(
+    (result) => result.floor !== undefined && result.source !== "session",
   );
+  return floored ? { ...winner, floor: floored.floor } : winner;
 }
 
 /**
@@ -168,11 +220,25 @@ function floorUnparsedUnit(
   resolved: PermissionCheckResult,
 ): PermissionCheckResult {
   if (!cmd.parseUnresolved || resolved.state !== "allow") return resolved;
+  return { ...floorToAsk(resolved, UNPARSED_SUBTREE_SENTINEL), command };
+}
+
+/**
+ * Clamp a resolved check up to a synthetic `ask` naming the floor that raised
+ * it.
+ *
+ * Spreads `resolved`, so a `source: "session"` grant survives to `GateRunner`'s
+ * session fast path.
+ */
+function floorToAsk(
+  resolved: PermissionCheckResult,
+  sentinel: string,
+): PermissionCheckResult {
   return {
     ...resolved,
     state: "ask",
-    command,
-    matchedPattern: UNPARSED_SUBTREE_SENTINEL,
+    matchedPattern: sentinel,
+    floor: sentinel,
   };
 }
 
@@ -199,11 +265,7 @@ function resolveWrapperUnit(
 ): PermissionCheckResult {
   const inner = cmd.floorExemption && cmd.executedUnit;
   if (!inner) {
-    return {
-      ...base,
-      state: "ask",
-      matchedPattern: WRAPPER_SENTINEL[wrapperKind],
-    };
+    return floorToAsk(base, WRAPPER_SENTINEL[wrapperKind]);
   }
   // The inner command's rule decides, but the unit is still what runs: the
   // prompt, the decision value, and the session-approval suggestion all read

package/src/handlers/gates/tool.ts

@@ -14,7 +14,7 @@ import {
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
-import type { PermissionCheckResult } from "#src/types";
+import type { AskingBashUnit, PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
 import {
   accessFactsFromPath,
@@ -173,10 +173,15 @@ export function describeToolGate(
   );
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
-  // (bash command, MCP target, plain tool) carries its already-portable value.
+  // (bash command, MCP target, plain tool) carries its already-portable value,
+  // and a bash ask the floor that raised it.
   const accessIntent = pathAccess
     ? accessFactsFromPath(gateSurface, pathAccess.path)
-    : accessFactsFromValue(gateSurface, decisionValue);
+    : {
+        ...accessFactsFromValue(gateSurface, decisionValue),
+        ...floorFact(check),
+        ...askingUnitsFact(check),
+      };
 
   return {
     surface: gateSurface,
@@ -226,3 +231,27 @@ function floorExemptionFact(
     ? {}
     : { floorExemption: check.floorExemption };
 }
+
+/**
+ * The floor that raised a bash ask, as a child-fixed fact for the wire.
+ *
+ * Only the child's parse knows a unit was a wrapper or failed to parse, so the
+ * serving node of a forwarded ask cannot recompute it (ADR 0008). Absent when
+ * no floor was raised, so every other ask's facts keep their exact shape.
+ */
+function floorFact(check: PermissionCheckResult): { floor?: string } {
+  return check.floor === undefined ? {} : { floor: check.floor };
+}
+
+/**
+ * Every unit of a bash chain the child left asking, as a child-fixed fact for
+ * the wire, so the serving node judges each command rather than the winner
+ * alone (#1030). Absent when the check lists none.
+ */
+function askingUnitsFact(check: PermissionCheckResult): {
+  askingUnits?: AskingBashUnit[];
+} {
+  return check.askingUnits === undefined
+    ? {}
+    : { askingUnits: [...check.askingUnits] };
+}

package/src/index.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { warmBashParser } from "#src/access-intent/bash/parser";
-import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
 import { AskDialogQueue } from "#src/authority/ask-dialog-queue";
 import { AuthorizerChainAudit } from "#src/authority/authorizer-chain-audit";
 import {
@@ -10,10 +9,7 @@ import {
 } from "#src/authority/authorizer-registry";
 import { AuthorizerSelection } from "#src/authority/authorizer-selection";
 import { ChildNodeAudit } from "#src/authority/child-node-audit";
-import {
-  ForwardedRequestServer,
-  type ServingPolicy,
-} from "#src/authority/forwarded-request-server";
+import { ForwardedRequestServer } from "#src/authority/forwarded-request-server";
 import {
   ForwardingLivenessJudge,
   ServingHeartbeatStore,
@@ -52,6 +48,7 @@ import { PermissionSessionLogger } from "#src/logging/session-logger";
 import { pathFlavorForPlatform } from "#src/path/path-flavor";
 import { PermissionManager } from "#src/policy/permission-manager";
 import { PermissionResolver } from "#src/policy/permission-resolver";
+import { ResolverServingPolicy } from "#src/policy/serving-policy";
 import { resolveRenderBudget } from "#src/presentation/dialog-renderer";
 import { LocalPermissionsService } from "#src/service/permissions-service";
 import { PermissionServiceLifecycle } from "#src/service/service-lifecycle";
@@ -198,16 +195,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // composed ruleset, agent-scoped to the requester (§3) — the match values
   // are used as fixed by the child, never re-derived through this session's
   // PathNormalizer/cwd (#597).
-  const servingPolicy: ServingPolicy = {
-    resolve: (intent) =>
-      resolver.resolve(
-        buildResolvedIntentFromMatchValues(
-          intent.surface,
-          intent.matchValues,
-          intent.principal.agentName,
-        ),
-      ),
-  };
+  const servingPolicy = new ResolverServingPolicy(resolver, isYoloEnabled);
 
   // Constructed here rather than beside the gate runner below: the serving
   // side broadcasts its own decisions, so both readers share one reporter over

package/src/policy/serving-policy.ts

@@ -0,0 +1,102 @@
+import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
+import type { ServingPolicy } from "#src/authority/forwarded-request-server";
+import type { ForwardedAccessIntent } from "#src/authority/permission-forwarding";
+import type { AskingBashUnit, PermissionCheckResult } from "#src/types";
+import type { PermissionResolver } from "./permission-resolver";
+import { mostRestrictiveOf } from "./restrictiveness";
+
+/**
+ * The serving node's recorded authority over a forwarded request: the
+ * child-fixed facts (ADR 0008) resolved against this node's composed ruleset,
+ * agent-scoped to the requester (`principal.agentName`, §3), with the floor the
+ * child raised honored.
+ *
+ * A bash chain is judged unit by unit: the child names its winner in
+ * `matchValues`, but this answer approves the whole tool call, so every unit the
+ * child left asking (`askingUnits`) is resolved with its own floor and the most
+ * restrictive answer decides (#1030). A request without units (an older child,
+ * or an ask raised without a chain) is judged on its single value.
+ *
+ * The `matchValues` are used as the child fixed them, never re-derived through
+ * this session's `PathNormalizer`/cwd. The resolver's surface-family fold is
+ * what keeps a parent's bare `path` deny answering a child's request, which is
+ * why this goes through `resolve` rather than the manager directly (#712, #806).
+ */
+export class ResolverServingPolicy implements ServingPolicy {
+  constructor(
+    private readonly resolver: Pick<PermissionResolver, "resolve">,
+    private readonly isYoloEnabled: () => boolean,
+  ) {}
+
+  resolve(intent: ForwardedAccessIntent): PermissionCheckResult {
+    const units = intent.askingUnits ?? [];
+    const first = units.at(0);
+    if (first === undefined) return this.resolveValue(intent);
+    const judge = (unit: AskingBashUnit): PermissionCheckResult =>
+      this.resolveUnit(unit, intent.principal.agentName);
+    return mostRestrictiveOf([judge(first), ...units.slice(1).map(judge)]);
+  }
+
+  /**
+   * Judge one unit the child left asking, with that unit's own floor.
+   *
+   * Resolved as the same `bash-command` intent the child's gate emitted for
+   * it, so a serving rule matches the unit exactly as a local one would.
+   */
+  private resolveUnit(
+    unit: AskingBashUnit,
+    agentName: string,
+  ): PermissionCheckResult {
+    const check = this.resolver.resolve({
+      kind: "bash-command",
+      surface: "bash",
+      command: unit.command,
+      spellings: [],
+      agentName,
+    });
+    return honorChildFloor(check, unit.floor, this.isYoloEnabled());
+  }
+
+  /**
+   * Judge the intent's single child-fixed value, with the chain-level floor.
+   */
+  private resolveValue(intent: ForwardedAccessIntent): PermissionCheckResult {
+    const check = this.resolver.resolve(
+      buildResolvedIntentFromMatchValues(
+        intent.surface,
+        intent.matchValues,
+        intent.principal.agentName,
+      ),
+    );
+    return honorChildFloor(check, intent.floor, this.isYoloEnabled());
+  }
+}
+
+/**
+ * Clamp this node's `allow` with the floor the child raised, as the child's
+ * own gate clamped its own (#1029).
+ *
+ * Only the child's parse knows a bash unit was a wrapper or failed to parse,
+ * so without this a permissive serving rule answers exactly the ask the floor
+ * exists to raise. The floor leaves three answers standing, each for the
+ * reason it stands locally: a `deny` or `ask` decides before any floor is
+ * consulted; a session grant names a command the user already approved, which
+ * the local gate honors through its session fast path; and yolo approves every
+ * synthetic ask, keeping the floor's sentinel as the reported pattern.
+ */
+function honorChildFloor(
+  check: PermissionCheckResult,
+  floor: string | undefined,
+  yoloEnabled: boolean,
+): PermissionCheckResult {
+  if (
+    floor === undefined ||
+    check.state !== "allow" ||
+    check.source === "session"
+  ) {
+    return check;
+  }
+  return yoloEnabled
+    ? { ...check, origin: "yolo", matchedPattern: floor }
+    : { ...check, state: "ask", matchedPattern: floor };
+}

package/src/types.ts

@@ -89,6 +89,29 @@ export interface PermissionCheckResult {
    * once have prompted for is auditable to the reason that let it through.
    */
   floorExemption?: FloorExemption;
+  /**
+   * The synthetic pattern of a floor that raised this ask on the bash chain —
+   * on the deciding unit, or on another asking unit of the same command. Only
+   * the child's parse knows it, so a forwarded ask carries it for the serving
+   * node to clamp its own `allow` with.
+   */
+  floor?: string;
+  /**
+   * Every unit of the bash chain that resolved to `ask` and was not
+   * session-granted, in chain order, each with its own floor. Set only on an
+   * asking chain winner: the serving node of a forwarded ask judges each one,
+   * since the winner alone would approve commands it never saw.
+   */
+  askingUnits?: readonly AskingBashUnit[];
+}
+
+/**
+ * One unit of a bash chain the gate left asking, as the serving node of a
+ * forwarded ask needs it: the unit as typed, and the floor that raised it.
+ */
+export interface AskingBashUnit {
+  command: string;
+  floor?: string;
 }
 
 export function isPermissionState(value: unknown): value is PermissionState {