@gotgenes/pi-permission-system 39.1.1 → 39.1.2

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [39.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.1...pi-permission-system-v39.1.2) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a subagent's forwarded bash line is judged command by command on the parent ([0990e92](https://github.com/gotgenes/pi-packages/commit/0990e921868d077868b007682ffbaacc3a00cbc8)), closes [#1030](https://github.com/gotgenes/pi-packages/issues/1030)
+
+### Documentation
+
+* **pi-permission-system:** a forwarded bash line carries every asking command ([5cb6696](https://github.com/gotgenes/pi-packages/commit/5cb6696feb8572247dd6d09d4eb980292c0510f1))
+
 ## [39.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.0...pi-permission-system-v39.1.1) (2026-10-06)
 
 

package/dist/public.d.ts

@@ -76,6 +76,21 @@ interface PermissionCheckResult {
      * node to clamp its own `allow` with.
      */
     floor?: string;
+    /**
+     * Every unit of the bash chain that resolved to `ask` and was not
+     * session-granted, in chain order, each with its own floor. Set only on an
+     * asking chain winner: the serving node of a forwarded ask judges each one,
+     * since the winner alone would approve commands it never saw.
+     */
+    askingUnits?: readonly AskingBashUnit[];
+}
+/**
+ * One unit of a bash chain the gate left asking, as the serving node of a
+ * forwarded ask needs it: the unit as typed, and the floor that raised it.
+ */
+interface AskingBashUnit {
+    command: string;
+    floor?: string;
 }
 
 /**
@@ -385,6 +400,14 @@ interface ForwardedAccessFacts {
      * than recomputing it. Absent when no floor was raised.
      */
     floor?: string;
+    /**
+     * Every unit of a bash chain the child left asking, each with its own floor.
+     * `matchValues` names only the chain's winner, and the serving node's answer
+     * approves the whole tool call, so it judges each of these instead. Absent
+     * for a non-bash ask and for a bash ask raised without a chain (the empty
+     * parse), where `matchValues` is the whole command.
+     */
+    askingUnits?: AskingBashUnit[];
 }
 
 type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";

package/docs/configuration.md

@@ -541,6 +541,7 @@ Approving one for the session works normally: the floors clamp the decision and
 A subagent's floored ask keeps its floor when it is forwarded to the parent session.
 The parent's `allow` rule does not answer it, so `sudo rm x` from a subagent prompts in the parent even under a parent `bash: *` allow.
 The parent's `deny` still denies, and a grant for the whole parent session or the parent's `yoloMode` still approves.
+A subagent's chained command (`ls && rm -rf /tmp/x`) is judged by the parent command by command: every command the subagent's own policy left asking is forwarded with its floor, and the parent's `deny` or `ask` on any one of them decides, not only on the first.
 
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.

package/docs/subagent-integration.md

@@ -148,6 +148,7 @@ When `@gotgenes/pi-permission-system` is not installed, an implementation emits
 When a delegated or routed subagent cannot decide an `ask` where it runs — because it has no UI of its own, or because it names a parent session that is answering for it — the confirmation request is forwarded through Pi session directories instead.
 The main interactive session polls for forwarded requests, shows the confirmation prompt, writes the response, and the subagent resumes once that decision is available.
 A parent `allow`/`deny` rule governs a child's escalation directly (the serving node resolves it as recorded authority before prompting), and a "whole session" grant recorded on the parent auto-approves later forwards of the same pattern.
+For a chained bash command, the parent judges every command the child left asking, not only the first, and the most restrictive answer decides.
 The exception is a bash ask the child raised through a [synthetic floor](configuration.md#fail-closed-behavior) (a wrapper such as `sudo` or `bash -c`, or a command the parser could not resolve): the child forwards the floor with the ask, and a parent `allow` rule escalates it to the parent's prompt instead of approving it.
 
 This keeps `ask` policies usable even when the original permission check happens inside a non-UI execution context.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "39.1.1",
+  "version": "39.1.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/forwarded-request-server.ts

@@ -57,7 +57,9 @@ export interface InboxProcessor {
  * used as-is, never re-derived through this session's `PathNormalizer`/cwd.
  *
  * The answer honors the floor the child raised (`intent.floor`): a serving
- * `allow` rule does not answer an ask the child's own gate floored.
+ * `allow` rule does not answer an ask the child's own gate floored. A bash
+ * chain is judged on every unit the child left asking (`intent.askingUnits`),
+ * each with its own floor, since this answer approves the whole tool call.
  *
  * Narrow by design (ISP): the server needs one decision, not the whole
  * resolver. The composition root satisfies it with `ResolverServingPolicy`
@@ -155,6 +157,9 @@ function toAccessFacts(intent: ForwardedAccessIntent): ForwardedAccessFacts {
     matchValues: intent.matchValues,
     boundaryValue: intent.boundaryValue,
     ...(intent.floor === undefined ? {} : { floor: intent.floor }),
+    ...(intent.askingUnits === undefined
+      ? {}
+      : { askingUnits: intent.askingUnits }),
   };
 }
 

package/src/authority/forwarding-io.ts

@@ -19,6 +19,7 @@ import {
   type ApprovalGrant,
   isSessionGrantWidth,
 } from "#src/session/approval-grant";
+import type { AskingBashUnit } from "#src/types";
 import { asDecisionSource } from "./decision-source";
 import { isPermissionDecisionState } from "./permission-dialog";
 import {
@@ -125,6 +126,7 @@ function asForwardedAccessIntent(
     matchValues?: unknown;
     boundaryValue?: unknown;
     floor?: unknown;
+    askingUnits?: unknown;
     requesterCwd?: unknown;
     principal?: unknown;
   };
@@ -139,6 +141,12 @@ function asForwardedAccessIntent(
     // A malformed floor drops the whole intent, which escalates: it must
     // never read as "no floor".
     !(candidate.floor === undefined || typeof candidate.floor === "string") ||
+    // Likewise a malformed unit list: it must never read as "no units", which
+    // would judge the chain's winner alone.
+    !(
+      candidate.askingUnits === undefined ||
+      isWellFormedAskingUnits(candidate.askingUnits)
+    ) ||
     typeof candidate.requesterCwd !== "string" ||
     typeof candidate.principal !== "object" ||
     candidate.principal === null
@@ -160,6 +168,9 @@ function asForwardedAccessIntent(
     matchValues: [...candidate.matchValues],
     boundaryValue: candidate.boundaryValue,
     ...(candidate.floor === undefined ? {} : { floor: candidate.floor }),
+    ...(isWellFormedAskingUnits(candidate.askingUnits)
+      ? { askingUnits: copyAskingUnits(candidate.askingUnits) }
+      : {}),
     requesterCwd: candidate.requesterCwd,
     principal: {
       sessionId: principal.sessionId,
@@ -168,6 +179,39 @@ function asForwardedAccessIntent(
   };
 }
 
+/**
+ * True for a non-empty list of `{ command: string, floor?: string }` units.
+ *
+ * Empty is malformed: a child stamps the list only when it holds a unit, so an
+ * empty one says nothing a well-formed request would.
+ */
+function isWellFormedAskingUnits(
+  value: unknown,
+): value is readonly { command: string; floor?: string }[] {
+  return (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every(
+      (unit: unknown) =>
+        typeof unit === "object" &&
+        unit !== null &&
+        typeof (unit as { command?: unknown }).command === "string" &&
+        ((unit as { floor?: unknown }).floor === undefined ||
+          typeof (unit as { floor?: unknown }).floor === "string"),
+    )
+  );
+}
+
+/** Rebuild each unit field by field, so no unread key rides through. */
+function copyAskingUnits(
+  units: readonly { command: string; floor?: string }[],
+): AskingBashUnit[] {
+  return units.map((unit) => ({
+    command: unit.command,
+    ...(unit.floor === undefined ? {} : { floor: unit.floor }),
+  }));
+}
+
 export function formatUnknownErrorMessage(error: unknown): string {
   if (error instanceof Error && error.message) {
     return error.message;

package/src/authority/permission-forwarding.ts

@@ -5,6 +5,7 @@ import type {
   ApprovalGrant,
   SessionGrantWidth,
 } from "#src/session/approval-grant";
+import type { AskingBashUnit } from "#src/types";
 import type { DecisionSource } from "./decision-source";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
@@ -131,6 +132,14 @@ export interface ForwardedAccessFacts {
    * than recomputing it. Absent when no floor was raised.
    */
   floor?: string;
+  /**
+   * Every unit of a bash chain the child left asking, each with its own floor.
+   * `matchValues` names only the chain's winner, and the serving node's answer
+   * approves the whole tool call, so it judges each of these instead. Absent
+   * for a non-bash ask and for a bash ask raised without a chain (the empty
+   * parse), where `matchValues` is the whole command.
+   */
+  askingUnits?: AskingBashUnit[];
 }
 
 /**

package/src/handlers/gates/bash-command.ts

@@ -115,7 +115,30 @@ export function resolveBashCommandCheck(
   const winner =
     pickMostRestrictive(results) ??
     resolveOnBashSurface(command, [], agentName, resolver);
-  return withChainFloor(winner, results);
+  return withAskingUnits(withChainFloor(winner, results), results);
+}
+
+/**
+ * List on an asking winner every unit of the chain the gate left asking.
+ *
+ * The winner names one command, but a forwarded ask's answer approves the
+ * whole tool call, so the serving node has to judge every unit the child could
+ * not resolve, each with its own floor (#1030). A unit the child's rules
+ * allowed stays home, and so does one the session already granted: the user
+ * approved exactly that command.
+ */
+function withAskingUnits(
+  winner: PermissionCheckResult,
+  results: readonly PermissionCheckResult[],
+): PermissionCheckResult {
+  if (winner.state !== "ask") return winner;
+  const askingUnits = results
+    .filter((result) => result.state === "ask" && result.source !== "session")
+    .map((result) => ({
+      command: result.command ?? "",
+      ...(result.floor === undefined ? {} : { floor: result.floor }),
+    }));
+  return askingUnits.length === 0 ? winner : { ...winner, askingUnits };
 }
 
 /**

package/src/handlers/gates/tool.ts

@@ -14,7 +14,7 @@ import {
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
-import type { PermissionCheckResult } from "#src/types";
+import type { AskingBashUnit, PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
 import {
   accessFactsFromPath,
@@ -180,6 +180,7 @@ export function describeToolGate(
     : {
         ...accessFactsFromValue(gateSurface, decisionValue),
         ...floorFact(check),
+        ...askingUnitsFact(check),
       };
 
   return {
@@ -241,3 +242,16 @@ function floorExemptionFact(
 function floorFact(check: PermissionCheckResult): { floor?: string } {
   return check.floor === undefined ? {} : { floor: check.floor };
 }
+
+/**
+ * Every unit of a bash chain the child left asking, as a child-fixed fact for
+ * the wire, so the serving node judges each command rather than the winner
+ * alone (#1030). Absent when the check lists none.
+ */
+function askingUnitsFact(check: PermissionCheckResult): {
+  askingUnits?: AskingBashUnit[];
+} {
+  return check.askingUnits === undefined
+    ? {}
+    : { askingUnits: [...check.askingUnits] };
+}

package/src/policy/serving-policy.ts

@@ -1,8 +1,9 @@
 import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
 import type { ServingPolicy } from "#src/authority/forwarded-request-server";
 import type { ForwardedAccessIntent } from "#src/authority/permission-forwarding";
-import type { PermissionCheckResult } from "#src/types";
+import type { AskingBashUnit, PermissionCheckResult } from "#src/types";
 import type { PermissionResolver } from "./permission-resolver";
+import { mostRestrictiveOf } from "./restrictiveness";
 
 /**
  * The serving node's recorded authority over a forwarded request: the
@@ -10,6 +11,12 @@ import type { PermissionResolver } from "./permission-resolver";
  * agent-scoped to the requester (`principal.agentName`, §3), with the floor the
  * child raised honored.
  *
+ * A bash chain is judged unit by unit: the child names its winner in
+ * `matchValues`, but this answer approves the whole tool call, so every unit the
+ * child left asking (`askingUnits`) is resolved with its own floor and the most
+ * restrictive answer decides (#1030). A request without units (an older child,
+ * or an ask raised without a chain) is judged on its single value.
+ *
  * The `matchValues` are used as the child fixed them, never re-derived through
  * this session's `PathNormalizer`/cwd. The resolver's surface-family fold is
  * what keeps a parent's bare `path` deny answering a child's request, which is
@@ -22,6 +29,38 @@ export class ResolverServingPolicy implements ServingPolicy {
   ) {}
 
   resolve(intent: ForwardedAccessIntent): PermissionCheckResult {
+    const units = intent.askingUnits ?? [];
+    const first = units.at(0);
+    if (first === undefined) return this.resolveValue(intent);
+    const judge = (unit: AskingBashUnit): PermissionCheckResult =>
+      this.resolveUnit(unit, intent.principal.agentName);
+    return mostRestrictiveOf([judge(first), ...units.slice(1).map(judge)]);
+  }
+
+  /**
+   * Judge one unit the child left asking, with that unit's own floor.
+   *
+   * Resolved as the same `bash-command` intent the child's gate emitted for
+   * it, so a serving rule matches the unit exactly as a local one would.
+   */
+  private resolveUnit(
+    unit: AskingBashUnit,
+    agentName: string,
+  ): PermissionCheckResult {
+    const check = this.resolver.resolve({
+      kind: "bash-command",
+      surface: "bash",
+      command: unit.command,
+      spellings: [],
+      agentName,
+    });
+    return honorChildFloor(check, unit.floor, this.isYoloEnabled());
+  }
+
+  /**
+   * Judge the intent's single child-fixed value, with the chain-level floor.
+   */
+  private resolveValue(intent: ForwardedAccessIntent): PermissionCheckResult {
     const check = this.resolver.resolve(
       buildResolvedIntentFromMatchValues(
         intent.surface,

package/src/types.ts

@@ -96,6 +96,22 @@ export interface PermissionCheckResult {
    * node to clamp its own `allow` with.
    */
   floor?: string;
+  /**
+   * Every unit of the bash chain that resolved to `ask` and was not
+   * session-granted, in chain order, each with its own floor. Set only on an
+   * asking chain winner: the serving node of a forwarded ask judges each one,
+   * since the winner alone would approve commands it never saw.
+   */
+  askingUnits?: readonly AskingBashUnit[];
+}
+
+/**
+ * One unit of a bash chain the gate left asking, as the serving node of a
+ * forwarded ask needs it: the unit as typed, and the floor that raised it.
+ */
+export interface AskingBashUnit {
+  command: string;
+  floor?: string;
 }
 
 export function isPermissionState(value: unknown): value is PermissionState {