@gotgenes/pi-permission-system 4.0.0 → 4.0.1

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.1](https://github.com/gotgenes/pi-permission-system/compare/v4.0.0...v4.0.1) (2026-05-04)
+
+
+### Bug Fixes
+
+* skip bare-slash tokens in bash external-directory extraction ([#68](https://github.com/gotgenes/pi-permission-system/issues/68)) ([84f9a88](https://github.com/gotgenes/pi-permission-system/commit/84f9a88243c0033ddf1ca72894ceb42eb0f5f298))
+
+
+### Documentation
+
+* plan skip bare-slash tokens in external-directory extraction ([#68](https://github.com/gotgenes/pi-permission-system/issues/68)) ([f4fded8](https://github.com/gotgenes/pi-permission-system/commit/f4fded847ab7f4c8b82ebcd08edb0cb640d18fa7))
+* plan skip bare-slash tokens in external-directory extraction ([#68](https://github.com/gotgenes/pi-permission-system/issues/68)) ([f33964a](https://github.com/gotgenes/pi-permission-system/commit/f33964a34da726e3667319bf2015193de171767c))
+* **retro:** add retro notes for issue [#66](https://github.com/gotgenes/pi-permission-system/issues/66) ([61d7e5c](https://github.com/gotgenes/pi-permission-system/commit/61d7e5ca30c20c48f52152f9443ede1900010410))
+
 ## [4.0.0](https://github.com/gotgenes/pi-permission-system/compare/v3.11.0...v4.0.0) (2026-05-04)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "files": [

package/src/external-directory.ts

@@ -184,6 +184,10 @@ function classifyTokenAsPathCandidate(token: string): string | null {
   // Skip @scope/package patterns
   if (token.startsWith("@") && !token.startsWith("@/")) return null;
 
+  // Skip bare-slash tokens (// JS comments, lone /, etc.) — they resolve to root
+  // and are never meaningful path arguments in practice.
+  if (/^\/+$/.test(token)) return null;
+
   // Must look like a path: starts with /, ~/, or contains ..
   if (token.startsWith("/")) return token;
   if (token.startsWith("~/")) return token;

package/tests/bash-external-directory.test.ts

@@ -279,6 +279,37 @@ describe("extractExternalPathsFromBashCommand", () => {
     });
   });
 
+  describe("bare-slash tokens are skipped", () => {
+    test("does not flag // token", () => {
+      const result = extractExternalPathsFromBashCommand("echo //", cwd);
+      expect(result).toHaveLength(0);
+    });
+
+    test("does not flag / token", () => {
+      const result = extractExternalPathsFromBashCommand("echo /", cwd);
+      expect(result).toHaveLength(0);
+    });
+
+    test("does not flag /// token", () => {
+      const result = extractExternalPathsFromBashCommand("echo ///", cwd);
+      expect(result).toHaveLength(0);
+    });
+
+    test("does not flag // in echo with other args", () => {
+      const result = extractExternalPathsFromBashCommand("echo // hello", cwd);
+      expect(result).toHaveLength(0);
+    });
+
+    test("still flags real external path alongside //", () => {
+      const result = extractExternalPathsFromBashCommand(
+        "cat /etc/hosts; echo //",
+        cwd,
+      );
+      expect(result).toContain("/etc/hosts");
+      expect(result).toHaveLength(1);
+    });
+  });
+
   describe("deduplication", () => {
     test("returns deduplicated paths", () => {
       const result = extractExternalPathsFromBashCommand(