@gotgenes/pi-permission-system 40.0.0 → 40.0.1

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.0...pi-permission-system-v40.0.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a /dev/null redirect keeps the core-reader wrapper exemption ([25d8455](https://github.com/gotgenes/pi-packages/commit/25d84557eac5e09974ba1ffcb5b81fccf25e0f34))
+
 ## [40.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.2...pi-permission-system-v40.0.0) (2026-10-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.0.0",
+  "version": "40.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/redirect-analysis.ts

@@ -1,4 +1,5 @@
 import { type TokenEffect, UNPROVEN_EFFECT } from "#src/access-intent/effect";
+import { isDiscardDevice } from "#src/path/safe-system-paths";
 import { redirectDestinationEffect } from "./command-effects";
 import { parseUnresolvedAt } from "./parse-health";
 import type { TSNode } from "./parser";
@@ -88,9 +89,15 @@ export function redirectEffectForDestination(
  * are the operator and a descriptor, so the loop finds nothing to refuse on and
  * clears the exemption for a form nobody understood (#814).
  *
- * Past that, only two things clear it: a descriptor duplication (`2>&1`), which
- * names no file, and an operator that proves a read — reading a file alongside
- * a pure reader leaves it a pure reader.
+ * Past that, only three things clear it: a descriptor duplication (`2>&1`),
+ * which names no file; a destination spelled exactly `/dev/null`, whose writes
+ * touch no file (ADR 0013 §11 withholds the exemption only for a *real* output
+ * redirect, #951); and an operator that proves a read — reading a file
+ * alongside a pure reader leaves it a pure reader.
+ *
+ * The device check reads the node's raw text, so a quoted or computed spelling
+ * stays unproven, and it answers only this refusal: the token collector's proof
+ * still attributes the device a write, which `path_write` rules match.
  */
 export function redirectMayWriteFile(redirect: TSNode): boolean {
   if (parseUnresolvedAt(redirect)) return true;
@@ -100,6 +107,8 @@ export function redirectMayWriteFile(redirect: TSNode): boolean {
     if (!child?.isNamed) continue;
     // A source or duplicated descriptor (`2`, `&1`) names no file.
     if (DESCRIPTOR_NODE_TYPES.has(child.type)) continue;
+    // A write to the discard device touches no file.
+    if (isDiscardDevice(child.text)) continue;
     if (redirectEffectForDestination(redirect, child)?.effect !== "read") {
       return true;
     }

package/src/path/safe-system-paths.ts

@@ -1,9 +1,12 @@
+/** The device a write discards: nothing written to it reaches any file. */
+const DISCARD_DEVICE = "/dev/null";
+
 /**
  * Paths that are universally safe and should never trigger external-directory checks.
  * These are OS device files: read returns EOF or process streams, write discards or goes to process streams.
  */
 export const SAFE_SYSTEM_PATHS: ReadonlySet<string> = new Set([
-  "/dev/null",
+  DISCARD_DEVICE,
   "/dev/stdin",
   "/dev/stdout",
   "/dev/stderr",
@@ -16,3 +19,16 @@ export const SAFE_SYSTEM_PATHS: ReadonlySet<string> = new Set([
 export function isSafeSystemPath(normalizedPath: string): boolean {
   return SAFE_SYSTEM_PATHS.has(normalizedPath);
 }
+
+/**
+ * Returns true only for the discard device, `/dev/null`, so a write to `path`
+ * touches no file.
+ *
+ * Narrower than {@link isSafeSystemPath}: on Linux, `/dev/std{in,out,err}`
+ * link to `/proc/self/fd/N`, and opening one for writing reopens the
+ * descriptor's underlying file with `O_TRUNC` — `cat < f > /dev/stdin`
+ * truncates `f`.
+ */
+export function isDiscardDevice(path: string): boolean {
+  return path === DISCARD_DEVICE;
+}