@gotgenes/pi-permission-system 40.0.0 → 40.0.2

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.1...pi-permission-system-v40.0.2) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a session grant on one bash unit no longer approves the chain's other asking units ([3fffff8](https://github.com/gotgenes/pi-packages/commit/3fffff8158da81094d43a62673c8388ccb1ddf61)), closes [#1033](https://github.com/gotgenes/pi-packages/issues/1033)
+
+## [40.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.0...pi-permission-system-v40.0.1) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a /dev/null redirect keeps the core-reader wrapper exemption ([25d8455](https://github.com/gotgenes/pi-packages/commit/25d84557eac5e09974ba1ffcb5b81fccf25e0f34))
+
 ## [40.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.1.2...pi-permission-system-v40.0.0) (2026-10-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.0.0",
+  "version": "40.0.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/redirect-analysis.ts

@@ -1,4 +1,5 @@
 import { type TokenEffect, UNPROVEN_EFFECT } from "#src/access-intent/effect";
+import { isDiscardDevice } from "#src/path/safe-system-paths";
 import { redirectDestinationEffect } from "./command-effects";
 import { parseUnresolvedAt } from "./parse-health";
 import type { TSNode } from "./parser";
@@ -88,9 +89,15 @@ export function redirectEffectForDestination(
  * are the operator and a descriptor, so the loop finds nothing to refuse on and
  * clears the exemption for a form nobody understood (#814).
  *
- * Past that, only two things clear it: a descriptor duplication (`2>&1`), which
- * names no file, and an operator that proves a read — reading a file alongside
- * a pure reader leaves it a pure reader.
+ * Past that, only three things clear it: a descriptor duplication (`2>&1`),
+ * which names no file; a destination spelled exactly `/dev/null`, whose writes
+ * touch no file (ADR 0013 §11 withholds the exemption only for a *real* output
+ * redirect, #951); and an operator that proves a read — reading a file
+ * alongside a pure reader leaves it a pure reader.
+ *
+ * The device check reads the node's raw text, so a quoted or computed spelling
+ * stays unproven, and it answers only this refusal: the token collector's proof
+ * still attributes the device a write, which `path_write` rules match.
  */
 export function redirectMayWriteFile(redirect: TSNode): boolean {
   if (parseUnresolvedAt(redirect)) return true;
@@ -100,6 +107,8 @@ export function redirectMayWriteFile(redirect: TSNode): boolean {
     if (!child?.isNamed) continue;
     // A source or duplicated descriptor (`2`, `&1`) names no file.
     if (DESCRIPTOR_NODE_TYPES.has(child.type)) continue;
+    // A write to the discard device touches no file.
+    if (isDiscardDevice(child.text)) continue;
     if (redirectEffectForDestination(redirect, child)?.effect !== "read") {
       return true;
     }

package/src/handlers/gates/bash-command.ts

@@ -123,9 +123,8 @@ export function resolveBashCommandCheck(
  *
  * The winner names one command, but a forwarded ask's answer approves the
  * whole tool call, so the serving node has to judge every unit the child could
- * not resolve, each with its own floor (#1030). A unit the child's rules
- * allowed stays home, and so does one the session already granted: the user
- * approved exactly that command.
+ * not resolve, each with its own floor (#1030). A unit the child's rules or
+ * the session allowed stays home.
  */
 function withAskingUnits(
   winner: PermissionCheckResult,
@@ -133,7 +132,7 @@ function withAskingUnits(
 ): PermissionCheckResult {
   if (winner.state !== "ask") return winner;
   const askingUnits = results
-    .filter((result) => result.state === "ask" && result.source !== "session")
+    .filter((result) => result.state === "ask")
     .map((result) => ({
       command: result.command ?? "",
       ...(result.floor === undefined ? {} : { floor: result.floor }),
@@ -149,17 +148,14 @@ function withAskingUnits(
  * `git push x && sudo rm y` a `git push *: ask` rule wins the tie and the
  * wrapper's floor would otherwise go unrecorded. A forwarded ask is judged on
  * the winner's value alone, so the floor has to ride the result for the
- * serving node to keep it (#1029). A unit the session already granted is left
- * out: the user approved exactly that command.
+ * serving node to keep it (#1029).
  */
 function withChainFloor(
   winner: PermissionCheckResult,
   results: readonly PermissionCheckResult[],
 ): PermissionCheckResult {
   if (winner.state !== "ask" || winner.floor !== undefined) return winner;
-  const floored = results.find(
-    (result) => result.floor !== undefined && result.source !== "session",
-  );
+  const floored = results.find((result) => result.floor !== undefined);
   return floored ? { ...winner, floor: floored.floor } : winner;
 }
 
@@ -181,7 +177,7 @@ function resolveCommandUnit(
     resolver,
   );
   const floored =
-    cmd.wrapperKind && base.state === "allow"
+    cmd.wrapperKind && base.state === "allow" && !isSessionGrant(base)
       ? resolveWrapperUnit(cmd, cmd.wrapperKind, base, agentName, resolver)
       : base;
   const unparsed = floorUnparsedUnit(cmd, command, floored);
@@ -210,26 +206,40 @@ function resolveCommandUnit(
  * decides instead — and a wrapper unit already floored to `ask` keeps its own,
  * more specific sentinel.
  *
- * The result is built by spreading `resolved`, so a `source: "session"` grant
- * survives to `GateRunner`'s session fast path, which tests the source before
- * the state. A grant the user gave for this exact command still holds.
+ * A session grant is never floored: the user approved this exact command, and
+ * an `ask` carrying it would tie with a sibling unit's real ask and could
+ * approve the whole chain through `GateRunner`'s session fast path (#1033).
  */
 function floorUnparsedUnit(
   cmd: BashCommand,
   command: string,
   resolved: PermissionCheckResult,
 ): PermissionCheckResult {
-  if (!cmd.parseUnresolved || resolved.state !== "allow") return resolved;
+  if (
+    !cmd.parseUnresolved ||
+    resolved.state !== "allow" ||
+    isSessionGrant(resolved)
+  ) {
+    return resolved;
+  }
   return { ...floorToAsk(resolved, UNPARSED_SUBTREE_SENTINEL), command };
 }
 
+/**
+ * True when the session layer decided the check. `SessionRules` records only
+ * `allow`s, so this is a grant the user gave for the command it matched.
+ */
+function isSessionGrant(check: PermissionCheckResult): boolean {
+  return check.source === "session";
+}
+
 /**
  * Clamp a resolved check up to a synthetic `ask` naming the floor that raised
  * it.
  *
- * Spreads `resolved`, so a `source: "session"` grant survives to `GateRunner`'s
- * session fast path. Drops `matchedSpelling`: it names what the replaced rule
- * matched, and beside the sentinel it would name a match that did not decide.
+ * Never handed a session grant: both floors leave one unfloored. Drops
+ * `matchedSpelling`: it names what the replaced rule matched, and beside the
+ * sentinel it would name a match that did not decide.
  */
 function floorToAsk(
   resolved: PermissionCheckResult,

package/src/handlers/gates/descriptor.ts

@@ -138,13 +138,10 @@ export function preResolvedCheckOf(
  * a semantic one, and it is why the same treatment is *not* extended to `ask`
  * (#915): two asking gates ask two different questions.
  *
- * Subordinate to {@link GateRunner.runDescriptor}'s own precedence, which
- * tests `source === "session"` before the deny/ask/allow gate is reached — a
- * session-sourced check is allowed there, so it is not pre-emptive here.
- * `SessionRules` records only allows, so that combination is unreachable
- * today; the clause is kept so the predicate is correct on its own terms
- * rather than by way of a distant invariant, and it errs toward today's
- * behavior by declining to pre-empt.
+ * A session-sourced `deny` counts too: {@link GateRunner.runDescriptor}'s
+ * session fast path takes only a session `allow`, so any other session-sourced
+ * check reaches the deny/ask/allow gate and a `deny` blocks there. `SessionRules`
+ * records only allows, so that combination is unreachable today.
  *
  * Yolo needs no clause: `resolveYoloGrant` matches an `allow` of origin
  * `yolo` and an `ask`, never a `deny`.
@@ -154,7 +151,7 @@ export function isUnconditionalDeny(gate: GateResult): boolean {
     return false;
   }
   const check = preResolvedCheckOf(gate);
-  return check !== null && check.state === "deny" && check.source !== "session";
+  return check !== null && check.state === "deny";
 }
 
 /**

package/src/handlers/gates/runner.ts

@@ -116,8 +116,10 @@ export class GateRunner {
     // context holds what every resolution of this gate shares, and who decided
     // is by definition not shared (#726).
 
-    // 2. Session-hit fast path
-    if (check.source === "session") {
+    // 2. Session-hit fast path: a session grant is an allow. `SessionRules`
+    // records nothing else, so a session-sourced ask or deny means something
+    // clamped a grant, and it takes the gate below instead of riding the grant.
+    if (check.source === "session" && check.state === "allow") {
       this.reporter.writeReviewLog("permission_request.session_approved", {
         ...logContext,
         resolution: "session_approved",

package/src/path/safe-system-paths.ts

@@ -1,9 +1,12 @@
+/** The device a write discards: nothing written to it reaches any file. */
+const DISCARD_DEVICE = "/dev/null";
+
 /**
  * Paths that are universally safe and should never trigger external-directory checks.
  * These are OS device files: read returns EOF or process streams, write discards or goes to process streams.
  */
 export const SAFE_SYSTEM_PATHS: ReadonlySet<string> = new Set([
-  "/dev/null",
+  DISCARD_DEVICE,
   "/dev/stdin",
   "/dev/stdout",
   "/dev/stderr",
@@ -16,3 +19,16 @@ export const SAFE_SYSTEM_PATHS: ReadonlySet<string> = new Set([
 export function isSafeSystemPath(normalizedPath: string): boolean {
   return SAFE_SYSTEM_PATHS.has(normalizedPath);
 }
+
+/**
+ * Returns true only for the discard device, `/dev/null`, so a write to `path`
+ * touches no file.
+ *
+ * Narrower than {@link isSafeSystemPath}: on Linux, `/dev/std{in,out,err}`
+ * link to `/proc/self/fd/N`, and opening one for writing reopens the
+ * descriptor's underlying file with `O_TRUNC` — `cat < f > /dev/stdin`
+ * truncates `f`.
+ */
+export function isDiscardDevice(path: string): boolean {
+  return path === DISCARD_DEVICE;
+}