@gotgenes/pi-permission-system 40.0.1 → 40.0.2

package/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.1...pi-permission-system-v40.0.2) (2026-10-06)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a session grant on one bash unit no longer approves the chain's other asking units ([3fffff8](https://github.com/gotgenes/pi-packages/commit/3fffff8158da81094d43a62673c8388ccb1ddf61)), closes [#1033](https://github.com/gotgenes/pi-packages/issues/1033)
+
 ## [40.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.0...pi-permission-system-v40.0.1) (2026-10-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.0.1",
+  "version": "40.0.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/handlers/gates/bash-command.ts

@@ -123,9 +123,8 @@ export function resolveBashCommandCheck(
  *
  * The winner names one command, but a forwarded ask's answer approves the
  * whole tool call, so the serving node has to judge every unit the child could
- * not resolve, each with its own floor (#1030). A unit the child's rules
- * allowed stays home, and so does one the session already granted: the user
- * approved exactly that command.
+ * not resolve, each with its own floor (#1030). A unit the child's rules or
+ * the session allowed stays home.
  */
 function withAskingUnits(
   winner: PermissionCheckResult,
@@ -133,7 +132,7 @@ function withAskingUnits(
 ): PermissionCheckResult {
   if (winner.state !== "ask") return winner;
   const askingUnits = results
-    .filter((result) => result.state === "ask" && result.source !== "session")
+    .filter((result) => result.state === "ask")
     .map((result) => ({
       command: result.command ?? "",
       ...(result.floor === undefined ? {} : { floor: result.floor }),
@@ -149,17 +148,14 @@ function withAskingUnits(
  * `git push x && sudo rm y` a `git push *: ask` rule wins the tie and the
  * wrapper's floor would otherwise go unrecorded. A forwarded ask is judged on
  * the winner's value alone, so the floor has to ride the result for the
- * serving node to keep it (#1029). A unit the session already granted is left
- * out: the user approved exactly that command.
+ * serving node to keep it (#1029).
  */
 function withChainFloor(
   winner: PermissionCheckResult,
   results: readonly PermissionCheckResult[],
 ): PermissionCheckResult {
   if (winner.state !== "ask" || winner.floor !== undefined) return winner;
-  const floored = results.find(
-    (result) => result.floor !== undefined && result.source !== "session",
-  );
+  const floored = results.find((result) => result.floor !== undefined);
   return floored ? { ...winner, floor: floored.floor } : winner;
 }
 
@@ -181,7 +177,7 @@ function resolveCommandUnit(
     resolver,
   );
   const floored =
-    cmd.wrapperKind && base.state === "allow"
+    cmd.wrapperKind && base.state === "allow" && !isSessionGrant(base)
       ? resolveWrapperUnit(cmd, cmd.wrapperKind, base, agentName, resolver)
       : base;
   const unparsed = floorUnparsedUnit(cmd, command, floored);
@@ -210,26 +206,40 @@ function resolveCommandUnit(
  * decides instead — and a wrapper unit already floored to `ask` keeps its own,
  * more specific sentinel.
  *
- * The result is built by spreading `resolved`, so a `source: "session"` grant
- * survives to `GateRunner`'s session fast path, which tests the source before
- * the state. A grant the user gave for this exact command still holds.
+ * A session grant is never floored: the user approved this exact command, and
+ * an `ask` carrying it would tie with a sibling unit's real ask and could
+ * approve the whole chain through `GateRunner`'s session fast path (#1033).
  */
 function floorUnparsedUnit(
   cmd: BashCommand,
   command: string,
   resolved: PermissionCheckResult,
 ): PermissionCheckResult {
-  if (!cmd.parseUnresolved || resolved.state !== "allow") return resolved;
+  if (
+    !cmd.parseUnresolved ||
+    resolved.state !== "allow" ||
+    isSessionGrant(resolved)
+  ) {
+    return resolved;
+  }
   return { ...floorToAsk(resolved, UNPARSED_SUBTREE_SENTINEL), command };
 }
 
+/**
+ * True when the session layer decided the check. `SessionRules` records only
+ * `allow`s, so this is a grant the user gave for the command it matched.
+ */
+function isSessionGrant(check: PermissionCheckResult): boolean {
+  return check.source === "session";
+}
+
 /**
  * Clamp a resolved check up to a synthetic `ask` naming the floor that raised
  * it.
  *
- * Spreads `resolved`, so a `source: "session"` grant survives to `GateRunner`'s
- * session fast path. Drops `matchedSpelling`: it names what the replaced rule
- * matched, and beside the sentinel it would name a match that did not decide.
+ * Never handed a session grant: both floors leave one unfloored. Drops
+ * `matchedSpelling`: it names what the replaced rule matched, and beside the
+ * sentinel it would name a match that did not decide.
  */
 function floorToAsk(
   resolved: PermissionCheckResult,

package/src/handlers/gates/descriptor.ts

@@ -138,13 +138,10 @@ export function preResolvedCheckOf(
  * a semantic one, and it is why the same treatment is *not* extended to `ask`
  * (#915): two asking gates ask two different questions.
  *
- * Subordinate to {@link GateRunner.runDescriptor}'s own precedence, which
- * tests `source === "session"` before the deny/ask/allow gate is reached — a
- * session-sourced check is allowed there, so it is not pre-emptive here.
- * `SessionRules` records only allows, so that combination is unreachable
- * today; the clause is kept so the predicate is correct on its own terms
- * rather than by way of a distant invariant, and it errs toward today's
- * behavior by declining to pre-empt.
+ * A session-sourced `deny` counts too: {@link GateRunner.runDescriptor}'s
+ * session fast path takes only a session `allow`, so any other session-sourced
+ * check reaches the deny/ask/allow gate and a `deny` blocks there. `SessionRules`
+ * records only allows, so that combination is unreachable today.
  *
  * Yolo needs no clause: `resolveYoloGrant` matches an `allow` of origin
  * `yolo` and an `ask`, never a `deny`.
@@ -154,7 +151,7 @@ export function isUnconditionalDeny(gate: GateResult): boolean {
     return false;
   }
   const check = preResolvedCheckOf(gate);
-  return check !== null && check.state === "deny" && check.source !== "session";
+  return check !== null && check.state === "deny";
 }
 
 /**

package/src/handlers/gates/runner.ts

@@ -116,8 +116,10 @@ export class GateRunner {
     // context holds what every resolution of this gate shares, and who decided
     // is by definition not shared (#726).
 
-    // 2. Session-hit fast path
-    if (check.source === "session") {
+    // 2. Session-hit fast path: a session grant is an allow. `SessionRules`
+    // records nothing else, so a session-sourced ask or deny means something
+    // clamped a grant, and it takes the gate below instead of riding the grant.
+    if (check.source === "session" && check.state === "allow") {
       this.reporter.writeReviewLog("permission_request.session_approved", {
         ...logContext,
         resolution: "session_approved",