@gotgenes/pi-permission-system 40.0.2 → 40.1.1

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.0...pi-permission-system-v40.1.1) (2026-10-08)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** commands inside time ( … ) are gated on their own rules ([0b77df6](https://github.com/gotgenes/pi-packages/commit/0b77df61d03c31e394cf68971df0e526b44a1abd)), closes [#1027](https://github.com/gotgenes/pi-packages/issues/1027)
+* **pi-permission-system:** a cd inside time ( … ) resolves the paths after it in that subshell ([6994e15](https://github.com/gotgenes/pi-packages/commit/6994e15042e2ec6cb9e495973e0407d80fa2ff25)), closes [#1027](https://github.com/gotgenes/pi-packages/issues/1027)
+
+### Documentation
+
+* **pi-permission-system:** document the timed-subshell descent and mark #1027 complete ([8337f54](https://github.com/gotgenes/pi-packages/commit/8337f5494ddd7a6c84561e3092700112e1de78a8))
+
+## [40.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.2...pi-permission-system-v40.1.0) (2026-10-08)
+
+
+### Features
+
+* **pi-permission-system:** sudo -n true and other shell no-ops behind a wrapper resolve by their own rule ([a0889ee](https://github.com/gotgenes/pi-packages/commit/a0889ee49c3ea217bb534339c12dc6c470020429)), closes [#1039](https://github.com/gotgenes/pi-packages/issues/1039)
+
+### Documentation
+
+* **pi-permission-system:** document shell no-ops in the pure-reader core ([#1039](https://github.com/gotgenes/pi-packages/issues/1039)) ([de296e0](https://github.com/gotgenes/pi-packages/commit/de296e0306a022b19fc5a8584e7c74841a35e69f))
+
 ## [40.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.1...pi-permission-system-v40.0.2) (2026-10-06)
 
 

package/docs/configuration.md

@@ -1009,7 +1009,7 @@ A path token owned by one of them consults the `_read` surface alone:
 
 <!-- BEGIN PURE_READER_CORE -->
 
-`awk`, `basename`, `cat`, `cd`, `diff`, `dirname`, `echo`, `egrep`, `fd`, `fgrep`, `find`, `grep`, `head`, `ls`, `pwd`, `realpath`, `rg`, `sed`, `sort`, `stat`, `tail`, `wc`, `which`
+`:`, `awk`, `basename`, `cat`, `cd`, `diff`, `dirname`, `echo`, `egrep`, `false`, `fd`, `fgrep`, `find`, `grep`, `head`, `ls`, `pwd`, `realpath`, `rg`, `sed`, `sort`, `stat`, `tail`, `true`, `wc`, `which`
 
 <!-- END PURE_READER_CORE -->
 
@@ -1079,7 +1079,7 @@ All four of these must hold, and each is a way the floor's reason could still ap
 4. The enclosing statement provably writes no file through a redirect.
    A destination the parse cannot resolve — `> $OUT`, `> $(mktemp)` — counts against the exemption rather than for it.
 
-So `xargs grep -l foo`, `xargs wc -l`, `xargs sed -n 1p`, and `find . -name '*.ts' -exec cat {} +` stop prompting under a matching `bash` allow, while `xargs rm`, `xargs sed -i`, and `find . -exec sh -c '…' \;` still prompt.
+So `xargs grep -l foo`, `xargs wc -l`, `xargs sed -n 1p`, `find . -name '*.ts' -exec cat {} +`, and the no-op probe `sudo -n true` stop prompting under a matching `bash` allow, while `xargs rm`, `xargs sed -i`, and `find . -exec sh -c '…' \;` still prompt.
 
 Three things this does **not** change:
 
@@ -1107,7 +1107,8 @@ All four of these must hold, and each keeps the decision about the command that
    The admitted options are `time -p`/`-l`/`-h`/`-f`; `timeout -s`/`-k`/`-f`/`-p`/`-v` and their long forms; `nice -n`/`--adjustment`; and `stdbuf -i`/`-o`/`-e` and their long forms.
 3. The command it runs is not itself a wrapper or an inline shell, so `timeout 5 bash -c '…'` stays floored.
 4. The command it runs is named literally.
-   `time ( … )` and `time { …; }` stay floored: the parser reads the group as `time`'s arguments, so the commands inside are not yet gated on their own rules.
+   `time ( … )` is decided by the commands inside it, each on its own rule, so `time (rm -rf /tmp/x)` reaches an `rm *` deny.
+   `time { …; }` stays floored: the parser reads the group as `time`'s arguments, so the commands inside are not yet gated on their own rules.
 
 So under `bash: {"*": "allow", "git push *": "deny"}`, `time pnpm run lint >/tmp/lint.txt 2>&1` is allowed and `timeout 60 git push --force` is denied, exactly as without the wrapper.
 No redirect refusal applies here: the redirect destination goes through `path` and `external_directory` as it does for the bare command, and a destination the parse cannot resolve (`> $OUT`) is unprojected for both forms alike.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.0.2",
+  "version": "40.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/bash-path-resolver.ts

@@ -8,6 +8,7 @@ import { normalizePathPolicyLiteral } from "#src/access-intent/path-normalizatio
 import type { PathNormalizer } from "#src/path/path-normalizer";
 import { isSafeSystemPath } from "#src/path/safe-system-paths";
 import type { ArgumentSpeller } from "./command-enumeration";
+import { timedSubshellOf } from "./nested-execution";
 import {
   ARG_NODE_TYPES,
   SKIP_SUBTREE_TYPES,
@@ -238,6 +239,8 @@ export class BashPathResolver {
    * does not update the running directory; subshell and brace-group interiors
    * inherit the enclosing base without folding their own `cd`s (a conservative
    * first tier).
+   * A subshell timed by `time`, which the grammar reads as the argument of a
+   * command named `time`, is walked as a bare subshell is.
    */
   private collectPathCandidates(
     rootNode: TSNode,
@@ -263,9 +266,14 @@ export class BashPathResolver {
       case "list":
       case "redirected_statement":
         return this.walkCurrentShellSequence(node, base, out);
-      case "command":
+      case "command": {
+        const timed = timedSubshellOf(node);
+        if (timed !== null) {
+          return this.walkTimedSubshell(node, timed, base, out);
+        }
         tagTokens(collectCommandTokens(node, this.words), base, out);
         return this.foldCd(node, base);
+      }
       case "pipeline":
         // tree-sitter-bash mis-groups a redirect-bearing `&&`/`;` list as the
         // first stage of a pipeline (`cd a && pnpm x 2>&1 | tail` parses as
@@ -294,6 +302,30 @@ export class BashPathResolver {
     }
   }
 
+  /**
+   * Walk `time ( … )`, returning the base in force after it, which is `base`.
+   *
+   * The subshell is walked as a subshell, so its `cd`s fold for the commands
+   * after them inside it and reset on exit. Every other named child but the
+   * `time` name, such as a redirect the command hosts (`2>err time ( … )`),
+   * is collected against `base`.
+   */
+  private walkTimedSubshell(
+    command: TSNode,
+    subshell: TSNode,
+    base: EffectiveBase,
+    out: PathCandidate[],
+  ): EffectiveBase {
+    for (let i = 0; i < command.childCount; i++) {
+      const child = command.child(i);
+      if (!child?.isNamed || child.type === "command_name") continue;
+      if (child.startIndex === subshell.startIndex) continue;
+      tagTokens(collectPathCandidateTokens(child, this.words), base, out);
+    }
+    this.walkForCandidates(subshell, base, out);
+    return base;
+  }
+
   /**
    * Fold a current-shell sequence (`program` / `list` / `redirected_statement`):
    * thread the effective base left-to-right through the children so a `cd`

package/src/access-intent/bash/command-effects.ts

@@ -155,6 +155,11 @@ function coreAdmissions(): readonly CoreAdmission[] {
       reason:
         "No filesystem write: `echo` writes to stdout (a redirect destination is the syntax proof's job, not `echo`'s); `cd` reads a directory to enter it",
     },
+    {
+      words: ["true", "false", ":"],
+      reason:
+        "No-ops: ignore their operands and touch no file; GNU's `--help`/`--version` print to stdout only",
+    },
     {
       words: ["find", "fd", "sort"],
       reason:

package/src/access-intent/bash/command-enumeration.ts

@@ -1,5 +1,10 @@
 import type { BashCommandContext, FloorExemption } from "#src/types";
-import { EXECUTION_HOST_TYPES, forEachExecutionIn } from "./nested-execution";
+import {
+  commandWordNodes,
+  EXECUTION_HOST_TYPES,
+  forEachExecutionIn,
+  timedSubshellOf,
+} from "./nested-execution";
 import type { WordReader } from "./node-text";
 import { parseUnresolvedWithin } from "./parse-health";
 import type { TSNode } from "./parser";
@@ -269,7 +274,8 @@ const STATEMENT_TYPES = new Set([
  * substitution (`$(…)`, backticks), process substitution (`<(…)`/`>(…)`), and
  * subshells (`( … )`) — emitting each inner command as its own unit *in
  * addition to* the enclosing command, since those inner commands really execute
- * (#306).
+ * (#306). A subshell timed by `time`, which the grammar reads as the argument
+ * of a command named `time`, is descended the same way.
  * A compound statement (control flow, a function definition, a `{ … }` brace
  * group) is emitted whole and then descended for the statements it contains,
  * while its operand words — a loop variable, a word list, a `case` subject, a
@@ -363,6 +369,11 @@ function collectCommandsInto(
   const scope = unresolvedScope(node, inherited);
 
   if (node.type === "command") {
+    const timed = timedSubshellOf(node);
+    if (timed !== null) {
+      collectTimedSubshell(node, timed, scope, out);
+      return;
+    }
     out.push(makeCommandUnit(node, scope));
     // A command's text already contains any substitution; descend its subtree
     // to ALSO emit the inner commands of command/process substitutions.
@@ -422,6 +433,40 @@ function collectCommandsInto(
   collectHostedCommands(node, scope, out);
 }
 
+/**
+ * Enumerate `time ( … )`: the `time` unit whole, then the subshell's commands
+ * as units of their own, exactly as a bare subshell's are.
+ *
+ * The `time` unit is the never-weaker whole emit, and it is exempt from the
+ * wrapper floor: the floor exists because a wrapper hides the command that
+ * should be gated, and every command in this subshell is a unit gated on its
+ * own rules. It resolves by its executed unit, the subshell's text, which is
+ * how the bare subshell's whole unit resolves.
+ *
+ * Substitutions the command hosts outside the subshell (in a redirect) are
+ * still enumerated, and the subshell is left to the descent so a substitution
+ * inside it is emitted once.
+ */
+function collectTimedSubshell(
+  node: TSNode,
+  subshell: TSNode,
+  scope: UnitScope,
+  out: BashCommand[],
+): void {
+  out.push(makeCommandUnit(node, scope, "execution-modifier"));
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child && child.startIndex !== subshell.startIndex) {
+      collectHostedCommands(child, scope, out);
+    }
+  }
+  descendCommandChildren(
+    subshell,
+    { ...redirectedScope(node, scope), context: "subshell" },
+    out,
+  );
+}
+
 /**
  * The scope `node`'s own subtree establishes, marking it unresolved when
  * tree-sitter could not parse a region within it (#840).
@@ -488,7 +533,11 @@ function makeUnit(
  * before or between the words (`>/tmp/o xargs grep foo`) writes a file as
  * surely as one on the enclosing statement.
  */
-function makeCommandUnit(node: TSNode, scope: UnitScope): BashCommand {
+function makeCommandUnit(
+  node: TSNode,
+  scope: UnitScope,
+  floorExemption?: FloorExemption,
+): BashCommand {
   const { text, words, argumentSpelling } = readCommandUnit(node, scope);
   return makeUnit(text, scope, {
     spellings: distinctSpellings(text, [
@@ -497,7 +546,8 @@ function makeCommandUnit(node: TSNode, scope: UnitScope): BashCommand {
     ]),
     wrapperKind: classifyWrapperWords(words),
     executedUnit: executedUnitOf(text, words) ?? undefined,
-    floorExemption: floorExemptionOf(words, redirectedScope(node, scope)),
+    floorExemption:
+      floorExemption ?? floorExemptionOf(words, redirectedScope(node, scope)),
   });
 }
 
@@ -626,28 +676,6 @@ function gapBetween(
   );
 }
 
-/**
- * The nodes {@link readCommandUnit} reports words for, in the same order: every
- * named child except a prefix assignment and a hosted redirect.
- *
- * Split out so a consumer that needs a *node* rather than a word (the log's
- * command masker, which offsets a re-parse by the payload node's `startIndex`)
- * walks the identical filtered list. Two walks over the same children with the
- * same filter, written twice, is how the two come to disagree about which word
- * is at which index.
- */
-function commandWordNodes(node: TSNode): TSNode[] {
-  const nodes: TSNode[] = [];
-  for (let i = 0; i < node.childCount; i++) {
-    const child = node.child(i);
-    if (!child?.isNamed) continue;
-    if (child.type === "variable_assignment") continue;
-    if (REDIRECT_NODE_TYPES.has(child.type)) continue;
-    nodes.push(child);
-  }
-  return nodes;
-}
-
 /** The redirects a `command` node hosts among its own children. */
 function hostedRedirects(node: TSNode): TSNode[] {
   const redirects: TSNode[] = [];

package/src/access-intent/bash/nested-execution.ts

@@ -1,5 +1,6 @@
 import type { BashCommandContext } from "#src/types";
 import type { TSNode } from "./parser";
+import { REDIRECT_NODE_TYPES } from "./redirect-analysis";
 
 /**
  * AST node types whose interior commands really execute when the shell runs the
@@ -47,6 +48,50 @@ export const EXECUTION_HOST_TYPES: ReadonlySet<string> = new Set([
   "heredoc_body",
 ]);
 
+/**
+ * The word nodes of a `command` node, in source order: every named child except
+ * a prefix assignment and a hosted redirect.
+ *
+ * Shared so every consumer that reads a command's words, whether as words (the
+ * command enumerator's unit text) or as nodes (the log's command masker, which
+ * offsets a re-parse by the payload node's `startIndex`), walks the identical
+ * filtered list. Two walks over the same children with the same filter,
+ * written twice, is how the two come to disagree about which word is at which
+ * index.
+ */
+export function commandWordNodes(node: TSNode): TSNode[] {
+  const nodes: TSNode[] = [];
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (!child?.isNamed) continue;
+    if (child.type === "variable_assignment") continue;
+    if (REDIRECT_NODE_TYPES.has(child.type)) continue;
+    nodes.push(child);
+  }
+  return nodes;
+}
+
+/**
+ * The subshell a `command` node times, or `null` when it is not `time ( … )`.
+ *
+ * `tree-sitter-bash` has no `time` keyword, so `time (rm x)` parses as a
+ * command named `time` whose only argument is a `subshell`. Bash runs that
+ * subshell's commands as surely as a bare `( … )`'s, so both bash surfaces read
+ * the shape through this one recognizer rather than each re-deciding it.
+ *
+ * The words must be exactly a `time` spelled literally (a quoted `"time"` is
+ * not the keyword) and one subshell. Anything between them (`time -p ( … )`,
+ * whose `-p` the grammar cannot place) leaves the shape unrecognized, so it
+ * keeps whatever floor the enumerator gives it.
+ */
+export function timedSubshellOf(command: TSNode): TSNode | null {
+  const words = commandWordNodes(command);
+  if (words.length !== 2) return null;
+  const [name, argument] = words;
+  if (argument.type !== "subshell") return null;
+  return name.type === "command_name" && name.text === "time" ? argument : null;
+}
+
 /**
  * Visit every execution context `node` *is or contains*, in source order.
  *

package/src/access-intent/bash/wrapper-analysis.ts

@@ -223,7 +223,10 @@ export function floorExemptionOf(
  *    past.
  * 4. The inner head is a literal command name. The grammar has no `time`
  *    keyword, so `time { …; }` and `time ( … )` reach here with shell syntax
- *    where the command name should be.
+ *    where the command name should be. A word list cannot tell whether that
+ *    syntax was enumerated, so both keep the floor here; the command
+ *    enumerator, which descends a `time ( … )` subshell, exempts that shape
+ *    itself.
  */
 function onlyModifiesExecution(
   peeled: readonly (readonly CommandWord[])[],