@gotgenes/pi-permission-system 40.1.1 → 40.1.2

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.1...pi-permission-system-v40.1.2) (2026-10-09)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** sudoedit and sudo's clustered or long options no longer earn the pure-reader exemption ([b94d064](https://github.com/gotgenes/pi-packages/commit/b94d064f27e3271a40b157ae311105d14aa83c1b)), closes [#1042](https://github.com/gotgenes/pi-packages/issues/1042)
+* **pi-permission-system:** sudo's shell, login, chdir, and chroot modes keep the indirection floor ([3e36c7b](https://github.com/gotgenes/pi-packages/commit/3e36c7b4090299a147d877d25ea332ad95a8bc0c)), closes [#1042](https://github.com/gotgenes/pi-packages/issues/1042)
+
+### Documentation
+
+* **pi-permission-system:** document the sudo modes that keep the indirection floor ([bd77430](https://github.com/gotgenes/pi-packages/commit/bd774308a50d817b7913713acc963c0f49c635e0))
+
 ## [40.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.0...pi-permission-system-v40.1.1) (2026-10-08)
 
 

package/docs/configuration.md

@@ -1138,6 +1138,10 @@ If you run a permissive `bash` policy and want privilege elevation to prompt reg
 
 That rule matches the wrapper's own text, so it is decided before the exemption is ever consulted.
 
+`sudo`'s own options are read the way `sudo` reads them, so `sudo -nu cat rm x` runs `rm x`, not a pure reader named `cat`.
+A `sudo` mode in which the command it names is not what runs as named keeps the floor whatever that command is: `-e`/`--edit` (sudoedit edits its operands as files, as root), `-s`/`--shell` and `-i`/`--login` (a shell runs the operand), and `-D`/`--chdir` and `-R`/`--chroot` (relative operands resolve somewhere the path surfaces do not look).
+So does `-h`, whose meaning depends on what follows it, and any option `sudo`'s manual does not list; a mode that keeps the floor is approved at the prompt or under `yoloMode`.
+
 #### Which key to actually write
 
 The useful *grants* are `*_read: allow` and the bare sugar key.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.1.1",
+  "version": "40.1.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/wrapper-analysis.ts

@@ -402,10 +402,10 @@ function unquote(text: string): string {
  * Index of the word beginning the inner command, or `-1` when the wrapper's own
  * options run out first.
  *
- * Skips the wrapper name, environment assignments, options (consuming a
- * following value for the options in {@link VALUE_TAKING_FLAGS}), and a leading
- * operand for the wrappers that take one. An exec-conditional wrapper instead
- * starts immediately after its exec flag.
+ * An exec-conditional wrapper starts immediately after its exec flag. A wrapper
+ * with a {@link GETOPT_GRAMMARS} entry is read as getopt reads it, and answers
+ * `-1` for any option its grammar refuses; every other wrapper is read by the
+ * per-wrapper tables.
  */
 function innerCommandIndex(words: readonly CommandWord[]): number {
   const name = wrapperName(words);
@@ -415,6 +415,101 @@ function innerCommandIndex(words: readonly CommandWord[]): number {
   const execFlag = execFlagIndex(name, argTexts);
   if (execFlag !== -1) return execFlag + 2;
 
+  const grammar = GETOPT_GRAMMARS.get(name);
+  return grammar === undefined
+    ? tableInnerIndex(words, name)
+    : getoptInnerIndex(words, grammar);
+}
+
+/**
+ * {@link innerCommandIndex} for a wrapper read as getopt_long reads it, with
+ * options permuted no further than the first non-option (sudo's `+` optstring).
+ *
+ * Options come first, then the `NAME=value` assignments the wrapper passes to
+ * the command, then the command. `-1` when an option is refused, unlisted, or
+ * an ambiguous abbreviation, or when the words run out first.
+ */
+function getoptInnerIndex(
+  words: readonly CommandWord[],
+  grammar: GetoptGrammar,
+): number {
+  let index = 1;
+  while (index < words.length) {
+    const word = words[index].text;
+    if (word === "--") {
+      index++;
+      break;
+    }
+    if (!word.startsWith("-") || word === "-") break;
+    const consumed = word.startsWith("--")
+      ? longOptionWords(word.slice(2), grammar.long)
+      : shortClusterWords(word.slice(1), grammar.short);
+    if (consumed === undefined) return -1;
+    index += consumed;
+  }
+  while (index < words.length && isEnvironmentAssignment(words[index].text)) {
+    index++;
+  }
+  return index < words.length ? index : -1;
+}
+
+/**
+ * How many words a short-option cluster spans (`-nu root` is two), or
+ * `undefined` when a letter in it is refused or unlisted.
+ *
+ * A value-taking letter ends the cluster: the rest of the cluster is its value
+ * (`-uedward`), or the following word when nothing is left (`-nu root`).
+ */
+function shortClusterWords(
+  letters: string,
+  table: ReadonlyMap<string, OptionArity>,
+): number | undefined {
+  for (let position = 0; position < letters.length; position++) {
+    const arity = table.get(letters[position]);
+    if (arity === undefined || arity === "refuse") return undefined;
+    if (arity === "value") return position + 1 < letters.length ? 1 : 2;
+  }
+  return 1;
+}
+
+/**
+ * How many words a long option spans (`--user root` is two, `--user=root`
+ * one), or `undefined` when it is refused, unlisted, or ambiguous.
+ */
+function longOptionWords(
+  body: string,
+  table: ReadonlyMap<string, OptionArity>,
+): number | undefined {
+  const equals = body.indexOf("=");
+  const name = equals === -1 ? body : body.slice(0, equals);
+  const arity = resolveLongOption(name, table);
+  if (arity === undefined || arity === "refuse") return undefined;
+  return arity === "value" && equals === -1 ? 2 : 1;
+}
+
+/**
+ * A long option's arity by its exact name, or by the one key it abbreviates.
+ *
+ * Abbreviations resolve against every key, refusing ones included, as
+ * getopt_long does: `--l` is ambiguous between `--list` and `--login`, and
+ * resolving against the admitted keys alone would read it as `--list`.
+ */
+function resolveLongOption(
+  name: string,
+  table: ReadonlyMap<string, OptionArity>,
+): OptionArity | undefined {
+  const exact = table.get(name);
+  if (exact !== undefined) return exact;
+  const matches = [...table.keys()].filter((key) => key.startsWith(name));
+  return matches.length === 1 ? table.get(matches[0]) : undefined;
+}
+
+/**
+ * {@link innerCommandIndex} for a wrapper described by the per-wrapper tables:
+ * its value-taking options ({@link VALUE_TAKING_FLAGS}) and whether it takes a
+ * leading operand ({@link LEADING_OPERAND_WRAPPERS}).
+ */
+function tableInnerIndex(words: readonly CommandWord[], name: string): number {
   const valueTaking = VALUE_TAKING_FLAGS.get(name) ?? EMPTY_FLAGS;
   let operandPending = LEADING_OPERAND_WRAPPERS.has(name);
   let index = 1;
@@ -535,11 +630,15 @@ const EXEC_CONDITIONAL_WRAPPERS = new Map<string, ReadonlySet<string>>([
  * Curated per-wrapper options that consume the following word, so skipping a
  * wrapper's own arguments does not mistake an option's value for the inner
  * command. Attached forms (`-I{}`, `--user=root`) need no entry — they are one
- * word. Only the display-side extraction reads this, and a missing or wrong
- * entry yields `null` (see {@link executedUnitOf}), never a weaker gate.
+ * word.
+ *
+ * This table decides the gate, not only the display: {@link floorExemptionOf}
+ * judges the command it locates, so a missing entry can name a pure reader that
+ * is really an option's value (`xargs -J cat rm x`), and the execution-modifier
+ * clause admits value-taking options from it. A wrapper read by a
+ * {@link GETOPT_GRAMMARS} entry has no row here.
  */
 const VALUE_TAKING_FLAGS = new Map<string, ReadonlySet<string>>([
-  ["sudo", new Set(["-u", "-g", "-p", "-C", "-h", "-U", "-r", "-t"])],
   ["doas", new Set(["-u", "-C"])],
   ["env", new Set(["-u", "-C", "--unset", "--chdir"])],
   [
@@ -556,6 +655,101 @@ const VALUE_TAKING_FLAGS = new Map<string, ReadonlySet<string>>([
 
 const EMPTY_FLAGS: ReadonlySet<string> = new Set<string>();
 
+/**
+ * How a getopt-parsed wrapper treats one of its options: a flag, an option
+ * taking a value, or a mode in which the command the peel would name is not
+ * the one that runs, which refuses the peel.
+ */
+type OptionArity = "flag" | "value" | "refuse";
+
+/**
+ * A wrapper's options as getopt_long reads them, keyed by short letter and by
+ * full long name. Anything absent refuses, so a missing row costs a prompt and
+ * never misplaces the inner command.
+ */
+interface GetoptGrammar {
+  readonly short: ReadonlyMap<string, OptionArity>;
+  readonly long: ReadonlyMap<string, OptionArity>;
+}
+
+/**
+ * `sudo`'s options, verified against `man sudo` (1.9.17p2). The SELinux
+ * `-r`/`-t` (`--role`/`--type`) are absent from that page, so they are left
+ * unlisted and refuse.
+ *
+ * Each refusing mode is one where the command the peel would name is not what
+ * runs as named: `-e` (sudoedit) opens each operand in an editor and writes it
+ * back as root; `-s` and `-i` hand the operand to a shell, which still expands
+ * `$`; `-i`, `-D`, and `-R` move where its relative operands resolve, so the
+ * path surfaces would judge the wrong file; and `-h` is help alone but a remote
+ * host with a value, an arity the page does not settle.
+ */
+const SUDO_GRAMMAR: GetoptGrammar = {
+  short: new Map<string, OptionArity>([
+    ["A", "flag"],
+    ["B", "flag"],
+    ["b", "flag"],
+    ["E", "flag"],
+    ["H", "flag"],
+    ["K", "flag"],
+    ["k", "flag"],
+    ["l", "flag"],
+    ["N", "flag"],
+    ["n", "flag"],
+    ["P", "flag"],
+    ["S", "flag"],
+    ["V", "flag"],
+    ["v", "flag"],
+    ["C", "value"],
+    ["g", "value"],
+    ["p", "value"],
+    ["T", "value"],
+    ["U", "value"],
+    ["u", "value"],
+    ["D", "refuse"],
+    ["e", "refuse"],
+    ["h", "refuse"],
+    ["i", "refuse"],
+    ["R", "refuse"],
+    ["s", "refuse"],
+  ]),
+  long: new Map<string, OptionArity>([
+    ["askpass", "flag"],
+    ["background", "flag"],
+    ["bell", "flag"],
+    ["help", "flag"],
+    ["list", "flag"],
+    ["no-update", "flag"],
+    ["non-interactive", "flag"],
+    // Its value is attached only (`--preserve-env=list`), which a flag accepts.
+    ["preserve-env", "flag"],
+    ["preserve-groups", "flag"],
+    ["remove-timestamp", "flag"],
+    ["reset-timestamp", "flag"],
+    ["set-home", "flag"],
+    ["stdin", "flag"],
+    ["validate", "flag"],
+    ["version", "flag"],
+    ["close-from", "value"],
+    ["command-timeout", "value"],
+    ["group", "value"],
+    ["other-user", "value"],
+    ["prompt", "value"],
+    ["user", "value"],
+    ["chdir", "refuse"],
+    ["chroot", "refuse"],
+    ["edit", "refuse"],
+    ["host", "refuse"],
+    ["login", "refuse"],
+    ["shell", "refuse"],
+  ]),
+};
+
+/** Wrappers whose inner command is located by a getopt grammar. */
+const GETOPT_GRAMMARS = new Map<string, GetoptGrammar>([
+  ["sudo", SUDO_GRAMMAR],
+]);
+
 /**
  * Wrappers that change only *how* the same visible command runs — timing, kill
  * deadline, scheduling, buffering, session — each with the flags (options