@gotgenes/pi-permission-system 5.11.1 → 5.14.1

package/CHANGELOG.md

@@ -5,6 +5,85 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.14.1](https://github.com/gotgenes/pi-permission-system/compare/v5.14.0...v5.14.1) (2026-05-11)
+
+
+### Bug Fixes
+
+* show tool name instead of bare wildcard in session-approval label ([1a65c30](https://github.com/gotgenes/pi-permission-system/commit/1a65c3017f25012c3a7ced63f26d40fcecea81d3))
+* surface-prefixed session-approval labels for all permission surfaces ([759da03](https://github.com/gotgenes/pi-permission-system/commit/759da03be9c0d847ec6de58e161ef2e7cbbc70b8))
+
+
+### Documentation
+
+* **retro:** add retro notes for issue [#122](https://github.com/gotgenes/pi-permission-system/issues/122) ([7867db2](https://github.com/gotgenes/pi-permission-system/commit/7867db22054df00e13aa6c88347238dadaa63166))
+
+## [5.14.0](https://github.com/gotgenes/pi-permission-system/compare/v5.13.0...v5.14.0) (2026-05-09)
+
+
+### Features
+
+* support ? single-character wildcard in permission patterns ([#122](https://github.com/gotgenes/pi-permission-system/issues/122)) ([7b56f49](https://github.com/gotgenes/pi-permission-system/commit/7b56f4979a3479912dcc1d903f52a517587b95f6))
+
+
+### Documentation
+
+* document ? wildcard and update OpenCode compatibility ([#122](https://github.com/gotgenes/pi-permission-system/issues/122)) ([31ace5f](https://github.com/gotgenes/pi-permission-system/commit/31ace5f36a11299750994c2b9e6084dbecc240ba))
+* plan ? single-character wildcard support ([#122](https://github.com/gotgenes/pi-permission-system/issues/122)) ([a7a2963](https://github.com/gotgenes/pi-permission-system/commit/a7a296337809ee7c107f86b87b64bfeb3709467f))
+* **retro:** add retro notes for issue [#1](https://github.com/gotgenes/pi-permission-system/issues/1) ([b1c66f1](https://github.com/gotgenes/pi-permission-system/commit/b1c66f18d1aed5cc95a1fccb1a9c6c0f44f5cd11))
+
+## [5.13.0](https://github.com/gotgenes/pi-permission-system/compare/v5.12.0...v5.13.0) (2026-05-08)
+
+
+### Features
+
+* warn that this is a pnpm project on global npm pass-throughs ([f643149](https://github.com/gotgenes/pi-permission-system/commit/f64314981126331ec96ec6a20418440eff1738e7))
+
+
+### Bug Fixes
+
+* pass through npm install/uninstall -g in PATH shim ([eaf4256](https://github.com/gotgenes/pi-permission-system/commit/eaf4256446b2c1ec3ecba98d11cc75b1406931af))
+* prevent double-loading extension in dev via project settings ([6c39f33](https://github.com/gotgenes/pi-permission-system/commit/6c39f33890e61b5e0fde41d178aad9df93592cc9))
+
+
+### Documentation
+
+* plan external_directory integration tests ([#1](https://github.com/gotgenes/pi-permission-system/issues/1)) ([695ffeb](https://github.com/gotgenes/pi-permission-system/commit/695ffeb6d7a648df3dd9e18a01c20ff22266857b))
+* **retro:** add retro notes for double-prompt investigation ([37734a5](https://github.com/gotgenes/pi-permission-system/commit/37734a57aee972aa4c732d92eeda424dd40443ee))
+* **retro:** add retro notes for issue [#123](https://github.com/gotgenes/pi-permission-system/issues/123) ([5dbea33](https://github.com/gotgenes/pi-permission-system/commit/5dbea3379963b6231a4a101c889a4594705b12b6))
+
+
+### Miscellaneous Chores
+
+* switch ask tool from pi-ask-user to @eko24ive/pi-ask ([0087458](https://github.com/gotgenes/pi-permission-system/commit/00874585724d79fbeda1fca84b998db3bcd1a043))
+
+## [5.12.0](https://github.com/gotgenes/pi-permission-system/compare/v5.11.2...v5.12.0) (2026-05-08)
+
+
+### Features
+
+* support trailing wildcard optionality ([#123](https://github.com/gotgenes/pi-permission-system/issues/123)) ([c25b0b5](https://github.com/gotgenes/pi-permission-system/commit/c25b0b5c59e5d5739a3b6c99de18444a4e7820ec))
+
+
+### Documentation
+
+* plan trailing wildcard optionality ([#123](https://github.com/gotgenes/pi-permission-system/issues/123)) ([a6a50d2](https://github.com/gotgenes/pi-permission-system/commit/a6a50d28284bb624a3695d361b5b9f2a9861f470))
+* **retro:** add retro notes for issue [#113](https://github.com/gotgenes/pi-permission-system/issues/113) ([7412740](https://github.com/gotgenes/pi-permission-system/commit/7412740c876c42cc1cd63f95ee4cb0ea0de72e68))
+* update wildcard optionality docs ([#123](https://github.com/gotgenes/pi-permission-system/issues/123)) ([562adaf](https://github.com/gotgenes/pi-permission-system/commit/562adaff9726096004dc4f5214550af2dc2fc118))
+
+## [5.11.2](https://github.com/gotgenes/pi-permission-system/compare/v5.11.1...v5.11.2) (2026-05-08)
+
+
+### Documentation
+
+* plan removal of legacy path defaults from logging and extension-config ([#113](https://github.com/gotgenes/pi-permission-system/issues/113)) ([27ec0d8](https://github.com/gotgenes/pi-permission-system/commit/27ec0d8668c8c006f94c544e55d10c0eb272ddab))
+
+
+### Miscellaneous Chores
+
+* approve @google/genai build scripts in pnpm-workspace.yaml ([23b177f](https://github.com/gotgenes/pi-permission-system/commit/23b177f8c5e00d5bc9812fa826c34844cc665d7a))
+* upgrade pnpm to 11.0.8 and update deps ([31eb848](https://github.com/gotgenes/pi-permission-system/commit/31eb848539ff411cb7b6f422cd0244d6c9765ac7))
+
 ## [5.11.1](https://github.com/gotgenes/pi-permission-system/compare/v5.11.0...v5.11.1) (2026-05-08)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "5.11.1",
+  "version": "5.14.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "files": [
@@ -52,10 +52,10 @@
     "@earendil-works/pi-tui": "*"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.13",
+    "@biomejs/biome": "^2.4.14",
     "@earendil-works/pi-coding-agent": "^0.74.0",
     "@earendil-works/pi-tui": "^0.74.0",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.6.2",
     "markdownlint-cli2": "^0.22.1",
     "typescript": "6.0.3",
     "vitest": "^4.1.5"

package/src/extension-config.ts

@@ -1,11 +1,4 @@
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
+import { existsSync, mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -21,17 +14,6 @@ export interface PermissionSystemExtensionConfig {
   piInfrastructureReadPaths?: string[];
 }
 
-export interface PermissionSystemConfigLoadResult {
-  config: PermissionSystemExtensionConfig;
-  created: boolean;
-  warning?: string;
-}
-
-export interface PermissionSystemConfigSaveResult {
-  success: boolean;
-  error?: string;
-}
-
 export const DEFAULT_EXTENSION_CONFIG: PermissionSystemExtensionConfig = {
   debugLog: false,
   permissionReviewLog: true,
@@ -43,25 +25,6 @@ export function resolveExtensionRoot(moduleUrl = import.meta.url): string {
 }
 
 export const EXTENSION_ROOT = resolveExtensionRoot();
-export const CONFIG_PATH = join(EXTENSION_ROOT, "config.json");
-export const LOGS_DIR = join(EXTENSION_ROOT, "logs");
-export const DEBUG_LOG_PATH = join(LOGS_DIR, `${EXTENSION_ID}-debug.jsonl`);
-export const PERMISSION_REVIEW_LOG_PATH = join(
-  LOGS_DIR,
-  `${EXTENSION_ID}-permission-review.jsonl`,
-);
-
-function cloneDefaultConfig(): PermissionSystemExtensionConfig {
-  return {
-    debugLog: DEFAULT_EXTENSION_CONFIG.debugLog,
-    permissionReviewLog: DEFAULT_EXTENSION_CONFIG.permissionReviewLog,
-    yoloMode: DEFAULT_EXTENSION_CONFIG.yoloMode,
-  };
-}
-
-function createDefaultConfigContent(): string {
-  return `${JSON.stringify(DEFAULT_EXTENSION_CONFIG, null, 2)}\n`;
-}
 
 const PERMISSION_POLICY_KEYS: ReadonlySet<string> = new Set([
   "defaultPolicy",
@@ -100,108 +63,8 @@ export function normalizePermissionSystemConfig(
   return result;
 }
 
-function ensureConfigDirectory(configPath: string): void {
-  mkdirSync(dirname(configPath), { recursive: true });
-}
-
-export function ensurePermissionSystemConfig(configPath = CONFIG_PATH): {
-  created: boolean;
-  warning?: string;
-} {
-  if (existsSync(configPath)) {
-    return { created: false };
-  }
-
-  try {
-    ensureConfigDirectory(configPath);
-    writeFileSync(configPath, createDefaultConfigContent(), "utf-8");
-    return { created: true };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      created: false,
-      warning: `Failed to initialize permission-system config at '${configPath}': ${message}`,
-    };
-  }
-}
-
-export function loadPermissionSystemConfig(
-  configPath = CONFIG_PATH,
-): PermissionSystemConfigLoadResult {
-  const ensureResult = ensurePermissionSystemConfig(configPath);
-
-  try {
-    const raw = readFileSync(configPath, "utf-8");
-    const parsed = JSON.parse(raw) as unknown;
-    const config = normalizePermissionSystemConfig(parsed);
-    const misplacedKeys = detectMisplacedPermissionKeys(toRecord(parsed));
-
-    const warnings: string[] = [];
-    if (ensureResult.warning) {
-      warnings.push(ensureResult.warning);
-    }
-    if (misplacedKeys.length > 0) {
-      warnings.push(
-        `config.json contains legacy permission-rule keys that are ignored: ${misplacedKeys.join(", ")}.\n` +
-          'Use the flat permission format: { "permission": { "*": "ask", "read": "allow", ... } }.\n' +
-          "See config/config.example.json for the new format.",
-      );
-    }
-
-    return {
-      config,
-      created: ensureResult.created,
-      warning: warnings.length > 0 ? warnings.join("\n") : undefined,
-    };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      config: cloneDefaultConfig(),
-      created: ensureResult.created,
-      warning:
-        ensureResult.warning ??
-        `Failed to read permission-system config at '${configPath}': ${message}`,
-    };
-  }
-}
-
-export function savePermissionSystemConfig(
-  config: PermissionSystemExtensionConfig,
-  configPath = CONFIG_PATH,
-): PermissionSystemConfigSaveResult {
-  const normalized = normalizePermissionSystemConfig(config);
-  const tmpPath = `${configPath}.tmp`;
-
-  try {
-    ensureConfigDirectory(configPath);
-    writeFileSync(tmpPath, `${JSON.stringify(normalized, null, 2)}\n`, "utf-8");
-    renameSync(tmpPath, configPath);
-    return { success: true };
-  } catch (error) {
-    try {
-      if (existsSync(tmpPath)) {
-        unlinkSync(tmpPath);
-      }
-    } catch {
-      // Ignore cleanup failures.
-    }
-
-    const message = error instanceof Error ? error.message : String(error);
-    return {
-      success: false,
-      error: `Failed to save permission-system config at '${configPath}': ${message}`,
-    };
-  }
-}
-
-export function getPermissionSystemConfigPath(
-  configPath = CONFIG_PATH,
-): string {
-  return configPath;
-}
-
 export function ensurePermissionSystemLogsDirectory(
-  logsDir = LOGS_DIR,
+  logsDir: string,
 ): string | undefined {
   try {
     mkdirSync(logsDir, { recursive: true });

package/src/logging.ts

@@ -1,11 +1,7 @@
 import { appendFileSync } from "node:fs";
 
 import {
-  DEBUG_LOG_PATH,
   EXTENSION_ID,
-  ensurePermissionSystemLogsDirectory,
-  LOGS_DIR,
-  PERMISSION_REVIEW_LOG_PATH,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
 
@@ -48,19 +44,15 @@ export interface PermissionSystemLogger {
 
 interface PermissionSystemLoggerOptions {
   getConfig: () => PermissionSystemExtensionConfig;
-  debugLogPath?: string;
-  reviewLogPath?: string;
-  ensureLogsDirectory?: () => string | undefined;
+  debugLogPath: string;
+  reviewLogPath: string;
+  ensureLogsDirectory: () => string | undefined;
 }
 
 export function createPermissionSystemLogger(
   options: PermissionSystemLoggerOptions,
 ): PermissionSystemLogger {
-  const debugLogPath = options.debugLogPath ?? DEBUG_LOG_PATH;
-  const reviewLogPath = options.reviewLogPath ?? PERMISSION_REVIEW_LOG_PATH;
-  const ensureLogsDirectory =
-    options.ensureLogsDirectory ??
-    (() => ensurePermissionSystemLogsDirectory(LOGS_DIR));
+  const { debugLogPath, reviewLogPath, ensureLogsDirectory } = options;
 
   const writeLine = (
     stream: "debug" | "review",

package/src/pattern-suggest.ts

@@ -57,8 +57,21 @@ export function suggestMcpPattern(target: string): string {
   return "*";
 }
 
-function buildLabel(pattern: string): string {
-  return `Yes, allow "${pattern}" for this session`;
+/** Surface-aware human-readable labels for the session-approval option. */
+function buildLabel(pattern: string, surface: string): string {
+  switch (surface) {
+    case "bash":
+      return `Yes, allow bash "${pattern}" for this session`;
+    case "mcp":
+      return `Yes, allow mcp tool "${pattern}" for this session`;
+    case "skill":
+      return `Yes, allow skill "${pattern}" for this session`;
+    case "external_directory":
+      return `Yes, allow access to external directory "${pattern}" for this session`;
+    default:
+      // Tool surfaces (read, write, edit, grep, find, ls, extension tools)
+      return `Yes, allow tool "${surface}" for this session`;
+  }
 }
 
 /**
@@ -92,5 +105,5 @@ export function suggestSessionPattern(
       break;
   }
 
-  return { surface, pattern, label: buildLabel(pattern) };
+  return { surface, pattern, label: buildLabel(pattern, surface) };
 }

package/src/wildcard-matcher.ts

@@ -21,11 +21,18 @@ export function compileWildcardPattern<TState>(
   state: TState,
 ): CompiledWildcardPattern<TState> {
   const expanded = expandHomePath(pattern);
-  const escaped = expanded
+  let escaped = expanded
     .split("*")
-    .map((part) => escapeRegExp(part))
+    .map((part) => escapeRegExp(part).replaceAll("\\?", "."))
     .join(".*");
 
+  // If the pattern ends with " *" (space + wildcard), make the trailing
+  // space-and-arguments portion optional so that e.g. "git *" matches both
+  // "git status" and bare "git". Mirrors OpenCode wildcard semantics.
+  if (escaped.endsWith(" .*")) {
+    escaped = escaped.slice(0, -3) + "( .*)?";
+  }
+
   return {
     pattern,
     state,
@@ -62,7 +69,8 @@ export function findCompiledWildcardMatch<TState>(
 
 /**
  * Test whether `value` matches `pattern` using wildcard rules.
- * `*` in the pattern matches any sequence of characters (including empty).
+ * `*` matches any sequence of characters (including empty).
+ * `?` matches exactly one character.
  * Used by evaluate() for rule matching.
  */
 export function wildcardMatch(pattern: string, value: string): boolean {

package/tests/config-modal.test.ts

@@ -1,14 +1,13 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test, vi } from "vitest";
 import { registerPermissionSystemCommand } from "../src/config-modal";
 import {
   DEFAULT_EXTENSION_CONFIG,
-  loadPermissionSystemConfig,
+  normalizePermissionSystemConfig,
   type PermissionSystemExtensionConfig,
-  savePermissionSystemConfig,
 } from "../src/extension-config";
 import type { Rule } from "../src/rule";
 
@@ -136,17 +135,28 @@ test("permission-system command handlers manage config summary, persistence, and
   };
 
   try {
-    const initialSave = savePermissionSystemConfig(config, configPath);
-    assert.equal(initialSave.success, true);
+    writeFileSync(
+      configPath,
+      `${JSON.stringify(normalizePermissionSystemConfig(config), null, 2)}\n`,
+      "utf-8",
+    );
 
     const controller = {
       getConfig: () => config,
       setConfig: (next: PermissionSystemExtensionConfig) => {
-        const normalized = loadPermissionSystemConfig(configPath).config;
-        const saved = savePermissionSystemConfig(next, configPath);
-        assert.equal(saved.success, true);
-        config = loadPermissionSystemConfig(configPath).config;
-        assert.notDeepEqual(config, normalized);
+        const currentConfig = normalizePermissionSystemConfig(
+          JSON.parse(readFileSync(configPath, "utf-8")) as unknown,
+        );
+        const normalized = normalizePermissionSystemConfig(next);
+        writeFileSync(
+          configPath,
+          `${JSON.stringify(normalized, null, 2)}\n`,
+          "utf-8",
+        );
+        config = normalizePermissionSystemConfig(
+          JSON.parse(readFileSync(configPath, "utf-8")) as unknown,
+        );
+        assert.notDeepEqual(config, currentConfig);
       },
       getConfigPath: () => configPath,
     };

package/tests/config-reporter.test.ts

@@ -100,6 +100,7 @@ test("config.resolved entry appears in review log via logger", () => {
     const logsDir = join(tempDir, "logs");
     mkdirSync(logsDir, { recursive: true });
     const reviewLogPath = join(logsDir, "review.jsonl");
+    const debugLogPath = join(logsDir, "debug.jsonl");
 
     const globalConfigPath = join(tempDir, "pi-permissions.jsonc");
     writeFileSync(globalConfigPath, "{}", "utf-8");
@@ -116,6 +117,7 @@ test("config.resolved entry appears in review log via logger", () => {
         permissionReviewLog: true,
         yoloMode: false,
       }),
+      debugLogPath,
       reviewLogPath,
       ensureLogsDirectory: () => undefined,
     });

package/tests/extension-config.test.ts

@@ -1,11 +1,7 @@
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { describe, expect, it } from "vitest";
 
 import {
   detectMisplacedPermissionKeys,
-  loadPermissionSystemConfig,
   normalizePermissionSystemConfig,
 } from "../src/extension-config";
 
@@ -78,61 +74,6 @@ describe("detectMisplacedPermissionKeys", () => {
   });
 });
 
-describe("loadPermissionSystemConfig", () => {
-  let tempDir: string;
-  let configPath: string;
-
-  beforeEach(() => {
-    tempDir = mkdtempSync(join(tmpdir(), "perm-config-test-"));
-    configPath = join(tempDir, "config.json");
-  });
-
-  afterEach(() => {
-    rmSync(tempDir, { recursive: true, force: true });
-  });
-
-  it("returns no warning for a clean config", () => {
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        debugLog: false,
-        permissionReviewLog: true,
-        yoloMode: false,
-      }),
-    );
-    const result = loadPermissionSystemConfig(configPath);
-    expect(result.warning).toBeUndefined();
-  });
-
-  it("returns a warning naming misplaced permission-rule keys", () => {
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        debugLog: true,
-        defaultPolicy: { tools: "ask" },
-        bash: { "git status": "allow" },
-      }),
-    );
-    const result = loadPermissionSystemConfig(configPath);
-    expect(result.warning).toBeDefined();
-    expect(result.warning).toContain("defaultPolicy");
-    expect(result.warning).toContain("bash");
-    expect(result.warning).toContain("permission");
-  });
-
-  it("still returns the valid extension config fields when misplaced keys are present", () => {
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        debugLog: true,
-        bash: { "git status": "allow" },
-      }),
-    );
-    const result = loadPermissionSystemConfig(configPath);
-    expect(result.config.debugLog).toBe(true);
-  });
-});
-
 describe("normalizePermissionSystemConfig", () => {
   it("normalizes a valid config object", () => {
     const result = normalizePermissionSystemConfig({