my-pi/pi-permission-system/CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

Changed

• Preserve a registered shell-alias input preview as authorizer evidence and permission review context, so wrappers such as ssh_bash can disclose their remote execution target while retaining full Bash policy enforcement.
• Add shellTools.<name>.decisionFloor: "ask", which raises Bash allows to reviewable asks without weakening existing asks or hard denies, and preserve a global floor through field-level project config merging.

26.2.1 (2026-08-17)

Bug Fixes

• pi-permission-system: accept pasted text in the denial-reason field (8b33c38), closes #760

Documentation

• pi-permission-system: document the delegated denial-reason editor (e7329f5), closes #760

26.2.0 (2026-08-17)

Features

• pi-permission-system: publish a serving heartbeat while draining the inbox (2055e35), closes #721

Bug Fixes

• pi-permission-system: fail fast when an out-of-process parent is not serving (e190af9), closes #721

Documentation

• pi-permission-system: document out-of-process forwarding liveness (b5a50d5), closes #721

26.1.0 (2026-08-17)

Features

• pi-permission-system: attribute absent-authority denials (225412d), closes #726
• pi-permission-system: carry decision provenance across the forwarding boundary (0dbf13f), closes #726
• pi-permission-system: name the authorizer link that decided an ask (8556724), closes #726
• pi-permission-system: record the decider on non-prompting resolutions (5e24abf), closes #726
• pi-permission-system: record the human decider on prompted decisions (9f540ba), closes #726

Documentation

• pi-permission-system: record decision provenance and mark Phase 13 Step 6 complete (e2739e7), closes #726

26.0.0 (2026-08-16)

⚠ BREAKING CHANGES

• pi-permission-system: the message field is removed from every permission_request.* review-log entry. A consumer parsing it should read the structured fields instead: surface, matchedPattern, executedUnit, commandContext, invokedToolName, forwarded, and requesterSessionId, alongside the existing toolName, command, path, target, and toolInputPreview.
• pi-permission-system: values in the permission review log are now truncated at reviewLogFieldMaxWidth (default 1000) with a trailing ellipsis, where a bash command was previously written whole. Raise reviewLogFieldMaxWidth to keep longer values. ToolPreviewFormatterOptions.toolInputLogPreviewMaxLength and TOOL_INPUT_LOG_PREVIEW_MAX_LENGTH are removed, superseded by that setting.
• pi-permission-system: toolInputPreviewMaxLength and toolTextSummaryMaxLength are still accepted but ignored, and a config setting either now logs a deprecation warning at session start. Remove them; use promptMaxRows and promptFieldMaxWidth to bound what a permission prompt renders.
• pi-permission-system: PermissionUiPromptEvent.message is removed. Read request.value for the decision-relevant value and request.matchedPattern for the rule that fired; surface, value, agentName, and forwarding are unchanged. DirectPromptInput.message likewise becomes payload: PromptPayload.
• pi-permission-system: ForwardedPermissionRequest.message is removed and replaced by payload: PromptPayload, which carries the ask's complete structured facts. A serving node on this version accepts an older child's message-only request and renders it from surface, value, and the requester provenance; an older parent rejects a newer child's request, so upgrade the parent session first.

Features

• pi-permission-system: bound review-log field width with reviewLogFieldMaxWidth (#746) (dceb931)
• pi-permission-system: carry the prompt payload on the forwarded-request wire (bf67cd6), closes #745
• pi-permission-system: ignore the deprecated tool-preview caps and notice their use (47d7610), closes #745
• pi-permission-system: narrow the ui_prompt broadcast to the request facts (fcdb174), closes #745
• pi-permission-system: render a forwarded ask from the child's own payload (8587269), closes #745
• pi-permission-system: render the review log from the prompt payload (#746) (b373876)
• pi-permission-system: replace the forwarded-request message with the structured payload (1af41a9), closes #745

Bug Fixes

• pi-permission-system: stop echoing tool input in agent-facing denial text (#746) (525b7e4)

Documentation

• pi-permission-system: document the payload contracts and mark Phase 13 Step 3 complete (a2381ac), closes #745
• pi-permission-system: record the agent and review-log renderers (#746) (af88cc1)
• pi-permission-system: retire references to the dissolved denial module (#746) (53647b2)

25.4.0 (2026-08-15)

Features

• pi-permission-system: adopt the requester's request id as the forwarded request id (3f8d3fd), closes #752
• pi-permission-system: carry the request id on permissions:decision (95c001c), closes #752
• pi-permission-system: give the gate-error review entry a request id (172bc68), closes #752
• pi-permission-system: mint a permission request id at request creation (336842d), closes #752

Documentation

• pi-permission-system: record the minted request id in the API and architecture docs (84f5856), closes #752

25.3.0 (2026-08-15)

Features

• pi-permission-system: add promptMaxRows and promptFieldMaxWidth (8dbca30), closes #710
• pi-permission-system: expand the permission dialog to the complete request on Ctrl+O (b741513), closes #710
• pi-permission-system: render permission prompts as bounded, aligned fact lines (2bd18c5)

Documentation

• pi-permission-system: distinguish the redundancy rule from elision (5b26a46), closes #710
• pi-permission-system: document the bounded permission dialog (68fcf58), closes #710

25.2.2 (2026-08-15)

Bug Fixes

• pi-permission-system: gate commands hosted in bash redirect targets (1015bb8), closes #741
• pi-permission-system: gate commands hosted in interpolating heredoc bodies (48978d2), closes #741
• pi-permission-system: project path operands of heredoc-hosted nested commands (8e2fbee), closes #741
• pi-permission-system: project path operands of redirect-hosted nested commands (12164f3), closes #741

Documentation

• pi-permission-system: document hosted nested-command evaluation (f24b338), closes #741

25.2.1 (2026-08-15)

Bug Fixes

• pi-permission-system: auto-approve residual synthetic asks under yolo (e1706d3)
• pi-permission-system: honor an explicit bash deny for an unparseable command (2e45633)

Documentation

• pi-permission-system: describe the gate-level yolo grant (8a8e4a7), closes #712

25.2.0 (2026-08-14)

Features

• pi-permission-system: record which chain links were consulted on each ask (8bb52ff), closes #727

Bug Fixes

• pi-permission-system: stop reporting a delegated subagent chain as unregistered links (2a1c082), closes #727

Documentation

• pi-permission-system: document one-chain-per-node adjudication semantics (c36980a), closes #727

25.1.0 (2026-08-13)

Features

• pi-permission-system: add a process-global serving-session registry (2939982), closes #719
• pi-permission-system: announce the session serving forwarded requests (74c0259), closes #719
• pi-permission-system: make the forwarding timeout configurable (fc6190d), closes #719

Bug Fixes

• pi-permission-system: carry the denial reason into the unavailable block message (1a0b289), closes #719
• pi-permission-system: fail fast when no session serves a forwarded request (5241df0), closes #719
• pi-permission-system: report forwarding failures as unavailable, not user-denied (6c37d27), closes #719

Documentation

• pi-permission-system: document forwarding liveness and the timeout field (e493991), closes #719

25.0.0 (2026-08-11)

⚠ BREAKING CHANGES

• pi-permission-system: a bash command referencing $HOME or ${HOME} now reaches the external_directory gate whether or not the target exists, so a policy with external_directory: {"*": "ask"} prompts for commands that previously ran silently. Allow the directory explicitly to restore the old behavior — e.g. "external_directory": {"~/.cargo/registry/*": "allow"}. The token shown in prompts, review-log entries, and derived session-approval patterns is now the expanded path rather than the $HOME/... spelling; this makes the prompt agree with the approval pattern, which was already derived from the expanded form.

Features

• pi-permission-system: expand ${HOME} alongside $HOME in path patterns (3ebbd41), closes #694

Bug Fixes

• pi-permission-system: resolve $HOME and $PWD expansions in bash path tokens (8cbc7ee), closes #694

Documentation

• pi-permission-system: record resolved shell expansions in ADR 0009 and user docs (caaf5ec), closes #694

24.0.0 (2026-07-26)

⚠ BREAKING CHANGES

• pi-permission-system: an authorizer chain link's allow on a forwarded subagent ask raised by the path or external_directory gate is now downgraded to defer, so the request falls through to an interactive prompt. This affects only an operator running an allow-capable third-party link named in authorizerChain; the first-party model judge is deny-first and is unaffected, as are forwarded bash asks and per-tool-gated asks. See packages/pi-permission-system/docs/migration/0635-forwarded-ask-delegation-envelope.md

Bug Fixes

• pi-permission-system: carry forwarded access facts to the Authorizer Chain (#635) (c0790ad)

23.0.3 (2026-07-26)

Bug Fixes

• pi-permission-system: preserve tool expansion in inline permission prompts (6a0d241)

Documentation

• pi-permission-system: document tool expansion during permission prompts (f4098d3)

23.0.2 (2026-07-26)

Bug Fixes

• pi-permission-system: create forwarding request files owner-only (8c77c72), closes #647
• pi-permission-system: create permission logs owner-only (6043cf8), closes #647
• pi-permission-system: mask sensitive-keyed values in permission logs (05cb12a), closes #647
• pi-permission-system: redact generic tool input in the review log (2035fb2), closes #647

Documentation

• pi-permission-system: link ADR 0010 by absolute URL from shipped docs (0384af6), closes #647
• pi-permission-system: record ADR 0010 on permission-log secret exposure (c13b48a), closes #647

23.0.1 (2026-07-25)

Bug Fixes

• pi-permission-system: fold separators on both sides of a win32 path match (50e2ac0), closes #653

Documentation

• pi-permission-system: record the symmetric win32 separator fold (e2eea21), closes #653

23.0.0 (2026-07-24)

⚠ BREAKING CHANGES

• pi-permission-system: path values embedded in --opt=value bash tokens are now extracted and gated by the path and external_directory surfaces. Previously they were invisible to both, so a permissive bash rule such as grep * allowed them. Add an allow pattern on external_directory or path for an intended target.
• pi-permission-system: bash commands referencing existing bare-named files or in-project symlinks are now gated by path rules (matched against the canonical, symlink-resolved form) and by external_directory when they resolve outside the working directory. Previously a permissive bash allow rule such as cat * bypassed both. A bare token naming no file is still dropped, so git status-style commands are unaffected. To restore prior behavior for an intended target, add an allow pattern on external_directory (for outside-CWD paths) or on path.

Bug Fixes

• pi-permission-system: classify path values embedded in --opt=value tokens (0be19fd), closes #645
• pi-permission-system: gate existing bare-named files and symlinks in bash commands (9467858), closes #645

Documentation

• pi-permission-system: update architecture and skill docs for probe-based path candidacy (90c402d), closes #645

22.0.0 (2026-07-24)

⚠ BREAKING CHANGES

• pi-permission-system: In an untrusted project, project-scoped permission configuration (project config.json and project-agent frontmatter) and project-scoped runtime config (yoloMode, permissionReviewLog, etc.) are no longer loaded until the user grants project trust. Only global policy applies. Grant project trust, or set defaultProjectTrust, to restore the prior behavior.

Features

• pi-permission-system: support skipping project scope in loadAndMergeConfigs (e5a2e57)

Bug Fixes

• pi-permission-system: gate project-scoped config on project trust (f264e71)

Documentation

• pi-permission-system: document project-trust gating for project config (e955a29)

21.0.0 (2026-07-24)

⚠ BREAKING CHANGES

• pi-permission-system: A session whose project/agent/project-agent config is invalid previously inherited a lower scope's allow rules unchanged; those surfaces now resolve to ask (prompt) until the invalid config is corrected. Only sessions that already emit a config-validation warning are affected. Fix the reported config issues and reload to restore the intended policy.

Features

• pi-permission-system: add floorAllowsToAsk allow→ask overlay (#646) (8dbdcd7)
• pi-permission-system: mark invalid non-global config scopes (#646) (1abd318)

Bug Fixes

• pi-permission-system: fail closed when a higher-precedence config scope is invalid (#646) (b3c11c0)

Documentation

• pi-permission-system: document cross-scope fail-closed config clamp (#646) (7903b4c)

20.10.0 (2026-07-21)

Features

• pi-permission-system: thread a review-log seam into the authorizer chain (b086474)

20.9.1 (2026-07-20)

Documentation

• pi-permission-system: cite pi-permission-model-judge as a registerAuthorizer example (6bc1e67)

20.9.0 (2026-07-19)

Features

• pi-permission-system: add authorizerChain config field (#599) (6c0bb72)
• pi-permission-system: add registerAuthorizer cross-extension seam (#599) (ea60900)
• pi-permission-system: cap link verdicts with the delegation envelope (#599) (28733fc)
• pi-permission-system: inject a session-scoped PermissionQuery into chain links (#599) (29452ff)
• pi-permission-system: resolve the configured authorizer chain (#599) (fb366d9)

Documentation

• pi-permission-system: document registerAuthorizer + authorizerChain and mark Phase 12 Step 5 complete (#599) (1d6b228)

20.8.0 (2026-07-18)

Features

• pi-permission-system: accept pre-fixed path-values intents for forwarded serving (ab60874)
• pi-permission-system: declare ForwardedAccessIntent wire schema with tolerant read (#596) (66ddbef)
• pi-permission-system: emit access-intent facts from the bash path gates (#596) (1a0e6de)
• pi-permission-system: emit access-intent facts from the per-tool gate (#596) (2e17256)
• pi-permission-system: emit access-intent facts from the skill gates (#596) (5a20033)
• pi-permission-system: emit access-intent facts from the tool path gates (#596) (93a3398)
• pi-permission-system: serialize the child-fixed access intent onto the forwarded request (#596) (5234614)
• pi-permission-system: serving resolves the forwarded access intent at gate parity (#597) (a8fe815)

Documentation

• pi-permission-system: fix stale ServingPolicy doc comment (#597) (64b1b8e)

20.7.3 (2026-07-15)

Bug Fixes

• pi-permission-system: ship consumable public type declarations (#592) (542e094)

Documentation

• pi-permission-system: document the bundled public type declaration (070875d)

20.7.2 (2026-07-14)

Bug Fixes

• pi-permission-system: floor additional exec-capable indirection wrappers (#575) (abddb7b)

Documentation

• pi-permission-system: record exec-capable wrapper survey and mark Phase 11 Step 6 complete (#575) (6485246)

20.7.1 (2026-07-14)

Bug Fixes

• pi-permission-system: clip inline permission prompt lines to terminal width (e3c6907), closes #573

20.7.0 (2026-07-14)

Features

• pi-permission-system: add doublePressToConfirm config toggle (bd401bf)
• pi-permission-system: add inline permission prompt decision model (08d6ec6)
• pi-permission-system: dispatch TUI permission prompts to the inline keybind dialog (197c0f9)
• pi-permission-system: render inline keybind permission prompt (7ac7dad)

20.6.0 (2026-07-13)

Features

• pi-permission-system: add resolveShellInvocation dispatch point (5c5edc8)
• pi-permission-system: gate aliased shell tools through the bash stack (2c17f2c), closes #574
• pi-permission-system: resolve and gate aliased shell workdir (d9b2af8), closes #574

Documentation

• pi-permission-system: document live shellTools enforcement (b8048ed)

20.5.0 (2026-07-13)

Features

• pi-permission-system: add shellTools config schema (cd4f851)
• pi-permission-system: carry shellTools through config merge (635d66b)

Bug Fixes

• pi-permission-system: treat bare / as a filesystem-root path candidate (#583) (dfa4080)

Documentation

• pi-permission-system: document shellTools config (1b8e3c3)

20.4.2 (2026-07-13)

Documentation

• pi-permission-system: add read-only bash command allowlist recipe (#521) (6e9710f)

20.4.1 (2026-07-12)

Bug Fixes

• pi-permission-system: floor find/fd exec wrappers to ask (#490) (6cb1d54)
• pi-permission-system: floor sudo/env/xargs/time/nohup/timeout/nice to ask (#490) (b4d5c40)

Documentation

• pi-permission-system: document indirection-wrapper floor and mark roadmap step 5 (#490) (e35c1ee)

20.4.0 (2026-07-12)

Features

• pi-permission-system: add bash advisory decompose-or-fallback resolver (e0637f1)
• pi-permission-system: add warm tree-sitter parser and sync bash-command parse (66470f0)
• pi-permission-system: decompose advisory bash checkPermission at gate parity (d8d7ef0)
• pi-permission-system: warm bash parser on before_agent_start (509c597)

Documentation

• pi-permission-system: document advisory bash decomposition and complete roadmap step 4 (aeb8633)

20.3.0 (2026-07-09)

Features

• pi-permission-system: forward the child's session-approval suggestion (fa04d8c)
• pi-permission-system: offer whole-session scope on forwarded approvals (bd2be07)

Documentation

• pi-permission-system: record forwarded grant-scope selection (Phase 9 Step 4) (a3d1fca)

20.2.0 (2026-07-09)

Features

• pi-permission-system: serve forwarded permissions by resolution and Authorizer escalation (#557) (c5d3bcb)

Documentation

• pi-permission-system: mark Phase 9 Step 3 complete (a5a348f)

20.1.0 (2026-07-08)

Features

• pi-permission-system: gate win32 backslash-relative bash args via path rules (#520) (ad90fe5)
• pi-permission-system: recognize win32 backslash-relative path tokens (#520) (343f331)

Documentation

• pi-permission-system: document win32 backslash-relative path recognition (#520) (b71d0b8)

20.0.0 (2026-07-07)

⚠ BREAKING CHANGES

• pi-permission-system: The permissions:rpc:check and permissions:rpc:prompt event-bus channels are removed, along with their request/reply types (PermissionsCheckRequest, PermissionsCheckReplyData, PermissionsPromptRequest, PermissionsPromptReplyData), the PermissionsRpcReply envelope, PERMISSIONS_PROTOCOL_VERSION, and the rpc_prompt member of PermissionUiPromptSource. permissions:rpc:check consumers migrate to getPermissionsService().checkPermission(surface, value?, agentName?). permissions:rpc:prompt is removed with no public replacement; prompt forwarding is an internal subagent-to-parent mechanism.

Features

• pi-permission-system: remove deprecated event-bus RPC channel (557ea91)

Documentation

• pi-permission-system: repoint cross-extension docs off the removed RPC channel (b3d06f7), closes #531

19.0.1 (2026-07-07)

Documentation

• pi-permission-system: mark Phase 8 Step 6 complete; retarget forwarder docs (c11d8a2)

19.0.0 (2026-07-06)

⚠ BREAKING CHANGES

• pi-permission-system: The permission-system config loader was tolerant — it silently discarded malformed fields (a non-boolean debugLog, an invalid permission action, an unknown key) and loaded the rest. It now rejects the entire config file for that scope when any field is invalid, and reports each problem with its JSON path. On upgrade, a config that previously loaded with silently-dropped fields will be rejected until the reported problems are fixed; the affected scope falls back to the safe ask default until then. Fix each field named in the emitted issues (visible in the permission review log / debug log).

Features

• pi-permission-system: add zod config schema as validation source (6b71491)
• pi-permission-system: generate JSON Schema from zod and fix hosted $id URL (7b6556d)
• pi-permission-system: validate config with zod and reject invalid fields (7e32cae)

Documentation

• pi-permission-system: document zod config schema and strict validation (c8babf9)

18.2.0 (2026-07-06)

Features

• pi-permission-system: add yolo rule origin and ask→allow rewrite helper (a4bbcc0)
• pi-permission-system: auto-approve yolo-origin allow in the gate runner (caf8419)
• pi-permission-system: rewrite ask rules to yolo-origin allow at check time (cd4e509)

18.1.2 (2026-07-05)

Bug Fixes

• pi-permission-system: allow-list Git Bash POSIX paths via external_directory on win32 (#533) (5532a43)
• pi-permission-system: fold Git Bash cd targets with MSYS semantics on win32 (#533) (5cb20b4)
• pi-permission-system: match Git Bash POSIX-absolute bash tokens as typed on win32 (#533) (095fa5e)
• pi-permission-system: recognize POSIX device paths in bash commands on win32 (#533) (11ca70f)
• pi-permission-system: translate MSYS drive-mount bash tokens on win32 (#533) (2bf4e53)

Documentation

• pi-permission-system: document Git Bash path semantics on Windows (#533) (09afcb2)

18.1.1 (2026-07-03)

Bug Fixes

• pi-permission-system: publish user-facing docs so README and CDN links resolve (#484) (3282369)

18.1.0 (2026-07-02)

Features

• pi-permission-system: add rule-driven bare-token classifier (0d693a7), closes #509
• pi-permission-system: derive promotable path-token matcher from config (4a29882), closes #509
• pi-permission-system: gate bash bare filenames via path rules (4ee201a), closes #509
• pi-permission-system: promote bare tokens in bash path projection (f887b7c), closes #509

Documentation

• pi-permission-system: document bash bare-filename path promotion (db7159b), closes #509

18.0.2 (2026-07-01)

Bug Fixes

• pi-permission-system: add AccessPath.resolvedAlias() for symlink-target disclosure (cf6e25c)
• pi-permission-system: disclose resolved symlink target in tool external-directory messages (1225e2b)
• pi-permission-system: disclose resolved symlink targets in bash external-directory messages (f9fab42)

18.0.1 (2026-06-30)

Documentation

• pi-permission-system: name the path-values boundary contract and guard it (#506) (a47648c)

18.0.0 (2026-06-29)

⚠ BREAKING CHANGES

• pi-permission-system: A permissions:rpc:check query for a path / external_directory / path-bearing surface now matches the canonical (symlink-resolved) alias, and a path / path-bearing query now evaluates the supplied path instead of collapsing to *.
• pi-permission-system: A service (getPermissionsService().checkPermission) query for a path / external_directory / path-bearing surface now matches the canonical (symlink-resolved) alias, and a path / path-bearing query now evaluates the supplied path instead of collapsing to *. A symlinked path can now match a rule on its canonical target.
• pi-permission-system: a per-tool path rule (e.g. read: deny *.env) now also fires when a symlink's resolved target matches the pattern, where previously only the lexically-referenced spelling matched. A symlink alias can no longer evade a per-tool deny/allow.

Features

• pi-permission-system: match the canonical form on service path queries (be4a3e7)
• pi-permission-system: match the canonical form on the per-tool path gate (ad36e78)
• pi-permission-system: match the canonical form on the RPC check query (bb04ca5)

Bug Fixes

• pi-permission-system: remove unused join import; annotate closed findings (#504) (eb7c7b2)

Documentation

• pi-permission-system: document canonical per-tool path matching (bafa492)
• pi-permission-system: document canonical service/RPC path matching (35c36fa)

17.1.1 (2026-06-29)

Bug Fixes

• pi-permission-system: gate Windows drive-letter paths in bash external_directory (#508) (2d33183)

17.1.0 (2026-06-28)

Features

• pi-permission-system: add PathNormalizer collaborator (#510) (d016089)

17.0.0 (2026-06-27)

⚠ BREAKING CHANGES

• pi-permission-system: the path surface now also matches the canonical (symlink-resolved) form of bash path-rule tokens, so a path rule can fire on a symlink alias it previously missed, changing decisions on upgrade with no config edit.
• pi-permission-system: the path surface now also matches the canonical (symlink-resolved) form of a tool's file path. A path rule that previously matched only the as-typed spelling now also matches when the path resolves through a symlink to a target the pattern covers, which can change allow/deny decisions on upgrade with no config edit.

Features

• pi-permission-system: add AccessPath.forPath and forLiteral factories (4323cae), closes #486
• pi-permission-system: match the canonical form on the bash-path gate (6ce0c06)
• pi-permission-system: match the canonical form on the path tool gate (869ca76)

Documentation

• pi-permission-system: document canonical path-surface matching (9606dce), closes #486

16.2.1 (2026-06-27)

Bug Fixes

• pi-permission-system: floor opaque bash -c/eval wrappers to ask (#481) (e69493c)
• pi-permission-system: strip env-var assignment prefix from bash command units (#481) (1c99fb3)

Documentation

• pi-permission-system: document env-prefix stripping and opaque bash-wrapper floor (#481) (40c0012)
• pi-permission-system: note opaque-wrapper sentinel in README and skill (#481) (e226fe7)
• pi-permission-system: note prefix strip and opaque flag in commands() JSDoc (#481) (1892098)

16.2.0 (2026-06-26)

Features

• pi-permission-system: add ScopedPermissionManager.check(intent) (#478) (7cb600a)
• pi-permission-system: narrow ScopedPermissionResolver to resolve(intent) (#478) (908176f)

Documentation

• pi-permission-system: record resolve(intent) narrowing (#478) (fb8f986)

16.1.0 (2026-06-26)

Features

• pi-permission-system: introduce AccessPath value object (c00d5c5), closes #476

16.0.2 (2026-06-25)

Documentation

• pi-permission-system: record parser/node-text extraction in architecture and skill (#473) (7626425)

16.0.1 (2026-06-21)

Bug Fixes

• pi-permission-system: fold cd across redirect-then-pipe in external-directory projection (293c0b7), closes #454

16.0.0 (2026-06-21)

⚠ BREAKING CHANGES

• pi-permission-system: the bash permission gate fails closed. An internal gate error blocks the tool (with a gate_error review-log entry) instead of running it ungated, and a non-empty unparseable bash command resolves to ask instead of riding a permissive top-level "". To opt back into permissive bash behavior, set an explicit "bash": { "": "allow" } policy.

Bug Fixes

• pi-permission-system: cut a major release for the fail-closed gate change (#452) (c7451cd)

15.1.0 (2026-06-20)

Features

• pi-permission-system: trace tool-call decisions and emit a session summary (#452) (528e340)
• pi-permission-system: warn when a permissive top-level "*" leaves bash ungated (#452) (8ef8d0f)

Bug Fixes

• pi-permission-system: prompt instead of allowing an unparseable bash command (#452) (538bac1)
• pi-permission-system: retry tree-sitter parser init instead of caching a rejected promise (#452) (468facd)

Documentation

• pi-permission-system: document fail-closed gate behavior and bash fallback warning (#452) (fbb2844)

15.0.1 (2026-06-20)

Bug Fixes

• permission-system: bind session approval for current-directory files (#438) (083a8e8)

15.0.0 (2026-06-20)

⚠ BREAKING CHANGES

• the wire system prompt now lists the active tools (narrowed to the permission-allowed set) in the Available tools: section. Previously the permission system removed that section entirely, so the model saw no tool listing. Sessions that relied on the empty-listing behavior will now see the narrowed listing.

Bug Fixes

• narrow the Available tools section to the active set instead of stripping it (#437) (dc0b97d)

Documentation

• describe Available-tools narrowing and drop the prompt-cache module (#437) (4112057)

14.0.1 (2026-06-19)

Bug Fixes

• pi-permission-system: strip shell comment lines from bash commands before matching (d045591)

14.0.0 (2026-06-17)

⚠ BREAKING CHANGES

• project agents' permission: frontmatter at <cwd>/.pi/agents/<name>.md is now read and enforced. Previously the wrong directory (<cwd>/.pi/agent/agents) was checked and the frontmatter was silently ignored, so a session may become more restrictive on upgrade.

Bug Fixes

• correct project agents directory path to <cwd>/.pi/agents (#428) (eb5af78)

Documentation

• correct project agent override path to <cwd>/.pi/agents (#428) (d193d6a)
• fix stale project agents path in troubleshooting and ADR-0001 (#428) (95effeb)

13.2.0 (2026-06-17)

Features

• pi-permission-system: add external-directory typed+resolved policy aliases (#418) (ae653d1)

Bug Fixes

• pi-permission-system: match external_directory patterns against typed and resolved paths (#418) (d08e645)

Documentation

• pi-permission-system: document external_directory symlink alias matching (#418) (8760273)

13.1.2 (2026-06-16)

Documentation

• pi-permission-system: clarify external_directory surface in README (#413) (c09929b)
• pi-permission-system: document external_directory allow-list for outside-CWD caches (#413) (86b1d87)
• pi-permission-system: show external_directory allow-list in example config and schema (#413) (8178a7e)

13.1.1 (2026-06-13)

Bug Fixes

• preserve forwarded-permission responses dir while requests pending (#398) (9914e70)
• recreate forwarded-permission responses dir before write (#398) (67d34ef)

13.1.0 (2026-06-13)

Features

• pi-permission-system: add DenyWithReason type and shared guard (51750e1), closes #395
• pi-permission-system: append custom reason to denial messages (d8e5756), closes #395
• pi-permission-system: build deny rules with reason in normalizeFlatConfig (186c15a), closes #395
• pi-permission-system: preserve deny-with-reason from JSON config (3201bfd), closes #395
• pi-permission-system: thread deny reason into PermissionCheckResult (ed712e4), closes #395

Documentation

• pi-permission-system: document deny-with-reason config form (45be4e7), closes #395

13.0.0 (2026-06-12)

⚠ BREAKING CHANGES

• A relative bash path token now also matches absolute allowlist rules naming the same file, resolved against the effective directory after literal cd commands. A token under a config like path: { "*": "ask", "/workspace/project/*": "allow" } moves from ask to allow. Tokens after a non-literal cd (e.g. cd "$DIR") stay conservative and match only their literal form.
• When Pi's working directory is known, a relative path input now also matches absolute allowlist rules naming the same file. A config like path: { "*": "ask", "/workspace/project/*": "allow" } moves a relative src/App.jsx from ask to allow. To keep tighter control, narrow the allowlist patterns or add an explicit path deny for the sensitive paths.

Features

• add alias-aware evaluateAnyValue (#393) (2b7d240)
• add cd-aware pathRuleCandidates to BashProgram (#393) (102a491)
• add path-policy value derivation (#393) (d34e57f)
• add resolvePathPolicy resolver method (#393) (8ec81da)
• match relative path inputs against absolute allowlists (#393) (6d0c564)
• normalize path inputs to cwd-aware policy values (#393) (3c2784f)
• resolve bash path tokens with cd-aware policy values (#393) (7bcdbe7)

Documentation

• document cwd-aware path policy matching (#393) (8ab53a2)
• pi-permission-system: update Development section to current scripts and tooling (ebda301)

12.0.0 (2026-06-12)

⚠ BREAKING CHANGES

• extension and MCP tools that expose a filesystem path (input.path, or input.arguments.path for MCP) are now subject to the path and external_directory permission gates. Tools previously ungated may now prompt or be denied under existing path rules.

Features

• add extensible tool input path extraction (#352) (3a54ea1)
• add tool access extractor registry (#352) (7a34f01)
• expose registerToolAccessExtractor via permissions service (#352) (5e02c16)
• gate extension and MCP path tools by default (#352) (1d53f4f)

Documentation

• document path-aware extension/MCP gating and registerToolAccessExtractor (#352) (a2f825f)

11.0.0 (2026-06-11)

⚠ BREAKING CHANGES

• The permission system no longer auto-activates pi's off-by-default tools (find, grep, ls) in the main session. Users who want them active should enable them via pi's own activeTools configuration rather than relying on the permission system to expose every non-denied tool.

Features

• add getActive to ToolRegistry wired to pi.getActiveTools (#385) (79c4594)

Bug Fixes

• respect pi's default active tool set in before_agent_start (#385) (bf5be48)

Documentation

• clarify before_agent_start filters pi's active tool set (#385) (bdb5a6a)

10.10.1 (2026-06-11)

Documentation

• fix bash rule precedence examples and wording (#387) (9e18d6f)

10.10.0 (2026-06-10)

Features

• pi-permission-system: add case-insensitive and Windows-separator options to wildcard matcher (587b3e8)

Bug Fixes

• pi-permission-system: auto-allow infrastructure reads case-insensitively on Windows (a3f137a)
• pi-permission-system: auto-detect Pi's install directory for infrastructure reads (#382) (c3d89ba)
• pi-permission-system: include an optional Pi package dir in infrastructure reads (da667ec)
• pi-permission-system: make path containment case-insensitive on Windows via path.relative (c10b84a)
• pi-permission-system: match external_directory/path patterns case-insensitively on Windows (3ed92da)

Documentation

• pi-permission-system: document Windows case-insensitive matching and Pi-install auto-allow (c98d33b)

10.9.0 (2026-06-10)

Features

• add ToolInputFormatterRegistrar write-side interface (#366) (e000eb0)

10.8.0 (2026-06-10)

Features

• add CacheKeyGate for agent-start cache keys (#365) (e99285c)

Documentation

• mark Phase 5 Step 4 complete (#365) (4bd0e30)

10.7.2 (2026-06-10)

Miscellaneous Chores

• deps: bump tooling dependencies to latest minor/patch (8b9105d)

10.7.1 (2026-06-09)

Bug Fixes

• surface full chained command in bash permission prompt (#333) (7f448fb)

10.7.0 (2026-06-09)

Features

• add normalizeOptionalStringArray to common (8be9154)

Bug Fixes

• carry piInfrastructureReadPaths through the unified config loader (#347) (51bc145)

10.6.0 (2026-06-08)

Features

• pi-permission-system: add best-effort canonicalizePath helper (5b5002e)

Bug Fixes

• pi-permission-system: canonicalize bash external-path containment (#345) (89f8e9b)
• pi-permission-system: canonicalize tool-call external-directory containment (#345) (d7f3bd1)

Documentation

• pi-permission-system: note symlink canonicalization in architecture (b758a48)

10.5.3 (2026-06-08)

Bug Fixes

• merge tool preview length fields across config layers (803fbb4)
• parse tool preview length fields in unified config loader (3241956)

10.5.2 (2026-06-08)

Bug Fixes

• pi-permission-system: expand $HOME in normalizePathForComparison (#350) (1b92ed3)
• pi-permission-system: home-expand path values before matching (#350) (48a7b37)

Documentation

• pi-permission-system: note path values are home-expanded for matching (#350) (e9c264d)

10.5.1 (2026-06-07)

Documentation

• correct SkillPermissionChecker comment after resolver rewire (#341) (1528382)

10.5.0 (2026-06-07)

Features

• add PermissionResolver class and route gate runner through it (#340) (4133601)

Bug Fixes

• suppress fallow unused-class-member for pre-Step-8 resolver methods (#340) (fd65626)

10.4.0 (2026-06-07)

Features

• add context-owning PromptingGateway (1885be2)

Documentation

• mark Phase 4 Step 6 complete; drop unused beforeEach import (217057a)

10.3.1 (2026-06-06)

Bug Fixes

• share one PermissionManager and SessionRules across gate and RPC paths (#337) (7dd1e65)

10.3.0 (2026-06-05)

Features

• add ConfigStore owning extension config state (5941733)

10.2.0 (2026-06-04)

Features

• add PermissionManager.configureForCwd and agentDir option (5a2d363)

10.1.0 (2026-06-03)

Features

• add DecisionReporter and GateDecisionReporter (530211d)
• add GatePrompter and SessionApprovalRecorder session roles (2f761e4)
• add GateRunner class consolidating gate dispatch (a390558)
• add getToolPreviewLimits and getInfrastructureReadDirs to PermissionSession (#327) (a0bf166)
• add PermissionResolver.resolve to PermissionSession (c922bbd)
• add skill_input denial context (#326) (71e9d28)
• introduce SkillInputGatePipeline collaborator (#329) (4ddd5af)
• introduce ToolCallGatePipeline collaborator (#327) (3a87727)

Bug Fixes

• drop vestigial events field; document makeReporter in package skill (9e0a8a7)

Documentation

• document SkillInputGatePipeline in architecture and package skill (#329) (9193c86)
• record the composition-root collaborator extraction (#320) (dab8890)
• standardize and correct package READMEs (4c270ad)

10.0.0 (2026-06-02)

⚠ BREAKING CHANGES

• pi-permission-system: the permissions:ready event payload no longer includes protocolVersion. Consumers that read it must rely on package semver instead.

Features

• pi-permission-manager: broadcast permission prompts on permissions:prompt channel (8540f3b)
• pi-permission-system: drop protocolVersion from permissions:ready (6728a93)
• pi-permission-system: harden prompt broadcasts (067bafd)
• pi-permission-system: make ready and decision broadcasts best-effort (00a895f)
• pi-permission-system: preserve display fields for forwarded prompts (9970912)
• pi-permission-system: slim ui_prompt payload and centralize construction (7a1ec56)

Bug Fixes

• pi-permission-system: drop manual CHANGELOG Unreleased section (f14e4f5)

Documentation

• pi-permission-system: document the lean ui_prompt contract (0b3c11c)

9.2.0 (2026-06-02)

Features

• flag relative paths conservatively after a non-literal cd (6e631a0), closes #307
• fold sequential current-shell cd into the bash effective directory (7fd8e95), closes #307
• scope cd inside subshells and persist it across brace groups (37b948c), closes #307

9.1.0 (2026-06-02)

Features

• evaluate nested bash command substitutions and subshells (#306) (0e52d64)
• surface nested execution context in bash deny and ask messages (#306) (9d88543)

Documentation

• document nested bash command evaluation (#306) (352e206)

9.0.1 (2026-06-01)

Bug Fixes

• enumerate top-level bash commands in BashProgram (cdb41e1)
• evaluate each bash sub-command with most-restrictive precedence (85e48b2)
• gate bash command chains per sub-command (#301) (3f80097)

Documentation

• document per-sub-command bash chain evaluation (#301) (e195a70)

9.0.0 (2026-06-01)

⚠ BREAKING CHANGES

• unpublishPermissionsService() now requires the service to remove as its sole argument. The package's public export is service.ts, so this changes the published API surface.

Features

• scope service teardown to the publishing instance (#302) (72180e9)

Bug Fixes

• keep the parent's service published across child shutdown (#302) (300214c)

Documentation

• document session_start service publication and ready timing (#302) (a894fb8)

8.3.2 (2026-06-01)

Bug Fixes

• pi-permission-system: key subagent registry by session id and drop vestigial agentName (d299c54)
• pi-permission-system: resolve subagent detection and forwarding target by session id (0f7e079)

Documentation

• retro: add retro notes for issue #296 (75743ab)

8.3.1 (2026-06-01)

Bug Fixes

• add process-global SubagentSessionRegistry accessor (#296) (d3fd3b0)
• share SubagentSessionRegistry across parent and child sessions (#296) (fed676a)

Documentation

• explain process-global subagent registry across session buses (#296) (1804dbb)
• use ADR-NNNN with links docs-wide (c6b6431)

8.3.0 (2026-06-01)

Features

• add built-in MCP input summarizer (#283) (2d47e36)
• add ToolInputFormatterRegistry (#283) (c2c2b3d)
• consult custom formatter registry in ToolPreviewFormatter (#283) (9a0d756)
• expose registerToolInputFormatter on PermissionsService (#283) (2287484)

Documentation

• add authoring guide for tool input formatters (#283) (6d154a1)
• document tool input formatter seam (#283) (2fc9ff1)

8.2.1 (2026-05-31)

Bug Fixes

• remove stale PermissionGateHandler import in tool-call.test.ts (#288) (67259f6)

8.2.0 (2026-05-31)

Features

• add SessionApproval value object and SessionRules.record (8f98d92)
• centralize decision-event construction in buildDecisionEvent (19c2c83)

8.1.0 (2026-05-31)

Features

• add toolInputPreviewMaxLength and toolTextSummaryMaxLength config fields (#266) (3a7dafb)
• use configured preview limits in permission prompts (#266) (83e2829)

Documentation

• document configurable tool-preview length knobs (#266) (6d0b134)

8.0.0 (2026-05-30)

⚠ BREAKING CHANGES

• registerSubagentSession and unregisterSubagentSession are removed from the PermissionsService interface and its implementation. The SubagentSessionInfo type is no longer re-exported from the public service module.

Features

• remove inbound subagent-registration methods from PermissionsService (#267) (552735a)

Documentation

• pi-permission-system: describe event-driven subagent registration (#267) (8c39b87)

7.4.1 (2026-05-30)

Bug Fixes

• pi-permission-system: resolve bash paths against leading cd target (c655a7e)

Documentation

• pi-permission-system: document cd-aware bash path resolution (a2e6541)

7.4.0 (2026-05-29)

Features

• register subagent child sessions via lifecycle events (cd324dc)

Documentation

• document event-based subagent child lifecycle (62621fa)

7.3.3 (2026-05-28)

Bug Fixes

• respect config-level allow/deny in bash external-directory gate (#249) (1437ff3)

Documentation

• plan fix for bash external-directory config-level allow bypass (#249) (9e09f35)
• retro: add planning stage notes for issue #249 (fe13214)
• retro: add TDD stage notes for issue #249 (b5d22f6)

7.3.2 (2026-05-27)

Documentation

• replace \n with <br/> in Mermaid node labels (3312a45)

7.3.1 (2026-05-26)

Bug Fixes

• resolve pre-existing lint errors in pi-autoformat and pi-permission-system (68fd516)

Documentation

• update subagent integration docs for native permission bridge (#101) (0bd456b)

7.3.0 (2026-05-25)

Features

• pi-permission-system: add SubagentSessionRegistry class (a0ef16b)
• pi-permission-system: detect in-process subagents via session registry (c90b824)
• pi-permission-system: expose registry and getToolPermission on PermissionsService (984d2bb)
• pi-permission-system: resolve forwarding target from subagent registry (5eb15af)

Documentation

• pi-permission-system: document subagent session registry API (93c5c3e)
• pi-permission-system: update architecture for subagent registry (7b32e6a)
• plan subagent session registry and tool-level permission query (#221) (a11d91a)
• retro: add planning stage notes for issue #221 (cf434c2)
• retro: add TDD stage notes for issue #221 (e050898)

7.2.0 (2026-05-24)

Features

• add eslint config with type-aware rules and import enforcement (4fb3cc6)

7.1.4 (2026-05-23)

Bug Fixes

• add package.json imports field for #src/#test path aliases (#157) (75b4598)

7.1.3 (2026-05-23)

Documentation

• retro: add retro notes for issue #155 (4aa3250)

7.1.2 (2026-05-23)

Bug Fixes

• resolve fallow dead-code warnings (2113f6b)

Documentation

• plan barrel discipline enforcement (#155) (58692cf)

7.1.1 (2026-05-22)

Documentation

• retro: add retro notes for issue #122 (d17f86d)

7.1.0 (2026-05-22)

Features

• support glob patterns in piInfrastructureReadPaths (#122) (7ebce24)

Documentation

• document piInfrastructureReadPaths glob support (#122) (94fa688)
• fix misleading ** examples and clarify * matches all characters (00563dc)
• plan glob support for piInfrastructureReadPaths (#122) (1450d8b)

7.0.1 (2026-05-21)

Documentation

• retro: add retro notes for issue #78 (594d3e1)
• retro: add retro notes for issue #78 (5f93117)

7.0.0 (2026-05-21)

⚠ BREAKING CHANGES

• GateDescriptor.messages has been replaced by GateDescriptor.denialContext. Any code constructing a GateDescriptor must provide a DenialContext instead of pre-formatted message strings.

Features

• add centralized denial message formatter (#78) (99f2d36)

Bug Fixes

• remove broken relative links in archived plan 0042 (07bcca4)

Documentation

• add README to archived plans directory (c3fcb9f)
• archive pre-monorepo plans, plan soften denial messages (#78) (7709f8f)

Code Refactoring

• remove messages from GateDescriptor (#78) (d3cae38)

6.0.2 (2026-05-20)

Miscellaneous Chores

• enforce MD029 ordered list numbering (95f8574)

6.0.1 (2026-05-19)

Bug Fixes

• re-enable MD057 and fix broken links (52a88b1)

Documentation

• enforce one-sentence-per-line across all markdown files (a533869)

6.0.0 (2026-05-19)

⚠ BREAKING CHANGES

• All @earendil-works/pi-* peerDependencies and devDependencies now require >=0.75.0, aligning with Pi's Node 22 minimum.
• Minimum supported Node.js version is now >=22, aligning with Pi v0.75.0. tsconfig target raised from ES2023 to ES2024.
  • ES2024 APIs (Promise.withResolvers, Object.groupBy, Map.groupBy, Array.fromAsync) are now allowed.
  • @types/node catalog aligned to ^22.15.3.
  • pi-autoformat now declares engines.node for consistency.

Features

• raise minimum Node.js version to 22 and bump tsconfig target to ES2024 (98a5b01)
• raise minimum Pi dependency to v0.75.0 (1068329)

Bug Fixes

• unquote rumdl globs so shell expands them (3b13a20)

5.18.3 (2026-05-17)

Documentation

• retro: add retro notes for issue #58 (27c8a2d)

5.18.2 (2026-05-17)

Bug Fixes

• bash path gate skips tokens matching only universal default (#58) (33fd169)
• restore per-package lint:md and lint scripts (0e42617)
• skip path gate when no explicit path rules configured (#58) (a6d55e1)
• use root markdownlint config from all packages (30192f8)

Documentation

• add redirect AGENTS.md to each package subdirectory (cbdcd29)
• plan fix path gate firing for universal default (#58) (ae9bbab)

Miscellaneous Chores

• consolidate configs into monorepo root (8583eaf)
• remove per-package pi-autoformat configs (b2d405a)
• replace markdownlint-cli2 with rumdl (d8dc789)
• update package.json URLs to monorepo (b92dbfa)

5.18.1 (2026-05-15)

Documentation

• plan Pi GitHub Tools extension (#153) (6f8566f)
• retro: add retro notes for issue #145 (70ff363)
• update /ship-issue to use pi-github-tools (#153) (7a4de21)
• update docs and pattern-suggest for path surface (6defcdb)

5.18.0 (2026-05-14)

Features

• add package.json exports field for cross-extension import (#145) (1091de5)
• add Symbol.for()-backed service accessor module (#145) (6a7ddab)
• publish permissions service on startup, clear on shutdown (#145) (97bea7b)

Documentation

• deprecate permissions:rpc:check types in favor of service accessor (#145) (a64b1b9)
• document service accessor and deprecate RPC check (#145) (931a14e)
• plan Symbol.for()-backed service accessor (#145) (d9448bc)
• retro: add retro notes for issue #148 (84e0262)

5.17.0 (2026-05-14)

Features

• bash path gate with broader token extraction (#148) (affe202)
• broader token extraction for path rules (#148) (6303641)
• evaluateMostRestrictive helper for cross-cutting path evaluation (#148) (5260f21)
• integrate path gates into permission pipeline (#148) (36fb30e)
• path gate for tool path restrictions (#148) (cc53681)
• register path as a special permission surface (#148) (356bcf7)

Documentation

• document cross-cutting path permission surface (#148) (3bd4478)
• include edit alongside write in config examples (#147) (f083ccc)
• plan path-aware bash permission rules (#148) (71ff973)
• retro: add retro notes for issue #147 (e40402b)

5.16.0 (2026-05-13)

Features

• decision events include file path for path-bearing tools (#147) (eea226d)
• normalizeInput returns file path for path-bearing tools (#147) (0b48995)
• path-scoped session approvals for path-bearing tools (#147) (1feacc5)

Documentation

• document per-tool path patterns (#147) (81245f6)
• plan per-tool path patterns for path-bearing tools (#147) (9458706)

5.15.0 (2026-05-13)

Features

• add PI_SUBAGENT_PARENT_SESSION convention for parent session resolution (3829195), closes #143

Documentation

• add Cross-Extension Integration section to AGENTS.md (#145) (90209f7)

5.14.1 (2026-05-11)

Bug Fixes

• show tool name instead of bare wildcard in session-approval label (1a65c30)
• surface-prefixed session-approval labels for all permission surfaces (759da03)

Documentation

• retro: add retro notes for issue #122 (7867db2)

5.14.0 (2026-05-09)

Features

• support ? single-character wildcard in permission patterns (#122) (7b56f49)

Documentation

• document ? wildcard and update OpenCode compatibility (#122) (31ace5f)
• plan ? single-character wildcard support (#122) (a7a2963)
• retro: add retro notes for issue #1 (b1c66f1)

5.13.0 (2026-05-08)

Features

• warn that this is a pnpm project on global npm pass-throughs (f643149)

Bug Fixes

• pass through npm install/uninstall -g in PATH shim (eaf4256)
• prevent double-loading extension in dev via project settings (6c39f33)

Documentation

• plan external_directory integration tests (#1) (695ffeb)
• retro: add retro notes for double-prompt investigation (37734a5)
• retro: add retro notes for issue #123 (5dbea33)

Miscellaneous Chores

• switch ask tool from pi-ask-user to @eko24ive/pi-ask (0087458)

5.12.0 (2026-05-08)

Features

• support trailing wildcard optionality (#123) (c25b0b5)

Documentation

• plan trailing wildcard optionality (#123) (a6a50d2)
• retro: add retro notes for issue #113 (7412740)
• update wildcard optionality docs (#123) (562adaf)

5.11.2 (2026-05-08)

Documentation

• plan removal of legacy path defaults from logging and extension-config (#113) (27ec0d8)

Miscellaneous Chores

• approve @google/genai build scripts in pnpm-workspace.yaml (23b177f)
• upgrade pnpm to 11.0.8 and update deps (31eb848)

5.11.1 (2026-05-08)

Documentation

• retro: add retro notes for issue #130 (e2ed7cb)

Miscellaneous Chores

• migrate @mariozechner/* deps to @earendil-works/* (8908be1)

5.11.0 (2026-05-08)

Features

• add ToolRegistry interface (#130) (5e886fd)
• PermissionSession absorbs prompting methods (#130) (4ae81e6)

Documentation

• plan handler classes to replace HandlerDeps (#130) (e8bc1a4)
• retro: add retro notes for issue #129 (23c29a2)
• update architecture for handler classes (#130) (02d02b6)

5.10.0 (2026-05-08)

Features

• PermissionSession class with delegation methods (#129) (a8486ce)
• PermissionSession lifecycle, cache, agent name, and infra methods (#129) (8f6edf7)

Documentation

• plan PermissionSession extraction (#129) (9dc21b4)
• retro: add retro notes for issue #128 (9794053)
• update architecture for PermissionSession (#129) (d452c50)

5.9.0 (2026-05-08)

Features

• add ForwardingManager class (#128) (7790380)

Documentation

• plan ForwardingManager extraction (#128) (2f10450)
• retro: add retro notes for issue #127 (2dde534)

5.8.0 (2026-05-08)

Features

• add SessionLogger interface and createSessionLogger factory (#127) (8765ab8)

Documentation

• plan SessionLogger extraction (#127) (b13ac62)
• retro: add retro notes for issue #126 (3d8a38a)
• update architecture doc for SessionLogger (#127) (8fa4123)

5.7.0 (2026-05-08)

Features

• extract ExtensionPaths value object (#126) (85bc347)

Documentation

• add handler decomposition plan (#126, #127, #128, #129, #130) (5a116a6)
• add structural design heuristics, design-review skill, and plan-issue hook (d8e3233)
• extract code-style, testing, and markdown-conventions skills from AGENTS.md (9d5ba7a)
• plan ExtensionPaths value object extraction (#126) (d76e6cc)
• rename target-architecture to architecture, strip progress indicators (9776550)
• retro: add retro notes for issue #110 (5597de3)

5.6.3 (2026-05-07)

Documentation

• retro: add retro notes for issue #109 (7d46cf4)
• update architecture for external-directory split (#110) (2e86fe7)
• update plan for #110 after #109 landed (3541d57)

5.6.2 (2026-05-07)

Documentation

• clarify bash arity table usage difference with OpenCode (b387480)
• clarify doom_loop is not a Pi surface, not just deprecated (8c38ab2)
• detail superior bash path extraction vs OpenCode's allowlist approach (b16767b)
• merge doom_loop into OpenCode-only surfaces row (85756a7)
• move bash arity/tree-sitter to shared concepts (both at parity) (6fd7cdc)
• plan deduplicate shared helpers (#109) (52bff2e)
• plan split external-directory into focused modules (#110) (b2a4610)
• retro: add retro notes for issue #106 (a945814)
• update target architecture for extracted helpers (52693d6)

5.6.1 (2026-05-07)

Documentation

• document OpenCode compatibility (#106) (be9b2ab)
• plan document OpenCode compatibility (#106) (57aa584)
• retro: add retro notes for issue #118 (cb89995)

5.6.0 (2026-05-07)

Features

• implement runGateCheck gate runner (#118) (46da4b6)

Documentation

• plan gate runner extraction (#118) (8c0eb18)
• retro: add retro notes for issue #111 (e327323)
• update target architecture for gate runner (#118) (40e1b1b)

5.5.1 (2026-05-07)

Documentation

• plan narrow handler dependencies by splitting ExtensionRuntime (#111) (cb44dee)
• retro: add retro notes for issue #108 (e967fd9)
• update target architecture for gate interfaces and SessionState (#111) (85620c4)

5.5.0 (2026-05-07)

Features

• extract FilePolicyLoader from PermissionManager (705d800)

Bug Fixes

• pass through npm calls targeting .pi/npm directory (4104712)

Documentation

• add PolicyLoader to target architecture (fbbb85f)
• plan extract PolicyLoader from PermissionManager (#108) (4d5f0df)
• retro: add retro notes for issue #107 (d979562)

5.4.0 (2026-05-07)

Features

• add npm shim to enforce pnpm usage via mise (6a446b2)

Documentation

• add redundant integration test cleanup step (#107) (236d812)
• expand gate test surfaces in plan (#107) (d671556)
• plan extract per-gate functions from handleToolCall (#107) (c867d34)
• update architecture for gate extraction (#107) (fe4c967)

5.3.4 (2026-05-06)

Documentation

• center logo with HTML align (707f3e7)
• convert logo to PNG for npm compatibility (c81e094)
• remove width constraint on logo (d50930a)

5.3.3 (2026-05-06)

Documentation

• add project logo, remove lock emoji from title (3de430f)
• increase logo size to 200px (cd983c8)

5.3.2 (2026-05-06)

Documentation

• fix ordered list continuation, use realistic quick-start config (dd26166)
• retro: add retro notes for issue #98 (bf2bbc6)

5.3.1 (2026-05-05)

Documentation

• add permission frontmatter convention guide for subagent extensions (c992959)
• add upstream issue template for subagent extension outreach (79eef27)
• link permission frontmatter guide from README and target architecture (df261fc)
• plan shared permission frontmatter convention for subagent extensions (#98) (eec5763)
• restructure README with inverted pyramid, extract reference docs (db51142)
• retro: add retro notes for issue #29 (be0620b)

5.3.0 (2026-05-05)

Features

• add permission event types and emit helpers (#29) (45a4158)
• add permissions:rpc:check policy query RPC (#29) (b230ff8)
• add permissions:rpc:prompt forwarding RPC (#29) (438227c)
• clean up RPC handlers on session shutdown (#29) (0a54a10)
• distinguish auto-approved from user-approved in decision events (#29) (746d988)
• emit permission decision events from input handler (#29) (bfc21bb)
• emit permission decision events from tool-call handler (#29) (40cf12e)
• emit permissions:ready on extension load (#29) (bfa3606)

Documentation

• document permission event API and RPC protocol (#29) (3872e54)
• plan permission event channel with decision broadcast and RPC (#29) (d31754a)
• retro: add retro notes for issue #97 (43d66d9)

5.2.1 (2026-05-05)

Documentation

• document subagent extension coexistence (#97) (9bf2972)
• plan subagent extension coexistence documentation (#97) (4cf975f)
• retro: add retro notes for issue #96 (8757ffc)

5.2.0 (2026-05-05)

Features

• add SUBAGENT_PARENT_SESSION_ENV_CANDIDATES, iterate in resolver (#96) (ac6831d)
• broaden SUBAGENT_ENV_HINT_KEYS for nicobailon + HazAT extensions (#96) (8adafdb)

Documentation

• plan broaden subagent env hint keys (#96) (9fa97b7)
• update target-architecture subagent detection for #96 (64cce35)

5.1.2 (2026-05-05)

Documentation

• fix README per-agent frontmatter example to flat format (#78) (1295427)
• plan fix README frontmatter example and add missing tests (#78) (3fc99e1)
• retro: add retro notes for issue #93 (c9e8e89)

5.1.1 (2026-05-05)

Bug Fixes

• discover global node_modules root from dev checkout via npm root -g fallback (93aac81)

Documentation

• note npm root -g fallback for dev checkout infrastructure reads (d06caf7)
• plan createRequire fallback for dev checkout infra read bypass (#93) (7750044)
• plan npm root -g fallback for dev checkout infra read bypass (#93) (85e697c)
• retro: add retro notes for issue #91 (d2d1263)

5.1.0 (2026-05-05)

Features

• command-aware path extraction for pattern-first commands (#91) (befca23)

Documentation

• plan command-aware path extraction for sed/awk/grep/rg/sd (#91) (be88a6a)
• retro: add retro notes for issue #88 (453a8ba)

5.0.0 (2026-05-05)

⚠ BREAKING CHANGES

• Rule.origin and PermissionCheckResult.origin are now required fields. Code that constructs Rule or PermissionCheckResult literals must include an origin value.

Features

• add RuleOrigin type and origin field to Rule (b4452d1)
• display rule origins in /permission-system show output (af34c8e)
• include rule origin in permission review log entries (b19fdf6)
• make Rule.origin and PermissionCheckResult.origin required (937a9f5)
• propagate origin to synthesized default rule (04f9130)
• track and propagate rule origin through checkPermission (327bc60)

Documentation

• plan rule origin provenance tracking (#88) (d8f8840)
• retro: add retro notes for issue #48 (2187a53)
• update target architecture for required Rule.origin (edf0620)
• update target architecture for rule origin provenance (c82435b)

4.9.0 (2026-05-05)

Features

• bypass external_directory gate for Pi infrastructure reads (229a352)

Bug Fixes

• skip regex patterns in bash external-directory path extraction (9fe4ba6)

Documentation

• document piInfrastructureReadPaths config and infrastructure auto-allow (65e0ac8)
• plan auto-allow reads from Pi infrastructure directories (#48) (06b8d44)
• retro: add retro notes for issue #53 (1988d7a)

4.8.0 (2026-05-05)

Features

• add expandHomePath utility for ~ and $HOME expansion (18264e1)
• expand ~ and $HOME in wildcard patterns at compile time (3c7e0c2)

Documentation

• document ~/$HOME pattern expansion in schema, example config, and README (8ad5190)
• plan home directory expansion in permission patterns (#53) (b5b77b6)
• retro: add retro notes for issue #52 (7fc8113)
• sleep before pulling release commit and tag (af701b5)

4.7.0 (2026-05-05)

Features

• add bash arity table with prefix lookup (#52) (56a8e81)
• integrate arity table into suggestBashPattern (#52) (5a3c809)

Documentation

• document bash arity table (#52) (376ae5c)
• plan bash arity table for smart approval patterns (#52) (6a78244)
• retro: add retro notes for issue #60 (54ed04a)

4.6.0 (2026-05-05)

Features

• bump tsconfig target to ES2023 (#60) (7557ffd)

Documentation

• plan tsconfig ES2023 bump (#60) (7005929)
• retro: add retro notes for issue #81 (7eb892e)
• update AGENTS.md ES version floor to ES2023 (#60) (3fe87da)

4.5.0 (2026-05-05)

Features

• add evaluateFirst multi-candidate evaluate helper (6b1fa60)
• add input normalizer for non-MCP surfaces (6d25624)
• add MCP input normalization to input-normalizer (6fa58b2)
• concatenate session rules into composed ruleset (e85e844)

Documentation

• mark unified checkPermission as implemented in target architecture (bb7214a)
• plan unified checkPermission evaluate path (#81) (6562328)
• retro: add retro notes for issue #82 (f748fe0)

4.4.1 (2026-05-05)

Documentation

• plan delete deprecated defaults.ts stub (#82) (36fcace)
• retro: add retro notes for issue #80 (bfa11d5)

Miscellaneous Chores

• delete deprecated defaults.ts stub (#82) (40ae42a)

4.4.0 (2026-05-05)

Features

• wire PermissionPrompter and remove runtime promptPermission (#80) (8e0980a)

Documentation

• add permission-prompter architecture note (#80) (6cc1b60)
• add permission-prompter to target architecture module map (#80) (c5cf101)
• add permission-prompter to v3 architecture module map (#80) (94be5b5)
• plan extract PermissionPrompter class (#80) (50fcf34)
• remove interim permission-prompter from target architecture map (#80) (f300f08)
• retro: add retro notes for issue #51 (79a564d)
• update target architecture for completed work and new issues (#80) (e661345)

4.3.0 (2026-05-04)

Features

• add pattern-suggest module for session approval patterns (0752604)
• dynamic session approval label in permission dialog (4737f0d)
• extend checkPermission session evaluation to all surfaces (ffc6731)
• extend permission gate with sessionApproval pass-through (a77bad7)
• generalize session approvals to all permission surfaces (#51) (2fcc2e3)

Documentation

• document generalized session approvals (#51) (233666e)
• plan generalized session approvals for all surfaces (#51) (3b40cf9)
• retro: add retro notes for issue #74 (0eb2ea0)

4.2.0 (2026-05-04)

Features

• replace shell-quote with tree-sitter-bash for AST-based path extraction (7dce2a4)

Documentation

• note tree-sitter follow-up addressed by #74 (bd835bd)
• note tree-sitter-bash AST parser in architecture docs (ecec2a6)
• plan tree-sitter-bash AST-based path extraction (#74) (1693794)
• rename current-architecture.md to v3-architecture.md (38d91c5)
• retro: add retro notes for issue #73 (d73097d)
• update bash external-directory description for tree-sitter AST parser (d022d3d)

4.1.1 (2026-05-04)

Bug Fixes

• add dotAll flag so wildcard * matches newlines (#73) (57085e3)

Documentation

• plan dotAll fix for wildcard multiline matching (#73) (b9c0a5b)

4.1.0 (2026-05-04)

Features

• replace regex tokenizer with shell-quote (#72) (1568992)

Documentation

• plan shell-quote tokenizer migration (#72) (0390e06)
• retro: add retro notes for issue #68 (4775453)

4.0.1 (2026-05-04)

Bug Fixes

• skip bare-slash tokens in bash external-directory extraction (#68) (84f9a88)

Documentation

• plan skip bare-slash tokens in external-directory extraction (#68) (f4fded8)
• plan skip bare-slash tokens in external-directory extraction (#68) (f33964a)
• retro: add retro notes for issue #66 (61d7e5c)

4.0.0 (2026-05-04)

⚠ BREAKING CHANGES

• permissions.schema.json replaces defaultPolicy/tools/bash/mcp/ skills/special with a single 'permission' object where each key is a surface name and the value is a PermissionState string or pattern-action map. config.example.json updated to use flat format.
• warning message now directs users to the flat permission format ({ "permission": { ... } }) instead of the legacy pi-permissions.jsonc paths. The set of detected misplaced keys is unchanged (legacy keys still warned). The flat-format "permission" key is explicitly not flagged.
• PermissionManager now reads policy from permission.permission (FlatPermissionConfig) instead of defaultPolicy/tools/bash/mcp/skills/special.
• PermissionDefaultPolicy type is removed from types.ts. ScopeConfig is simplified to { permission?: FlatPermissionConfig }. defaults.ts is stubbed out pending full PermissionManager migration (step 5).
• UnifiedPermissionConfig now has permission?: FlatPermissionConfig instead of defaultPolicy/tools/bash/mcp/skills/special fields. Legacy files parsed with the flat-format parser produce no permission rules (old-format keys are not translated). Migration warnings are still emitted for legacy file paths.
• synthesizeDefaults() now accepts PermissionState (the universal default) instead of PermissionDefaultPolicy. synthesizeOverrides() and OverrideScope are removed. composeRuleset() signature reduced from 4 parameters to 3 (no overrides layer). PermissionManager is updated in a follow-up step.
• introduces FlatPermissionConfig type and normalizeFlatConfig(). The legacy normalizeConfig() remains temporarily until PermissionManager is updated in a follow-up step.

Features

• add normalizeFlatConfig for flat permission format (#66) (c8f6177)
• remove PermissionDefaultPolicy and legacy defaults (#66) (404ffa1)
• replace config-loader with flat permission format (#66) (0bd8d71)
• simplify synthesize layer for flat config (#66) (c9a73a4)
• update misplaced-key detection for flat format (#66) (5b8e9da)
• update PermissionManager for flat permission config (#66) (eb578b0)
• update schema and example for flat permission format (#66) (32dd44d)

Documentation

• acknowledge MasuRii/pi-permission-system as the upstream origin (fe8b642)
• add legacy-to-flat migration guide (#66) (d415cc4)
• add migration guide and fork-language revision to plan (#66) (be58dd1)
• link MasuRii profile and acknowledge OpenCode inspiration (21e5bc7)
• plan flat permission config format (#66) (b5e0657)
• remove unrelated pi extensions section from README (22d0057)
• retro: add retro notes for issue #65 (9e85dcb)
• revise fork language from friendly to full fork (#66) (bcea397)

3.11.0 (2026-05-04)

Features

• add "session" source to PermissionCheckResult (#65) (039ae26)
• add synthesize module (synthesizeDefaults, synthesizeOverrides, synthesizeBaseline, composeRuleset) (#65) (e0469b2)
• compose ruleset with synthesized defaults and overrides (#65) (dac47c1)
• remove separate session pre-check from tool_call (#65) (d156e9b)
• tag session rules with layer metadata (#65) (2346f95)

Documentation

• drop backward-compat language for config format (#66) (fabde91)
• plan generalized session approvals and update target architecture (#51) (23a019a)
• plan synthesize defaults into ruleset and unify evaluate path (#65) (295fd10)
• retro: add retro notes for issue #57 (cffb3a5)
• update architecture for synthesized defaults and deprecate getSurfaceDefault() (#65) (e703809)

3.10.0 (2026-05-04)

Features

• migrate tool_call external_directory to SessionRules (42c2bd9)
• remove SessionApprovalCache (9d5a5be)
• replace SessionApprovalCache with SessionRules in runtime (4cec9c5)

Documentation

• plan replace SessionApprovalCache with session Ruleset (#57) (ed1cefe)
• retro: add retro notes for issue #56 (f97f65c)
• update session approval references (#57) (40e5e89)

3.9.0 (2026-05-03)

Features

• add normalizeConfig and defaults modules (84f9c3e)
• evaluate() accepts optional defaultAction parameter (69dde81)

Bug Fixes

• remove unused imports flagged by biome (62704a3)

Documentation

• mark #42 and #43 complete in target architecture (04430f2)
• mark #56 complete in target architecture (2fe95c5)
• plan unify Rule type and normalize config into flat Ruleset (#56) (61e8c48)
• retro: add retro notes for issue #43 (bd6aea6)

3.8.0 (2026-05-03)

Features

• define ExtensionRuntime and createExtensionRuntime factory (#43) (6ad3db6)
• eliminate module-scope state in src/index.ts (#43) (45b2bc1)
• relocate factory helpers into src/runtime.ts (#43) (88c1acd)
• simplify HandlerDeps to use ExtensionRuntime (#43) (2ff5971)
• thread logger through forwarded-permissions IO (#43) (66db158)

Documentation

• plan eliminate module-scope mutable state (#43) (6a782d7)
• retro: add retro notes for issue #42 (9b91110)
• update plan with implementation notes (#43) (d29a7c0)

3.7.0 (2026-05-03)

Features

• define HandlerDeps interface for handler extraction (#42) (a71e553)
• extract before_agent_start handler into src/handlers/before-agent-start.ts (#42) (9443a99)
• extract input handler into src/handlers/input.ts (#42) (196862a)
• extract lifecycle handlers into src/handlers/lifecycle.ts (#42) (0edb194)
• extract tool_call handler into src/handlers/tool-call.ts (#42) (a4b81ca)

Documentation

• align handler extraction plan with architecture docs (#42) (4d91e03)
• retro: add retro notes for issue #55 (ee763ff)
• update plan with implementation notes for handler extraction (#42) (73603b2)

3.6.0 (2026-05-03)

Features

• add Rule, Ruleset, getDefaultAction, and evaluate() in src/rule.ts (482e00a)
• add wildcardMatch convenience function to wildcard-matcher (fa65219)

Bug Fixes

• replace findLast with manual backwards loop in evaluate() (1911f37)

Documentation

• mark #55 complete in target architecture refactoring sequence (0c87289)
• plan extract pure evaluate() function (#55) (fd11860)
• retro: add retro notes for issue #54 (d7c5e8a)

3.5.0 (2026-05-03)

Features

• deprecate doom_loop special permission key (68e70e7)
• remove doom_loop from type union and config-loader (bf2f288)

Documentation

• add architecture documents for current and target permission model (aab1ac5)
• plan doom_loop deprecation (#54) (2e730f5)
• plan handler extraction from piPermissionSystemExtension (#42) (6ecd419)
• remove doom_loop from schema, example, and README (7f422e0)
• retro: add retro notes for issue #45 (14c5559)

3.4.0 (2026-05-03)

Features

• add "approve for session" option to permission dialog (#45) (909d5ee)
• add SessionApprovalCache for ephemeral session approvals (#45) (4f97779)
• wire session approvals into external-directory gates (#45) (3ab156d)

Documentation

• document session-scoped approval option (#45) (eb1eb9c)
• plan session-scoped approvals for permission prompts (#45) (29dcede)
• retro: add retro notes for issue #41 (fd2755f)

3.3.0 (2026-05-03)

Features

• add permission-gate module (507a1b6), closes #41

Documentation

• plan extract reusable permission-gate function (#41) (2458bf2)
• retro: add retro notes for issue #44 (963bb1b)

3.2.0 (2026-05-03)

Features

• add SAFE_SYSTEM_PATHS allowlist and isSafeSystemPath helper (#44) (331b53f)
• filter safe system paths from bash external path extraction (#44) (a0a907f)
• skip safe system paths in isPathOutsideWorkingDirectory (#44) (360594c)

Documentation

• clarify /dev/null redirect risks in plan #44 (00c61e7)
• note safe system path allowlist in external-directory section (#44) (eaec9ae)
• plan auto-allow /dev/null in external directory checks (#44) (90b94f4)

3.1.0 (2026-05-03)

Features

• add bash external-directory format helpers (#39) (5c7e93c)
• enforce external_directory gate on bash commands (#39) (5342139)
• extract external paths from bash command tokens (#39) (8cb3c2a)

Documentation

• document bash external_directory gate in README (#39) (d33e1ea)
• plan bash external_directory gate (#39) (ba80c64)

3.0.5 (2026-05-03)

Miscellaneous Chores

• deps: update dependencies and clean up unused peers (d8482a9)

3.0.4 (2026-05-03)

Documentation

• plan drop .js extensions from internal imports (#32) (1d73759)
• retro: add retro notes for issue #33 (4e4ef43)

Miscellaneous Chores

• add lint:imports guard against .js extensions (#32) (fa0b924)

3.0.3 (2026-05-03)

Bug Fixes

• stop findSection at first non-body line instead of EOF (#33) (15c178e)

Documentation

• plan fix for findSection greedy end boundary (#33) (72a5f9e)
• retro: add retro notes for issue #35 (89830cb)

3.0.2 (2026-05-03)

Documentation

• plan align test mock-cleanup and node:* default-export rules (#35) (480aa02)
• retro: add retro notes for issue #21 (c7aae09)

3.0.1 (2026-05-03)

Documentation

• add descriptions to all JSON schema entities (cb3a7ce)
• enrich JSON schema with examples, defaults, and markdown descriptions (6f38d7e)
• plan index.ts split into focused modules (#21) (ccd736a)
• retro: add retro notes for issue #10 (31e59d6)
• retro: correct formatting friction attribution (#10) (2e96b7b)
• update plan with Phase 2 unit tests using DI and vitest mocks (#21) (ad7f5fe)

3.0.0 (2026-05-03)

⚠ BREAKING CHANGES

• Config is now loaded from ~/.pi/agent/extensions/pi-permission-system/config.json (global) and /.pi/extensions/pi-permission-system/config.json (project). Legacy paths are detected and merged with migration warnings.
• Config and log file paths move from the extension install directory and ~/.pi/agent/ to the extensions// convention.

Features

• add config-paths module with new layout paths (#10) (532d2a1)
• add unified config loader (#10) (20143e0)
• detect and merge legacy config paths (#10) (95046de)
• implement config merge in unified loader (#10) (30b9afe)
• update config-reporter for consolidated layout (#10) (96c9ef4)
• wire index.ts to consolidated config layout (#10) (e7f8e5f)

Documentation

• plan config layout consolidation (#10) (eb2924d)
• retro: add retro notes for issue #20 (4735f0c)
• update schema, example, and docs for consolidated config (#10) (39b5c01)

2.0.0 (2026-05-03)

⚠ BREAKING CHANGES

• the pi-permission-system:permission-request event channel is no longer emitted. No known consumers exist; the type was never exported. Re-adding with a proper public contract is tracked

Features

• add /build-plan prompt template for non-TDD plans (e98f13c)
• delete permission-request event channel (#20) (6a41cfa)

Documentation

• plan delete permission-request event channel (#20) (e202350)
• remove event channel from preserved-identity list (#20) (52299a2)
• retro: add retro notes for issue #22 (55629fe)
• update copyright in license (b27994e)

1.2.1 (2026-05-03)

Bug Fixes

• retro: correct MD060 rule — column alignment, not separator spacing (7f116b8)

Documentation

• plan relax on-disk identity rule (#22) (d886862)
• relax on-disk identity rule for config/log paths (#22) (352b103)
• retro: add retro notes for issue #19 (1d4a4a6)
• update README badges to match pi-autoformat style (5c6ef1f)

1.2.0 (2026-05-03)

Features

• drop legacy settings.json fallback for MCP server names (#19) (3978f94)

Documentation

• plan drop legacy settings.json MCP fallback (#19) (fd88aac)
• retro: add retro notes for issue #18 (1bb9cc5)

1.1.0 (2026-05-03)

Features

• emit deprecation warning for special.tool_call_limit (#18) (1170d40)
• notify user of deprecated config fields at startup (#18) (3408672)
• surface config issues from PermissionManager (#18) (4c8103b)

Documentation

• plan drop unread special.tool_call_limit from schema (#18) (c45f6f7)
• remove tool_call_limit from schema and README (#18) (780b414)

1.0.0 (2026-05-03)

⚠ BREAKING CHANGES

• The bundled temperature-stripping shim for OpenAI Responses-style APIs (openai-codex-responses, openai-responses, azure-openai-responses) has been removed. This module monkey-patched the provider stack at the process level and had no connection to permission enforcement. Users who need the shim can extract it into a standalone extension.

Features

• remove out-of-scope model-option-compatibility provider shim (#17) (b390896)

Documentation

• plan removal of out-of-scope model-option-compatibility shim (#17) (a48f2ef)
• retro: add retro notes for issue #16 (ee710cb)

0.8.0 (2026-05-03)

Features

• replace vendored zellij-modal with direct pi-tui SettingsList (#16) (868675f)

Documentation

• plan delete vendored zellij-modal and rebuild settings UI (#16) (35274da)

Miscellaneous Chores

• add project-local pi-autoformat config (13a6f33)

0.7.0 (2026-05-02)

Features

• add prek pre-commit hooks for Biome and markdownlint (#14) (1093e87)
• align prek config with pi-autoformat conventions (#14) (a9b72aa)

Bug Fixes

• use check-only mode for pre-commit hooks (#14) (fc37f1f)

Documentation

• plan prek pre-commit linting setup (#14) (5debd98)
• retro: add retro notes for issue #13 (a0b889d)

0.6.1 (2026-05-02)

Bug Fixes

• consolidate duplicate session_start handlers (#13) (6f5591a)

Documentation

• plan consolidate duplicate session_start handlers (#13) (3b045c2)
• remove dual-handler caveat from AGENTS.md (#13) (5e8bf87)
• retro: add retro notes for issue #6 (8921a47)

0.6.0 (2026-05-02)

Features

• add getResolvedPolicyPaths to PermissionManager (#6) (663b892)
• emit config.resolved review-log entry at startup (#6) (6968171)

Documentation

• document config.resolved diagnostic log entry (#6) (332fe41)
• plan config.resolved diagnostic log entry (#6) (8d51ff3)

0.5.0 (2026-05-02)

Features

• add extension config, logging system, and permission request events (6252d9e)
• add getToolPermission for tool-level permission checks (fe3ab17)
• add guidelines sanitization to system prompt sanitizer (5689e4a)
• add yolo mode and permission forwarding (b36e113)
• caching: add before-agent-start cache for active tools and prompt state (b0f1c85)
• detect misplaced permission keys in config.json (#4) (5be5eda)
• loadPermissionSystemConfig warns on misplaced permission keys (#4) (4f0e173)
• permission-system: expose tool input params in logs and ask prompts (e334964)
• permission: add layered policy reload handling (ad0a4da)
• permission: add state and denial reason to permission prompts (d499b94)
• permission: forward subagent approval requests (bb9086e)
• permission: log sanitized tool input previews (192b66c)
• special: enforce external_directory CWD boundary in tool_call handler (6c59781)
• status: add permission system status sync for yolo mode (0b77943)

Bug Fixes

• events: listen on session_start instead of nonexistent session_switch (2bbbaba)
• package: stop publishing config.json (af1b531)
• permission: add model option compatibility guard (d9dd506)
• permission: harden prompt and external directory enforcement (48c3af1)
• permission: summarize file tool approval prompts (3775894)
• prompt: remove denied tools from available tools section (f22bccc)

Documentation

• add AGENTS.md and .pi/prompts workflow templates (bebc197)
• add readme and changelog (07e29c5)
• add Related Pi Extensions cross-linking section (facdf3f)
• clarify config.json vs permission-policy file (#4) (464e1d1)
• fix recipe ordering and clarify last-match-wins precedence (70427f6)
• plan warn on misplaced permission keys in config.json (#4) (ffcef67)
• release: finalize 0.4.2 notes (ea1c587)
• release: prepare 0.4.3 notes (73a255c)
• release: prepare 0.4.4 notes (78f5c48)
• release: prepare v0.4.5 (e5a713b)
• release: update CHANGELOG for 0.4.2 (47084d6)
• update README for @gotgenes fork (f6ff1dd)

Miscellaneous Chores

• add biome and markdownlint-cli2 tooling (3140f32)
• add license, ignores, and assets (f59ce79)
• align npm keywords for discoverability (fabbb4d)
• bootstrap extension project (4b3e7d5)
• bump version to 0.2.0 (4df5864)
• deps: update pi peer dependencies (bf3d7e6)
• exclude docs folder from version control (3fa6a49)
• pin typescript as devDependency (2ff692f)
• release v0.3.0 (36a3d7e)
• release v0.4.1 (da22e18)
• release: cut v0.1.1 (5d8739b)
• release: cut v0.1.2 (f4f0fe7)
• release: cut v0.1.3 (88667f2)
• release: cut v0.1.4 (6c9804b)
• release: cut v0.1.5 (cdaca30)
• release: cut v0.1.6 (644660e)
• release: cut v0.1.7 (1e73124)
• release: cut v0.1.8 (164a6e3)
• rename package and update metadata for @gotgenes fork (cd9bc5f)
• types: replace types-shims.d.ts with real type packages (3809612)

[Unreleased]

[0.4.6] - 2026-04-28

Added

• Added bounded, sanitized tool input previews to permission review logs for non-bash/non-MCP tool calls, inspired by PR #10 from @DevkumarPatel.

Changed

• Reused the extension's safe JSON serialization path for generic tool approval previews so circular values and BigInts are summarized without raw full-input logging.
• Updated @mariozechner/pi-ai, @mariozechner/pi-coding-agent, and @mariozechner/pi-tui peer dependencies to ^0.70.5.

[0.4.5] - 2026-04-27

Fixed

• Added a model option compatibility guard for OpenAI Responses/Codex streams so unsupported temperature values are removed from stream options and outgoing payloads before provider calls.

[0.4.4] - 2026-04-25

Added

• Added runtime enforcement for the external_directory special permission on path-bearing tools (read, write, edit, find, grep, ls) before normal tool permission checks (thanks to @gotgenes for PR #9)
• Added readable ask prompt summaries for built-in file tools and bounded input previews for generic extension tools so users can make informed approval decisions (thanks to @beantownbytes for PR #8)
• Added skill-prompt-sanitizer.ts to parse and sanitize every <available_skills> block, including prompts with multiple skill sections

Changed

• Updated @mariozechner/pi-coding-agent and @mariozechner/pi-tui peer dependencies to ^0.70.2
• Refactored skill prompt filtering out of src/index.ts into a dedicated module for clearer ownership and reuse
• Permission prompts for edit, write, read, find, grep, and ls now show concise path/action summaries instead of raw multiline JSON

Fixed

• Denied skills are now removed from all available-skill prompt blocks instead of only the first block
• Denied skill entries are no longer retained for later skill-read path matching after prompt sanitization
• External path access now honors special.external_directory: deny and blocks ask decisions when no UI or forwarding channel is available

Tests

• Added runtime tool_call coverage for external directory deny, ask-without-UI, ask approval, internal path allow, and optional path omission
• Added prompt regression coverage for generic tool input previews and readable built-in file-tool approval summaries
• Added multi-block skill prompt sanitizer regression coverage

[0.4.2] - 2026-04-20

Added

• Added project-level permission layering from the active session workspace via <cwd>/.pi/agent/pi-permissions.jsonc
• Added project-level per-agent overrides via <cwd>/.pi/agent/agents/<agent>.md (thanks to @Talia-12 for PR #7)
• Added reload-aware permission manager refresh paths so policy caches are rebuilt when Pi reload events occur
• Added a dedicated tests/ directory with modular test entrypoints and a shared test harness
• Added before-agent-start caching module to dedupe unchanged active-tool exposure and prompt state across before_agent_start lifecycle invocations
• Added PermissionPromptDecision type with state and denialReason fields for richer permission prompt resolution
• Added getPolicyCacheStamp() method to PermissionManager for cache invalidation tracking

Changed

• Global path resolution now follows Pi's getAgentDir() helper, so global config, agents, sessions, and logs respect PI_CODING_AGENT_DIR (thanks to @jvortmann for PR #6)
• Updated @mariozechner/pi-coding-agent and @mariozechner/pi-tui peer dependencies to ^0.67.68
• Updated TypeScript project configuration and npm scripts to run tests from tests/ instead of src/
• Updated README documentation for project-level policy files, yolo mode config, test layout, and PI_CODING_AGENT_DIR
• Permission prompts and forwarding now return PermissionPromptDecision instead of boolean for richer resolution tracking
• Permission denial messages now include user-provided denial reasons when available

Removed

• Removed the legacy packaged asset/ directory because the README now uses externally hosted images instead of repository-bundled screenshots

Fixed

• /skill:<name> permission handling now falls back to the current merged skill policy when no active agent context is available in the main session (thanks to @NSBeidou and @hidromagnetismo for reporting the issue)
• Skill denial messaging now reflects whether the block came from an agent-specific rule or the merged policy without agent context

Tests

• Added coverage for project-level precedence across global, project, system-agent, and project-agent layers
• Added coverage for resolving config from PI_CODING_AGENT_DIR
• Added coverage for before-agent-start cache key generation and state deduplication
• Added coverage for cache invalidation on permission policy changes

[0.4.1] - 2026-04-01

Changed

• Updated npm keywords for improved discoverability (pi-coding-agent, coding-agent, access-control, authorization, security)
• Updated README permission prompt example image
• Added Related Pi Extensions cross-linking section to README

[0.4.0] - 2026-04-01

Added

• System prompt sanitizer now removes inactive tool guidelines from the Guidelines: section
• Guideline filtering based on allowed tools (e.g., removes task/mcp/bash/write guidance when tools are denied)
• New TOOL_GUIDELINE_RULES configuration for extensible guideline filtering
• Helper functions: findSection(), removeLineSection(), sanitizeGuidelinesSection()

Changed

• Updated @mariozechner/pi-coding-agent and @mariozechner/pi-tui peer dependencies to ^0.64.0
• Updated @sinclair/typebox peer dependency to ^0.34.49
• Refactored system prompt sanitizer to handle both Available tools: and Guidelines: sections

Tests

• Added tests for system prompt sanitizer removing Available tools section
• Added tests for guideline filtering based on allowed tools
• Added tests for inactive built-in write/edit/task/mcp guidance removal

[0.3.1] - 2026-03-24

Added

• Permission system status module (status.ts) to expose yolo mode status to the UI
• syncPermissionSystemStatus() function to sync status with the TUI status bar
• PERMISSION_SYSTEM_STATUS_KEY and PERMISSION_SYSTEM_YOLO_STATUS_VALUE constants for status identification

Changed

• Integrated status sync on config load, config save, and extension unload
• Status is only exposed when yolo mode is enabled

Tests

• Added test for permission-system status being undefined when yolo mode is disabled and "yolo" when enabled

[0.3.0] - 2026-03-23

Added

• Yolo mode for auto-approval when enabled — bypasses permission prompts for streamlined workflows
• Permission forwarding system for subagent-to-primary IPC communication
• Configuration modal UI with Zellij integration (config-modal.ts, zellij-modal.ts)
• permission-forwarding.ts module for subagent permission request routing
• yolo-mode.ts module for automatic permission approval when yolo mode is active

Changed

• Updated @mariozechner/pi-coding-agent and @mariozechner/pi-tui peer dependencies to ^0.62.0
• Refactored index.ts to export new permission resolution utilities
• Expanded extension-config.ts with config normalization for new features
• Added types-shims.d.ts for Zellij modal type definitions

Tests

• Added comprehensive tests for config modal functionality
• Added tests for permission forwarding behavior

[0.2.2] - 2026-03-13

Changed

• Removed delegation task restriction logic — the task tool is no longer restricted to orchestrator agent only
• Simplified tool permission lookup to use explicit tools entries for arbitrary registered tools instead of MCP fallback
• Renamed TOOL_PERMISSION_NAMES to BUILT_IN_TOOL_PERMISSION_NAMES to clarify it covers only canonical Pi tools
• Updated schema descriptions for tools and mcp fields to guide configuration usage

Removed

• Removed delegation-specific permission checks (isDelegationAllowedAgent, getDelegationBlockReason) from permission evaluation

Tests

• Added comprehensive test coverage for tool permission lookup behavior

[0.2.1] - 2026-03-13

Added

• Extension configuration system (config.json) with debugLog and permissionReviewLog options
• JSONL debug logging to logs/pi-permission-system-debug.jsonl when debugLog is enabled
• JSONL permission review logging to logs/pi-permission-system-permission-review.jsonl for auditing
• Permission request event emission on pi-permission-system:permission-request channel for external consumers
• New extension-config.ts module for config file management and path resolution
• New logging.ts module with createPermissionSystemLogger for structured log output

Changed

• Replaced console.warn/console.error calls with structured logging to file
• Permission forwarding now logs request creation, response received, timeout, and user prompts
• Updated README documentation to cover extension config, logging, and event emission

[0.2.0] - 2026-03-12

Added

• getToolPermission() method to retrieve tool-level permission state without evaluating command-level rules, useful for tool injection decisions

[0.1.8] - 2026-03-10

Changed

• Refactored pattern compilation to support multiple sources for proper global+agent pattern merging
• Simplified wildcard-matcher.ts by removing unused wildcardCount and literalLength properties
• BashFilter now accepts pre-compiled patterns via BashPermissionSource type
• Replaced compilePermissionPatterns with compilePermissionPatternsFromSources for cleaner API

Fixed

• Permission pattern priority now correctly implements last-match-wins hierarchy (opencode-style)
• MCP tool-level deny no longer blocks specific MCP allow patterns

Tests

• Updated tests to reflect last-match-wins behavior
• Added test for specific MCP rules winning over tools.mcp: deny
• Rearranged test pattern declarations for clarity

[0.1.7] - 2026-03-10

Added

• src/common.ts — Shared utility module with toRecord(), getNonEmptyString(), isPermissionState(), parseSimpleYamlMap(), extractFrontmatter()
• src/wildcard-matcher.ts — Wildcard pattern compilation and matching with specificity sorting
• File stamp caching in PermissionManager for improved performance
• tools.mcp fallback permission for MCP operations
• MCP tool permission targets now inferred from configured server names in mcp.json

Changed

• Refactored bash-filter.ts to use shared wildcard-matcher.ts module
• Refactored index.ts to use shared common.ts utilities
• Refactored permission-manager.ts to use shared modules and caching
• Pre-compiled wildcard patterns are now reused across permission checks
• Updated README architecture documentation to reflect new module organization

Tests

• Added tests for MCP proxy tool inferring server-prefixed aliases from configured server names
• Added tests for tools.mcp fallback behavior
• Added tests for task using tool permissions instead of MCP fallback

[0.1.6] - 2026-03-09

Added

• Sanitized the Available tools: system prompt section so denied tools are removed before the agent starts.

Changed

• Updated README documentation to describe system-prompt tool sanitization and refreshed the displayed package version.

Fixed

• Prevented hidden tools from remaining advertised in the startup system prompt after runtime tool filtering.

[0.1.5] - 2026-03-09

Changed

• Added repository, homepage, and bugs package metadata so npm links back to the public GitHub repository and issue tracker.

[0.1.4] - 2026-03-07

Added

• Added permission request forwarding so non-UI subagent sessions can surface ask confirmations back to the main interactive session.
• Added filesystem-based request/response handling for both primary and legacy permission-forwarding directories.

Changed

• Updated README documentation to describe subagent permission forwarding behavior and current architecture responsibilities.
• Added package-lock.json to the repository for reproducible local installs.

Fixed

• Preserved interactive ask permission flows for delegated subagents that would otherwise fail without direct UI access.
• Improved cleanup and compatibility handling around legacy permission-forwarding directories.

[0.1.3] - 2026-03-04

Fixed

• Use absolute GitHub raw URL for README image to fix npm display

[0.1.2] - 2026-03-04

Changed

• Rewrote README.md with professional documentation standards
• Added comprehensive feature documentation, configuration reference, and usage examples

[0.1.1] - 2026-03-02

Changed

• Added asset/ to the npm package files whitelist so README image assets are included in tarballs.

[0.1.0] - 2026-03-02

Changed

• Reorganized repository structure to match standard extension layout:
  • moved implementation and tests into src/
  • added root index.ts shim for Pi auto-discovery
  • standardized TypeScript project settings with Bundler module resolution
• Added package distribution metadata and scripts, including pi.extensions and publish file whitelist.
• Added repository scaffolding files (README.md, CHANGELOG.md, LICENSE, .gitignore, .npmignore) and config starter template.

Preserved

• Global permission config path semantics remained ~/.pi/agent/pi-permissions.jsonc.
• Permission schema location remained schemas/permissions.schema.json.
• Permission enforcement behavior remained intact.