mirror of
https://bitbucket.org/siakitem/my-pi.git
synced 2026-08-28 16:45:22 +00:00
215 KiB
215 KiB
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
26.2.1 (2026-08-17)
Bug Fixes
Documentation
26.2.0 (2026-08-17)
Features
Bug Fixes
Documentation
26.1.0 (2026-08-17)
Features
- pi-permission-system: attribute absent-authority denials (225412d), closes #726
- pi-permission-system: carry decision provenance across the forwarding boundary (0dbf13f), closes #726
- pi-permission-system: name the authorizer link that decided an ask (8556724), closes #726
- pi-permission-system: record the decider on non-prompting resolutions (5e24abf), closes #726
- pi-permission-system: record the human decider on prompted decisions (9f540ba), closes #726
Documentation
- pi-permission-system: record decision provenance and mark Phase 13 Step 6 complete (e2739e7), closes #726
26.0.0 (2026-08-16)
⚠ BREAKING CHANGES
- pi-permission-system: the
messagefield is removed from everypermission_request.*review-log entry. A consumer parsing it should read the structured fields instead:surface,matchedPattern,executedUnit,commandContext,invokedToolName,forwarded, andrequesterSessionId, alongside the existingtoolName,command,path,target, andtoolInputPreview. - pi-permission-system: values in the permission review log are now truncated at
reviewLogFieldMaxWidth(default 1000) with a trailing ellipsis, where a bashcommandwas previously written whole. RaisereviewLogFieldMaxWidthto keep longer values.ToolPreviewFormatterOptions.toolInputLogPreviewMaxLengthandTOOL_INPUT_LOG_PREVIEW_MAX_LENGTHare removed, superseded by that setting. - pi-permission-system:
toolInputPreviewMaxLengthandtoolTextSummaryMaxLengthare still accepted but ignored, and a config setting either now logs a deprecation warning at session start. Remove them; usepromptMaxRowsandpromptFieldMaxWidthto bound what a permission prompt renders. - pi-permission-system:
PermissionUiPromptEvent.messageis removed. Readrequest.valuefor the decision-relevant value andrequest.matchedPatternfor the rule that fired;surface,value,agentName, andforwardingare unchanged.DirectPromptInput.messagelikewise becomespayload: PromptPayload. - pi-permission-system:
ForwardedPermissionRequest.messageis removed and replaced bypayload: PromptPayload, which carries the ask's complete structured facts. A serving node on this version accepts an older child'smessage-only request and renders it fromsurface,value, and the requester provenance; an older parent rejects a newer child's request, so upgrade the parent session first.
Features
- pi-permission-system: bound review-log field width with reviewLogFieldMaxWidth (#746) (dceb931)
- pi-permission-system: carry the prompt payload on the forwarded-request wire (bf67cd6), closes #745
- pi-permission-system: ignore the deprecated tool-preview caps and notice their use (47d7610), closes #745
- pi-permission-system: narrow the ui_prompt broadcast to the request facts (fcdb174), closes #745
- pi-permission-system: render a forwarded ask from the child's own payload (8587269), closes #745
- pi-permission-system: render the review log from the prompt payload (#746) (b373876)
- pi-permission-system: replace the forwarded-request message with the structured payload (1af41a9), closes #745
Bug Fixes
Documentation
- pi-permission-system: document the payload contracts and mark Phase 13 Step 3 complete (a2381ac), closes #745
- pi-permission-system: record the agent and review-log renderers (#746) (af88cc1)
- pi-permission-system: retire references to the dissolved denial module (#746) (53647b2)
25.4.0 (2026-08-15)
Features
- pi-permission-system: adopt the requester's request id as the forwarded request id (3f8d3fd), closes #752
- pi-permission-system: carry the request id on permissions:decision (95c001c), closes #752
- pi-permission-system: give the gate-error review entry a request id (172bc68), closes #752
- pi-permission-system: mint a permission request id at request creation (336842d), closes #752
Documentation
- pi-permission-system: record the minted request id in the API and architecture docs (84f5856), closes #752
25.3.0 (2026-08-15)
Features
- pi-permission-system: add promptMaxRows and promptFieldMaxWidth (8dbca30), closes #710
- pi-permission-system: expand the permission dialog to the complete request on Ctrl+O (b741513), closes #710
- pi-permission-system: render permission prompts as bounded, aligned fact lines (2bd18c5)
Documentation
- pi-permission-system: distinguish the redundancy rule from elision (5b26a46), closes #710
- pi-permission-system: document the bounded permission dialog (68fcf58), closes #710
25.2.2 (2026-08-15)
Bug Fixes
- pi-permission-system: gate commands hosted in bash redirect targets (1015bb8), closes #741
- pi-permission-system: gate commands hosted in interpolating heredoc bodies (48978d2), closes #741
- pi-permission-system: project path operands of heredoc-hosted nested commands (8e2fbee), closes #741
- pi-permission-system: project path operands of redirect-hosted nested commands (12164f3), closes #741
Documentation
25.2.1 (2026-08-15)
Bug Fixes
- pi-permission-system: auto-approve residual synthetic asks under yolo (e1706d3)
- pi-permission-system: honor an explicit bash deny for an unparseable command (2e45633)
Documentation
25.2.0 (2026-08-14)
Features
Bug Fixes
- pi-permission-system: stop reporting a delegated subagent chain as unregistered links (2a1c082), closes #727
Documentation
25.1.0 (2026-08-13)
Features
- pi-permission-system: add a process-global serving-session registry (2939982), closes #719
- pi-permission-system: announce the session serving forwarded requests (74c0259), closes #719
- pi-permission-system: make the forwarding timeout configurable (fc6190d), closes #719
Bug Fixes
- pi-permission-system: carry the denial reason into the unavailable block message (1a0b289), closes #719
- pi-permission-system: fail fast when no session serves a forwarded request (5241df0), closes #719
- pi-permission-system: report forwarding failures as unavailable, not user-denied (6c37d27), closes #719
Documentation
25.0.0 (2026-08-11)
⚠ BREAKING CHANGES
- pi-permission-system: a bash command referencing
$HOMEor${HOME}now reaches theexternal_directorygate whether or not the target exists, so a policy withexternal_directory: {"*": "ask"}prompts for commands that previously ran silently. Allow the directory explicitly to restore the old behavior — e.g."external_directory": {"~/.cargo/registry/*": "allow"}. The token shown in prompts, review-log entries, and derived session-approval patterns is now the expanded path rather than the$HOME/...spelling; this makes the prompt agree with the approval pattern, which was already derived from the expanded form.
Features
Bug Fixes
Documentation
- pi-permission-system: record resolved shell expansions in ADR 0009 and user docs (caaf5ec), closes #694
24.0.0 (2026-07-26)
⚠ BREAKING CHANGES
- pi-permission-system: an authorizer chain link's
allowon a forwarded subagent ask raised by thepathorexternal_directorygate is now downgraded todefer, so the request falls through to an interactive prompt. This affects only an operator running an allow-capable third-party link named inauthorizerChain; the first-party model judge is deny-first and is unaffected, as are forwardedbashasks and per-tool-gated asks. See packages/pi-permission-system/docs/migration/0635-forwarded-ask-delegation-envelope.md
Bug Fixes
23.0.3 (2026-07-26)
Bug Fixes
- pi-permission-system: preserve tool expansion in inline permission prompts (6a0d241)
Documentation
- pi-permission-system: document tool expansion during permission prompts (f4098d3)
23.0.2 (2026-07-26)
Bug Fixes
- pi-permission-system: create forwarding request files owner-only (8c77c72), closes #647
- pi-permission-system: create permission logs owner-only (6043cf8), closes #647
- pi-permission-system: mask sensitive-keyed values in permission logs (05cb12a), closes #647
- pi-permission-system: redact generic tool input in the review log (2035fb2), closes #647
Documentation
- pi-permission-system: link ADR 0010 by absolute URL from shipped docs (0384af6), closes #647
- pi-permission-system: record ADR 0010 on permission-log secret exposure (c13b48a), closes #647
23.0.1 (2026-07-25)
Bug Fixes
Documentation
23.0.0 (2026-07-24)
⚠ BREAKING CHANGES
- pi-permission-system: path values embedded in
--opt=valuebash tokens are now extracted and gated by thepathandexternal_directorysurfaces. Previously they were invisible to both, so a permissivebashrule such asgrep *allowed them. Add an allow pattern onexternal_directoryorpathfor an intended target. - pi-permission-system: bash commands referencing existing bare-named files or in-project symlinks are now gated by
pathrules (matched against the canonical, symlink-resolved form) and byexternal_directorywhen they resolve outside the working directory. Previously a permissivebashallow rule such ascat *bypassed both. A bare token naming no file is still dropped, sogit status-style commands are unaffected. To restore prior behavior for an intended target, add an allow pattern onexternal_directory(for outside-CWD paths) or onpath.
Bug Fixes
- pi-permission-system: classify path values embedded in --opt=value tokens (0be19fd), closes #645
- pi-permission-system: gate existing bare-named files and symlinks in bash commands (9467858), closes #645
Documentation
- pi-permission-system: update architecture and skill docs for probe-based path candidacy (90c402d), closes #645
22.0.0 (2026-07-24)
⚠ BREAKING CHANGES
- pi-permission-system: In an untrusted project, project-scoped permission configuration (project config.json and project-agent frontmatter) and project-scoped runtime config (yoloMode, permissionReviewLog, etc.) are no longer loaded until the user grants project trust. Only global policy applies. Grant project trust, or set defaultProjectTrust, to restore the prior behavior.
Features
- pi-permission-system: support skipping project scope in loadAndMergeConfigs (e5a2e57)
Bug Fixes
- pi-permission-system: gate project-scoped config on project trust (f264e71)
Documentation
- pi-permission-system: document project-trust gating for project config (e955a29)
21.0.0 (2026-07-24)
⚠ BREAKING CHANGES
- pi-permission-system: A session whose project/agent/project-agent config is invalid previously inherited a lower scope's
allowrules unchanged; those surfaces now resolve toask(prompt) until the invalid config is corrected. Only sessions that already emit a config-validation warning are affected. Fix the reported config issues and reload to restore the intended policy.
Features
- pi-permission-system: add floorAllowsToAsk allow→ask overlay (#646) (8dbdcd7)
- pi-permission-system: mark invalid non-global config scopes (#646) (1abd318)
Bug Fixes
Documentation
20.10.0 (2026-07-21)
Features
- pi-permission-system: thread a review-log seam into the authorizer chain (b086474)
20.9.1 (2026-07-20)
Documentation
- pi-permission-system: cite pi-permission-model-judge as a registerAuthorizer example (6bc1e67)
20.9.0 (2026-07-19)
Features
- pi-permission-system: add authorizerChain config field (#599) (6c0bb72)
- pi-permission-system: add registerAuthorizer cross-extension seam (#599) (ea60900)
- pi-permission-system: cap link verdicts with the delegation envelope (#599) (28733fc)
- pi-permission-system: inject a session-scoped PermissionQuery into chain links (#599) (29452ff)
- pi-permission-system: resolve the configured authorizer chain (#599) (fb366d9)
Documentation
- pi-permission-system: document registerAuthorizer + authorizerChain and mark Phase 12 Step 5 complete (#599) (1d6b228)
20.8.0 (2026-07-18)
Features
- pi-permission-system: accept pre-fixed path-values intents for forwarded serving (ab60874)
- pi-permission-system: declare ForwardedAccessIntent wire schema with tolerant read (#596) (66ddbef)
- pi-permission-system: emit access-intent facts from the bash path gates (#596) (1a0e6de)
- pi-permission-system: emit access-intent facts from the per-tool gate (#596) (2e17256)
- pi-permission-system: emit access-intent facts from the skill gates (#596) (5a20033)
- pi-permission-system: emit access-intent facts from the tool path gates (#596) (93a3398)
- pi-permission-system: serialize the child-fixed access intent onto the forwarded request (#596) (5234614)
- pi-permission-system: serving resolves the forwarded access intent at gate parity (#597) (a8fe815)
Documentation
20.7.3 (2026-07-15)
Bug Fixes
Documentation
- pi-permission-system: document the bundled public type declaration (070875d)
20.7.2 (2026-07-14)
Bug Fixes
Documentation
- pi-permission-system: record exec-capable wrapper survey and mark Phase 11 Step 6 complete (#575) (6485246)
20.7.1 (2026-07-14)
Bug Fixes
20.7.0 (2026-07-14)
Features
- pi-permission-system: add doublePressToConfirm config toggle (bd401bf)
- pi-permission-system: add inline permission prompt decision model (08d6ec6)
- pi-permission-system: dispatch TUI permission prompts to the inline keybind dialog (197c0f9)
- pi-permission-system: render inline keybind permission prompt (7ac7dad)
20.6.0 (2026-07-13)
Features
- pi-permission-system: add resolveShellInvocation dispatch point (5c5edc8)
- pi-permission-system: gate aliased shell tools through the bash stack (2c17f2c), closes #574
- pi-permission-system: resolve and gate aliased shell workdir (d9b2af8), closes #574
Documentation
- pi-permission-system: document live shellTools enforcement (b8048ed)
20.5.0 (2026-07-13)
Features
- pi-permission-system: add shellTools config schema (cd4f851)
- pi-permission-system: carry shellTools through config merge (635d66b)
Bug Fixes
Documentation
- pi-permission-system: document shellTools config (1b8e3c3)
20.4.2 (2026-07-13)
Documentation
20.4.1 (2026-07-12)
Bug Fixes
- pi-permission-system: floor find/fd exec wrappers to ask (#490) (6cb1d54)
- pi-permission-system: floor sudo/env/xargs/time/nohup/timeout/nice to ask (#490) (b4d5c40)
Documentation
20.4.0 (2026-07-12)
Features
- pi-permission-system: add bash advisory decompose-or-fallback resolver (e0637f1)
- pi-permission-system: add warm tree-sitter parser and sync bash-command parse (66470f0)
- pi-permission-system: decompose advisory bash checkPermission at gate parity (d8d7ef0)
- pi-permission-system: warm bash parser on before_agent_start (509c597)
Documentation
- pi-permission-system: document advisory bash decomposition and complete roadmap step 4 (aeb8633)
20.3.0 (2026-07-09)
Features
- pi-permission-system: forward the child's session-approval suggestion (fa04d8c)
- pi-permission-system: offer whole-session scope on forwarded approvals (bd2be07)
Documentation
- pi-permission-system: record forwarded grant-scope selection (Phase 9 Step 4) (a3d1fca)
20.2.0 (2026-07-09)
Features
- pi-permission-system: serve forwarded permissions by resolution and Authorizer escalation (#557) (c5d3bcb)
Documentation
- pi-permission-system: mark Phase 9 Step 3 complete (a5a348f)
20.1.0 (2026-07-08)
Features
- pi-permission-system: gate win32 backslash-relative bash args via path rules (#520) (ad90fe5)
- pi-permission-system: recognize win32 backslash-relative path tokens (#520) (343f331)
Documentation
20.0.0 (2026-07-07)
⚠ BREAKING CHANGES
- pi-permission-system: The permissions:rpc:check and permissions:rpc:prompt event-bus channels are removed, along with their request/reply types (PermissionsCheckRequest, PermissionsCheckReplyData, PermissionsPromptRequest, PermissionsPromptReplyData), the PermissionsRpcReply envelope, PERMISSIONS_PROTOCOL_VERSION, and the rpc_prompt member of PermissionUiPromptSource. permissions:rpc:check consumers migrate to getPermissionsService().checkPermission(surface, value?, agentName?). permissions:rpc:prompt is removed with no public replacement; prompt forwarding is an internal subagent-to-parent mechanism.
Features
- pi-permission-system: remove deprecated event-bus RPC channel (557ea91)
Documentation
- pi-permission-system: repoint cross-extension docs off the removed RPC channel (b3d06f7), closes #531
19.0.1 (2026-07-07)
Documentation
- pi-permission-system: mark Phase 8 Step 6 complete; retarget forwarder docs (c11d8a2)
19.0.0 (2026-07-06)
⚠ BREAKING CHANGES
- pi-permission-system: The permission-system config loader was tolerant — it silently discarded malformed fields (a non-boolean
debugLog, an invalid permission action, an unknown key) and loaded the rest. It now rejects the entire config file for that scope when any field is invalid, and reports each problem with its JSON path. On upgrade, a config that previously loaded with silently-dropped fields will be rejected until the reported problems are fixed; the affected scope falls back to the safeaskdefault until then. Fix each field named in the emitted issues (visible in the permission review log / debug log).
Features
- pi-permission-system: add zod config schema as validation source (6b71491)
- pi-permission-system: generate JSON Schema from zod and fix hosted $id URL (7b6556d)
- pi-permission-system: validate config with zod and reject invalid fields (7e32cae)
Documentation
- pi-permission-system: document zod config schema and strict validation (c8babf9)
18.2.0 (2026-07-06)
Features
- pi-permission-system: add yolo rule origin and ask→allow rewrite helper (a4bbcc0)
- pi-permission-system: auto-approve yolo-origin allow in the gate runner (caf8419)
- pi-permission-system: rewrite ask rules to yolo-origin allow at check time (cd4e509)
18.1.2 (2026-07-05)
Bug Fixes
- pi-permission-system: allow-list Git Bash POSIX paths via external_directory on win32 (#533) (5532a43)
- pi-permission-system: fold Git Bash cd targets with MSYS semantics on win32 (#533) (5cb20b4)
- pi-permission-system: match Git Bash POSIX-absolute bash tokens as typed on win32 (#533) (095fa5e)
- pi-permission-system: recognize POSIX device paths in bash commands on win32 (#533) (11ca70f)
- pi-permission-system: translate MSYS drive-mount bash tokens on win32 (#533) (2bf4e53)
Documentation
18.1.1 (2026-07-03)
Bug Fixes
18.1.0 (2026-07-02)
Features
- pi-permission-system: add rule-driven bare-token classifier (0d693a7), closes #509
- pi-permission-system: derive promotable path-token matcher from config (4a29882), closes #509
- pi-permission-system: gate bash bare filenames via path rules (4ee201a), closes #509
- pi-permission-system: promote bare tokens in bash path projection (f887b7c), closes #509
Documentation
18.0.2 (2026-07-01)
Bug Fixes
- pi-permission-system: add AccessPath.resolvedAlias() for symlink-target disclosure (cf6e25c)
- pi-permission-system: disclose resolved symlink target in tool external-directory messages (1225e2b)
- pi-permission-system: disclose resolved symlink targets in bash external-directory messages (f9fab42)
18.0.1 (2026-06-30)
Documentation
18.0.0 (2026-06-29)
⚠ BREAKING CHANGES
- pi-permission-system: A permissions:rpc:check query for a
path/external_directory/ path-bearing surface now matches the canonical (symlink-resolved) alias, and apath/ path-bearing query now evaluates the supplied path instead of collapsing to*. - pi-permission-system: A service (
getPermissionsService().checkPermission) query for apath/external_directory/ path-bearing surface now matches the canonical (symlink-resolved) alias, and apath/ path-bearing query now evaluates the supplied path instead of collapsing to*. A symlinked path can now match a rule on its canonical target. - pi-permission-system: a per-tool path rule (e.g.
read: deny *.env) now also fires when a symlink's resolved target matches the pattern, where previously only the lexically-referenced spelling matched. A symlink alias can no longer evade a per-tool deny/allow.
Features
- pi-permission-system: match the canonical form on service path queries (be4a3e7)
- pi-permission-system: match the canonical form on the per-tool path gate (ad36e78)
- pi-permission-system: match the canonical form on the RPC check query (bb04ca5)
Bug Fixes
Documentation
- pi-permission-system: document canonical per-tool path matching (bafa492)
- pi-permission-system: document canonical service/RPC path matching (35c36fa)
17.1.1 (2026-06-29)
Bug Fixes
17.1.0 (2026-06-28)
Features
17.0.0 (2026-06-27)
⚠ BREAKING CHANGES
- pi-permission-system: the path surface now also matches the canonical (symlink-resolved) form of bash path-rule tokens, so a path rule can fire on a symlink alias it previously missed, changing decisions on upgrade with no config edit.
- pi-permission-system: the path surface now also matches the canonical (symlink-resolved) form of a tool's file path. A path rule that previously matched only the as-typed spelling now also matches when the path resolves through a symlink to a target the pattern covers, which can change allow/deny decisions on upgrade with no config edit.
Features
- pi-permission-system: add AccessPath.forPath and forLiteral factories (4323cae), closes #486
- pi-permission-system: match the canonical form on the bash-path gate (6ce0c06)
- pi-permission-system: match the canonical form on the path tool gate (869ca76)
Documentation
16.2.1 (2026-06-27)
Bug Fixes
- pi-permission-system: floor opaque bash -c/eval wrappers to ask (#481) (e69493c)
- pi-permission-system: strip env-var assignment prefix from bash command units (#481) (1c99fb3)
Documentation
- pi-permission-system: document env-prefix stripping and opaque bash-wrapper floor (#481) (40c0012)
- pi-permission-system: note opaque-wrapper sentinel in README and skill (#481) (e226fe7)
- pi-permission-system: note prefix strip and opaque flag in commands() JSDoc (#481) (1892098)
16.2.0 (2026-06-26)
Features
- pi-permission-system: add ScopedPermissionManager.check(intent) (#478) (7cb600a)
- pi-permission-system: narrow ScopedPermissionResolver to resolve(intent) (#478) (908176f)
Documentation
16.1.0 (2026-06-26)
Features
16.0.2 (2026-06-25)
Documentation
16.0.1 (2026-06-21)
Bug Fixes
- pi-permission-system: fold cd across redirect-then-pipe in external-directory projection (293c0b7), closes #454
16.0.0 (2026-06-21)
⚠ BREAKING CHANGES
- pi-permission-system: the bash permission gate fails closed. An internal gate error blocks the tool (with a gate_error review-log entry) instead of running it ungated, and a non-empty unparseable bash command resolves to ask instead of riding a permissive top-level "". To opt back into permissive bash behavior, set an explicit "bash": { "": "allow" } policy.
Bug Fixes
15.1.0 (2026-06-20)
Features
- pi-permission-system: trace tool-call decisions and emit a session summary (#452) (528e340)
- pi-permission-system: warn when a permissive top-level "*" leaves bash ungated (#452) (8ef8d0f)
Bug Fixes
- pi-permission-system: prompt instead of allowing an unparseable bash command (#452) (538bac1)
- pi-permission-system: retry tree-sitter parser init instead of caching a rejected promise (#452) (468facd)
Documentation
15.0.1 (2026-06-20)
Bug Fixes
15.0.0 (2026-06-20)
⚠ BREAKING CHANGES
- the wire system prompt now lists the active tools (narrowed to the permission-allowed set) in the
Available tools:section. Previously the permission system removed that section entirely, so the model saw no tool listing. Sessions that relied on the empty-listing behavior will now see the narrowed listing.
Bug Fixes
Documentation
14.0.1 (2026-06-19)
Bug Fixes
- pi-permission-system: strip shell comment lines from bash commands before matching (d045591)
14.0.0 (2026-06-17)
⚠ BREAKING CHANGES
- project agents'
permission:frontmatter at<cwd>/.pi/agents/<name>.mdis now read and enforced. Previously the wrong directory (<cwd>/.pi/agent/agents) was checked and the frontmatter was silently ignored, so a session may become more restrictive on upgrade.
Bug Fixes
Documentation
- correct project agent override path to <cwd>/.pi/agents (#428) (d193d6a)
- fix stale project agents path in troubleshooting and ADR-0001 (#428) (95effeb)
13.2.0 (2026-06-17)
Features
Bug Fixes
- pi-permission-system: match external_directory patterns against typed and resolved paths (#418) (d08e645)
Documentation
13.1.2 (2026-06-16)
Documentation
- pi-permission-system: clarify external_directory surface in README (#413) (c09929b)
- pi-permission-system: document external_directory allow-list for outside-CWD caches (#413) (86b1d87)
- pi-permission-system: show external_directory allow-list in example config and schema (#413) (8178a7e)
13.1.1 (2026-06-13)
Bug Fixes
- preserve forwarded-permission responses dir while requests pending (#398) (9914e70)
- recreate forwarded-permission responses dir before write (#398) (67d34ef)
13.1.0 (2026-06-13)
Features
- pi-permission-system: add DenyWithReason type and shared guard (51750e1), closes #395
- pi-permission-system: append custom reason to denial messages (d8e5756), closes #395
- pi-permission-system: build deny rules with reason in normalizeFlatConfig (186c15a), closes #395
- pi-permission-system: preserve deny-with-reason from JSON config (3201bfd), closes #395
- pi-permission-system: thread deny reason into PermissionCheckResult (ed712e4), closes #395
Documentation
13.0.0 (2026-06-12)
⚠ BREAKING CHANGES
- A relative bash path token now also matches absolute allowlist rules naming the same file, resolved against the effective directory after literal cd commands. A token under a config like
path: { "*": "ask", "/workspace/project/*": "allow" }moves fromasktoallow. Tokens after a non-literal cd (e.g. cd "$DIR") stay conservative and match only their literal form. - When Pi's working directory is known, a relative path input now also matches absolute allowlist rules naming the same file. A config like
path: { "*": "ask", "/workspace/project/*": "allow" }moves a relativesrc/App.jsxfromasktoallow. To keep tighter control, narrow the allowlist patterns or add an explicitpathdeny for the sensitive paths.
Features
- add alias-aware evaluateAnyValue (#393) (2b7d240)
- add cd-aware pathRuleCandidates to BashProgram (#393) (102a491)
- add path-policy value derivation (#393) (d34e57f)
- add resolvePathPolicy resolver method (#393) (8ec81da)
- match relative path inputs against absolute allowlists (#393) (6d0c564)
- normalize path inputs to cwd-aware policy values (#393) (3c2784f)
- resolve bash path tokens with cd-aware policy values (#393) (7bcdbe7)
Documentation
- document cwd-aware path policy matching (#393) (8ab53a2)
- pi-permission-system: update Development section to current scripts and tooling (ebda301)
12.0.0 (2026-06-12)
⚠ BREAKING CHANGES
- extension and MCP tools that expose a filesystem path (input.path, or input.arguments.path for MCP) are now subject to the path and external_directory permission gates. Tools previously ungated may now prompt or be denied under existing path rules.
Features
- add extensible tool input path extraction (#352) (3a54ea1)
- add tool access extractor registry (#352) (7a34f01)
- expose registerToolAccessExtractor via permissions service (#352) (5e02c16)
- gate extension and MCP path tools by default (#352) (1d53f4f)
Documentation
11.0.0 (2026-06-11)
⚠ BREAKING CHANGES
- The permission system no longer auto-activates pi's off-by-default tools (
find,grep,ls) in the main session. Users who want them active should enable them via pi's ownactiveToolsconfiguration rather than relying on the permission system to expose every non-denied tool.
Features
Bug Fixes
Documentation
10.10.1 (2026-06-11)
Documentation
10.10.0 (2026-06-10)
Features
- pi-permission-system: add case-insensitive and Windows-separator options to wildcard matcher (587b3e8)
Bug Fixes
- pi-permission-system: auto-allow infrastructure reads case-insensitively on Windows (a3f137a)
- pi-permission-system: auto-detect Pi's install directory for infrastructure reads (#382) (c3d89ba)
- pi-permission-system: include an optional Pi package dir in infrastructure reads (da667ec)
- pi-permission-system: make path containment case-insensitive on Windows via path.relative (c10b84a)
- pi-permission-system: match external_directory/path patterns case-insensitively on Windows (3ed92da)
Documentation
- pi-permission-system: document Windows case-insensitive matching and Pi-install auto-allow (c98d33b)
10.9.0 (2026-06-10)
Features
10.8.0 (2026-06-10)
Features
Documentation
10.7.2 (2026-06-10)
Miscellaneous Chores
- deps: bump tooling dependencies to latest minor/patch (8b9105d)
10.7.1 (2026-06-09)
Bug Fixes
10.7.0 (2026-06-09)
Features
- add normalizeOptionalStringArray to common (8be9154)
Bug Fixes
10.6.0 (2026-06-08)
Features
- pi-permission-system: add best-effort canonicalizePath helper (5b5002e)
Bug Fixes
- pi-permission-system: canonicalize bash external-path containment (#345) (89f8e9b)
- pi-permission-system: canonicalize tool-call external-directory containment (#345) (d7f3bd1)
Documentation
- pi-permission-system: note symlink canonicalization in architecture (b758a48)
10.5.3 (2026-06-08)
Bug Fixes
- merge tool preview length fields across config layers (803fbb4)
- parse tool preview length fields in unified config loader (3241956)
10.5.2 (2026-06-08)
Bug Fixes
- pi-permission-system: expand $HOME in normalizePathForComparison (#350) (1b92ed3)
- pi-permission-system: home-expand path values before matching (#350) (48a7b37)
Documentation
10.5.1 (2026-06-07)
Documentation
10.5.0 (2026-06-07)
Features
Bug Fixes
10.4.0 (2026-06-07)
Features
- add context-owning PromptingGateway (1885be2)
Documentation
- mark Phase 4 Step 6 complete; drop unused beforeEach import (217057a)
10.3.1 (2026-06-06)
Bug Fixes
10.3.0 (2026-06-05)
Features
- add ConfigStore owning extension config state (5941733)
10.2.0 (2026-06-04)
Features
- add PermissionManager.configureForCwd and agentDir option (5a2d363)
10.1.0 (2026-06-03)
Features
- add DecisionReporter and GateDecisionReporter (530211d)
- add GatePrompter and SessionApprovalRecorder session roles (2f761e4)
- add GateRunner class consolidating gate dispatch (a390558)
- add getToolPreviewLimits and getInfrastructureReadDirs to PermissionSession (#327) (a0bf166)
- add PermissionResolver.resolve to PermissionSession (c922bbd)
- add skill_input denial context (#326) (71e9d28)
- introduce SkillInputGatePipeline collaborator (#329) (4ddd5af)
- introduce ToolCallGatePipeline collaborator (#327) (3a87727)
Bug Fixes
- drop vestigial events field; document makeReporter in package skill (9e0a8a7)
Documentation
- document SkillInputGatePipeline in architecture and package skill (#329) (9193c86)
- record the composition-root collaborator extraction (#320) (dab8890)
- standardize and correct package READMEs (4c270ad)
10.0.0 (2026-06-02)
⚠ BREAKING CHANGES
- pi-permission-system: the permissions:ready event payload no longer includes protocolVersion. Consumers that read it must rely on package semver instead.
Features
- pi-permission-manager: broadcast permission prompts on permissions:prompt channel (8540f3b)
- pi-permission-system: drop protocolVersion from permissions:ready (6728a93)
- pi-permission-system: harden prompt broadcasts (067bafd)
- pi-permission-system: make ready and decision broadcasts best-effort (00a895f)
- pi-permission-system: preserve display fields for forwarded prompts (9970912)
- pi-permission-system: slim ui_prompt payload and centralize construction (7a1ec56)
Bug Fixes
- pi-permission-system: drop manual CHANGELOG Unreleased section (f14e4f5)
Documentation
- pi-permission-system: document the lean ui_prompt contract (0b3c11c)
9.2.0 (2026-06-02)
Features
- flag relative paths conservatively after a non-literal cd (6e631a0), closes #307
- fold sequential current-shell cd into the bash effective directory (7fd8e95), closes #307
- scope cd inside subshells and persist it across brace groups (37b948c), closes #307
9.1.0 (2026-06-02)
Features
- evaluate nested bash command substitutions and subshells (#306) (0e52d64)
- surface nested execution context in bash deny and ask messages (#306) (9d88543)
Documentation
9.0.1 (2026-06-01)
Bug Fixes
- enumerate top-level bash commands in BashProgram (cdb41e1)
- evaluate each bash sub-command with most-restrictive precedence (85e48b2)
- gate bash command chains per sub-command (#301) (3f80097)
Documentation
9.0.0 (2026-06-01)
⚠ BREAKING CHANGES
- unpublishPermissionsService() now requires the service to remove as its sole argument. The package's public export is service.ts, so this changes the published API surface.
Features
Bug Fixes
Documentation
8.3.2 (2026-06-01)
Bug Fixes
- pi-permission-system: key subagent registry by session id and drop vestigial agentName (d299c54)
- pi-permission-system: resolve subagent detection and forwarding target by session id (0f7e079)
Documentation
8.3.1 (2026-06-01)
Bug Fixes
- add process-global SubagentSessionRegistry accessor (#296) (d3fd3b0)
- share SubagentSessionRegistry across parent and child sessions (#296) (fed676a)
Documentation
- explain process-global subagent registry across session buses (#296) (1804dbb)
- use ADR-NNNN with links docs-wide (c6b6431)
8.3.0 (2026-06-01)
Features
- add built-in MCP input summarizer (#283) (2d47e36)
- add ToolInputFormatterRegistry (#283) (c2c2b3d)
- consult custom formatter registry in ToolPreviewFormatter (#283) (9a0d756)
- expose registerToolInputFormatter on PermissionsService (#283) (2287484)
Documentation
- add authoring guide for tool input formatters (#283) (6d154a1)
- document tool input formatter seam (#283) (2fc9ff1)
8.2.1 (2026-05-31)
Bug Fixes
8.2.0 (2026-05-31)
Features
- add SessionApproval value object and SessionRules.record (8f98d92)
- centralize decision-event construction in buildDecisionEvent (19c2c83)
8.1.0 (2026-05-31)
Features
- add toolInputPreviewMaxLength and toolTextSummaryMaxLength config fields (#266) (3a7dafb)
- use configured preview limits in permission prompts (#266) (83e2829)
Documentation
8.0.0 (2026-05-30)
⚠ BREAKING CHANGES
registerSubagentSessionandunregisterSubagentSessionare removed from thePermissionsServiceinterface and its implementation. TheSubagentSessionInfotype is no longer re-exported from the public service module.
Features
Documentation
7.4.1 (2026-05-30)
Bug Fixes
- pi-permission-system: resolve bash paths against leading cd target (c655a7e)
Documentation
- pi-permission-system: document cd-aware bash path resolution (a2e6541)
7.4.0 (2026-05-29)
Features
- register subagent child sessions via lifecycle events (cd324dc)
Documentation
- document event-based subagent child lifecycle (62621fa)
7.3.3 (2026-05-28)
Bug Fixes
Documentation
- plan fix for bash external-directory config-level allow bypass (#249) (9e09f35)
- retro: add planning stage notes for issue #249 (fe13214)
- retro: add TDD stage notes for issue #249 (b5d22f6)
7.3.2 (2026-05-27)
Documentation
- replace \n with <br/> in Mermaid node labels (3312a45)
7.3.1 (2026-05-26)
Bug Fixes
- resolve pre-existing lint errors in pi-autoformat and pi-permission-system (68fd516)
Documentation
7.3.0 (2026-05-25)
Features
- pi-permission-system: add SubagentSessionRegistry class (a0ef16b)
- pi-permission-system: detect in-process subagents via session registry (c90b824)
- pi-permission-system: expose registry and getToolPermission on PermissionsService (984d2bb)
- pi-permission-system: resolve forwarding target from subagent registry (5eb15af)
Documentation
- pi-permission-system: document subagent session registry API (93c5c3e)
- pi-permission-system: update architecture for subagent registry (7b32e6a)
- plan subagent session registry and tool-level permission query (#221) (a11d91a)
- retro: add planning stage notes for issue #221 (cf434c2)
- retro: add TDD stage notes for issue #221 (e050898)
7.2.0 (2026-05-24)
Features
- add eslint config with type-aware rules and import enforcement (4fb3cc6)
7.1.4 (2026-05-23)
Bug Fixes
7.1.3 (2026-05-23)
Documentation
7.1.2 (2026-05-23)
Bug Fixes
- resolve fallow dead-code warnings (2113f6b)
Documentation
7.1.1 (2026-05-22)
Documentation
7.1.0 (2026-05-22)
Features
Documentation
- document piInfrastructureReadPaths glob support (#122) (94fa688)
- fix misleading ** examples and clarify * matches all characters (00563dc)
- plan glob support for piInfrastructureReadPaths (#122) (1450d8b)
7.0.1 (2026-05-21)
Documentation
7.0.0 (2026-05-21)
⚠ BREAKING CHANGES
- GateDescriptor.messages has been replaced by GateDescriptor.denialContext. Any code constructing a GateDescriptor must provide a DenialContext instead of pre-formatted message strings.
Features
Bug Fixes
- remove broken relative links in archived plan 0042 (07bcca4)
Documentation
- add README to archived plans directory (c3fcb9f)
- archive pre-monorepo plans, plan soften denial messages (#78) (7709f8f)
Code Refactoring
6.0.2 (2026-05-20)
Miscellaneous Chores
- enforce MD029 ordered list numbering (95f8574)
6.0.1 (2026-05-19)
Bug Fixes
- re-enable MD057 and fix broken links (52a88b1)
Documentation
- enforce one-sentence-per-line across all markdown files (a533869)
6.0.0 (2026-05-19)
⚠ BREAKING CHANGES
- All @earendil-works/pi-* peerDependencies and devDependencies now require >=0.75.0, aligning with Pi's Node 22 minimum.
- Minimum supported Node.js version is now >=22, aligning with Pi v0.75.0. tsconfig target raised from ES2023 to ES2024.
- ES2024 APIs (Promise.withResolvers, Object.groupBy, Map.groupBy, Array.fromAsync) are now allowed.
- @types/node catalog aligned to ^22.15.3.
- pi-autoformat now declares engines.node for consistency.
Features
- raise minimum Node.js version to 22 and bump tsconfig target to ES2024 (98a5b01)
- raise minimum Pi dependency to v0.75.0 (1068329)
Bug Fixes
- unquote rumdl globs so shell expands them (3b13a20)
5.18.3 (2026-05-17)
Documentation
5.18.2 (2026-05-17)
Bug Fixes
- bash path gate skips tokens matching only universal default (#58) (33fd169)
- restore per-package lint:md and lint scripts (0e42617)
- skip path gate when no explicit path rules configured (#58) (a6d55e1)
- use root markdownlint config from all packages (30192f8)
Documentation
- add redirect AGENTS.md to each package subdirectory (cbdcd29)
- plan fix path gate firing for universal default (#58) (ae9bbab)
Miscellaneous Chores
- consolidate configs into monorepo root (8583eaf)
- remove per-package pi-autoformat configs (b2d405a)
- replace markdownlint-cli2 with rumdl (d8dc789)
- update package.json URLs to monorepo (b92dbfa)
5.18.1 (2026-05-15)
Documentation
- plan Pi GitHub Tools extension (#153) (6f8566f)
- retro: add retro notes for issue #145 (70ff363)
- update /ship-issue to use pi-github-tools (#153) (7a4de21)
- update docs and pattern-suggest for path surface (6defcdb)
5.18.0 (2026-05-14)
Features
- add package.json exports field for cross-extension import (#145) (1091de5)
- add Symbol.for()-backed service accessor module (#145) (6a7ddab)
- publish permissions service on startup, clear on shutdown (#145) (97bea7b)
Documentation
- deprecate permissions:rpc:check types in favor of service accessor (#145) (a64b1b9)
- document service accessor and deprecate RPC check (#145) (931a14e)
- plan Symbol.for()-backed service accessor (#145) (d9448bc)
- retro: add retro notes for issue #148 (84e0262)
5.17.0 (2026-05-14)
Features
- bash path gate with broader token extraction (#148) (affe202)
- broader token extraction for path rules (#148) (6303641)
- evaluateMostRestrictive helper for cross-cutting path evaluation (#148) (5260f21)
- integrate path gates into permission pipeline (#148) (36fb30e)
- path gate for tool path restrictions (#148) (cc53681)
- register path as a special permission surface (#148) (356bcf7)
Documentation
- document cross-cutting path permission surface (#148) (3bd4478)
- include edit alongside write in config examples (#147) (f083ccc)
- plan path-aware bash permission rules (#148) (71ff973)
- retro: add retro notes for issue #147 (e40402b)
5.16.0 (2026-05-13)
Features
- decision events include file path for path-bearing tools (#147) (eea226d)
- normalizeInput returns file path for path-bearing tools (#147) (0b48995)
- path-scoped session approvals for path-bearing tools (#147) (1feacc5)
Documentation
- document per-tool path patterns (#147) (81245f6)
- plan per-tool path patterns for path-bearing tools (#147) (9458706)
5.15.0 (2026-05-13)
Features
Documentation
5.14.1 (2026-05-11)
Bug Fixes
- show tool name instead of bare wildcard in session-approval label (1a65c30)
- surface-prefixed session-approval labels for all permission surfaces (759da03)
Documentation
5.14.0 (2026-05-09)
Features
Documentation
- document ? wildcard and update OpenCode compatibility (#122) (31ace5f)
- plan ? single-character wildcard support (#122) (a7a2963)
- retro: add retro notes for issue #1 (b1c66f1)
5.13.0 (2026-05-08)
Features
- warn that this is a pnpm project on global npm pass-throughs (f643149)
Bug Fixes
- pass through npm install/uninstall -g in PATH shim (eaf4256)
- prevent double-loading extension in dev via project settings (6c39f33)
Documentation
- plan external_directory integration tests (#1) (695ffeb)
- retro: add retro notes for double-prompt investigation (37734a5)
- retro: add retro notes for issue #123 (5dbea33)
Miscellaneous Chores
- switch ask tool from pi-ask-user to @eko24ive/pi-ask (0087458)
5.12.0 (2026-05-08)
Features
Documentation
- plan trailing wildcard optionality (#123) (a6a50d2)
- retro: add retro notes for issue #113 (7412740)
- update wildcard optionality docs (#123) (562adaf)
5.11.2 (2026-05-08)
Documentation
Miscellaneous Chores
- approve @google/genai build scripts in pnpm-workspace.yaml (23b177f)
- upgrade pnpm to 11.0.8 and update deps (31eb848)
5.11.1 (2026-05-08)
Documentation
Miscellaneous Chores
- migrate @mariozechner/* deps to @earendil-works/* (8908be1)
5.11.0 (2026-05-08)
Features
- add ToolRegistry interface (#130) (5e886fd)
- PermissionSession absorbs prompting methods (#130) (4ae81e6)
Documentation
- plan handler classes to replace HandlerDeps (#130) (e8bc1a4)
- retro: add retro notes for issue #129 (23c29a2)
- update architecture for handler classes (#130) (02d02b6)
5.10.0 (2026-05-08)
Features
- PermissionSession class with delegation methods (#129) (a8486ce)
- PermissionSession lifecycle, cache, agent name, and infra methods (#129) (8f6edf7)
Documentation
- plan PermissionSession extraction (#129) (9dc21b4)
- retro: add retro notes for issue #128 (9794053)
- update architecture for PermissionSession (#129) (d452c50)
5.9.0 (2026-05-08)
Features
Documentation
5.8.0 (2026-05-08)
Features
Documentation
- plan SessionLogger extraction (#127) (b13ac62)
- retro: add retro notes for issue #126 (3d8a38a)
- update architecture doc for SessionLogger (#127) (8fa4123)
5.7.0 (2026-05-08)
Features
Documentation
- add handler decomposition plan (#126, #127, #128, #129, #130) (5a116a6)
- add structural design heuristics, design-review skill, and plan-issue hook (d8e3233)
- extract code-style, testing, and markdown-conventions skills from AGENTS.md (9d5ba7a)
- plan ExtensionPaths value object extraction (#126) (d76e6cc)
- rename target-architecture to architecture, strip progress indicators (9776550)
- retro: add retro notes for issue #110 (5597de3)
5.6.3 (2026-05-07)
Documentation
- retro: add retro notes for issue #109 (7d46cf4)
- update architecture for external-directory split (#110) (2e86fe7)
- update plan for #110 after #109 landed (3541d57)
5.6.2 (2026-05-07)
Documentation
- clarify bash arity table usage difference with OpenCode (b387480)
- clarify doom_loop is not a Pi surface, not just deprecated (8c38ab2)
- detail superior bash path extraction vs OpenCode's allowlist approach (b16767b)
- merge doom_loop into OpenCode-only surfaces row (85756a7)
- move bash arity/tree-sitter to shared concepts (both at parity) (6fd7cdc)
- plan deduplicate shared helpers (#109) (52bff2e)
- plan split external-directory into focused modules (#110) (b2a4610)
- retro: add retro notes for issue #106 (a945814)
- update target architecture for extracted helpers (52693d6)
5.6.1 (2026-05-07)
Documentation
- document OpenCode compatibility (#106) (be9b2ab)
- plan document OpenCode compatibility (#106) (57aa584)
- retro: add retro notes for issue #118 (cb89995)
5.6.0 (2026-05-07)
Features
Documentation
- plan gate runner extraction (#118) (8c0eb18)
- retro: add retro notes for issue #111 (e327323)
- update target architecture for gate runner (#118) (40e1b1b)
5.5.1 (2026-05-07)
Documentation
- plan narrow handler dependencies by splitting ExtensionRuntime (#111) (cb44dee)
- retro: add retro notes for issue #108 (e967fd9)
- update target architecture for gate interfaces and SessionState (#111) (85620c4)
5.5.0 (2026-05-07)
Features
- extract FilePolicyLoader from PermissionManager (705d800)
Bug Fixes
- pass through npm calls targeting .pi/npm directory (4104712)
Documentation
- add PolicyLoader to target architecture (fbbb85f)
- plan extract PolicyLoader from PermissionManager (#108) (4d5f0df)
- retro: add retro notes for issue #107 (d979562)
5.4.0 (2026-05-07)
Features
- add npm shim to enforce pnpm usage via mise (6a446b2)
Documentation
- add redundant integration test cleanup step (#107) (236d812)
- expand gate test surfaces in plan (#107) (d671556)
- plan extract per-gate functions from handleToolCall (#107) (c867d34)
- update architecture for gate extraction (#107) (fe4c967)
5.3.4 (2026-05-06)
Documentation
- center logo with HTML align (707f3e7)
- convert logo to PNG for npm compatibility (c81e094)
- remove width constraint on logo (d50930a)
5.3.3 (2026-05-06)
Documentation
5.3.2 (2026-05-06)
Documentation
- fix ordered list continuation, use realistic quick-start config (dd26166)
- retro: add retro notes for issue #98 (bf2bbc6)
5.3.1 (2026-05-05)
Documentation
- add permission frontmatter convention guide for subagent extensions (c992959)
- add upstream issue template for subagent extension outreach (79eef27)
- link permission frontmatter guide from README and target architecture (df261fc)
- plan shared permission frontmatter convention for subagent extensions (#98) (eec5763)
- restructure README with inverted pyramid, extract reference docs (db51142)
- retro: add retro notes for issue #29 (be0620b)
5.3.0 (2026-05-05)
Features
- add permission event types and emit helpers (#29) (45a4158)
- add permissions:rpc:check policy query RPC (#29) (b230ff8)
- add permissions:rpc:prompt forwarding RPC (#29) (438227c)
- clean up RPC handlers on session shutdown (#29) (0a54a10)
- distinguish auto-approved from user-approved in decision events (#29) (746d988)
- emit permission decision events from input handler (#29) (bfc21bb)
- emit permission decision events from tool-call handler (#29) (40cf12e)
- emit permissions:ready on extension load (#29) (bfa3606)
Documentation
- document permission event API and RPC protocol (#29) (3872e54)
- plan permission event channel with decision broadcast and RPC (#29) (d31754a)
- retro: add retro notes for issue #97 (43d66d9)
5.2.1 (2026-05-05)
Documentation
- document subagent extension coexistence (#97) (9bf2972)
- plan subagent extension coexistence documentation (#97) (4cf975f)
- retro: add retro notes for issue #96 (8757ffc)
5.2.0 (2026-05-05)
Features
- add SUBAGENT_PARENT_SESSION_ENV_CANDIDATES, iterate in resolver (#96) (ac6831d)
- broaden SUBAGENT_ENV_HINT_KEYS for nicobailon + HazAT extensions (#96) (8adafdb)
Documentation
- plan broaden subagent env hint keys (#96) (9fa97b7)
- update target-architecture subagent detection for #96 (64cce35)
5.1.2 (2026-05-05)
Documentation
- fix README per-agent frontmatter example to flat format (#78) (1295427)
- plan fix README frontmatter example and add missing tests (#78) (3fc99e1)
- retro: add retro notes for issue #93 (c9e8e89)
5.1.1 (2026-05-05)
Bug Fixes
- discover global node_modules root from dev checkout via npm root -g fallback (93aac81)
Documentation
- note npm root -g fallback for dev checkout infrastructure reads (d06caf7)
- plan createRequire fallback for dev checkout infra read bypass (#93) (7750044)
- plan npm root -g fallback for dev checkout infra read bypass (#93) (85e697c)
- retro: add retro notes for issue #91 (d2d1263)
5.1.0 (2026-05-05)
Features
Documentation
- plan command-aware path extraction for sed/awk/grep/rg/sd (#91) (be88a6a)
- retro: add retro notes for issue #88 (453a8ba)
5.0.0 (2026-05-05)
⚠ BREAKING CHANGES
- Rule.origin and PermissionCheckResult.origin are now required fields. Code that constructs Rule or PermissionCheckResult literals must include an origin value.
Features
- add RuleOrigin type and origin field to Rule (b4452d1)
- display rule origins in /permission-system show output (af34c8e)
- include rule origin in permission review log entries (b19fdf6)
- make Rule.origin and PermissionCheckResult.origin required (937a9f5)
- propagate origin to synthesized default rule (04f9130)
- track and propagate rule origin through checkPermission (327bc60)
Documentation
- plan rule origin provenance tracking (#88) (d8f8840)
- retro: add retro notes for issue #48 (2187a53)
- update target architecture for required Rule.origin (edf0620)
- update target architecture for rule origin provenance (c82435b)
4.9.0 (2026-05-05)
Features
- bypass external_directory gate for Pi infrastructure reads (229a352)
Bug Fixes
- skip regex patterns in bash external-directory path extraction (9fe4ba6)
Documentation
- document piInfrastructureReadPaths config and infrastructure auto-allow (65e0ac8)
- plan auto-allow reads from Pi infrastructure directories (#48) (06b8d44)
- retro: add retro notes for issue #53 (1988d7a)
4.8.0 (2026-05-05)
Features
- add expandHomePath utility for ~ and $HOME expansion (18264e1)
- expand ~ and $HOME in wildcard patterns at compile time (3c7e0c2)
Documentation
- document ~/$HOME pattern expansion in schema, example config, and README (8ad5190)
- plan home directory expansion in permission patterns (#53) (b5b77b6)
- retro: add retro notes for issue #52 (7fc8113)
- sleep before pulling release commit and tag (af701b5)
4.7.0 (2026-05-05)
Features
- add bash arity table with prefix lookup (#52) (56a8e81)
- integrate arity table into suggestBashPattern (#52) (5a3c809)
Documentation
- document bash arity table (#52) (376ae5c)
- plan bash arity table for smart approval patterns (#52) (6a78244)
- retro: add retro notes for issue #60 (54ed04a)
4.6.0 (2026-05-05)
Features
Documentation
- plan tsconfig ES2023 bump (#60) (7005929)
- retro: add retro notes for issue #81 (7eb892e)
- update AGENTS.md ES version floor to ES2023 (#60) (3fe87da)
4.5.0 (2026-05-05)
Features
- add evaluateFirst multi-candidate evaluate helper (6b1fa60)
- add input normalizer for non-MCP surfaces (6d25624)
- add MCP input normalization to input-normalizer (6fa58b2)
- concatenate session rules into composed ruleset (e85e844)
Documentation
- mark unified checkPermission as implemented in target architecture (bb7214a)
- plan unified checkPermission evaluate path (#81) (6562328)
- retro: add retro notes for issue #82 (f748fe0)
4.4.1 (2026-05-05)
Documentation
- plan delete deprecated defaults.ts stub (#82) (36fcace)
- retro: add retro notes for issue #80 (bfa11d5)
Miscellaneous Chores
4.4.0 (2026-05-05)
Features
Documentation
- add permission-prompter architecture note (#80) (6cc1b60)
- add permission-prompter to target architecture module map (#80) (c5cf101)
- add permission-prompter to v3 architecture module map (#80) (94be5b5)
- plan extract PermissionPrompter class (#80) (50fcf34)
- remove interim permission-prompter from target architecture map (#80) (f300f08)
- retro: add retro notes for issue #51 (79a564d)
- update target architecture for completed work and new issues (#80) (e661345)
4.3.0 (2026-05-04)
Features
- add pattern-suggest module for session approval patterns (0752604)
- dynamic session approval label in permission dialog (4737f0d)
- extend checkPermission session evaluation to all surfaces (ffc6731)
- extend permission gate with sessionApproval pass-through (a77bad7)
- generalize session approvals to all permission surfaces (#51) (2fcc2e3)
Documentation
- document generalized session approvals (#51) (233666e)
- plan generalized session approvals for all surfaces (#51) (3b40cf9)
- retro: add retro notes for issue #74 (0eb2ea0)
4.2.0 (2026-05-04)
Features
- replace shell-quote with tree-sitter-bash for AST-based path extraction (7dce2a4)
Documentation
- note tree-sitter follow-up addressed by #74 (bd835bd)
- note tree-sitter-bash AST parser in architecture docs (ecec2a6)
- plan tree-sitter-bash AST-based path extraction (#74) (1693794)
- rename current-architecture.md to v3-architecture.md (38d91c5)
- retro: add retro notes for issue #73 (d73097d)
- update bash external-directory description for tree-sitter AST parser (d022d3d)
4.1.1 (2026-05-04)
Bug Fixes
Documentation
4.1.0 (2026-05-04)
Features
Documentation
4.0.1 (2026-05-04)
Bug Fixes
Documentation
- plan skip bare-slash tokens in external-directory extraction (#68) (f4fded8)
- plan skip bare-slash tokens in external-directory extraction (#68) (f33964a)
- retro: add retro notes for issue #66 (61d7e5c)
4.0.0 (2026-05-04)
⚠ BREAKING CHANGES
- permissions.schema.json replaces defaultPolicy/tools/bash/mcp/ skills/special with a single 'permission' object where each key is a surface name and the value is a PermissionState string or pattern-action map. config.example.json updated to use flat format.
- warning message now directs users to the flat permission format ({ "permission": { ... } }) instead of the legacy pi-permissions.jsonc paths. The set of detected misplaced keys is unchanged (legacy keys still warned). The flat-format "permission" key is explicitly not flagged.
- PermissionManager now reads policy from permission.permission (FlatPermissionConfig) instead of defaultPolicy/tools/bash/mcp/skills/special.
- PermissionDefaultPolicy type is removed from types.ts. ScopeConfig is simplified to { permission?: FlatPermissionConfig }. defaults.ts is stubbed out pending full PermissionManager migration (step 5).
- UnifiedPermissionConfig now has permission?: FlatPermissionConfig instead of defaultPolicy/tools/bash/mcp/skills/special fields. Legacy files parsed with the flat-format parser produce no permission rules (old-format keys are not translated). Migration warnings are still emitted for legacy file paths.
- synthesizeDefaults() now accepts PermissionState (the universal default) instead of PermissionDefaultPolicy. synthesizeOverrides() and OverrideScope are removed. composeRuleset() signature reduced from 4 parameters to 3 (no overrides layer). PermissionManager is updated in a follow-up step.
- introduces FlatPermissionConfig type and normalizeFlatConfig(). The legacy normalizeConfig() remains temporarily until PermissionManager is updated in a follow-up step.
Features
- add normalizeFlatConfig for flat permission format (#66) (c8f6177)
- remove PermissionDefaultPolicy and legacy defaults (#66) (404ffa1)
- replace config-loader with flat permission format (#66) (0bd8d71)
- simplify synthesize layer for flat config (#66) (c9a73a4)
- update misplaced-key detection for flat format (#66) (5b8e9da)
- update PermissionManager for flat permission config (#66) (eb578b0)
- update schema and example for flat permission format (#66) (32dd44d)
Documentation
- acknowledge MasuRii/pi-permission-system as the upstream origin (fe8b642)
- add legacy-to-flat migration guide (#66) (d415cc4)
- add migration guide and fork-language revision to plan (#66) (be58dd1)
- link MasuRii profile and acknowledge OpenCode inspiration (21e5bc7)
- plan flat permission config format (#66) (b5e0657)
- remove unrelated pi extensions section from README (22d0057)
- retro: add retro notes for issue #65 (9e85dcb)
- revise fork language from friendly to full fork (#66) (bcea397)
3.11.0 (2026-05-04)
Features
- add "session" source to PermissionCheckResult (#65) (039ae26)
- add synthesize module (synthesizeDefaults, synthesizeOverrides, synthesizeBaseline, composeRuleset) (#65) (e0469b2)
- compose ruleset with synthesized defaults and overrides (#65) (dac47c1)
- remove separate session pre-check from tool_call (#65) (d156e9b)
- tag session rules with layer metadata (#65) (2346f95)
Documentation
- drop backward-compat language for config format (#66) (fabde91)
- plan generalized session approvals and update target architecture (#51) (23a019a)
- plan synthesize defaults into ruleset and unify evaluate path (#65) (295fd10)
- retro: add retro notes for issue #57 (cffb3a5)
- update architecture for synthesized defaults and deprecate getSurfaceDefault() (#65) (e703809)
3.10.0 (2026-05-04)
Features
- migrate tool_call external_directory to SessionRules (42c2bd9)
- remove SessionApprovalCache (9d5a5be)
- replace SessionApprovalCache with SessionRules in runtime (4cec9c5)
Documentation
- plan replace SessionApprovalCache with session Ruleset (#57) (ed1cefe)
- retro: add retro notes for issue #56 (f97f65c)
- update session approval references (#57) (40e5e89)
3.9.0 (2026-05-03)
Features
- add normalizeConfig and defaults modules (84f9c3e)
- evaluate() accepts optional defaultAction parameter (69dde81)
Bug Fixes
- remove unused imports flagged by biome (62704a3)
Documentation
- mark #42 and #43 complete in target architecture (04430f2)
- mark #56 complete in target architecture (2fe95c5)
- plan unify Rule type and normalize config into flat Ruleset (#56) (61e8c48)
- retro: add retro notes for issue #43 (bd6aea6)
3.8.0 (2026-05-03)
Features
- define ExtensionRuntime and createExtensionRuntime factory (#43) (6ad3db6)
- eliminate module-scope state in src/index.ts (#43) (45b2bc1)
- relocate factory helpers into src/runtime.ts (#43) (88c1acd)
- simplify HandlerDeps to use ExtensionRuntime (#43) (2ff5971)
- thread logger through forwarded-permissions IO (#43) (66db158)
Documentation
- plan eliminate module-scope mutable state (#43) (6a782d7)
- retro: add retro notes for issue #42 (9b91110)
- update plan with implementation notes (#43) (d29a7c0)
3.7.0 (2026-05-03)
Features
- define HandlerDeps interface for handler extraction (#42) (a71e553)
- extract before_agent_start handler into src/handlers/before-agent-start.ts (#42) (9443a99)
- extract input handler into src/handlers/input.ts (#42) (196862a)
- extract lifecycle handlers into src/handlers/lifecycle.ts (#42) (0edb194)
- extract tool_call handler into src/handlers/tool-call.ts (#42) (a4b81ca)
Documentation
- align handler extraction plan with architecture docs (#42) (4d91e03)
- retro: add retro notes for issue #55 (ee763ff)
- update plan with implementation notes for handler extraction (#42) (73603b2)
3.6.0 (2026-05-03)
Features
- add Rule, Ruleset, getDefaultAction, and evaluate() in src/rule.ts (482e00a)
- add wildcardMatch convenience function to wildcard-matcher (fa65219)
Bug Fixes
- replace findLast with manual backwards loop in evaluate() (1911f37)
Documentation
- mark #55 complete in target architecture refactoring sequence (0c87289)
- plan extract pure evaluate() function (#55) (fd11860)
- retro: add retro notes for issue #54 (d7c5e8a)
3.5.0 (2026-05-03)
Features
- deprecate doom_loop special permission key (68e70e7)
- remove doom_loop from type union and config-loader (bf2f288)
Documentation
- add architecture documents for current and target permission model (aab1ac5)
- plan doom_loop deprecation (#54) (2e730f5)
- plan handler extraction from piPermissionSystemExtension (#42) (6ecd419)
- remove doom_loop from schema, example, and README (7f422e0)
- retro: add retro notes for issue #45 (14c5559)
3.4.0 (2026-05-03)
Features
- add "approve for session" option to permission dialog (#45) (909d5ee)
- add SessionApprovalCache for ephemeral session approvals (#45) (4f97779)
- wire session approvals into external-directory gates (#45) (3ab156d)
Documentation
- document session-scoped approval option (#45) (eb1eb9c)
- plan session-scoped approvals for permission prompts (#45) (29dcede)
- retro: add retro notes for issue #41 (fd2755f)
3.3.0 (2026-05-03)
Features
Documentation
- plan extract reusable permission-gate function (#41) (2458bf2)
- retro: add retro notes for issue #44 (963bb1b)
3.2.0 (2026-05-03)
Features
- add SAFE_SYSTEM_PATHS allowlist and isSafeSystemPath helper (#44) (331b53f)
- filter safe system paths from bash external path extraction (#44) (a0a907f)
- skip safe system paths in isPathOutsideWorkingDirectory (#44) (360594c)
Documentation
- clarify /dev/null redirect risks in plan #44 (00c61e7)
- note safe system path allowlist in external-directory section (#44) (eaec9ae)
- plan auto-allow /dev/null in external directory checks (#44) (90b94f4)
3.1.0 (2026-05-03)
Features
- add bash external-directory format helpers (#39) (5c7e93c)
- enforce external_directory gate on bash commands (#39) (5342139)
- extract external paths from bash command tokens (#39) (8cb3c2a)
Documentation
- document bash external_directory gate in README (#39) (d33e1ea)
- plan bash external_directory gate (#39) (ba80c64)
3.0.5 (2026-05-03)
Miscellaneous Chores
- deps: update dependencies and clean up unused peers (d8482a9)
3.0.4 (2026-05-03)
Documentation
- plan drop .js extensions from internal imports (#32) (1d73759)
- retro: add retro notes for issue #33 (4e4ef43)
Miscellaneous Chores
3.0.3 (2026-05-03)
Bug Fixes
Documentation
- plan fix for findSection greedy end boundary (#33) (72a5f9e)
- retro: add retro notes for issue #35 (89830cb)
3.0.2 (2026-05-03)
Documentation
- plan align test mock-cleanup and node:* default-export rules (#35) (480aa02)
- retro: add retro notes for issue #21 (c7aae09)
3.0.1 (2026-05-03)
Documentation
- add descriptions to all JSON schema entities (cb3a7ce)
- enrich JSON schema with examples, defaults, and markdown descriptions (6f38d7e)
- plan index.ts split into focused modules (#21) (ccd736a)
- retro: add retro notes for issue #10 (31e59d6)
- retro: correct formatting friction attribution (#10) (2e96b7b)
- update plan with Phase 2 unit tests using DI and vitest mocks (#21) (ad7f5fe)
3.0.0 (2026-05-03)
⚠ BREAKING CHANGES
- Config is now loaded from ~/.pi/agent/extensions/pi-permission-system/config.json (global) and /.pi/extensions/pi-permission-system/config.json (project). Legacy paths are detected and merged with migration warnings.
- Config and log file paths move from the extension install directory and ~/.pi/agent/ to the extensions// convention.
Features
- add config-paths module with new layout paths (#10) (532d2a1)
- add unified config loader (#10) (20143e0)
- detect and merge legacy config paths (#10) (95046de)
- implement config merge in unified loader (#10) (30b9afe)
- update config-reporter for consolidated layout (#10) (96c9ef4)
- wire index.ts to consolidated config layout (#10) (e7f8e5f)
Documentation
- plan config layout consolidation (#10) (eb2924d)
- retro: add retro notes for issue #20 (4735f0c)
- update schema, example, and docs for consolidated config (#10) (39b5c01)
2.0.0 (2026-05-03)
⚠ BREAKING CHANGES
- the pi-permission-system:permission-request event channel is no longer emitted. No known consumers exist; the type was never exported. Re-adding with a proper public contract is tracked
Features
- add /build-plan prompt template for non-TDD plans (e98f13c)
- delete permission-request event channel (#20) (6a41cfa)
Documentation
- plan delete permission-request event channel (#20) (e202350)
- remove event channel from preserved-identity list (#20) (52299a2)
- retro: add retro notes for issue #22 (55629fe)
- update copyright in license (b27994e)
1.2.1 (2026-05-03)
Bug Fixes
- retro: correct MD060 rule — column alignment, not separator spacing (7f116b8)
Documentation
- plan relax on-disk identity rule (#22) (d886862)
- relax on-disk identity rule for config/log paths (#22) (352b103)
- retro: add retro notes for issue #19 (1d4a4a6)
- update README badges to match pi-autoformat style (5c6ef1f)
1.2.0 (2026-05-03)
Features
Documentation
- plan drop legacy settings.json MCP fallback (#19) (fd88aac)
- retro: add retro notes for issue #18 (1bb9cc5)
1.1.0 (2026-05-03)
Features
- emit deprecation warning for special.tool_call_limit (#18) (1170d40)
- notify user of deprecated config fields at startup (#18) (3408672)
- surface config issues from PermissionManager (#18) (4c8103b)
Documentation
- plan drop unread special.tool_call_limit from schema (#18) (c45f6f7)
- remove tool_call_limit from schema and README (#18) (780b414)
1.0.0 (2026-05-03)
⚠ BREAKING CHANGES
- The bundled temperature-stripping shim for OpenAI Responses-style APIs (openai-codex-responses, openai-responses, azure-openai-responses) has been removed. This module monkey-patched the provider stack at the process level and had no connection to permission enforcement. Users who need the shim can extract it into a standalone extension.
Features
Documentation
- plan removal of out-of-scope model-option-compatibility shim (#17) (a48f2ef)
- retro: add retro notes for issue #16 (ee710cb)
0.8.0 (2026-05-03)
Features
Documentation
Miscellaneous Chores
- add project-local pi-autoformat config (13a6f33)
0.7.0 (2026-05-02)
Features
- add prek pre-commit hooks for Biome and markdownlint (#14) (1093e87)
- align prek config with pi-autoformat conventions (#14) (a9b72aa)
Bug Fixes
Documentation
0.6.1 (2026-05-02)
Bug Fixes
Documentation
- plan consolidate duplicate session_start handlers (#13) (3b045c2)
- remove dual-handler caveat from AGENTS.md (#13) (5e8bf87)
- retro: add retro notes for issue #6 (8921a47)
0.6.0 (2026-05-02)
Features
- add getResolvedPolicyPaths to PermissionManager (#6) (663b892)
- emit config.resolved review-log entry at startup (#6) (6968171)
Documentation
- document config.resolved diagnostic log entry (#6) (332fe41)
- plan config.resolved diagnostic log entry (#6) (8d51ff3)
0.5.0 (2026-05-02)
Features
- add extension config, logging system, and permission request events (6252d9e)
- add getToolPermission for tool-level permission checks (fe3ab17)
- add guidelines sanitization to system prompt sanitizer (5689e4a)
- add yolo mode and permission forwarding (b36e113)
- caching: add before-agent-start cache for active tools and prompt state (b0f1c85)
- detect misplaced permission keys in config.json (#4) (5be5eda)
- loadPermissionSystemConfig warns on misplaced permission keys (#4) (4f0e173)
- permission-system: expose tool input params in logs and ask prompts (e334964)
- permission: add layered policy reload handling (ad0a4da)
- permission: add state and denial reason to permission prompts (d499b94)
- permission: forward subagent approval requests (bb9086e)
- permission: log sanitized tool input previews (192b66c)
- special: enforce external_directory CWD boundary in tool_call handler (6c59781)
- status: add permission system status sync for yolo mode (0b77943)
Bug Fixes
- events: listen on session_start instead of nonexistent session_switch (2bbbaba)
- package: stop publishing config.json (af1b531)
- permission: add model option compatibility guard (d9dd506)
- permission: harden prompt and external directory enforcement (48c3af1)
- permission: summarize file tool approval prompts (3775894)
- prompt: remove denied tools from available tools section (f22bccc)
Documentation
- add AGENTS.md and .pi/prompts workflow templates (bebc197)
- add readme and changelog (07e29c5)
- add Related Pi Extensions cross-linking section (facdf3f)
- clarify config.json vs permission-policy file (#4) (464e1d1)
- fix recipe ordering and clarify last-match-wins precedence (70427f6)
- plan warn on misplaced permission keys in config.json (#4) (ffcef67)
- release: finalize 0.4.2 notes (ea1c587)
- release: prepare 0.4.3 notes (73a255c)
- release: prepare 0.4.4 notes (78f5c48)
- release: prepare v0.4.5 (e5a713b)
- release: update CHANGELOG for 0.4.2 (47084d6)
- update README for @gotgenes fork (f6ff1dd)
Miscellaneous Chores
- add biome and markdownlint-cli2 tooling (3140f32)
- add license, ignores, and assets (f59ce79)
- align npm keywords for discoverability (fabbb4d)
- bootstrap extension project (4b3e7d5)
- bump version to 0.2.0 (4df5864)
- deps: update pi peer dependencies (bf3d7e6)
- exclude docs folder from version control (3fa6a49)
- pin typescript as devDependency (2ff692f)
- release v0.3.0 (36a3d7e)
- release v0.4.1 (da22e18)
- release: cut v0.1.1 (5d8739b)
- release: cut v0.1.2 (f4f0fe7)
- release: cut v0.1.3 (88667f2)
- release: cut v0.1.4 (6c9804b)
- release: cut v0.1.5 (cdaca30)
- release: cut v0.1.6 (644660e)
- release: cut v0.1.7 (1e73124)
- release: cut v0.1.8 (164a6e3)
- rename package and update metadata for @gotgenes fork (cd9bc5f)
- types: replace types-shims.d.ts with real type packages (3809612)
[Unreleased]
[0.4.6] - 2026-04-28
Added
- Added bounded, sanitized tool input previews to permission review logs for non-bash/non-MCP tool calls, inspired by PR #10 from @DevkumarPatel.
Changed
- Reused the extension's safe JSON serialization path for generic tool approval previews so circular values and BigInts are summarized without raw full-input logging.
- Updated
@mariozechner/pi-ai,@mariozechner/pi-coding-agent, and@mariozechner/pi-tuipeer dependencies to^0.70.5.
[0.4.5] - 2026-04-27
Fixed
- Added a model option compatibility guard for OpenAI Responses/Codex streams so unsupported
temperaturevalues are removed from stream options and outgoing payloads before provider calls.
[0.4.4] - 2026-04-25
Added
- Added runtime enforcement for the
external_directoryspecial permission on path-bearing tools (read,write,edit,find,grep,ls) before normal tool permission checks (thanks to @gotgenes for PR #9) - Added readable
askprompt summaries for built-in file tools and bounded input previews for generic extension tools so users can make informed approval decisions (thanks to @beantownbytes for PR #8) - Added
skill-prompt-sanitizer.tsto parse and sanitize every<available_skills>block, including prompts with multiple skill sections
Changed
- Updated
@mariozechner/pi-coding-agentand@mariozechner/pi-tuipeer dependencies to^0.70.2 - Refactored skill prompt filtering out of
src/index.tsinto a dedicated module for clearer ownership and reuse - Permission prompts for
edit,write,read,find,grep, andlsnow show concise path/action summaries instead of raw multiline JSON
Fixed
- Denied skills are now removed from all available-skill prompt blocks instead of only the first block
- Denied skill entries are no longer retained for later skill-read path matching after prompt sanitization
- External path access now honors
special.external_directory: denyand blocksaskdecisions when no UI or forwarding channel is available
Tests
- Added runtime
tool_callcoverage for external directory deny, ask-without-UI, ask approval, internal path allow, and optional path omission - Added prompt regression coverage for generic tool input previews and readable built-in file-tool approval summaries
- Added multi-block skill prompt sanitizer regression coverage
[0.4.2] - 2026-04-20
Added
- Added project-level permission layering from the active session workspace via
<cwd>/.pi/agent/pi-permissions.jsonc - Added project-level per-agent overrides via
<cwd>/.pi/agent/agents/<agent>.md(thanks to @Talia-12 for PR #7) - Added reload-aware permission manager refresh paths so policy caches are rebuilt when Pi reload events occur
- Added a dedicated
tests/directory with modular test entrypoints and a shared test harness - Added before-agent-start caching module to dedupe unchanged active-tool exposure and prompt state across
before_agent_startlifecycle invocations - Added
PermissionPromptDecisiontype withstateanddenialReasonfields for richer permission prompt resolution - Added
getPolicyCacheStamp()method toPermissionManagerfor cache invalidation tracking
Changed
- Global path resolution now follows Pi's
getAgentDir()helper, so global config, agents, sessions, and logs respectPI_CODING_AGENT_DIR(thanks to @jvortmann for PR #6) - Updated
@mariozechner/pi-coding-agentand@mariozechner/pi-tuipeer dependencies to^0.67.68 - Updated TypeScript project configuration and npm scripts to run tests from
tests/instead ofsrc/ - Updated README documentation for project-level policy files, yolo mode config, test layout, and
PI_CODING_AGENT_DIR - Permission prompts and forwarding now return
PermissionPromptDecisioninstead of boolean for richer resolution tracking - Permission denial messages now include user-provided denial reasons when available
Removed
- Removed the legacy packaged
asset/directory because the README now uses externally hosted images instead of repository-bundled screenshots
Fixed
/skill:<name>permission handling now falls back to the current merged skill policy when no active agent context is available in the main session (thanks to @NSBeidou and @hidromagnetismo for reporting the issue)- Skill denial messaging now reflects whether the block came from an agent-specific rule or the merged policy without agent context
Tests
- Added coverage for project-level precedence across global, project, system-agent, and project-agent layers
- Added coverage for resolving config from
PI_CODING_AGENT_DIR - Added coverage for before-agent-start cache key generation and state deduplication
- Added coverage for cache invalidation on permission policy changes
[0.4.1] - 2026-04-01
Changed
- Updated npm keywords for improved discoverability (
pi-coding-agent,coding-agent,access-control,authorization,security) - Updated README permission prompt example image
- Added Related Pi Extensions cross-linking section to README
[0.4.0] - 2026-04-01
Added
- System prompt sanitizer now removes inactive tool guidelines from the
Guidelines:section - Guideline filtering based on allowed tools (e.g., removes task/mcp/bash/write guidance when tools are denied)
- New
TOOL_GUIDELINE_RULESconfiguration for extensible guideline filtering - Helper functions:
findSection(),removeLineSection(),sanitizeGuidelinesSection()
Changed
- Updated
@mariozechner/pi-coding-agentand@mariozechner/pi-tuipeer dependencies to ^0.64.0 - Updated
@sinclair/typeboxpeer dependency to ^0.34.49 - Refactored system prompt sanitizer to handle both
Available tools:andGuidelines:sections
Tests
- Added tests for system prompt sanitizer removing Available tools section
- Added tests for guideline filtering based on allowed tools
- Added tests for inactive built-in write/edit/task/mcp guidance removal
[0.3.1] - 2026-03-24
Added
- Permission system status module (
status.ts) to expose yolo mode status to the UI syncPermissionSystemStatus()function to sync status with the TUI status barPERMISSION_SYSTEM_STATUS_KEYandPERMISSION_SYSTEM_YOLO_STATUS_VALUEconstants for status identification
Changed
- Integrated status sync on config load, config save, and extension unload
- Status is only exposed when yolo mode is enabled
Tests
- Added test for permission-system status being undefined when yolo mode is disabled and "yolo" when enabled
[0.3.0] - 2026-03-23
Added
- Yolo mode for auto-approval when enabled — bypasses permission prompts for streamlined workflows
- Permission forwarding system for subagent-to-primary IPC communication
- Configuration modal UI with Zellij integration (
config-modal.ts,zellij-modal.ts) permission-forwarding.tsmodule for subagent permission request routingyolo-mode.tsmodule for automatic permission approval when yolo mode is active
Changed
- Updated
@mariozechner/pi-coding-agentand@mariozechner/pi-tuipeer dependencies to ^0.62.0 - Refactored
index.tsto export new permission resolution utilities - Expanded
extension-config.tswith config normalization for new features - Added
types-shims.d.tsfor Zellij modal type definitions
Tests
- Added comprehensive tests for config modal functionality
- Added tests for permission forwarding behavior
[0.2.2] - 2026-03-13
Changed
- Removed delegation task restriction logic — the
tasktool is no longer restricted to orchestrator agent only - Simplified tool permission lookup to use explicit
toolsentries for arbitrary registered tools instead of MCP fallback - Renamed
TOOL_PERMISSION_NAMEStoBUILT_IN_TOOL_PERMISSION_NAMESto clarify it covers only canonical Pi tools - Updated schema descriptions for
toolsandmcpfields to guide configuration usage
Removed
- Removed delegation-specific permission checks (
isDelegationAllowedAgent,getDelegationBlockReason) from permission evaluation
Tests
- Added comprehensive test coverage for tool permission lookup behavior
[0.2.1] - 2026-03-13
Added
- Extension configuration system (
config.json) withdebugLogandpermissionReviewLogoptions - JSONL debug logging to
logs/pi-permission-system-debug.jsonlwhendebugLogis enabled - JSONL permission review logging to
logs/pi-permission-system-permission-review.jsonlfor auditing - Permission request event emission on
pi-permission-system:permission-requestchannel for external consumers - New
extension-config.tsmodule for config file management and path resolution - New
logging.tsmodule withcreatePermissionSystemLoggerfor structured log output
Changed
- Replaced
console.warn/console.errorcalls with structured logging to file - Permission forwarding now logs request creation, response received, timeout, and user prompts
- Updated README documentation to cover extension config, logging, and event emission
[0.2.0] - 2026-03-12
Added
getToolPermission()method to retrieve tool-level permission state without evaluating command-level rules, useful for tool injection decisions
[0.1.8] - 2026-03-10
Changed
- Refactored pattern compilation to support multiple sources for proper global+agent pattern merging
- Simplified
wildcard-matcher.tsby removing unusedwildcardCountandliteralLengthproperties BashFilternow accepts pre-compiled patterns viaBashPermissionSourcetype- Replaced
compilePermissionPatternswithcompilePermissionPatternsFromSourcesfor cleaner API
Fixed
- Permission pattern priority now correctly implements last-match-wins hierarchy (opencode-style)
- MCP tool-level deny no longer blocks specific MCP allow patterns
Tests
- Updated tests to reflect last-match-wins behavior
- Added test for specific MCP rules winning over
tools.mcp: deny - Rearranged test pattern declarations for clarity
[0.1.7] - 2026-03-10
Added
src/common.ts— Shared utility module withtoRecord(),getNonEmptyString(),isPermissionState(),parseSimpleYamlMap(),extractFrontmatter()src/wildcard-matcher.ts— Wildcard pattern compilation and matching with specificity sorting- File stamp caching in
PermissionManagerfor improved performance tools.mcpfallback permission for MCP operations- MCP tool permission targets now inferred from configured server names in
mcp.json
Changed
- Refactored
bash-filter.tsto use sharedwildcard-matcher.tsmodule - Refactored
index.tsto use sharedcommon.tsutilities - Refactored
permission-manager.tsto use shared modules and caching - Pre-compiled wildcard patterns are now reused across permission checks
- Updated README architecture documentation to reflect new module organization
Tests
- Added tests for MCP proxy tool inferring server-prefixed aliases from configured server names
- Added tests for
tools.mcpfallback behavior - Added tests for
taskusing tool permissions instead of MCP fallback
[0.1.6] - 2026-03-09
Added
- Sanitized the
Available tools:system prompt section so denied tools are removed before the agent starts.
Changed
- Updated README documentation to describe system-prompt tool sanitization and refreshed the displayed package version.
Fixed
- Prevented hidden tools from remaining advertised in the startup system prompt after runtime tool filtering.
[0.1.5] - 2026-03-09
Changed
- Added
repository,homepage, andbugspackage metadata so npm links back to the public GitHub repository and issue tracker.
[0.1.4] - 2026-03-07
Added
- Added permission request forwarding so non-UI subagent sessions can surface
askconfirmations back to the main interactive session. - Added filesystem-based request/response handling for both primary and legacy permission-forwarding directories.
Changed
- Updated README documentation to describe subagent permission forwarding behavior and current architecture responsibilities.
- Added
package-lock.jsonto the repository for reproducible local installs.
Fixed
- Preserved interactive
askpermission flows for delegated subagents that would otherwise fail without direct UI access. - Improved cleanup and compatibility handling around legacy permission-forwarding directories.
[0.1.3] - 2026-03-04
Fixed
- Use absolute GitHub raw URL for README image to fix npm display
[0.1.2] - 2026-03-04
Changed
- Rewrote README.md with professional documentation standards
- Added comprehensive feature documentation, configuration reference, and usage examples
[0.1.1] - 2026-03-02
Changed
- Added
asset/to the npm packagefileswhitelist so README image assets are included in tarballs.
[0.1.0] - 2026-03-02
Changed
- Reorganized repository structure to match standard extension layout:
- moved implementation and tests into
src/ - added root
index.tsshim for Pi auto-discovery - standardized TypeScript project settings with Bundler module resolution
- moved implementation and tests into
- Added package distribution metadata and scripts, including
pi.extensionsand publish file whitelist. - Added repository scaffolding files (
README.md,CHANGELOG.md,LICENSE,.gitignore,.npmignore) and config starter template.
Preserved
- Global permission config path semantics remained
~/.pi/agent/pi-permissions.jsonc. - Permission schema location remained
schemas/permissions.schema.json. - Permission enforcement behavior remained intact.