@adeildo/pi-ask-permission 4.0.0 → 5.0.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Felipe Adeildo
+Copyright (c) 2026 adeildo
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -24,7 +24,7 @@ Answer `yes`, `always yes`, or `deny`, and add a note if you want. The note reac
 pi install npm:@adeildo/pi-ask-permission
 ```
 
-Then start pi as usual. There is nothing to configure.
+Then start pi as usual. There is nothing to configure. It also comes in [`@adeildo/pi-harness`](../harness), with the rest of the pieces.
 
 `pi-ask-permission` on npm is this same extension under an older name, and it reads the same config, grants and sessions. To switch:
 
@@ -38,7 +38,7 @@ pi install npm:@adeildo/pi-ask-permission
 Ask the agent to do something that writes, like `run the tests`. The dialog opens before the command runs:
 
 ```
-╭─ permission · bash ──────────────────────────────────╮
+╭─ permission bash ────────────────────────────────────╮
 │ pnpm test                                            │
 │                                                      │
 │ ❯ 1  yes                                             │
@@ -53,6 +53,32 @@ Ask the agent to do something that writes, like `run the tests`. The dialog open
 
 Reads inside the project never ask. `read`, `grep`, `find`, `ls`, and bash commands that only read, like `cat`, `git log`, or `rg`, run on their own. An `edit` or `write` shows the diff it would make.
 
+## One dialog for everything
+
+With [`@adeildo/pi-ask-questions`](../ask-questions) installed, this package does not draw this dialog itself: it asks through the questions package, so the permission ask and the questions the agent asks are one dialog, with the same keys and a note on any option.
+
+```
+╭─ permission ─────────────────────────────────────────╮
+│ bash wants to run:                                   │
+│                                                      │
+│   git push --force origin main                        │
+│                                                      │
+│ ▲ the judge leaned deny but was only 61% confident   │
+│                                                      │
+│ ❯ 1  yes, run it                                     │
+│      Run this call now, and ask again next time.      │
+│   2  always yes                                      │
+│   3  no                                               │
+│   4  Type something.                                 │
+│                                                      │
+│ ↑↓ or 1-4 move   enter choose   tab note   esc cancel │
+╰──────────────────────────────────────────────────────╯
+```
+
+Everything the dialog showed before is still there, as an option or in the question: the call, the summary, the reason it is asking and the diff of the change. `always yes` asks two more questions, which calls to remember and for how long. An answer typed in your own words instead of a pick blocks the call and becomes the reason the model reads.
+
+Without that package the dialog below is the one you get, and RPC hosts always get it, since they cannot draw a terminal component.
+
 ## Everyday use
 
 ### Stop answering the same question
@@ -60,7 +86,7 @@ Reads inside the project never ask. `read`, `grep`, `find`, `ls`, and bash comma
 Pick `always yes`, then choose how much to remember and for how long:
 
 ```
-╭─ permission · bash ──────────────────────────────────╮
+╭─ permission bash ────────────────────────────────────╮
 │ pnpm test                                            │
 │                                                      │
 │ always yes for...                                    │
@@ -81,19 +107,78 @@ We recommend the narrowest level, which is preselected. `pnpm` would also approv
 | this project | every session in this project            | `.pi/extensions/pi-ask-permission/always-yes.json`         |
 | everywhere   | every session                            | `~/.pi/agent/extensions/pi-ask-permission/always-yes.json` |
 
-Run `/perm forget` to drop this session's, or `/perm forget project` for the project's.
+The `Always yes` section of the settings screen shows how many rules each scope holds, and forgets them.
 
 ### Let the agent work
 
 Press `Alt+M` to switch modes. The status bar shows the one you are in.
 
-| Mode           | Runs without asking                  |
-| -------------- | ------------------------------------ |
-| `manual`       | nothing beyond reads and always yes  |
-| `accept edits` | file edits and writes in the project |
-| `auto`         | everything in the project            |
+| Mode     | Runs without asking                                                        |
+| -------- | -------------------------------------------------------------------------- |
+| `manual` | reads (`allow` and read-only bash) and always yes                          |
+| `edits`  | the same, plus file edits and writes                                       |
+| `judge`  | the same as `edits`, and the [judge](#let-a-model-decide) decides the rest |
+| `full`   | everything                                                                 |
+
+The workspace comes before the mode. A call outside `workspace.roots` asks you in every mode, even `full`. `Alt+W` lets calls outside through for this session, and a second press puts the check back. The status bar shows `anywhere` in red while it is off.
+
+A resumed session keeps its mode and its `Alt+W` choice. A new one starts from `mode` and `workspace.outside` in the settings.
+
+### Read a folder next door
+
+In a monorepo, a session in `apps/api` that reads `apps/web` leaves the workspace. The dialog says so and offers to open the repository for reads. The cursor starts on that answer:
+
+```text
+╭─ permission bash ────────────────────────────────────────────╮
+│ cd ~/Projects/grace/apps/web && git status --short | head    │
+│ ▲ reads outside the workspace                                │
+│                                                              │
+│   1  yes                                                     │
+│ ❯ 2  yes, and allow reads in ~/Projects/grace  repo root     │
+│   3  always yes                                              │
+│   4  deny                                                    │
+│                                                              │
+│ ←→ folder   s keep for this project   tab note   esc deny    │
+╰──────────────────────────────────────────────────────────────╯
+```
 
-A call that leaves the project still asks, in every mode. The mode lasts for the session and never changes the settings file.
+Press `enter` and the next reads in `~/Projects/grace` run without asking, until the session ends. `←` and `→` move the folder one level up or down. `s` keeps it for every session in this project, in `.pi/extensions/pi-ask-permission/folders.json`. An untrusted project keeps it only until pi exits.
+
+A write outside gets `yes, and add … to the workspace` instead, and the cursor stays on `yes`. A folder opened for reads never lets a write through. The dialog never offers your home or a folder above it.
+
+The status bar counts the open folders, like `+1 folder`. The `Folders` section of the settings screen closes them.
+
+### Calls to an MCP server
+
+Pi registers each tool an MCP server offers as `mcp__<server>__<tool>`. The settings screen has a row per server under `MCP servers`, and each one follows a policy of its own:
+
+| Policy        | Runs without asking                                                        |
+| ------------- | -------------------------------------------------------------------------- |
+| `ask me`      | Nothing, in any mode. Every call comes to you                              |
+| `trust hints` | A call the server declares read-only. The rest follows the mode you are in |
+| `allow`       | Every call                                                                 |
+| `deny`        | Nothing. Every call is blocked, whatever the mode says                     |
+
+`trust hints` is the default, and the hint is what the server claims about its own tool. Pi does not verify it, so a server you do not fully trust belongs on `ask me`. A server that declares nothing reads as a writer, so with `trust hints` the mode decides: `manual` and `edits` ask, `judge` judges, `full` runs.
+
+`deny` and `ask me` outrank the mode, `full` included. The `allow` list does not bring a denied server back.
+
+The resource tools pi adds for reading resources name the server in their arguments rather than in the tool name, so no server policy covers them: `list_mcp_resources`, `list_mcp_resource_templates` and `read_mcp_resource`. They declare themselves read-only, so the read-only layer runs them whatever the mode.
+
+The dialog names the server and repeats what it declares, and says when a script issued the call:
+
+```text
+╭─ permission sauron:delete_dashboard ────────────────────────╮
+│ {"uid":"abc","id":12}                                       │
+│ sauron: destructive                                         │
+│                                                             │
+│   1  yes                                                    │
+│   2  always yes                                             │
+│ ❯ 3  deny                                                   │
+╰─────────────────────────────────────────────────────────────╯
+```
+
+Pi's `codemode` tool runs a script that calls other tools, and `tool_search` loads a tool for the next call. Both run without asking, because every call they make reaches this gate on its own, and the dialog says it came from a script.
 
 ### Correct the agent
 
@@ -103,13 +188,33 @@ If you are typing in the editor when a call arrives, the dialog waits until you
 
 ## Let a model decide
 
-The judge answers first, and only the calls it is unsure about reach you. It is off by default. We recommend this setup:
+In the `judge` mode, a model answers every call that is not a read or an edit. You only see the ones it is unsure about. We recommend this setup:
 
 1. Run `/login typesafe` to use Jev, a fast model that answers with a confidence. Any model you set up in pi works too.
-2. Open `/perm`, turn on `Judge`, and turn on `Dry run`. The judge now shows its verdict as a card, and you still decide.
+2. Switch to `judge` with `Alt+M`, open the settings with `Alt+S`, and turn on `Dry run` in `Judge`. The judge now shows its verdict as a card, and you still decide.
 3. Pick a policy. `Standard development` allows edits, tests, builds, and local git, and asks about installs, network, and anything destructive.
 4. After a few sessions of agreeing with it, turn off `Dry run`.
 
+The `Judge` section has five settings, then `Test the judge` and the session's verdicts.
+
+| Row           | Does                                                                                        |
+| ------------- | ------------------------------------------------------------------------------------------- |
+| Model         | Who judges. A Jev name goes to TypeSafe, and `provider/model` is any model you set up in pi |
+| Policy        | The rules the judge follows, in plain English                                               |
+| Always ask me | Patterns the judge never approves, like `git push*`                                         |
+| Rigor         | How sure the judge must be before a call runs without you                                   |
+| Dry run       | Show the verdict, and still ask you                                                         |
+
+A call runs when the judge approves it with at least the rigor's confidence, and its risk stays at or below the ceiling. Anything else asks you.
+
+| Rigor                  | Confidence | Risk ceiling |
+| ---------------------- | ---------- | ------------ |
+| `cautious`             | 85%        | 0.45         |
+| `balanced`, by default | 70%        | 0.50         |
+| `relaxed`              | 55%        | 0.60         |
+
+The judge also reads your last message, to tell whether a call is a step of what you asked. The policy still decides, and nothing in the message overrides `Always ask me`. The card says `saw your last message` when the request carried it.
+
 The policy is plain text, so you can start from a preset and edit it:
 
 ```text
@@ -125,23 +230,25 @@ The policy is plain text, so you can start from a preset and edit it:
 Ask me.
 ```
 
-If calls come back as `the judge could not decide`, run `/perm judge test`. It sends one request and reports the model, the latency, and the error.
+If calls come back as `the judge could not decide`, run `Test the judge` in the `Judge` section. It sends one request and reports the model, the latency, and the error.
+
+## Settings
 
-## Commands
+`Alt+S` opens them. The Permission tab:
 
-Type `/perm ` and the editor suggests the rest.
+| Section      | Has                                               |
+| ------------ | ------------------------------------------------- |
+| This session | Mode and outside policy for this session          |
+| New sessions | The mode and outside policy a session starts with |
+| Workspace    | The project folders                               |
+| MCP servers  | One row per server, with its policy               |
+| Reads        | Tools that never ask, read-only bash              |
+| Dialog       | Notes, no-dialog behavior, typing pause           |
+| Judge        | Model, policy, rigor, dry run, a test, the log    |
+| Always yes   | Rule counts, and forget                           |
+| Folders      | Folders opened from the dialog, and close         |
 
-| Command                | Does                                                        |
-| ---------------------- | ----------------------------------------------------------- |
-| `/perm`                | Open the settings                                           |
-| `/perm mode`           | Switch to the next mode (also `Alt+M`)                      |
-| `/perm mode auto`      | Switch to a mode (also `manual`, `accept-edits`)            |
-| `/perm status`         | Show the config, always yes, and file paths                 |
-| `/perm forget`         | Forget this session's always yes                            |
-| `/perm forget project` | Forget this project's always yes (also `everywhere`, `all`) |
-| `/perm judge on`       | Turn the judge on (also `off`)                              |
-| `/perm judge log`      | Show this session's judge decisions                         |
-| `/perm judge test`     | Send one real request and report what happened              |
+Type to search. `Delete` resets a value.
 
 ## Reference
 
@@ -151,6 +258,8 @@ Type `/perm ` and the editor suggests the rest.
 | ---------------------- | ---------------------------------------------------- |
 | `↑` `↓` or `1` `2` `3` | Move the highlight                                   |
 | `enter`                | Confirm the highlighted row                          |
+| `←` `→`                | Pick the folder to open, on the folder row           |
+| `s`                    | Keep the folder for this project, on the folder row  |
 | `tab`                  | Open or close a note, or change the always yes scope |
 | `esc`                  | Close the note, or deny                              |
 | `ctrl+v`               | Paste a clipboard image as its file path             |
@@ -159,7 +268,7 @@ A long paste collapses to `[paste #1 +48 lines]` and expands when you confirm.
 
 ### Configuration
 
-The settings live in the file every pi-harness package shares, `~/.pi/agent/extensions/pi-harness/settings.json`, under a `permission.` prefix. Every key has a row of the same name in `/perm`, and only what you change is written, so a new default reaches you.
+The settings live in the file every piece shares, `~/.pi/agent/extensions/pi-harness/settings.json`, under a `permission.` prefix. Most keys have a row on the settings screen, which shows the key under its description. `mcp.servers` gets one row per connected server, and the finer judge keys below live in the file only. Only what you change is written, so a new default reaches you.
 
 ```json
 {
@@ -168,71 +277,77 @@ The settings live in the file every pi-harness package shares, `~/.pi/agent/exte
 		"mode": "manual",
 		"readOnlyBash": true,
 		"workspace": { "roots": ["."], "outside": "ask" },
-		"judge": { "enabled": false, "model": "jev-latest" }
+		"judge": { "model": "jev-latest" }
 	}
 }
 ```
 
 The ids below leave out the `permission.` prefix.
 
-| Key                 | Does                                                                                                                                   |
-| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `allow`             | Tools that never ask. `mcp_*` matches a family. It matches the tool name, so `bash` allows every command                               |
-| `mode`              | The mode a new session starts in                                                                                                       |
-| `readOnlyBash`      | Run bash commands that only read without asking                                                                                        |
-| `notes`             | `"result"` adds a note to the tool result. `"message"` sends it as its own message                                                     |
-| `noUI`              | `"allow"` or `"deny"` when nobody can answer, as in print mode or a subagent. Takes a per-tool map: `{ "*": "allow", "bash": "deny" }` |
-| `workspace.roots`   | Paths that count as the project. Relative, absolute, and `~` work                                                                      |
-| `workspace.outside` | A call outside the roots: `"ask"` you, `"deny"` it, or `"allow"` it like any other                                                     |
-| `typing.pause`      | Milliseconds of quiet before the dialog opens while you type                                                                           |
-| `typing.maxWait`    | The longest the dialog waits for you to stop typing. `null` waits forever                                                              |
+| Key                 | Does                                                                                                                                        |
+| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allow`             | Tools that never ask. `mcp__*` matches a family. It matches the tool name, so `bash` allows every command. An MCP server policy comes first |
+| `mode`              | The mode a new session starts in: `"manual"`, `"edits"`, `"judge"`, or `"full"`                                                             |
+| `readOnlyBash`      | Run bash commands that only read without asking                                                                                             |
+| `notes`             | `"result"` adds a note to the tool result. `"message"` sends it as its own message                                                          |
+| `noUI`              | `"allow"` or `"deny"` when nobody can answer, as in print mode or a subagent. Takes a per-tool map: `{ "*": "allow", "bash": "deny" }`      |
+| `workspace.roots`   | Paths that count as the project. Relative, absolute, and `~` work                                                                           |
+| `workspace.outside` | Where a new session starts for a call outside the roots: `"ask"` you, `"deny"` it, or `"allow"` it like any other                           |
+| `typing.pause`      | Milliseconds of quiet before the dialog opens while you type                                                                                |
+| `typing.maxWait`    | The longest the dialog waits for you to stop typing. `null` waits forever                                                                   |
+| `mcp.servers`       | The policy per MCP server, like `{ "sauron": "deny" }`. The row per server on the settings screen writes this one                           |
 
 The `judge` block:
 
-| Key                 | Default        | Does                                                  |
-| ------------------- | -------------- | ----------------------------------------------------- |
-| `enabled`           | `false`        | Turn the judge on                                     |
-| `provider`          | `"jev"`        | `"jev"`, or `"pi"` for a model you set up in pi       |
-| `model`             | `"jev-latest"` | A Jev alias, or `provider/modelId` for a pi model     |
-| `tools`             | `["bash"]`     | Tools the judge decides. The rest ask you             |
-| `policy`            | Standard       | The rules the judge follows                           |
-| `canDeny`           | `true`         | A confident no blocks the call. Off, it asks you      |
-| `whenUnsure`        | `"ask"`        | `"ask"`, `"allow"`, or `"deny"`                       |
-| `whenItFails`       | `"ask"`        | The same, for a timeout, an error, or a missing key   |
-| `alwaysAsk`         | `[]`           | Patterns the judge never approves, like `"git push*"` |
-| `dryRun`            | `false`        | Show the verdict, and still ask you                   |
-| `noUI`              | `false`        | Also judge print, JSON, and subagent runs             |
-| `rememberApprovals` | `false`        | A judge approval becomes always yes for this session  |
-| `thresholds`        | `0.85` / `0.8` | Confidence needed to allow / deny                     |
-| `riskCeiling`       | `0.45`         | Highest risk the judge may approve                    |
-| `timeoutMs`         | `5000`         | How long to wait for an answer                        |
-
-A malformed value falls back and says what it dropped, so a typo never lets more through. A key from before 3.0 is read with the new name. `PI_CODING_AGENT_DIR` moves the file with the rest of the agent directory.
-
-Up to 3.0 the config was `~/.pi/agent/extensions/pi-ask-permission/config.json`. The first session after this version reads it, writes what you changed into the shared settings, and keeps the old file as `config.json.bak`.
+| Key                 | Default        | Does                                                                                                                                  |
+| ------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
+| `model`             | `"jev-latest"` | A name that starts with `jev` goes to TypeSafe. Anything else is a pi model, as `provider/modelId` or a bare id                       |
+| `policy`            | Standard       | The rules the judge follows                                                                                                           |
+| `alwaysAsk`         | `[]`           | Patterns the judge never approves, like `"git push*"`. A pattern matches the tool name too, so `mcp__*` catches every MCP call        |
+| `rigor`             | `"balanced"`   | `"cautious"`, `"balanced"`, or `"relaxed"`. Sets `thresholds` and `riskCeiling`                                                       |
+| `dryRun`            | `false`        | Show the verdict, and still ask you                                                                                                   |
+| `thresholds`        | from `rigor`   | Confidence needed to allow / deny. File only. Set here, it wins over `rigor`, and the Rigor row reads `custom` until you pick a rigor |
+| `riskCeiling`       | from `rigor`   | Highest risk the judge may approve. File only, and it wins over `rigor` the same way                                                  |
+| `canDeny`           | `true`         | A confident no blocks the call. Off, it asks you. File only                                                                           |
+| `whenUnsure`        | `"ask"`        | `"ask"`, `"allow"`, or `"deny"`. File only                                                                                            |
+| `whenItFails`       | `"ask"`        | The same, for a timeout, an error, or a missing key. File only                                                                        |
+| `noUI`              | `false`        | Also judge print, JSON, and subagent runs. File only                                                                                  |
+| `rememberApprovals` | `false`        | A judge approval becomes always yes for this session. File only                                                                       |
+| `timeoutMs`         | `5000`         | How long to wait for an answer. File only                                                                                             |
+| `cache`             | `true`         | Reuse a verdict for the same call and the same last message in one session. File only                                                 |
+
+`judge.enabled`, `judge.tools`, and `judge.provider` are gone. A session that finds them removes them from the file and says so. If `judge.enabled` was `true` and no `mode` was set, it writes `"mode": "judge"`.
+
+A malformed value falls back and says what it dropped, so a typo never lets more through. Keys under an older name are read under the current one. `PI_CODING_AGENT_DIR` moves the file with the rest of the agent directory.
+
+If `~/.pi/agent/extensions/pi-ask-permission/config.json` exists, the next session reads it, writes what you set there into the shared settings, and renames it to `config.json.bak`.
 
 ### How a call is decided
 
 The first step that answers wins.
 
 1. **Always yes** matches the tool and level: run it.
-2. **Workspace**: a call outside `workspace.roots` asks you, or is blocked with `outside: "deny"`. Nothing below can approve it.
-3. **Mode**: `auto` runs it, `accept edits` runs an edit.
-4. **Allow list**: the tool is in `allow`, run it.
-5. **Read-only bash**: the command only reads, run it.
-6. **Judge**: a confident yes runs it, a confident no blocks it.
-7. **No UI**: `noUI` decides.
-8. **Edit check**: an `edit` that cannot apply is blocked with pi's own error, so you never approve a failure.
-9. **You**, in the dialog.
+2. **Codemode**: `codemode` and `tool_search` themselves run. Every call inside is decided on its own.
+3. **Workspace**: a call outside `workspace.roots` asks you, or is blocked with this session's outside set to `deny`. Nothing below can approve it. The call goes on with `allow`, or when every path it reaches is in a folder you opened.
+4. **MCP**: the policy of the server. `deny` blocks, `allow` runs, `ask` asks, and `trust hints` decides nothing here.
+5. **Read-only hint**: the tool declares that it only reads, run it.
+6. **Mode**: `full` runs it, `edits` and `judge` run an edit.
+7. **Allow list**: the tool is in `allow`, run it.
+8. **Read-only bash**: the command only reads, and its paths can be read, run it.
+9. **Judge**, in the `judge` mode: a confident yes runs it, a confident no blocks it.
+10. **No UI**: `noUI` decides.
+11. **Edit check**: an `edit` that cannot apply is blocked with pi's own error, so you never approve a failure.
+12. **You**, in the dialog.
 
 The judge answers three questions: a verdict, how reversible the call is, and whether it touches secrets. Code combines them into `risk = 0.6 × reversibility + 0.4 × sensitive` and approves only when the verdict is `allow`, confidence clears `thresholds.allow`, and risk is at most `riskCeiling`. The judge treats the tool call as data, so a command cannot talk its way past the policy or `alwaysAsk`.
 
 ### Limits
 
 - Always yes matches text. `cd /repo && pnpm test` offers `cd`, `cd /repo`, and the whole line, not `pnpm test`.
-- A bash path the check cannot read counts as outside. `$HOME`, `$SECRET`, and `"$@"` ask for that reason.
+- A bash path hidden behind `$HOME`, `$SECRET`, or `"$@"` counts as outside in `manual` and `edits`. In `judge` the judge decides it, even when the command only reads. In `full` it runs. Redirects to `/dev/null` and the other device files stay inside.
 - The read-only check is a classifier, not a sandbox. It trusts the command name as written and does not resolve `PATH`. It refuses anything it cannot prove harmless, so a few safe commands still ask.
-- The judge is a model, and it can be wrong. It sees the tool call, so do not judge calls that carry secrets you would not send to its provider.
+- The judge is a model, and it can be wrong. It sees the tool call and your last message, so do not judge calls or messages that carry secrets you would not send to its provider.
+- Pi's `codemode` tool runs a script that calls other tools. The script itself does not ask, and every call it makes goes through the same steps on its own, saying so in the dialog. The judge reads the arguments of an MCP call as data, like any other call.
 - If you want deterministic rules and no human in the loop, use a sandbox instead.
 
 ### For other extensions
@@ -247,7 +362,7 @@ pi.events.on("pi-ask-permission:decided", (decided) => {
 
 `by` names the step above that decided, `you` for the dialog, or `no UI`. Dialog answers are also saved in the session as `pi-ask-permission:answer` entries.
 
-A custom tool can say what it touches, so the workspace and `accept edits` treat it like `edit`. Emit from `session_start`, after every extension has loaded:
+A custom tool can say what it touches, so the workspace and the `edits` mode treat it like `edit`. Emit from `session_start`, after every extension has loaded:
 
 ```ts
 pi.on("session_start", () => {
@@ -271,4 +386,4 @@ See [CONTRIBUTING.md](CONTRIBUTING.md). Commits follow [Conventional Commits](ht
 
 ## License
 
-[MIT](LICENSE) © Felipe Adeildo
+[MIT](LICENSE) © adeildo

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@adeildo/pi-ask-permission",
-	"version": "4.0.0",
+	"version": "5.0.0",
 	"description": "A permission dialog for the Pi coding agent. Approve, always approve, or deny a tool call, and attach a note the model reads with the result.",
 	"keywords": [
 		"approval",
@@ -15,7 +15,7 @@
 	"bugs": "https://github.com/felipeadeildo/pi-harness/issues",
 	"license": "MIT",
 	"author": {
-		"name": "Felipe Adeildo",
+		"name": "adeildo",
 		"email": "contato@felipeadeildo.com",
 		"url": "https://github.com/felipeadeildo"
 	},
@@ -39,6 +39,9 @@
 		"#ui/*": "./src/ui/*",
 		"#util/*": "./src/util/*"
 	},
+	"exports": {
+		".": "./src/index.ts"
+	},
 	"publishConfig": {
 		"access": "public"
 	},
@@ -46,7 +49,7 @@
 		"prepublishOnly": "cd ../.. && bun run verify"
 	},
 	"dependencies": {
-		"@adeildo/pi-kit": "4.0.0",
+		"@adeildo/pi-kit": "5.0.0",
 		"shell-quote": "^1.10.0"
 	},
 	"peerDependencies": {

package/src/core/answer.ts

@@ -1,8 +1,16 @@
 import type { Scope } from "#core/always-yes.ts";
+import type { Access } from "#core/folders.ts";
+import type { FolderChoices } from "#core/workspace.ts";
+
+/** A call that left the workspace, with the folders the dialog can open for it. */
+export interface FolderOffer extends FolderChoices {
+	access: Access;
+}
 
 export interface DialogAnswer {
 	decision: "allow" | "deny";
 	note?: string;
 	remember?: string;
 	scope?: Scope;
+	open?: { path: string; access: Access; scope: Scope };
 }

package/src/core/config/decode.ts

@@ -22,6 +22,7 @@ import {
 	DEFAULT_TYPING,
 	DEFAULT_WORKSPACE,
 	defaultConfig,
+	isMcpPolicy,
 	type NoUIMode,
 	type PermissionConfig,
 	type TypingConfig,
@@ -29,7 +30,8 @@ import {
 } from "#core/config/schema.ts";
 import { defaultJudge } from "#core/judge/config.ts";
 import { judgeConfig } from "#core/judge/decode.ts";
-import { DEFAULT_MODE } from "#core/mode.ts";
+import { MCP_POLICIES, type McpPolicy } from "#core/mcp.ts";
+import { DEFAULT_MODE, parseMode, PERMISSION_MODES, type PermissionMode } from "#core/mode.ts";
 
 export type NoUIConfig = NoUIMode | Record<string, NoUIMode>;
 
@@ -48,6 +50,32 @@ export const noUI: Decoder<NoUIConfig> = {
 	},
 };
 
+export const mode: Decoder<PermissionMode> = {
+	decode(input, path) {
+		const value = typeof input === "string" ? parseMode(input) : undefined;
+		if (value !== undefined) return pass(value);
+		return fail(problem(path, `expected one of ${PERMISSION_MODES.join(", ")}`));
+	},
+};
+
+/** The policy per MCP server, keyed by server name. */
+export const mcpPolicies: Decoder<Record<string, McpPolicy>> = {
+	decode(input, path) {
+		if (!isObject(input)) return fail(problem(path, "expected a map of server to policy"));
+
+		const problems: Problem[] = [];
+		const value: Record<string, McpPolicy> = {};
+		for (const [server, entry] of Object.entries(input)) {
+			if (isMcpPolicy(entry)) value[server] = entry;
+			else
+				problems.push(
+					problem(fieldPath(path, server), `expected one of ${MCP_POLICIES.join(", ")}`),
+				);
+		}
+		return pass(value, problems);
+	},
+};
+
 const typing: Decoder<TypingConfig> = object({
 	pause: withDefault(duration, DEFAULT_TYPING.pause),
 	maxWait: withDefault(nullable(duration), DEFAULT_TYPING.maxWait),
@@ -62,7 +90,7 @@ const config: Decoder<PermissionConfig> = object({
 	allow: withDefaultOf(stringList("tool names"), () => [...DEFAULT_CONFIG.allow]),
 	noUI: withDefaultOf(noUI, () => DEFAULT_CONFIG.noUI),
 	notes: withDefault(literal("result", "message"), DEFAULT_CONFIG.notes),
-	mode: withDefault(literal("manual", "accept-edits", "auto"), DEFAULT_MODE),
+	mode: withDefault(mode, DEFAULT_MODE),
 	readOnlyBash: withDefault(boolean, DEFAULT_CONFIG.readOnlyBash),
 	workspace: withDefaultOf(workspace, () => ({
 		...DEFAULT_WORKSPACE,
@@ -70,6 +98,7 @@ const config: Decoder<PermissionConfig> = object({
 	})),
 	typing: withDefaultOf(typing, () => ({ ...DEFAULT_TYPING })),
 	judge: withDefaultOf(judgeConfig, defaultJudge),
+	mcp: withDefaultOf(object({ servers: withDefault(mcpPolicies, {}) }), () => ({ servers: {} })),
 });
 
 export function decodeConfig(input: unknown, warnings: string[] = []): PermissionConfig {
@@ -82,7 +111,6 @@ export function decodeConfig(input: unknown, warnings: string[] = []): Permissio
 const RENAMED: [section: "judge" | undefined, from: string, to: string][] = [
 	[undefined, "followup", "notes"],
 	[undefined, "headless", "noUI"],
-	["judge", "backend", "provider"],
 	["judge", "autoDeny", "canDeny"],
 	["judge", "onUncertain", "whenUnsure"],
 	["judge", "onError", "whenItFails"],
@@ -91,7 +119,6 @@ const RENAMED: [section: "judge" | undefined, from: string, to: string][] = [
 	["judge", "grant", "rememberApprovals"],
 ];
 
-// A rename keeps the value and says nothing. The migration writes the new names.
 function migrate(input: unknown, warnings: string[]): unknown {
 	if (!isObject(input)) return input;
 
@@ -107,8 +134,15 @@ function migrate(input: unknown, warnings: string[]): unknown {
 	}
 
 	if (next.mode === "yolo") {
-		next.mode = "auto";
-		warnings.push('mode "yolo" is now "auto", with workspace.outside "allow" for the same reach');
+		next.mode = "full";
+		warnings.push('mode "yolo" is now "full", with workspace.outside "allow" for the same reach');
+	}
+	// A judge switched on in 3.x becomes the judge mode.
+	if (isObject(next.judge) && "enabled" in next.judge) {
+		if (next.judge.enabled === true && (next.mode === undefined || next.mode === "manual")) {
+			next.mode = "judge";
+		}
+		delete next.judge.enabled;
 	}
 	if ("yolo" in next) {
 		delete next.yolo;

package/src/core/config/patterns.ts

@@ -21,12 +21,6 @@ export function isAllowed(config: PermissionConfig, toolName: string): boolean {
 	return config.allow.some((pattern) => matchesPattern(pattern, toolName));
 }
 
-export function isJudged(config: PermissionConfig, toolName: string): boolean {
-	return (
-		config.judge.enabled && config.judge.tools.some((pattern) => matchesPattern(pattern, toolName))
-	);
-}
-
 export function noUIMode(config: PermissionConfig, toolName: string): NoUIMode {
 	if (typeof config.noUI === "string") return config.noUI;
 

package/src/core/config/schema.ts

@@ -1,4 +1,5 @@
 import { DEFAULT_JUDGE, defaultJudge, type JudgeConfig } from "#core/judge/config.ts";
+import { MCP_POLICIES, type McpPolicy } from "#core/mcp.ts";
 import { DEFAULT_MODE, type PermissionMode } from "#core/mode.ts";
 
 export type NoUIMode = "allow" | "deny";
@@ -17,6 +18,11 @@ export interface TypingConfig {
 	maxWait: number | null;
 }
 
+export interface McpConfig {
+	/** The policy per server, by server name. A server not listed follows the default. */
+	servers: Record<string, McpPolicy>;
+}
+
 export interface PermissionConfig {
 	allow: string[];
 	noUI: NoUIMode | Record<string, NoUIMode>;
@@ -26,6 +32,7 @@ export interface PermissionConfig {
 	workspace: WorkspaceConfig;
 	typing: TypingConfig;
 	judge: JudgeConfig;
+	mcp: McpConfig;
 }
 
 export const DEFAULT_TYPING: TypingConfig = {
@@ -47,6 +54,7 @@ export const DEFAULT_CONFIG: PermissionConfig = {
 	workspace: DEFAULT_WORKSPACE,
 	typing: DEFAULT_TYPING,
 	judge: DEFAULT_JUDGE,
+	mcp: { servers: {} },
 };
 
 export function defaultConfig(): PermissionConfig {
@@ -56,9 +64,14 @@ export function defaultConfig(): PermissionConfig {
 		workspace: { ...DEFAULT_WORKSPACE, roots: [...DEFAULT_WORKSPACE.roots] },
 		typing: { ...DEFAULT_CONFIG.typing },
 		judge: defaultJudge(),
+		mcp: { servers: {} },
 	};
 }
 
+export function isMcpPolicy(value: unknown): value is McpPolicy {
+	return MCP_POLICIES.some((policy) => policy === value);
+}
+
 export function isNoUIMode(value: unknown): value is NoUIMode {
 	return value === "allow" || value === "deny";
 }