@czottmann/pi-automode 1.12.0 → 1.14.0

package/extensions/auto-mode/classifier.ts

@@ -155,6 +155,55 @@ export type ClassifierCompletionPlan = {
   reasoningLevel?: Exclude<EffectiveClassifierReasoningLevel, "off">;
 };
 
+async function completeClassifierAttempt(
+  completeFn: ClassifierCompletionFn,
+  model: Model<any>,
+  prompt: Parameters<ClassifierCompletionFn>[1],
+  parentSignal: AbortSignal | undefined,
+  options: Omit<Parameters<ClassifierCompletionFn>[2], "signal">,
+): Promise<AssistantMessage> {
+  if (options.timeoutMs === undefined) {
+    return completeFn(model, prompt, {
+      ...options,
+      ...(parentSignal === undefined ? {} : { signal: parentSignal }),
+    });
+  }
+
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parentSignal?.reason);
+  if (parentSignal?.aborted) onParentAbort();
+  else parentSignal?.addEventListener("abort", onParentAbort, { once: true });
+
+  let onAbort: (() => void) | undefined;
+  const aborted = new Promise<never>((_resolve, reject) => {
+    onAbort = () => {
+      const reason = controller.signal.reason;
+      reject(reason instanceof Error ? reason : new Error("Classifier request aborted."));
+    };
+    if (controller.signal.aborted) onAbort();
+    else controller.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  const timer = setTimeout(() => {
+    controller.abort(
+      new Error(`Classifier request timed out after ${options.timeoutMs} ms.`),
+    );
+  }, options.timeoutMs);
+
+  try {
+    return await Promise.race([
+      completeFn(model, prompt, {
+        ...options,
+        signal: controller.signal,
+      }),
+      aborted,
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) controller.signal.removeEventListener("abort", onAbort);
+    parentSignal?.removeEventListener("abort", onParentAbort);
+  }
+}
+
 /**
  * Run normalized Pi AI completion through the provider in Pi's runtime registry.
  * This temporary bridge is only valid until Pi exposes
@@ -435,14 +484,15 @@ export async function classifyWithRetry(
     const started = Date.now();
     let response: AssistantMessage;
     try {
-      response = await completeFn(
+      response = await completeClassifierAttempt(
+        completeFn,
         classifier.model,
         prompt,
+        signal,
         {
           apiKey: classifier.apiKey,
           headers: classifier.headers,
           env: classifier.env,
-          signal,
           maxTokens,
           ...(temperature === undefined ? {} : { temperature }),
           ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),
@@ -505,7 +555,8 @@ export async function classifyInStages(
   const fastStarted = Date.now();
   let fastResponse: AssistantMessage;
   try {
-    fastResponse = await completeFn(
+    fastResponse = await completeClassifierAttempt(
+      completeFn,
       classifier.model,
       {
         systemPrompt: prompt.systemPrompt,
@@ -515,11 +566,11 @@ export async function classifyInStages(
           stageMessage(CLASSIFIER_FAST_INSTRUCTION),
         ],
       },
+      signal,
       {
         apiKey: classifier.apiKey,
         headers: classifier.headers,
         env: classifier.env,
-        signal,
         // Reasoning and OpenAI-compatible models may consume hidden reasoning,
         // control, and EOS tokens before emitting the required visible digit.
         maxTokens: options.fastClassifierMaxTokens ??

package/extensions/auto-mode/config.ts

@@ -1,4 +1,12 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
 import { dirname, resolve } from "node:path";
 import {
   DEFAULT_ALLOW,
@@ -14,7 +22,9 @@ import {
   DEFAULT_MAX_USER_TRANSCRIPT_TOKENS,
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
+  MAX_CLASSIFIER_TIMEOUT_MS,
   PI_GLOBAL_SETTINGS,
+  PI_LEGACY_GLOBAL_SETTINGS,
   PI_PROJECT_LOCAL_SETTINGS,
   PI_PROJECT_SHARED_SETTINGS,
 } from "./constants.ts";
@@ -35,6 +45,169 @@ import type {
 } from "./types.ts";
 import { hasOwn, stringArray } from "./utils.ts";
 
+export type GlobalConfigPreparation = {
+  status: "current" | "migrated" | "conflict" | "failed";
+  activePath: string;
+  diagnostic?: string;
+  notification?: string;
+  writeBlockedReason?: string;
+};
+
+export type PrepareGlobalConfigOptions = {
+  currentPath?: string;
+  legacyPath?: string;
+  moveFile?: (source: string, destination: string) => void;
+  unlinkFile?: (path: string) => void;
+};
+
+function sameFileIdentity(firstPath: string, secondPath: string): boolean {
+  try {
+    const first = lstatSync(firstPath);
+    const second = lstatSync(secondPath);
+    return first.dev === second.dev && first.ino === second.ino;
+  } catch {
+    return false;
+  }
+}
+
+function cleanupPublishedDestination(
+  destination: string,
+  unlinkFile: (path: string) => void,
+  originalError: unknown,
+): AggregateError | undefined {
+  try {
+    unlinkFile(destination);
+    return undefined;
+  } catch (cleanupError) {
+    return new AggregateError(
+      [originalError, cleanupError],
+      `Could not clean up interrupted Auto Mode config migration at ${destination}`,
+    );
+  }
+}
+
+function moveFileWithoutOverwrite(
+  source: string,
+  destination: string,
+  unlinkFile: (path: string) => void,
+): void {
+  linkSync(source, destination);
+  try {
+    unlinkFile(source);
+  } catch (error) {
+    throw cleanupPublishedDestination(destination, unlinkFile, error) ?? error;
+  }
+}
+
+function globalConfigFailure(
+  currentPath: string,
+  legacyPath: string,
+  error: unknown,
+  writeBlockedReason?: string,
+): GlobalConfigPreparation {
+  const message =
+    `Could not move Auto Mode config from ${legacyPath} to ${currentPath}: ${
+      error instanceof Error ? error.message : String(error)
+    }. Using the legacy config for this session${
+      writeBlockedReason ? "; global config writes are disabled" : ""
+    }.`;
+  return {
+    status: "failed",
+    activePath: legacyPath,
+    diagnostic: message,
+    notification: message,
+    writeBlockedReason,
+  };
+}
+
+function globalConfigConflict(
+  currentPath: string,
+  legacyPath: string,
+): GlobalConfigPreparation {
+  const message =
+    `Auto Mode config conflict: using ${currentPath}; legacy config ${legacyPath} is ignored and was not changed.`;
+  return {
+    status: "conflict",
+    activePath: currentPath,
+    diagnostic: message,
+    notification: message,
+  };
+}
+
+/** Select one global config path for this runtime and migrate a legacy file when possible. */
+export function prepareGlobalConfig(
+  options: PrepareGlobalConfigOptions = {},
+): GlobalConfigPreparation {
+  const currentPath = options.currentPath ?? PI_GLOBAL_SETTINGS[0];
+  const legacyPath = options.legacyPath ?? PI_LEGACY_GLOBAL_SETTINGS;
+  const currentExists = existsSync(currentPath);
+  const legacyExists = existsSync(legacyPath);
+  const unlinkFile = options.unlinkFile ?? unlinkSync;
+
+  if (currentExists && legacyExists) {
+    if (!sameFileIdentity(currentPath, legacyPath)) {
+      return globalConfigConflict(currentPath, legacyPath);
+    }
+    try {
+      unlinkFile(legacyPath);
+      return {
+        status: "migrated",
+        activePath: currentPath,
+        notification:
+          `Completed interrupted Auto Mode config migration from ${legacyPath} to ${currentPath}.`,
+      };
+    } catch (error) {
+      const cleanupError = cleanupPublishedDestination(
+        currentPath,
+        unlinkFile,
+        error,
+      );
+      return globalConfigFailure(
+        currentPath,
+        legacyPath,
+        cleanupError ?? error,
+        cleanupError?.message,
+      );
+    }
+  }
+  if (currentExists || !legacyExists) {
+    return { status: "current", activePath: currentPath };
+  }
+
+  try {
+    mkdirSync(dirname(currentPath), { recursive: true });
+    const moveFile = options.moveFile ??
+      ((source: string, destination: string) =>
+        moveFileWithoutOverwrite(source, destination, unlinkFile));
+    moveFile(legacyPath, currentPath);
+    return {
+      status: "migrated",
+      activePath: currentPath,
+      notification: `Moved Auto Mode config from ${legacyPath} to ${currentPath}.`,
+    };
+  } catch (error) {
+    if (existsSync(currentPath)) {
+      if (!sameFileIdentity(currentPath, legacyPath)) {
+        return globalConfigConflict(currentPath, legacyPath);
+      }
+      const cleanupError = cleanupPublishedDestination(
+        currentPath,
+        unlinkFile,
+        error,
+      );
+      if (cleanupError) {
+        return globalConfigFailure(
+          currentPath,
+          legacyPath,
+          cleanupError,
+          cleanupError.message,
+        );
+      }
+    }
+    return globalConfigFailure(currentPath, legacyPath, error);
+  }
+}
+
 function readSettingsFile(path: string): LoadedSettingsFile | undefined {
   if (!existsSync(path)) return undefined;
   try {
@@ -152,10 +325,11 @@ export function validateSettingsFile(
       if (
         hasOwn(autoMode, "classifierTimeoutMs") &&
         (!Number.isInteger(autoMode.classifierTimeoutMs) ||
-          (autoMode.classifierTimeoutMs as number) < 1000)
+          (autoMode.classifierTimeoutMs as number) < 1000 ||
+          (autoMode.classifierTimeoutMs as number) > MAX_CLASSIFIER_TIMEOUT_MS)
       ) {
         diagnostics.push(
-          `${source}: autoMode.classifierTimeoutMs must be an integer of at least 1000`,
+          `${source}: autoMode.classifierTimeoutMs must be an integer from 1000 through ${MAX_CLASSIFIER_TIMEOUT_MS}`,
         );
       }
       if (
@@ -419,7 +593,9 @@ function validFastClassifierBudget(value: unknown): value is number {
 }
 
 function validClassifierTimeout(value: unknown): value is number {
-  return Number.isInteger(value) && Number(value) >= 1000;
+  return Number.isInteger(value) &&
+    Number(value) >= 1000 &&
+    Number(value) <= MAX_CLASSIFIER_TIMEOUT_MS;
 }
 
 function applyAutoModeScalars(
@@ -611,6 +787,7 @@ function ignoredSharedAllowDiagnostics(
 export function loadEffectiveConfigWithDiagnostics(
   cwd: string,
   projectTrusted = false,
+  globalSettingsPath = PI_GLOBAL_SETTINGS[0],
 ): ConfigLoadResult {
   const inlineSettings: SettingsFile[] = [];
   const diagnostics: string[] = [];
@@ -632,7 +809,7 @@ export function loadEffectiveConfigWithDiagnostics(
     }
   }
 
-  const globalFiles = PI_GLOBAL_SETTINGS.map(readSettingsFile);
+  const globalFiles = [readSettingsFile(globalSettingsPath)];
   const projectLocalPaths = PI_PROJECT_LOCAL_SETTINGS.map((file) =>
     resolve(cwd, file)
   );
@@ -682,8 +859,13 @@ export function loadEffectiveConfigWithDiagnostics(
 export function loadEffectiveConfig(
   cwd: string,
   projectTrusted = false,
+  globalSettingsPath = PI_GLOBAL_SETTINGS[0],
 ): EffectiveConfig {
-  return loadEffectiveConfigWithDiagnostics(cwd, projectTrusted).config;
+  return loadEffectiveConfigWithDiagnostics(
+    cwd,
+    projectTrusted,
+    globalSettingsPath,
+  ).config;
 }
 
 function readWritableSettingsFile(path: string): SettingsFile {

package/extensions/auto-mode/constants.ts

@@ -61,6 +61,8 @@ export const DENIAL_HISTORY_LIMIT = 12;
 
 /** Per-request timeout for classifier completions (fast and detailed stages). */
 export const DEFAULT_CLASSIFIER_TIMEOUT_MS = 20_000;
+/** Largest timeout that Node can represent without reducing it to 1 ms. */
+export const MAX_CLASSIFIER_TIMEOUT_MS = 2_147_483_647;
 
 /** Built-in trusted environment. Users extend this with `$defaults`. */
 export const DEFAULT_ENVIRONMENT = [
@@ -164,7 +166,10 @@ Valid decision/tier combinations:
 - block: hard_deny, soft_deny, or none
 If an allow exception or explicit user intent overrides a soft-deny rule, return allow with tier allow or explicit_intent, never soft_deny.`;
 
-export const PI_GLOBAL_SETTINGS = [resolve(HOME, ".pi/agent/automode.json")];
+export const PI_GLOBAL_SETTINGS = [
+  resolve(HOME, ".pi/agent/extensions/pi-automode/config.json"),
+];
+export const PI_LEGACY_GLOBAL_SETTINGS = resolve(HOME, ".pi/agent/automode.json");
 export const PI_PROJECT_LOCAL_SETTINGS = [".pi/automode.local.json"];
 export const PI_PROJECT_SHARED_SETTINGS = [".pi/automode.json"];
 

package/extensions/auto-mode/extension.ts

@@ -13,6 +13,7 @@ import {
   defaultClassifyAction,
   serializeClassifierAction,
 } from "./classifier.ts";
+import { analyzeBash, type BashAnalysis } from "./bash.ts";
 import {
   AUTO_MODE_GUIDANCE,
   DEFAULT_ALLOW,
@@ -21,10 +22,13 @@ import {
   DEFAULT_PROTECTED_PATHS,
   DEFAULT_SOFT_DENY,
   PATH_BEARING_TOOLS,
+  PI_GLOBAL_SETTINGS,
   READ_ONLY_TOOLS,
 } from "./constants.ts";
 import {
+  type GlobalConfigPreparation,
   loadEffectiveConfigWithDiagnostics,
+  prepareGlobalConfig,
   writeGlobalClassifierModel,
 } from "./config.ts";
 import { deterministicHardDeny } from "./hard-deny.ts";
@@ -37,8 +41,10 @@ import {
 import { formatModelSpec, parseModelSpec } from "./model.ts";
 import { promptForClassifierModel } from "./model-selector.ts";
 import {
+  matchesAllowedToolPatterns,
   matchesDeniedPath,
   matchesToolPattern,
+  matchingBashCommandText,
   recursiveSearchMayReachDeniedPath,
 } from "./permissions.ts";
 import {
@@ -67,12 +73,16 @@ import type {
   DenialRecord,
   EffectiveConfig,
 } from "./types.ts";
-import { safeJson } from "./utils.ts";
+import { safeJson, truncateMiddle } from "./utils.ts";
 
 const INSPECT_TOOL = "automode_inspect";
 const INSPECTION_ACTIONS = ["status", "config", "defaults", "denials"] as const;
 type InspectionAction = (typeof INSPECTION_ACTIONS)[number];
 
+function matchedCommandSummary(command: string | undefined): string | undefined {
+  return command ? truncateMiddle(command, 500) : undefined;
+}
+
 function canonicalPath(path: string): string {
   try {
     return realpathSync(path);
@@ -102,12 +112,16 @@ export type PiAutomodeOptions = {
   loadConfig?: (cwd: string, projectTrusted: boolean) => EffectiveConfig;
   /** Override classifier calls in tests so unit tests never need a real LLM/API key. */
   classifyAction?: ClassifyAction;
-  /** Override classifier-model persistence in tests. Runtime code writes ~/.pi/agent/automode.json. */
+  /** Override classifier-model persistence in tests. Runtime code writes the active global config. */
   saveClassifierModel?: (classifierModel: string) => void;
+  /** Override global config migration and path selection in tests. */
+  prepareGlobalConfig?: () => GlobalConfigPreparation;
   /** Override the application-owned observability log root in tests. */
   logRoot?: string;
   /** Override the observability log clock in tests. */
   now?: () => Date;
+  /** Override Bash analysis in tests. Runtime code uses unbash. */
+  analyzeBash?: typeof analyzeBash;
 };
 
 type LogCtx = {
@@ -157,18 +171,43 @@ function logClassifierIo(decision: ClassifyResult, log: LogCtx): void {
 
 /** Create a Pi extension instance. Default export uses production dependencies. */
 export function createPiAutomode(options: PiAutomodeOptions = {}) {
-  const loadConfigWithDiagnostics = options.loadConfig
-    ? (cwd: string, projectTrusted: boolean): ConfigLoadResult => ({
-      config: options.loadConfig!(cwd, projectTrusted),
-      diagnostics: [],
-    })
-    : loadEffectiveConfigWithDiagnostics;
   const classify = options.classifyAction ?? defaultClassifyAction;
-  const saveClassifierModel = options.saveClassifierModel ??
-    writeGlobalClassifierModel;
   const now = options.now ?? (() => new Date());
 
   return function piAutomode(pi: ExtensionAPI) {
+    const globalConfig = options.prepareGlobalConfig?.() ??
+      (options.loadConfig
+        ? { status: "current" as const, activePath: PI_GLOBAL_SETTINGS[0] }
+        : prepareGlobalConfig());
+    const loadConfigWithDiagnostics = (
+      cwd: string,
+      projectTrusted: boolean,
+    ): ConfigLoadResult => {
+      const result = options.loadConfig
+        ? {
+          config: options.loadConfig(cwd, projectTrusted),
+          diagnostics: [],
+        }
+        : loadEffectiveConfigWithDiagnostics(
+          cwd,
+          projectTrusted,
+          globalConfig.activePath,
+        );
+      return globalConfig.diagnostic
+        ? {
+          ...result,
+          diagnostics: [...result.diagnostics, globalConfig.diagnostic],
+        }
+        : result;
+    };
+    const persistClassifierModel = options.saveClassifierModel ??
+      ((classifierModel: string) =>
+        writeGlobalClassifierModel(classifierModel, globalConfig.activePath));
+    const saveClassifierModel = globalConfig.writeBlockedReason
+      ? (_classifierModel: string) => {
+        throw new Error(globalConfig.writeBlockedReason);
+      }
+      : persistClassifierModel;
     let loadResult = loadConfigWithDiagnostics(process.cwd(), false);
     let config: EffectiveConfig = loadResult.config;
     let configDiagnostics: string[] = loadResult.diagnostics;
@@ -180,6 +219,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       recentDenials: [],
     };
     let loadedContext = "";
+    let globalConfigNoticeShown = false;
 
     function effectiveConfig(): EffectiveConfig {
       return {
@@ -227,6 +267,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           `classifier denied: ${state.classifierDenied}`,
           `permissions.deny rules: ${cfg.permissionDeny.length}`,
           `permissions.ask rules: ${cfg.permissionAsk.length}`,
+          `permissions.allow rules: ${cfg.permissionAllow.length}`,
           `environment entries: ${cfg.environment.length}`,
           `allow entries: ${cfg.allow.length}`,
           `soft_deny entries: ${cfg.softDeny.length}`,
@@ -357,6 +398,17 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       config = loadResult.config;
       configDiagnostics = loadResult.diagnostics;
       state = restoreState(ctx);
+      if (
+        ctx.hasUI &&
+        globalConfig.notification &&
+        !globalConfigNoticeShown
+      ) {
+        ctx.ui.notify(
+          globalConfig.notification,
+          globalConfig.status === "migrated" ? "info" : "warning",
+        );
+        globalConfigNoticeShown = true;
+      }
       updateUi(ctx);
     });
 
@@ -385,6 +437,27 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       const isOwnedInspection = event.toolName === INSPECT_TOOL &&
         ownsInspectionTool();
       const input = event.input as Record<string, unknown>;
+      let bashAnalysis: BashAnalysis | undefined;
+      if (event.toolName === "bash") {
+        const source = typeof input.command === "string" ? input.command : "";
+        try {
+          bashAnalysis = (options.analyzeBash ?? analyzeBash)(source);
+        } catch (error) {
+          bashAnalysis = {
+            source,
+            commands: [],
+            redirects: [],
+            redirectTargets: [],
+            structure: [],
+            allowStructureSafe: false,
+            errors: [{
+              message: `Bash analysis failed: ${
+                error instanceof Error ? error.message : String(error)
+              }`,
+            }],
+          };
+        }
+      }
       const summary = actionSummary(event.toolName, input);
       if (!isOwnedInspection) state.checkedActions += 1;
       const logCtx: LogCtx = {
@@ -404,12 +477,26 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       };
 
       for (const pattern of cfg.permissionDeny) {
-        if (matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
+        if (
+          matchesToolPattern(
+            pattern,
+            event.toolName,
+            input,
+            ctx.cwd,
+            "match",
+            bashAnalysis,
+          )
+        ) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
           if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
-            reason: `Blocked by permissions.deny: ${pattern.raw}`,
+            reason: `Blocked by permissions.deny: ${pattern.raw}${
+              matchedCommand ? `; matched command: ${matchedCommand}` : ""
+            }`,
             action: summary,
             kind: "permissions.deny",
           }, logCtx);
@@ -418,16 +505,30 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
 
       let askRequiresClassifier = false;
       for (const pattern of cfg.permissionAsk) {
-        if (!matchesToolPattern(pattern, event.toolName, input, ctx.cwd)) {
+        if (
+          !matchesToolPattern(
+            pattern,
+            event.toolName,
+            input,
+            ctx.cwd,
+            "match",
+            bashAnalysis,
+          )
+        ) {
           continue;
         }
         if (!ctx.hasUI) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
           if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
             reason:
-              `Matched permissions.ask (${pattern.raw}) but no UI is available`,
+              `Matched permissions.ask (${pattern.raw})${
+                matchedCommand ? ` for command: ${matchedCommand}` : ""
+              } but no UI is available`,
             action: summary,
             kind: "permissions.ask",
           }, logCtx);
@@ -438,11 +539,16 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
           { signal: ctx.signal },
         );
         if (!allowed) {
+          const matchedCommand = matchedCommandSummary(
+            matchingBashCommandText(pattern, bashAnalysis),
+          );
           if (isOwnedInspection) state.checkedActions += 1;
           return block(ctx, {
             timestamp: Date.now(),
             toolName: event.toolName,
-            reason: `Declined permissions.ask: ${pattern.raw}`,
+            reason: `Declined permissions.ask: ${pattern.raw}${
+              matchedCommand ? `; matched command: ${matchedCommand}` : ""
+            }`,
             action: summary,
             kind: "permissions.ask",
           }, logCtx);
@@ -454,6 +560,7 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
         event.toolName,
         input,
         ctx.cwd,
+        bashAnalysis,
       );
       if (deterministicReason) {
         if (isOwnedInspection) state.checkedActions += 1;
@@ -564,20 +671,18 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
       // Deterministic allow tier. It runs after every deterministic denial.
       // Accepted ask rules skip this tier and always reach the classifier.
       if (!askRequiresClassifier) {
-        for (const pattern of cfg.permissionAllow) {
-          if (
-            !matchesToolPattern(
-              pattern,
-              event.toolName,
-              input,
-              ctx.cwd,
-              "no-match",
-            )
-          ) {
-            continue;
-          }
+        if (
+          matchesAllowedToolPatterns(
+            cfg.permissionAllow,
+            event.toolName,
+            input,
+            ctx.cwd,
+            bashAnalysis,
+          )
+        ) {
           // A protected-path write/edit is never covered by permissions.allow;
           // it stays on the classifier path (same rule as the inside-CWD tier).
+          let protectedWrite = false;
           if (event.toolName === "write" || event.toolName === "edit") {
             const inputPath = extractInputPath(event.toolName, input);
             const resolved = inputPath === undefined
@@ -588,17 +693,19 @@ export function createPiAutomode(options: PiAutomodeOptions = {}) {
               resolved !== undefined &&
               isProtectedPath(resolved, ctx.cwd, cfg.protectedPaths)
             ) {
-              break;
+              protectedWrite = true;
             }
           }
-          return allow(
-            ctx,
-            "permissions.allow",
-            `Allowed by permissions.allow: ${pattern.raw}`,
-            event.toolName,
-            summary,
-            logCtx,
-          );
+          if (!protectedWrite) {
+            return allow(
+              ctx,
+              "permissions.allow",
+              "Allowed by permissions.allow",
+              event.toolName,
+              summary,
+              logCtx,
+            );
+          }
         }
       }