@davisliu2006/pi-permission-system 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+## [0.4.0] — 2026-11-11
+
+### Added
+
+- Added experimental auto-classifier, `auto` permission, and `settings.auto_allow_criteria`.
+- Added `settings.ignore_global` to the local config to ignore global permission rules.
+
+## [0.3.0] — 2026-11-07
+
+### Added
+
+- Added `settings` to the config schema for non-permission settings.
+- Added `settings.ai_model` config field to optionally override the model for small helper completions.
+
+### Changed
+
+- `deny` rules can now check complex bash segments.
+
+## [0.2.0] — 2026-11-03
+
+### Added
+
+- Added bash splitting. A chained command like `cd dir && git status` now checks `cd dir` and `git status` separately. Bash wildcard can now generate multiple patterns at once (eg. `cd *; git status`).
+
+### Changed
+
+- Local permission config now loads from `.pi/pi-permissions.jsonc` instead of the project root, which is consistent with Pi local config conventions.
+- Made `ai-purpose` responses more concise by adding examples to the prompt.
+- Improved permission dialog UI by putting details in a custom TUI display instead of the selector title.
+
+## [0.1.0] — 2026-11-01
+
+Initial version.

package/README.md

@@ -4,6 +4,13 @@ Permissions management for the `pi` coding agent.
 
 Roughly based on [MasuRii/pi-permission-system](https://github.com/MasuRii/pi-permission-system).
 
+<img src="https://raw.githubusercontent.com/davisliu2006/pi-permission-system/main/images/image.webp">
+
+### Key Features
+
+- [Bash splitting](#bash-matching-safeguards). Splits chained commands (eg. `cd ~ && pwd`) into parts and matches rules for each segment.
+- AI-generated request purpose and bash rule wildcard.
+- Experimental auto-classifier. Supports configurable auto-allow critera.
 
 ## Permissions Overview
 
@@ -11,8 +18,9 @@ A permission can be one of the following:
 
 ```jsonc
 "allow"  // allows the action
-"ask"  // asks the user for permission
-"deny"  // automatically denies the action
+"auto"   // uses an AI classifier to choose between allow and ask
+"ask"    // asks the user for permission
+"deny"   // automatically denies the action
 ```
 
 Ask states the purpose of the request and gives the following options:
@@ -29,7 +37,7 @@ Reject
 
 ## Configuration
 
-The supported top-level keys are: `default`, `tools`, `bash`, and `external_directory`.
+The supported top-level keys are: `default`, `tools`, `bash`, `external_directory`, and `settings`.
 
 `bash` body matching supports wildcard:
 - `*` matches any sequence and `?` matches one character
@@ -39,6 +47,8 @@ The supported top-level keys are: `default`, `tools`, `bash`, and `external_dire
 
 The builtin path tools in pi are: `read`, `write`, `edit`, `find`, `grep`, `ls`. `external_directory` overrides the settings for these path tools. The primary use is to override `write` and `edit` to a stronger policy for external directories.
 
+`settings` holds optional non-permission settings.
+
 ### Rule Precedence
 
 More specific rules override less specific rules:
@@ -90,7 +100,8 @@ Example:
         "rg*": "allow"
     },
     "external_directory": {
-        "write": "ask"
+        "write": "ask",
+        "edit": "ask"
     }
 }
 ```
@@ -103,6 +114,24 @@ Located in the local Pi config folder:
 
 Local configuration overrides global configuration, including `deny` rules.
 
+Set `settings.ignore_global` to `true` in the local config to ignore global permission sections entirely.
+
+### Optional Settings
+
+```jsonc
+{
+    "settings": {
+        "ignore_global": true,
+        "ai_model": "provider/model-id",
+        "auto_allow_criteria": "read-only or easily reversible"
+    }
+}
+```
+
+- `ignore_global: boolean`: Skips global permission sections if placed in a local config. Has no effect if placed in a global config.
+- `ai_model: string`: Overrides the model used for helper completions.
+- `auto_allow_criteria: string`: Specify the auto-classifer criteria. Defaults to `"read-only or easily reversible"`.
+
 ## "Allow Always" Matching
 
 Matching is done as `(tool, body)`.
@@ -122,8 +151,8 @@ Body matching rules:
 
 Bash matching safeguards against unsafe shell syntax.
 
-Simple sequences separated only by `;`, `&&`, `||`, or newlines are split and each segment is matched against `bash` rules. The strictest result wins (`deny` > `ask` > `allow`).
+Sequences separated by `;`, `&&`, `||`, or newlines are split and each segment is matched against `bash` rules. The strictest result wins (`deny` > `ask` > `auto` > `allow`).
 
-If a command contains other chaining or control syntax (`|`, `&`, command substitution, process substitution, or parentheses), `bash` pattern rules are skipped and the `tools.bash` policy is used instead, falling back to `default`.
+If a command contains other chaining (`|`, `&`, command/process substitution, or parentheses), `bash` pattern rules for `allow` are skipped, allowing other segments to take priority and successively falling back to `tools.bash` and `default`.
 
-"Allow always" for complex or multi-command sequences saves the exact command, not a wildcard.
+"Allow always" for complex sequences saves the exact command, not a wildcard.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davisliu2006/pi-permission-system",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "main": "./index.ts",
@@ -10,7 +10,9 @@
   "files": [
     "index.ts",
     "src",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
@@ -21,7 +23,8 @@
     "pi-package",
     "pi",
     "pi-extension",
-    "permissions"
+    "permissions",
+    "pi-permissions"
   ],
   "author": "davisliu2006",
   "license": "MIT",
@@ -32,7 +35,8 @@
   "pi": {
     "extensions": [
       "./index.ts"
-    ]
+    ],
+    "image": "https://raw.githubusercontent.com/davisliu2006/pi-permission-system/main/images/image.webp"
   },
   "engines": {
     "node": ">=20"

package/src/ai-classifier.ts

@@ -0,0 +1,53 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { completeText } from "./ai-gen.ts";
+import { ALLOW, ASK, DEFAULT_AUTO_ALLOW_CRITERIA } from "./constants.ts";
+import {
+  buildClassifierInstructions,
+  buildClassifierPromptContext,
+  CLASSIFIER_SYSTEM_PROMPT,
+} from "./prompts.ts";
+import type { PermissionRequest } from "./types.ts";
+
+const CLASSIFIER_TIMEOUT_MS = 5000;
+const MAX_CLASSIFIER_TOKENS = 16;
+
+export type AutoDecision = typeof ALLOW | typeof ASK;
+
+/**
+ * Parses a classifier reply.
+ * Sanitizes against escape sequences, newlines, and punctuation.
+ */
+export function parseAutoDecision(text: string | undefined): AutoDecision {
+  if (!text) {return ASK;}
+  const line = text
+    .replace(/\u001b\[[0-9;]*m/g, "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .toLowerCase()
+    .replace(/^["'`]+|["'`.,!:;]+$/g, "");
+  return line === ALLOW ? ALLOW : ASK;
+}
+
+/**
+ * Classifies whether an "auto" request should auto-allow or ask the user.
+ * Leans towards "ask" in case of uncertainty.
+ */
+export async function classifyAutoPermission(
+  ctx: ExtensionContext,
+  request: PermissionRequest,
+  aiModel?: string,
+  allowCriteria?: string
+): Promise<AutoDecision> {
+  const criteria = allowCriteria?.trim() || DEFAULT_AUTO_ALLOW_CRITERIA;
+  const text = await completeText(ctx, {
+    systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+    userText: buildClassifierInstructions(
+      buildClassifierPromptContext(request),
+      criteria
+    ),
+    maxTokens: MAX_CLASSIFIER_TOKENS,
+    timeoutMs: CLASSIFIER_TIMEOUT_MS,
+    aiModel,
+  });
+  return parseAutoDecision(text);
+}

package/src/ai-gen.ts

@@ -1,5 +1,6 @@
-import { complete, type Message } from "@earendil-works/pi-ai";
+import { complete, type Api, type Message, type Model } from "@earendil-works/pi-ai";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { parseAiModelRef } from "./types.ts";
 
 export interface CompleteTextOptions {
   systemPrompt: string;
@@ -8,6 +9,8 @@ export interface CompleteTextOptions {
   timeoutMs: number;
   /** How to join multiple text blocks. Defaults to a single space. */
   joinWith?: string;
+  /** Optional `provider/model-id` override. Falls back to the session model. */
+  aiModel?: string;
 }
 
 /**
@@ -23,17 +26,37 @@ function timeoutSignal(signal: AbortSignal | undefined, timeoutMs: number): Abor
 }
 
 /**
- * Runs a single-turn text completion against the extension model.
+ * Resolves the model for helper completions.
+ */
+export function resolveCompletionModel(
+  ctx: ExtensionContext,
+  aiModel?: string
+): Model<Api> | undefined {
+  if (aiModel) {
+    const parsed = parseAiModelRef(aiModel);
+    if (parsed) {
+      const configured = ctx.modelRegistry.find(parsed.provider, parsed.modelId);
+      if (configured && ctx.modelRegistry.hasConfiguredAuth(configured)) {
+        return configured;
+      }
+    }
+  }
+  return ctx.model;
+}
+
+/**
+ * Runs a single-turn text completion against the extension helper model.
  * Returns undefined when the model/auth is unavailable, the call aborts, or no text is returned.
  */
 export async function completeText(
   ctx: ExtensionContext,
   options: CompleteTextOptions
 ): Promise<string | undefined> {
-  if (!ctx.model) {return undefined;}
+  const model = resolveCompletionModel(ctx, options.aiModel);
+  if (!model) {return undefined;}
 
   try {
-    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(ctx.model);
+    const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
     if (!auth.ok || !auth.apiKey) {return undefined;}
 
     // prompt
@@ -50,7 +73,7 @@ export async function completeText(
 
     // call model
     const response = await complete(
-      ctx.model,
+      model,
       {
         systemPrompt: options.systemPrompt,
         messages: [message],

package/src/ai-purpose.ts

@@ -41,7 +41,8 @@ function sanitizePurpose(value: string): string | undefined {
 export async function generateRequestPurpose(
   ctx: ExtensionContext,
   request: PermissionRequest,
-  context: string
+  context: string,
+  aiModel?: string
 ): Promise<string | undefined> {
   const key = cacheKey(request);
   const cached = purposeCache.get(key);
@@ -52,6 +53,7 @@ export async function generateRequestPurpose(
     userText: buildPurposeInstructions(context),
     maxTokens: MAX_PURPOSE_TOKENS,
     timeoutMs: PURPOSE_TIMEOUT_MS,
+    aiModel,
   });
   if (!text) {return undefined;}
 

package/src/ai-wildcard.ts

@@ -39,7 +39,8 @@ function sanitizeWildcard(value: string): string | undefined {
  */
 export async function generateBashWildcard(
   ctx: ExtensionContext,
-  command: string
+  command: string,
+  aiModel?: string
 ): Promise<string | undefined> {
   const text = await completeText(ctx, {
     systemPrompt: WILDCARD_SYSTEM_PROMPT,
@@ -47,6 +48,7 @@ export async function generateBashWildcard(
     maxTokens: MAX_WILDCARD_TOKENS,
     timeoutMs: WILDCARD_TIMEOUT_MS,
     joinWith: "\n",
+    aiModel,
   });
   if (!text) {return undefined;}
 
@@ -65,7 +67,8 @@ export async function generateBashWildcard(
  */
 export async function generateBashWildcards(
   ctx: ExtensionContext,
-  commands: readonly string[]
+  commands: readonly string[],
+  aiModel?: string
 ): Promise<string[] | undefined> {
   if (commands.length === 0) {return undefined;}
 
@@ -75,6 +78,7 @@ export async function generateBashWildcards(
     maxTokens: MAX_WILDCARD_LIST_TOKENS,
     timeoutMs: WILDCARD_TIMEOUT_MS,
     joinWith: "\n",
+    aiModel,
   });
   if (!text) {return undefined;}
 

package/src/config.ts

@@ -3,11 +3,13 @@ import { ASK } from "./constants.ts";
 import { parseJsonc } from "./jsonc.ts";
 import {
   createDefaultPermissionConfig,
+  parseAiModelRef,
   toPermissionState,
   toRecord,
   type ConfigWarning,
   type PermissionConfig,
   type PermissionSection,
+  type PermissionSettings,
   type PermissionState,
 } from "./types.ts";
 import {
@@ -16,7 +18,12 @@ import {
   formatConfigReadFailure,
   formatIgnoredSectionEntryWarning,
   formatIgnoredSectionWarning,
+  IGNORED_AI_MODEL_WARNING,
+  IGNORED_AUTO_ALLOW_CRITERIA_WARNING,
   IGNORED_DEFAULT_WARNING,
+  IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING,
+  IGNORED_IGNORE_GLOBAL_WARNING,
+  IGNORED_SETTINGS_WARNING,
 } from "./warning-strings.ts";
 
 const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"]);
@@ -57,14 +64,77 @@ function normalizeSection(
   return result;
 }
 
+/**
+ * Helper used by normalizeConfig.
+ * Ensures settings is a valid PermissionSettings object.
+ */
+function normalizeSettings(
+  raw: unknown,
+  configPath: string | undefined,
+  warnings: ConfigWarning[],
+  isLocal: boolean
+): PermissionSettings {
+  if (raw === undefined) {return {};}
+  const record = toRecord(raw);
+  if (!record) {
+    warnings.push({
+      path: configPath,
+      message: IGNORED_SETTINGS_WARNING,
+    });
+    return {};
+  }
+
+  const settings: PermissionSettings = {};
+  if (record.ignore_global !== undefined) {
+    if (!isLocal) {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING,
+      });
+    } else if (typeof record.ignore_global === "boolean") {
+      settings.ignore_global = record.ignore_global;
+    } else {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_IGNORE_GLOBAL_WARNING,
+      });
+    }
+  }
+  if (record.ai_model !== undefined) {
+    if (typeof record.ai_model === "string" && parseAiModelRef(record.ai_model)) {
+      settings.ai_model = record.ai_model.trim();
+    } else {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_AI_MODEL_WARNING,
+      });
+    }
+  }
+  if (record.auto_allow_criteria !== undefined) {
+    if (
+      typeof record.auto_allow_criteria === "string"
+      && record.auto_allow_criteria.trim()
+    ) {
+      settings.auto_allow_criteria = record.auto_allow_criteria.trim();
+    } else {
+      warnings.push({
+        path: configPath,
+        message: IGNORED_AUTO_ALLOW_CRITERIA_WARNING,
+      });
+    }
+  }
+  return settings;
+}
+
 /**
  * Convert the raw config to a PermissionConfig.
  * Ensures the config is valid.
  */
-function normalizeConfig(
+export function normalizeConfig(
   rawConfig: unknown,
   configPath: string | undefined,
-  warnings: ConfigWarning[]
+  warnings: ConfigWarning[],
+  isLocal: boolean
 ): PermissionConfig {
   const config = toRecord(rawConfig);
   if (!config) {
@@ -94,6 +164,7 @@ function normalizeConfig(
       configPath,
       warnings
     ),
+    settings: normalizeSettings(config.settings, configPath, warnings, isLocal),
   };
 }
 
@@ -102,7 +173,8 @@ function normalizeConfig(
  */
 async function loadConfigFile(
   path: string,
-  warnings: ConfigWarning[]
+  warnings: ConfigWarning[],
+  isLocal: boolean
 ): Promise<PermissionConfig | undefined> {
   let raw: string;
   try {
@@ -118,7 +190,7 @@ async function loadConfigFile(
   }
 
   try {
-    return normalizeConfig(parseJsonc(raw), path, warnings);
+    return normalizeConfig(parseJsonc(raw), path, warnings, isLocal);
   } catch (error) {
     warnings.push({
       path,
@@ -148,6 +220,8 @@ function mergeBashSections(
 
 /**
  * Merges configs such that local config overrides global config.
+ * If local `settings.ignore_global` is true, global permission
+ * sections are ignored.
  */
 export function mergeConfigs(
   globalConfig: PermissionConfig | undefined,
@@ -158,6 +232,20 @@ export function mergeConfigs(
   }
 
   globalConfig = globalConfig ?? createDefaultPermissionConfig();
+  const mergedSettings: PermissionSettings = {
+    ...globalConfig.settings,
+    ...(localConfig?.settings ?? {}),
+  };
+
+  if (localConfig?.settings.ignore_global === true) {
+    return {
+      default: localConfig.default,
+      tools: { ...localConfig.tools },
+      bash: { ...localConfig.bash },
+      external_directory: { ...localConfig.external_directory },
+      settings: mergedSettings,
+    };
+  }
 
   return {
     default: localConfig?.default ?? globalConfig.default,
@@ -167,6 +255,7 @@ export function mergeConfigs(
       ...globalConfig.external_directory,
       ...(localConfig?.external_directory ?? {}),
     },
+    settings: mergedSettings,
   };
 }
 
@@ -178,8 +267,8 @@ export async function loadMergedConfig(
   localPath: string
 ): Promise<{ config: PermissionConfig; warnings: ConfigWarning[] }> {
   const warnings: ConfigWarning[] = [];
-  const globalConfig = await loadConfigFile(globalPath, warnings);
-  const localConfig = await loadConfigFile(localPath, warnings);
+  const globalConfig = await loadConfigFile(globalPath, warnings, false);
+  const localConfig = await loadConfigFile(localPath, warnings, true);
   return {
     config: mergeConfigs(globalConfig, localConfig),
     warnings,

package/src/constants.ts

@@ -7,10 +7,14 @@ export const CONFIG_FILENAME = "pi-permissions.jsonc";
 export const LOCAL_CONFIG_DIR_SEGMENTS = [".pi"] as const;
 
 export const ALLOW = "allow";
+export const AUTO = "auto";
 export const ASK = "ask";
 export const DENY = "deny";
-export const PERMISSION_STATES = [ALLOW, ASK, DENY] as const;
-export const PERMISSION_STATES_DESCRIPTION = "allow, ask, or deny";
+export const PERMISSION_STATES = [ALLOW, AUTO, ASK, DENY] as const;
+export const PERMISSION_STATES_DESCRIPTION = "allow, auto, ask, or deny";
+
+/** Default criteria used by "auto" classifier. */
+export const DEFAULT_AUTO_ALLOW_CRITERIA = "read-only or easily reversible";
 
 export const ALLOW_ONCE = "Allow Once";
 export const ALLOW_ALWAYS_EXACT = "Allow Always (exact match)";

package/src/extension.ts

@@ -1,10 +1,12 @@
 import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { join } from "node:path";
 
+import { classifyAutoPermission } from "./ai-classifier.ts";
 import { clearPurposeCache, generateRequestPurpose } from "./ai-purpose.ts";
 import { clearWildcardCache } from "./matcher.ts";
 import {
   ALLOW,
+  AUTO,
   CONFIG_FILENAME,
   DENY,
   LOCAL_CONFIG_DIR_SEGMENTS,
@@ -23,7 +25,7 @@ import {
 import { buildRequest } from "./request-builder.ts";
 import { SessionApprovalStore } from "./session-approvals.ts";
 import {
-  buildSelectorSummary,
+  STATUS_CLASSIFYING_REQUEST,
   STATUS_SUMMARIZING_REQUEST,
 } from "./ui-strings.ts";
 import {
@@ -118,29 +120,49 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
     if (policy.state === ALLOW) { // auto allow
       return undefined;
     }
-    if (!ctx.hasUI) { // no ui, auto deny
-      return { block: true, reason: formatNoUiReason(request, policy) };
-    }
 
     // check session approval
     const approval = findSessionApproval(state.approvals.getRules(), request);
     if (approval) {return undefined;} // approved, proceed
 
-    const summary = buildSelectorSummary(request);
+    if (policy.state === AUTO) { // use ai classifier
+      if (ctx.hasUI) {
+        ctx.ui.setStatus(STATUS_KEY, STATUS_CLASSIFYING_REQUEST);
+      }
+      try {
+        const decision = await classifyAutoPermission(
+          ctx,
+          request,
+          config.settings.ai_model,
+          config.settings.auto_allow_criteria
+        );
+        if (decision === ALLOW) {return undefined;}
+      } finally {
+        if (ctx.hasUI) {
+          ctx.ui.setStatus(STATUS_KEY, undefined);
+        }
+      }
+    }
+
+    if (!ctx.hasUI) { // no ui, deny (same path as ask)
+      return { block: true, reason: formatNoUiReason(request, policy) };
+    }
+
     ctx.ui.setStatus(STATUS_KEY, STATUS_SUMMARIZING_REQUEST);
     let purpose: string | undefined;
     try {
       purpose = await generateRequestPurpose(
         ctx,
         request,
-        buildPurposePromptContext(request)
+        buildPurposePromptContext(request),
+        config.settings.ai_model
       );
     } finally {
       ctx.ui.setStatus(STATUS_KEY, undefined);
     }
 
     while (true) {
-      const choice = await promptForPermission(ctx, request, policy, summary, purpose);
+      const choice = await promptForPermission(ctx, request, policy, purpose);
       if (choice.kind === "once") { // approved, proceed
         return;
       }
@@ -149,7 +171,12 @@ export function registerPermissionSystem(pi: ExtensionAPI): void {
       }
 
       // "allow always"
-      const rules = await chooseAlwaysRules(ctx, request, policy);
+      const rules = await chooseAlwaysRules(
+        ctx,
+        request,
+        policy,
+        config.settings.ai_model
+      );
       if (!rules) {
         // the user cancelled the wildcard editor, return to the permission dialog
         continue;

package/src/permission-dialog.ts

@@ -1,4 +1,4 @@
-import type { ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { ExtensionSelectorComponent } from "@earendil-works/pi-coding-agent";
 import { Container, Text } from "@earendil-works/pi-tui";
 import {
@@ -13,10 +13,11 @@ import type {
   PolicyResolution,
 } from "./types.ts";
 import {
+  buildPlainSelectorSummary,
+  buildStyledSelectorSummary,
   formatAllowAlwaysOption,
   PERMISSION_DIALOG_QUESTION,
   PERMISSION_DIALOG_TITLE,
-  PURPOSE_PREFIX,
 } from "./ui-strings.ts";
 
 function mapChoice(choice: string | undefined | null): PermissionDialogSelection {
@@ -27,14 +28,6 @@ function mapChoice(choice: string | undefined | null): PermissionDialogSelection
   return { kind: "reject" };
 }
 
-/** Bold + color the `Label:` prefix; warning color for note lines. */
-function styleSummaryLine(theme: Theme, line: string): string {
-  const sep = line.indexOf(": ");
-  if (sep === -1) {return theme.fg("text", line);}
-  return theme.fg("accent", theme.bold(line.slice(0, sep + 1)))
-    + theme.fg("text", line.slice(sep + 1));
-}
-
 /**
  * Shows permission dialog and gets input.
  */
@@ -42,7 +35,6 @@ export async function promptForPermission(
   ctx: ExtensionContext,
   request: PermissionRequest,
   policy: PolicyResolution,
-  summary: string,
   purpose?: string
 ): Promise<PermissionDialogSelection> {
   const options = [ALLOW_ONCE, formatAllowAlwaysOption(request, policy), REJECT];
@@ -50,8 +42,8 @@ export async function promptForPermission(
   try {
     // non-tui mode fallback
     if (ctx.mode !== "tui") {
-      const purposeLine = purpose ? `\n${PURPOSE_PREFIX}${purpose}` : "";
-      const title = `${PERMISSION_DIALOG_TITLE}\n${summary}${purposeLine}\n${PERMISSION_DIALOG_QUESTION}`;
+      const summary = buildPlainSelectorSummary(request, purpose);
+      const title = `${PERMISSION_DIALOG_TITLE}\n${summary}\n${PERMISSION_DIALOG_QUESTION}`;
       return mapChoice(await ctx.ui.select(title, options));
     }
 
@@ -59,11 +51,8 @@ export async function promptForPermission(
     const choice = await ctx.ui.custom<string | null>((tui, theme, _kb, done) => {
       const container = new Container();
       container.addChild(new Text(theme.fg("accent", theme.bold(PERMISSION_DIALOG_TITLE)), 1, 0));
-      for (const line of summary.split("\n")) {
-        container.addChild(new Text(styleSummaryLine(theme, line), 1, 0));
-      }
-      if (purpose) {
-        container.addChild(new Text(styleSummaryLine(theme, `${PURPOSE_PREFIX}${purpose}`), 1, 0));
+      for (const line of buildStyledSelectorSummary(theme, request, purpose)) {
+        container.addChild(new Text(line, 1, 0));
       }
 
       const selector = new ExtensionSelectorComponent(

package/src/policy-bash.ts

@@ -11,10 +11,15 @@ import type {
 
 const STATE_RANK: Record<PermissionState, number> = {
   allow: 0,
-  ask: 1,
-  deny: 2,
+  auto: 1,
+  ask: 2,
+  deny: 3,
 };
 
+function appliesWhenComplex(state: PermissionState): boolean {
+  return state === "deny" || state === "ask" || state === "auto";
+}
+
 /**
  * Prefers the analysis stored on the request.
  * Falls back for hand-built fixtures.
@@ -41,30 +46,37 @@ function bashFallbackResolution(config: PermissionConfig): PolicyResolution {
 }
 
 /**
- * Resolves one simple bash segment against bash rules, then tools.bash / default.
+ * Resolves one bash segment against bash rules.
+ * Returns undefined if a complex segment fails to match a rule.
  */
 function resolveBashSegment(
   config: PermissionConfig,
-  segment: string
-): PolicyResolution {
+  segment: string,
+  isComplex: boolean
+): PolicyResolution | undefined {
   const match = findLastWildcardMatch(config.bash, segment);
-  if (match) {
-    return {
-      state: match.state,
-      source: "bash",
-      matchedPattern: match.pattern,
-    };
+  if (!match) {
+    return isComplex ? undefined : bashFallbackResolution(config);
+  }
+  if (isComplex && !appliesWhenComplex(match.state)) {
+    return undefined;
   }
-  return bashFallbackResolution(config);
+  return {
+    state: match.state,
+    source: "bash",
+    matchedPattern: match.pattern,
+  };
 }
 
 /**
- * Worst state wins across simple list segments.
+ * Worst state wins across segment resolutions.
  * When ranks tie, keep the later segment's resolution.
+ * Returns undefined when there are no votes.
  */
 function combineBashSegmentResolutions(
-  resolutions: PolicyResolution[]
-): PolicyResolution {
+  resolutions: readonly PolicyResolution[]
+): PolicyResolution | undefined {
+  if (resolutions.length === 0) {return undefined;}
   let worst = resolutions[0]!;
   for (let index = 1; index < resolutions.length; index++) {
     const next = resolutions[index]!;
@@ -76,20 +88,19 @@ function combineBashSegmentResolutions(
 }
 
 /**
- * Resolves bash policy, including simple list splitting.
+ * Resolves bash policy, including command splitting.
  */
 export function resolveBashPolicy(
   config: PermissionConfig,
   request: PermissionRequest
 ): PolicyResolution {
   const analysis = bashAnalysisOf(request);
-  if (analysis.isComplex) {
-    return bashFallbackResolution(config);
+  const votes: PolicyResolution[] = [];
+  for (const segment of analysis.segments) {
+    const resolution = resolveBashSegment(config, segment, analysis.isComplex);
+    if (resolution) {votes.push(resolution);}
   }
-  const resolutions = analysis.segments.map((segment) =>
-    resolveBashSegment(config, segment)
-  );
-  return combineBashSegmentResolutions(resolutions);
+  return combineBashSegmentResolutions(votes) ?? bashFallbackResolution(config);
 }
 
 /**

package/src/prompts.ts

@@ -1,7 +1,6 @@
 import { describePolicy } from "./policy.ts";
 import type { PermissionRequest, PolicyResolution } from "./types.ts";
 
-const CHAINED_BASH_NOTE = "Shell chaining detected: bash pattern rules were skipped.";
 const EXTERNAL_DIRECTORY_NOTE = "Outside the working directory.";
 
 function preview(value: string, limit: number): string {
@@ -27,6 +26,32 @@ export function describeBlockedSubject(
     : `tool ${JSON.stringify(request.toolName)}`;
 }
 
+/**
+ * Builds context for the "auto" permission classifier.
+ */
+export function buildClassifierPromptContext(request: PermissionRequest): string {
+  const lines = [
+    `Tool: ${request.toolName}`,
+    `Working directory: ${request.cwd}`,
+  ];
+
+  if (request.bodyKind === "command") {
+    lines.push(`Command:\n${preview(request.body, 600)}`);
+  } else if (request.bodyKind === "path") {
+    lines.push(`Path: ${preview(request.body, 400)}`);
+  } else {
+    lines.push(`Input: ${preview(request.body, 600)}`);
+  }
+
+  if (request.isExternalDirectory !== undefined) {
+    lines.push(
+      `Outside working directory: ${request.isExternalDirectory ? "yes" : "no"}`
+    );
+  }
+
+  return lines.join("\n");
+}
+
 /**
  * Builds context for the ai-generated purpose.
  */
@@ -49,6 +74,23 @@ export function buildPurposePromptContext(request: PermissionRequest): string {
   return lines.join("\n");
 }
 
+export const CLASSIFIER_SYSTEM_PROMPT = [
+  "You decide whether a coding-agent tool request can be auto-allowed.",
+  "Reply with exactly one word, with no punctuation: \"allow\" or \"ask\".",
+  "If uncertain, reply \"ask\".",
+].join(" ");
+
+export function buildClassifierInstructions(
+  context: string,
+  allowCriteria: string
+): string {
+  return [
+    `A request can be \"allow\" if it meets this criteria: ${allowCriteria}.`,
+    "",
+    `Classify the following request:\n${context}`,
+  ].join("\n");
+}
+
 export const PURPOSE_SYSTEM_PROMPT = [
   "You summarize the purpose of coding-agent tool requests for a permission prompt.",
   "Be as concise and neutral as possible.",
@@ -102,9 +144,6 @@ export function buildWildcardInstructions(command: string): string {
   ].join("\n");
 }
 
-/**
- * Builds instructions for generating one wildcard per command in a simple list.
- */
 export function buildWildcardListInstructions(commands: readonly string[]): string {
   return [
     "Create a permission wildcard for each command below.",
@@ -123,9 +162,7 @@ export function buildWildcardListInstructions(commands: readonly string[]): stri
  */
 export function formatDenyReason(request: PermissionRequest, policy: PolicyResolution): string {
   const subject = describeBlockedSubject(request, true);
-  const chainedNote = request.bashAnalysis?.isComplex ? ` ${CHAINED_BASH_NOTE}` : "";
-
-  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}.${chainedNote} Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
+  return `Permission denied for ${subject}. Policy: ${describePolicy(policy)}. Hard stop: do not retry or investigate a bypass. Report the denial to the user.`;
 }
 
 /**

package/src/shell.ts

@@ -2,7 +2,11 @@
  * Result of a conservative shell scan.
  *
  * When `isComplex` is false, `segments` are commands separated only by `;`,
- * `&&`, `||`, or newlines (or a single command). When true, `segments` is empty.
+ * `&&`, `||`, or newlines (or a single command).
+ *
+ * When `isComplex` is true because of `|` / `|&`, `segments` are still filled
+ * so deny rules can be checked per stage. Other complex syntax returns empty
+ * `segments`.
  */
 export type ShellCommandAnalysis = {
   isComplex: boolean;
@@ -17,6 +21,7 @@ const COMPLEX: ShellCommandAnalysis = { isComplex: true, segments: [] };
  *
  * Splits on:
  * - `;`, `&&`, `||`, and newlines outside quotes
+ * - '|' and '|&' outside quotes (also treated as complex)
  *
  * Treats as complex:
  * - Substitutions like `command` and $(command)
@@ -27,6 +32,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
   let quote: "'" | '"' | undefined;
   let index = 0;
   let current = "";
+  let isComplex = false;
   const segments: string[] = [];
 
   const pushCurrent = (): void => {
@@ -47,7 +53,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
     }
     if (quote === '"') {
       if (character === "\\") {
-        current += character + (command[index + 1] ?? "");
+        current += character + (command[index+1] ?? "");
         index += 2;
         continue;
       }
@@ -58,7 +64,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
         continue;
       }
       if (character === "`") {return COMPLEX;}
-      if (character === "$" && command[index + 1] === "(") {return COMPLEX;}
+      if (character === "$" && command[index+1] === "(") {return COMPLEX;}
       current += character;
       index++;
       continue;
@@ -66,7 +72,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
 
     // escape character
     if (character === "\\") {
-      current += character + (command[index + 1] ?? "");
+      current += character + (command[index+1] ?? "");
       index += 2;
       continue;
     }
@@ -86,7 +92,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
     }
 
     if (character === "`") {return COMPLEX;}
-    if (character === "$" && command[index + 1] === "(") {return COMPLEX;}
+    if (character === "$" && command[index+1] === "(") {return COMPLEX;}
     if (character === "(" || character === ")") {return COMPLEX;}
 
     // simple separators
@@ -102,14 +108,18 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
       continue;
     }
     if (character === "|") {
-      if (command[index+1] !== "|") {return COMPLEX;}
       pushCurrent();
-      index += 2;
+      if (command[index+1] === "|") {
+        index += 2;
+        continue;
+      }
+      isComplex = true;
+      index += command[index+1] === "&" ? 2 : 1;
       continue;
     }
     if (character === "\n" || character === "\r") {
       pushCurrent();
-      if (character === "\r" && command[index + 1] === "\n") {index += 2;}
+      if (character === "\r" && command[index+1] === "\n") {index += 2;}
       else {index++;}
       continue;
     }
@@ -123,7 +133,7 @@ export function analyzeShellCommand(command: string): ShellCommandAnalysis {
 
   pushCurrent();
   return {
-    isComplex: false,
+    isComplex,
     segments: segments.length > 0 ? segments : [""],
   };
 }

package/src/types.ts

@@ -21,15 +21,41 @@ export function toPermissionState(value: unknown): PermissionState | undefined {
 
 export type PermissionSection = Record<string, PermissionState>;
 
+export interface PermissionSettings {
+  /** Tells the local config to ignore global permission sections. */
+  ignore_global?: boolean;
+  /** `provider/model-id` override for small helper completions. */
+  ai_model?: string;
+  /** Criteria prompt override for what "auto" may allow. */
+  auto_allow_criteria?: string;
+}
+
 export interface PermissionConfig {
   default: PermissionState;
   tools: PermissionSection;
   bash: PermissionSection;
   external_directory: PermissionSection;
+  settings: PermissionSettings;
 }
 
 export function createDefaultPermissionConfig(): PermissionConfig {
-  return { default: ASK, tools: {}, bash: {}, external_directory: {} };
+  return { default: ASK, tools: {}, bash: {}, external_directory: {}, settings: {} };
+}
+
+/**
+ * Parses `provider/model-id`.
+ * Splits using the first '/'.
+ */
+export function parseAiModelRef(
+  value: string
+): { provider: string; modelId: string } | undefined {
+  const trimmed = value.trim();
+  const slash = trimmed.indexOf("/");
+  if (slash <= 0 || slash >= trimmed.length - 1) {return undefined;}
+  const provider = trimmed.slice(0, slash).trim();
+  const modelId = trimmed.slice(slash + 1).trim();
+  if (!provider || !modelId) {return undefined;}
+  return { provider, modelId };
 }
 
 // permission request

package/src/ui-strings.ts

@@ -1,3 +1,4 @@
+import type { Theme } from "@earendil-works/pi-coding-agent";
 import {
   ALLOW_ALWAYS_EXACT,
   ALLOW_ALWAYS_WILDCARD,
@@ -6,11 +7,11 @@ import { resolveAllowAlwaysMode } from "./policy-bash.ts";
 import type { PermissionRequest, PolicyResolution } from "./types.ts";
 
 export const STATUS_SUMMARIZING_REQUEST = "Summarizing permission request...";
+export const STATUS_CLASSIFYING_REQUEST = "Classifying permission request...";
 export const STATUS_GENERATING_WILDCARD = "Generating bash wildcard...";
 
 export const PERMISSION_DIALOG_TITLE = "Permission Required";
 export const PERMISSION_DIALOG_QUESTION = "What should the agent be allowed to do?";
-export const PURPOSE_PREFIX = "Purpose: ";
 
 export const WILDCARD_EDITOR_TITLE = "Review bash wildcard";
 export const WILDCARD_LIST_EDITOR_TITLE = "Review bash wildcards (semicolon-separated)";
@@ -19,34 +20,75 @@ export const BROAD_WILDCARD_TITLE = "Very broad wildcard";
 const CHAINED_BASH_NOTE = "Shell chaining detected.";
 const EXTERNAL_DIRECTORY_NOTE = "Outside the current working directory.";
 
+type SummaryLine = {
+  label?: string;
+  value: string;
+};
+
 function preview(value: string, limit: number): string {
   const normalized = value.replace(/\r\n/g, "\n");
   return normalized.length > limit ? `${normalized.slice(0, limit)}...` : normalized;
 }
 
-/**
- * Summary shown in the permission select dialog.
- */
-export function buildSelectorSummary(request: PermissionRequest): string {
-  const lines = [
-    `Tool: ${request.toolName}`,
+function buildSelectorSummaryLines(
+  request: PermissionRequest,
+  purpose?: string
+): SummaryLine[] {
+  const lines: SummaryLine[] = [
+    { label: "Tool", value: request.toolName },
   ];
-
   if (request.bodyKind === "command") {
-    lines.push(`Command: ${preview(request.body, 600)}`);
+    lines.push({ label: "Command", value: preview(request.body, 600) });
     if (request.bashAnalysis?.isComplex) {
-      lines.push(CHAINED_BASH_NOTE);
+      lines.push({ value: CHAINED_BASH_NOTE });
     }
   } else if (request.bodyKind === "path") {
-    lines.push(`Path: ${preview(request.body, 400)}`);
+    lines.push({ label: "Path", value: preview(request.body, 400) });
     if (request.isExternalDirectory) {
-      lines.push(EXTERNAL_DIRECTORY_NOTE);
+      lines.push({ value: EXTERNAL_DIRECTORY_NOTE });
     }
   } else {
-    lines.push(`Input: ${preview(request.body, 600)}`);
+    lines.push({ label: "Input", value: preview(request.body, 600) });
   }
+  if (purpose) {
+    lines.push({ label: "Purpose", value: purpose });
+  }
+  return lines;
+}
+
+/**
+ * Plain summary shown in the non-TUI permission dialog.
+ */
+export function buildPlainSelectorSummary(
+  request: PermissionRequest,
+  purpose?: string
+): string {
+  return buildSelectorSummaryLines(request, purpose)
+    .map((line) => (
+      line.label ? `${line.label}: ${line.value}` : line.value)
+    )
+    .join("\n");
+}
 
-  return lines.join("\n");
+/**
+ * Styled summary lines shown in the TUI permission dialog.
+ */
+export function buildStyledSelectorSummary(
+  theme: Theme,
+  request: PermissionRequest,
+  purpose?: string
+): string[] {
+  return buildSelectorSummaryLines(request, purpose).map((line) => {
+    if (!line.label) {
+      return theme.fg("muted", line.value);
+    }
+    if (line.label === "Purpose") {
+      return theme.fg("accent", theme.bold(`${line.label}:`))
+        + theme.fg("muted", ` ${line.value}`);
+    }
+    return theme.fg("accent", theme.bold(`${line.label}:`))
+      + theme.fg("text", ` ${line.value}`);
+  });
 }
 
 /**

package/src/warning-strings.ts

@@ -7,6 +7,16 @@ export const CONFIG_MUST_BE_OBJECT =
   "Permission config must be a JSON object; using defaults.";
 export const IGNORED_DEFAULT_WARNING =
   `Ignoring "default": expected ${PERMISSION_STATES_DESCRIPTION}.`;
+export const IGNORED_SETTINGS_WARNING =
+  'Ignoring "settings": expected an object.';
+export const IGNORED_AI_MODEL_WARNING =
+  'Ignoring "settings.ai_model": expected a string like "provider/model-id".';
+export const IGNORED_AUTO_ALLOW_CRITERIA_WARNING =
+  'Ignoring "settings.auto_allow_criteria": expected a non-empty string.';
+export const IGNORED_IGNORE_GLOBAL_WARNING =
+  'Ignoring "settings.ignore_global": expected a boolean.';
+export const IGNORED_IGNORE_GLOBAL_LOCAL_ONLY_WARNING =
+  'Ignoring "settings.ignore_global": this setting is only valid in local config.';
 
 export const WILDCARD_LENGTH_REASON =
   "Pattern must be between 1 and 500 characters.";

package/src/wildcard-editor.ts

@@ -28,12 +28,13 @@ import type {
  */
 async function chooseSingleWildcard(
   ctx: ExtensionContext,
-  command: string
+  command: string,
+  aiModel?: string
 ): Promise<AllowAlwaysRule | undefined> {
   ctx.ui.setStatus(STATUS_KEY, STATUS_GENERATING_WILDCARD);
   let suggestion: string | undefined;
   try {
-    suggestion = await generateBashWildcard(ctx, command);
+    suggestion = await generateBashWildcard(ctx, command, aiModel);
   } finally {
     ctx.ui.setStatus(STATUS_KEY, undefined);
   }
@@ -71,12 +72,13 @@ async function chooseSingleWildcard(
  */
 async function chooseWildcardListRules(
   ctx: ExtensionContext,
-  commands: readonly string[]
+  commands: readonly string[],
+  aiModel?: string
 ): Promise<AllowAlwaysRule[] | undefined> {
   ctx.ui.setStatus(STATUS_KEY, STATUS_GENERATING_WILDCARD);
   let suggestion: string[] | undefined;
   try {
-    suggestion = await generateBashWildcards(ctx, commands);
+    suggestion = await generateBashWildcards(ctx, commands, aiModel);
   } finally {
     ctx.ui.setStatus(STATUS_KEY, undefined);
   }
@@ -118,18 +120,19 @@ async function chooseWildcardListRules(
 export async function chooseAlwaysRules(
   ctx: ExtensionContext,
   request: PermissionRequest,
-  policy: PolicyResolution
+  policy: PolicyResolution,
+  aiModel?: string
 ): Promise<AllowAlwaysRule[] | undefined> {
   const mode = resolveAllowAlwaysMode(request, policy);
 
   if (mode === "wildcard") {
-    const rule = await chooseSingleWildcard(ctx, request.body);
+    const rule = await chooseSingleWildcard(ctx, request.body, aiModel);
     return rule ? [rule] : undefined;
   }
 
   if (mode === "wildcard-list") {
     const analysis = request.bashAnalysis ?? analyzeShellCommand(request.body);
-    return chooseWildcardListRules(ctx, analysis.segments);
+    return chooseWildcardListRules(ctx, analysis.segments, aiModel);
   }
 
   return [{ kind: "exact", tool: request.toolName, body: request.body }];

package/src/wildcard-validation.ts

@@ -76,7 +76,7 @@ export function validateWildcardSuggestionList(
     if (!result.valid) {
       return {
         valid: false,
-        reason: formatWildcardListItemReason(index + 1, pattern, result.reason),
+        reason: formatWildcardListItemReason(index+1, pattern, result.reason),
       };
     }
     if (result.broad) {broadPatterns.push(pattern);}