@dieulc/workflow 0.6.1 → 0.7.0

package/README.md

@@ -319,15 +319,16 @@ The extension has three modes — **Plan → Build → Default**. Plan mode is r
 | Mode | Meaning |
 | --- | --- |
 | `allow` (default) | The agent writes files freely — today's behaviour, and the shipped default so existing installs are unaffected |
-| `ask` | Every file write pops a dialog: **Allow once** / **Always allow this path** (or *this command*) / **Deny** / **Deny with instructions…**. A permanent grant is remembered, so the same target stops asking |
-| `never` | The agent may not write files at all. You apply the changes, or the user switches to `/build` for the approved-execution path |
+| `ask` | Writes pop a dialog: **Allow once (this turn)** / **Always allow …** (*this path*, *these paths*, *this command*, *these commands*) / **Deny** / **Deny with instructions…**. One dialog covers a whole turn and lists the writes it covers; a permanent grant is remembered, so the same target stops asking |
+| `never` | The agent may not modify your files (`.pi/plans/` excepted). You apply the changes, or the user switches to `/build` for the approved-execution path |
 
 The status line always shows the active permission (`◦ commits:never · writes:ask`), so you can see at a glance what the agent may touch.
 
 ### What is gated
 
 - The `edit` and `write` tools.
-- `bash` commands that may modify files. A command is treated as a write when it is **not provably read-only**: a file redirect (`>`, `>>`), a heredoc or command substitution, a command outside the read-only/verify allowlist (`rm`, `mv`, `cp`, `sed -i`, `npm install`, `git checkout`, interpreters, unknown binaries …), or a write flag on an otherwise-safe command (`eslint --fix`). Read-only commands (`ls`, `cat`, `rg`, `git status`, `npm test`, `tsc --noEmit`) and harmless redirections (`2>/dev/null`, `2>&1`) stay free.
+- `bash` commands that may modify files. A command is treated as a write when it is **not provably read-only**: a file redirect (`>`, `>>`), a heredoc or command substitution, a command outside the read-only/verify allowlist (`rm`, `mv`, `cp`, `sed`, `awk`, `npm install`, `git checkout`, interpreters, unknown binaries …), or a write flag on an otherwise-safe command (`eslint --fix`). Read-only commands (`ls`, `cat`, `rg`, `git status`, `npm test`, `tsc --noEmit`) and harmless redirections (`2>/dev/null`, `2>&1`) stay free.
+- **`sed` and `awk` are gated as potential writes whatever their flags** — their programs are code (GNU sed's `e` command runs a shell command and its `w` command writes a file; awk can `system()` or redirect), so a plain `sed -n '…p' file` asks too. To inspect a file without a prompt use `rg` / `head` / `tail` / `cut` / `column` / `jq`, or the `read` tool — or pick **Always allow this command** to grant that one command permanently.
 - `powershell` is always treated as a write — it cannot be classified by the POSIX allowlist, so it fails closed.
 
 `git add` / `git commit` / `git push` are **not** treated as file writes: they touch the index and the object store, not your working tree, and the independent [commit policy](#commit-policy) already governs them.
@@ -359,18 +360,18 @@ Write denied — tell the agent how to proceed
 The instruction reaches the model through **two channels**, on purpose:
 
 1. **The tool result** — the block reason quotes your sentence verbatim and ends with the disposition (*"Do not retry this write. Follow the instruction above. If it cannot be followed, say so and stop."*).
-2. **A user message** — the same sentence is delivered as a real user turn (`deliverAs: "steer"`), after the current tool batch and before the next model call.
+2. **A user message** — the same sentence is delivered as a real user turn (`deliverAs: "steer"`), after the current tool batch and before the next model call. One user turn per turn, not one per blocked call.
 
 The second channel is not redundancy for its own sake: Claude Code shipped the comment-on-rejection design and then shipped a bug where the model ignored the comment (it kept trying workarounds) — [anthropics/claude-code#89231](https://github.com/anthropics/claude-code/issues/89231), [#52824](https://github.com/anthropics/claude-code/issues/52824). A tool result is a fact the model may reinterpret; a user turn is an instruction it must follow. Cursor and Claude Code now offer the same affordance (*"Reject? Tell what to do differently"*).
 
 Behaviour worth knowing:
 
-- **Scope: this write only.** The instruction governs the denied call. The next write asks again — nothing is remembered, nothing is persisted (your sentence is never written to `settings.json`; it lives in the transcript and in one audit entry).
+- **One dialog per turn, not per call.** Pi runs an assistant message's tool calls as a batch, and the gate is asked about *every* call of that batch before the first of them runs. Asking per call therefore asked the same question twice when the model batched two writes to one file — and the sentence typed into the first dialog could not reach the model before the second one opened (a tool result is only appended after the whole batch, and a user turn lands only after the batch has run). The dialog now lists every write the answer covers, and the answer applies to all of them: **Allow once (this turn)** allows the listed writes of that turn, **Always allow …** persists a grant for every one of them.
+- **A denial is remembered for the rest of the run.** If the agent tries the same write again in a later turn, it is denied again with the same sentence — no second dialog, nothing to retype. The memory ends with the run (the next run asks again). To let that write through sooner, end the run (Esc) and start a new one, or switch to `/build` — the gate only applies in Default mode. Your sentence is never written to `settings.json`; it lives in the transcript and in one audit entry per turn.
 - **A plain Deny behaves exactly as it always has** — the agent's run is not cut short, and the model keeps its turn. A denial never sets pi's `terminate` flag: that flag is only consulted *after* a whole tool batch has run, so it cannot stop a sibling write — it would only take away the model's next turn.
-- **For a durable "explore only, don't edit yet", use `/plan`.** Plan mode is read-only by design and keeps the agent inside that rule for the whole session; a denial sentence applies to one write.
+- **For a durable "explore only, don't edit yet", use `/plan`.** Plan mode is read-only by design and keeps the agent inside that rule for the whole session; a denial sentence applies to the run it was given in.
 - **Cancelling the text box is a plain Deny** — never an implicit allow. An empty or whitespace-only sentence behaves the same way.
 - **Long or noisy input is sanitized**: line endings are normalised, control characters are stripped, and the text is capped at 2000 characters.
-- **One prompt per gated call.** If the model asks for several writes in one turn, each is a separate dialog.
 
 ## Settings
 
@@ -432,10 +433,10 @@ Write Permission settings live under `workflow.writePolicy` (same global/project
 
 | Key | Default | Meaning |
 | --- | --- | --- |
-| `mode` | `"allow"` | `"allow"` = the agent writes freely in Default mode; `"ask"` = every write prompts; `"never"` = writes are blocked (you write, or the user switches to `/build`) |
-| `allowedPaths` | `[]` | Absolute paths the agent may write without being asked again. An entry covers the file itself and everything under it on a directory boundary |
-| `allowedCommands` | `[]` | Command keys the agent may run without being asked again (the mutating shell segment, e.g. `rm -rf build`) |
-| `mutatingTools` | `[]` | Extra tool names to treat as file writes (e.g. `ast_grep_replace`, `office_excel_write_cells`) |
+| `mode` | `"allow"` | `"allow"` = the agent writes freely in Default mode; `"ask"` = every write prompts; `"never"` = writes are blocked (`.pi/plans/` excepted — you write, or the user switches to `/build`) |
+| `allowedPaths` | `[]` | Absolute paths the agent may write without being asked again (stored absolute, forward-slashed and lower-cased). An entry covers the file itself and everything under it on a directory boundary |
+| `allowedCommands` | `[]` | Command keys the agent may run without being asked again (the mutating shell segment, e.g. `rm -rf build`). A key is stored **normalised** — trimmed, whitespace collapsed, lower-cased — so a hand-written entry has to match that form |
+| `mutatingTools` | `[]` | Extra tool names to treat as file writes (e.g. `ast_grep_replace`, `office_excel_write_cells`). A grant for a tool **without** a path is stored in `allowedCommands` as `tool:<name>` (e.g. `tool:ast_grep_replace`) |
 
 ```json
 {
@@ -504,9 +505,12 @@ The write policy also has an end-to-end check that drives the real `tool_call` h
 
 ```bash
 node --experimental-transform-types scripts/verify-write-policy.mjs
+# or, equivalently (and the form the repo's own agent can run — the raw
+# `node` binary is outside a read-only role's command allowlist):
+npm run check:policy
 ```
 
-It covers the allow/ask/never modes, the "always allow" grant, and the guided denial (the instruction dialog, the two delivery channels, the audit entry, and the cancelled/empty fallbacks). What it cannot check is the part that matters most: how the real TUI renders the text box, and whether a live model actually obeys your instruction — do those two by hand once.
+It covers the allow/ask/never modes, the "always allow" grant, the guided denial (the instruction dialog, the two delivery channels, the audit entry, and the cancelled/empty fallbacks) and the turn-scoped gate: one dialog per assistant turn, the denial remembered for the run, and a batch grant covering every listed target. What it cannot check is the part that matters most: how the real TUI renders the text box, and whether a live model actually obeys your instruction — do those two by hand once.
 
 Plain TypeScript, no build step — Pi loads `index.ts` directly (via jiti). From the repo root, `npm run verify` checks this package's manifest, tarball contents, tests and load path before a release. Live reload: edit the `.ts` file and run `/reload` in Pi.
 

package/edit-policy.ts

@@ -753,23 +753,44 @@ export function sanitizeWriteInstruction(raw: unknown): string {
  * The gate consumes this and `parseWriteGateChoice` below, so a renamed
  * label can never silently change the gate's behaviour (the unit test maps
  * every real option through the parser).
+ *
+ * The labels state the scope they really have, because ONE answer now
+ * covers every gated write of the turn (see the turn-scoped helpers below):
+ * "Allow once (this turn)" allows the writes the dialog listed, and
+ * "Always allow …" persists a grant for every one of them.
  */
 export function writeGateOptions(
-  kind: "path" | "command",
+  kind: WriteGateOptionKind,
 ): readonly string[] {
-  return kind === "path"
-    ? [
-        "Allow once",
-        "Always allow this path",
-        "Deny",
-        WRITE_DENY_WITH_INSTRUCTIONS_LABEL,
-      ]
-    : [
-        "Allow once",
-        "Always allow this command",
-        "Deny",
-        WRITE_DENY_WITH_INSTRUCTIONS_LABEL,
-      ];
+  return [
+    "Allow once (this turn)",
+    writeGateAlwaysLabel(kind),
+    "Deny",
+    WRITE_DENY_WITH_INSTRUCTIONS_LABEL,
+  ];
+}
+
+/**
+ * The "always allow" label for a set of items — singular, plural or mixed.
+ *
+ * The prefix "Always allow" is what `parseWriteGateChoice` matches on, so
+ * every variant parses to the same choice.
+ */
+export function writeGateAlwaysLabel(kind: WriteGateOptionKind): string {
+  switch (kind) {
+    case "path":
+      return "Always allow this path";
+    case "paths":
+      return "Always allow these paths";
+    case "command":
+      return "Always allow this command";
+    case "commands":
+      return "Always allow these commands";
+    case "mixed":
+      return "Always allow these";
+    default:
+      return "Always allow these";
+  }
 }
 
 /** What the ask dialog's answer means. */
@@ -855,6 +876,164 @@ export function buildWriteGuidanceMessage(input: {
   );
 }
 
+// ── Turn-scoped gate helpers ───────────────────────────────────────────
+//
+// The gate asks ONE question per assistant turn — not one per tool call.
+//
+// WHY: Pi executes an assistant message's tool calls as a BATCH, and the
+// extension's `tool_call` hook runs in the batch's PREPARATION phase: once
+// per call, sequentially, before any tool in the batch runs
+// (pi-agent-core/dist/agent-loop.js → executeToolCallsParallel →
+// prepareToolCall → beforeToolCall). A model that batches two writes to the
+// same file therefore produced two dialogs back to back, with no agent
+// output in between — and the instruction typed into the first one could
+// not reach the model before the second one opened, because a tool result is
+// appended only after the whole batch and a steer message lands only after
+// the turn's tool calls have run. The user had to retype the same sentence.
+//
+// So the gate collects the turn's gated writes, shows them all in one
+// dialog, and applies the answer to every one of them.
+
+/** One gated write covered by a single dialog answer. */
+export interface WriteGateItem {
+  /** The tool that would write (edit, write, bash, powershell, …). */
+  tool: string;
+  /** Human target: the joined paths, or the command/tool key. */
+  target: string;
+  /** Short cause, e.g. "edits src/a.ts". */
+  why?: string;
+  /** Stable key a denial is remembered under (see `writeGateTargetKey`). */
+  key: string;
+  /** Path grants "always allow" would persist for this item. */
+  grantPaths?: string[];
+  /** Command (or tool) grant "always allow" would persist for this item. */
+  grantCommand?: string;
+}
+
+/**
+ * Which "always allow" label fits a set of items.
+ *
+ * "path"/"paths" — every item writes files; "command"/"commands" — every
+ * item runs a command (or a path-less tool, whose grant is stored in the
+ * command list); "mixed" — both in one turn.
+ */
+export type WriteGateOptionKind =
+  | "path"
+  | "paths"
+  | "command"
+  | "commands"
+  | "mixed";
+
+/**
+ * The stable key a denial is remembered under.
+ *
+ * Path writes key on their normalized absolute path(s) (so the same file
+ * keys the same way whatever the model spelled it as), command writes on
+ * their allow-key, and a path-less tool on its tool key.
+ */
+export function writeGateTargetKey(
+  toolName: string,
+  classification: WriteCallClassification,
+  cwd: string,
+): string {
+  const paths = classification.paths
+    .map((p) => normalizeWritePath(p, cwd))
+    .filter((p) => p.length > 0)
+    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+  if (paths.length > 0) return `path:${paths.join("|")}`;
+  if (classification.key) return `cmd:${commandAllowKey(classification.key)}`;
+  return `tool:${toolAllowKey(toolName)}`;
+}
+
+/**
+ * Build the item for one classified call.
+ *
+ * `grantPaths` / `grantCommand` are what "always allow" would persist for
+ * this item: the normalized paths for a file write, the allow-key for a
+ * command or a path-less tool.
+ */
+export function writeGateItemFromClassification(
+  toolName: string,
+  classification: WriteCallClassification,
+  cwd: string,
+): WriteGateItem {
+  const tool = String(toolName ?? "");
+  const rawPaths = classification.paths.filter(
+    (p) => typeof p === "string" && p.trim().length > 0,
+  );
+  const grantPaths = rawPaths
+    .map((p) => normalizeWritePath(p, cwd))
+    .filter((p) => p.length > 0);
+  const item: WriteGateItem = {
+    tool,
+    target: rawPaths.length > 0 ? rawPaths.join(", ") : (classification.key ?? tool),
+    why: classification.reason,
+    key: writeGateTargetKey(tool, classification, cwd),
+  };
+  if (grantPaths.length > 0) item.grantPaths = grantPaths;
+  else if (classification.key) item.grantCommand = classification.key;
+  return item;
+}
+
+/** Which "always allow" label fits a set of items. */
+export function writeGateItemsKind(
+  items: readonly WriteGateItem[],
+): WriteGateOptionKind {
+  const paths = items.filter((i) => (i.grantPaths?.length ?? 0) > 0);
+  const commands = items.filter((i) => Boolean(i.grantCommand));
+  if (paths.length > 0 && commands.length > 0) return "mixed";
+  if (paths.length > 0) return paths.length === 1 ? "path" : "paths";
+  if (commands.length > 0) return commands.length === 1 ? "command" : "commands";
+  return "path";
+}
+
+/**
+ * The human list of the writes a dialog covers:
+ * "edits src/a.ts; edits src/b.ts".
+ */
+export function describeWriteGateItems(
+  items: readonly WriteGateItem[],
+): string {
+  return items
+    .map((item) => {
+      const why = String(item.why ?? "").trim();
+      return why || String(item.target ?? "").trim();
+    })
+    .filter((text) => text.length > 0)
+    .join("; ");
+}
+
+/**
+ * The targets of a set of items, joined for the reason/guidance text:
+ * "src/a.ts, src/b.ts".
+ */
+export function writeGateTargetsLabel(
+  items: readonly WriteGateItem[],
+): string {
+  return items
+    .map((item) => String(item.target ?? "").trim())
+    .filter((text) => text.length > 0)
+    .join(", ");
+}
+
+/**
+ * The dialog title.
+ *
+ * One write keeps today's wording verbatim; several writes are listed, so
+ * the user sees exactly what the answer covers.
+ */
+export function writeGateTitle(items: readonly WriteGateItem[]): string {
+  if (items.length <= 1) {
+    const only = items[0];
+    const why = only?.why ? ` (${only.why})` : "";
+    return `Write policy 'ask': allow this write${why}?`;
+  }
+  return (
+    `Write policy 'ask': allow these ${items.length} writes? ` +
+    `(${describeWriteGateItems(items)})`
+  );
+}
+
 // ── Argument completions (/write-policy) ────────────────────────────
 
 /** One /write-policy subcommand with its usage hint. */

package/index.ts

@@ -117,16 +117,23 @@ import {
   decideWriteGate,
   describeWritePolicyMode,
   isWriteCallAllowed,
-  normalizeWritePath,
   parseWriteGateChoice,
   readWritePolicyConfig,
   sanitizeWriteInstruction,
   writePolicyArgumentCompletions,
   writePolicyConfigPaths,
   writeWritePolicyConfig,
+  writeGateItemFromClassification,
+  writeGateItemsKind,
   writeGateOptions,
+  writeGateTargetsLabel,
+  writeGateTitle,
   WRITE_INSTRUCTION_PROMPT_PLACEHOLDER,
   WRITE_INSTRUCTION_PROMPT_TITLE,
+  type WriteGateChoice,
+  type WriteGateItem,
+  type WriteCallClassification,
+  type WritePolicyConfig,
   type WritePolicyMode,
 } from "./edit-policy.ts";
 import {
@@ -176,6 +183,7 @@ import {
   PROFILE_ROLES,
   type ProfileConfig,
   type Profile,
+  type ProfileRoleName,
 } from "./profiles.ts";
 import {
   applySubmittedPlan,
@@ -457,6 +465,34 @@ export default function workflowExtension(pi: ExtensionAPI) {
   // already accounted for so they never trigger a spurious commit.
   const committedStepRefs = new Set<string>();
   let stepCommitsSeeded = false;
+  // ── Write-policy gate state (turn-scoped decisions, run-scoped denials) ──
+  // Pi runs an assistant message's tool calls as ONE batch, and the
+  // extension's tool_call hook runs in the batch's preparation phase — once
+  // per call, before any tool in the batch runs. Asking per call therefore
+  // asked the SAME question twice (two calls to the same path), and the
+  // instruction typed into the first dialog could not reach the model
+  // before the second one opened. The gate now asks once per turn:
+  //   writeGateBatchCalls  — the tool calls of the current assistant
+  //                          message (the turn's batch), captured on
+  //                          message_end; the dialog lists the writes it
+  //                          covers.
+  //   writeGateTurnAnswer  — the answer the user gave for this turn; it
+  //                          applies to every gated call of the turn, so
+  //                          the siblings are never asked again.
+  //   writeGateTurnSteered — whether this turn already delivered the
+  //                          instruction as a user turn (at most one steer
+  //                          per turn).
+  //   writeGateRunDenials  — denials remembered for the rest of the run,
+  //                          keyed by the write's target key, so a later
+  //                          retry is auto-denied (no second dialog) with
+  //                          the same instruction.
+  let writeGateBatchCalls: { name: string; args: unknown }[] = [];
+  /** The tool-call ids of the cached batch — a call outside it starts a new one. */
+  let writeGateBatchCallIds = new Set<string>();
+  let writeGateTurnAnswer: { choice: WriteGateChoice; instruction: string } | null =
+    null;
+  let writeGateTurnSteered = false;
+  const writeGateRunDenials = new Map<string, { instruction: string }>();
   // ── Reminder throttle + staleness tracking (passive enforcement layer) ──
   let turnsSinceLastTodoWrite = 0;
   let turnsSinceLastReminder = 0;
@@ -687,6 +723,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
           `  ${roleIcon(roleName)} ${roleName} → ${formatModelRef(m)} (${m.thinking})`,
         );
     }
+    if (profile.defaultModel) {
+      const m = profile.defaultModel;
+      lines.push(
+        `  ◦ default → ${formatModelRef(m)} (${m.thinking})`,
+      );
+    }
     const missing = missingProfileRoles(profile);
     if (missing.length) {
       lines.push(
@@ -736,6 +778,13 @@ export default function workflowExtension(pi: ExtensionAPI) {
     }
     profileExplicit = opts?.explicit ?? true;
     invalidateEffectiveRoles();
+    const prof = activeProfileName
+      ? getProfile(profilesConfig, activeProfileName)
+      : null;
+    // Default-mode model follows the profile when it carries one.
+    if (prof?.defaultModel) {
+      defaultModel = { ...prof.defaultModel };
+    }
     try {
       persistState();
     } catch (_e) {
@@ -748,6 +797,27 @@ export default function workflowExtension(pi: ExtensionAPI) {
       } catch (_e) {
         void _e;
       }
+    } else if (prof?.defaultModel) {
+      // In Default mode, apply the profile's default model immediately.
+      try {
+        const m = prof.defaultModel;
+        const reg = (ctx as any)?.modelRegistry;
+        const found = reg?.find?.(m.provider, m.id);
+        if (found) {
+          await (pi as any).setModel?.(found);
+          if (m.thinking && isValidThinkingLevel(m.thinking)) {
+            (pi as any).setThinkingLevel?.(m.thinking);
+          }
+          if (!opts?.quiet) {
+            ctx.ui.notify(
+              `Default mode: model → ${m.provider}/${m.id}${m.thinking ? ` (${m.thinking})` : ""}`,
+              "info",
+            );
+          }
+        }
+      } catch (_e) {
+        void _e;
+      }
     }
     if (!opts?.quiet) {
       ctx.ui.notify(
@@ -3420,6 +3490,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
       const m = getEffectiveRole(roleName)?.model;
       if (m) seed.roles[roleName] = { ...m };
     }
+    if (defaultModel)
+      seed.defaultModel = {
+        provider: defaultModel.provider,
+        id: defaultModel.id,
+        thinking: (defaultModel.thinking as ThinkingLevel) ?? "medium",
+      };
     return seed;
   }
 
@@ -3600,10 +3676,15 @@ export default function workflowExtension(pi: ExtensionAPI) {
         ]
           .filter(Boolean)
           .join(", ");
-        const modelSummary = PROFILE_ROLES.map((r) => {
-          const m = p.roles[r];
-          return m ? `${roleIcon(r)} ${formatModelRef(m)}` : null;
-        })
+        const modelSummary = [
+          ...PROFILE_ROLES.map((r) => {
+            const m = p.roles[r];
+            return m ? `${roleIcon(r)} ${formatModelRef(m)}` : null;
+          }),
+          p.defaultModel
+            ? `◦ ${formatModelRef(p.defaultModel)}`
+            : null,
+        ]
           .filter(Boolean)
           .join(" · ");
         entries.push({
@@ -3996,8 +4077,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
         description: base?.description ?? `Role ${roleName}`,
       });
     }
+    roleMeta.set("default", {
+      name: "default",
+      description: "Model used in Default mode (chat)",
+    });
     // Keep the narrow tuple type so profile.roles[roleName] typechecks.
-    const tabIds = [...PROFILE_ROLES];
+    const tabIds = [...PROFILE_ROLES, "default"];
     // Stage from the profile (edit) or the current effective roles (create).
     const staged = new Map<string, StagedProfileModel>();
     for (const roleName of PROFILE_ROLES) {
@@ -4009,6 +4094,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
         thinking: src?.thinking ?? "medium",
       });
     }
+    const defaultSrc = existing?.defaultModel ?? defaultModel;
+    staged.set("default", {
+      provider: defaultSrc?.provider ?? "",
+      id: defaultSrc?.id ?? "",
+      thinking: (defaultSrc?.thinking as ThinkingLevel) ?? "medium",
+    });
 
     overlayActive = true;
     let saved: {
@@ -4178,7 +4269,10 @@ export default function workflowExtension(pi: ExtensionAPI) {
           for (let i = 0; i < tabIds.length; i++) {
             const roleName = tabIds[i];
             const st = staged.get(roleName)!;
-            const base = existing?.roles[roleName];
+            const base =
+              roleName === "default"
+                ? existing?.defaultModel
+                : existing?.roles[roleName as ProfileRoleName];
             const dirty =
               !base ||
               `${st.provider}/${st.id}` !== `${base.provider}/${base.id}` ||
@@ -4355,6 +4449,16 @@ export default function workflowExtension(pi: ExtensionAPI) {
           thinking: st.thinking,
         };
     }
+    const defaultSt = saved.staged.get("default");
+    if (defaultSt && defaultSt.provider && defaultSt.id) {
+      profile.defaultModel = {
+        provider: defaultSt.provider,
+        id: defaultSt.id,
+        thinking: defaultSt.thinking,
+      };
+    } else {
+      delete profile.defaultModel;
+    }
     try {
       saveProfiles(profilesConfig, "user");
     } catch (e: any) {
@@ -6299,6 +6403,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
   // ── Session & Agent lifecycle ────────────────────────────────────
 
   pi.on("session_start", async (event, ctx) => {
+    // A reloaded/forked session must never inherit a stale write denial.
+    writeGateRunDenials.clear();
+    writeGateTurnAnswer = null;
+    writeGateTurnSteered = false;
+    writeGateBatchCalls = [];
+    writeGateBatchCallIds = new Set();
     // Roles are file-backed; load them up-front so every read path (status,
     // band label, reviewer runtime) sees the real config even in a fresh
     // session that has no persisted workflow entry yet. Profiles likewise.
@@ -6368,6 +6478,11 @@ export default function workflowExtension(pi: ExtensionAPI) {
                       void _e;
                     }
                     activeProfileName = null;
+                  } else if (activeProfileName) {
+                    const rp = getProfile(profilesConfig, activeProfileName);
+                    if (rp?.defaultModel) {
+                      defaultModel = { ...rp.defaultModel };
+                    }
                   }
                 } else {
                   activeProfileName = null;
@@ -6471,6 +6586,9 @@ export default function workflowExtension(pi: ExtensionAPI) {
               activeProfileName = p.name;
               invalidateEffectiveRoles();
             }
+            if (p.defaultModel) {
+              defaultModel = { ...p.defaultModel };
+            }
           } else {
             try {
               (ctx as any).ui?.notify?.(
@@ -6544,6 +6662,12 @@ export default function workflowExtension(pi: ExtensionAPI) {
   });
 
   pi.on("session_shutdown", async (_event, ctx) => {
+    // A write denial is run-scoped; the session is going away, so drop it.
+    writeGateRunDenials.clear();
+    writeGateTurnAnswer = null;
+    writeGateTurnSteered = false;
+    writeGateBatchCalls = [];
+    writeGateBatchCallIds = new Set();
     // Kill any active explore subagents to prevent orphan leaks.
     // Without this, `pi --mode json` children spawned by runSingleAgent
     // (up to 4 concurrent) could survive if VS Code closes the terminal
@@ -6745,6 +6869,88 @@ export default function workflowExtension(pi: ExtensionAPI) {
     }
   }
 
+  /**
+   * The gated writes of the current assistant turn (the batch), as items the
+   * dialog can list.
+   *
+   * Pi runs an assistant message's tool calls as a batch and prompts the
+   * extension for EVERY call before the first tool of the batch runs, so the
+   * batch is the natural scope of ONE question. The current call is always
+   * part of the list (its arguments may have been rewritten by another
+   * extension's tool_call handler after the assistant message was sealed).
+   */
+  function collectWriteGateItems(
+    currentEvent: any,
+    currentClassification: WriteCallClassification,
+    config: WritePolicyConfig,
+    cwd: string,
+  ): WriteGateItem[] {
+    const items: WriteGateItem[] = [];
+    const seen = new Set<string>();
+    const add = (name: string, classification: WriteCallClassification) => {
+      const item = writeGateItemFromClassification(name, classification, cwd);
+      if (!item.key || seen.has(item.key)) return;
+      seen.add(item.key);
+      items.push(item);
+    };
+    for (const call of writeGateBatchCalls) {
+      const name = String(call.name ?? "");
+      if (!name) continue;
+      const classification = classifyWriteCall(name, call.args, config);
+      if (!classification.mutating) continue;
+      // A granted target is not gated — it never reaches a dialog.
+      if (isWriteCallAllowed(classification, config, cwd)) continue;
+      // The plan directory stays writable in every mode.
+      if (
+        classification.paths.length > 0 &&
+        classification.paths.every((p) => isPlanWritePath(p, cwd))
+      ) {
+        continue;
+      }
+      add(name, classification);
+    }
+    add(String(currentEvent?.toolName ?? ""), currentClassification);
+    return items;
+  }
+
+  /**
+   * Deliver the user's instruction to the model as a USER turn (a steer).
+   *
+   * At most once per assistant turn: the sentence is also quoted in every
+   * blocked call's reason (the tool result), so a turn needs ONE user turn,
+   * not one per blocked call.
+   */
+  function deliverWriteInstruction(
+    items: readonly WriteGateItem[],
+    instruction: string,
+  ): void {
+    if (!instruction || writeGateTurnSteered) return;
+    // Guard: while a review round is active the extension's `input` handler
+    // routes incoming user text to the REVIEWER, so steering here would
+    // hand the instruction to the wrong agent. The tool result still carries
+    // it, so skip the steer rather than misroute.
+    const rt = reviewRuntime;
+    const wouldRouteToReviewer = shouldRouteInputToReviewer({
+      reviewEnabled: reviewEnabled(),
+      reviewActive: rt?.isRoundActive() === true,
+      hasReviewerSession: rt?.isAlive() === true,
+    });
+    if (!wouldRouteToReviewer) {
+      try {
+        (pi as any).sendUserMessage?.(
+          buildWriteGuidanceMessage({
+            target: writeGateTargetsLabel(items) || "the requested write",
+            instruction,
+          }),
+          { deliverAs: "steer" },
+        );
+      } catch (_e) {
+        void _e;
+      }
+    }
+    writeGateTurnSteered = true;
+  }
+
   /**
    * Write permission gate (workflow.writePolicy) — Default mode only.
    *
@@ -6762,6 +6968,9 @@ export default function workflowExtension(pi: ExtensionAPI) {
    * may. Never throws — a throwing tool_call handler blocks the tool as a
    * fail-safe, so every failure path here fails CLOSED with an actionable
    * reason (the reason is what the model reads).
+   *
+   * Under `ask` it asks ONE question per assistant turn (see the batch
+   * helpers above) and remembers a denial for the rest of the run.
    */
   async function writePolicyGate(
     event: any,
@@ -6830,7 +7039,20 @@ export default function workflowExtension(pi: ExtensionAPI) {
         };
       }
 
-      // decision === "ask" — prompt the user.
+      // decision === "ask" — ONE question per assistant turn.
+      //
+      // Pi runs an assistant message's tool calls as a batch and prompts the
+      // extension for EVERY call before the first tool of the batch runs
+      // (pi-agent-core: executeToolCallsParallel → prepareToolCall →
+      // beforeToolCall). Asking per call therefore asked the SAME question
+      // twice when the model batched two writes to one path, and the
+      // instruction typed into the first dialog could not reach the model
+      // before the second one opened (a tool result is appended only after
+      // the whole batch, and a steer lands only after the turn's tool calls
+      // have run) — the user had to retype the same sentence.
+      //
+      // So: one dialog per turn, listing every write the answer covers, and
+      // the answer applies to all of them.
       const ui = ctx?.ui;
       if (!ui || !ctx.hasUI) {
         return {
@@ -6842,41 +7064,98 @@ export default function workflowExtension(pi: ExtensionAPI) {
         };
       }
 
-      const isPathGrant = classification.paths.length > 0;
-      const options = writeGateOptions(isPathGrant ? "path" : "command");
+      // The turn's gated writes (the current call at minimum).
+      // A call that is NOT part of the cached batch belongs to a NEW batch
+      // (a host that delivers no assistant message, or a nested tool call):
+      // reset the turn's answer first — a stale answer must never carry
+      // over, or the gate would stop asking altogether.
+      const callId = String(event.toolCallId ?? "");
+      if (!writeGateBatchCallIds.has(callId)) {
+        writeGateTurnAnswer = null;
+        writeGateTurnSteered = false;
+        writeGateBatchCalls = [];
+        writeGateBatchCallIds = new Set();
+      }
+      const items = collectWriteGateItems(event, classification, config, cwd);
+      const currentItem = writeGateItemFromClassification(
+        String(event.toolName ?? ""),
+        classification,
+        cwd,
+      );
+
+      // (a) The user denied this target earlier in THIS RUN → deny again,
+      // silently. The model gets the same sentence; the user is not asked a
+      // second time for the same decision.
+      const remembered = writeGateRunDenials.get(currentItem.key);
+      if (remembered) {
+        deliverWriteInstruction(items, remembered.instruction);
+        return {
+          block: true,
+          reason: buildWriteDenyReason({
+            target,
+            why: classification.reason,
+            instruction: remembered.instruction,
+          }),
+        };
+      }
+
+      // (b) The user already answered for THIS TURN → apply the answer to
+      // every gated call of the turn. No second dialog.
+      if (writeGateTurnAnswer) {
+        const answer = writeGateTurnAnswer;
+        if (answer.choice === "allow-once" || answer.choice === "always") {
+          return undefined;
+        }
+        return {
+          block: true,
+          reason: buildWriteDenyReason({
+            target,
+            why: classification.reason,
+            instruction: answer.instruction,
+          }),
+        };
+      }
+
+      // (c) The first gated call of the turn → ask ONCE.
+      const options = writeGateOptions(writeGateItemsKind(items));
       let sel: unknown;
       try {
-        sel = await ui.select(
-          `Write policy 'ask': allow this write${why}?`,
-          options,
-        );
+        sel = await ui.select(writeGateTitle(items), options);
       } catch (_e) {
         void _e;
         sel = undefined;
       }
       const choice = parseWriteGateChoice(sel);
-      if (choice === "allow-once") return undefined;
+      if (choice === "allow-once") {
+        // Applies to every gated write of this turn — the dialog listed them.
+        writeGateTurnAnswer = { choice, instruction: "" };
+        return undefined;
+      }
 
       if (choice === "always") {
-        // Persist the grant so the same target stops asking. A path grant
-        // stores the absolute path; a command grant stores the command key.
-        const patch = isPathGrant
-          ? {
-              allowedPaths: classification.paths.map((p) =>
-                normalizeWritePath(p, cwd),
-              ),
-            }
-          : { allowedCommands: classification.key ? [classification.key] : [] };
-        const written = writeWritePolicyConfig("global", cwd, getAgentDir(), patch);
+        // Persist a grant for EVERY write the dialog listed, so none of them
+        // asks again. A path grant stores the absolute path; a command (or
+        // path-less tool) grant stores the command key.
+        const allowedPaths: string[] = [];
+        const allowedCommands: string[] = [];
+        for (const item of items) {
+          for (const p of item.grantPaths ?? []) allowedPaths.push(p);
+          if (item.grantCommand) allowedCommands.push(item.grantCommand);
+        }
+        const written = writeWritePolicyConfig("global", cwd, getAgentDir(), {
+          allowedPaths,
+          allowedCommands,
+        });
         if (written.ok) {
           try {
             (ctx as any).ui?.notify?.(
-              `Write policy: always allowed ${isPathGrant ? classification.paths.join(", ") : classification.key}`,
+              `Write policy: always allowed ${writeGateTargetsLabel(items)}`,
               "info",
             );
           } catch (_e) {
             void _e;
           }
+          writeGateTurnAnswer = { choice, instruction: "" };
           return undefined;
         }
         // The grant could not be persisted — do not silently allow a write
@@ -6921,8 +7200,17 @@ export default function workflowExtension(pi: ExtensionAPI) {
         // below. A cancel is never an implicit allow.
       }
 
+      // The answer covers every gated write of this turn.
+      writeGateTurnAnswer = { choice, instruction };
+      // …and the denial is remembered for the REST OF THE RUN, under every
+      // target of this turn: a later retry is auto-denied with the same
+      // sentence instead of asking the user again.
+      for (const item of items) {
+        writeGateRunDenials.set(item.key, { instruction });
+      }
+
       const reason = buildWriteDenyReason({
-        target,
+        target: items.length > 1 ? writeGateTargetsLabel(items) : target,
         why: classification.reason,
         instruction,
       });
@@ -6930,35 +7218,19 @@ export default function workflowExtension(pi: ExtensionAPI) {
       if (instruction) {
         // Channel 2: a user-role message. `steer` queues it while the agent
         // is running; it lands after the current tool batch, before the next
-        // model call, as a genuine user turn.
-        //
-        // Guard: while a review round is active the extension's `input`
-        // handler routes incoming user text to the REVIEWER, so steering
-        // here would hand the instruction to the wrong agent. The tool result
-        // still carries it, so skip the steer rather than misroute.
-        const rt = reviewRuntime;
-        const wouldRouteToReviewer = shouldRouteInputToReviewer({
-          reviewEnabled: reviewEnabled(),
-          reviewActive: rt?.isRoundActive() === true,
-          hasReviewerSession: rt?.isAlive() === true,
-        });
-        if (!wouldRouteToReviewer) {
-          try {
-            (pi as any).sendUserMessage?.(
-              buildWriteGuidanceMessage({ target, instruction }),
-              { deliverAs: "steer" },
-            );
-          } catch (_e) {
-            void _e;
-          }
-        }
-        // Audit trail — transcript only (appendEntry is never sent to the LLM).
+        // model call, as a genuine user turn. ONE per turn, not one per
+        // blocked call.
+        deliverWriteInstruction(items, instruction);
+        // Audit trail — transcript only (appendEntry is never sent to the
+        // LLM). One entry per turn: it records the user's decision, not each
+        // call the decision was applied to.
         try {
           pi.appendEntry("workflow-write-denial", {
             tool: String(event.toolName ?? ""),
             target,
             instruction,
             at: Date.now(),
+            targets: items.map((item) => item.target),
           });
         } catch (_e) {
           void _e;
@@ -7274,8 +7546,45 @@ export default function workflowExtension(pi: ExtensionAPI) {
     }
   });
 
+  // ── Write-policy gate: the turn's batch ──
+  // Pi prepares and prompts EVERY tool call of an assistant message before
+  // the first tool of that message runs (pi-agent-core's
+  // executeToolCallsParallel → prepareToolCall → beforeToolCall). The tool
+  // calls of the assistant message ARE the turn's batch, so the gate can ask
+  // ONE question that lists every write the answer covers. A new assistant
+  // message is a new batch — hence a new turn, hence a new answer.
+  pi.on("message_end", async (event) => {
+    try {
+      const message = (event as any)?.message;
+      if (!message || message.role !== "assistant") return;
+      const content = Array.isArray(message.content) ? message.content : [];
+      const calls: { name: string; args: unknown }[] = [];
+      const callIds = new Set<string>();
+      for (const block of content) {
+        if (!block || block.type !== "toolCall") continue;
+        calls.push({
+          name: String(block.name ?? ""),
+          args: block.arguments,
+        });
+        if (block.id) callIds.add(String(block.id));
+      }
+      writeGateBatchCalls = calls;
+      writeGateBatchCallIds = callIds;
+      writeGateTurnAnswer = null;
+      writeGateTurnSteered = false;
+    } catch (_e) {
+      void _e;
+    }
+  });
+
   pi.on("turn_start", async (_event, ctx) => {
     footerInjectedThisTurn = false;
+    // A new turn = a new answer for the write gate (the batch's own
+    // message_end already resets it; this is the defensive second guard).
+    writeGateTurnAnswer = null;
+    writeGateTurnSteered = false;
+    writeGateBatchCalls = [];
+    writeGateBatchCallIds = new Set();
     // Seed the per-step commit ledger once per session: steps already done
     // (restored sessions, re-executed plans) never trigger a spurious commit.
     try {
@@ -7318,6 +7627,14 @@ export default function workflowExtension(pi: ExtensionAPI) {
     // dropped here — nothing that runs next inherits them.
     commitAuthorization = null;
     pendingCommitFlow = null;
+    // A write denial is remembered for the REST OF THE RUN, so a later retry
+    // of the same target is auto-denied instead of asking again. The run is
+    // over → the next run asks again.
+    writeGateRunDenials.clear();
+    writeGateTurnAnswer = null;
+    writeGateTurnSteered = false;
+    writeGateBatchCalls = [];
+    writeGateBatchCallIds = new Set();
     // keep persisted CustomEntry for reload, clear in-memory tombstone only on explicit prune; for now no clear to survive fork
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dieulc/workflow",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "type": "module",
   "private": false,
   "keywords": ["pi-package", "workflow", "plan-mode", "review-mode", "questionnaire", "rewind"],
@@ -8,7 +8,8 @@
   "license": "MIT",
   "scripts": {
     "test": "node --test utils.todo.test.ts permissions.test.ts roles.test.ts profiles.test.ts review.test.ts review-ui.test.ts commit-policy.test.ts edit-policy.test.ts",
-    "typecheck": "tsc --noEmit -p tsconfig.json"
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "check:policy": "node --experimental-transform-types scripts/verify-write-policy.mjs"
   },
   "repository": {
     "type": "git",

package/profiles.ts

@@ -55,6 +55,8 @@ export interface Profile {
   description: string;
   /** Partial by design: hand-edited files may override a subset of roles. */
   roles: Partial<Record<ProfileRoleName, RoleModel>>;
+  /** Optional model used in Default mode (chat). Not a role — roles.json is untouched. */
+  defaultModel?: RoleModel;
 }
 
 export interface ProfileConfig {
@@ -240,11 +242,17 @@ export function sanitizeProfile(p: any): Profile | undefined {
     const m = sanitizeProfileModel((rawRoles as any)[roleName]);
     if (m) roles[roleName] = m;
   }
-  if (Object.keys(roles).length === 0) return undefined;
+  // Default-mode model: prefer the dedicated field, fall back to a
+  // `roles.default` alias for hand-edited files.
+  const defaultModel =
+    sanitizeProfileModel(p.defaultModel) ??
+    sanitizeProfileModel((rawRoles as any).default);
+  if (Object.keys(roles).length === 0 && !defaultModel) return undefined;
   return {
     name: nameCheck.value,
     description: typeof p.description === "string" ? p.description.trim() : "",
     roles,
+    ...(defaultModel ? { defaultModel } : {}),
   };
 }
 
@@ -417,6 +425,10 @@ export function formatProfileOneLine(p: Profile): string {
     const m = p.roles[r];
     return m ? `${roleIcon(r)} ${formatModelRef(m)} (${m.thinking})` : `${roleIcon(r)} —`;
   });
+  if (p.defaultModel) {
+    const m = p.defaultModel;
+    parts.push(`◦ ${formatModelRef(m)} (${m.thinking})`);
+  }
   const desc = p.description ? ` — ${p.description}` : "";
   return `⚡ ${p.name}${desc}: ${parts.join(" · ")}`;
 }
@@ -433,6 +445,12 @@ export function describeProfile(p: Profile): string {
       }`,
     );
   }
+  const dm = p.defaultModel;
+  lines.push(
+    `  ◦ default: ${
+      dm ? `${formatModelRef(dm)} (${dm.thinking})` : "(not set — keeps current Default-mode model)"
+    }`,
+  );
   return lines.join("\n");
 }
 
@@ -473,6 +491,12 @@ export function formatProfilesForDisplay(
         }`,
       );
     }
+    const dm = p.defaultModel;
+    lines.push(
+      `     ◦ default: ${
+        dm ? `${formatModelRef(dm)} (${dm.thinking})` : "(current Default-mode model)"
+      }`,
+    );
   }
   lines.push("");
   lines.push(