@gotgenes/pi-permission-system 16.0.2 → 16.2.0

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [16.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v16.1.0...pi-permission-system-v16.2.0) (2026-06-26)
+
+
+### Features
+
+* **pi-permission-system:** add ScopedPermissionManager.check(intent) ([#478](https://github.com/gotgenes/pi-packages/issues/478)) ([7cb600a](https://github.com/gotgenes/pi-packages/commit/7cb600a11efd4bc60bd31c70d85550c7e1b28058))
+* **pi-permission-system:** narrow ScopedPermissionResolver to resolve(intent) ([#478](https://github.com/gotgenes/pi-packages/issues/478)) ([908176f](https://github.com/gotgenes/pi-packages/commit/908176f8341e05d9181d5cf22ede10a6d5a470d0))
+
+
+### Documentation
+
+* **pi-permission-system:** record resolve(intent) narrowing ([#478](https://github.com/gotgenes/pi-packages/issues/478)) ([fb8f986](https://github.com/gotgenes/pi-packages/commit/fb8f986e15e5db20d84030d0f77b2aa4aad39aab))
+
+## [16.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v16.0.2...pi-permission-system-v16.1.0) (2026-06-26)
+
+
+### Features
+
+* **pi-permission-system:** introduce AccessPath value object ([c00d5c5](https://github.com/gotgenes/pi-packages/commit/c00d5c580a828234fafd7946be4e81313665d25d)), closes [#476](https://github.com/gotgenes/pi-packages/issues/476)
+
 ## [16.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v16.0.1...pi-permission-system-v16.0.2) (2026-06-25)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "16.0.2",
+  "version": "16.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/access-intent.ts

@@ -0,0 +1,57 @@
+import type { AccessPath } from "#src/access-intent/access-path";
+
+/**
+ * Raw tool input the manager must normalize (path / bash / MCP / extension tools).
+ *
+ * The `surface` is the tool name fed to `normalizeInput` (e.g. `"read"`, `"bash"`,
+ * an MCP server name).
+ */
+export interface ToolAccessIntent {
+  kind: "tool";
+  /** Tool name fed to input normalization. */
+  surface: string;
+  input: unknown;
+  agentName?: string;
+}
+
+/**
+ * Precomputed equivalent policy values for a path-shaped surface.
+ *
+ * Used by the bash-path gate (`path` surface), whose cd-resolved lexical
+ * `string[]` carry no canonical-boundary notion.
+ */
+export interface PathValuesAccessIntent {
+  kind: "path-values";
+  /** `"path"` or `"external_directory"`. */
+  surface: string;
+  values: readonly string[];
+  agentName?: string;
+}
+
+/**
+ * An `AccessPath` value object for a path-shaped surface.
+ *
+ * Used by the external-directory gates; lets `AccessPath` flow into the
+ * resolver as a first-class variant so the resolver — not the gate — asks it
+ * for `matchValues()` (Tell-Don't-Ask).
+ */
+export interface AccessPathAccessIntent {
+  kind: "access-path";
+  surface: string;
+  path: AccessPath;
+  agentName?: string;
+}
+
+/** What a gate emits — the full three-variant union. */
+export type AccessIntent =
+  | ToolAccessIntent
+  | PathValuesAccessIntent
+  | AccessPathAccessIntent;
+
+/**
+ * What the manager consumes — the `access-path` variant has already been
+ * unwrapped to `path-values` by the resolver via `path.matchValues()`.
+ *
+ * The manager stays string-based and never imports `AccessPath`.
+ */
+export type ResolvedAccessIntent = ToolAccessIntent | PathValuesAccessIntent;

package/src/access-intent/access-path.ts

@@ -0,0 +1,88 @@
+import {
+  canonicalNormalizePathForComparison,
+  getPathPolicyValues,
+  normalizePathForComparison,
+} from "#src/path-utils";
+
+/**
+ * A path's two representations held behind type-distinct accessors.
+ *
+ * A single `string` carrying both meanings was the root cause of [#418]:
+ * both external-directory gates matched config patterns against the
+ * symlink-resolved (canonical) path instead of the typed (lexical) path,
+ * defeating a configured `/tmp/*` allow.
+ *
+ * `AccessPath` makes the misuse a compile error:
+ * - {@link matchValues} returns `string[]` — the lexical alias union ∪ canonical,
+ *   for `external_directory` pattern matching.
+ * - {@link boundaryValue} returns `string` — the canonical form, for
+ *   outside-CWD containment and infra-read checks.
+ * - {@link value} returns `string` — the lexical absolute form, for display,
+ *   approval patterns, decision values, and logs.
+ *
+ * Construct via {@link forExternalDirectory}; the constructor is private.
+ */
+export class AccessPath {
+  private constructor(
+    private readonly lexical: string,
+    private readonly matchAliases: readonly string[],
+    private readonly canonical: string,
+  ) {}
+
+  /**
+   * Pattern-match values for the `external_directory` surface: the lexical
+   * alias union plus the canonical alias, so a config pattern on either the
+   * typed form (`/tmp/*`) or the symlink-resolved form (`/private/tmp/*`)
+   * matches (#418).
+   *
+   * Collapses to the lexical aliases when the canonical equals one of them
+   * (e.g. when the path is not a symlink).
+   */
+  matchValues(): string[] {
+    return this.canonical
+      ? [...new Set([...this.matchAliases, this.canonical])]
+      : [...this.matchAliases];
+  }
+
+  /**
+   * Canonical (symlink-resolved, win32-lowercased) form, for the outside-CWD
+   * boundary decision and Pi infrastructure-read containment checks.
+   *
+   * Returns `""` when the path could not be resolved (empty input).
+   */
+  boundaryValue(): string {
+    return this.canonical;
+  }
+
+  /**
+   * Lexical (as-typed, normalized but not symlink-resolved) form, for display,
+   * approval patterns, decision values, and log messages.
+   *
+   * Returns `""` for empty input.
+   */
+  value(): string {
+    return this.lexical;
+  }
+
+  /**
+   * Build an `AccessPath` for a tool-input or bash-token path resolved against
+   * `cwd`.
+   *
+   * - `matchValues()` returns the same set as the former
+   *   `getExternalDirectoryPolicyValues(pathValue, cwd)` — the lexical alias
+   *   union from `getPathPolicyValues` plus the canonical alias from
+   *   `canonicalNormalizePathForComparison` (#418).
+   * - `boundaryValue()` returns `canonicalNormalizePathForComparison(pathValue, cwd)`,
+   *   which is win32-lowercased (#382) — do not substitute a raw
+   *   `canonicalizePath` output here.
+   * - `value()` returns `normalizePathForComparison(pathValue, cwd)`, the
+   *   absolute lexical form.
+   */
+  static forExternalDirectory(pathValue: string, cwd: string): AccessPath {
+    return new AccessPath(
+      normalizePathForComparison(pathValue, cwd),
+      getPathPolicyValues(pathValue, { cwd }),
+      canonicalNormalizePathForComparison(pathValue, cwd),
+    );
+  }
+}

package/src/access-intent/bash/cwd-projection.ts

@@ -1,4 +1,5 @@
 import { isAbsolute, join, resolve } from "node:path";
+import { AccessPath } from "#src/access-intent/access-path";
 import {
   ARG_NODE_TYPES,
   SKIP_SUBTREE_TYPES,
@@ -409,11 +410,11 @@ function getPolicyValuesForRuleCandidate(
 export function projectExternalPaths(
   candidates: readonly PathCandidate[],
   cwd: string,
-): string[] {
+): AccessPath[] {
   const normalizedCwd = canonicalizePath(normalizePathForComparison(cwd, cwd));
 
   const seen = new Set<string>();
-  const externalPaths: string[] = [];
+  const externalPaths: AccessPath[] = [];
 
   for (const { token, base } of candidates) {
     const candidate = classifyTokenAsPathCandidate(token);
@@ -432,7 +433,9 @@ export function projectExternalPaths(
         !seen.has(canonical)
       ) {
         seen.add(canonical);
-        externalPaths.push(lexical);
+        // The factory recomputes the canonical via canonicalNormalizePathForComparison
+        // (win32-lowercased, #382) rather than reusing the raw canonicalizePath output.
+        externalPaths.push(AccessPath.forExternalDirectory(lexical, cwd));
       }
       continue;
     }
@@ -452,7 +455,9 @@ export function projectExternalPaths(
       !seen.has(canonical)
     ) {
       seen.add(canonical);
-      externalPaths.push(lexical);
+      // The factory recomputes the canonical via canonicalNormalizePathForComparison
+      // (win32-lowercased, #382) rather than reusing the raw canonicalizePath output.
+      externalPaths.push(AccessPath.forExternalDirectory(lexical, cwd));
     }
   }
 

package/src/access-intent/bash/program.ts

@@ -1,3 +1,4 @@
+import type { AccessPath } from "#src/access-intent/access-path";
 import {
   type BashCommand,
   collectCommands,
@@ -25,7 +26,7 @@ export type { BashCommand, BashPathRuleCandidate };
 export class BashProgram {
   private constructor(
     private readonly commandUnits: readonly BashCommand[],
-    private readonly resolvedExternalPaths: readonly string[],
+    private readonly resolvedExternalPaths: readonly AccessPath[],
     private readonly resolvedRuleCandidates: readonly BashPathRuleCandidate[],
   ) {}
 
@@ -73,16 +74,15 @@ export class BashProgram {
   }
 
   /**
-   * Deduplicated paths that resolve outside `cwd`, in their lexical (as-typed,
-   * normalized but not symlink-resolved) form.
+   * Deduplicated paths that resolve outside `cwd`, as {@link AccessPath} value
+   * objects holding both the lexical (as-typed) and canonical (symlink-resolved)
+   * forms behind distinct accessors.
    *
    * Resolved eagerly at parse time against the `cwd` supplied to `parse()`.
-   * The outside-`cwd` decision and the dedup identity use the canonical
-   * (symlink-resolved) form, but the returned value is the lexical form so
-   * `external_directory` config patterns match the path as the user typed it
-   * (#418); the gate re-derives the canonical alias for matching.
+   * Use `.matchValues()` for `external_directory` pattern matching and
+   * `.boundaryValue()` for containment checks; `.value()` for display and logs.
    */
-  externalPaths(): string[] {
+  externalPaths(): AccessPath[] {
     return [...this.resolvedExternalPaths];
   }
 

package/src/handlers/gates/bash-command.ts

@@ -38,7 +38,12 @@ export function resolveBashCommandCheck(
 ): PermissionCheckResult {
   if (commands.length === 0) {
     if (isTriviallyEmptyCommand(command)) {
-      return resolver.resolve("bash", { command }, agentName);
+      return resolver.resolve({
+        kind: "tool",
+        surface: "bash",
+        input: { command },
+        agentName,
+      });
     }
     return {
       state: "ask",
@@ -51,12 +56,22 @@ export function resolveBashCommandCheck(
   }
 
   const results = commands.map((cmd) => {
-    const result = resolver.resolve("bash", { command: cmd.text }, agentName);
+    const result = resolver.resolve({
+      kind: "tool",
+      surface: "bash",
+      input: { command: cmd.text },
+      agentName,
+    });
     return cmd.context ? { ...result, commandContext: cmd.context } : result;
   });
   return (
     pickMostRestrictive(results) ??
-    resolver.resolve("bash", { command }, agentName)
+    resolver.resolve({
+      kind: "tool",
+      surface: "bash",
+      input: { command },
+      agentName,
+    })
   );
 }
 

package/src/handlers/gates/bash-external-directory.ts

@@ -1,13 +1,11 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
-import { getExternalDirectoryPolicyValues } from "#src/path-utils";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
-import type { PermissionCheckResult } from "#src/types";
-import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
 import { formatBashExternalDirectoryAskPrompt } from "./external-directory-messages";
+import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -34,27 +32,17 @@ export function describeBashExternalDirectoryGate(
   const externalPaths = bashProgram.externalPaths();
   if (externalPaths.length === 0) return null;
 
-  // Collect paths whose resolved state is not already "allow".
-  // Checking state (not source) ensures config-level allow rules (source: "special")
-  // suppress the prompt just as session-level allow rules (source: "session") do.
-  const uncoveredEntries: Array<{
-    path: string;
-    check: PermissionCheckResult;
-  }> = [];
-  for (const p of externalPaths) {
-    // Match each path against both its typed and symlink-resolved aliases on
-    // the external_directory surface, so a config pattern on either form
-    // applies (#418).
-    const check = resolver.resolvePathPolicy(
-      getExternalDirectoryPolicyValues(p, tcc.cwd),
+  // Resolve every external path on the external_directory surface and keep the
+  // ones not already allowed (config-level allows suppress the prompt just as
+  // session-level allows do); the shared helper single-sources the #418 alias
+  // matching and the worst-uncovered selection.
+  const { uncovered: uncoveredEntries, worstCheck } =
+    selectUncoveredExternalPaths(
+      externalPaths,
+      resolver,
       tcc.agentName ?? undefined,
-      "external_directory",
     );
-    if (check.state !== "allow") {
-      uncoveredEntries.push({ path: p, check });
-    }
-  }
-  const uncoveredPaths = uncoveredEntries.map(({ path }) => path);
+  const uncoveredPaths = uncoveredEntries.map(({ path }) => path.value());
 
   if (uncoveredPaths.length === 0) {
     return {
@@ -67,19 +55,17 @@ export function describeBashExternalDirectoryGate(
           toolName: tcc.toolName,
           agentName: tcc.agentName,
           command,
-          externalPaths,
+          externalPaths: externalPaths.map((p) => p.value()),
           resolution: "session_approved",
         },
       },
     };
   }
 
-  // Use the most restrictive check among uncovered paths as the pre-check result.
-  // This ensures a config-level "deny" rule is not downgraded to "ask" by the
-  // generic "*" catch-all that the old path-less checkPermission call returned.
-  const worstCheck =
-    pickMostRestrictive(uncoveredEntries.map(({ check }) => check)) ??
-    uncoveredEntries[0].check;
+  // After the early bypass, at least one path is uncovered, so worstCheck is
+  // defined; the fallback keeps TypeScript happy across the early return. A
+  // config-level "deny" is preserved (not downgraded to the catch-all "ask").
+  const preCheck = worstCheck ?? uncoveredEntries[0].check;
 
   const bashExtMessage = formatBashExternalDirectoryAskPrompt(
     command,
@@ -122,6 +108,6 @@ export function describeBashExternalDirectoryGate(
       surface: "external_directory",
       value: command,
     },
-    preCheck: worstCheck,
+    preCheck,
   };
 }

package/src/handlers/gates/bash-path-extractor.ts

@@ -4,12 +4,18 @@ import { BashProgram } from "#src/access-intent/bash/program";
  * Extract paths from a bash command string that resolve outside CWD.
  *
  * Thin facade over {@link BashProgram.externalPaths}; parses the command and
- * returns the cd-aware external paths. See `BashProgram` for the parsing and
- * resolution semantics.
+ * returns the cd-aware external paths in their lexical (as-typed) string form.
+ * See `BashProgram` for the parsing and resolution semantics.
+ *
+ * Returns `string[]` (not `AccessPath[]`) so the large projection-correctness
+ * test suite in `bash-external-directory.test.ts` can assert path values
+ * without migrating every call site.
  */
 export async function extractExternalPathsFromBashCommand(
   command: string,
   cwd: string,
 ): Promise<string[]> {
-  return (await BashProgram.parse(command, cwd)).externalPaths();
+  return (await BashProgram.parse(command, cwd))
+    .externalPaths()
+    .map((p) => p.value());
 }

package/src/handlers/gates/bash-path.ts

@@ -51,10 +51,12 @@ export function describeBashPathGate(
   let allSessionCovered = true;
 
   for (const { token, policyValues } of candidates) {
-    const check = resolver.resolvePathPolicy(
-      policyValues,
-      tcc.agentName ?? undefined,
-    );
+    const check = resolver.resolve({
+      kind: "path-values",
+      surface: "path",
+      values: policyValues,
+      agentName: tcc.agentName ?? undefined,
+    });
 
     // No explicit path rule matched — only the universal default fired.
     // Treat this token as unrestricted to preserve backward compatibility

package/src/handlers/gates/external-directory-policy.ts

@@ -0,0 +1,66 @@
+import type { AccessPath } from "#src/access-intent/access-path";
+import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PermissionCheckResult } from "#src/types";
+import { pickMostRestrictive } from "./candidate-check";
+
+/** An external path whose resolved `external_directory` state is not "allow". */
+export interface UncoveredExternalPath {
+  path: AccessPath;
+  check: PermissionCheckResult;
+}
+
+/** The uncovered external paths plus the most restrictive check among them. */
+export interface UncoveredExternalPaths {
+  uncovered: UncoveredExternalPath[];
+  /** Worst check among uncovered paths; `undefined` only when none are uncovered. */
+  worstCheck: PermissionCheckResult | undefined;
+}
+
+/**
+ * Resolve one external path's policy on the `external_directory` surface.
+ *
+ * Emits an `access-path` {@link AccessIntent}; the resolver unwraps it via
+ * {@link AccessPath.matchValues} so a config pattern on either the typed or
+ * symlink-resolved alias applies (#418). This is the single source for the
+ * external-directory resolve that the two external-directory gates previously
+ * duplicated.
+ */
+export function resolveExternalDirectoryPolicy(
+  path: AccessPath,
+  resolver: ScopedPermissionResolver,
+  agentName: string | undefined,
+): PermissionCheckResult {
+  return resolver.resolve({
+    kind: "access-path",
+    surface: "external_directory",
+    path,
+    agentName,
+  });
+}
+
+/**
+ * Resolve a set of external paths and select those not already allowed.
+ *
+ * Each path is resolved via {@link resolveExternalDirectoryPolicy}; entries
+ * whose state is not "allow" are collected (filtering on state, not source, so
+ * config-level allow rules suppress the prompt just as session-level allow
+ * rules do), and the most restrictive uncovered check is returned so a config
+ * "deny" is not downgraded to the catch-all "ask".
+ */
+export function selectUncoveredExternalPaths(
+  paths: readonly AccessPath[],
+  resolver: ScopedPermissionResolver,
+  agentName: string | undefined,
+): UncoveredExternalPaths {
+  const uncovered: UncoveredExternalPath[] = [];
+  for (const path of paths) {
+    const check = resolveExternalDirectoryPolicy(path, resolver, agentName);
+    if (check.state !== "allow") {
+      uncovered.push({ path, check });
+    }
+  }
+  return {
+    uncovered,
+    worstCheck: pickMostRestrictive(uncovered.map(({ check }) => check)),
+  };
+}

package/src/handlers/gates/external-directory.ts

@@ -1,6 +1,5 @@
+import { AccessPath } from "#src/access-intent/access-path";
 import {
-  canonicalNormalizePathForComparison,
-  getExternalDirectoryPolicyValues,
   getToolInputPath,
   isPathOutsideWorkingDirectory,
   isPiInfrastructureRead,
@@ -12,6 +11,7 @@ import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { formatExternalDirectoryAskPrompt } from "./external-directory-messages";
+import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -42,10 +42,11 @@ export function describeExternalDirectoryGate(
   // The boundary decision (above) and the infrastructure-read containment
   // check (below) use the canonical, symlink-resolved path; pattern matching
   // uses the typed and resolved aliases (#418).
-  const canonicalExtPath = canonicalNormalizePathForComparison(
+  const accessPath = AccessPath.forExternalDirectory(
     externalDirectoryPath,
     tcc.cwd,
   );
+  const canonicalExtPath = accessPath.boundaryValue();
 
   // ── Pi infrastructure read bypass ──────────────────────────────────────
   if (
@@ -83,13 +84,11 @@ export function describeExternalDirectoryGate(
     tcc.agentName ?? undefined,
   );
 
-  // Match against both the typed and symlink-resolved aliases on the
-  // external_directory surface, so a config pattern on either form applies
-  // (#418). The runner consumes this preCheck and skips its own resolve.
-  const preCheck = resolver.resolvePathPolicy(
-    getExternalDirectoryPolicyValues(externalDirectoryPath, tcc.cwd),
+  // The runner consumes this preCheck and skips its own resolve.
+  const preCheck = resolveExternalDirectoryPolicy(
+    accessPath,
+    resolver,
     tcc.agentName ?? undefined,
-    "external_directory",
   );
   const pattern = deriveApprovalPattern(
     normalizePathForComparison(externalDirectoryPath, tcc.cwd),

package/src/handlers/gates/path.ts

@@ -22,11 +22,12 @@ export function describePathGate(
   const filePath = getToolInputPath(tcc.toolName, tcc.input, extractors);
   if (!filePath) return null;
 
-  const check = resolver.resolve(
-    "path",
-    { path: filePath },
-    tcc.agentName ?? undefined,
-  );
+  const check = resolver.resolve({
+    kind: "tool",
+    surface: "path",
+    input: { path: filePath },
+    agentName: tcc.agentName ?? undefined,
+  });
 
   if (check.state === "allow") return null;
 

package/src/handlers/gates/runner.ts

@@ -77,11 +77,12 @@ export class GateRunner {
         origin: "builtin",
       };
     } else {
-      check = this.resolver.resolve(
-        descriptor.surface,
-        descriptor.input,
-        agentName ?? undefined,
-      );
+      check = this.resolver.resolve({
+        kind: "tool",
+        surface: descriptor.surface,
+        input: descriptor.input,
+        agentName: agentName ?? undefined,
+      });
     }
 
     // 2. Session-hit fast path

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -102,11 +102,12 @@ export class ToolCallGatePipeline {
                 tcc.agentName ?? undefined,
                 this.resolver,
               )
-            : this.resolver.resolve(
-                tcc.toolName,
-                tcc.input,
-                tcc.agentName ?? undefined,
-              );
+            : this.resolver.resolve({
+                kind: "tool",
+                surface: tcc.toolName,
+                input: tcc.input,
+                agentName: tcc.agentName ?? undefined,
+              });
         const toolDescriptor = describeToolGate(tcc, toolCheck, formatter);
         toolDescriptor.preCheck = toolCheck;
         return toolDescriptor;

package/src/path-utils.ts

@@ -112,26 +112,6 @@ export function getPathPolicyValues(
   ];
 }
 
-/**
- * Equivalent `external_directory` policy-match values for a path: the lexical
- * (as-typed) alias list plus the canonical (symlink-resolved) absolute path.
- *
- * The outside-CWD boundary decision uses the canonical form separately; this
- * helper exists only for pattern matching, so a user's pattern on the typed
- * path (`/tmp/*`) and on the resolved path (`/private/tmp/*`) both match under
- * the last-match-wins alias evaluation. On systems where the path is not a
- * symlink the canonical form equals the lexical absolute alias and the `Set`
- * collapses it, leaving today's behavior unchanged.
- */
-export function getExternalDirectoryPolicyValues(
-  pathValue: string,
-  cwd: string,
-): string[] {
-  const lexical = getPathPolicyValues(pathValue, { cwd });
-  const canonical = canonicalNormalizePathForComparison(pathValue, cwd);
-  return canonical ? [...new Set([...lexical, canonical])] : lexical;
-}
-
 function getAbsolutePathPolicyValues(
   pathValue: string,
   options: PathPolicyValueOptions,

package/src/permission-event-rpc.ts

@@ -26,7 +26,7 @@ import {
   PERMISSIONS_RPC_CHECK_CHANNEL,
   PERMISSIONS_RPC_PROMPT_CHANNEL,
 } from "./permission-events";
-import type { PermissionManager } from "./permission-manager";
+import type { ScopedPermissionManager } from "./permission-manager";
 import { buildRpcUiPrompt } from "./permission-ui-prompt";
 import type { ReviewLogger } from "./session-logger";
 import type { SessionRules } from "./session-rules";
@@ -34,7 +34,7 @@ import type { SessionRules } from "./session-rules";
 /** Dependencies injected into the RPC handler registry. */
 export interface PermissionRpcDeps {
   /** The shared PermissionManager instance. */
-  permissionManager: Pick<PermissionManager, "checkPermission">;
+  permissionManager: Pick<ScopedPermissionManager, "check">;
   /** The shared SessionRules instance. */
   sessionRules: Pick<SessionRules, "getRuleset">;
   /**
@@ -109,10 +109,8 @@ function handleCheckRpc(
 
     const input = buildInputForSurface(surface, value);
     const sessionRules = deps.sessionRules.getRuleset();
-    const result = deps.permissionManager.checkPermission(
-      surface,
-      input,
-      agentName ?? undefined,
+    const result = deps.permissionManager.check(
+      { kind: "tool", surface, input, agentName: agentName ?? undefined },
       sessionRules,
     );