@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [18.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v18.1.2...pi-permission-system-v18.2.0) (2026-07-06)
+
+
+### Features
+
+* **pi-permission-system:** add yolo rule origin and ask→allow rewrite helper ([a4bbcc0](https://github.com/gotgenes/pi-packages/commit/a4bbcc0f25d57e31c7658e48ec5bc4465a4c1908))
+* **pi-permission-system:** auto-approve yolo-origin allow in the gate runner ([caf8419](https://github.com/gotgenes/pi-packages/commit/caf8419f835b37693678fccf77373a828f850386))
+* **pi-permission-system:** rewrite ask rules to yolo-origin allow at check time ([cd4e509](https://github.com/gotgenes/pi-packages/commit/cd4e509290aed701928890a6df585b383abbfc2b))
+
+## [18.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v18.1.1...pi-permission-system-v18.1.2) (2026-07-05)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** allow-list Git Bash POSIX paths via external_directory on win32 ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([5532a43](https://github.com/gotgenes/pi-packages/commit/5532a436d825625316c67f29b90f0ceb427d4b29))
+* **pi-permission-system:** fold Git Bash cd targets with MSYS semantics on win32 ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([5cb20b4](https://github.com/gotgenes/pi-packages/commit/5cb20b41db7c22c3344ab7f8a4fa39e89adb1e1a))
+* **pi-permission-system:** match Git Bash POSIX-absolute bash tokens as typed on win32 ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([095fa5e](https://github.com/gotgenes/pi-packages/commit/095fa5eaf774567cfae8f82d11b0224ace7bc5eb))
+* **pi-permission-system:** recognize POSIX device paths in bash commands on win32 ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([11ca70f](https://github.com/gotgenes/pi-packages/commit/11ca70fe845469d478fb47b12e8ff572930a1be4))
+* **pi-permission-system:** translate MSYS drive-mount bash tokens on win32 ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([2bf4e53](https://github.com/gotgenes/pi-packages/commit/2bf4e53674c48ac9591ffb21831eb82bc3cb77b8))
+
+
+### Documentation
+
+* **pi-permission-system:** document Git Bash path semantics on Windows ([#533](https://github.com/gotgenes/pi-packages/issues/533)) ([09afcb2](https://github.com/gotgenes/pi-packages/commit/09afcb241ea05938d88ffce8c3d6d34cbb821619))
+
 ## [18.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v18.1.0...pi-permission-system-v18.1.1) (2026-07-03)
 
 

package/docs/configuration.md

@@ -505,6 +505,17 @@ On Windows, path matching for `external_directory`, `path`, and the path-bearing
 A mixed-case allow override such as `~/AppData/Roaming/npm/node_modules/@earendil-works/pi-coding-agent/*` therefore matches a lowercased, backslash-normalized path value.
 POSIX matching remains case-sensitive.
 
+#### Git Bash / MSYS paths on Windows
+
+On Windows, Pi executes bash commands through Git Bash, so a bash token that looks like a POSIX absolute path carries MSYS mount semantics rather than native `node:path.win32` semantics.
+The `external_directory` and `path` gates interpret bash tokens accordingly (tool-input paths for `read`/`write`/`edit` keep native Windows semantics, since those tools resolve them through Node's filesystem):
+
+- The safe device paths (`/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`) are recognized as MSYS devices and never trigger the gate — the same exclusion that holds on POSIX, so `echo hi > /dev/null` does not prompt.
+- MSYS drive mounts (`/c/…`, `/d/…`) are translated to their Windows equivalent (`C:\…`), so a project file referenced through a mount is matched against its real Windows path and an in-CWD mount is not flagged.
+- Every other POSIX-absolute token (`/tmp/foo`, `/usr/bin`) has an install-dependent target this extension cannot resolve deterministically (Git Bash mounts `/tmp` to `%TEMP%`, MSYS2 to its own root), so it is treated as an external path matched and displayed exactly as typed, never rewritten to `C:\tmp\foo`.
+
+To allow-list such a path, write the rule using the path as typed — for example `external_directory: { "/tmp/*": "allow" }` — and the Windows separator folding above makes the forward-slash rule match the Git Bash token.
+
 ### Home Directory Expansion in Patterns
 
 Pattern keys in any permission surface can start with `~/` or `$HOME/` (or be exactly `~` / `$HOME`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "18.1.1",
+  "version": "18.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {
@@ -12,7 +12,6 @@
   },
   "files": [
     "src",
-    "test",
     "config/config.example.json",
     "schemas/permissions.schema.json",
     "docs/*.md",

package/src/access-intent/access-path.ts

@@ -118,10 +118,35 @@ export class AccessPath {
    * unknown (a relative bash token after a non-literal `cd`).
    *
    * Carries no canonical alias and no absolute resolution — `matchValues()` is
-   * `[literal]` (or `[]` when empty) and `boundaryValue()` is `""` — so no
-   * spurious absolute or symlink-resolved rule can match (#393).
+   * `[literal, ...matchAliases]` (or `[]` when empty) and `boundaryValue()` is
+   * `""` — so no spurious absolute or symlink-resolved rule can match (#393).
+   *
+   * `matchAliases` supplies extra match-only forms that do not change the
+   * display value: a win32 Git Bash POSIX absolute carries a backslash-separated
+   * alias so the separator-folding path matcher can match a `/tmp/*` rule (#533).
+   */
+  static forLiteral(
+    literal: string,
+    matchAliases: readonly string[] = [],
+  ): AccessPath {
+    if (!literal) return new AccessPath("", [], "");
+    const aliases = [...new Set([literal, ...matchAliases.filter(Boolean)])];
+    return new AccessPath(literal, aliases, "");
+  }
+
+  /**
+   * Build an `AccessPath` for a Git Bash/MSYS device path (`/dev/null`,
+   * `/dev/std{in,out,err}`) seen in a bash command on a win32 host.
+   *
+   * The token names an MSYS runtime device, not a filesystem path, so it is
+   * preserved verbatim across all three representations — `value()`,
+   * `boundaryValue()`, and `matchValues()` are the device path itself, never
+   * `win32.resolve`-mangled into `c:\dev\null`. The identical lexical and
+   * canonical forms let the boundary check reach `isSafeSystemPath` (so the
+   * device never triggers `external_directory`) while a config rule still
+   * matches the path as typed.
    */
-  static forLiteral(literal: string): AccessPath {
-    return new AccessPath(literal, literal ? [literal] : [], "");
+  static forDevice(devicePath: string): AccessPath {
+    return new AccessPath(devicePath, [devicePath], devicePath);
   }
 }

package/src/access-intent/bash/bash-path-resolver.ts

@@ -315,23 +315,34 @@ export class BashPathResolver {
    * Returns `base` unchanged unless the command is `cd`:
    *
    * - `cd /abs` (absolute literal) → a fresh known base, recovering from an
-   *   earlier unknown base.
+   *   earlier unknown base. On win32 a drive-mount target (`cd /c/x`) folds to
+   *   its translated Windows base, while a non-mount POSIX absolute
+   *   (`cd /tmp`) is not deterministically resolvable and yields unknown (#533).
    * - `cd rel` (relative literal) → fold into a known base, or stay unknown if
    *   the base was already unknown.
    * - `cd "$DIR"` / `cd $(…)` / `cd -` / bare `cd` / `cd ~…` (non-literal) →
    *   unknown.
+   *
+   * The target's platform/MSYS interpretation is delegated to the
+   * {@link PathNormalizer}; this method owns only the base-folding state.
    */
   private foldCd(commandNode: TSNode, base: EffectiveBase): EffectiveBase {
     if (extractCommandName(commandNode) !== "cd") return base;
     const target = cdLiteralTarget(commandNode);
     if (target === null) return UNKNOWN_BASE;
-    if (this.normalizer.isAbsolute(target))
-      return { kind: "known", offset: target };
-    if (base.kind === "unknown") return UNKNOWN_BASE;
-    return {
-      kind: "known",
-      offset: this.normalizer.joinBase(base.offset, target),
-    };
+    const interpreted = this.normalizer.interpretBashCdTarget(target);
+    switch (interpreted.kind) {
+      case "absolute":
+        return { kind: "known", offset: interpreted.value };
+      case "unknown":
+        return UNKNOWN_BASE;
+      case "relative":
+        if (base.kind === "unknown") return UNKNOWN_BASE;
+        return {
+          kind: "known",
+          offset: this.normalizer.joinBase(base.offset, target),
+        };
+    }
   }
 
   // ── Projection ─────────────────────────────────────────────────────────
@@ -376,19 +387,29 @@ export class BashPathResolver {
         base.kind === "known"
           ? this.normalizer.resolveBase(base.offset)
           : undefined;
-      const accessPath = this.normalizer.forPath(candidate, { resolveBase });
+      const accessPath = this.normalizer.forBashToken(candidate, {
+        resolveBase,
+      });
       const lexical = accessPath.value();
       if (!lexical) continue;
       // The boundary decision and dedup identity use the canonical
-      // (symlink-resolved) form, but the returned value is the lexical form so
-      // config patterns match the path as the user typed it (#418).
+      // (symlink-resolved) form the AccessPath already derived, but the returned
+      // value is the lexical form so config patterns match the path as the user
+      // typed it (#418). A win32 device path preserves `/dev/null` as its
+      // boundary value, so `isBoundaryOutsideWorkingDirectory` reaches the
+      // safe-path exclusion (#533).
       const canonical = accessPath.boundaryValue();
-
-      if (
-        this.normalizer.isOutsideWorkingDirectory(lexical) &&
-        !seen.has(canonical)
-      ) {
-        seen.add(canonical);
+      // A literal-only bash token (a win32 non-mount POSIX absolute like `/tmp`)
+      // has no canonical form; it is foreign to the win32 cwd, so it is always
+      // external. Its lexical value is the dedup identity so two distinct
+      // literal-only paths do not collapse (#533).
+      const isExternal = canonical
+        ? this.normalizer.isBoundaryOutsideWorkingDirectory(canonical)
+        : true;
+      const dedupKey = canonical || lexical;
+
+      if (isExternal && !seen.has(dedupKey)) {
+        seen.add(dedupKey);
         externalPaths.push(accessPath);
       }
     }
@@ -450,7 +471,7 @@ export class BashPathResolver {
       base.kind === "known"
         ? this.normalizer.resolveBase(base.offset)
         : undefined;
-    return this.normalizer.forPath(candidate, { resolveBase });
+    return this.normalizer.forBashToken(candidate, { resolveBase });
   }
 
   /**

package/src/access-intent/bash/msys-bash-tokens.ts

@@ -0,0 +1,64 @@
+/**
+ * Pure shape classifier for a bash-command token on a win32 host, where Pi core
+ * executes commands through Git Bash and POSIX-shaped absolute tokens carry
+ * MSYS mount semantics rather than `node:path.win32` semantics.
+ *
+ * Consumed only by {@link PathNormalizer.forBashToken}; kept as a standalone
+ * module so the shape knowledge is unit-testable in isolation (no filesystem,
+ * no platform read).
+ */
+import { isSafeSystemPath } from "#src/safe-system-paths";
+
+/**
+ * The MSYS interpretation of a win32 bash token:
+ *
+ * - `device` — a safe MSYS runtime device (`/dev/null`, `/dev/std{in,out,err}`);
+ *   never a filesystem path.
+ * - `drive-mount` — an MSYS drive mount (`/c/…`, `/d/…`); `windowsPath` is its
+ *   deterministic Windows equivalent (`C:\…`).
+ * - `posix-absolute` — any other absolute POSIX path (`/tmp/foo`, `/usr/bin`);
+ *   its Windows target is install-dependent and not deterministically knowable,
+ *   so it is treated literally.
+ * - `plain` — everything else (relative tokens, `~/…`, native Windows drive
+ *   paths); handled by ordinary win32 resolution.
+ */
+export type Win32BashTokenKind =
+  | { kind: "device" }
+  | { kind: "drive-mount"; windowsPath: string }
+  | { kind: "posix-absolute" }
+  | { kind: "plain" };
+
+/**
+ * A single-letter first path segment identifies an MSYS drive mount: `/c`,
+ * `/c/`, or `/c/rest`. A multi-letter first segment (`/dev`, `/tmp`) is not a
+ * mount. The device set is checked before this pattern, so `/dev/*` never
+ * reaches it.
+ */
+const MSYS_DRIVE_MOUNT_PATTERN = /^\/([a-zA-Z])(\/.*)?$/;
+
+export function classifyWin32BashToken(token: string): Win32BashTokenKind {
+  if (isSafeSystemPath(token)) return { kind: "device" };
+
+  const driveMatch = MSYS_DRIVE_MOUNT_PATTERN.exec(token);
+  if (driveMatch) {
+    return {
+      kind: "drive-mount",
+      windowsPath: toWindowsDrivePath(driveMatch[1], driveMatch[2]),
+    };
+  }
+
+  if (token.startsWith("/")) return { kind: "posix-absolute" };
+
+  return { kind: "plain" };
+}
+
+/**
+ * Build the Windows equivalent of an MSYS drive mount: uppercase drive letter,
+ * `:\`, and the remainder with `/` separators rewritten to `\`. A bare or
+ * trailing-slash mount (`/c`, `/c/`) maps to the drive root (`C:\`).
+ */
+function toWindowsDrivePath(letter: string, rest: string | undefined): string {
+  const drive = `${letter.toUpperCase()}:`;
+  const tail = (rest ?? "").replace(/^\//, "").replaceAll("/", "\\");
+  return tail ? `${drive}\\${tail}` : `${drive}\\`;
+}

package/src/extension-config.ts

@@ -66,6 +66,13 @@ export function normalizePermissionSystemConfig(
   return result;
 }
 
+export function isYoloModeEnabled(
+  config: PermissionSystemExtensionConfig,
+): boolean {
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion -- typed as boolean but may be undefined at runtime (untyped callers); Boolean() guards against that
+  return Boolean(config.yoloMode);
+}
+
 export function ensurePermissionSystemLogsDirectory(
   logsDir: string,
 ): string | undefined {

package/src/forwarded-permissions/permission-forwarder.ts

@@ -6,6 +6,7 @@ import {
   type SessionEntryView,
 } from "#src/active-agent";
 import type { ConfigReader } from "#src/config-store";
+import { isYoloModeEnabled } from "#src/extension-config";
 import type {
   PermissionDecisionUi,
   PermissionPromptDecision,
@@ -31,7 +32,6 @@ import type { DebugReviewLogger } from "#src/session-logger";
 import { isSubagentExecutionContext } from "#src/subagent-context";
 import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import { toRecord } from "#src/value-guards";
-import { shouldAutoApprovePermissionState } from "#src/yolo-mode";
 
 import {
   cleanupPermissionForwardingLocationIfEmpty,
@@ -90,7 +90,7 @@ export interface PermissionForwarderDeps {
     message: string,
     options?: RequestPermissionOptions,
   ) => Promise<PermissionPromptDecision>;
-  /** Read current config for yolo-mode auto-approve check (called at prompt time). */
+  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
   config: ConfigReader;
 }
 
@@ -506,7 +506,10 @@ export class PermissionForwarder implements ApprovalRequester, InboxProcessor {
       approved: false,
       state: "denied",
     };
-    if (shouldAutoApprovePermissionState("ask", this.config.current())) {
+    // Last yolo check outside the composed ruleset: dissolves when
+    // processInbox is refactored onto evaluate() + Authorizer selection in
+    // the Phase 9 spine work.
+    if (isYoloModeEnabled(this.config.current())) {
       this.logger.review(
         "forwarded_permission.auto_approved",
         forwardedPermissionLogDetails,

package/src/handlers/gates/helpers.ts

@@ -62,7 +62,7 @@ export function deriveResolution(
   canConfirm: boolean,
   autoApproved = false,
 ): PermissionDecisionResolution {
-  if (state === "allow") return "policy_allow";
+  if (state === "allow") return autoApproved ? "auto_approved" : "policy_allow";
   if (state === "deny") return "policy_deny";
   // state === "ask"
   if (action === "allow") {

package/src/handlers/gates/runner.ts

@@ -105,6 +105,28 @@ export class GateRunner {
       return { action: "allow" };
     }
 
+    // 2b. Yolo fast-path — a composition-stage ask→allow rewrite records
+    // origin "yolo" on the matched rule. Auto-approve without prompting,
+    // preserving today's single auto_approved review entry + decision event
+    // so review-log parity holds (#526).
+    if (check.state === "allow" && check.origin === "yolo") {
+      this.reporter.writeReviewLog("permission_request.auto_approved", {
+        ...descriptor.logContext,
+        agentName,
+        resolution: "auto_approved",
+      });
+      this.reporter.emitDecision(
+        buildDecisionEvent(
+          descriptor.decision,
+          check,
+          agentName,
+          "allow",
+          deriveResolution(check.state, "allow", false, false, true),
+        ),
+      );
+      return { action: "allow" };
+    }
+
     // 3. Apply the deny/ask/allow gate
     const canConfirm = this.prompter.canConfirm();
 

package/src/index.ts

@@ -6,6 +6,7 @@ import { getGlobalConfigPath } from "./config-paths";
 import { ConfigStore } from "./config-store";
 import { DecisionAudit } from "./decision-audit";
 import { GateDecisionReporter } from "./decision-reporter";
+import { isYoloModeEnabled } from "./extension-config";
 import { computeExtensionPaths } from "./extension-paths";
 import {
   PermissionForwarder,
@@ -46,10 +47,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // session (PathNormalizer) and, later, rule evaluation. Interior modules must
   // not read process.platform (enforced by the eslint guard scoped to src/).
   const hostPlatform = process.platform;
-  const permissionManager = new PermissionManager({
-    agentDir,
-    platform: hostPlatform,
-  });
   const sessionRules = new SessionRules();
   const subagentRegistry = getSubagentSessionRegistry();
   const formatterRegistry = new ToolInputFormatterRegistry();
@@ -65,6 +62,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // eslint-disable-next-line prefer-const -- forward-declared let; `const` requires an initializer
   let session: PermissionSession;
 
+  // Constructed after the `configStore` forward declaration so the yolo reader
+  // can close over it; the closure runs per check(), after configStore is
+  // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
+  const permissionManager = new PermissionManager({
+    agentDir,
+    platform: hostPlatform,
+    isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
+  });
+
   const logger = new PermissionSessionLogger({
     globalLogsDir: paths.globalLogsDir,
     getConfig: () => configStore.current(),
@@ -90,14 +96,12 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const forwarder = new PermissionForwarder(forwardingDeps);
 
   const prompter = new PermissionPrompter({
-    config: configStore,
     logger,
     events: pi.events,
     forwarder,
   });
 
   const gateway = new PromptingGateway({
-    config: configStore,
     subagentSessionsDir: paths.subagentSessionsDir,
     platform: hostPlatform,
     registry: subagentRegistry,

package/src/path-normalizer.ts

@@ -1,9 +1,11 @@
 import { posix as posixPath, win32 as winPath } from "node:path";
 
 import { AccessPath } from "./access-intent/access-path";
+import { classifyWin32BashToken } from "./access-intent/bash/msys-bash-tokens";
 import {
   canonicalNormalizePathForComparison,
   normalizePathForComparison,
+  normalizePathPolicyLiteral,
 } from "./access-intent/path-normalization";
 import {
   isPathOutsideWorkingDirectory,
@@ -11,6 +13,22 @@ import {
 } from "./path-containment";
 import { isPiInfrastructureRead } from "./pi-infrastructure-read";
 
+/**
+ * The interpreted effect of a literal `cd` target on the effective base, under
+ * the host platform's (and, on win32, Git Bash's) semantics.
+ *
+ * - `absolute` — the target names a resolvable absolute base (`value`); an
+ *   earlier unknown base is recovered.
+ * - `relative` — the target folds into the current base.
+ * - `unknown` — the target is not deterministically resolvable (a win32
+ *   non-mount POSIX absolute like `cd /tmp`, or a device), so the base becomes
+ *   conservatively unknown.
+ */
+export type BashCdTarget =
+  | { readonly kind: "absolute"; readonly value: string }
+  | { readonly kind: "relative" }
+  | { readonly kind: "unknown" };
+
 /**
  * Path-interpretation collaborator, constructed once at the session edge with
  * the two ambient inputs — the host `platform` and the session `cwd` — baked
@@ -47,8 +65,46 @@ export class PathNormalizer {
   }
 
   /** Build a literal-only AccessPath (unknown base after a non-literal `cd`). */
-  forLiteral(literal: string): AccessPath {
-    return AccessPath.forLiteral(literal);
+  forLiteral(literal: string, matchAliases?: readonly string[]): AccessPath {
+    return AccessPath.forLiteral(literal, matchAliases);
+  }
+
+  /**
+   * Build an AccessPath for a bash-command token, applying Git Bash/MSYS
+   * semantics on a win32 host.
+   *
+   * Pi core always executes bash through Git Bash on Windows, so a POSIX-shaped
+   * absolute token carries MSYS semantics, not `node:path.win32` semantics. On
+   * win32 the recognized safe device paths (`/dev/null`, `/dev/std{in,out,err}`)
+   * are preserved verbatim as devices instead of being resolved into
+   * `c:\dev\null`, and MSYS drive mounts (`/c/…`) are translated to their
+   * Windows equivalent (`C:\…`) before resolution; every other token delegates
+   * to {@link forPath}. On POSIX this is a straight delegation to
+   * {@link forPath}.
+   */
+  forBashToken(token: string, options?: { resolveBase?: string }): AccessPath {
+    if (this.platform !== "win32") return this.forPath(token, options);
+
+    const shape = classifyWin32BashToken(token);
+    switch (shape.kind) {
+      case "device":
+        return AccessPath.forDevice(token);
+      case "drive-mount":
+        return this.forPath(shape.windowsPath, options);
+      case "posix-absolute": {
+        // A non-mount POSIX absolute (`/tmp`, `/usr`) has an install-dependent
+        // Windows target this package cannot know, so it is kept literal: always
+        // external, matched and displayed as typed, never fabricated into
+        // `c:\tmp` (#533). The win32 path matcher folds a rule's separators
+        // (`/` -> `\`), so a forward-slash value is unmatchable; carry a
+        // backslash match alias so a natural `/tmp/*` external_directory rule
+        // still resolves, while `value()` stays as typed for display.
+        const literal = normalizePathPolicyLiteral(token);
+        return this.forLiteral(literal, [literal.replaceAll("/", "\\")]);
+      }
+      case "plain":
+        return this.forPath(token, options);
+    }
   }
 
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
@@ -56,6 +112,36 @@ export class PathNormalizer {
     return this.impl.isAbsolute(pathValue);
   }
 
+  /**
+   * Interpret a literal `cd` target's effect on the effective base.
+   *
+   * On win32 the target carries Git Bash/MSYS semantics: a drive mount
+   * (`cd /c/x`) resolves to a translated Windows base (`C:\x`), a non-mount
+   * POSIX absolute (`cd /tmp`) is not deterministically resolvable and yields an
+   * `unknown` base, and a native/relative target is handled as usual. On POSIX
+   * an absolute target is absolute and everything else is relative.
+   */
+  interpretBashCdTarget(target: string): BashCdTarget {
+    if (this.platform !== "win32") {
+      return this.impl.isAbsolute(target)
+        ? { kind: "absolute", value: target }
+        : { kind: "relative" };
+    }
+
+    const shape = classifyWin32BashToken(target);
+    switch (shape.kind) {
+      case "drive-mount":
+        return { kind: "absolute", value: shape.windowsPath };
+      case "device":
+      case "posix-absolute":
+        return { kind: "unknown" };
+      case "plain":
+        return this.impl.isAbsolute(target)
+          ? { kind: "absolute", value: target }
+          : { kind: "relative" };
+    }
+  }
+
   /** Resolve a `cd`-folded offset against the baked cwd (platform-aware). */
   resolveBase(offset: string): string {
     return this.impl.resolve(this.cwd, offset);
@@ -85,6 +171,23 @@ export class PathNormalizer {
     );
   }
 
+  /**
+   * Outside-cwd test for an already-canonical boundary value (from
+   * {@link AccessPath.boundaryValue}), against the baked cwd.
+   *
+   * Unlike {@link isOutsideWorkingDirectory}, it does not re-derive the
+   * canonical form — the caller passes a value the {@link AccessPath} already
+   * canonicalized, so a device's preserved `/dev/null` reaches the pure check's
+   * `isSafeSystemPath` exclusion intact.
+   */
+  isBoundaryOutsideWorkingDirectory(canonicalPath: string): boolean {
+    return isPathOutsideWorkingDirectory(
+      canonicalPath,
+      this.canonicalCwd,
+      this.platform,
+    );
+  }
+
   /**
    * Lexical (not symlink-resolved) comparison value, resolved against the baked
    * cwd. Mirrors the as-typed absolute form used for skill-prompt matching;

package/src/permission-manager.ts

@@ -20,6 +20,7 @@ import {
   evaluateAnyValue,
   evaluateFirst,
   pathMatchOptions,
+  rewriteAsksToYolo,
 } from "./rule";
 import { mergeScopesWithOrigins } from "./scope-merge";
 import {
@@ -53,6 +54,9 @@ const DEFAULT_UNIVERSAL_FALLBACK: PermissionState = "ask";
 /** Promotion predicate matching no token — the no-`path`-rules default (#509). */
 const NO_PROMOTION: PathRuleTokenMatcher = () => false;
 
+/** Default yolo reader — yolo disabled unless the composition root injects one. */
+const YOLO_DISABLED = (): boolean => false;
+
 type FileCacheEntry<TValue> = {
   stamp: string;
   value: TValue;
@@ -110,11 +114,20 @@ export interface PermissionManagerOptions extends PolicyLoaderOptions {
    * Defaults to a POSIX flavor; production always supplies the real platform.
    */
   platform?: NodeJS.Platform;
+  /**
+   * yolo-mode reader, injected from the composition root. When it reports
+   * true, {@link PermissionManager.check} rewrites every matched `ask` to a
+   * standing `allow` tagged `origin: "yolo"` (recorded authority, #526).
+   * Read per check so a mid-session config change takes effect; defaults to
+   * yolo disabled.
+   */
+  isYoloEnabled?: () => boolean;
 }
 
 export class PermissionManager implements ScopedPermissionManager {
   private readonly agentDir: string | undefined;
   private readonly platform: NodeJS.Platform;
+  private readonly isYoloEnabled: () => boolean;
   private loader: PolicyLoader;
   private readonly resolvedPermissionsCache = new Map<
     string,
@@ -124,6 +137,7 @@ export class PermissionManager implements ScopedPermissionManager {
   constructor(options: PermissionManagerOptions = {}) {
     this.agentDir = options.agentDir;
     this.platform = options.platform ?? "linux";
+    this.isYoloEnabled = options.isYoloEnabled ?? YOLO_DISABLED;
     this.loader =
       options.policyLoader ??
       new FilePolicyLoader(
@@ -311,9 +325,15 @@ export class PermissionManager implements ScopedPermissionManager {
     sessionRules?: Ruleset,
   ): PermissionCheckResult {
     const { composedRules } = this.resolvePermissions(intent.agentName);
-    const fullRules: Ruleset = sessionRules?.length
+    const composedWithSession: Ruleset = sessionRules?.length
       ? [...composedRules, ...sessionRules]
       : composedRules;
+    // Apply the yolo rewrite post-cache so the resolved-permissions cache and
+    // the display surfaces (getComposedConfigRules / getToolPermission) stay
+    // yolo-free — only the resolution path sees the ask→allow rewrite (#526).
+    const fullRules: Ruleset = this.isYoloEnabled()
+      ? rewriteAsksToYolo(composedWithSession)
+      : composedWithSession;
 
     if (intent.kind === "path-values") {
       const lookupValues =