@gotgenes/pi-permission-system 18.1.2 → 18.2.0

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [18.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v18.1.2...pi-permission-system-v18.2.0) (2026-07-06)
+
+
+### Features
+
+* **pi-permission-system:** add yolo rule origin and ask→allow rewrite helper ([a4bbcc0](https://github.com/gotgenes/pi-packages/commit/a4bbcc0f25d57e31c7658e48ec5bc4465a4c1908))
+* **pi-permission-system:** auto-approve yolo-origin allow in the gate runner ([caf8419](https://github.com/gotgenes/pi-packages/commit/caf8419f835b37693678fccf77373a828f850386))
+* **pi-permission-system:** rewrite ask rules to yolo-origin allow at check time ([cd4e509](https://github.com/gotgenes/pi-packages/commit/cd4e509290aed701928890a6df585b383abbfc2b))
+
 ## [18.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v18.1.1...pi-permission-system-v18.1.2) (2026-07-05)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "18.1.2",
+  "version": "18.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/extension-config.ts

@@ -66,6 +66,13 @@ export function normalizePermissionSystemConfig(
   return result;
 }
 
+export function isYoloModeEnabled(
+  config: PermissionSystemExtensionConfig,
+): boolean {
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion -- typed as boolean but may be undefined at runtime (untyped callers); Boolean() guards against that
+  return Boolean(config.yoloMode);
+}
+
 export function ensurePermissionSystemLogsDirectory(
   logsDir: string,
 ): string | undefined {

package/src/forwarded-permissions/permission-forwarder.ts

@@ -6,6 +6,7 @@ import {
   type SessionEntryView,
 } from "#src/active-agent";
 import type { ConfigReader } from "#src/config-store";
+import { isYoloModeEnabled } from "#src/extension-config";
 import type {
   PermissionDecisionUi,
   PermissionPromptDecision,
@@ -31,7 +32,6 @@ import type { DebugReviewLogger } from "#src/session-logger";
 import { isSubagentExecutionContext } from "#src/subagent-context";
 import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import { toRecord } from "#src/value-guards";
-import { shouldAutoApprovePermissionState } from "#src/yolo-mode";
 
 import {
   cleanupPermissionForwardingLocationIfEmpty,
@@ -90,7 +90,7 @@ export interface PermissionForwarderDeps {
     message: string,
     options?: RequestPermissionOptions,
   ) => Promise<PermissionPromptDecision>;
-  /** Read current config for yolo-mode auto-approve check (called at prompt time). */
+  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
   config: ConfigReader;
 }
 
@@ -506,7 +506,10 @@ export class PermissionForwarder implements ApprovalRequester, InboxProcessor {
       approved: false,
       state: "denied",
     };
-    if (shouldAutoApprovePermissionState("ask", this.config.current())) {
+    // Last yolo check outside the composed ruleset: dissolves when
+    // processInbox is refactored onto evaluate() + Authorizer selection in
+    // the Phase 9 spine work.
+    if (isYoloModeEnabled(this.config.current())) {
       this.logger.review(
         "forwarded_permission.auto_approved",
         forwardedPermissionLogDetails,

package/src/handlers/gates/helpers.ts

@@ -62,7 +62,7 @@ export function deriveResolution(
   canConfirm: boolean,
   autoApproved = false,
 ): PermissionDecisionResolution {
-  if (state === "allow") return "policy_allow";
+  if (state === "allow") return autoApproved ? "auto_approved" : "policy_allow";
   if (state === "deny") return "policy_deny";
   // state === "ask"
   if (action === "allow") {

package/src/handlers/gates/runner.ts

@@ -105,6 +105,28 @@ export class GateRunner {
       return { action: "allow" };
     }
 
+    // 2b. Yolo fast-path — a composition-stage ask→allow rewrite records
+    // origin "yolo" on the matched rule. Auto-approve without prompting,
+    // preserving today's single auto_approved review entry + decision event
+    // so review-log parity holds (#526).
+    if (check.state === "allow" && check.origin === "yolo") {
+      this.reporter.writeReviewLog("permission_request.auto_approved", {
+        ...descriptor.logContext,
+        agentName,
+        resolution: "auto_approved",
+      });
+      this.reporter.emitDecision(
+        buildDecisionEvent(
+          descriptor.decision,
+          check,
+          agentName,
+          "allow",
+          deriveResolution(check.state, "allow", false, false, true),
+        ),
+      );
+      return { action: "allow" };
+    }
+
     // 3. Apply the deny/ask/allow gate
     const canConfirm = this.prompter.canConfirm();
 

package/src/index.ts

@@ -6,6 +6,7 @@ import { getGlobalConfigPath } from "./config-paths";
 import { ConfigStore } from "./config-store";
 import { DecisionAudit } from "./decision-audit";
 import { GateDecisionReporter } from "./decision-reporter";
+import { isYoloModeEnabled } from "./extension-config";
 import { computeExtensionPaths } from "./extension-paths";
 import {
   PermissionForwarder,
@@ -46,10 +47,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // session (PathNormalizer) and, later, rule evaluation. Interior modules must
   // not read process.platform (enforced by the eslint guard scoped to src/).
   const hostPlatform = process.platform;
-  const permissionManager = new PermissionManager({
-    agentDir,
-    platform: hostPlatform,
-  });
   const sessionRules = new SessionRules();
   const subagentRegistry = getSubagentSessionRegistry();
   const formatterRegistry = new ToolInputFormatterRegistry();
@@ -65,6 +62,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // eslint-disable-next-line prefer-const -- forward-declared let; `const` requires an initializer
   let session: PermissionSession;
 
+  // Constructed after the `configStore` forward declaration so the yolo reader
+  // can close over it; the closure runs per check(), after configStore is
+  // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
+  const permissionManager = new PermissionManager({
+    agentDir,
+    platform: hostPlatform,
+    isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
+  });
+
   const logger = new PermissionSessionLogger({
     globalLogsDir: paths.globalLogsDir,
     getConfig: () => configStore.current(),
@@ -90,14 +96,12 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const forwarder = new PermissionForwarder(forwardingDeps);
 
   const prompter = new PermissionPrompter({
-    config: configStore,
     logger,
     events: pi.events,
     forwarder,
   });
 
   const gateway = new PromptingGateway({
-    config: configStore,
     subagentSessionsDir: paths.subagentSessionsDir,
     platform: hostPlatform,
     registry: subagentRegistry,

package/src/permission-manager.ts

@@ -20,6 +20,7 @@ import {
   evaluateAnyValue,
   evaluateFirst,
   pathMatchOptions,
+  rewriteAsksToYolo,
 } from "./rule";
 import { mergeScopesWithOrigins } from "./scope-merge";
 import {
@@ -53,6 +54,9 @@ const DEFAULT_UNIVERSAL_FALLBACK: PermissionState = "ask";
 /** Promotion predicate matching no token — the no-`path`-rules default (#509). */
 const NO_PROMOTION: PathRuleTokenMatcher = () => false;
 
+/** Default yolo reader — yolo disabled unless the composition root injects one. */
+const YOLO_DISABLED = (): boolean => false;
+
 type FileCacheEntry<TValue> = {
   stamp: string;
   value: TValue;
@@ -110,11 +114,20 @@ export interface PermissionManagerOptions extends PolicyLoaderOptions {
    * Defaults to a POSIX flavor; production always supplies the real platform.
    */
   platform?: NodeJS.Platform;
+  /**
+   * yolo-mode reader, injected from the composition root. When it reports
+   * true, {@link PermissionManager.check} rewrites every matched `ask` to a
+   * standing `allow` tagged `origin: "yolo"` (recorded authority, #526).
+   * Read per check so a mid-session config change takes effect; defaults to
+   * yolo disabled.
+   */
+  isYoloEnabled?: () => boolean;
 }
 
 export class PermissionManager implements ScopedPermissionManager {
   private readonly agentDir: string | undefined;
   private readonly platform: NodeJS.Platform;
+  private readonly isYoloEnabled: () => boolean;
   private loader: PolicyLoader;
   private readonly resolvedPermissionsCache = new Map<
     string,
@@ -124,6 +137,7 @@ export class PermissionManager implements ScopedPermissionManager {
   constructor(options: PermissionManagerOptions = {}) {
     this.agentDir = options.agentDir;
     this.platform = options.platform ?? "linux";
+    this.isYoloEnabled = options.isYoloEnabled ?? YOLO_DISABLED;
     this.loader =
       options.policyLoader ??
       new FilePolicyLoader(
@@ -311,9 +325,15 @@ export class PermissionManager implements ScopedPermissionManager {
     sessionRules?: Ruleset,
   ): PermissionCheckResult {
     const { composedRules } = this.resolvePermissions(intent.agentName);
-    const fullRules: Ruleset = sessionRules?.length
+    const composedWithSession: Ruleset = sessionRules?.length
       ? [...composedRules, ...sessionRules]
       : composedRules;
+    // Apply the yolo rewrite post-cache so the resolved-permissions cache and
+    // the display surfaces (getComposedConfigRules / getToolPermission) stay
+    // yolo-free — only the resolution path sees the ask→allow rewrite (#526).
+    const fullRules: Ruleset = this.isYoloEnabled()
+      ? rewriteAsksToYolo(composedWithSession)
+      : composedWithSession;
 
     if (intent.kind === "path-values") {
       const lookupValues =

package/src/permission-prompter.ts

@@ -1,5 +1,4 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ConfigReader } from "./config-store";
 import type { ApprovalRequester } from "./forwarded-permissions/permission-forwarder";
 import type { PermissionPromptDecision } from "./permission-dialog";
 import {
@@ -8,7 +7,6 @@ import {
 } from "./permission-events";
 import { buildDirectUiPrompt } from "./permission-ui-prompt";
 import type { ReviewLogger } from "./session-logger";
-import { shouldAutoApprovePermissionState } from "./yolo-mode";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
@@ -40,13 +38,11 @@ export interface PermissionPrompterApi {
 /**
  * Dependencies required by PermissionPrompter.
  *
- * Keeps the prompter's external surface narrow: callers provide config
- * access, a review logger, the UI-prompt event bus, and the forwarder
- * that owns the UI/subagent-forwarding branching logic.
+ * Keeps the prompter's external surface narrow: callers provide a review
+ * logger, the UI-prompt event bus, and the forwarder that owns the
+ * UI/subagent-forwarding branching logic.
  */
 export interface PermissionPrompterDeps {
-  /** Read current config for yolo-mode check (called at prompt time). */
-  config: ConfigReader;
   /** Write structured entries to the permission review log. */
   logger: ReviewLogger;
   /** Event bus used for UI prompt broadcasts. */
@@ -57,10 +53,13 @@ export interface PermissionPrompterDeps {
 
 /**
  * Encapsulates the full permission-prompt flow:
- *   1. Yolo-mode auto-approval check.
- *   2. Review-log "waiting" entry.
- *   3. UI-present vs. subagent-forwarding branching (via confirmPermission).
- *   4. Review-log "approved" / "denied" entry.
+ *   1. Review-log "waiting" entry.
+ *   2. UI-present vs. subagent-forwarding branching (via confirmPermission).
+ *   3. Review-log "approved" / "denied" entry.
+ *
+ * Yolo-mode auto-approval happens upstream, at the composition stage
+ * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
+ * this class under yolo, so this class has no yolo-mode knowledge.
  *
  * Injecting a single PermissionPrompter instance means adding a new prompt
  * parameter (e.g. a future sessionLabel variant) only requires changing
@@ -73,11 +72,6 @@ export class PermissionPrompter implements PermissionPrompterApi {
     ctx: ExtensionContext,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    if (shouldAutoApprovePermissionState("ask", this.deps.config.current())) {
-      this.writeReviewEntry("permission_request.auto_approved", details);
-      return { approved: true, state: "approved", autoApproved: true };
-    }
-
     this.writeReviewEntry("permission_request.waiting", details);
 
     // Build the event once. When this session has UI it broadcasts directly;

package/src/prompting-gateway.ts

@@ -1,6 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
-import type { ConfigReader } from "./config-store";
 import type { GatePrompter } from "./gate-prompter";
 import type { PermissionPromptDecision } from "./permission-dialog";
 import type {
@@ -9,18 +8,15 @@ import type {
 } from "./permission-prompter";
 import { isSubagentExecutionContext } from "./subagent-context";
 import type { SubagentSessionRegistry } from "./subagent-registry";
-import { canResolveAskPermissionRequest } from "./yolo-mode";
 
 /**
  * Dependencies required by PromptingGateway.
  *
- * All four fields are actively consumed:
- * - `config` + `subagentSessionsDir` + `registry` drive `canConfirm()`.
+ * All fields are actively consumed:
+ * - `subagentSessionsDir` + `registry` drive `canConfirm()`.
  * - `prompter` is called by `prompt()`.
  */
 export interface PromptingGatewayDeps {
-  /** Read current config for the yolo-mode branch of the can-prompt policy. */
-  config: ConfigReader;
   /** Static path used to detect a forwarding subagent context. */
   subagentSessionsDir: string;
   /** Host platform, injected from the composition root, for subagent-context path detection. */
@@ -46,8 +42,8 @@ export interface PromptingGatewayLifecycle {
  * Context-owning implementation of the GatePrompter role.
  *
  * Owns the stored ExtensionContext and the "can we prompt?" policy
- * (UI / subagent / yolo-mode), replacing the four twin methods
- * that previously lived on PermissionSession.
+ * (UI / subagent), replacing the four twin methods that previously
+ * lived on PermissionSession.
  *
  * Lifecycle: PermissionSession drives activate/deactivate so the stored
  * context mirrors the session context without independent call-site changes.
@@ -72,22 +68,22 @@ export class PromptingGateway
   /**
    * Whether an interactive permission prompt can be shown.
    *
-   * Returns false when no context is active. Otherwise delegates to
-   * canResolveAskPermissionRequest, which checks hasUI, subagent status,
-   * and yolo-mode — relocating the policy from the index.ts closure.
+   * Returns false when no context is active. Otherwise true when the
+   * context has UI or is a forwarding subagent — the two Authorizer-
+   * selection predicates the Phase 9 spine will consume. Yolo-mode never
+   * reaches this policy: it is resolved upstream at the composition stage.
    */
   canConfirm(): boolean {
     if (this.context === null) return false;
-    return canResolveAskPermissionRequest({
-      config: this.deps.config.current(),
-      hasUI: this.context.hasUI,
-      isSubagent: isSubagentExecutionContext(
+    return (
+      this.context.hasUI ||
+      isSubagentExecutionContext(
         this.context,
         this.deps.subagentSessionsDir,
         this.deps.platform,
         this.deps.registry,
-      ),
-    });
+      )
+    );
   }
 
   /**

package/src/rule.ts

@@ -9,6 +9,7 @@ import { wildcardMatch } from "./wildcard-matcher";
  * Synthesized:   "builtin" (universal default / evaluate() fallback),
  *                "baseline" (conditional MCP metadata auto-allow).
  * Runtime:       "session" (session approvals).
+ * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
  */
 export type RuleOrigin =
   | "global"
@@ -17,7 +18,8 @@ export type RuleOrigin =
   | "project-agent"
   | "builtin"
   | "baseline"
-  | "session";
+  | "session"
+  | "yolo";
 
 /** A single permission rule — the atomic unit of policy. */
 export interface Rule {
@@ -41,6 +43,24 @@ export interface Rule {
 /** An ordered list of rules. Later rules take priority (last-match-wins). */
 export type Ruleset = Rule[];
 
+/**
+ * Rewrite every `ask` rule to `allow`, tagged `origin: "yolo"`.
+ *
+ * The composition-stage expression of yolo mode as recorded authority: when
+ * enabled, an `ask` becomes a standing `allow` grant in the ruleset rather than
+ * a live prompt-path concern. `deny` and existing `allow` rules pass through
+ * untouched, so yolo suppresses prompts but preserves hard denies.
+ *
+ * Pure and non-mutating — `surface`, `pattern`, and `layer` are preserved so
+ * downstream `matchedPattern` / source derivation is unaffected; only `action`
+ * and `origin` change.
+ */
+export function rewriteAsksToYolo(rules: Ruleset): Ruleset {
+  return rules.map((rule) =>
+    rule.action === "ask" ? { ...rule, action: "allow", origin: "yolo" } : rule,
+  );
+}
+
 /**
  * Pure permission evaluation.
  *

package/src/status.ts

@@ -5,9 +5,9 @@ import type {
 
 import {
   EXTENSION_ID,
+  isYoloModeEnabled,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
-import { isYoloModeEnabled } from "./yolo-mode";
 
 export const PERMISSION_SYSTEM_STATUS_KEY = EXTENSION_ID;
 export const PERMISSION_SYSTEM_YOLO_STATUS_VALUE = "yolo";

package/src/yolo-mode.ts

@@ -1,30 +0,0 @@
-import type { PermissionSystemExtensionConfig } from "./extension-config";
-import type { PermissionState } from "./types";
-
-export interface AskPermissionResolutionOptions {
-  config: PermissionSystemExtensionConfig;
-  hasUI: boolean;
-  isSubagent: boolean;
-}
-
-export function isYoloModeEnabled(
-  config: PermissionSystemExtensionConfig,
-): boolean {
-  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion -- typed as boolean but may be undefined at runtime (untyped callers); Boolean() guards against that
-  return Boolean(config.yoloMode);
-}
-
-export function shouldAutoApprovePermissionState(
-  state: PermissionState,
-  config: PermissionSystemExtensionConfig,
-): boolean {
-  return state === "ask" && isYoloModeEnabled(config);
-}
-
-export function canResolveAskPermissionRequest(
-  options: AskPermissionResolutionOptions,
-): boolean {
-  return (
-    options.hasUI || options.isSubagent || isYoloModeEnabled(options.config)
-  );
-}