@gotgenes/pi-permission-system 18.1.2 → 19.0.0

package/src/config-schema.ts

@@ -0,0 +1,204 @@
+import { z } from "zod";
+
+/**
+ * Single source of truth for the permission-system config file shape.
+ *
+ * These composable zod schemas drive two consumers:
+ * 1. Runtime validation in the config-file loader (`config-loader.ts`).
+ * 2. The published JSON Schema (`schemas/permissions.schema.json`), derived by
+ *    `buildPermissionsJsonSchema()` and regenerated via `pnpm run gen:schema`.
+ *
+ * Edit the schemas here — never the generated JSON by hand. A parity test
+ * (`config-schema.test.ts`) fails if the committed JSON drifts from this source.
+ */
+
+/** Canonical hosted location of the generated JSON Schema (monorepo raw path). */
+export const PERMISSIONS_SCHEMA_URL =
+  "https://raw.githubusercontent.com/gotgenes/pi-packages/main/packages/pi-permission-system/schemas/permissions.schema.json";
+
+const permissionStateSchema = z
+  .union([
+    z.literal("allow").meta({
+      description: "Permit the action silently with no user interaction.",
+    }),
+    z.literal("deny").meta({
+      description:
+        "Block the action with an error message. The agent is told not to retry.",
+    }),
+    z.literal("ask").meta({
+      description:
+        "Prompt the user for confirmation via the interactive UI before proceeding.",
+    }),
+  ])
+  .meta({
+    id: "permissionState",
+    description:
+      "A permission decision: allow (permit silently), deny (block with error), or ask (prompt the user for confirmation).",
+  });
+
+const denyWithReasonSchema = z
+  .strictObject({
+    action: z.literal("deny").meta({
+      description: 'The permission decision — must be "deny".',
+    }),
+    reason: z.string().max(500).optional().meta({
+      description:
+        "Optional reason shown to the agent when this action is denied.",
+    }),
+  })
+  .meta({
+    id: "denyWithReason",
+    description:
+      "Deny with an optional custom reason shown to the agent when the action is blocked.",
+  });
+
+const patternValueSchema = z.union([
+  permissionStateSchema,
+  denyWithReasonSchema,
+]);
+
+const permissionMapSchema = z
+  .record(
+    z.string().min(1).meta({
+      description:
+        "A non-empty pattern string. Use * for wildcard matching. Prefix with ~/ or $HOME/ for home-relative paths.",
+    }),
+    patternValueSchema,
+  )
+  .meta({
+    id: "permissionMap",
+    description:
+      "A map of wildcard patterns to permission states. Last matching pattern wins.",
+    markdownDescription:
+      "A map of wildcard patterns to permission states.\n\nUse `*` for wildcard matching. When multiple patterns match, the **last matching rule wins** — put broad catch-alls first and specific overrides after them.\n\nPattern keys support home directory expansion:\n- `~/path` or `$HOME/path` — expanded to the OS home directory at match time.\n- `~` or `$HOME` alone — expands to the home directory itself.\n\nThe stored pattern is always shown in logs and approval dialogs as written (e.g. `~/dev/*`).",
+  });
+
+const permissionSchema = z
+  .record(
+    z.string().min(1).meta({
+      description: "A surface name or the universal fallback key '*'.",
+    }),
+    z.union([permissionStateSchema, permissionMapSchema]),
+  )
+  .meta({
+    description:
+      "Flat permission policy. Each key is a surface name; values are a PermissionState string (catch-all) or a pattern→action map.",
+    markdownDescription:
+      'Flat permission policy.\n\nEach top-level key is a surface name:\n- `"*"` — universal fallback (replaces `defaultPolicy.tools` from the legacy format)\n- Tool names (`read`, `write`, `bash`, `mcp`, `skill`, `external_directory`, `path`, etc.)\n\nA **string** value is shorthand for `{ "*": action }` (surface-level catch-all).\nAn **object** value maps wildcard patterns to actions — last matching pattern wins.\n\nFor built-in file tools (`read`, `write`, `edit`, `find`, `grep`, `ls`), patterns are matched against the file path from `input.path`. For example, `"read": { "*": "allow", "*.env": "deny" }` allows reads but denies `.env` files.\n\nWhen Pi\'s current working directory is known, relative path inputs also match their cwd-normalized absolute form, so `src/App.jsx` can match both `src/*` and `/workspace/project/*`. Bash path tokens use the effective directory after literal `cd` commands for this matching; non-literal `cd "$DIR"` style commands remain conservative.\n\nThe `path` surface is a cross-cutting gate that applies to **all** file access: Pi tools, bash commands, MCP calls (via `input.arguments.path`), and extension tools (via `input.path` or a registered access extractor). A `path` deny cannot be overridden by a per-tool allow. Use it to protect sensitive files (`.env`, `~/.ssh/*`) from all path-aware tools at once.\n\nThe `external_directory` surface gates access **outside** the working directory. Give it a pattern map to allow specific outside-CWD directories without opening all external access — e.g. `"external_directory": { "*": "ask", "~/.cargo/registry/*": "allow" }` to silence repeated prompts on a local cache. The trailing `*` is greedy and crosses subdirectory boundaries; a bare `~/.cargo/registry` matches only the directory entry itself. Because layers compose with most-restrictive-wins, a `path` allow cannot loosen an `external_directory: ask` boundary — allow outside-CWD directories here, not on `path`.\n\n**Merge order (lowest → highest precedence):** global → project → per-agent frontmatter.',
+    examples: [
+      {
+        "*": "ask",
+        path: {
+          "*": "allow",
+          "*.env": "deny",
+          "*.env.*": "deny",
+          "*.env.example": "allow",
+        },
+        read: "allow",
+        write: "deny",
+        edit: "deny",
+        bash: {
+          "*": "ask",
+          "git *": "ask",
+          "git status": "allow",
+          "git diff": "allow",
+        },
+        mcp: { "*": "ask", mcp_status: "allow", "exa:*": "allow" },
+        skill: { "*": "ask", librarian: "allow" },
+        external_directory: { "*": "ask", "~/.cargo/registry/*": "allow" },
+      },
+    ],
+  });
+
+/**
+ * The on-disk config file shape.
+ *
+ * Every field is optional so partial global/project configs merge before the
+ * runtime defaults are applied downstream (`normalizePermissionSystemConfig`).
+ * No `.default()` lives here — injecting defaults at parse time would break the
+ * global-vs-project override semantics. `strictObject` makes unknown top-level
+ * keys an error, so editors flag typos and the runtime loader rejects them.
+ */
+export const unifiedConfigSchema = z
+  .strictObject({
+    $schema: z.string().optional().meta({
+      description: "JSON Schema URI for editor autocomplete and validation.",
+    }),
+    debugLog: z.boolean().optional().meta({
+      description:
+        "Write verbose permission-system diagnostics to the extension logs directory.",
+      markdownDescription:
+        "Write verbose permission-system diagnostics to `logs/pi-permission-system-debug.jsonl` under the extension config directory.",
+      default: false,
+    }),
+    permissionReviewLog: z.boolean().optional().meta({
+      description:
+        "Write permission request and decision audit events to the extension logs directory.",
+      markdownDescription:
+        "Write permission request and decision audit events to `logs/pi-permission-system-permission-review.jsonl` under the extension config directory.",
+      default: true,
+    }),
+    yoloMode: z.boolean().optional().meta({
+      description:
+        "Auto-approve ask-state permission checks, including subagent approval forwarding.",
+      markdownDescription:
+        "Auto-approve `ask`-state permission checks, including subagent approval forwarding.\n\n⚠️ **Use with caution** — this disables all interactive confirmation prompts.",
+      default: false,
+    }),
+    toolInputPreviewMaxLength: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",
+      markdownDescription:
+        "Maximum character length of the inline-JSON tool-input preview shown in permission prompts.\n\nOmit to use the default (200). Set to a large value (e.g. `10000`) to effectively disable truncation and see the full input.",
+    }),
+    toolTextSummaryMaxLength: z.number().int().min(1).optional().meta({
+      description:
+        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) in permission prompts. Omit to use the default (80).",
+      markdownDescription:
+        "Maximum character length of inline pattern/path summaries (e.g. grep patterns, find globs, ls paths) shown in permission prompts.\n\nOmit to use the default (80). Increase this when working with long regexes or deep paths that are being cut off.",
+    }),
+    piInfrastructureReadPaths: z.array(z.string().min(1)).optional().meta({
+      description:
+        "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the external_directory gate. Supports ~ expansion and wildcard patterns (* and ?).",
+      markdownDescription:
+        "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), `agentDir`, `agentDir/git`, and project-local `.pi/npm/` and `.pi/git/`. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
+      default: [],
+    }),
+    permission: permissionSchema.optional(),
+  })
+  .meta({
+    title: "PI Permission System Configuration",
+    description:
+      "Unified config file combining runtime knobs and flat permission policy for pi-permission-system.",
+    markdownDescription:
+      "Unified config file combining runtime knobs and flat permission policy for [pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system).\n\nPlace at `~/.pi/agent/extensions/pi-permission-system/config.json` (global) or `<project>/.pi/extensions/pi-permission-system/config.json` (project).",
+  });
+
+/** A permission decision. */
+export type PermissionState = z.infer<typeof permissionStateSchema>;
+
+/** A deny action with an optional custom reason. */
+export type DenyWithReason = z.infer<typeof denyWithReasonSchema>;
+
+/** A pattern value: a PermissionState string OR a DenyWithReason object. */
+export type PatternValue = z.infer<typeof patternValueSchema>;
+
+/** The on-disk permission shape inside the `"permission"` key. */
+export type FlatPermissionConfig = z.infer<typeof permissionSchema>;
+
+/** The raw config file shape after validation (all fields optional). */
+export type UnifiedPermissionConfig = z.infer<typeof unifiedConfigSchema>;
+
+/**
+ * Derive the published JSON Schema (Draft 2020-12) from the zod source.
+ *
+ * The three id-tagged sub-schemas (`permissionState`, `permissionMap`,
+ * `denyWithReason`) become `$defs` referenced by `$ref`; everything else
+ * inlines. The root `$id` is set to the canonical monorepo URL.
+ */
+export function buildPermissionsJsonSchema(): Record<string, unknown> {
+  const { $schema, ...rest } = z.toJSONSchema(unifiedConfigSchema, {
+    target: "draft-2020-12",
+  });
+  return { $schema, $id: PERMISSIONS_SCHEMA_URL, ...rest };
+}

package/src/extension-config.ts

@@ -66,6 +66,13 @@ export function normalizePermissionSystemConfig(
   return result;
 }
 
+export function isYoloModeEnabled(
+  config: PermissionSystemExtensionConfig,
+): boolean {
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-conversion -- typed as boolean but may be undefined at runtime (untyped callers); Boolean() guards against that
+  return Boolean(config.yoloMode);
+}
+
 export function ensurePermissionSystemLogsDirectory(
   logsDir: string,
 ): string | undefined {

package/src/forwarded-permissions/permission-forwarder.ts

@@ -6,6 +6,7 @@ import {
   type SessionEntryView,
 } from "#src/active-agent";
 import type { ConfigReader } from "#src/config-store";
+import { isYoloModeEnabled } from "#src/extension-config";
 import type {
   PermissionDecisionUi,
   PermissionPromptDecision,
@@ -31,7 +32,6 @@ import type { DebugReviewLogger } from "#src/session-logger";
 import { isSubagentExecutionContext } from "#src/subagent-context";
 import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import { toRecord } from "#src/value-guards";
-import { shouldAutoApprovePermissionState } from "#src/yolo-mode";
 
 import {
   cleanupPermissionForwardingLocationIfEmpty,
@@ -90,7 +90,7 @@ export interface PermissionForwarderDeps {
     message: string,
     options?: RequestPermissionOptions,
   ) => Promise<PermissionPromptDecision>;
-  /** Read current config for yolo-mode auto-approve check (called at prompt time). */
+  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
   config: ConfigReader;
 }
 
@@ -506,7 +506,10 @@ export class PermissionForwarder implements ApprovalRequester, InboxProcessor {
       approved: false,
       state: "denied",
     };
-    if (shouldAutoApprovePermissionState("ask", this.config.current())) {
+    // Last yolo check outside the composed ruleset: dissolves when
+    // processInbox is refactored onto evaluate() + Authorizer selection in
+    // the Phase 9 spine work.
+    if (isYoloModeEnabled(this.config.current())) {
       this.logger.review(
         "forwarded_permission.auto_approved",
         forwardedPermissionLogDetails,

package/src/handlers/gates/helpers.ts

@@ -62,7 +62,7 @@ export function deriveResolution(
   canConfirm: boolean,
   autoApproved = false,
 ): PermissionDecisionResolution {
-  if (state === "allow") return "policy_allow";
+  if (state === "allow") return autoApproved ? "auto_approved" : "policy_allow";
   if (state === "deny") return "policy_deny";
   // state === "ask"
   if (action === "allow") {

package/src/handlers/gates/runner.ts

@@ -105,6 +105,28 @@ export class GateRunner {
       return { action: "allow" };
     }
 
+    // 2b. Yolo fast-path — a composition-stage ask→allow rewrite records
+    // origin "yolo" on the matched rule. Auto-approve without prompting,
+    // preserving today's single auto_approved review entry + decision event
+    // so review-log parity holds (#526).
+    if (check.state === "allow" && check.origin === "yolo") {
+      this.reporter.writeReviewLog("permission_request.auto_approved", {
+        ...descriptor.logContext,
+        agentName,
+        resolution: "auto_approved",
+      });
+      this.reporter.emitDecision(
+        buildDecisionEvent(
+          descriptor.decision,
+          check,
+          agentName,
+          "allow",
+          deriveResolution(check.state, "allow", false, false, true),
+        ),
+      );
+      return { action: "allow" };
+    }
+
     // 3. Apply the deny/ask/allow gate
     const canConfirm = this.prompter.canConfirm();
 

package/src/index.ts

@@ -6,6 +6,7 @@ import { getGlobalConfigPath } from "./config-paths";
 import { ConfigStore } from "./config-store";
 import { DecisionAudit } from "./decision-audit";
 import { GateDecisionReporter } from "./decision-reporter";
+import { isYoloModeEnabled } from "./extension-config";
 import { computeExtensionPaths } from "./extension-paths";
 import {
   PermissionForwarder,
@@ -46,10 +47,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // session (PathNormalizer) and, later, rule evaluation. Interior modules must
   // not read process.platform (enforced by the eslint guard scoped to src/).
   const hostPlatform = process.platform;
-  const permissionManager = new PermissionManager({
-    agentDir,
-    platform: hostPlatform,
-  });
   const sessionRules = new SessionRules();
   const subagentRegistry = getSubagentSessionRegistry();
   const formatterRegistry = new ToolInputFormatterRegistry();
@@ -65,6 +62,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // eslint-disable-next-line prefer-const -- forward-declared let; `const` requires an initializer
   let session: PermissionSession;
 
+  // Constructed after the `configStore` forward declaration so the yolo reader
+  // can close over it; the closure runs per check(), after configStore is
+  // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
+  const permissionManager = new PermissionManager({
+    agentDir,
+    platform: hostPlatform,
+    isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
+  });
+
   const logger = new PermissionSessionLogger({
     globalLogsDir: paths.globalLogsDir,
     getConfig: () => configStore.current(),
@@ -90,14 +96,12 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const forwarder = new PermissionForwarder(forwardingDeps);
 
   const prompter = new PermissionPrompter({
-    config: configStore,
     logger,
     events: pi.events,
     forwarder,
   });
 
   const gateway = new PromptingGateway({
-    config: configStore,
     subagentSessionsDir: paths.subagentSessionsDir,
     platform: hostPlatform,
     registry: subagentRegistry,

package/src/permission-manager.ts

@@ -20,6 +20,7 @@ import {
   evaluateAnyValue,
   evaluateFirst,
   pathMatchOptions,
+  rewriteAsksToYolo,
 } from "./rule";
 import { mergeScopesWithOrigins } from "./scope-merge";
 import {
@@ -53,6 +54,9 @@ const DEFAULT_UNIVERSAL_FALLBACK: PermissionState = "ask";
 /** Promotion predicate matching no token — the no-`path`-rules default (#509). */
 const NO_PROMOTION: PathRuleTokenMatcher = () => false;
 
+/** Default yolo reader — yolo disabled unless the composition root injects one. */
+const YOLO_DISABLED = (): boolean => false;
+
 type FileCacheEntry<TValue> = {
   stamp: string;
   value: TValue;
@@ -110,11 +114,20 @@ export interface PermissionManagerOptions extends PolicyLoaderOptions {
    * Defaults to a POSIX flavor; production always supplies the real platform.
    */
   platform?: NodeJS.Platform;
+  /**
+   * yolo-mode reader, injected from the composition root. When it reports
+   * true, {@link PermissionManager.check} rewrites every matched `ask` to a
+   * standing `allow` tagged `origin: "yolo"` (recorded authority, #526).
+   * Read per check so a mid-session config change takes effect; defaults to
+   * yolo disabled.
+   */
+  isYoloEnabled?: () => boolean;
 }
 
 export class PermissionManager implements ScopedPermissionManager {
   private readonly agentDir: string | undefined;
   private readonly platform: NodeJS.Platform;
+  private readonly isYoloEnabled: () => boolean;
   private loader: PolicyLoader;
   private readonly resolvedPermissionsCache = new Map<
     string,
@@ -124,6 +137,7 @@ export class PermissionManager implements ScopedPermissionManager {
   constructor(options: PermissionManagerOptions = {}) {
     this.agentDir = options.agentDir;
     this.platform = options.platform ?? "linux";
+    this.isYoloEnabled = options.isYoloEnabled ?? YOLO_DISABLED;
     this.loader =
       options.policyLoader ??
       new FilePolicyLoader(
@@ -311,9 +325,15 @@ export class PermissionManager implements ScopedPermissionManager {
     sessionRules?: Ruleset,
   ): PermissionCheckResult {
     const { composedRules } = this.resolvePermissions(intent.agentName);
-    const fullRules: Ruleset = sessionRules?.length
+    const composedWithSession: Ruleset = sessionRules?.length
       ? [...composedRules, ...sessionRules]
       : composedRules;
+    // Apply the yolo rewrite post-cache so the resolved-permissions cache and
+    // the display surfaces (getComposedConfigRules / getToolPermission) stay
+    // yolo-free — only the resolution path sees the ask→allow rewrite (#526).
+    const fullRules: Ruleset = this.isYoloEnabled()
+      ? rewriteAsksToYolo(composedWithSession)
+      : composedWithSession;
 
     if (intent.kind === "path-values") {
       const lookupValues =

package/src/permission-prompter.ts

@@ -1,5 +1,4 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ConfigReader } from "./config-store";
 import type { ApprovalRequester } from "./forwarded-permissions/permission-forwarder";
 import type { PermissionPromptDecision } from "./permission-dialog";
 import {
@@ -8,7 +7,6 @@ import {
 } from "./permission-events";
 import { buildDirectUiPrompt } from "./permission-ui-prompt";
 import type { ReviewLogger } from "./session-logger";
-import { shouldAutoApprovePermissionState } from "./yolo-mode";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
@@ -40,13 +38,11 @@ export interface PermissionPrompterApi {
 /**
  * Dependencies required by PermissionPrompter.
  *
- * Keeps the prompter's external surface narrow: callers provide config
- * access, a review logger, the UI-prompt event bus, and the forwarder
- * that owns the UI/subagent-forwarding branching logic.
+ * Keeps the prompter's external surface narrow: callers provide a review
+ * logger, the UI-prompt event bus, and the forwarder that owns the
+ * UI/subagent-forwarding branching logic.
  */
 export interface PermissionPrompterDeps {
-  /** Read current config for yolo-mode check (called at prompt time). */
-  config: ConfigReader;
   /** Write structured entries to the permission review log. */
   logger: ReviewLogger;
   /** Event bus used for UI prompt broadcasts. */
@@ -57,10 +53,13 @@ export interface PermissionPrompterDeps {
 
 /**
  * Encapsulates the full permission-prompt flow:
- *   1. Yolo-mode auto-approval check.
- *   2. Review-log "waiting" entry.
- *   3. UI-present vs. subagent-forwarding branching (via confirmPermission).
- *   4. Review-log "approved" / "denied" entry.
+ *   1. Review-log "waiting" entry.
+ *   2. UI-present vs. subagent-forwarding branching (via confirmPermission).
+ *   3. Review-log "approved" / "denied" entry.
+ *
+ * Yolo-mode auto-approval happens upstream, at the composition stage
+ * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
+ * this class under yolo, so this class has no yolo-mode knowledge.
  *
  * Injecting a single PermissionPrompter instance means adding a new prompt
  * parameter (e.g. a future sessionLabel variant) only requires changing
@@ -73,11 +72,6 @@ export class PermissionPrompter implements PermissionPrompterApi {
     ctx: ExtensionContext,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    if (shouldAutoApprovePermissionState("ask", this.deps.config.current())) {
-      this.writeReviewEntry("permission_request.auto_approved", details);
-      return { approved: true, state: "approved", autoApproved: true };
-    }
-
     this.writeReviewEntry("permission_request.waiting", details);
 
     // Build the event once. When this session has UI it broadcasts directly;

package/src/policy-loader.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import {
   loadUnifiedConfig,
-  normalizeUnifiedConfig,
+  normalizeFlatPermissionValue,
   stripJsonComments,
 } from "./config-loader";
 import { getGlobalConfigPath } from "./config-paths";
@@ -263,10 +263,14 @@ export class FilePolicyLoader implements PolicyLoader {
       if (!frontmatter) {
         value = {};
       } else {
+        // Agent frontmatter carries non-config keys (name, description, model,
+        // …) alongside `permission`, so it is not validated by the strict
+        // config-file schema; only the `permission` block is extracted, and its
+        // malformed entries are dropped tolerantly as before.
         const parsed = parseSimpleYamlMap(frontmatter);
-        const { config, issues } = normalizeUnifiedConfig(parsed);
-        this.accumulateConfigIssues(issues);
-        value = { permission: config.permission };
+        value = {
+          permission: normalizeFlatPermissionValue(parsed.permission),
+        };
       }
     } catch {
       value = {};

package/src/prompting-gateway.ts

@@ -1,6 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
-import type { ConfigReader } from "./config-store";
 import type { GatePrompter } from "./gate-prompter";
 import type { PermissionPromptDecision } from "./permission-dialog";
 import type {
@@ -9,18 +8,15 @@ import type {
 } from "./permission-prompter";
 import { isSubagentExecutionContext } from "./subagent-context";
 import type { SubagentSessionRegistry } from "./subagent-registry";
-import { canResolveAskPermissionRequest } from "./yolo-mode";
 
 /**
  * Dependencies required by PromptingGateway.
  *
- * All four fields are actively consumed:
- * - `config` + `subagentSessionsDir` + `registry` drive `canConfirm()`.
+ * All fields are actively consumed:
+ * - `subagentSessionsDir` + `registry` drive `canConfirm()`.
  * - `prompter` is called by `prompt()`.
  */
 export interface PromptingGatewayDeps {
-  /** Read current config for the yolo-mode branch of the can-prompt policy. */
-  config: ConfigReader;
   /** Static path used to detect a forwarding subagent context. */
   subagentSessionsDir: string;
   /** Host platform, injected from the composition root, for subagent-context path detection. */
@@ -46,8 +42,8 @@ export interface PromptingGatewayLifecycle {
  * Context-owning implementation of the GatePrompter role.
  *
  * Owns the stored ExtensionContext and the "can we prompt?" policy
- * (UI / subagent / yolo-mode), replacing the four twin methods
- * that previously lived on PermissionSession.
+ * (UI / subagent), replacing the four twin methods that previously
+ * lived on PermissionSession.
  *
  * Lifecycle: PermissionSession drives activate/deactivate so the stored
  * context mirrors the session context without independent call-site changes.
@@ -72,22 +68,22 @@ export class PromptingGateway
   /**
    * Whether an interactive permission prompt can be shown.
    *
-   * Returns false when no context is active. Otherwise delegates to
-   * canResolveAskPermissionRequest, which checks hasUI, subagent status,
-   * and yolo-mode — relocating the policy from the index.ts closure.
+   * Returns false when no context is active. Otherwise true when the
+   * context has UI or is a forwarding subagent — the two Authorizer-
+   * selection predicates the Phase 9 spine will consume. Yolo-mode never
+   * reaches this policy: it is resolved upstream at the composition stage.
    */
   canConfirm(): boolean {
     if (this.context === null) return false;
-    return canResolveAskPermissionRequest({
-      config: this.deps.config.current(),
-      hasUI: this.context.hasUI,
-      isSubagent: isSubagentExecutionContext(
+    return (
+      this.context.hasUI ||
+      isSubagentExecutionContext(
         this.context,
         this.deps.subagentSessionsDir,
         this.deps.platform,
         this.deps.registry,
-      ),
-    });
+      )
+    );
   }
 
   /**

package/src/rule.ts

@@ -9,6 +9,7 @@ import { wildcardMatch } from "./wildcard-matcher";
  * Synthesized:   "builtin" (universal default / evaluate() fallback),
  *                "baseline" (conditional MCP metadata auto-allow).
  * Runtime:       "session" (session approvals).
+ * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
  */
 export type RuleOrigin =
   | "global"
@@ -17,7 +18,8 @@ export type RuleOrigin =
   | "project-agent"
   | "builtin"
   | "baseline"
-  | "session";
+  | "session"
+  | "yolo";
 
 /** A single permission rule — the atomic unit of policy. */
 export interface Rule {
@@ -41,6 +43,24 @@ export interface Rule {
 /** An ordered list of rules. Later rules take priority (last-match-wins). */
 export type Ruleset = Rule[];
 
+/**
+ * Rewrite every `ask` rule to `allow`, tagged `origin: "yolo"`.
+ *
+ * The composition-stage expression of yolo mode as recorded authority: when
+ * enabled, an `ask` becomes a standing `allow` grant in the ruleset rather than
+ * a live prompt-path concern. `deny` and existing `allow` rules pass through
+ * untouched, so yolo suppresses prompts but preserves hard denies.
+ *
+ * Pure and non-mutating — `surface`, `pattern`, and `layer` are preserved so
+ * downstream `matchedPattern` / source derivation is unaffected; only `action`
+ * and `origin` change.
+ */
+export function rewriteAsksToYolo(rules: Ruleset): Ruleset {
+  return rules.map((rule) =>
+    rule.action === "ask" ? { ...rule, action: "allow", origin: "yolo" } : rule,
+  );
+}
+
 /**
  * Pure permission evaluation.
  *

package/src/status.ts

@@ -5,9 +5,9 @@ import type {
 
 import {
   EXTENSION_ID,
+  isYoloModeEnabled,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
-import { isYoloModeEnabled } from "./yolo-mode";
 
 export const PERMISSION_SYSTEM_STATUS_KEY = EXTENSION_ID;
 export const PERMISSION_SYSTEM_YOLO_STATUS_VALUE = "yolo";