@gotgenes/pi-permission-system 19.0.1 → 20.1.0

package/src/authority/authorizer-selection.ts

@@ -0,0 +1,87 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { GatePrompter } from "#src/gate-prompter";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
+import {
+  type Authorizer,
+  type AuthorizerSelectionDeps,
+  selectAuthorizer,
+} from "./authorizer";
+import type {
+  PermissionPrompterApi,
+  PromptPermissionDetails,
+} from "./permission-prompter";
+
+/**
+ * The lifecycle slice of the selection owner that PermissionSession drives.
+ *
+ * PermissionSession calls activate/deactivate to keep the selection's stored
+ * context in sync with its own — the same pattern the former
+ * PromptingGatewayLifecycle used.
+ */
+export interface AuthorizerSelectionLifecycle {
+  activate(ctx: ExtensionContext): void;
+  deactivate(): void;
+}
+
+/**
+ * Context-owning selection root for the Authorizer spine.
+ *
+ * The rewrite of `PromptingGateway`: owns the stored `ExtensionContext`, runs
+ * `selectAuthorizer` once per activation, and implements `GatePrompter` by
+ * delegating to the selected `Authorizer` via `PermissionPrompter`.
+ *
+ * `canConfirm()` survives this step (dissolved in #556): it is recomputed
+ * transitionally alongside `selectAuthorizer`'s own branch, rather than
+ * derived from the selected authorizer, to keep the ask path byte-identical
+ * until #556 derives confirmability from a `DenyingAuthorizer` marker.
+ */
+export class AuthorizerSelection
+  implements GatePrompter, AuthorizerSelectionLifecycle
+{
+  private selected: Authorizer | null = null;
+  private confirmable = false;
+
+  constructor(
+    private readonly deps: AuthorizerSelectionDeps & {
+      prompter: PermissionPrompterApi;
+    },
+  ) {}
+
+  /** Select the Authorizer for `ctx` and store both it and the confirmable predicate. */
+  activate(ctx: ExtensionContext): void {
+    this.selected = selectAuthorizer(ctx, this.deps);
+    this.confirmable = ctx.hasUI || this.deps.detection.isSubagent(ctx);
+  }
+
+  /** Clear the stored selection. */
+  deactivate(): void {
+    this.selected = null;
+    this.confirmable = false;
+  }
+
+  /**
+   * Whether an interactive permission prompt can be shown.
+   *
+   * Returns false when no authorizer has been selected. Otherwise true when
+   * the context had UI or was a forwarding subagent at selection time — the
+   * two Authorizer-selection predicates, evaluated once at `activate`.
+   */
+  canConfirm(): boolean {
+    return this.selected !== null && this.confirmable;
+  }
+
+  /**
+   * Prompt for a permission decision using the selected authorizer.
+   *
+   * Rejects if no authorizer has been selected — `canConfirm()` guards this
+   * in normal use. Implements {@link GatePrompter}.
+   */
+  prompt(details: PromptPermissionDetails): Promise<PermissionPromptDecision> {
+    if (this.selected === null) {
+      return Promise.reject(
+        new Error("prompt called before the session was activated"),
+      );
+    }
+    return this.deps.prompter.prompt(this.selected, details);
+  }
+}

package/src/authority/authorizer.ts

@@ -0,0 +1,72 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type {
+  PermissionPromptDecision,
+  requestPermissionDecisionFromUi,
+} from "#src/permission-dialog";
+import type { PermissionEventBus } from "#src/permission-events";
+import type { DebugReviewLogger } from "#src/session-logger";
+import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import { ParentAuthorizer } from "./approval-escalator";
+import { DenyingAuthorizer } from "./denying-authorizer";
+import { LocalUserAuthorizer } from "./local-user-authorizer";
+import type { PromptPermissionDetails } from "./permission-prompter";
+import type { SubagentDetector } from "./subagent-detection";
+
+/**
+ * The live-authority role: on `ask`, an `Authorizer` rules on a single
+ * request and is told the decision.
+ *
+ * One method, one responsibility. `DenyingAuthorizer` ignores `details`;
+ * `LocalUserAuthorizer` reads `message`/`sessionLabel` and derives the UI
+ * event from it; `ParentAuthorizer` reads `message` and derives the
+ * forwarded display from it.
+ */
+export interface Authorizer {
+  authorize(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision>;
+}
+
+/** Construction inputs for {@link selectAuthorizer}. */
+export interface AuthorizerSelectionDeps {
+  /** Single owner of subagent detection; the ParentAuthorizer-selection predicate. */
+  detection: SubagentDetector;
+  /** Event bus used by `LocalUserAuthorizer` for the `permissions:ui_prompt` broadcast. */
+  events: PermissionEventBus;
+  /** Injected for testability; production callers pass the real function. */
+  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+  /** Forwarding directory `ParentAuthorizer` reads/writes request and response files under. */
+  forwardingDir: string;
+  /** In-process subagent session registry for forwarding target resolution. */
+  registry?: SubagentSessionRegistry;
+  logger: DebugReviewLogger;
+}
+
+/**
+ * Select the `Authorizer` for the current context: the single owner of the
+ * three-way `hasUI` / `isSubagent` / deny dispatch.
+ *
+ * Evaluated once per session activation (`AuthorizerSelection.activate`),
+ * replacing the re-derivation of the same predicates across
+ * `PromptingGateway`, `PermissionPrompter`, and `ApprovalEscalator`.
+ */
+export function selectAuthorizer(
+  ctx: ExtensionContext,
+  deps: AuthorizerSelectionDeps,
+): Authorizer {
+  if (ctx.hasUI) {
+    return new LocalUserAuthorizer({
+      ui: ctx.ui,
+      events: deps.events,
+      requestPermissionDecisionFromUi: deps.requestPermissionDecisionFromUi,
+    });
+  }
+  if (deps.detection.isSubagent(ctx)) {
+    return new ParentAuthorizer(ctx, {
+      forwardingDir: deps.forwardingDir,
+      registry: deps.registry,
+      logger: deps.logger,
+    });
+  }
+  return new DenyingAuthorizer();
+}

package/src/authority/denying-authorizer.ts

@@ -0,0 +1,12 @@
+import type { PermissionPromptDecision } from "#src/permission-dialog";
+import type { Authorizer } from "./authorizer";
+
+/**
+ * Least-privilege Authorizer: no authority is reachable for this session
+ * (no UI, not a subagent), so every ask is denied.
+ */
+export class DenyingAuthorizer implements Authorizer {
+  authorize(): Promise<PermissionPromptDecision> {
+    return Promise.resolve({ approved: false, state: "denied" });
+  }
+}

package/src/authority/forwarding-io.ts

@@ -24,7 +24,6 @@ const UI_PROMPT_SOURCES = [
   "tool_call",
   "skill_input",
   "skill_read",
-  "rpc_prompt",
 ] as const satisfies readonly PermissionUiPromptSource[];
 
 /** Narrow an unknown value to a valid prompt source, or `undefined`. */

package/src/authority/local-user-authorizer.ts

@@ -0,0 +1,46 @@
+import type {
+  PermissionDecisionUi,
+  PermissionPromptDecision,
+  requestPermissionDecisionFromUi,
+} from "#src/permission-dialog";
+import {
+  emitUiPromptEvent,
+  type PermissionEventBus,
+} from "#src/permission-events";
+import { buildDirectUiPrompt } from "#src/permission-ui-prompt";
+import type { Authorizer } from "./authorizer";
+import type { PromptPermissionDetails } from "./permission-prompter";
+
+/** Dependencies required by {@link LocalUserAuthorizer}. */
+export interface LocalUserAuthorizerDeps {
+  /** The active session's UI surface. */
+  ui: PermissionDecisionUi;
+  /** Event bus used for the `permissions:ui_prompt` broadcast. */
+  events: PermissionEventBus;
+  /** Injected for testability; production callers pass the real function. */
+  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+}
+
+/**
+ * Authorizer for a session with an active UI: prompt the human here.
+ *
+ * Emits the `permissions:ui_prompt` broadcast (moved here from
+ * `PermissionPrompter`'s `ctx.hasUI` arm) before showing the dialog, so
+ * observers know a decision is imminent.
+ */
+export class LocalUserAuthorizer implements Authorizer {
+  constructor(private readonly deps: LocalUserAuthorizerDeps) {}
+
+  authorize(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision> {
+    const uiPrompt = buildDirectUiPrompt(details);
+    emitUiPromptEvent(this.deps.events, uiPrompt);
+    return this.deps.requestPermissionDecisionFromUi(
+      this.deps.ui,
+      "Permission Required",
+      details.message,
+      details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
+    );
+  }
+}

package/src/{permission-prompter.ts → authority/permission-prompter.ts}

@@ -1,12 +1,6 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ApprovalRequester } from "./authority/approval-escalator";
-import type { PermissionPromptDecision } from "./permission-dialog";
-import {
-  emitUiPromptEvent,
-  type PermissionEventBus,
-} from "./permission-events";
-import { buildDirectUiPrompt } from "./permission-ui-prompt";
-import type { ReviewLogger } from "./session-logger";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
+import type { ReviewLogger } from "#src/session-logger";
+import type { Authorizer } from "./authorizer";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
@@ -27,72 +21,53 @@ export interface PromptPermissionDetails {
   sessionLabel?: string;
 }
 
-/** Mockable contract for permission prompting. */
+/**
+ * Narrow seam onto {@link PermissionPrompter}.
+ *
+ * Kept separate from the concrete class so consumers (e.g. `AuthorizerSelection`)
+ * can inject a plain `{ prompt: vi.fn() }` mock in tests — a private field on
+ * the concrete class would create a nominal brand that a structural mock
+ * cannot satisfy without a cast.
+ */
 export interface PermissionPrompterApi {
   prompt(
-    ctx: ExtensionContext,
+    authorizer: Authorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
 }
 
-/**
- * Dependencies required by PermissionPrompter.
- *
- * Keeps the prompter's external surface narrow: callers provide a review
- * logger, the UI-prompt event bus, and the forwarder that owns the
- * UI/subagent-forwarding branching logic.
- */
+/** Dependencies required by {@link PermissionPrompter}. */
 export interface PermissionPrompterDeps {
   /** Write structured entries to the permission review log. */
   logger: ReviewLogger;
-  /** Event bus used for UI prompt broadcasts. */
-  events: PermissionEventBus;
-  /** Resolves the permission decision: direct UI dialog or forwarded to parent. */
-  forwarder: ApprovalRequester;
 }
 
 /**
- * Encapsulates the full permission-prompt flow:
+ * Brackets the ask-path flow with review-log entries and delegates the
+ * live decision to the selected {@link Authorizer}:
  *   1. Review-log "waiting" entry.
- *   2. UI-present vs. subagent-forwarding branching (via confirmPermission).
+ *   2. `authorizer.authorize(details)`.
  *   3. Review-log "approved" / "denied" entry.
  *
+ * The UI/forwarding branching this class previously owned now lives on the
+ * individual `Authorizer` implementations (`LocalUserAuthorizer`,
+ * `ParentAuthorizer`, `DenyingAuthorizer`) — this class no longer threads
+ * `ExtensionContext` per call.
+ *
  * Yolo-mode auto-approval happens upstream, at the composition stage
  * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
  * this class under yolo, so this class has no yolo-mode knowledge.
- *
- * Injecting a single PermissionPrompter instance means adding a new prompt
- * parameter (e.g. a future sessionLabel variant) only requires changing
- * PromptPermissionDetails and this class — not the full threading chain.
  */
 export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}
 
   async prompt(
-    ctx: ExtensionContext,
+    authorizer: Authorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
     this.writeReviewEntry("permission_request.waiting", details);
 
-    // Build the event once. When this session has UI it broadcasts directly;
-    // when it does not (a forwarding subagent), the display fields ride along
-    // to the parent so the parent emits a non-degraded event from the
-    // forwarded path instead of here.
-    const uiPrompt = buildDirectUiPrompt(details);
-    if (ctx.hasUI) {
-      emitUiPromptEvent(this.deps.events, uiPrompt);
-    }
-
-    const decision = await this.deps.forwarder.requestApproval(
-      ctx,
-      details.message,
-      details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
-      {
-        source: uiPrompt.source,
-        surface: uiPrompt.surface,
-        value: uiPrompt.value,
-      },
-    );
+    const decision = await authorizer.authorize(details);
 
     this.writeReviewEntry(
       decision.approved

package/src/authority/subagent-detection.ts

@@ -8,7 +8,7 @@ import type { SubagentSessionRegistry } from "#src/subagent-registry";
 /**
  * Narrow seam for the ask-path consumers: "is the current session a subagent?"
  *
- * `PromptingGateway`, `ForwardingManager`, and `ApprovalEscalator` depend on
+ * `selectAuthorizer`/`AuthorizerSelection` and `ForwardingManager` depend on
  * this single-method view so their unit tests inject a one-field fake without
  * casts. It is the Authorizer-selection predicate the Phase 9 spine consumes.
  */

package/src/config-loader.ts

@@ -14,7 +14,7 @@ import {
 } from "./config-schema";
 import { mergeFlatPermissions } from "./permission-merge";
 import type { FlatPermissionConfig, PatternValue } from "./types";
-import { isDenyWithReason, isPermissionState } from "./value-guards";
+import { isDenyWithReason, isPermissionState } from "./types";
 
 // The unified config shape is derived from the zod schema (config-schema.ts,
 // the single source of truth) and re-exported so existing importers keep their

package/src/gate-prompter.ts

@@ -1,5 +1,5 @@
+import type { PromptPermissionDetails } from "./authority/permission-prompter";
 import type { PermissionPromptDecision } from "./permission-dialog";
-import type { PromptPermissionDetails } from "./permission-prompter";
 
 /**
  * The prompting role the gate runner needs: a yes/no on whether an

package/src/handlers/gates/descriptor.ts

@@ -1,6 +1,6 @@
+import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
 import type { DenialContext } from "#src/denial-messages";
 import type { PermissionDecisionEvent } from "#src/permission-events";
-import type { PromptPermissionDetails } from "#src/permission-prompter";
 import type { SessionApproval } from "#src/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 

package/src/index.ts

@@ -1,13 +1,11 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
-import {
-  ApprovalEscalator,
-  type ApprovalEscalatorDeps,
-} from "./authority/approval-escalator";
+import { AuthorizerSelection } from "./authority/authorizer-selection";
 import {
   ForwardedRequestServer,
   type ForwardedRequestServerDeps,
 } from "./authority/forwarded-request-server";
+import { PermissionPrompter } from "./authority/permission-prompter";
 import { SubagentDetection } from "./authority/subagent-detection";
 import { registerBuiltinToolInputFormatters } from "./builtin-tool-input-formatters";
 import { registerPermissionSystemCommand } from "./config-modal";
@@ -28,13 +26,10 @@ import { SkillInputGatePipeline } from "./handlers/gates/skill-input-gate-pipeli
 import { ToolCallGatePipeline } from "./handlers/gates/tool-call-gate-pipeline";
 import { createFailClosedToolCall } from "./handlers/tool-call-boundary";
 import { requestPermissionDecisionFromUi } from "./permission-dialog";
-import { registerPermissionRpcHandlers } from "./permission-event-rpc";
 import { PermissionManager } from "./permission-manager";
-import { PermissionPrompter } from "./permission-prompter";
 import { PermissionResolver } from "./permission-resolver";
 import { PermissionSession } from "./permission-session";
 import { LocalPermissionsService } from "./permissions-service";
-import { PromptingGateway } from "./prompting-gateway";
 import { PermissionServiceLifecycle } from "./service-lifecycle";
 import { PermissionSessionLogger } from "./session-logger";
 import { SessionRules } from "./session-rules";
@@ -95,15 +90,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     logger,
   });
 
-  const escalatorDeps: ApprovalEscalatorDeps = {
-    forwardingDir: paths.forwardingDir,
-    detection: subagentDetection,
-    registry: subagentRegistry,
-    logger,
-    requestPermissionDecisionFromUi,
-  };
-  const escalator = new ApprovalEscalator(escalatorDeps);
-
   const requestServerDeps: ForwardedRequestServerDeps = {
     forwardingDir: paths.forwardingDir,
     logger,
@@ -113,14 +99,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   };
   const requestServer = new ForwardedRequestServer(requestServerDeps);
 
-  const prompter = new PermissionPrompter({
-    logger,
-    events: pi.events,
-    forwarder: escalator,
-  });
+  const prompter = new PermissionPrompter({ logger });
 
-  const gateway = new PromptingGateway({
+  const authorizerSelection = new AuthorizerSelection({
     detection: subagentDetection,
+    events: pi.events,
+    requestPermissionDecisionFromUi,
+    forwardingDir: paths.forwardingDir,
+    registry: subagentRegistry,
+    logger,
     prompter,
   });
 
@@ -130,7 +117,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     permissionManager,
     sessionRules,
     configStore,
-    gateway,
+    authorizerSelection,
     hostPlatform,
   );
 
@@ -150,17 +137,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   });
 
   // Resolver composes the manager + session ruleset and owns the
-  // access-path → path-values unwrap; the RPC and service route their policy
-  // queries through it, so it is constructed before both.
+  // access-path → path-values unwrap; the service routes its policy
+  // queries through it, so it is constructed before it.
   const resolver = new PermissionResolver(permissionManager, sessionRules);
 
-  const rpcHandles = registerPermissionRpcHandlers(pi.events, {
-    resolver,
-    session,
-    requestPermissionDecisionFromUi,
-    logger,
-  });
-
   const permissionsService = new LocalPermissionsService(
     resolver,
     session,
@@ -184,7 +164,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     permissionsService,
     subagentDetection,
     pi.events,
-    [rpcHandles.unsubCheck, rpcHandles.unsubPrompt, unsubSubagentLifecycle],
+    [unsubSubagentLifecycle],
   );
 
   const toolRegistry = {
@@ -204,7 +184,12 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const agentPrep = new AgentPrepHandler(session, resolver, toolRegistry);
 
   const reporter = new GateDecisionReporter(logger, pi.events);
-  const gateRunner = new GateRunner(resolver, sessionRules, gateway, reporter);
+  const gateRunner = new GateRunner(
+    resolver,
+    sessionRules,
+    authorizerSelection,
+    reporter,
+  );
   const toolCallGatePipeline = new ToolCallGatePipeline(
     resolver,
     session,

package/src/normalize.ts

@@ -1,6 +1,6 @@
 import type { Rule, Ruleset } from "./rule";
 import type { FlatPermissionConfig } from "./types";
-import { isDenyWithReason, isPermissionState } from "./value-guards";
+import { isDenyWithReason, isPermissionState } from "./types";
 
 /**
  * Convert a flat permission config into a Ruleset.

package/src/path-normalizer.ts

@@ -112,6 +112,18 @@ export class PathNormalizer {
     return this.impl.isAbsolute(pathValue);
   }
 
+  /**
+   * True when the host platform treats a backslash as a path separator (win32).
+   *
+   * The bash rule-candidate classifier reads this to decide whether a
+   * backslash-relative token (`dir\file`) is path-shaped: on win32 `\` is a
+   * separator, but on POSIX it is a legal filename character (#520). Keeping the
+   * decision here means no bash-layer module re-reads `process.platform`.
+   */
+  usesWindowsSeparators(): boolean {
+    return this.platform === "win32";
+  }
+
   /**
    * Interpret a literal `cd` target's effect on the effective base.
    *

package/src/permission-events.ts

@@ -1,27 +1,19 @@
 /**
  * Permission event channel — public contract.
  *
- * Exports channel name constants, protocol version, TypeScript types for all
- * emitted events and RPC envelopes, and thin emit helpers.
+ * Exports channel name constants, TypeScript types for all emitted events,
+ * and thin emit helpers.
  *
  * Stability guarantee: fields may be added, but existing fields will not be
  * removed or renamed without a semver-major version bump.
  */
 
-/** Minimal event bus interface required by the emit helpers and RPC handlers. */
+/** Minimal event bus interface required by the emit helpers. */
 export interface PermissionEventBus {
   emit(channel: string, data: unknown): void;
   on(channel: string, handler: (data: unknown) => void): () => void;
 }
 
-// ── Protocol version ───────────────────────────────────────────────────────
-
-/**
- * RPC protocol version.
- * Bumped when the envelope shape or method contracts change in a breaking way.
- */
-export const PERMISSIONS_PROTOCOL_VERSION = 1;
-
 // ── Channel name constants ─────────────────────────────────────────────────
 
 /** Emitted at `session_start`, after the service is published. */
@@ -33,43 +25,14 @@ export const PERMISSIONS_UI_PROMPT_CHANNEL = "permissions:ui_prompt";
 /** Emitted after every permission gate resolution. */
 export const PERMISSIONS_DECISION_CHANNEL = "permissions:decision";
 
-/**
- * RPC request channel — query the permission policy (no prompting).
- *
- * @deprecated Use the `Symbol.for()`-backed service accessor instead:
- * ```typescript
- * const { getPermissionsService } = await import("@gotgenes/pi-permission-system");
- * const service = getPermissionsService();
- * if (service) {
- *   const result = service.checkPermission("bash", "git push");
- * }
- * ```
- * The event-bus RPC remains available as a zero-dependency fallback.
- */
-export const PERMISSIONS_RPC_CHECK_CHANNEL = "permissions:rpc:check";
-
-/** RPC request channel — forward a permission prompt to the parent UI. */
-export const PERMISSIONS_RPC_PROMPT_CHANNEL = "permissions:rpc:prompt";
-
-// ── Shared RPC envelope ────────────────────────────────────────────────────
-
-/**
- * Standard RPC reply envelope.
- * Success: `{ success: true, protocolVersion, data? }`.
- * Error:   `{ success: false, protocolVersion, error }`.
- */
-export type PermissionsRpcReply<T = void> =
-  | { success: true; protocolVersion: number; data?: T }
-  | { success: false; protocolVersion: number; error: string };
-
 // ── permissions:ready ──────────────────────────────────────────────────────
 
 /**
  * Payload emitted on `permissions:ready`.
  *
- * Intentionally empty: the channel is a readiness signal. Version negotiation
- * lives in the RPC envelope (`PermissionsRpcReply`), not in broadcast payloads —
- * the published types plus package semver define the broadcast contract.
+ * Intentionally empty: the channel is a readiness signal. There is no
+ * `protocolVersion` — the published types plus package semver define the
+ * broadcast contract.
  */
 export type PermissionsReadyEvent = Record<string, never>;
 
@@ -85,8 +48,7 @@ export type PermissionsReadyEvent = Record<string, never>;
 export type PermissionUiPromptSource =
   | "tool_call"
   | "skill_input"
-  | "skill_read"
-  | "rpc_prompt";
+  | "skill_read";
 
 /** Forwarding context, present only when a prompt was forwarded from a non-UI subagent. */
 export interface ForwardedPromptContext {
@@ -155,64 +117,6 @@ export interface PermissionDecisionEvent {
   matchedPattern: string | null;
 }
 
-// ── permissions:rpc:check ──────────────────────────────────────────────────
-
-/**
- * Request payload for `permissions:rpc:check`.
- *
- * @deprecated Prefer `getPermissionsService().checkPermission()` from the
- * service accessor module. See `PERMISSIONS_RPC_CHECK_CHANNEL` for details.
- */
-export interface PermissionsCheckRequest {
-  requestId: string;
-  /** Permission surface to evaluate. */
-  surface: string;
-  /** The value to evaluate: command string, tool name, skill name, or path. */
-  value?: string;
-  /** Optional agent name for per-agent policy resolution. */
-  agentName?: string;
-}
-
-/**
- * Data field in a successful `permissions:rpc:check` reply.
- *
- * @deprecated Prefer `getPermissionsService().checkPermission()` from the
- * service accessor module. See `PERMISSIONS_RPC_CHECK_CHANNEL` for details.
- */
-export interface PermissionsCheckReplyData {
-  result: "allow" | "deny" | "ask";
-  matchedPattern: string | null;
-  origin: string | null;
-}
-
-// ── permissions:rpc:prompt ─────────────────────────────────────────────────
-
-/** Request payload for `permissions:rpc:prompt`. */
-export interface PermissionsPromptRequest {
-  requestId: string;
-  /** Permission surface being evaluated. */
-  surface: string;
-  /** Value being evaluated (shown in the dialog). */
-  value: string;
-  /** Optional agent name for display. */
-  agentName?: string;
-  /** Message to display in the permission dialog. */
-  message: string;
-  /** Optional label for the "for this session" option. */
-  sessionLabel?: string;
-}
-
-/** Data field in a successful `permissions:rpc:prompt` reply. */
-export interface PermissionsPromptReplyData {
-  approved: boolean;
-  /**
-   * Detailed state: "approved", "approved_for_session",
-   * "denied", or "denied_with_reason".
-   */
-  state: string;
-  denialReason?: string;
-}
-
 // ── Emit helpers ───────────────────────────────────────────────────────────
 
 /**