@gotgenes/pi-permission-system 20.0.0 → 20.2.0

package/src/authority/forwarded-request-server.ts

@@ -3,26 +3,17 @@ import {
   type ForwarderContext,
   getSessionId,
 } from "#src/authority/forwarder-context";
-import type { ConfigReader } from "#src/config-store";
-import { isYoloModeEnabled } from "#src/extension-config";
-import type {
-  PermissionDecisionUi,
-  PermissionPromptDecision,
-  RequestPermissionOptions,
-} from "#src/permission-dialog";
-import {
-  emitUiPromptEvent,
-  type PermissionEventBus,
-} from "#src/permission-events";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   isForwardedPermissionRequestForSession,
   type PermissionForwardingLocation,
 } from "#src/permission-forwarding";
-import { buildForwardedUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
-
+import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import type { PermissionCheckResult } from "#src/types";
+import type { AskEscalator } from "./authorizer-selection";
 import {
   cleanupPermissionForwardingLocationIfEmpty,
   ensureDirectoryExists,
@@ -34,6 +25,7 @@ import {
   safeDeleteFile,
   writeJsonFileAtomic,
 } from "./forwarding-io";
+import type { PromptPermissionDetails } from "./permission-prompter";
 
 /**
  * Narrow seam describing what `ForwardingManager` needs from the server: a
@@ -47,20 +39,30 @@ export interface InboxProcessor {
   processInbox(ctx: ForwarderContext): Promise<void>;
 }
 
+/**
+ * Recorded-authority view the serving node resolves a forwarded request
+ * against: answer one `(surface, value)` query on the serving session's
+ * composed base ruleset (agent-neutral — the child already applied its own
+ * per-agent overrides before forwarding).
+ *
+ * Narrow by design (ISP): the server needs one decision, not the whole
+ * resolver. The composition root satisfies it with an access-intent build plus
+ * `resolver.resolve`, the same primitives `LocalPermissionsService` composes.
+ */
+export interface ServingPolicy {
+  check(surface: string, value: string | null): PermissionCheckResult;
+}
+
 /** Constructor config for `ForwardedRequestServer`. */
 export interface ForwardedRequestServerDeps {
   forwardingDir: string;
   logger: DebugReviewLogger;
-  /** Event bus used for UI prompt broadcasts. */
-  events?: PermissionEventBus;
-  requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
-  config: ConfigReader;
+  /** Recorded-authority resolution for `(surface, value)` requests. */
+  policy: ServingPolicy;
+  /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
+  escalator: AskEscalator;
+  /** In-process subagent registry, read only by the one-hop canary. */
+  registry?: SubagentSessionRegistry;
 }
 
 // ── Module-private helpers ────────────────────────────────────────────────
@@ -78,39 +80,70 @@ function formatForwardedPermissionPrompt(
   ].join("\n");
 }
 
+/**
+ * A request is resolvable against the ruleset only when it carries a concrete
+ * `(surface, value)` display projection. A legacy/version-skew request without
+ * them floors to `ask` (escalate), never a silent grant.
+ */
+function hasDisplayFields(
+  request: ForwardedPermissionRequest,
+): request is ForwardedPermissionRequest & { surface: string; value: string } {
+  return (
+    typeof request.surface === "string" &&
+    request.surface.length > 0 &&
+    typeof request.value === "string" &&
+    request.value.length > 0
+  );
+}
+
+/**
+ * Map a forwarded request onto the escalated ask's details, carrying the
+ * forwarded provenance (requester agent/session + the child's original display
+ * projection) so `LocalUserAuthorizer` emits a non-degraded broadcast (#292).
+ */
+function buildForwardedAskDetails(
+  request: ForwardedPermissionRequest,
+): PromptPermissionDetails {
+  return {
+    requestId: request.id,
+    source: request.source ?? "tool_call",
+    agentName: request.requesterAgentName || null,
+    message: formatForwardedPermissionPrompt(request),
+    surface: request.surface ?? null,
+    value: request.value ?? null,
+    forwarding: {
+      requesterAgentName: request.requesterAgentName || null,
+      requesterSessionId: request.requesterSessionId || null,
+    },
+  };
+}
+
 // ── ForwardedRequestServer ────────────────────────────────────────────────
 
 /**
  * Owner of the serving-down role of the forwarded-permission behavior:
  * draining this session's forwarded-permission inbox and answering each
- * request (auto-approve under yolo, or prompt via the injected UI).
+ * request the same way the session resolves a local action — `evaluate()`
+ * against its recorded authority (`ServingPolicy`), then escalation to its
+ * selected `Authorizer` (`AskEscalator`) on `ask`.
  */
 export class ForwardedRequestServer implements InboxProcessor {
   private readonly forwardingDir: string;
-  private readonly events: PermissionEventBus | undefined;
   private readonly logger: DebugReviewLogger;
-  private readonly requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  private readonly config: ConfigReader;
+  private readonly policy: ServingPolicy;
+  private readonly escalator: AskEscalator;
+  private readonly registry: SubagentSessionRegistry | undefined;
 
   constructor(deps: ForwardedRequestServerDeps) {
     this.forwardingDir = deps.forwardingDir;
-    this.events = deps.events;
     this.logger = deps.logger;
-    this.requestPermissionDecisionFromUi = deps.requestPermissionDecisionFromUi;
-    this.config = deps.config;
+    this.policy = deps.policy;
+    this.escalator = deps.escalator;
+    this.registry = deps.registry;
   }
 
   /** Drain and respond to this session's forwarded-permission inbox. */
   async processInbox(ctx: ForwarderContext): Promise<void> {
-    if (!ctx.hasUI) {
-      return;
-    }
-
     const currentSessionId = getSessionId(ctx);
     const location = getExistingPermissionForwardingLocation(
       this.forwardingDir,
@@ -152,7 +185,6 @@ export class ForwardedRequestServer implements InboxProcessor {
       }
 
       await this.processSingleForwardedRequest(
-        ctx,
         request,
         location,
         requestPath,
@@ -166,7 +198,6 @@ export class ForwardedRequestServer implements InboxProcessor {
   // ── Private methods ────────────────────────────────────────────────────
 
   private async processSingleForwardedRequest(
-    ctx: ForwarderContext,
     request: ForwardedPermissionRequest,
     location: PermissionForwardingLocation,
     requestPath: string,
@@ -185,6 +216,8 @@ export class ForwardedRequestServer implements InboxProcessor {
       return;
     }
 
+    this.warnOnMultiHop(request, currentSessionId);
+
     const forwardedPermissionLogDetails = {
       requestId: request.id,
       source: location.label,
@@ -194,55 +227,32 @@ export class ForwardedRequestServer implements InboxProcessor {
       requestPath,
     };
 
-    let decision: PermissionPromptDecision = {
-      approved: false,
-      state: "denied",
-    };
-    // Last yolo check outside the composed ruleset: dissolves when
-    // processInbox is refactored onto evaluate() + Authorizer selection in
-    // the Phase 9 spine work.
-    if (isYoloModeEnabled(this.config.current())) {
-      this.logger.review(
-        "forwarded_permission.auto_approved",
-        forwardedPermissionLogDetails,
-      );
-      decision = { approved: true, state: "approved" };
-    } else {
-      this.logger.review(
-        "forwarded_permission.prompted",
-        forwardedPermissionLogDetails,
-      );
-      try {
-        const forwardedMessage = formatForwardedPermissionPrompt(request);
-        if (this.events) {
-          emitUiPromptEvent(
-            this.events,
-            buildForwardedUiPrompt({
-              requestId: request.id,
-              message: forwardedMessage,
-              requesterAgentName: request.requesterAgentName || null,
-              requesterSessionId: request.requesterSessionId || null,
-              source: request.source ?? null,
-              surface: request.surface ?? null,
-              value: request.value ?? null,
-            }),
-          );
-        }
-        decision = await this.requestPermissionDecisionFromUi(
-          ctx.ui,
-          "Permission Required (Subagent)",
-          forwardedMessage,
-        );
-      } catch (error) {
-        logPermissionForwardingError(
-          this.logger,
-          "Failed to show forwarded permission confirmation dialog",
-          error,
-        );
-        decision = { approved: false, state: "denied" };
-      }
-    }
+    const decision = await this.resolveDecision(
+      request,
+      forwardedPermissionLogDetails,
+    );
 
+    this.recordForwardedDecision(
+      request,
+      location,
+      requestPath,
+      currentSessionId,
+      decision,
+    );
+  }
+
+  /**
+   * Persist the served decision: write the response file the child polls for,
+   * log the outcome, and delete the drained request. The symmetric "respond"
+   * half to {@link resolveDecision}'s "decide" half.
+   */
+  private recordForwardedDecision(
+    request: ForwardedPermissionRequest,
+    location: PermissionForwardingLocation,
+    requestPath: string,
+    currentSessionId: string,
+    decision: PermissionPromptDecision,
+  ): void {
     const responsePath = join(location.responsesDir, `${request.id}.json`);
     this.logger.review(
       decision.approved
@@ -282,4 +292,68 @@ export class ForwardedRequestServer implements InboxProcessor {
       `${location.label} forwarded permission request`,
     );
   }
+
+  /**
+   * Resolve the request the same way the session resolves a local action:
+   * recorded authority first (a request carrying `(surface, value)` resolves
+   * against the serving node's composed ruleset — `allow`, including
+   * yolo-rewritten, auto-approves; `deny` auto-denies), then escalate `ask`
+   * (or a request without display fields) to the selected `Authorizer`.
+   */
+  private async resolveDecision(
+    request: ForwardedPermissionRequest,
+    logDetails: Record<string, unknown>,
+  ): Promise<PermissionPromptDecision> {
+    const state = hasDisplayFields(request)
+      ? this.policy.check(request.surface, request.value).state
+      : "ask";
+
+    if (state === "allow") {
+      this.logger.review("forwarded_permission.auto_approved", logDetails);
+      return { approved: true, state: "approved" };
+    }
+    if (state === "deny") {
+      this.logger.review("forwarded_permission.auto_denied", logDetails);
+      return { approved: false, state: "denied" };
+    }
+
+    this.logger.review("forwarded_permission.prompted", logDetails);
+    try {
+      return await this.escalator.escalate(buildForwardedAskDetails(request));
+    } catch (error) {
+      logPermissionForwardingError(
+        this.logger,
+        `Failed to escalate forwarded permission request '${request.id}'`,
+        error,
+      );
+      return { approved: false, state: "denied" };
+    }
+  }
+
+  /**
+   * One-hop canary: forwarding is depth-1 (child → root). If the requester is
+   * itself a registered subagent whose parent is not this serving session, the
+   * request came through more than one hop (or was misrouted) — resolution is
+   * still well-defined, so keep serving, but warn loudly so a future
+   * recursion-guard break is visible rather than silent. Unregistered
+   * (external file-based) requesters have no recorded parent and are silent.
+   */
+  private warnOnMultiHop(
+    request: ForwardedPermissionRequest,
+    currentSessionId: string,
+  ): void {
+    const requesterInfo = this.registry?.get(request.requesterSessionId);
+    if (
+      requesterInfo?.parentSessionId &&
+      requesterInfo.parentSessionId !== currentSessionId
+    ) {
+      logPermissionForwardingWarning(
+        this.logger,
+        `Forwarded permission request '${request.id}' violates the one-hop ` +
+          `invariant: requester '${request.requesterSessionId}' is a registered ` +
+          `subagent whose parent '${requesterInfo.parentSessionId}' is not this ` +
+          `serving session '${currentSessionId}' (multi-hop or misrouted).`,
+      );
+    }
+  }
 }

package/src/authority/local-user-authorizer.ts

@@ -0,0 +1,51 @@
+import type {
+  PermissionDecisionUi,
+  PermissionPromptDecision,
+  requestPermissionDecisionFromUi,
+} from "#src/permission-dialog";
+import {
+  emitUiPromptEvent,
+  type PermissionEventBus,
+} from "#src/permission-events";
+import { buildUiPrompt } from "#src/permission-ui-prompt";
+import type { Authorizer } from "./authorizer";
+import type { PromptPermissionDetails } from "./permission-prompter";
+
+/** Dependencies required by {@link LocalUserAuthorizer}. */
+export interface LocalUserAuthorizerDeps {
+  /** The active session's UI surface. */
+  ui: PermissionDecisionUi;
+  /** Event bus used for the `permissions:ui_prompt` broadcast. */
+  events: PermissionEventBus;
+  /** Injected for testability; production callers pass the real function. */
+  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+}
+
+/**
+ * Authorizer for a session with an active UI: prompt the human here.
+ *
+ * Emits the `permissions:ui_prompt` broadcast (moved here from
+ * `PermissionPrompter`'s `ctx.hasUI` arm) before showing the dialog, so
+ * observers know a decision is imminent. This is the single emit site: a
+ * forwarded ask carries its provenance on `details.forwarding`, which this
+ * class renders (populated `forwarding` context + "(Subagent)" title) so the
+ * broadcast stays non-degraded (#292) without a second emission path.
+ */
+export class LocalUserAuthorizer implements Authorizer {
+  constructor(private readonly deps: LocalUserAuthorizerDeps) {}
+
+  authorize(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision> {
+    const uiPrompt = buildUiPrompt(details);
+    emitUiPromptEvent(this.deps.events, uiPrompt);
+    return this.deps.requestPermissionDecisionFromUi(
+      this.deps.ui,
+      details.forwarding
+        ? "Permission Required (Subagent)"
+        : "Permission Required",
+      details.message,
+      details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
+    );
+  }
+}

package/src/{permission-prompter.ts → authority/permission-prompter.ts}

@@ -1,15 +1,22 @@
-import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ApprovalRequester } from "./authority/approval-escalator";
-import type { PermissionPromptDecision } from "./permission-dialog";
-import {
-  emitUiPromptEvent,
-  type PermissionEventBus,
-} from "./permission-events";
-import { buildDirectUiPrompt } from "./permission-ui-prompt";
-import type { ReviewLogger } from "./session-logger";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
+import type { ReviewLogger } from "#src/session-logger";
+import type { Authorizer } from "./authorizer";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
+/**
+ * Provenance of a forwarded ask: who is really asking, one hop below.
+ *
+ * Present on {@link PromptPermissionDetails} only when the ask was forwarded
+ * from a subagent. Structurally identical to the event's `ForwardedPromptContext`
+ * so the details flow straight into `buildUiPrompt`, but declared here to keep
+ * the prompter layer free of an events-module import.
+ */
+export interface ForwardedAskProvenance {
+  requesterAgentName: string | null;
+  requesterSessionId: string | null;
+}
+
 /** Details passed when prompting the user for a permission decision. */
 export interface PromptPermissionDetails {
   requestId: string;
@@ -25,74 +32,61 @@ export interface PromptPermissionDetails {
   toolInputPreview?: string;
   /** Override label for the "for this session" dialog option. */
   sessionLabel?: string;
+  /** Explicit display-surface override (a forwarded ask carries the child's original). */
+  surface?: string | null;
+  /** Explicit display-value override (a forwarded ask carries the child's original). */
+  value?: string | null;
+  /** Present iff this ask was forwarded from a subagent; drives the non-degraded broadcast + "(Subagent)" title. */
+  forwarding?: ForwardedAskProvenance;
 }
 
-/** Mockable contract for permission prompting. */
+/**
+ * Narrow seam onto {@link PermissionPrompter}.
+ *
+ * Kept separate from the concrete class so consumers (e.g. `AuthorizerSelection`)
+ * can inject a plain `{ prompt: vi.fn() }` mock in tests — a private field on
+ * the concrete class would create a nominal brand that a structural mock
+ * cannot satisfy without a cast.
+ */
 export interface PermissionPrompterApi {
   prompt(
-    ctx: ExtensionContext,
+    authorizer: Authorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
 }
 
-/**
- * Dependencies required by PermissionPrompter.
- *
- * Keeps the prompter's external surface narrow: callers provide a review
- * logger, the UI-prompt event bus, and the forwarder that owns the
- * UI/subagent-forwarding branching logic.
- */
+/** Dependencies required by {@link PermissionPrompter}. */
 export interface PermissionPrompterDeps {
   /** Write structured entries to the permission review log. */
   logger: ReviewLogger;
-  /** Event bus used for UI prompt broadcasts. */
-  events: PermissionEventBus;
-  /** Resolves the permission decision: direct UI dialog or forwarded to parent. */
-  forwarder: ApprovalRequester;
 }
 
 /**
- * Encapsulates the full permission-prompt flow:
+ * Brackets the ask-path flow with review-log entries and delegates the
+ * live decision to the selected {@link Authorizer}:
  *   1. Review-log "waiting" entry.
- *   2. UI-present vs. subagent-forwarding branching (via confirmPermission).
+ *   2. `authorizer.authorize(details)`.
  *   3. Review-log "approved" / "denied" entry.
  *
+ * The UI/forwarding branching this class previously owned now lives on the
+ * individual `Authorizer` implementations (`LocalUserAuthorizer`,
+ * `ParentAuthorizer`, `DenyingAuthorizer`) — this class no longer threads
+ * `ExtensionContext` per call.
+ *
  * Yolo-mode auto-approval happens upstream, at the composition stage
  * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
  * this class under yolo, so this class has no yolo-mode knowledge.
- *
- * Injecting a single PermissionPrompter instance means adding a new prompt
- * parameter (e.g. a future sessionLabel variant) only requires changing
- * PromptPermissionDetails and this class — not the full threading chain.
  */
 export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}
 
   async prompt(
-    ctx: ExtensionContext,
+    authorizer: Authorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
     this.writeReviewEntry("permission_request.waiting", details);
 
-    // Build the event once. When this session has UI it broadcasts directly;
-    // when it does not (a forwarding subagent), the display fields ride along
-    // to the parent so the parent emits a non-degraded event from the
-    // forwarded path instead of here.
-    const uiPrompt = buildDirectUiPrompt(details);
-    if (ctx.hasUI) {
-      emitUiPromptEvent(this.deps.events, uiPrompt);
-    }
-
-    const decision = await this.deps.forwarder.requestApproval(
-      ctx,
-      details.message,
-      details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
-      {
-        source: uiPrompt.source,
-        surface: uiPrompt.surface,
-        value: uiPrompt.value,
-      },
-    );
+    const decision = await authorizer.authorize(details);
 
     this.writeReviewEntry(
       decision.approved
@@ -100,7 +94,9 @@ export class PermissionPrompter implements PermissionPrompterApi {
         : "permission_request.denied",
       {
         ...details,
-        resolution: decision.state,
+        resolution: decision.confirmationUnavailable
+          ? "confirmation_unavailable"
+          : decision.state,
         denialReason: decision.denialReason,
       },
     );

package/src/authority/subagent-detection.ts

@@ -8,7 +8,7 @@ import type { SubagentSessionRegistry } from "#src/subagent-registry";
 /**
  * Narrow seam for the ask-path consumers: "is the current session a subagent?"
  *
- * `PromptingGateway`, `ForwardingManager`, and `ApprovalEscalator` depend on
+ * `selectAuthorizer`/`AuthorizerSelection` and `ForwardingManager` depend on
  * this single-method view so their unit tests inject a one-field fake without
  * casts. It is the Authorizer-selection predicate the Phase 9 spine consumes.
  */

package/src/config-loader.ts

@@ -14,7 +14,7 @@ import {
 } from "./config-schema";
 import { mergeFlatPermissions } from "./permission-merge";
 import type { FlatPermissionConfig, PatternValue } from "./types";
-import { isDenyWithReason, isPermissionState } from "./value-guards";
+import { isDenyWithReason, isPermissionState } from "./types";
 
 // The unified config shape is derived from the zod schema (config-schema.ts,
 // the single source of truth) and re-exported so existing importers keep their

package/src/handlers/gates/descriptor.ts

@@ -1,6 +1,6 @@
+import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
 import type { DenialContext } from "#src/denial-messages";
 import type { PermissionDecisionEvent } from "#src/permission-events";
-import type { PromptPermissionDetails } from "#src/permission-prompter";
 import type { SessionApproval } from "#src/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 

package/src/handlers/gates/helpers.ts

@@ -53,13 +53,14 @@ export function buildDecisionEvent(
  * @param action    - The gate's resulting action ("allow" | "block").
  * @param hasSession - True when the gate result carries a sessionApproval
  *                    (indicates the user chose "for this session").
- * @param canConfirm - Whether an interactive prompt was available.
+ * @param confirmationUnavailable - True when the denial came from the
+ *                    DenyingAuthorizer (no live authority was reachable).
  */
 export function deriveResolution(
   state: "allow" | "deny" | "ask",
   action: "allow" | "block",
   hasSession: boolean,
-  canConfirm: boolean,
+  confirmationUnavailable: boolean,
   autoApproved = false,
 ): PermissionDecisionResolution {
   if (state === "allow") return autoApproved ? "auto_approved" : "policy_allow";
@@ -69,5 +70,5 @@ export function deriveResolution(
     if (autoApproved) return "auto_approved";
     return hasSession ? "user_approved_for_session" : "user_approved";
   }
-  return canConfirm ? "user_denied" : "confirmation_unavailable";
+  return confirmationUnavailable ? "confirmation_unavailable" : "user_denied";
 }

package/src/handlers/gates/runner.ts

@@ -1,10 +1,10 @@
+import type { AskEscalator } from "#src/authority/authorizer-selection";
 import type { DecisionReporter } from "#src/decision-reporter";
 import {
   formatDenyReason,
   formatUnavailableReason,
   formatUserDeniedReason,
 } from "#src/denial-messages";
-import type { GatePrompter } from "#src/gate-prompter";
 import type { PermissionPromptDecision } from "#src/permission-dialog";
 import { applyPermissionGate } from "#src/permission-gate";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
@@ -30,7 +30,7 @@ export class GateRunner {
   constructor(
     private readonly resolver: ScopedPermissionResolver,
     private readonly recorder: SessionApprovalRecorder,
-    private readonly prompter: GatePrompter,
+    private readonly prompter: AskEscalator,
     private readonly reporter: DecisionReporter,
   ) {}
 
@@ -127,8 +127,8 @@ export class GateRunner {
       return { action: "allow" };
     }
 
-    // 3. Apply the deny/ask/allow gate
-    const canConfirm = this.prompter.canConfirm();
+    // 3. Apply the deny/ask/allow gate — always escalate on ask; the selected
+    // Authorizer answers (the DenyingAuthorizer by denying with a marker).
 
     // Construct messages from the centralized formatter.
     const messages = {
@@ -139,16 +139,17 @@ export class GateRunner {
     };
 
     let autoApproved = false;
+    let confirmationUnavailable = false;
     const gateResult = await applyPermissionGate({
       state: check.state,
-      canConfirm,
       sessionApproval: descriptor.sessionApproval?.toGateApproval(),
       promptForApproval: async () => {
-        const decision = await this.prompter.prompt({
+        const decision = await this.prompter.escalate({
           requestId: toolCallId,
           ...descriptor.promptDetails,
         });
         autoApproved = decision.autoApproved === true;
+        confirmationUnavailable = decision.confirmationUnavailable === true;
         return decision;
       },
       writeLog: (event, details) =>
@@ -172,7 +173,7 @@ export class GateRunner {
           check.state,
           gateResult.action,
           hasSessionApproval,
-          canConfirm,
+          confirmationUnavailable,
           autoApproved,
         ),
       ),