@gotgenes/pi-permission-system 20.10.0 → 22.0.0

package/CHANGELOG.md

@@ -5,6 +5,49 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [22.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v21.0.0...pi-permission-system-v22.0.0) (2026-07-24)
+
+
+### ⚠ BREAKING CHANGES
+
+* **pi-permission-system:** In an untrusted project, project-scoped permission configuration (project config.json and project-agent frontmatter) and project-scoped runtime config (yoloMode, permissionReviewLog, etc.) are no longer loaded until the user grants project trust. Only global policy applies. Grant project trust, or set defaultProjectTrust, to restore the prior behavior.
+
+### Features
+
+* **pi-permission-system:** support skipping project scope in loadAndMergeConfigs ([e5a2e57](https://github.com/gotgenes/pi-packages/commit/e5a2e57b39c7bae44e7ac126b24094c2d5dce155))
+
+
+### Bug Fixes
+
+* **pi-permission-system:** gate project-scoped config on project trust ([f264e71](https://github.com/gotgenes/pi-packages/commit/f264e711b90c7947d805bec654bc78199a76fada))
+
+
+### Documentation
+
+* **pi-permission-system:** document project-trust gating for project config ([e955a29](https://github.com/gotgenes/pi-packages/commit/e955a299156215be57144000d5157481615d8060))
+
+## [21.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.10.0...pi-permission-system-v21.0.0) (2026-07-24)
+
+
+### ⚠ BREAKING CHANGES
+
+* **pi-permission-system:** A session whose project/agent/project-agent config is invalid previously inherited a lower scope's `allow` rules unchanged; those surfaces now resolve to `ask` (prompt) until the invalid config is corrected. Only sessions that already emit a config-validation warning are affected. Fix the reported config issues and reload to restore the intended policy.
+
+### Features
+
+* **pi-permission-system:** add floorAllowsToAsk allow→ask overlay ([#646](https://github.com/gotgenes/pi-packages/issues/646)) ([8dbdcd7](https://github.com/gotgenes/pi-packages/commit/8dbdcd75bd8c6f62528d0466f93cfefa039f3d4b))
+* **pi-permission-system:** mark invalid non-global config scopes ([#646](https://github.com/gotgenes/pi-packages/issues/646)) ([1abd318](https://github.com/gotgenes/pi-packages/commit/1abd3182b7c1b6304d0ef28acfbb59c470508a43))
+
+
+### Bug Fixes
+
+* **pi-permission-system:** fail closed when a higher-precedence config scope is invalid ([#646](https://github.com/gotgenes/pi-packages/issues/646)) ([b3c11c0](https://github.com/gotgenes/pi-packages/commit/b3c11c0984b7d9849349c5d8d0f1de111d1c7a03))
+
+
+### Documentation
+
+* **pi-permission-system:** document cross-scope fail-closed config clamp ([#646](https://github.com/gotgenes/pi-packages/issues/646)) ([7903b4c](https://github.com/gotgenes/pi-packages/commit/7903b4cc15710618a6f0ed5cc302687af18db4be))
+
 ## [20.10.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.9.1...pi-permission-system-v20.10.0) (2026-07-21)
 
 

package/README.md

@@ -107,6 +107,7 @@ Config lives in one JSON file per scope:
 | Project | `<cwd>/.pi/extensions/pi-permission-system/config.json`   |
 
 Project overrides global; per-agent YAML frontmatter overrides both.
+Project config (policy and runtime knobs) is loaded only once the project is trusted — in an untrusted directory only global config applies, so an untrusted repository cannot loosen your global policy (see [Upgrading](#2200--project-config-requires-project-trust)).
 
 Within a surface map like `bash` or `mcp`, **last matching rule wins** — put broad catch-alls first and specific overrides after.
 
@@ -120,6 +121,13 @@ For the full reference — all surfaces, runtime knobs, per-agent overrides, mer
 
 ## Upgrading
 
+### 22.0.0 — project config requires project trust
+
+Project-scoped configuration (the project `config.json` and project-agent frontmatter — both permission policy and runtime knobs such as `yoloMode`) is now loaded only when Pi reports the project as trusted.
+In an untrusted directory, only global config applies; a skip is surfaced with a warning and a `project_trust.skipped` review-log entry.
+Grant project trust (or set `defaultProjectTrust`) to load a project's config.
+See [docs/migration/0644-project-trust-gating.md](docs/migration/0644-project-trust-gating.md).
+
 ### 16.0.0 — the bash gate now fails closed
 
 The permission gate fails closed: an internal gate error blocks the tool (with a `gate_error` review-log entry) instead of running it ungated, and a non-empty bash command that cannot be parsed resolves to `ask` (sentinel `<unparseable-bash-command>`) rather than falling through to a permissive top-level `*`.
@@ -129,17 +137,18 @@ If you relied on the old permissive behavior for bash, set an explicit permissiv
 
 ## Documentation
 
-| Document                                                                                                                       | Contents                                                                                |
-| ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- |
-| [docs/configuration.md](docs/configuration.md)                                                                                 | Full policy reference, runtime knobs, per-agent overrides, recipes                      |
-| [docs/session-approvals.md](docs/session-approvals.md)                                                                         | Session-scoped rules, pattern suggestions, bash arity table                             |
-| [docs/cross-extension-api.md](docs/cross-extension-api.md)                                                                     | Cross-extension service accessor, event bus integration, prompt and decision broadcasts |
-| [docs/subagent-integration.md](docs/subagent-integration.md)                                                                   | Permission forwarding, coexistence with subagent extensions                             |
-| [docs/guides/permission-frontmatter-for-subagent-extensions.md](docs/guides/permission-frontmatter-for-subagent-extensions.md) | Convention guide for subagent extension authors                                         |
-| [docs/opencode-compatibility.md](docs/opencode-compatibility.md)                                                               | OpenCode compatibility — shared concepts, divergences, porting guide                    |
-| [docs/troubleshooting.md](docs/troubleshooting.md)                                                                             | Common issues, diagnostic logging, threat model                                         |
-| [docs/migration/legacy-to-flat.md](docs/migration/legacy-to-flat.md)                                                           | Migration from pre-v2 config layout                                                     |
-| [docs/migration/strict-config-validation.md](docs/migration/strict-config-validation.md)                                       | Strict config validation (breaking) — reading and fixing rejected configs               |
+| Document                                                                                                                       | Contents                                                                                      |
+| ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
+| [docs/configuration.md](docs/configuration.md)                                                                                 | Full policy reference, runtime knobs, per-agent overrides, recipes                            |
+| [docs/session-approvals.md](docs/session-approvals.md)                                                                         | Session-scoped rules, pattern suggestions, bash arity table                                   |
+| [docs/cross-extension-api.md](docs/cross-extension-api.md)                                                                     | Cross-extension service accessor, event bus integration, prompt and decision broadcasts       |
+| [docs/subagent-integration.md](docs/subagent-integration.md)                                                                   | Permission forwarding, coexistence with subagent extensions                                   |
+| [docs/guides/permission-frontmatter-for-subagent-extensions.md](docs/guides/permission-frontmatter-for-subagent-extensions.md) | Convention guide for subagent extension authors                                               |
+| [docs/opencode-compatibility.md](docs/opencode-compatibility.md)                                                               | OpenCode compatibility — shared concepts, divergences, porting guide                          |
+| [docs/troubleshooting.md](docs/troubleshooting.md)                                                                             | Common issues, diagnostic logging, threat model                                               |
+| [docs/migration/legacy-to-flat.md](docs/migration/legacy-to-flat.md)                                                           | Migration from pre-v2 config layout                                                           |
+| [docs/migration/strict-config-validation.md](docs/migration/strict-config-validation.md)                                       | Strict config validation (breaking) — rejected configs, and the cross-scope fail-closed clamp |
+| [docs/migration/0644-project-trust-gating.md](docs/migration/0644-project-trust-gating.md)                                     | Project-trust gating (breaking) — project config loads only after project trust               |
 
 ## Development
 

package/dist/public.d.ts

@@ -86,9 +86,11 @@ type PermissionState = z.infer<typeof permissionStateSchema>;
  * Synthesized:   "builtin" (universal default / evaluate() fallback),
  *                "baseline" (conditional MCP metadata auto-allow).
  * Runtime:       "session" (session approvals).
- * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
+ * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode),
+ *                "fail-closed" (composition-stage allow→ask floor when an
+ *                invalid non-global config scope is detected).
  */
-type RuleOrigin = "global" | "project" | "agent" | "project-agent" | "builtin" | "baseline" | "session" | "yolo";
+type RuleOrigin = "global" | "project" | "agent" | "project-agent" | "builtin" | "baseline" | "session" | "yolo" | "fail-closed";
 
 /**
  * Execution context of a bash command nested inside a substitution or subshell.

package/docs/configuration.md

@@ -11,6 +11,12 @@ One unified config file per scope:
 
 Project config overrides global config; per-agent frontmatter overrides both.
 
+**Project config requires project trust.**
+Project and project-agent scopes (both permission policy and runtime config such as `yoloMode`) are loaded only when Pi reports the project as trusted (`ctx.isProjectTrusted()`).
+In an untrusted directory, only global (and global-agent) config applies, so an untrusted repository cannot loosen your global policy; the extension surfaces a loud warning plus a `project_trust.skipped` review-log entry when it skips a project scope.
+Grant project trust (or configure `defaultProjectTrust`) to load the project's config; a trust grant reloads project policy on the next `resources_discover` reload.
+See [migration/0644-project-trust-gating.md](migration/0644-project-trust-gating.md).
+
 > **Coming from OpenCode?**
 > This extension's permission model was inspired by OpenCode's.
 > See [OpenCode Compatibility](opencode-compatibility.md) for shared concepts, divergences, and a porting guide.
@@ -32,6 +38,14 @@ Project config overrides global config; per-agent frontmatter overrides both.
 The `permission` object uses deep-shallow merge: string-vs-string replaces; both-object shallow-merges pattern maps; string-vs-object the override wins entirely.
 Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`) use simple replacement.
 
+**Invalid higher-precedence scope fails closed.**
+If a non-global scope (project config, global agent frontmatter, or project agent frontmatter) is present but fails to load or validate, it no longer contributes an empty scope that silently inherits the lower scope's rules.
+Instead the effective policy is floored so nothing resolves more permissively than `ask`: every `allow` (including one inherited from a lower scope) is clamped to `ask`, while `deny` and `ask` are unchanged.
+So a global `bash: allow` cannot remain effective behind a project scope that was meant to deny bash but contains a typo — bash prompts until the invalid config is fixed.
+A validation warning plus a distinct fail-closed notice are emitted, and a fix + reload restores the intended policy.
+An invalid **global** scope does not trigger the clamp — it is the lowest precedence, so nothing more permissive is inherited when it fails.
+This clamp is deny-preserving and, like `yoloMode`, applied at composition; when `yoloMode` is on it re-permits the floored `ask` back to `allow`, since yolo is an explicit full-permissive opt-in.
+
 ## Full Example
 
 ```jsonc

package/docs/migration/0644-project-trust-gating.md

@@ -0,0 +1,32 @@
+# Migration guide: project-trust gating
+
+Starting with the release that closes #644, the permission-system loads project-scoped configuration only after Pi reports the project as **trusted** (`ctx.isProjectTrusted()`).
+This is a **breaking change** in how config is loaded in an untrusted directory.
+
+## What changed
+
+The extension used to load project-scoped config from the current working directory unconditionally — it never consulted Pi's project-trust decision.
+Because project scope has higher precedence than global, an untrusted repository could ship a `.pi/extensions/pi-permission-system/config.json` that **loosened** an operator's global policy before the user granted trust — for example flipping a global `bash: deny` to `bash: allow`, or setting `yoloMode: true`.
+
+Now, when the project is **not** trusted:
+
+- Project and project-agent **permission policy** scopes are not loaded — only global (and global-agent) policy participates in resolution.
+- Project **runtime config** (`yoloMode`, `permissionReviewLog`, `piInfrastructureReadPaths`, `shellTools`, `authorizerChain`, …) is not merged.
+- Each skip is surfaced loudly: a UI warning and a `project_trust.skipped` entry in the permission review log.
+
+This aligns the extension with Pi's own trust model, which already withholds project-local skills, prompts, and agents from untrusted directories.
+
+## Timing and recovery
+
+Pi resolves the trust decision (including any `defaultProjectTrust` setting) before `session_start`, so the guard sees the effective decision from the first tool call.
+If you grant trust after the session starts, Pi fires `resources_discover` with `reason: "reload"`, and the extension re-reads trust and loads the project **policy** at that point.
+Project **runtime** config (e.g. `yoloMode`) is re-read on the next session start.
+
+## What you need to do
+
+If you only use global config, nothing changes.
+
+If you rely on a project's `.pi/extensions/pi-permission-system/config.json`, **grant the project trust** when Pi prompts (or configure `defaultProjectTrust` to always trust).
+Until then, the project's permission rules and runtime knobs are ignored and only your global policy applies.
+
+If a project's rules stop taking effect after upgrading (surfaces you allowed at the project scope start prompting or denying per global policy), check whether the project is trusted — the review log will contain a `project_trust.skipped` entry naming the untrusted `cwd`.

package/docs/migration/strict-config-validation.md

@@ -11,11 +11,25 @@ For example, a config with `"debugLog": "yes"` (a string, not a boolean) simply
 The loader is now **strict and fail-closed**:
 
 - A config file with **any** invalid field is rejected as a whole scope (global or project).
-- The rejected scope contributes **no** permission rules, so its surfaces fall back to the safe universal `ask` default — never `allow`.
+- The rejected scope contributes **no** permission rules.
 - Each problem is reported as a clear, path-qualified issue in the permission review log (and the debug log when `debugLog` is on).
 
 Nothing about the config **format** changed — a config that was already valid keeps working unchanged.
 
+## Cross-scope hardening (fail closed on an invalid higher scope)
+
+Rejecting a scope's rules is only half the story.
+Because a higher-precedence scope that contributes no rules leaves the **lower** scope's rules in place, an invalid *higher* scope used to silently inherit the lower scope's policy — including a permissive `allow`.
+For example, a global `bash: allow` remained effective even when a project config meant to deny bash but contained a typo.
+
+The loader now fails closed across scopes as well: when a **non-global** scope (project config, global agent frontmatter, or project agent frontmatter) is present but invalid, the effective policy is floored so nothing resolves more permissively than `ask`.
+Every `allow` — including one inherited from a lower scope — is clamped to `ask`; `deny` and `ask` are unchanged.
+Alongside the per-problem validation issues, a distinct notice is reported: `Invalid <scope> configuration detected — failing closed: 'allow' rules are clamped to 'ask' …`.
+
+An invalid **global** scope does not trigger the cross-scope clamp — it is the lowest precedence, so nothing more permissive is inherited when it fails.
+The clamp is deny-preserving, and (like `yoloMode`) applied at composition; when `yoloMode` is on it re-permits the floored `ask` back to `allow`.
+Fix the reported problems and reload to restore the intended policy.
+
 ## What you need to do
 
 If your config was valid, nothing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.10.0",
+  "version": "22.0.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/config-loader.ts

@@ -286,12 +286,20 @@ export interface MergedConfigResult {
  * Legacy files are detected and warned about. Their content is parsed with the
  * flat-format parser — legacy-format keys (defaultPolicy, tools, bash, etc.)
  * are not translated and contribute no permission rules.
+ *
+ * When `options.includeProjectScope` is `false`, the project-scope steps (4 and
+ * 5) are skipped entirely — neither the legacy project policy nor the new
+ * project config is read or merged. This gates project-local config on project
+ * trust: an untrusted repository cannot loosen the operator's global policy
+ * (#644). It defaults to `true`, preserving the trusted / caller-agnostic path.
  */
 export function loadAndMergeConfigs(
   agentDir: string,
   cwd: string,
   extensionRoot: string,
+  options: { includeProjectScope?: boolean } = {},
 ): MergedConfigResult {
+  const includeProjectScope = options.includeProjectScope !== false;
   const allIssues: string[] = [];
 
   const newGlobalPath = getGlobalConfigPath(agentDir);
@@ -339,8 +347,8 @@ export function loadAndMergeConfigs(
   const globalConfig = globalResult.config;
   merged = mergeUnifiedConfigs(merged, globalConfig);
 
-  // 4. Legacy project policy
-  if (existsSync(legacyProjectPolicyPath)) {
+  // 4. Legacy project policy — skipped when the project scope is withheld.
+  if (includeProjectScope && existsSync(legacyProjectPolicyPath)) {
     const legacy = loadUnifiedConfig(legacyProjectPolicyPath);
     allIssues.push(
       `Legacy project policy found at '${legacyProjectPolicyPath}'. ` +
@@ -351,8 +359,11 @@ export function loadAndMergeConfigs(
     merged = mergeUnifiedConfigs(merged, legacy.config);
   }
 
-  // 5. New project config
-  const projectResult = loadUnifiedConfig(newProjectPath);
+  // 5. New project config — skipped when the project scope is withheld, so an
+  // untrusted project contributes nothing and `project` reports empty.
+  const projectResult = includeProjectScope
+    ? loadUnifiedConfig(newProjectPath)
+    : { config: {}, issues: [] };
   allIssues.push(...projectResult.issues);
   const projectConfig = projectResult.config;
   merged = mergeUnifiedConfigs(merged, projectConfig);

package/src/config-store.ts

@@ -41,7 +41,7 @@ export interface ConfigReader {
  * coupling between the class and test doubles.
  */
 export interface SessionConfigStore extends ConfigReader {
-  refresh(ctx?: ExtensionContext): void;
+  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void;
   logResolvedPaths(cwd?: string): void;
 }
 
@@ -96,14 +96,17 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
    * Reload merged config from disk.
    *
    * If `ctx` is provided, uses it to derive the cwd and sync UI status.
-   * Equivalent to `refreshExtensionConfig(runtime, ctx?)`.
+   * When `projectTrusted` is `false`, the project scope is withheld so an
+   * untrusted repository's runtime config (`yoloMode`, `permissionReviewLog`,
+   * …) cannot loosen the operator's global config (#644).
    */
-  refresh(ctx?: ExtensionContext): void {
+  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void {
     const cwd = ctx?.cwd ?? null;
     const mergeResult = loadAndMergeConfigs(
       this.deps.agentDir,
       cwd ?? "",
       EXTENSION_ROOT,
+      { includeProjectScope: projectTrusted },
     );
     const runtimeConfig = normalizePermissionSystemConfig(mergeResult.merged);
     this.config = runtimeConfig;
@@ -127,6 +130,7 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
       debugLog: runtimeConfig.debugLog,
       permissionReviewLog: runtimeConfig.permissionReviewLog,
       yoloMode: runtimeConfig.yoloMode,
+      projectTrusted,
     });
   }
 

package/src/handlers/before-agent-start.ts

@@ -62,7 +62,11 @@ export class AgentPrepHandler {
     // to whole-string matching.
     this.warmParser();
     this.session.activate(ctx);
-    this.session.refreshConfig(ctx);
+    // Gate the mid-session runtime-config refresh on project trust too, so an
+    // untrusted project cannot slip its runtime config (e.g. `yoloMode`) in
+    // right before agent start after session_start withheld it (#644). The
+    // session_start handler already warned; do not re-warn on every start.
+    this.session.refreshConfig(ctx, ctx.isProjectTrusted());
 
     const agentName = this.session.resolveAgentName(ctx, event.systemPrompt);
     const activeTools = this.toolRegistry.getActive();

package/src/handlers/lifecycle.ts

@@ -17,6 +17,15 @@ interface ResourcesDiscoverPayload {
   reason: string;
 }
 
+/**
+ * Shown when project config is skipped because the project is untrusted, so the
+ * reduced-scope state is never silent (#644). Exported for assertion in tests.
+ */
+export const UNTRUSTED_PROJECT_MESSAGE =
+  "pi-permission-system: project is not trusted — skipping project-scoped " +
+  "permission configuration. Only global policy applies. Grant project trust " +
+  "to load this project's permission rules.";
+
 /**
  * Handles session lifecycle events: start, reload, and shutdown.
  *
@@ -42,9 +51,13 @@ export class SessionLifecycleHandler {
     event: SessionStartPayload,
     ctx: ExtensionContext,
   ): Promise<void> {
-    this.session.refreshConfig(ctx);
-    this.session.resetForNewSession(ctx);
+    const projectTrusted = ctx.isProjectTrusted();
+    this.session.refreshConfig(ctx, projectTrusted);
+    this.session.resetForNewSession(ctx, projectTrusted);
     this.session.logResolvedConfigPaths();
+    if (!projectTrusted) {
+      this.warnProjectUntrusted(ctx, "session_start");
+    }
 
     const agentName = this.session.resolveAgentName(ctx);
     const policyIssues = this.resolver.getConfigIssues(agentName ?? undefined);
@@ -68,12 +81,19 @@ export class SessionLifecycleHandler {
     return Promise.resolve();
   }
 
-  handleResourcesDiscover(event: ResourcesDiscoverPayload): Promise<void> {
+  handleResourcesDiscover(
+    event: ResourcesDiscoverPayload,
+    ctx: ExtensionContext,
+  ): Promise<void> {
     if (event.reason !== "reload") {
       return Promise.resolve();
     }
 
-    this.session.reload();
+    const projectTrusted = ctx.isProjectTrusted();
+    this.session.reload(projectTrusted);
+    if (!projectTrusted) {
+      this.warnProjectUntrusted(ctx, "resources_discover");
+    }
     this.logger.debug("lifecycle.reload", {
       triggeredBy: "resources_discover",
       reason: event.reason,
@@ -82,6 +102,18 @@ export class SessionLifecycleHandler {
     return Promise.resolve();
   }
 
+  /**
+   * Record the project-trust skip in the review log and surface a loud warning
+   * to the user, so the reduced (global-only) scope is never silent (#644).
+   */
+  private warnProjectUntrusted(
+    ctx: ExtensionContext,
+    phase: "session_start" | "resources_discover",
+  ): void {
+    this.logger.review("project_trust.skipped", { cwd: ctx.cwd, phase });
+    this.logger.warn(UNTRUSTED_PROJECT_MESSAGE);
+  }
+
   handleSessionShutdown(): Promise<void> {
     const ctx = this.session.getRuntimeContext();
     if (ctx) {

package/src/index.ts

@@ -171,7 +171,9 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // refresh() must run after `session` is assigned: a debug-write IO failure
   // triggers the logger's notify sink — `session.notify(m)` — which no-ops
   // on the null context but requires `session` to be bound.
-  configStore.refresh();
+  // No ctx/trust decision exists at factory init, so withhold the project
+  // scope (fail closed); session_start reloads with the real trust decision.
+  configStore.refresh(undefined, false);
 
   const configPath = getGlobalConfigPath(agentDir);
   registerPermissionSystemCommand(pi, {
@@ -258,8 +260,8 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   pi.on("session_start", (event, ctx) =>
     lifecycle.handleSessionStart(event, ctx),
   );
-  pi.on("resources_discover", (event) =>
-    lifecycle.handleResourcesDiscover(event),
+  pi.on("resources_discover", (event, ctx) =>
+    lifecycle.handleResourcesDiscover(event, ctx),
   );
   pi.on("session_shutdown", () => lifecycle.handleSessionShutdown());
   pi.on("before_agent_start", (event, ctx) => agentPrep.handle(event, ctx));

package/src/permission-manager.ts

@@ -21,6 +21,7 @@ import {
   evaluate,
   evaluateAnyValue,
   evaluateFirst,
+  floorAllowsToAsk,
   pathMatchOptions,
   rewriteAsksToYolo,
 } from "./rule";
@@ -61,6 +62,12 @@ type ResolvedPermissions = {
    * Session rules are appended at call-time inside check().
    */
   composedRules: Ruleset;
+  /**
+   * Non-global scopes whose config file failed to load or validate. When
+   * non-empty the composed ruleset has been floored allow→ask (#646); the
+   * names also drive the fail-closed notice in {@link getConfigIssues}.
+   */
+  failClosedScopes: RuleOrigin[];
 };
 
 /**
@@ -159,8 +166,16 @@ export class PermissionManager implements ScopedPermissionManager {
 
   getConfigIssues(agentName?: string): string[] {
     // Trigger a load/resolve to ensure issues are collected.
-    this.resolvePermissions(agentName);
-    return [...this.loader.getConfigIssues()];
+    const { failClosedScopes } = this.resolvePermissions(agentName);
+    const issues = [...this.loader.getConfigIssues()];
+    if (failClosedScopes.length > 0) {
+      issues.push(
+        `Invalid ${failClosedScopes.join(", ")} configuration detected — ` +
+          `failing closed: 'allow' rules are clamped to 'ask' for this session ` +
+          `until the configuration is corrected.`,
+      );
+    }
+    return issues;
   }
 
   getResolvedPolicyPaths(): ResolvedPolicyPaths {
@@ -222,7 +237,25 @@ export class PermissionManager implements ScopedPermissionManager {
       configRules,
     );
 
-    const value: ResolvedPermissions = { composedRules };
+    // Fail closed when a non-global scope's config is invalid: floor every
+    // `allow` (including one inherited from a lower scope) to `ask` so a
+    // higher scope meant to tighten policy cannot silently fail open (#646).
+    // Global is excluded — nothing more permissive is inherited when it fails.
+    const failClosedScopes: RuleOrigin[] = [];
+    if (projectConfig.invalid === true) failClosedScopes.push("project");
+    if (agentConfig.invalid === true) failClosedScopes.push("agent");
+    if (projectAgentConfig.invalid === true)
+      failClosedScopes.push("project-agent");
+
+    const effectiveRules =
+      failClosedScopes.length > 0
+        ? floorAllowsToAsk(composedRules)
+        : composedRules;
+
+    const value: ResolvedPermissions = {
+      composedRules: effectiveRules,
+      failClosedScopes,
+    };
     this.resolvedPermissionsCache.set(cacheKey, { stamp, value });
     return value;
   }

package/src/permission-session.ts

@@ -99,11 +99,15 @@ export class PermissionSession implements ToolCallGateInputs {
   /**
    * Reset all mutable state for a new session.
    *
-   * Configures the injected PermissionManager for `ctx.cwd`, clears skill
+   * Configures the injected PermissionManager for `ctx.cwd` (or global-only
+   * when `projectTrusted` is `false`, withholding the project cwd so an
+   * untrusted project's policy scopes are not loaded, #644), clears skill
    * entries, and activates the new context.
    */
-  resetForNewSession(ctx: ExtensionContext): void {
-    this.permissionManager.configureForCwd(ctx.cwd);
+  resetForNewSession(ctx: ExtensionContext, projectTrusted: boolean): void {
+    this.permissionManager.configureForCwd(
+      projectTrusted ? ctx.cwd : undefined,
+    );
     this.skillEntries = [];
     this.activate(ctx);
   }
@@ -121,9 +125,15 @@ export class PermissionSession implements ToolCallGateInputs {
   /**
    * Reload permission manager and clear skill entries for the current context.
    * Used on config reload (e.g. `resources_discover` with reason "reload").
+   *
+   * When `projectTrusted` is `false` the project cwd is withheld, so a reload
+   * in an untrusted project reloads only global policy; a trust grant on a
+   * later reload re-includes the project scope (#644).
    */
-  reload(): void {
-    this.permissionManager.configureForCwd(this.context?.cwd);
+  reload(projectTrusted: boolean): void {
+    this.permissionManager.configureForCwd(
+      projectTrusted ? this.context?.cwd : undefined,
+    );
     this.skillEntries = [];
   }
 
@@ -168,9 +178,16 @@ export class PermissionSession implements ToolCallGateInputs {
 
   // ── Config ─────────────────────────────────────────────────────────────
 
-  /** Reload merged config from disk; optionally update the stored runtime context. */
-  refreshConfig(ctx?: ExtensionContext): void {
-    this.configStore.refresh(ctx);
+  /**
+   * Reload merged config from disk; optionally update the stored runtime
+   * context. When `projectTrusted` is `false`, the project scope is withheld
+   * so an untrusted project's runtime config is not merged (#644).
+   */
+  refreshConfig(
+    ctx: ExtensionContext | undefined,
+    projectTrusted: boolean,
+  ): void {
+    this.configStore.refresh(ctx, projectTrusted);
   }
 
   /** Write the resolved config path set to the review and debug logs. */

package/src/policy-loader.ts

@@ -232,8 +232,11 @@ export class FilePolicyLoader implements PolicyLoader {
     const { config, issues } = loadUnifiedConfig(this.projectGlobalConfigPath);
     this.accumulateConfigIssues(issues);
 
+    // A present-but-rejected file yields issues (parse error or schema
+    // rejection); an absent file yields none. Fail closed on the former.
     const value: ScopeConfig = {
       permission: config.permission,
+      ...(issues.length > 0 ? { invalid: true } : {}),
     };
 
     this.projectGlobalConfigCache = { stamp, value };
@@ -256,6 +259,14 @@ export class FilePolicyLoader implements PolicyLoader {
       return cached.value;
     }
 
+    // An absent file (stat failed) is a legitimately-empty scope, not invalid;
+    // only a present-but-unreadable file fails closed.
+    if (stamp === "missing") {
+      const value: ScopeConfig = {};
+      cache.set(agentName, { stamp, value });
+      return value;
+    }
+
     let value: ScopeConfig;
     try {
       const markdown = readFileSync(filePath, "utf-8");
@@ -273,7 +284,9 @@ export class FilePolicyLoader implements PolicyLoader {
         };
       }
     } catch {
-      value = {};
+      // The file exists (stat succeeded above) but could not be read or
+      // parsed — fail closed for this scope (#646).
+      value = { invalid: true };
     }
 
     cache.set(agentName, { stamp, value });

package/src/rule.ts

@@ -11,7 +11,9 @@ import { type WildcardMatchOptions, wildcardMatch } from "./wildcard-matcher";
  * Synthesized:   "builtin" (universal default / evaluate() fallback),
  *                "baseline" (conditional MCP metadata auto-allow).
  * Runtime:       "session" (session approvals).
- * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
+ * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode),
+ *                "fail-closed" (composition-stage allow→ask floor when an
+ *                invalid non-global config scope is detected).
  */
 export type RuleOrigin =
   | "global"
@@ -21,7 +23,8 @@ export type RuleOrigin =
   | "builtin"
   | "baseline"
   | "session"
-  | "yolo";
+  | "yolo"
+  | "fail-closed";
 
 /** A single permission rule — the atomic unit of policy. */
 export interface Rule {
@@ -63,6 +66,28 @@ export function rewriteAsksToYolo(rules: Ruleset): Ruleset {
   );
 }
 
+/**
+ * Floor every `allow` rule to `ask`, tagged `origin: "fail-closed"`.
+ *
+ * The mirror image of {@link rewriteAsksToYolo}: the composition-stage
+ * expression of the fail-closed clamp applied when an invalid non-global config
+ * scope is detected. A permissive `allow` inherited from a lower-precedence
+ * scope becomes an `ask` prompt rather than a silent grant, while `deny` and
+ * existing `ask` rules pass through untouched — so the clamp removes only
+ * permissive inheritance and never weakens a hard deny.
+ *
+ * Pure and non-mutating — `surface`, `pattern`, and `layer` are preserved so
+ * downstream `matchedPattern` / source derivation is unaffected; only `action`
+ * and `origin` change.
+ */
+export function floorAllowsToAsk(rules: Ruleset): Ruleset {
+  return rules.map((rule) =>
+    rule.action === "allow"
+      ? { ...rule, action: "ask", origin: "fail-closed" }
+      : rule,
+  );
+}
+
 /**
  * Pure permission evaluation.
  *

package/src/types.ts

@@ -34,6 +34,13 @@ export type PathRuleTokenMatcher = (token: string) => boolean;
  */
 export interface ScopeConfig {
   permission?: FlatPermissionConfig;
+  /**
+   * True when the scope's config file was present but failed to load or
+   * validate (JSON parse error or schema rejection). Absent and valid files
+   * leave this unset. Drives the fail-closed allow→ask clamp for non-global
+   * scopes (#646).
+   */
+  invalid?: boolean;
 }
 
 /**