@gotgenes/pi-permission-system 20.2.0 → 20.4.0

package/src/authority/forwarded-request-server.ts

@@ -3,15 +3,17 @@ import {
   type ForwarderContext,
   getSessionId,
 } from "#src/authority/forwarder-context";
-import type { PermissionPromptDecision } from "#src/permission-dialog";
+import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import {
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   isForwardedPermissionRequestForSession,
   type PermissionForwardingLocation,
-} from "#src/permission-forwarding";
+} from "#src/authority/permission-forwarding";
+import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
+import { SessionApproval } from "#src/session-approval";
+import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { DebugReviewLogger } from "#src/session-logger";
-import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import type { PermissionCheckResult } from "#src/types";
 import type { AskEscalator } from "./authorizer-selection";
 import {
@@ -61,6 +63,11 @@ export interface ForwardedRequestServerDeps {
   policy: ServingPolicy;
   /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
   escalator: AskEscalator;
+  /**
+   * The serving session's `SessionRules`. Records a whole-session grant when a
+   * human approves a forwarded request for the entire serving session.
+   */
+  recorder: SessionApprovalRecorder;
   /** In-process subagent registry, read only by the one-hop canary. */
   registry?: SubagentSessionRegistry;
 }
@@ -115,6 +122,11 @@ function buildForwardedAskDetails(
       requesterAgentName: request.requesterAgentName || null,
       requesterSessionId: request.requesterSessionId || null,
     },
+    // Carries the child's suggestion so LocalUserAuthorizer can offer the
+    // whole-session grant scope; absent for a legacy/version-skew request.
+    ...(request.sessionApproval
+      ? { sessionApproval: request.sessionApproval }
+      : {}),
   };
 }
 
@@ -132,6 +144,7 @@ export class ForwardedRequestServer implements InboxProcessor {
   private readonly logger: DebugReviewLogger;
   private readonly policy: ServingPolicy;
   private readonly escalator: AskEscalator;
+  private readonly recorder: SessionApprovalRecorder;
   private readonly registry: SubagentSessionRegistry | undefined;
 
   constructor(deps: ForwardedRequestServerDeps) {
@@ -139,6 +152,7 @@ export class ForwardedRequestServer implements InboxProcessor {
     this.logger = deps.logger;
     this.policy = deps.policy;
     this.escalator = deps.escalator;
+    this.recorder = deps.recorder;
     this.registry = deps.registry;
   }
 
@@ -237,10 +251,44 @@ export class ForwardedRequestServer implements InboxProcessor {
       location,
       requestPath,
       currentSessionId,
-      decision,
+      this.applyGrantScope(request, decision, forwardedPermissionLogDetails),
     );
   }
 
+  /**
+   * Apply the human's grant-scope choice on a forwarded approval.
+   *
+   * A whole-session grant (`approved_for_serving_session`) records the child's
+   * suggested pattern into this serving node's `SessionRules` — the single
+   * source of truth for the scope — and is then translated to a plain
+   * `approved` so the child records nothing (its next identical action
+   * re-forwards and resolves as recorded authority). Every other decision
+   * passes through unchanged (`approved_for_session` → the child records).
+   */
+  private applyGrantScope(
+    request: ForwardedPermissionRequest,
+    decision: PermissionPromptDecision,
+    logDetails: Record<string, unknown>,
+  ): PermissionPromptDecision {
+    if (decision.state !== "approved_for_serving_session") {
+      return decision;
+    }
+    if (request.sessionApproval) {
+      this.recorder.recordSessionApproval(
+        SessionApproval.multiple(
+          request.sessionApproval.surface,
+          request.sessionApproval.patterns,
+        ),
+      );
+      this.logger.review("forwarded_permission.session_recorded", {
+        ...logDetails,
+        surface: request.sessionApproval.surface,
+        patterns: request.sessionApproval.patterns,
+      });
+    }
+    return { approved: true, state: "approved" };
+  }
+
   /**
    * Persist the served decision: write the response file the child polls for,
    * log the outcome, and delete the drained request. The symmetric "respond"

package/src/authority/forwarder-context.ts

@@ -1,5 +1,5 @@
 import type { SessionEntryView } from "#src/active-agent";
-import type { PermissionDecisionUi } from "#src/permission-dialog";
+import type { PermissionDecisionUi } from "#src/authority/permission-dialog";
 
 /**
  * Narrow context the forwarding subsystem reads: the UI gate (`hasUI`), the

package/src/authority/forwarding-io.ts

@@ -9,14 +9,15 @@ import {
   writeFileSync,
 } from "node:fs";
 
-import { isPermissionDecisionState } from "#src/permission-dialog";
-import type { PermissionUiPromptSource } from "#src/permission-events";
+import { isPermissionDecisionState } from "#src/authority/permission-dialog";
 import {
   createPermissionForwardingLocation,
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
+  type ForwardedSessionApproval,
   type PermissionForwardingLocation,
-} from "#src/permission-forwarding";
+} from "#src/authority/permission-forwarding";
+import type { PermissionUiPromptSource } from "#src/permission-events";
 import type { DebugReviewLogger } from "#src/session-logger";
 
 /** Valid `permissions:ui_prompt` source values, for tolerant request reads. */
@@ -41,6 +42,31 @@ function asNullableDisplayString(value: unknown): string | null | undefined {
   return undefined;
 }
 
+/**
+ * Narrow an unknown value to a `ForwardedSessionApproval`, or `undefined`.
+ *
+ * Tolerant read: the child's session-approval suggestion is optional (absent
+ * on an older child) and only accepted when well-formed — a non-empty surface
+ * and an all-string patterns array.
+ */
+function asForwardedSessionApproval(
+  value: unknown,
+): ForwardedSessionApproval | undefined {
+  if (typeof value !== "object" || value === null) {
+    return undefined;
+  }
+  const candidate = value as Partial<ForwardedSessionApproval>;
+  if (
+    typeof candidate.surface !== "string" ||
+    candidate.surface.length === 0 ||
+    !Array.isArray(candidate.patterns) ||
+    !candidate.patterns.every((pattern) => typeof pattern === "string")
+  ) {
+    return undefined;
+  }
+  return { surface: candidate.surface, patterns: [...candidate.patterns] };
+}
+
 export function formatUnknownErrorMessage(error: unknown): string {
   if (error instanceof Error && error.message) {
     return error.message;
@@ -323,6 +349,7 @@ export function readForwardedPermissionRequest(
       source: asUiPromptSource(parsed.source),
       surface: asNullableDisplayString(parsed.surface),
       value: asNullableDisplayString(parsed.value),
+      sessionApproval: asForwardedSessionApproval(parsed.sessionApproval),
     };
   } catch (error) {
     logPermissionForwardingWarning(

package/src/{forwarding-manager.ts → authority/forwarding-manager.ts}

@@ -1,7 +1,7 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { InboxProcessor } from "./authority/forwarded-request-server";
-import type { SubagentDetector } from "./authority/subagent-detection";
+import type { InboxProcessor } from "./forwarded-request-server";
 import { PERMISSION_FORWARDING_POLL_INTERVAL_MS } from "./permission-forwarding";
+import type { SubagentDetector } from "./subagent-detection";
 
 /**
  * Narrow interface for the forwarding lifecycle used by `PermissionSession`.

package/src/authority/local-user-authorizer.ts

@@ -1,8 +1,10 @@
 import type {
   PermissionDecisionUi,
   PermissionPromptDecision,
+  RequestPermissionOptions,
   requestPermissionDecisionFromUi,
-} from "#src/permission-dialog";
+} from "#src/authority/permission-dialog";
+import { buildForwardedScopeLabels } from "#src/pattern-suggest";
 import {
   emitUiPromptEvent,
   type PermissionEventBus,
@@ -45,7 +47,30 @@ export class LocalUserAuthorizer implements Authorizer {
         ? "Permission Required (Subagent)"
         : "Permission Required",
       details.message,
-      details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
+      buildRequestOptions(details),
     );
   }
 }
+
+/**
+ * A forwarded ask carrying a session-approval suggestion offers the scope
+ * choice (subagent vs whole session); any other ask keeps its single
+ * "for this session" option (custom label when the gate supplied one).
+ */
+function buildRequestOptions(
+  details: PromptPermissionDetails,
+): RequestPermissionOptions | undefined {
+  const pattern = details.sessionApproval?.patterns[0];
+  if (details.forwarding && details.sessionApproval && pattern) {
+    return {
+      sessionScope: buildForwardedScopeLabels(
+        details.forwarding.requesterAgentName,
+        details.sessionApproval.surface,
+        pattern,
+      ),
+    };
+  }
+  return details.sessionLabel
+    ? { sessionLabel: details.sessionLabel }
+    : undefined;
+}

package/src/{permission-dialog.ts → authority/permission-dialog.ts}

@@ -1,6 +1,7 @@
 export type PermissionDecisionState =
   | "approved"
   | "approved_for_session"
+  | "approved_for_serving_session"
   | "denied"
   | "denied_with_reason";
 
@@ -67,6 +68,7 @@ export function isPermissionDecisionState(
   return (
     value === "approved" ||
     value === "approved_for_session" ||
+    value === "approved_for_serving_session" ||
     value === "denied" ||
     value === "denied_with_reason"
   );
@@ -75,6 +77,15 @@ export function isPermissionDecisionState(
 export interface RequestPermissionOptions {
   /** Override the "for this session" option label (e.g. to show the suggested pattern). */
   sessionLabel?: string;
+  /**
+   * Forwarded asks only: when set, choosing the "for this session" option opens
+   * a second select asking whether the grant applies to the requesting subagent
+   * only (the least-privilege default) or the whole serving session.
+   */
+  sessionScope?: {
+    subagentLabel: string;
+    servingSessionLabel: string;
+  };
 }
 
 export async function requestPermissionDecisionFromUi(
@@ -103,6 +114,21 @@ export async function requestPermissionDecisionFromUi(
   }
 
   if (selected === sessionOption) {
+    if (options?.sessionScope) {
+      const scope = await ui.select(`${title}\nApply this session grant to:`, [
+        options.sessionScope.subagentLabel,
+        options.sessionScope.servingSessionLabel,
+      ]);
+      return {
+        approved: true,
+        // A cancelled scope select (undefined) falls back to the
+        // least-privilege subagent scope.
+        state:
+          scope === options.sessionScope.servingSessionLabel
+            ? "approved_for_serving_session"
+            : "approved_for_session",
+      };
+    }
     return {
       approved: true,
       state: "approved_for_session",

package/src/{permission-forwarding.ts → authority/permission-forwarding.ts}

@@ -1,7 +1,6 @@
 import { join } from "node:path";
-
+import type { PermissionUiPromptSource } from "#src/permission-events";
 import type { PermissionDecisionState } from "./permission-dialog";
-import type { PermissionUiPromptSource } from "./permission-events";
 import type { SubagentSessionRegistry } from "./subagent-registry";
 
 export const PERMISSION_FORWARDING_POLL_INTERVAL_MS = 250;
@@ -53,6 +52,20 @@ export interface ForwardedPromptDisplay {
   value: string | null;
 }
 
+/**
+ * The child's session-approval suggestion, relayed to the serving node so a
+ * human who grants "the whole session" records the same pattern the child
+ * would have recorded locally.
+ *
+ * A plain data shape (not the `SessionApproval` value object) so it serializes
+ * onto the forwarded request; the serving node rebuilds a `SessionApproval`
+ * from it via `SessionApproval.multiple`.
+ */
+export interface ForwardedSessionApproval {
+  surface: string;
+  patterns: readonly string[];
+}
+
 export type ForwardedPermissionRequest = {
   id: string;
   createdAt: number;
@@ -69,6 +82,13 @@ export type ForwardedPermissionRequest = {
   source?: PermissionUiPromptSource;
   surface?: string | null;
   value?: string | null;
+  /**
+   * The child's session-approval suggestion. Present when the child computed a
+   * "for this session" pattern for the ask; lets the serving node record a
+   * whole-session grant. Optional for version-skew tolerance (an older child
+   * omits it, and the serving dialog then offers no scope choice).
+   */
+  sessionApproval?: ForwardedSessionApproval;
 };
 
 export type ForwardedPermissionResponse = {

package/src/authority/permission-prompter.ts

@@ -1,4 +1,5 @@
-import type { PermissionPromptDecision } from "#src/permission-dialog";
+import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
+import type { ForwardedSessionApproval } from "#src/authority/permission-forwarding";
 import type { ReviewLogger } from "#src/session-logger";
 import type { Authorizer } from "./authorizer";
 
@@ -38,6 +39,13 @@ export interface PromptPermissionDetails {
   value?: string | null;
   /** Present iff this ask was forwarded from a subagent; drives the non-degraded broadcast + "(Subagent)" title. */
   forwarding?: ForwardedAskProvenance;
+  /**
+   * The session-approval suggestion for this ask. On the child's escalation it
+   * rides into the forwarded request; on the serving node it lets the dialog
+   * offer a whole-session grant scope. Absent when the gate computed no
+   * suggestion.
+   */
+  sessionApproval?: ForwardedSessionApproval;
 }
 
 /**

package/src/authority/subagent-context.ts

@@ -1,7 +1,6 @@
-import { posix as posixPath, win32 as winPath } from "node:path";
-
-import { SUBAGENT_ENV_HINT_KEYS } from "#src/permission-forwarding";
-import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import { SUBAGENT_ENV_HINT_KEYS } from "#src/authority/permission-forwarding";
+import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
+import type { PathFlavor } from "#src/path/path-flavor";
 
 /**
  * Narrow context for subagent detection — the only session-manager readers
@@ -17,17 +16,15 @@ export interface SubagentDetectionContext {
 
 export function normalizeFilesystemPath(
   pathValue: string,
-  platform: NodeJS.Platform,
+  flavor: PathFlavor,
 ): string {
-  const impl = platform === "win32" ? winPath : posixPath;
-  const normalizedPath = impl.normalize(pathValue);
-  return platform === "win32" ? normalizedPath.toLowerCase() : normalizedPath;
+  return flavor.fold(flavor.impl.normalize(pathValue));
 }
 
 function isPathWithinDirectoryForSubagent(
   pathValue: string,
   directory: string,
-  platform: NodeJS.Platform,
+  flavor: PathFlavor,
 ): boolean {
   if (!pathValue || !directory) {
     return false;
@@ -37,7 +34,7 @@ function isPathWithinDirectoryForSubagent(
     return true;
   }
 
-  const sep = platform === "win32" ? "\\" : "/";
+  const sep = flavor.impl.sep;
   const prefix = directory.endsWith(sep) ? directory : `${directory}${sep}`;
   return pathValue.startsWith(prefix);
 }
@@ -71,7 +68,7 @@ export function isRegisteredSubagentChild(
 export function isSubagentExecutionContext(
   ctx: SubagentDetectionContext,
   subagentSessionsDir: string,
-  platform: NodeJS.Platform,
+  flavor: PathFlavor,
   registry?: SubagentSessionRegistry,
 ): boolean {
   // 1. Explicit registry — in-process subagent extensions register by child
@@ -99,14 +96,14 @@ export function isSubagentExecutionContext(
     return false;
   }
 
-  const normalizedSessionDir = normalizeFilesystemPath(sessionDir, platform);
+  const normalizedSessionDir = normalizeFilesystemPath(sessionDir, flavor);
   const normalizedSubagentRoot = normalizeFilesystemPath(
     subagentSessionsDir,
-    platform,
+    flavor,
   );
   return isPathWithinDirectoryForSubagent(
     normalizedSessionDir,
     normalizedSubagentRoot,
-    platform,
+    flavor,
   );
 }

package/src/authority/subagent-detection.ts

@@ -3,7 +3,8 @@ import {
   isSubagentExecutionContext,
   type SubagentDetectionContext,
 } from "#src/authority/subagent-context";
-import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
+import type { PathFlavor } from "#src/path/path-flavor";
 
 /**
  * Narrow seam for the ask-path consumers: "is the current session a subagent?"
@@ -30,7 +31,7 @@ export interface RegisteredChildDetector {
 /** Composition-root inputs for {@link SubagentDetection}. */
 export interface SubagentDetectionDeps {
   subagentSessionsDir: string;
-  platform: NodeJS.Platform;
+  flavor: PathFlavor;
   registry?: SubagentSessionRegistry;
 }
 
@@ -38,7 +39,7 @@ export interface SubagentDetectionDeps {
  * Single owner of subagent detection.
  *
  * Constructed once in the composition root with the detection inputs
- * (`subagentSessionsDir`, `platform`, `registry`) and shared across every
+ * (`subagentSessionsDir`, `flavor`, `registry`) and shared across every
  * consumer, replacing the dep triple those consumers previously threaded
  * individually. Delegates to the pure detection functions in
  * {@link ./subagent-context}, holding only the deps.
@@ -52,7 +53,7 @@ export class SubagentDetection
     return isSubagentExecutionContext(
       ctx,
       this.deps.subagentSessionsDir,
-      this.deps.platform,
+      this.deps.flavor,
       this.deps.registry,
     );
   }

package/src/bash-advisory-check.ts

@@ -0,0 +1,38 @@
+import { parseBashCommandsSync } from "#src/access-intent/bash/sync-commands";
+import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
+import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PermissionCheckResult } from "#src/types";
+
+/**
+ * Resolve an advisory bash query at the gate's decomposed fidelity.
+ *
+ * When the tree-sitter parser is warm, the command is decomposed into its
+ * command-pattern units and routed through the same shared orchestrator the
+ * enforcement gate uses (`resolveBashCommandCheck`) — so a chained/nested
+ * command returns the most-restrictive decision (`deny > ask > allow`) and
+ * inherits the opaque-wrapper floor (#481) and the fail-closed
+ * `<unparseable-bash-command>` sentinel (#452), at parity with the gate.
+ *
+ * In the pre-warm window (`parseBashCommandsSync` returns `null`) it falls back
+ * to the pre-#309 whole-string match, so the advisory answer is never *weaker*
+ * than before — only strengthened once warm.
+ *
+ * Synchronous, preserving `PermissionsService.checkPermission`'s sync contract:
+ * the only async step (parser init) happens earlier, at `before_agent_start`.
+ */
+export function resolveBashAdvisoryCheck(
+  command: string,
+  agentName: string | undefined,
+  resolver: ScopedPermissionResolver,
+): PermissionCheckResult {
+  const commands = parseBashCommandsSync(command);
+  if (commands === null) {
+    return resolver.resolve({
+      kind: "tool",
+      surface: "bash",
+      input: { command },
+      agentName,
+    });
+  }
+  return resolveBashCommandCheck(command, commands, agentName, resolver);
+}

package/src/denial-messages.ts

@@ -1,3 +1,4 @@
+import { classifyToolKind, isMcpCheck } from "./access-intent/tool-kind";
 import { EXTENSION_ID } from "./extension-config";
 import type { BashCommandContext, PermissionCheckResult } from "./types";
 
@@ -127,7 +128,7 @@ function buildToolDenyBody(
     parts.push(`Agent '${agentName}'`);
   }
 
-  if (isMcpCheck(check)) {
+  if (isMcpCheck(check) && check.target) {
     parts.push(`is not permitted to run MCP target '${check.target}'`);
   } else {
     parts.push(`is not permitted to run '${check.toolName}'`);
@@ -190,10 +191,10 @@ function buildUnavailableBody(ctx: DenialContext): string {
   switch (ctx.kind) {
     case "tool": {
       const { check } = ctx;
-      if (check.toolName === "bash" && check.command) {
+      if (classifyToolKind(check.toolName) === "bash" && check.command) {
         return `Running bash command '${check.command}' requires approval, but no interactive UI is available.`;
       }
-      if (isMcpCheck(check)) {
+      if (isMcpCheck(check) && check.target) {
         return "Using tool 'mcp' requires approval, but no interactive UI is available.";
       }
       return `Using tool '${check.toolName}' requires approval, but no interactive UI is available.`;
@@ -220,10 +221,10 @@ function buildUserDeniedBody(
   switch (ctx.kind) {
     case "tool": {
       const { check } = ctx;
-      if (isMcpCheck(check)) {
+      if (isMcpCheck(check) && check.target) {
         return `User denied MCP target '${check.target}'.${reasonSuffix(denialReason)}`;
       }
-      if (check.toolName === "bash" && check.command) {
+      if (classifyToolKind(check.toolName) === "bash" && check.command) {
         return `User denied bash command '${check.command}'.${reasonSuffix(denialReason)}`;
       }
       return `User denied tool '${check.toolName}'.${reasonSuffix(denialReason)}`;
@@ -243,10 +244,6 @@ function buildUserDeniedBody(
   }
 }
 
-function isMcpCheck(check: PermissionCheckResult): boolean {
-  return (check.source === "mcp" || check.toolName === "mcp") && !!check.target;
-}
-
 /** Render an external-path disclosure list for the bash deny body's path clause. */
 function formatExternalPathList(paths: ExternalPathDisclosure[]): string {
   return paths

package/src/handlers/before-agent-start.ts

@@ -40,12 +40,16 @@ export function shouldExposeTool(
  * - `session` — encapsulates all mutable session state and lifecycle operations
  * - `resolver` — owns permission-query surface: `getToolPermission`, skill check
  * - `toolRegistry` — Pi tool API subset (getActive + setActive)
+ * - `warmParser` — warms the tree-sitter parser so the synchronous advisory
+ *   bash path can decompose at gate parity; `before_agent_start` precedes any
+ *   tool call, so triggering it here closes the pre-warm window (#309)
  */
 export class AgentPrepHandler {
   constructor(
     private readonly session: PermissionSession,
     private readonly resolver: PermissionResolver,
     private readonly toolRegistry: ToolRegistry,
+    private readonly warmParser: () => void,
   ) {}
 
   // eslint-disable-next-line @typescript-eslint/require-await
@@ -53,6 +57,10 @@ export class AgentPrepHandler {
     event: BeforeAgentStartPayload,
     ctx: ExtensionContext,
   ): Promise<BeforeAgentStartEventResult> {
+    // Fire-and-forget: warming is idempotent and best-effort, so it never
+    // delays agent start. A bash advisory query before it completes falls back
+    // to whole-string matching.
+    this.warmParser();
     this.session.activate(ctx);
     this.session.refreshConfig(ctx);
 

package/src/handlers/gates/helpers.ts

@@ -1,3 +1,4 @@
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 import type {
   PermissionDecisionEvent,
   PermissionDecisionResolution,
@@ -14,10 +15,17 @@ export function deriveDecisionValue(
   check: Pick<PermissionCheckResult, "command" | "target">,
   path?: string,
 ): string {
-  if (toolName === "bash") return check.command ?? toolName;
-  if (toolName === "mcp") return check.target ?? toolName;
-  if (path) return path;
-  return toolName;
+  switch (classifyToolKind(toolName)) {
+    case "bash":
+      return check.command ?? toolName;
+    case "mcp":
+      return check.target ?? toolName;
+    case "path":
+    case "skill":
+    case "extension":
+      // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- || intentional: an empty path falls through to toolName (the original `if (path)` truthiness)
+      return path || toolName;
+  }
 }
 
 /**

package/src/handlers/gates/runner.ts

@@ -1,11 +1,11 @@
 import type { AskEscalator } from "#src/authority/authorizer-selection";
+import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type { DecisionReporter } from "#src/decision-reporter";
 import {
   formatDenyReason,
   formatUnavailableReason,
   formatUserDeniedReason,
 } from "#src/denial-messages";
-import type { PermissionPromptDecision } from "#src/permission-dialog";
 import { applyPermissionGate } from "#src/permission-gate";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
@@ -147,6 +147,9 @@ export class GateRunner {
         const decision = await this.prompter.escalate({
           requestId: toolCallId,
           ...descriptor.promptDetails,
+          ...(descriptor.sessionApproval
+            ? { sessionApproval: descriptor.sessionApproval.toForwardedData() }
+            : {}),
         });
         autoApproved = decision.autoApproved === true;
         confirmationUnavailable = decision.confirmationUnavailable === true;

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,5 +1,6 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import { BashProgram } from "#src/access-intent/bash/program";
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
@@ -77,7 +78,7 @@ export class ToolCallGatePipeline {
     const command = getNonEmptyString(toRecord(tcc.input).command);
     const normalizer = this.inputs.getPathNormalizer();
     const bashProgram =
-      tcc.toolName === "bash" && command
+      classifyToolKind(tcc.toolName) === "bash" && command
         ? await BashProgram.parse(
             command,
             normalizer,
@@ -159,7 +160,7 @@ export class ToolCallGatePipeline {
     command: string | null,
     normalizer: PathNormalizer,
   ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
-    if (tcc.toolName === "bash" && bashProgram) {
+    if (classifyToolKind(tcc.toolName) === "bash" && bashProgram) {
       return {
         toolCheck: resolveBashCommandCheck(
           command ?? "",

package/src/handlers/gates/tool.ts

@@ -1,4 +1,5 @@
 import type { AccessPath } from "#src/access-intent/access-path";
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 import { PATH_BEARING_TOOLS } from "#src/path-surfaces";
 import { suggestSessionPattern } from "#src/pattern-suggest";
 import { formatAskPrompt } from "#src/permission-prompts";
@@ -23,10 +24,14 @@ function deriveSuggestionValue(
   check: PermissionCheckResult,
   accessPath?: AccessPath,
 ): string {
-  if (tcc.toolName === "bash") return check.command ?? "";
-  if (tcc.toolName === "mcp") return check.target ?? "mcp";
-  if (accessPath) return accessPath.value();
-  return "*";
+  switch (classifyToolKind(tcc.toolName)) {
+    case "bash":
+      return check.command ?? "";
+    case "mcp":
+      return check.target ?? "mcp";
+    default:
+      return accessPath ? accessPath.value() : "*";
+  }
 }
 
 /**