@gotgenes/pi-permission-system 20.5.0 → 20.7.0

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.7.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.6.0...pi-permission-system-v20.7.0) (2026-07-14)
+
+
+### Features
+
+* **pi-permission-system:** add doublePressToConfirm config toggle ([bd401bf](https://github.com/gotgenes/pi-packages/commit/bd401bff0bd926313acfafe5e50b579c88e4002f))
+* **pi-permission-system:** add inline permission prompt decision model ([08d6ec6](https://github.com/gotgenes/pi-packages/commit/08d6ec6b7e9abbcbf05b49579d307e3f5934cb3a))
+* **pi-permission-system:** dispatch TUI permission prompts to the inline keybind dialog ([197c0f9](https://github.com/gotgenes/pi-packages/commit/197c0f91178f7010e84ed80eb3682dc27c1f737f))
+* **pi-permission-system:** render inline keybind permission prompt ([7ac7dad](https://github.com/gotgenes/pi-packages/commit/7ac7dad3ef49f03e19b279056ea54d4c5a456c80))
+
+## [20.6.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.5.0...pi-permission-system-v20.6.0) (2026-07-13)
+
+
+### Features
+
+* **pi-permission-system:** add resolveShellInvocation dispatch point ([5c5edc8](https://github.com/gotgenes/pi-packages/commit/5c5edc84cd46dafb5dade9fd51b2946632b72776))
+* **pi-permission-system:** gate aliased shell tools through the bash stack ([2c17f2c](https://github.com/gotgenes/pi-packages/commit/2c17f2ce4b6207684f999d0bc30fe630c79934bb)), closes [#574](https://github.com/gotgenes/pi-packages/issues/574)
+* **pi-permission-system:** resolve and gate aliased shell workdir ([d9b2af8](https://github.com/gotgenes/pi-packages/commit/d9b2af86107671366935242e704d1f17821db73f)), closes [#574](https://github.com/gotgenes/pi-packages/issues/574)
+
+
+### Documentation
+
+* **pi-permission-system:** document live shellTools enforcement ([b8048ed](https://github.com/gotgenes/pi-packages/commit/b8048eddba5f8c0e9b82cf0c3e31055e7813b745))
+
 ## [20.5.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.4.2...pi-permission-system-v20.5.0) (2026-07-13)
 
 

package/README.md

@@ -65,7 +65,8 @@ All permissions use one of three states:
 | `ask`   | Prompts the user for confirmation via UI |
 
 When the dialog prompts, you can approve once or approve a pattern for the rest of the session.
-See [docs/session-approvals.md](docs/session-approvals.md) for details on session-scoped rules and pattern suggestions.
+In an interactive TUI session the prompt is an inline keybind dialog — `y` approve, `s` approve for this session, `n` deny, `r` deny with a reason — where each hotkey arms and a second press confirms (configurable via `doublePressToConfirm`).
+See [docs/configuration.md](docs/configuration.md#inline-permission-dialog-tui) for the hotkeys and [docs/session-approvals.md](docs/session-approvals.md) for session-scoped rules and pattern suggestions.
 
 The `path` surface is a cross-cutting gate that applies to **all** file access — Pi tools, bash commands, MCP calls, and extension tools alike.
 Extension and MCP tools that operate on paths (via `input.path`, MCP's `input.arguments.path`, or a registered access extractor) are gated by default, so a `path` deny cannot be overridden by a per-tool allow — making it the right place to protect sensitive files like `.env` or `~/.ssh/*` from every tool at once.
@@ -109,7 +110,7 @@ Project overrides global; per-agent YAML frontmatter overrides both.
 
 Within a surface map like `bash` or `mcp`, **last matching rule wins** — put broad catch-alls first and specific overrides after.
 
-The optional `shellTools` field records which non-`bash` tools carry shell semantics (e.g. an `exec_command` tool that replaces native `bash`), so they can be gated through the same enforcement — see [docs/configuration.md](docs/configuration.md#shelltools--gating-aliased-shell-tools).
+The optional `shellTools` field records which non-`bash` tools carry shell semantics (e.g. an `exec_command` tool that replaces native `bash`), so they are gated at full parity with native `bash` — see [docs/configuration.md](docs/configuration.md#shelltools--gating-aliased-shell-tools).
 
 For the full reference — all surfaces, runtime knobs, per-agent overrides, merge semantics, and common recipes — see [docs/configuration.md](docs/configuration.md).
 

package/config/config.example.json

@@ -4,6 +4,7 @@
   "debugLog": false,
   "permissionReviewLog": true,
   "yoloMode": false,
+  "doublePressToConfirm": true,
 
   "toolInputPreviewMaxLength": 400,
   "toolTextSummaryMaxLength": 120,

package/docs/configuration.md

@@ -30,7 +30,7 @@ Project config overrides global config; per-agent frontmatter overrides both.
 4. Project agent frontmatter
 
 The `permission` object uses deep-shallow merge: string-vs-string replaces; both-object shallow-merges pattern maps; string-vs-object the override wins entirely.
-Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replacement.
+Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`) use simple replacement.
 
 ## Full Example
 
@@ -42,6 +42,7 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
   "debugLog": false,
   "permissionReviewLog": true,
   "yoloMode": false,
+  "doublePressToConfirm": true,
   "toolInputPreviewMaxLength": 400,
   "toolTextSummaryMaxLength": 120,
   "piInfrastructureReadPaths": [],
@@ -85,6 +86,7 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
 | `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                        |
 | `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`                                              |
 | `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                           |
+| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.    |
 | `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.      |
 | `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                |
 | `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`). |
@@ -92,6 +94,23 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
 Both logs write to `~/.pi/agent/extensions/pi-permission-system/logs/`.
 No debug output is printed to the terminal.
 
+### Inline permission dialog (TUI)
+
+In an interactive **TUI** session, an `ask` decision opens an inline keybind dialog with one-key shortcuts:
+
+| Key | Action                                                            |
+| --- | ----------------------------------------------------------------- |
+| `y` | Approve once                                                      |
+| `s` | Approve for this session                                          |
+| `n` | Deny                                                              |
+| `r` | Deny with a reason (opens an inline editor; a reason is required) |
+
+Arrow keys / `j`/`k` move the highlight, `enter` confirms the highlighted option, and `esc` denies.
+With `doublePressToConfirm` enabled (the default), a letter hotkey **arms** its action and shows a `Press y again to approve.` hint; press the same key again to commit.
+Set `doublePressToConfirm` to `false` to commit on the first press.
+
+Non-TUI contexts (RPC / frontend-driven sessions) keep the single-select prompt and are unaffected by `doublePressToConfirm`.
+
 ### `piInfrastructureReadPaths` patterns
 
 Each entry is either a plain directory prefix or a wildcard pattern.
@@ -115,7 +134,7 @@ The native `bash` tool goes through the full bash enforcement stack: command dec
 Some extensions replace `bash` with a differently-named tool — for example [`@howaboua/pi-codex-conversion`](https://github.com/IgorWarzocha/howaboua-pi-stuff) registers `exec_command`, which carries the shell command in a `cmd` argument and an optional working directory in `workdir`.
 Without a hint, the permission system cannot tell that such a tool is really a shell, so it gates it as a generic extension tool and the bash rules never apply.
 
-`shellTools` records that hint.
+`shellTools` records that hint, and an aliased tool is then gated at full parity with native `bash` — command decomposition, wrapper flooring, path and external-directory token gates, and `bash:` rules — with the invoked tool name preserved in the review log.
 Each key is a tool name; its value maps the tool's input arguments (the keys of the tool call's `arguments` object):
 
 ```jsonc
@@ -131,6 +150,8 @@ Each key is a tool name; its value maps the tool's input arguments (the keys of
 | `commandArgument` | yes      | The tool's input argument holding the shell command string (e.g. `cmd`).  |
 | `workdirArgument` | no       | The tool's input argument holding the working directory (e.g. `workdir`). |
 
+When `workdirArgument` is set, the tool's working directory is the base the command's relative paths resolve against, and the working directory itself is gated by `external_directory` when it falls outside the session's working directory.
+
 Merge semantics: `shellTools` **shallow-merges by tool name** across global → project.
 A project entry overrides a specific tool's mapping on a key collision but never drops a global entry — so adding a project-scoped alias cannot silently remove enforcement for a tool the global config already covers.
 To change a specific tool's mapping, set that tool's key at the project scope (the alias object is replaced wholesale, not deep-merged).
@@ -138,8 +159,6 @@ To change a specific tool's mapping, set that tool's key at the project scope (t
 `shellTools` only ever *tightens* enforcement and is inert when the named tool is not registered in the current session.
 Opting a project out of a shell-aliasing extension is a package-disable concern, not a `shellTools` edit.
 
-> **Note:** `shellTools` records the alias; the enforcement wiring that consumes it is tracked in [#574](https://github.com/gotgenes/pi-packages/issues/574).
-
 ---
 
 ## Policy Reference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.5.0",
+  "version": "20.7.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -25,6 +25,12 @@
       "default": false,
       "type": "boolean"
     },
+    "doublePressToConfirm": {
+      "description": "Require a confirming second press of a decision hotkey in the inline permission dialog. Applies to TUI sessions only.",
+      "markdownDescription": "Require a confirming second press of a decision hotkey (`y`/`s`/`n`/`r`) in the inline permission dialog before it commits — the first press arms the action and shows a `Press y again to approve.` hint.\n\nApplies to interactive **TUI** sessions only; the non-TUI (RPC/frontend) prompt keeps its single-select flow. Set to `false` to commit decisions on the first hotkey press.",
+      "default": true,
+      "type": "boolean"
+    },
     "toolInputPreviewMaxLength": {
       "description": "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",
       "markdownDescription": "Maximum character length of the inline-JSON tool-input preview shown in permission prompts.\n\nOmit to use the default (200). Set to a large value (e.g. `10000`) to effectively disable truncation and see the full input.",

package/src/access-intent/bash/bash-path-resolver.ts

@@ -101,20 +101,57 @@ export class BashPathResolver {
   constructor(
     private readonly normalizer: PathNormalizer,
     private readonly isPromotablePathToken: PathRuleTokenMatcher = NO_PROMOTION,
+    private readonly workdir?: string,
   ) {}
 
   /**
    * Resolve a parsed bash program's path references into its external-path and
    * rule-candidate slices, walking the AST exactly once.
+   *
+   * When a `workdir` is set (an aliased shell tool's working directory, #574),
+   * it seeds the initial effective base — as if the program were prefixed with
+   * `cd <workdir>` — so relative tokens resolve against it, and the `workdir`
+   * itself is added to the external paths when it resolves outside the cwd.
+   * Containment is always measured against the session cwd baked into the
+   * normalizer, so a `workdir` outside the cwd does not widen the sandbox.
    */
   resolve(rootNode: TSNode): ResolvedBashPaths {
-    const candidates = this.collectPathCandidates(rootNode);
+    const initialBase =
+      this.workdir === undefined
+        ? CWD_BASE
+        : this.deriveBaseFromCdTarget(CWD_BASE, this.workdir);
+    const candidates = this.collectPathCandidates(rootNode, initialBase);
     return {
-      externalPaths: this.projectExternalPaths(candidates),
+      externalPaths: this.withWorkdirExternal(
+        this.projectExternalPaths(candidates),
+      ),
       ruleCandidates: this.projectRuleCandidates(candidates),
     };
   }
 
+  /**
+   * Prepend the `workdir`'s own {@link AccessPath} to the external paths when it
+   * resolves outside the cwd. A real `cd /etc` flags `/etc` via its argument
+   * token; the seeded base carries no such token, so it is added explicitly and
+   * deduplicated against the command's own external tokens (#574).
+   */
+  private withWorkdirExternal(
+    tokenExternals: readonly AccessPath[],
+  ): AccessPath[] {
+    if (this.workdir === undefined) return [...tokenExternals];
+    const wdPath = this.normalizer.forBashToken(this.workdir);
+    const canonical = wdPath.boundaryValue();
+    const isExternal = canonical
+      ? this.normalizer.isBoundaryOutsideWorkingDirectory(canonical)
+      : true;
+    if (!isExternal) return [...tokenExternals];
+    const key = canonical || wdPath.value();
+    const alreadyPresent = tokenExternals.some(
+      (p) => (p.boundaryValue() || p.value()) === key,
+    );
+    return alreadyPresent ? [...tokenExternals] : [wdPath, ...tokenExternals];
+  }
+
   // ── AST walk — collect PathCandidates ──────────────────────────────────
 
   /**
@@ -129,9 +166,12 @@ export class BashPathResolver {
    * inherit the enclosing base without folding their own `cd`s (a conservative
    * first tier).
    */
-  private collectPathCandidates(rootNode: TSNode): PathCandidate[] {
+  private collectPathCandidates(
+    rootNode: TSNode,
+    initialBase: EffectiveBase,
+  ): PathCandidate[] {
     const out: PathCandidate[] = [];
-    this.walkForCandidates(rootNode, CWD_BASE, out);
+    this.walkForCandidates(rootNode, initialBase, out);
     return out;
   }
 
@@ -330,6 +370,25 @@ export class BashPathResolver {
     if (extractCommandName(commandNode) !== "cd") return base;
     const target = cdLiteralTarget(commandNode);
     if (target === null) return UNKNOWN_BASE;
+    return this.deriveBaseFromCdTarget(base, target);
+  }
+
+  /**
+   * Fold a literal `cd`/working-directory target string into the effective
+   * base, delegating the platform/MSYS interpretation to the
+   * {@link PathNormalizer}. Owns only the base-folding state:
+   *
+   * - `absolute` → a fresh known base (recovers from an earlier unknown base).
+   * - `unknown` → the base becomes conservatively unknown.
+   * - `relative` → join into a known base, or stay unknown if already unknown.
+   *
+   * Shared by {@link foldCd} (inline `cd` commands) and the initial-base seed
+   * (an aliased shell tool's `workdir`, an implicit leading `cd <workdir>`).
+   */
+  private deriveBaseFromCdTarget(
+    base: EffectiveBase,
+    target: string,
+  ): EffectiveBase {
     const interpreted = this.normalizer.interpretBashCdTarget(target);
     switch (interpreted.kind) {
       case "absolute":

package/src/access-intent/bash/program.ts

@@ -25,6 +25,7 @@ export type { BashCommand, BashPathRuleCandidate };
  */
 export class BashProgram {
   private constructor(
+    private readonly sourceCommand: string,
     private readonly commandUnits: readonly BashCommand[],
     private readonly resolvedExternalPaths: readonly AccessPath[],
     private readonly resolvedRuleCandidates: readonly BashPathRuleCandidate[],
@@ -44,22 +45,30 @@ export class BashProgram {
    * specific `path` deny/ask rule (#509). Defaults to promoting nothing, so
    * callers that only read `externalPaths()` (e.g. `bash-path-extractor.ts`)
    * are unaffected.
+   *
+   * `options.workdir`, when supplied (an aliased shell tool's working directory,
+   * #574), seeds the initial effective base — as if the command were prefixed
+   * with `cd <workdir>` — so relative tokens resolve against it, and the workdir
+   * itself is flagged as external when it resolves outside the cwd.
    */
   static async parse(
     command: string,
     normalizer: PathNormalizer,
     isPromotablePathToken?: PathRuleTokenMatcher,
+    options?: { workdir?: string },
   ): Promise<BashProgram> {
     const parser = await getParser();
     const tree = parser.parse(command);
-    if (!tree) return new BashProgram([], [], []);
+    if (!tree) return new BashProgram(command, [], [], []);
 
     try {
       const { externalPaths, ruleCandidates } = new BashPathResolver(
         normalizer,
         isPromotablePathToken,
+        options?.workdir,
       ).resolve(tree.rootNode);
       return new BashProgram(
+        command,
         collectCommands(tree.rootNode),
         externalPaths,
         ruleCandidates,
@@ -69,6 +78,18 @@ export class BashProgram {
     }
   }
 
+  /**
+   * The source command string this program was parsed from.
+   *
+   * The bash gates read this for prompts, logs, and decision display instead of
+   * receiving the command as a separate parameter — the program is the parsed
+   * command, so it owns its source text (#574). Native `bash` and an aliased
+   * shell tool alike reach the gates through this single collaborator.
+   */
+  commandText(): string {
+    return this.sourceCommand;
+  }
+
   /**
    * The top-level command-pattern units of the chain, in source order.
    *

package/src/access-intent/tool-kind.ts

@@ -1,3 +1,5 @@
+import type { ShellToolsConfig } from "#src/config-schema";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { PATH_BEARING_TOOLS } from "./path-surfaces";
 
 /**
@@ -39,6 +41,59 @@ export function classifyToolKind(toolName: string): ToolKind {
   return "extension";
 }
 
+/** A shell invocation's effective command and optional working directory. */
+export interface ShellInvocation {
+  /** The shell command string to decompose and gate. */
+  command: string;
+  /** The working directory the command runs in, if the tool projects one. */
+  workdir: string | undefined;
+}
+
+/**
+ * Decide whether a tool invocation carries shell semantics, and if so extract
+ * its command and working directory.
+ *
+ * Native `bash` and any tool recorded in `shellTools` both yield a
+ * {@link ShellInvocation}; every other tool yields `null`. This is the single
+ * dispatch point the bash gate pipeline consults instead of re-deriving
+ * `toolName === "bash"` and reading `input.command`, so an aliased shell tool
+ * (e.g. `@howaboua/pi-codex-conversion`'s `exec_command`) is routed through the
+ * same bash enforcement stack as native `bash` (#574).
+ *
+ * The command and workdir are read through {@link getNonEmptyString} (trimmed,
+ * empty → `""`/`undefined`), matching the pipeline's existing native-bash
+ * extraction. Kept separate from {@link classifyToolKind} because it needs
+ * config (the alias map) and returns a richer product than a {@link ToolKind}
+ * string — `classifyToolKind` stays AccessPath-free and config-free.
+ */
+export function resolveShellInvocation(
+  toolName: string,
+  input: unknown,
+  aliases: ShellToolsConfig | undefined,
+): ShellInvocation | null {
+  const name = toolName.trim();
+  const record = toRecord(input);
+
+  if (name === "bash") {
+    return {
+      command: getNonEmptyString(record.command) ?? "",
+      workdir: undefined,
+    };
+  }
+
+  const alias = aliases?.[name];
+  if (alias) {
+    return {
+      command: getNonEmptyString(record[alias.commandArgument]) ?? "",
+      workdir: alias.workdirArgument
+        ? (getNonEmptyString(record[alias.workdirArgument]) ?? undefined)
+        : undefined,
+    };
+  }
+
+  return null;
+}
+
 /** The resolved-check fields that decide MCP-ness. */
 interface McpKindFields {
   toolName: string;

package/src/authority/authorizer.ts

@@ -1,8 +1,9 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type {
-  PermissionPromptDecision,
-  requestPermissionDecisionFromUi,
-} from "#src/authority/permission-dialog";
+  PromptPreferences,
+  requestPermissionDecision,
+} from "#src/authority/permission-prompt-component";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PermissionEventBus } from "#src/permission-events";
 import type { DebugReviewLogger } from "#src/session-logger";
@@ -33,8 +34,10 @@ export interface AuthorizerSelectionDeps {
   detection: SubagentDetector;
   /** Event bus used by `LocalUserAuthorizer` for the `permissions:ui_prompt` broadcast. */
   events: PermissionEventBus;
+  /** Read live at prompt time; threaded into `LocalUserAuthorizer`. */
+  getPromptPreferences: () => PromptPreferences;
   /** Injected for testability; production callers pass the real function. */
-  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+  requestPermissionDecision: typeof requestPermissionDecision;
   /** Forwarding directory `ParentAuthorizer` reads/writes request and response files under. */
   forwardingDir: string;
   /** In-process subagent session registry for forwarding target resolution. */
@@ -57,8 +60,10 @@ export function selectAuthorizer(
   if (ctx.hasUI) {
     return new LocalUserAuthorizer({
       ui: ctx.ui,
+      mode: ctx.mode,
       events: deps.events,
-      requestPermissionDecisionFromUi: deps.requestPermissionDecisionFromUi,
+      getPromptPreferences: deps.getPromptPreferences,
+      requestPermissionDecision: deps.requestPermissionDecision,
     });
   }
   if (deps.detection.isSubagent(ctx)) {

package/src/authority/local-user-authorizer.ts

@@ -1,9 +1,13 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type {
-  PermissionDecisionUi,
   PermissionPromptDecision,
   RequestPermissionOptions,
-  requestPermissionDecisionFromUi,
 } from "#src/authority/permission-dialog";
+import type {
+  PermissionPromptUi,
+  PromptPreferences,
+  requestPermissionDecision,
+} from "#src/authority/permission-prompt-component";
 import { buildForwardedScopeLabels } from "#src/pattern-suggest";
 import {
   emitUiPromptEvent,
@@ -15,12 +19,16 @@ import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */
 export interface LocalUserAuthorizerDeps {
-  /** The active session's UI surface. */
-  ui: PermissionDecisionUi;
+  /** The active session's UI surface (select/input plus the inline `custom` dialog). */
+  ui: PermissionPromptUi;
+  /** The session run mode; the dispatcher renders the inline dialog only in `"tui"`. */
+  mode: ExtensionContext["mode"];
   /** Event bus used for the `permissions:ui_prompt` broadcast. */
   events: PermissionEventBus;
+  /** Read live at prompt time so a settings-modal toggle takes effect on the next prompt. */
+  getPromptPreferences: () => PromptPreferences;
   /** Injected for testability; production callers pass the real function. */
-  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+  requestPermissionDecision: typeof requestPermissionDecision;
 }
 
 /**
@@ -41,8 +49,13 @@ export class LocalUserAuthorizer implements Authorizer {
   ): Promise<PermissionPromptDecision> {
     const uiPrompt = buildUiPrompt(details);
     emitUiPromptEvent(this.deps.events, uiPrompt);
-    return this.deps.requestPermissionDecisionFromUi(
-      this.deps.ui,
+    return this.deps.requestPermissionDecision(
+      {
+        mode: this.deps.mode,
+        ui: this.deps.ui,
+        doublePressToConfirm:
+          this.deps.getPromptPreferences().doublePressToConfirm,
+      },
       details.forwarding
         ? "Permission Required (Subagent)"
         : "Permission Required",