@gotgenes/pi-permission-system 20.6.0 → 20.7.1

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.7.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.7.0...pi-permission-system-v20.7.1) (2026-07-14)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** clip inline permission prompt lines to terminal width ([e3c6907](https://github.com/gotgenes/pi-packages/commit/e3c6907057070cbb444f4ca0dbc69661849b7dc2)), closes [#573](https://github.com/gotgenes/pi-packages/issues/573)
+
+## [20.7.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.6.0...pi-permission-system-v20.7.0) (2026-07-14)
+
+
+### Features
+
+* **pi-permission-system:** add doublePressToConfirm config toggle ([bd401bf](https://github.com/gotgenes/pi-packages/commit/bd401bff0bd926313acfafe5e50b579c88e4002f))
+* **pi-permission-system:** add inline permission prompt decision model ([08d6ec6](https://github.com/gotgenes/pi-packages/commit/08d6ec6b7e9abbcbf05b49579d307e3f5934cb3a))
+* **pi-permission-system:** dispatch TUI permission prompts to the inline keybind dialog ([197c0f9](https://github.com/gotgenes/pi-packages/commit/197c0f91178f7010e84ed80eb3682dc27c1f737f))
+* **pi-permission-system:** render inline keybind permission prompt ([7ac7dad](https://github.com/gotgenes/pi-packages/commit/7ac7dad3ef49f03e19b279056ea54d4c5a456c80))
+
 ## [20.6.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.5.0...pi-permission-system-v20.6.0) (2026-07-13)
 
 

package/README.md

@@ -65,7 +65,8 @@ All permissions use one of three states:
 | `ask`   | Prompts the user for confirmation via UI |
 
 When the dialog prompts, you can approve once or approve a pattern for the rest of the session.
-See [docs/session-approvals.md](docs/session-approvals.md) for details on session-scoped rules and pattern suggestions.
+In an interactive TUI session the prompt is an inline keybind dialog — `y` approve, `s` approve for this session, `n` deny, `r` deny with a reason — where each hotkey arms and a second press confirms (configurable via `doublePressToConfirm`).
+See [docs/configuration.md](docs/configuration.md#inline-permission-dialog-tui) for the hotkeys and [docs/session-approvals.md](docs/session-approvals.md) for session-scoped rules and pattern suggestions.
 
 The `path` surface is a cross-cutting gate that applies to **all** file access — Pi tools, bash commands, MCP calls, and extension tools alike.
 Extension and MCP tools that operate on paths (via `input.path`, MCP's `input.arguments.path`, or a registered access extractor) are gated by default, so a `path` deny cannot be overridden by a per-tool allow — making it the right place to protect sensitive files like `.env` or `~/.ssh/*` from every tool at once.

package/config/config.example.json

@@ -4,6 +4,7 @@
   "debugLog": false,
   "permissionReviewLog": true,
   "yoloMode": false,
+  "doublePressToConfirm": true,
 
   "toolInputPreviewMaxLength": 400,
   "toolTextSummaryMaxLength": 120,

package/docs/configuration.md

@@ -30,7 +30,7 @@ Project config overrides global config; per-agent frontmatter overrides both.
 4. Project agent frontmatter
 
 The `permission` object uses deep-shallow merge: string-vs-string replaces; both-object shallow-merges pattern maps; string-vs-object the override wins entirely.
-Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replacement.
+Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`) use simple replacement.
 
 ## Full Example
 
@@ -42,6 +42,7 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
   "debugLog": false,
   "permissionReviewLog": true,
   "yoloMode": false,
+  "doublePressToConfirm": true,
   "toolInputPreviewMaxLength": 400,
   "toolTextSummaryMaxLength": 120,
   "piInfrastructureReadPaths": [],
@@ -85,6 +86,7 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
 | `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                        |
 | `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`                                              |
 | `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                           |
+| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.    |
 | `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.      |
 | `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                |
 | `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`). |
@@ -92,6 +94,23 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`) use simple replace
 Both logs write to `~/.pi/agent/extensions/pi-permission-system/logs/`.
 No debug output is printed to the terminal.
 
+### Inline permission dialog (TUI)
+
+In an interactive **TUI** session, an `ask` decision opens an inline keybind dialog with one-key shortcuts:
+
+| Key | Action                                                            |
+| --- | ----------------------------------------------------------------- |
+| `y` | Approve once                                                      |
+| `s` | Approve for this session                                          |
+| `n` | Deny                                                              |
+| `r` | Deny with a reason (opens an inline editor; a reason is required) |
+
+Arrow keys / `j`/`k` move the highlight, `enter` confirms the highlighted option, and `esc` denies.
+With `doublePressToConfirm` enabled (the default), a letter hotkey **arms** its action and shows a `Press y again to approve.` hint; press the same key again to commit.
+Set `doublePressToConfirm` to `false` to commit on the first press.
+
+Non-TUI contexts (RPC / frontend-driven sessions) keep the single-select prompt and are unaffected by `doublePressToConfirm`.
+
 ### `piInfrastructureReadPaths` patterns
 
 Each entry is either a plain directory prefix or a wildcard pattern.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.6.0",
+  "version": "20.7.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -25,6 +25,12 @@
       "default": false,
       "type": "boolean"
     },
+    "doublePressToConfirm": {
+      "description": "Require a confirming second press of a decision hotkey in the inline permission dialog. Applies to TUI sessions only.",
+      "markdownDescription": "Require a confirming second press of a decision hotkey (`y`/`s`/`n`/`r`) in the inline permission dialog before it commits — the first press arms the action and shows a `Press y again to approve.` hint.\n\nApplies to interactive **TUI** sessions only; the non-TUI (RPC/frontend) prompt keeps its single-select flow. Set to `false` to commit decisions on the first hotkey press.",
+      "default": true,
+      "type": "boolean"
+    },
     "toolInputPreviewMaxLength": {
       "description": "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",
       "markdownDescription": "Maximum character length of the inline-JSON tool-input preview shown in permission prompts.\n\nOmit to use the default (200). Set to a large value (e.g. `10000`) to effectively disable truncation and see the full input.",

package/src/authority/authorizer.ts

@@ -1,8 +1,9 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type {
-  PermissionPromptDecision,
-  requestPermissionDecisionFromUi,
-} from "#src/authority/permission-dialog";
+  PromptPreferences,
+  requestPermissionDecision,
+} from "#src/authority/permission-prompt-component";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PermissionEventBus } from "#src/permission-events";
 import type { DebugReviewLogger } from "#src/session-logger";
@@ -33,8 +34,10 @@ export interface AuthorizerSelectionDeps {
   detection: SubagentDetector;
   /** Event bus used by `LocalUserAuthorizer` for the `permissions:ui_prompt` broadcast. */
   events: PermissionEventBus;
+  /** Read live at prompt time; threaded into `LocalUserAuthorizer`. */
+  getPromptPreferences: () => PromptPreferences;
   /** Injected for testability; production callers pass the real function. */
-  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+  requestPermissionDecision: typeof requestPermissionDecision;
   /** Forwarding directory `ParentAuthorizer` reads/writes request and response files under. */
   forwardingDir: string;
   /** In-process subagent session registry for forwarding target resolution. */
@@ -57,8 +60,10 @@ export function selectAuthorizer(
   if (ctx.hasUI) {
     return new LocalUserAuthorizer({
       ui: ctx.ui,
+      mode: ctx.mode,
       events: deps.events,
-      requestPermissionDecisionFromUi: deps.requestPermissionDecisionFromUi,
+      getPromptPreferences: deps.getPromptPreferences,
+      requestPermissionDecision: deps.requestPermissionDecision,
     });
   }
   if (deps.detection.isSubagent(ctx)) {

package/src/authority/local-user-authorizer.ts

@@ -1,9 +1,13 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type {
-  PermissionDecisionUi,
   PermissionPromptDecision,
   RequestPermissionOptions,
-  requestPermissionDecisionFromUi,
 } from "#src/authority/permission-dialog";
+import type {
+  PermissionPromptUi,
+  PromptPreferences,
+  requestPermissionDecision,
+} from "#src/authority/permission-prompt-component";
 import { buildForwardedScopeLabels } from "#src/pattern-suggest";
 import {
   emitUiPromptEvent,
@@ -15,12 +19,16 @@ import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */
 export interface LocalUserAuthorizerDeps {
-  /** The active session's UI surface. */
-  ui: PermissionDecisionUi;
+  /** The active session's UI surface (select/input plus the inline `custom` dialog). */
+  ui: PermissionPromptUi;
+  /** The session run mode; the dispatcher renders the inline dialog only in `"tui"`. */
+  mode: ExtensionContext["mode"];
   /** Event bus used for the `permissions:ui_prompt` broadcast. */
   events: PermissionEventBus;
+  /** Read live at prompt time so a settings-modal toggle takes effect on the next prompt. */
+  getPromptPreferences: () => PromptPreferences;
   /** Injected for testability; production callers pass the real function. */
-  requestPermissionDecisionFromUi: typeof requestPermissionDecisionFromUi;
+  requestPermissionDecision: typeof requestPermissionDecision;
 }
 
 /**
@@ -41,8 +49,13 @@ export class LocalUserAuthorizer implements Authorizer {
   ): Promise<PermissionPromptDecision> {
     const uiPrompt = buildUiPrompt(details);
     emitUiPromptEvent(this.deps.events, uiPrompt);
-    return this.deps.requestPermissionDecisionFromUi(
-      this.deps.ui,
+    return this.deps.requestPermissionDecision(
+      {
+        mode: this.deps.mode,
+        ui: this.deps.ui,
+        doublePressToConfirm:
+          this.deps.getPromptPreferences().doublePressToConfirm,
+      },
       details.forwarding
         ? "Permission Required (Subagent)"
         : "Permission Required",

package/src/authority/permission-prompt-component.ts

@@ -0,0 +1,300 @@
+import type {
+  ExtensionContext,
+  ExtensionUIContext,
+} from "@earendil-works/pi-coding-agent";
+import {
+  type Component,
+  matchesKey,
+  truncateToWidth,
+  wrapTextWithAnsi,
+} from "@earendil-works/pi-tui";
+import {
+  type PermissionPromptDecision,
+  type RequestPermissionOptions,
+  requestPermissionDecisionFromUi,
+} from "#src/authority/permission-dialog";
+import {
+  initialPromptState,
+  type PromptEvent,
+  type PromptKey,
+  type PromptModelConfig,
+  type PromptViewState,
+  reducePrompt,
+} from "#src/authority/permission-prompt-decision";
+
+/**
+ * Inline `ctx.ui.custom` permission dialog for TUI sessions.
+ *
+ * All interaction logic lives in the pure {@link reducePrompt} model; this
+ * module is the thin adapter that renders the model's state to lines, maps raw
+ * keystrokes to {@link PromptEvent}s, and resolves the `ctx.ui.custom` promise
+ * with the committed {@link PermissionPromptDecision}. The component renders
+ * inline (never as an overlay).
+ */
+
+/** The subset of the session UI surface the inline dialog needs. */
+export type PermissionPromptUi = Pick<
+  ExtensionUIContext,
+  "select" | "input" | "custom"
+>;
+
+/** The resolved presentation context selected once per activation. */
+export interface PermissionPromptView {
+  mode: ExtensionContext["mode"];
+  ui: PermissionPromptUi;
+  doublePressToConfirm: boolean;
+}
+
+/** Live prompt-behavior preferences read at prompt time (see `doublePressToConfirm`). */
+export interface PromptPreferences {
+  doublePressToConfirm: boolean;
+}
+
+/**
+ * Route a permission ask to the inline keybind dialog in TUI mode, or the
+ * `select()`/`input()` flow otherwise (RPC / frontend — the #519 constraint).
+ *
+ * The single entry the `LocalUserAuthorizer` calls; keeps the mode dispatch in
+ * one place so the fallback and the inline component never both render.
+ */
+export function requestPermissionDecision(
+  view: PermissionPromptView,
+  title: string,
+  message: string,
+  options?: RequestPermissionOptions,
+): Promise<PermissionPromptDecision> {
+  if (view.mode === "tui") {
+    return presentInlinePermissionPrompt(view, title, message, options);
+  }
+  return requestPermissionDecisionFromUi(view.ui, title, message, options);
+}
+
+/** Minimal theme surface the dialog uses; satisfied by the real SDK theme. */
+interface PromptTheme {
+  fg(color: string, text: string): string;
+}
+
+const DEFAULT_SESSION_LABEL = "Yes, for this session";
+
+const OPTION_LABELS: Record<PromptKey, string> = {
+  y: "Yes",
+  s: DEFAULT_SESSION_LABEL,
+  n: "No",
+  r: "No, provide reason",
+};
+
+const OPTION_ORDER: readonly PromptKey[] = ["y", "s", "n", "r"];
+
+export function presentInlinePermissionPrompt(
+  view: PermissionPromptView,
+  title: string,
+  message: string,
+  options?: RequestPermissionOptions,
+): Promise<PermissionPromptDecision> {
+  const config: PromptModelConfig = {
+    doublePressToConfirm: view.doublePressToConfirm,
+    sessionLabel: options?.sessionLabel ?? DEFAULT_SESSION_LABEL,
+    sessionScope: options?.sessionScope,
+  };
+  return view.ui.custom<PermissionPromptDecision>(
+    (tui, theme, _keybindings, done) =>
+      new PermissionPromptComponent(
+        theme,
+        config,
+        title,
+        message,
+        () => {
+          tui.requestRender();
+        },
+        done,
+      ),
+    { overlay: false },
+  );
+}
+
+class PermissionPromptComponent implements Component {
+  private state: PromptViewState;
+  private reasonBuffer = "";
+
+  constructor(
+    private readonly theme: PromptTheme,
+    private readonly config: PromptModelConfig,
+    private readonly title: string,
+    private readonly message: string,
+    private readonly requestRender: () => void,
+    private readonly done: (decision: PermissionPromptDecision) => void,
+  ) {
+    this.state = initialPromptState(config);
+  }
+
+  invalidate(): void {
+    // No cached rendering state to clear.
+  }
+
+  render(width: number): string[] {
+    return fitToWidth(this.renderStep(), width);
+  }
+
+  private renderStep(): string[] {
+    switch (this.state.step) {
+      case "decision":
+        return this.renderDecision();
+      case "reason":
+        return this.renderReason();
+      case "scope":
+        return this.renderScope();
+    }
+  }
+
+  handleInput(data: string): void {
+    if (this.state.step === "reason") {
+      this.handleReasonInput(data);
+      return;
+    }
+    const event = this.toEvent(data);
+    if (event) {
+      this.apply(event);
+    }
+  }
+
+  private handleReasonInput(data: string): void {
+    if (matchesKey(data, "enter")) {
+      this.apply({ type: "submitReason", draft: this.reasonBuffer });
+      return;
+    }
+    if (matchesKey(data, "escape")) {
+      this.reasonBuffer = "";
+      this.apply({ type: "cancel" });
+      return;
+    }
+    if (matchesKey(data, "backspace")) {
+      this.reasonBuffer = this.reasonBuffer.slice(0, -1);
+      this.requestRender();
+      return;
+    }
+    if (isPrintable(data)) {
+      this.reasonBuffer += data;
+      this.requestRender();
+    }
+  }
+
+  private toEvent(data: string): PromptEvent | undefined {
+    if (matchesKey(data, "up") || matchesKey(data, "k")) {
+      return { type: "nav", direction: "up" };
+    }
+    if (matchesKey(data, "down") || matchesKey(data, "j")) {
+      return { type: "nav", direction: "down" };
+    }
+    if (matchesKey(data, "enter")) {
+      return { type: "confirm" };
+    }
+    if (matchesKey(data, "escape")) {
+      return { type: "cancel" };
+    }
+    if (this.state.step === "decision") {
+      const key = OPTION_ORDER.find((option) => matchesKey(data, option));
+      if (key) {
+        return { type: "hotkey", key };
+      }
+    }
+    return undefined;
+  }
+
+  private apply(event: PromptEvent): void {
+    const outcome = reducePrompt(this.config, this.state, event);
+    if (outcome.kind === "decision") {
+      this.done(outcome.decision);
+      return;
+    }
+    if (outcome.state.step === "reason" && this.state.step !== "reason") {
+      this.reasonBuffer = "";
+    }
+    this.state = outcome.state;
+    this.requestRender();
+  }
+
+  private renderDecision(): string[] {
+    const lines = [this.theme.fg("accent", this.title), this.message, ""];
+    for (const key of OPTION_ORDER) {
+      const label = key === "s" ? this.config.sessionLabel : OPTION_LABELS[key];
+      const selected = this.state.highlightedKey === key;
+      const marker = selected ? "▶" : " ";
+      const row = `${marker} (${key}) ${label}`;
+      lines.push(selected ? this.theme.fg("accent", row) : row);
+    }
+    lines.push("");
+    lines.push(
+      this.state.hint ||
+        this.theme.fg(
+          "muted",
+          "↑/↓ move · enter confirm · esc deny · press a letter, then again to confirm",
+        ),
+    );
+    return lines;
+  }
+
+  private renderReason(): string[] {
+    const lines = [
+      this.theme.fg("accent", this.title),
+      this.message,
+      "",
+      `Reason (required): ${this.reasonBuffer}\u2588`,
+    ];
+    if (this.state.reasonError) {
+      lines.push(this.theme.fg("error", this.state.reasonError));
+    }
+    lines.push("");
+    lines.push(this.theme.fg("muted", "enter submit · esc back"));
+    return lines;
+  }
+
+  private renderScope(): string[] {
+    const scope = this.config.sessionScope;
+    const subagentLabel = scope?.subagentLabel ?? "This subagent only";
+    const servingLabel = scope?.servingSessionLabel ?? "The whole session";
+    const rows: Array<{ label: string; serving: boolean }> = [
+      { label: subagentLabel, serving: false },
+      { label: servingLabel, serving: true },
+    ];
+    const lines = [
+      this.theme.fg("accent", this.title),
+      "Apply this session grant to:",
+      "",
+    ];
+    for (const row of rows) {
+      const selected = this.state.scopeServing === row.serving;
+      const marker = selected ? "▶" : " ";
+      const text = `${marker} ${row.label}`;
+      lines.push(selected ? this.theme.fg("accent", text) : text);
+    }
+    lines.push("");
+    lines.push(this.theme.fg("muted", "↑/↓ move · enter confirm · esc back"));
+    return lines;
+  }
+}
+
+/**
+ * Fit rendered lines to the terminal width, satisfying the `ctx.ui.custom`
+ * contract that every returned line be a single visual row no wider than
+ * `width`. Long lines (e.g. a wide tool-preview message) are wrapped rather
+ * than clipped so no content is lost; the final `truncateToWidth` guards the
+ * edge cases `wrapTextWithAnsi` cannot split (a lone wide grapheme).
+ */
+function fitToWidth(lines: string[], width: number): string[] {
+  if (width <= 0) {
+    return [];
+  }
+  return lines.flatMap((line) =>
+    wrapTextWithAnsi(line, width).map((wrapped) =>
+      truncateToWidth(wrapped, width),
+    ),
+  );
+}
+
+function isPrintable(data: string): boolean {
+  if (data.length !== 1) {
+    return false;
+  }
+  const code = data.charCodeAt(0);
+  return code >= 0x20 && code !== 0x7f;
+}

package/src/authority/permission-prompt-decision.ts

@@ -0,0 +1,258 @@
+import {
+  createDeniedPermissionDecision,
+  normalizePermissionDenialReason,
+  type PermissionPromptDecision,
+  type RequestPermissionOptions,
+} from "#src/authority/permission-dialog";
+
+/**
+ * Pure decision model for the inline keybind permission dialog.
+ *
+ * The interaction logic — which hotkey produces which decision, double-press
+ * arming, step transitions, and reason validation — lives here with no SDK or
+ * TUI imports, so it is unit-testable directly. The `ctx.ui.custom` component
+ * ({@link file://./permission-prompt-component.ts}) is a thin adapter that
+ * forwards keystrokes to {@link reducePrompt} and renders the returned state.
+ */
+
+/** The four decision hotkeys, in display order. */
+export type PromptKey = "y" | "s" | "n" | "r";
+
+/** Which sub-view the dialog is showing. */
+export type PromptStep = "decision" | "reason" | "scope";
+
+const OPTION_ORDER: readonly PromptKey[] = ["y", "s", "n", "r"];
+
+const OPTION_VERBS: Record<PromptKey, string> = {
+  y: "approve",
+  s: "approve for this session",
+  n: "deny",
+  r: "deny with a reason",
+};
+
+/** Static configuration for a single prompt presentation. */
+export interface PromptModelConfig {
+  /** When true, a letter hotkey arms first and commits only on a second press. */
+  doublePressToConfirm: boolean;
+  /** Label shown beside the approve-for-session option. */
+  sessionLabel: string;
+  /**
+   * Forwarded asks only: when set, confirming `s` opens a second step choosing
+   * whether the grant applies to the requesting subagent only (least-privilege
+   * default) or the whole serving session.
+   */
+  sessionScope?: NonNullable<RequestPermissionOptions["sessionScope"]>;
+}
+
+/** The re-render view state the component draws from. */
+export interface PromptViewState {
+  step: PromptStep;
+  highlightedKey: PromptKey;
+  /** Set only while awaiting the confirming second press of a hotkey. */
+  armedKey?: PromptKey;
+  /** "Press y again to approve." while armed; empty otherwise. */
+  hint: string;
+  reasonDraft: string;
+  /** Set when an empty reason submit is rejected. */
+  reasonError?: string;
+  /** Scope step: false = subagent-only (default), true = whole serving session. */
+  scopeServing: boolean;
+}
+
+/** An input event the reducer understands. */
+export type PromptEvent =
+  | { type: "nav"; direction: "up" | "down" }
+  | { type: "hotkey"; key: PromptKey }
+  | { type: "confirm" }
+  | { type: "cancel" }
+  | { type: "submitReason"; draft: string };
+
+/** Either a re-render or a terminal decision. */
+export type PromptOutcome =
+  | { kind: "render"; state: PromptViewState }
+  | { kind: "decision"; decision: PermissionPromptDecision };
+
+export function initialPromptState(
+  _config: PromptModelConfig,
+): PromptViewState {
+  return {
+    step: "decision",
+    highlightedKey: "y",
+    armedKey: undefined,
+    hint: "",
+    reasonDraft: "",
+    reasonError: undefined,
+    scopeServing: false,
+  };
+}
+
+/**
+ * Advance the dialog by one input event, returning either the next view state
+ * to render or the committed {@link PermissionPromptDecision}.
+ */
+export function reducePrompt(
+  config: PromptModelConfig,
+  state: PromptViewState,
+  event: PromptEvent,
+): PromptOutcome {
+  switch (state.step) {
+    case "decision":
+      return reduceDecisionStep(config, state, event);
+    case "reason":
+      return reduceReasonStep(state, event);
+    case "scope":
+      return reduceScopeStep(state, event);
+  }
+}
+
+function reduceDecisionStep(
+  config: PromptModelConfig,
+  state: PromptViewState,
+  event: PromptEvent,
+): PromptOutcome {
+  switch (event.type) {
+    case "nav":
+      return render({
+        ...state,
+        highlightedKey: shiftKey(state.highlightedKey, event.direction),
+        armedKey: undefined,
+        hint: "",
+      });
+    case "hotkey":
+      return pressHotkey(config, state, event.key);
+    case "confirm":
+      return commit(config, state, state.highlightedKey);
+    case "cancel":
+      return { kind: "decision", decision: createDeniedPermissionDecision() };
+    case "submitReason":
+      return render(state);
+  }
+}
+
+function pressHotkey(
+  config: PromptModelConfig,
+  state: PromptViewState,
+  key: PromptKey,
+): PromptOutcome {
+  if (!config.doublePressToConfirm || state.armedKey === key) {
+    return commit(config, state, key);
+  }
+  return render({
+    ...state,
+    highlightedKey: key,
+    armedKey: key,
+    hint: `Press ${key} again to ${OPTION_VERBS[key]}.`,
+  });
+}
+
+function commit(
+  config: PromptModelConfig,
+  state: PromptViewState,
+  key: PromptKey,
+): PromptOutcome {
+  switch (key) {
+    case "y":
+      return {
+        kind: "decision",
+        decision: { approved: true, state: "approved" },
+      };
+    case "n":
+      return { kind: "decision", decision: createDeniedPermissionDecision() };
+    case "r":
+      return render({
+        ...state,
+        step: "reason",
+        highlightedKey: "r",
+        armedKey: undefined,
+        hint: "",
+        reasonDraft: "",
+        reasonError: undefined,
+      });
+    case "s":
+      if (config.sessionScope) {
+        return render({
+          ...state,
+          step: "scope",
+          highlightedKey: "s",
+          armedKey: undefined,
+          hint: "",
+          scopeServing: false,
+        });
+      }
+      return {
+        kind: "decision",
+        decision: { approved: true, state: "approved_for_session" },
+      };
+  }
+}
+
+function reduceReasonStep(
+  state: PromptViewState,
+  event: PromptEvent,
+): PromptOutcome {
+  if (event.type === "cancel") {
+    return render({
+      ...state,
+      step: "decision",
+      armedKey: undefined,
+      hint: "",
+      reasonDraft: "",
+      reasonError: undefined,
+    });
+  }
+  if (event.type === "submitReason") {
+    const reason = normalizePermissionDenialReason(event.draft);
+    if (reason === undefined) {
+      return render({
+        ...state,
+        reasonDraft: event.draft,
+        reasonError: "A reason is required.",
+      });
+    }
+    return {
+      kind: "decision",
+      decision: createDeniedPermissionDecision(reason),
+    };
+  }
+  return render(state);
+}
+
+function reduceScopeStep(
+  state: PromptViewState,
+  event: PromptEvent,
+): PromptOutcome {
+  switch (event.type) {
+    case "nav":
+      return render({ ...state, scopeServing: event.direction === "down" });
+    case "confirm":
+      return {
+        kind: "decision",
+        decision: {
+          approved: true,
+          state: state.scopeServing
+            ? "approved_for_serving_session"
+            : "approved_for_session",
+        },
+      };
+    case "cancel":
+      return render({
+        ...state,
+        step: "decision",
+        armedKey: undefined,
+        hint: "",
+      });
+    default:
+      return render(state);
+  }
+}
+
+function shiftKey(current: PromptKey, direction: "up" | "down"): PromptKey {
+  const index = OPTION_ORDER.indexOf(current);
+  const delta = direction === "down" ? 1 : -1;
+  const next = (index + delta + OPTION_ORDER.length) % OPTION_ORDER.length;
+  return OPTION_ORDER[next] ?? current;
+}
+
+function render(state: PromptViewState): PromptOutcome {
+  return { kind: "render", state };
+}

package/src/config-loader.ts

@@ -197,6 +197,9 @@ function formatConfigIssues(error: ZodError): string[] {
  * - Array fields (piInfrastructureReadPaths) replace the base when present in
  *   the override (override-wins, same as scalars).
  */
+// Scalar knobs merged by override-replaces-base; keep in sync with
+// PermissionSystemExtensionConfig booleans (debugLog, permissionReviewLog,
+// yoloMode, doublePressToConfirm).
 export function mergeUnifiedConfigs(
   base: UnifiedPermissionConfig,
   override: UnifiedPermissionConfig,
@@ -204,7 +207,12 @@ export function mergeUnifiedConfigs(
   const merged: UnifiedPermissionConfig = {};
 
   // Boolean scalars: override replaces base when defined
-  for (const key of ["debugLog", "permissionReviewLog", "yoloMode"] as const) {
+  for (const key of [
+    "debugLog",
+    "permissionReviewLog",
+    "yoloMode",
+    "doublePressToConfirm",
+  ] as const) {
     const value = override[key] ?? base[key];
     if (value !== undefined) {
       merged[key] = value;

package/src/config-modal.ts

@@ -51,6 +51,7 @@ function cloneDefaultConfig(): PermissionSystemExtensionConfig {
     debugLog: DEFAULT_EXTENSION_CONFIG.debugLog,
     permissionReviewLog: DEFAULT_EXTENSION_CONFIG.permissionReviewLog,
     yoloMode: DEFAULT_EXTENSION_CONFIG.yoloMode,
+    doublePressToConfirm: DEFAULT_EXTENSION_CONFIG.doublePressToConfirm,
   };
 }
 
@@ -113,6 +114,14 @@ function buildSettingItems(
       currentValue: toOnOff(config.debugLog),
       values: ON_OFF,
     },
+    {
+      id: "doublePressToConfirm",
+      label: "Double-press to confirm",
+      description:
+        "Require a confirming second press of a decision hotkey in the inline TUI permission dialog",
+      currentValue: toOnOff(config.doublePressToConfirm),
+      values: ON_OFF,
+    },
   ];
 }
 
@@ -128,6 +137,8 @@ function applySetting(
       return { ...config, permissionReviewLog: value === "on" };
     case "debugLog":
       return { ...config, debugLog: value === "on" };
+    case "doublePressToConfirm":
+      return { ...config, doublePressToConfirm: value === "on" };
     default:
       return config;
   }
@@ -143,6 +154,10 @@ function syncSettingValues(
     toOnOff(config.permissionReviewLog),
   );
   settingsList.updateValue("debugLog", toOnOff(config.debugLog));
+  settingsList.updateValue(
+    "doublePressToConfirm",
+    toOnOff(config.doublePressToConfirm),
+  );
 }
 
 function getArgumentCompletions(

package/src/config-schema.ts

@@ -180,6 +180,13 @@ export const unifiedConfigSchema = z
         "Auto-approve `ask`-state permission checks, including subagent approval forwarding.\n\n⚠️ **Use with caution** — this disables all interactive confirmation prompts.",
       default: false,
     }),
+    doublePressToConfirm: z.boolean().optional().meta({
+      description:
+        "Require a confirming second press of a decision hotkey in the inline permission dialog. Applies to TUI sessions only.",
+      markdownDescription:
+        "Require a confirming second press of a decision hotkey (`y`/`s`/`n`/`r`) in the inline permission dialog before it commits — the first press arms the action and shows a `Press y again to approve.` hint.\n\nApplies to interactive **TUI** sessions only; the non-TUI (RPC/frontend) prompt keeps its single-select flow. Set to `false` to commit decisions on the first hotkey press.",
+      default: true,
+    }),
     toolInputPreviewMaxLength: z.number().int().min(1).optional().meta({
       description:
         "Maximum character length of the inline-JSON tool-input preview shown in permission prompts. Omit to use the default (200). Set to a large value to disable truncation.",

package/src/extension-config.ts

@@ -13,6 +13,8 @@ export interface PermissionSystemExtensionConfig {
   debugLog: boolean;
   permissionReviewLog: boolean;
   yoloMode: boolean;
+  /** Require a confirming second press of a decision hotkey in the inline TUI dialog. Defaults to true. */
+  doublePressToConfirm: boolean;
   /** Additional directories to auto-allow for reads as Pi infrastructure. */
   piInfrastructureReadPaths?: string[];
   /** Max length of the inline-JSON input preview shown in permission prompts. Defaults to 200. */
@@ -27,6 +29,7 @@ export const DEFAULT_EXTENSION_CONFIG: PermissionSystemExtensionConfig = {
   debugLog: false,
   permissionReviewLog: true,
   yoloMode: false,
+  doublePressToConfirm: true,
 };
 
 function resolveExtensionRoot(moduleUrl = import.meta.url): string {
@@ -58,6 +61,7 @@ export function normalizePermissionSystemConfig(
     debugLog: raw.debugLog === true,
     permissionReviewLog: raw.permissionReviewLog !== false,
     yoloMode: raw.yoloMode === true,
+    doublePressToConfirm: raw.doublePressToConfirm !== false,
   };
   if (raw.piInfrastructureReadPaths !== undefined) {
     result.piInfrastructureReadPaths = raw.piInfrastructureReadPaths;

package/src/index.ts

@@ -8,7 +8,7 @@ import {
   type ServingPolicy,
 } from "./authority/forwarded-request-server";
 import { ForwardingManager } from "./authority/forwarding-manager";
-import { requestPermissionDecisionFromUi } from "./authority/permission-dialog";
+import { requestPermissionDecision } from "./authority/permission-prompt-component";
 import { PermissionPrompter } from "./authority/permission-prompter";
 import { SubagentDetection } from "./authority/subagent-detection";
 import { subscribeSubagentLifecycle } from "./authority/subagent-lifecycle-events";
@@ -100,7 +100,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const authorizerSelection = new AuthorizerSelection({
     detection: subagentDetection,
     events: pi.events,
-    requestPermissionDecisionFromUi,
+    getPromptPreferences: () => ({
+      doublePressToConfirm: configStore.current().doublePressToConfirm,
+    }),
+    requestPermissionDecision,
     forwardingDir: paths.forwardingDir,
     registry: subagentRegistry,
     logger,