@gotgenes/pi-permission-system 20.7.3 → 20.9.0

package/src/authority/forwarding-io.ts

@@ -12,6 +12,7 @@ import {
 import { isPermissionDecisionState } from "#src/authority/permission-dialog";
 import {
   createPermissionForwardingLocation,
+  type ForwardedAccessIntent,
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   type ForwardedSessionApproval,
@@ -67,6 +68,65 @@ function asForwardedSessionApproval(
   return { surface: candidate.surface, patterns: [...candidate.patterns] };
 }
 
+/**
+ * Narrow an unknown value to a `ForwardedAccessIntent`, or `undefined`.
+ *
+ * Tolerant read: the child-fixed access intent is optional (absent on an older
+ * child) and only accepted when fully well-formed — a string `surface`, an
+ * all-string `matchValues` array, a `string | null` `boundaryValue`, a string
+ * `requesterCwd`, and a `principal` with string `sessionId`/`agentName`. Any
+ * malformed shape → `undefined`, so the serving node floors to `ask` (Step 3)
+ * rather than resolving against corrupt facts.
+ */
+function asForwardedAccessIntent(
+  value: unknown,
+): ForwardedAccessIntent | undefined {
+  if (typeof value !== "object" || value === null) {
+    return undefined;
+  }
+  const candidate = value as {
+    surface?: unknown;
+    matchValues?: unknown;
+    boundaryValue?: unknown;
+    requesterCwd?: unknown;
+    principal?: unknown;
+  };
+  if (
+    typeof candidate.surface !== "string" ||
+    !Array.isArray(candidate.matchValues) ||
+    !candidate.matchValues.every((entry) => typeof entry === "string") ||
+    !(
+      candidate.boundaryValue === null ||
+      typeof candidate.boundaryValue === "string"
+    ) ||
+    typeof candidate.requesterCwd !== "string" ||
+    typeof candidate.principal !== "object" ||
+    candidate.principal === null
+  ) {
+    return undefined;
+  }
+  const principal = candidate.principal as {
+    sessionId?: unknown;
+    agentName?: unknown;
+  };
+  if (
+    typeof principal.sessionId !== "string" ||
+    typeof principal.agentName !== "string"
+  ) {
+    return undefined;
+  }
+  return {
+    surface: candidate.surface,
+    matchValues: [...candidate.matchValues],
+    boundaryValue: candidate.boundaryValue,
+    requesterCwd: candidate.requesterCwd,
+    principal: {
+      sessionId: principal.sessionId,
+      agentName: principal.agentName,
+    },
+  };
+}
+
 export function formatUnknownErrorMessage(error: unknown): string {
   if (error instanceof Error && error.message) {
     return error.message;
@@ -350,6 +410,7 @@ export function readForwardedPermissionRequest(
       surface: asNullableDisplayString(parsed.surface),
       value: asNullableDisplayString(parsed.value),
       sessionApproval: asForwardedSessionApproval(parsed.sessionApproval),
+      accessIntent: asForwardedAccessIntent(parsed.accessIntent),
     };
   } catch (error) {
     logPermissionForwardingWarning(

package/src/authority/local-user-authorizer.ts

@@ -14,7 +14,7 @@ import {
   type PermissionEventBus,
 } from "#src/permission-events";
 import { buildUiPrompt } from "#src/permission-ui-prompt";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */
@@ -41,7 +41,7 @@ export interface LocalUserAuthorizerDeps {
  * class renders (populated `forwarding` context + "(Subagent)" title) so the
  * broadcast stays non-degraded (#292) without a second emission path.
  */
-export class LocalUserAuthorizer implements Authorizer {
+export class LocalUserAuthorizer implements TerminalAuthorizer {
   constructor(private readonly deps: LocalUserAuthorizerDeps) {}
 
   authorize(

package/src/authority/permission-forwarding.ts

@@ -66,6 +66,46 @@ export interface ForwardedSessionApproval {
   patterns: readonly string[];
 }
 
+/**
+ * The child-fixed facts a gate emits: the surface it evaluated and the match
+ * set it computed. `requesterCwd` and `principal` are stamped at the escalation
+ * edge (`ParentAuthorizer`), so a gate carries only what it alone can produce.
+ *
+ * Strings only — an `AccessPath` never crosses onto the wire
+ * (`docs/decisions/0002-path-values-string-boundary.md`).
+ */
+export interface ForwardedAccessFacts {
+  /** Gate surface: `"path"`, `"external_directory"`, `"bash"`, a tool name, or a skill name. */
+  surface: string;
+  /**
+   * The child-fixed match set. Path surface: `AccessPath.matchValues()`
+   * (absolute ∪ cwd-relative ∪ canonical), computed at the child. Non-path
+   * surface: the already-portable single value as a one-element array.
+   */
+  matchValues: string[];
+  /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
+  boundaryValue: string | null;
+}
+
+/**
+ * The forwarded-wire access intent (ADR 0008 §2): the child-fixed access facts
+ * plus the requester identity the escalation edge stamps.
+ *
+ * The serving node resolves against this intent directly (Step 3, [#597]),
+ * using `matchValues` as-is — it never re-derives a path through its own
+ * `PathNormalizer`/cwd. See
+ * `docs/decisions/0008-cross-session-access-intent.md`.
+ */
+export interface ForwardedAccessIntent extends ForwardedAccessFacts {
+  /** The requester's cwd, for provenance/disclosure — never for parent re-derivation. */
+  requesterCwd: string;
+  /** Who is requesting. */
+  principal: {
+    sessionId: string;
+    agentName: string;
+  };
+}
+
 export type ForwardedPermissionRequest = {
   id: string;
   createdAt: number;
@@ -89,6 +129,12 @@ export type ForwardedPermissionRequest = {
    * omits it, and the serving dialog then offers no scope choice).
    */
   sessionApproval?: ForwardedSessionApproval;
+  /**
+   * The child-fixed access intent (ADR 0008 §2). Optional for version-skew
+   * tolerance: an older child omits it, and the serving node floors to `ask`
+   * (Step 3). Present on a current child's request for every gate surface.
+   */
+  accessIntent?: ForwardedAccessIntent;
 };
 
 export type ForwardedPermissionResponse = {

package/src/authority/permission-prompter.ts

@@ -1,7 +1,10 @@
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type { ForwardedSessionApproval } from "#src/authority/permission-forwarding";
+import type {
+  ForwardedAccessFacts,
+  ForwardedSessionApproval,
+} from "#src/authority/permission-forwarding";
 import type { ReviewLogger } from "#src/session-logger";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
@@ -46,6 +49,14 @@ export interface PromptPermissionDetails {
    * suggestion.
    */
   sessionApproval?: ForwardedSessionApproval;
+  /**
+   * The child-fixed access facts the raising gate computed (surface + match
+   * set). Rides through the runner to the escalation edge, which completes
+   * them into a `ForwardedAccessIntent` by stamping `requesterCwd` and
+   * `principal`. Absent for a serving-node local prompt reconstructed from a
+   * forwarded request.
+   */
+  accessIntent?: ForwardedAccessFacts;
 }
 
 /**
@@ -58,7 +69,7 @@ export interface PromptPermissionDetails {
  */
 export interface PermissionPrompterApi {
   prompt(
-    authorizer: Authorizer,
+    authorizer: TerminalAuthorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
 }
@@ -71,7 +82,7 @@ export interface PermissionPrompterDeps {
 
 /**
  * Brackets the ask-path flow with review-log entries and delegates the
- * live decision to the selected {@link Authorizer}:
+ * live decision to the selected {@link TerminalAuthorizer}:
  *   1. Review-log "waiting" entry.
  *   2. `authorizer.authorize(details)`.
  *   3. Review-log "approved" / "denied" entry.
@@ -89,7 +100,7 @@ export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}
 
   async prompt(
-    authorizer: Authorizer,
+    authorizer: TerminalAuthorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
     this.writeReviewEntry("permission_request.waiting", details);

package/src/config-loader.ts

@@ -231,10 +231,11 @@ export function mergeUnifiedConfigs(
   }
 
   // Array fields: override replaces base when defined
-  const piInfrastructureReadPaths =
-    override.piInfrastructureReadPaths ?? base.piInfrastructureReadPaths;
-  if (piInfrastructureReadPaths !== undefined) {
-    merged.piInfrastructureReadPaths = piInfrastructureReadPaths;
+  for (const key of ["piInfrastructureReadPaths", "authorizerChain"] as const) {
+    const value = override[key] ?? base[key];
+    if (value !== undefined) {
+      merged[key] = value;
+    }
   }
 
   // shellTools: shallow-merge by tool name so a project entry overrides a

package/src/config-schema.ts

@@ -206,6 +206,13 @@ export const unifiedConfigSchema = z
         "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), `agentDir`, `agentDir/git`, and project-local `.pi/npm/` and `.pi/git/`. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
       default: [],
     }),
+    authorizerChain: z.array(z.string().min(1)).optional().meta({
+      description:
+        "Ordered names of registered live-authority chain links to consult before the terminal authorizer. Config order (not registration order) fixes the chain order; an unregistered name is skipped fail-safe (more prompting, never less); a link decides nothing until it is named here.",
+      markdownDescription:
+        "Ordered names of registered **live-authority chain links** (e.g. a model judge) to consult before the terminal authorizer (the human, or the subagent-forwarding / headless-deny fallback).\n\nA link reviews an `ask` and returns `allow` / `deny` (with an optional teaching reason) / `defer` to the next link. Three invariants govern the chain:\n\n- **Config order wins.** The order here \u2014 not the order extensions register in \u2014 fixes the security-relevant chain order.\n- **Fail-safe skip.** A name with no registered link is skipped with a warning; the `ask` still reaches the terminal (more prompting, never less).\n- **Opt-in activation.** Installing a judge extension grants it no authority; a link decides nothing until you name it here.\n\nThe chain owner caps every verdict with a bounded-delegation checkpoint: a link's `allow` on an excluded surface (`external_directory` or `path`) is downgraded to `defer`, so a link cannot exceed your policy.\n\nDefaults to an empty list (no links).",
+      default: [],
+    }),
     permission: permissionSchema.optional(),
     shellTools: shellToolsSchema.optional(),
   })

package/src/extension-config.ts

@@ -23,6 +23,8 @@ export interface PermissionSystemExtensionConfig {
   toolTextSummaryMaxLength?: number;
   /** Non-bash tools that carry shell semantics, keyed by tool name. */
   shellTools?: ShellToolsConfig;
+  /** Ordered names of registered live-authority chain links to consult before the terminal authorizer. */
+  authorizerChain?: string[];
 }
 
 export const DEFAULT_EXTENSION_CONFIG: PermissionSystemExtensionConfig = {
@@ -75,6 +77,9 @@ export function normalizePermissionSystemConfig(
   if (raw.shellTools !== undefined) {
     result.shellTools = raw.shellTools;
   }
+  if (raw.authorizerChain !== undefined) {
+    result.authorizerChain = raw.authorizerChain;
+  }
   return result;
 }
 

package/src/handlers/gates/bash-external-directory.ts

@@ -5,6 +5,7 @@ import { deriveApprovalPattern } from "#src/session-rules";
 import type { GateResult } from "./descriptor";
 import { formatBashExternalDirectoryAskPrompt } from "./external-directory-messages";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
+import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -65,6 +66,10 @@ export function describeBashExternalDirectoryGate(
   // defined; the fallback keeps TypeScript happy across the early return. A
   // config-level "deny" is preserved (not downgraded to the catch-all "ask").
   const preCheck = worstCheck ?? uncoveredEntries[0].check;
+  // The AccessPath the decision was made against — its facts ride the wire.
+  const worstEntry =
+    uncoveredEntries.find(({ check }) => check === preCheck) ??
+    uncoveredEntries[0];
 
   const disclosures = uncoveredEntries.map(({ path }) => ({
     path: path.value(),
@@ -98,6 +103,7 @@ export function describeBashExternalDirectoryGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
+      accessIntent: accessFactsFromPath("external_directory", worstEntry.path),
     },
     logContext: {
       source: "tool_call",

package/src/handlers/gates/bash-path.ts

@@ -6,6 +6,7 @@ import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
+import { accessFactsFromPath } from "./helpers";
 import { formatPathAskPrompt } from "./path";
 import type { ToolCallContext } from "./types";
 
@@ -135,6 +136,7 @@ export function describeBashPathGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       command,
+      accessIntent: accessFactsFromPath("path", worstEntry.path),
     },
     logContext: {
       source: "tool_call",

package/src/handlers/gates/external-directory.ts

@@ -7,6 +7,7 @@ import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-regis
 import type { GateResult } from "./descriptor";
 import { formatExternalDirectoryAskPrompt } from "./external-directory-messages";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
+import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -104,6 +105,7 @@ export function describeExternalDirectoryGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: externalDirectoryPath,
+      accessIntent: accessFactsFromPath("external_directory", accessPath),
     },
     logContext: {
       source: "tool_call",

package/src/handlers/gates/helpers.ts

@@ -1,10 +1,43 @@
+import type { AccessPath } from "#src/access-intent/access-path";
 import { classifyToolKind } from "#src/access-intent/tool-kind";
+import type { ForwardedAccessFacts } from "#src/authority/permission-forwarding";
 import type {
   PermissionDecisionEvent,
   PermissionDecisionResolution,
 } from "#src/permission-events";
 import type { PermissionCheckResult } from "#src/types";
 
+/**
+ * Build the child-fixed access facts for a path-shaped gate from its
+ * `AccessPath`.
+ *
+ * Converts the `AccessPath` to strings at the point of emission (ADR-0002: an
+ * `AccessPath` never crosses onto the wire), carrying the lexical ∪ canonical
+ * match set. An empty `boundaryValue()` (a literal-only path) becomes `null`,
+ * so the wire distinguishes "no canonical form" cleanly.
+ */
+export function accessFactsFromPath(
+  surface: string,
+  path: AccessPath,
+): ForwardedAccessFacts {
+  return {
+    surface,
+    matchValues: path.matchValues(),
+    boundaryValue: path.boundaryValue() || null,
+  };
+}
+
+/**
+ * Build the child-fixed access facts for a non-path gate (bash command, MCP
+ * target, skill name, plain tool) from its already-portable single value.
+ */
+export function accessFactsFromValue(
+  surface: string,
+  value: string,
+): ForwardedAccessFacts {
+  return { surface, matchValues: [value], boundaryValue: null };
+}
+
 /**
  * Derive the human-readable value for a decision event from a check result.
  * Bash → extracted command; MCP → qualified target;

package/src/handlers/gates/path.ts

@@ -5,6 +5,7 @@ import { SessionApproval } from "#src/session-approval";
 import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateDescriptor, GateResult } from "./descriptor";
+import { accessFactsFromPath } from "./helpers";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -67,6 +68,7 @@ export function describePathGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       path: filePath,
+      accessIntent: accessFactsFromPath("path", accessPath),
     },
     logContext: {
       source: "tool_call",

package/src/handlers/gates/skill-input.ts

@@ -1,6 +1,7 @@
 import { formatSkillAskPrompt } from "#src/permission-prompts";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
+import { accessFactsFromValue } from "./helpers";
 
 /**
  * Build a pure descriptor for the skill-input permission gate.
@@ -29,6 +30,7 @@ export function describeSkillInputGate(
       agentName,
       message,
       skillName,
+      accessIntent: accessFactsFromValue("skill", skillName),
     },
     logContext: {
       source: "skill_input",

package/src/handlers/gates/skill-read.ts

@@ -4,6 +4,7 @@ import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
 import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
 import { toRecord } from "#src/value-guards";
 import type { GateDescriptor } from "./descriptor";
+import { accessFactsFromValue } from "./helpers";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -64,6 +65,7 @@ export function describeSkillReadGate(
       toolName: tcc.toolName,
       skillName: matchedSkill.name,
       path,
+      accessIntent: accessFactsFromValue("skill", matchedSkill.name),
     },
     logContext: {
       source: "skill_read",

package/src/handlers/gates/tool.ts

@@ -11,7 +11,11 @@ import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
-import { deriveDecisionValue } from "./helpers";
+import {
+  accessFactsFromPath,
+  accessFactsFromValue,
+  deriveDecisionValue,
+} from "./helpers";
 import type { ToolCallContext } from "./types";
 
 /**
@@ -75,6 +79,18 @@ export function describeToolGate(
     formatter,
   );
 
+  const decisionValue = deriveDecisionValue(
+    gateSurface,
+    check,
+    getPathBearingToolPath(tcc.toolName, tcc.input) ?? undefined,
+  );
+
+  // A path-bearing tool carries the AccessPath's alias set; every other surface
+  // (bash command, MCP target, plain tool) carries its already-portable value.
+  const accessIntent = accessPath
+    ? accessFactsFromPath(gateSurface, accessPath)
+    : accessFactsFromValue(gateSurface, decisionValue);
+
   return {
     surface: gateSurface,
     input: tcc.input,
@@ -95,6 +111,7 @@ export function describeToolGate(
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
       sessionLabel: suggestion.label,
+      accessIntent,
       ...permissionLogContext,
     },
     logContext: {
@@ -106,11 +123,7 @@ export function describeToolGate(
     },
     decision: {
       surface: gateSurface,
-      value: deriveDecisionValue(
-        gateSurface,
-        check,
-        getPathBearingToolPath(tcc.toolName, tcc.input) ?? undefined,
-      ),
+      value: decisionValue,
     },
   };
 }

package/src/index.ts

@@ -1,7 +1,8 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { warmBashParser } from "./access-intent/bash/parser";
-import { buildAccessIntentForSurface } from "./access-intent/input-normalizer";
+import { buildResolvedIntentFromMatchValues } from "./access-intent/input-normalizer";
+import { AuthorizerRegistry } from "./authority/authorizer-registry";
 import { AuthorizerSelection } from "./authority/authorizer-selection";
 import {
   ForwardedRequestServer,
@@ -64,6 +65,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const formatterRegistry = new ToolInputFormatterRegistry();
   registerBuiltinToolInputFormatters(formatterRegistry);
   const accessExtractorRegistry = new ToolAccessExtractorRegistry();
+  // One registry instance backs both the registerAuthorizer service surface and
+  // AuthorizerSelection's chain resolution, so a registration is visible to
+  // composition.
+  const authorizerRegistry = new AuthorizerRegistry();
 
   // Both `configStore` and `session` are forward-declared so the logger's
   // lazy thunks can close over them without a cast or null-init holder.
@@ -108,6 +113,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     registry: subagentRegistry,
     logger,
     prompter,
+    // The published service is the narrow, session-scoped PermissionQuery a
+    // chain link is handed (it routes bash/path at gate parity against the live
+    // session cwd). A thunk because `permissionsService` is constructed below;
+    // it resolves at session_start (activate), well after assignment.
+    getPermissionQuery: () => permissionsService,
+    // Same registry instance the registerAuthorizer service surface writes to,
+    // resolved in config order at activation.
+    authorizerRegistry,
+    getAuthorizerChain: () => configStore.current().authorizerChain ?? [],
   });
 
   // Resolver composes the manager + session ruleset and owns the
@@ -116,20 +130,18 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // service and gates below share this one instance.
   const resolver = new PermissionResolver(permissionManager, sessionRules);
 
-  // Serving a forwarded request is resolution: evaluate (surface, value)
-  // against the serving node's composed base ruleset (agentName undefined —
-  // the child already applied its own per-agent overrides before forwarding).
-  // The session.getPathNormalizer() read is deferred behind the closure: inbox
-  // polling starts at session_start, after `session` is assigned — the same
-  // deferred-binding precedent as the logger notify sink below.
+  // Serving a forwarded request is resolution: resolve the child-fixed
+  // ForwardedAccessIntent (ADR 0008) directly against the serving node's
+  // composed ruleset, agent-scoped to the requester (§3) — the match values
+  // are used as fixed by the child, never re-derived through this session's
+  // PathNormalizer/cwd (#597).
   const servingPolicy: ServingPolicy = {
-    check: (surface, value) =>
+    resolve: (intent) =>
       resolver.resolve(
-        buildAccessIntentForSurface(
-          surface,
-          value ?? undefined,
-          session.getPathNormalizer(),
-          undefined,
+        buildResolvedIntentFromMatchValues(
+          intent.surface,
+          intent.matchValues,
+          intent.principal.agentName,
         ),
       ),
   };
@@ -176,6 +188,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     session,
     formatterRegistry,
     accessExtractorRegistry,
+    authorizerRegistry,
   );
 
   // Subscribe to @gotgenes/pi-subagents' child lifecycle events so child

package/src/permission-resolver.ts

@@ -1,5 +1,6 @@
 import type {
   AccessIntent,
+  PathValuesAccessIntent,
   ResolvedAccessIntent,
 } from "./access-intent/access-intent";
 import type { ScopedPermissionManager } from "./permission-manager";
@@ -31,8 +32,14 @@ export interface ScopedPermissionResolver {
  * canonical alias set (#418) is derived. Keeping it here (not in the manager)
  * is the deliberate boundary formalized in ADR-0002
  * (`docs/decisions/0002-path-values-string-boundary.md`).
+ *
+ * Also accepts an already-resolved {@link PathValuesAccessIntent} (the
+ * forwarded-serving wire's producer, #597) as a pure passthrough — it is
+ * already a `ResolvedAccessIntent`, so there is nothing to unwrap.
  */
-function toResolvedIntent(intent: AccessIntent): ResolvedAccessIntent {
+function toResolvedIntent(
+  intent: AccessIntent | PathValuesAccessIntent,
+): ResolvedAccessIntent {
   if (intent.kind === "access-path") {
     return {
       kind: "path-values",
@@ -66,8 +73,16 @@ export class PermissionResolver
    * Answer a gate-emitted access intent, composing the current session ruleset
    * so callers never thread it by hand. Unwraps the `access-path` variant via
    * `matchValues()` before handing a string-based intent to the manager.
+   *
+   * Also accepts a pre-fixed `path-values` intent (the forwarded-serving wire,
+   * #597) — a passthrough, since it is already a `ResolvedAccessIntent`. The
+   * gate-facing {@link ScopedPermissionResolver} interface stays narrow
+   * (`AccessIntent` only); this wider acceptance is available only through the
+   * concrete `PermissionResolver` instance the composition root holds.
    */
-  resolve(intent: AccessIntent): PermissionCheckResult {
+  resolve(
+    intent: AccessIntent | PathValuesAccessIntent,
+  ): PermissionCheckResult {
     return this.permissionManager.check(
       toResolvedIntent(intent),
       this.sessionRules.getRuleset(),

package/src/permissions-service.ts

@@ -1,5 +1,7 @@
 import type { AccessIntent } from "./access-intent/access-intent";
 import { buildAccessIntentForSurface } from "./access-intent/input-normalizer";
+import type { Authorizer } from "./authority/authorizer";
+import type { AuthorizerRegistrar } from "./authority/authorizer-registry";
 import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
 import type { PathNormalizer } from "./path-normalizer";
 import type { PermissionsService } from "./service";
@@ -44,6 +46,7 @@ export class LocalPermissionsService implements PermissionsService {
     private readonly session: PathNormalizerProvider,
     private readonly formatterRegistry: ToolInputFormatterRegistrar,
     private readonly accessExtractorRegistry: ToolAccessExtractorRegistrar,
+    private readonly authorizerRegistry: AuthorizerRegistrar,
   ) {}
 
   checkPermission(
@@ -87,4 +90,11 @@ export class LocalPermissionsService implements PermissionsService {
   ): ReturnType<PermissionsService["registerToolAccessExtractor"]> {
     return this.accessExtractorRegistry.register(toolName, extractor);
   }
+
+  registerAuthorizer(
+    name: string,
+    authorize: Authorizer["authorize"],
+  ): ReturnType<PermissionsService["registerAuthorizer"]> {
+    return this.authorizerRegistry.register(name, authorize);
+  }
 }