@gotgenes/pi-permission-system 26.2.1 → 26.3.0

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [26.3.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.2...pi-permission-system-v26.3.0) (2026-08-18)
+
+
+### Features
+
+* **pi-permission-system:** broadcast a terminal decision when a gate error blocks a tool call ([2ccb8e5](https://github.com/gotgenes/pi-packages/commit/2ccb8e50a4ef376ced8448efba2d5f9f3658e98f)), closes [#753](https://github.com/gotgenes/pi-packages/issues/753)
+* **pi-permission-system:** broadcast the terminal decision for a served forwarded ask ([f2d6b17](https://github.com/gotgenes/pi-packages/commit/f2d6b176abdd47a2b3ce5c3cf6973ba316d5eea6)), closes [#610](https://github.com/gotgenes/pi-packages/issues/610)
+
+
+### Documentation
+
+* **pi-permission-system:** document the served forwarded decision broadcast ([fc2b00b](https://github.com/gotgenes/pi-packages/commit/fc2b00bb801468b450a725e0cb4e9da7e5279844))
+
+## [26.2.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.1...pi-permission-system-v26.2.2) (2026-08-18)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** derive session-approval patterns through the injected PathFlavor ([cf561de](https://github.com/gotgenes/pi-packages/commit/cf561de4c19895ed9495d82f22280fe3ba215aa5)), closes [#655](https://github.com/gotgenes/pi-packages/issues/655)
+
 ## [26.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v26.2.0...pi-permission-system-v26.2.1) (2026-08-17)
 
 

package/README.md

@@ -19,9 +19,9 @@ Permission enforcement extension for the [Pi](https://pi.mariozechner.at/) codin
 - **Gates MCP and skill access** at server, tool, and skill-name granularity
 - **Protects sensitive file patterns** — cross-cutting `path` rules deny `.env`, `~/.ssh/*`, etc. across all tools and bash at once, matching both the path as referenced and its symlink-resolved form so a deny cannot be evaded through a symlink alias
 - **Guards external paths** — prompts before file tools or bash commands reach outside `cwd`
-- **Fails closed** — an internal gate error blocks the tool (with a `gate_error` review-log entry), and an unparseable bash command — or an indirection wrapper that hides the gated command (`bash -c`/`eval`, `sudo`, `env`, `xargs`, `find -exec`, …) — prompts (`ask`) rather than passing silently
+- **Fails closed** — an internal gate error blocks the tool (with a `gate_error` review-log entry and a matching `permissions:decision` broadcast), and an unparseable bash command — or an indirection wrapper that hides the gated command (`bash -c`/`eval`, `sudo`, `env`, `xargs`, `find -exec`, …) — prompts (`ask`) rather than passing silently
 - **Forwards prompts from subagents** — `ask` policies work even in non-UI execution contexts
-- **Broadcasts UI prompt events** — `permissions:ui_prompt` fires only when the permission system is about to invoke the active user-facing permission UI
+- **Broadcasts UI prompt events** — `permissions:ui_prompt` fires only when the permission system is about to invoke the active user-facing permission UI, and every prompt it announces — including one forwarded up from a subagent — is answered by a `permissions:decision` on the same bus
 - **Native [`@gotgenes/pi-subagents`](https://github.com/gotgenes/pi-subagents) integration** — in-process child sessions register with the permission system automatically, enabling per-agent policy enforcement and `ask`-state forwarding to the parent UI without configuration
 
 ## Install

package/dist/public.d.ts

@@ -225,7 +225,9 @@ interface PermissionUiPromptEvent {
     forwarding: ForwardedPromptContext | null;
 }
 /** How a permission decision was reached. */
-type PermissionDecisionResolution = "policy_allow" | "policy_deny" | "session_approved" | "infrastructure_auto_allowed" | "user_approved" | "user_approved_for_session" | "user_denied" | "auto_approved" | "confirmation_unavailable";
+type PermissionDecisionResolution = "policy_allow" | "policy_deny" | "session_approved" | "infrastructure_auto_allowed" | "user_approved" | "user_approved_for_session" | "user_denied" | "auto_approved" | "confirmation_unavailable"
+/** The gate threw, or an escalation failed, and the request was blocked. */
+ | "gate_error";
 /** Payload emitted on `permissions:decision`. */
 interface PermissionDecisionEvent {
     /**
@@ -248,6 +250,16 @@ interface PermissionDecisionEvent {
     agentName: string | null;
     /** Matched pattern from the winning rule (when available). */
     matchedPattern: string | null;
+    /**
+     * Forwarding context for a decision this session made while serving another
+     * session's forwarded request; absent on an ordinary local decision.
+     *
+     * The same `ForwardedPromptContext` the request's `permissions:ui_prompt`
+     * carried, so a consumer that never saw the prompt can still tell a served
+     * ask from a local one. Requester identity beyond it — the requester's cwd
+     * and principal — stays off the bus.
+     */
+    forwarding?: ForwardedPromptContext | null;
 }
 
 /**

package/docs/cross-extension-api.md

@@ -315,6 +315,7 @@ It is not a generic "permission request entered waiting state" event, and it doe
 Policy decisions that resolve without an active UI prompt, such as `policy_allow`, `policy_deny`, `session_approved`, `infrastructure_auto_allowed`, or `auto_approved`, do not emit this event.
 Non-UI child sessions also do not emit this event when they create a forwarded permission request; the parent UI session emits it immediately before showing the forwarded permission dialog.
 A forwarded request the parent's own recorded policy decides (a matching `allow` or `deny`) is answered without a prompt and emits no event; the event fires only when the parent is actually about to ask the human.
+The matching terminal `permissions:decision` is emitted in the parent session too, so a consumer that reacts to this event has a signal on the same bus telling it the prompt is over.
 Forwarded prompts that do reach the human are not degraded: the parent emits the child's original `source` and the same `surface`/`value` display projection, plus a populated `forwarding` context identifying the requesting subagent.
 
 The payload is lean by design — `surface`/`value` are the normalized display projection a notification consumer reads, not a mirror of the internal review log.
@@ -393,7 +394,13 @@ The stability guarantee is additive, so any can be reintroduced in a later minor
 Every permission gate resolution emits a `permissions:decision` event, regardless of outcome.
 This is useful for dashboards, telemetry, or audit overlays.
 
+A session serving another session's forwarded request emits one too, on its own bus, for every forwarded ask it escalates.
+That is what makes a forwarded prompt clearable: the ask is gated in the requesting session — a different process for an out-of-process subagent — so without it the serving session broadcasts a `permissions:ui_prompt` whose outcome never appears.
+A forwarded request the serving session's own policy allows or denies is answered without a prompt and broadcasts nothing, matching the UI-prompt channel.
+A served decision carries a non-null `forwarding` context; the requesting session still emits its own decision when the answer comes back.
+
 The `requestId` is the same id the request's review-log entries carry, and the same one `permissions:ui_prompt` carried if the request reached a prompt — so a prompt and its outcome are joinable, as are two concurrent prompts for the same command.
+A request that reaches a prompt is answered by exactly one terminal event on that prompt's own bus, including when the dialog itself fails.
 It identifies a permission *request*, not a tool call: one tool call runs several gates and so raises several requests, each with its own id.
 Use the review log's `toolCallId` to join back to the Pi transcript.
 
@@ -407,16 +414,17 @@ pi.events.on("permissions:decision", (raw) => {
 
 ### Payload Fields
 
-| Field            | Type                | Description                                                                               |
-| ---------------- | ------------------- | ----------------------------------------------------------------------------------------- |
-| `requestId`      | `string`            | Id of the permission request this decision resolves                                       |
-| `surface`        | `string`            | Permission surface (`"bash"`, `"read"`, `"mcp"`, `"skill"`, `"external_directory"`, etc.) |
-| `value`          | `string`            | Value evaluated (command, tool name, skill name, path)                                    |
-| `result`         | `"allow" \| "deny"` | Final outcome                                                                             |
-| `resolution`     | `string`            | How the outcome was reached (see table below)                                             |
-| `origin`         | `string \| null`    | Config scope that contributed the winning rule                                            |
-| `agentName`      | `string \| null`    | Active agent name when known                                                              |
-| `matchedPattern` | `string \| null`    | Pattern from the winning rule                                                             |
+| Field            | Type                                        | Description                                                                                           |
+| ---------------- | ------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
+| `requestId`      | `string`                                    | Id of the permission request this decision resolves                                                   |
+| `surface`        | `string`                                    | Permission surface (`"bash"`, `"read"`, `"mcp"`, `"skill"`, `"external_directory"`, etc.)             |
+| `value`          | `string`                                    | Value evaluated (command, tool name, skill name, path)                                                |
+| `result`         | `"allow" \| "deny"`                         | Final outcome                                                                                         |
+| `resolution`     | `string`                                    | How the outcome was reached (see table below)                                                         |
+| `origin`         | `string \| null`                            | Config scope that contributed the winning rule                                                        |
+| `agentName`      | `string \| null`                            | Active agent name when known                                                                          |
+| `matchedPattern` | `string \| null`                            | Pattern from the winning rule                                                                         |
+| `forwarding`     | `ForwardedPromptContext \| null` (optional) | Requesting subagent, on a decision made while serving a forwarded request; absent on a local decision |
 
 ### Resolution Values
 
@@ -431,6 +439,7 @@ pi.events.on("permissions:decision", (raw) => {
 | `user_denied`                 | User denied via dialog                                               |
 | `auto_approved`               | Yolo mode — approved automatically without dialog                    |
 | `confirmation_unavailable`    | State was `ask` but no UI was available — blocked                    |
+| `gate_error`                  | The gate threw, or an escalation failed — blocked, fail-closed       |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "26.2.1",
+  "version": "26.3.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/forwarded-request-server.ts

@@ -14,6 +14,11 @@ import {
   type PermissionForwardingLocation,
 } from "#src/authority/permission-forwarding";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
+import type { DecisionBroadcaster } from "#src/decision-reporter";
+import type {
+  PermissionDecisionEvent,
+  PermissionDecisionResolution,
+} from "#src/permission-events";
 import { buildForwardedAskPayload } from "#src/presentation/forwarded-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
@@ -70,6 +75,14 @@ export interface ForwardedRequestServerDeps {
   policy: ServingPolicy;
   /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
   escalator: AskEscalator;
+  /**
+   * Terminal-decision broadcast for an ask this session served.
+   *
+   * A forwarded ask is prompted here but gated in the requesting session — on
+   * another event bus for an out-of-process child — so without this the
+   * parent's own consumers observe a prompt that never ends (#610).
+   */
+  broadcaster: DecisionBroadcaster;
   /**
    * The serving session's `SessionRules`. Records a whole-session grant when a
    * human approves a forwarded request for the entire serving session.
@@ -143,6 +156,68 @@ function toAccessFacts(intent: ForwardedAccessIntent): ForwardedAccessFacts {
   };
 }
 
+/**
+ * Build the terminal `permissions:decision` for an ask this session served.
+ *
+ * Rendered from the same {@link PromptPermissionDetails} the `ui_prompt`
+ * broadcast was built from, so prompt and decision carry one projection by
+ * construction rather than by convention — which is what makes them joinable
+ * beyond the shared request id.
+ *
+ * `origin` and `matchedPattern` are `null` by construction: an escalated
+ * request is one recorded authority did *not* decide, so no rule won. The
+ * decider stays off the bus, which discloses request facts and verdicts only
+ * (ADR 0011 §6, #726).
+ */
+function buildServedDecisionEvent(
+  details: PromptPermissionDetails,
+  decision: PermissionPromptDecision,
+): PermissionDecisionEvent {
+  const facts = details.payload.request;
+  return {
+    requestId: details.requestId,
+    // The child's display projection, falling back to the payload's own facts
+    // for a version-skewed request that carried none. Both are non-nullable
+    // there, so the event's non-null contract holds without a sentinel.
+    surface: details.surface ?? facts.surface,
+    value: details.value ?? facts.value,
+    agentName: details.agentName,
+    result: decision.approved ? "allow" : "deny",
+    resolution: servedResolution(decision),
+    origin: null,
+    matchedPattern: null,
+    forwarding: details.forwarding ?? null,
+  };
+}
+
+/**
+ * Name how a served ask resolved, reading the decision's own stamp rather than
+ * re-deriving it from the outcome: the site that decided already recorded what
+ * it was (#726).
+ *
+ * The grant scope is reported as the human chose it. {@link applyGrantScope}
+ * rewrites a whole-serving-session grant to a plain approval on the wire, but
+ * that translation is about what the *child* records, not about what was
+ * allowed here.
+ */
+function servedResolution(
+  decision: PermissionPromptDecision,
+): PermissionDecisionResolution {
+  if (decision.decidedBy.kind === "gate_error") {
+    return "gate_error";
+  }
+  if (decision.confirmationUnavailable) {
+    return "confirmation_unavailable";
+  }
+  if (!decision.approved) {
+    return "user_denied";
+  }
+  return decision.state === "approved_for_session" ||
+    decision.state === "approved_for_serving_session"
+    ? "user_approved_for_session"
+    : "user_approved";
+}
+
 // ── ForwardedRequestServer ────────────────────────────────────────────────
 
 /**
@@ -158,6 +233,7 @@ export class ForwardedRequestServer implements InboxProcessor {
   private readonly logger: DebugReviewLogger;
   private readonly policy: ServingPolicy;
   private readonly escalator: AskEscalator;
+  private readonly broadcaster: DecisionBroadcaster;
   private readonly recorder: SessionApprovalRecorder;
   private readonly registry: SubagentSessionRegistry | undefined;
 
@@ -166,6 +242,7 @@ export class ForwardedRequestServer implements InboxProcessor {
     this.logger = deps.logger;
     this.policy = deps.policy;
     this.escalator = deps.escalator;
+    this.broadcaster = deps.broadcaster;
     this.recorder = deps.recorder;
     this.registry = deps.registry;
   }
@@ -406,16 +483,35 @@ export class ForwardedRequestServer implements InboxProcessor {
     }
 
     this.logger.review("forwarded_permission.prompted", logDetails);
+    const details = buildForwardedAskDetails(request);
+    const decision = await this.escalateAsk(details);
+    // Announced before the grant-scope translation and before the response is
+    // written: the ask this session broadcast is over once someone here has
+    // answered it, whatever becomes of the file the child polls for (#610).
+    this.broadcaster.emitDecision(buildServedDecisionEvent(details, decision));
+    return decision;
+  }
+
+  /**
+   * Escalate a forwarded ask to the serving session's selected `Authorizer`,
+   * failing closed instead of throwing: an escalation that breaks is nobody's
+   * denial, so the node records itself as the decider.
+   *
+   * Separate from {@link resolveDecision} so the ask's details outlive the
+   * call — every record of the served ask is a render over that one object.
+   */
+  private async escalateAsk(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision> {
     try {
-      return await this.escalator.escalate(buildForwardedAskDetails(request));
+      return await this.escalator.escalate(details);
     } catch (error) {
       const reason = formatUnknownErrorMessage(error);
       logPermissionForwardingError(
         this.logger,
-        `Failed to escalate forwarded permission request '${request.id}'`,
+        `Failed to escalate forwarded permission request '${details.requestId}'`,
         error,
       );
-      // Nobody denied this; the escalation broke and the node failed closed.
       return {
         approved: false,
         state: "denied",

package/src/decision-reporter.ts

@@ -5,14 +5,25 @@ import {
 } from "./permission-events";
 import type { SessionLogger } from "./session-logger";
 
+/**
+ * Broadcasts a terminal permission decision on the `permissions:decision`
+ * channel.
+ *
+ * Narrow by design (ISP): a collaborator that only announces an outcome — the
+ * serving session answering another session's forwarded request — depends on
+ * this rather than on the review-log half it never writes.
+ */
+export interface DecisionBroadcaster {
+  emitDecision(event: PermissionDecisionEvent): void;
+}
+
 /**
  * Reports a permission gate's outcome to the review log and the decision
  * channel. Groups the two side effects that always travel together:
  * writing a structured review-log entry and broadcasting a decision event.
  */
-export interface DecisionReporter {
+export interface DecisionReporter extends DecisionBroadcaster {
   writeReviewLog(event: string, details: Record<string, unknown>): void;
-  emitDecision(event: PermissionDecisionEvent): void;
 }
 
 /**

package/src/handlers/gates/bash-external-directory.ts

@@ -1,8 +1,8 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { GateResult } from "./descriptor";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";
@@ -25,6 +25,7 @@ export function describeBashExternalDirectoryGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -94,7 +95,9 @@ export function describeBashExternalDirectoryGate(
     matchedPattern: preCheck.matchedPattern,
   });
 
-  const patterns = uncoveredPaths.map((p) => deriveApprovalPattern(p));
+  const patterns = uncoveredEntries.map(({ path }) =>
+    normalizer.approvalPatternFor(path),
+  );
 
   return {
     surface: "external_directory",

package/src/handlers/gates/bash-path.ts

@@ -1,9 +1,9 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
+import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { PermissionCheckResult } from "#src/types";
 import { pickMostRestrictive } from "./candidate-check";
 import type { GateResult } from "./descriptor";
@@ -33,6 +33,7 @@ export function describeBashPathGate(
   tcc: ToolCallContext,
   bashProgram: BashProgram | null,
   resolver: ScopedPermissionResolver,
+  normalizer: PathNormalizer,
 ): GateResult {
   if (!bashProgram) return null;
   const command = bashProgram.commandText();
@@ -120,7 +121,7 @@ export function describeBashPathGate(
   // Derive the pattern from the lexical absolute form (the cd-aware resolved
   // path), so it matches the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
-  const pattern = deriveApprovalPattern(worstEntry.path.value());
+  const pattern = normalizer.approvalPatternFor(worstEntry.path);
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
     pathValue: worstToken,

package/src/handlers/gates/external-directory.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
@@ -78,7 +77,7 @@ export function describeExternalDirectoryGate(
     resolver,
     tcc.agentName ?? undefined,
   );
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildExternalDirectoryAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/path.ts

@@ -3,7 +3,6 @@ import type { PathNormalizer } from "#src/path-normalizer";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session-approval";
-import { deriveApprovalPattern } from "#src/session-rules";
 import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";
@@ -46,7 +45,7 @@ export function describePathGate(
 
   // Derive the approval pattern from the lexical absolute form so it matches
   // the policy values a later call produces.
-  const pattern = deriveApprovalPattern(accessPath.value());
+  const pattern = normalizer.approvalPatternFor(accessPath);
 
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,4 +1,3 @@
-import type { AccessPath } from "#src/access-intent/access-path";
 import { BashProgram } from "#src/access-intent/bash/program";
 import { getPathBearingToolPath } from "#src/access-intent/tool-input-path";
 import {
@@ -24,7 +23,7 @@ import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
 import type { GateRunner } from "./runner";
 import { describeSkillReadGate } from "./skill-read";
-import { describeToolGate } from "./tool";
+import { describeToolGate, type ToolPathAccess } from "./tool";
 import type { GateOutcome, ToolCallContext } from "./types";
 
 /**
@@ -115,10 +114,16 @@ export class ToolCallGatePipeline {
           normalizer,
           this.customExtractors,
         ),
-      () => describeBashExternalDirectoryGate(tcc, bashProgram, this.resolver),
-      () => describeBashPathGate(tcc, bashProgram, this.resolver),
+      () =>
+        describeBashExternalDirectoryGate(
+          tcc,
+          bashProgram,
+          this.resolver,
+          normalizer,
+        ),
+      () => describeBashPathGate(tcc, bashProgram, this.resolver, normalizer),
       () => {
-        const { toolCheck, accessPath } = this.resolvePerToolCheck(
+        const { toolCheck, pathAccess } = this.resolvePerToolCheck(
           tcc,
           shell,
           bashProgram,
@@ -128,7 +133,7 @@ export class ToolCallGatePipeline {
           tcc,
           toolCheck,
           formatter,
-          accessPath,
+          pathAccess,
           shell,
         );
         toolDescriptor.preCheck = toolCheck;
@@ -153,15 +158,16 @@ export class ToolCallGatePipeline {
    * #502); every other tool (and a path-bearing tool with no path) keeps the
    * raw `tool` intent the manager normalizes.
    *
-   * Returns the `AccessPath` alongside the check so `describeToolGate` derives
-   * the session-approval value from `accessPath.value()`.
+   * Returns the resolved path alongside the check, already paired with the
+   * session scope approving it grants — derived here, where the normalizer
+   * lives, rather than inside the gate (#655).
    */
   private resolvePerToolCheck(
     tcc: ToolCallContext,
     shell: ShellInvocation | null,
     bashProgram: BashProgram | null,
     normalizer: PathNormalizer,
-  ): { toolCheck: PermissionCheckResult; accessPath?: AccessPath } {
+  ): { toolCheck: PermissionCheckResult; pathAccess?: ToolPathAccess } {
     if (shell) {
       if (bashProgram) {
         return {
@@ -190,7 +196,10 @@ export class ToolCallGatePipeline {
     if (filePath !== null) {
       const accessPath = normalizer.forPath(filePath);
       return {
-        accessPath,
+        pathAccess: {
+          path: accessPath,
+          approvalPattern: normalizer.approvalPatternFor(accessPath),
+        },
         toolCheck: this.resolver.resolve({
           kind: "access-path",
           surface: tcc.toolName,

package/src/handlers/gates/tool.ts

@@ -5,7 +5,10 @@ import {
   classifyToolKind,
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
-import { suggestSessionPattern } from "#src/pattern-suggest";
+import {
+  suggestPathSessionPattern,
+  suggestSessionPattern,
+} from "#src/pattern-suggest";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
 import { SessionApproval } from "#src/session-approval";
 import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
@@ -18,18 +21,30 @@ import {
 } from "./helpers";
 import type { ToolCallContext } from "./types";
 
+/**
+ * A path-bearing tool call's resolved path, paired with the session scope
+ * approving it would grant.
+ *
+ * The pattern is derived by the pipeline's `PathNormalizer`, which owns the
+ * session's `PathFlavor`, rather than re-derived here from `path.value()` — so
+ * the gate carries the platform's separator semantics without holding them
+ * (#655).
+ */
+export interface ToolPathAccess {
+  readonly path: AccessPath;
+  readonly approvalPattern: string;
+}
+
 /**
  * Derive the value used for session-approval pattern suggestions.
  *
- * Bash → command string; MCP → qualified target;
- * path-bearing tools → the `AccessPath`'s lexical absolute form (`value()`),
- * so the suggested pattern matches the policy values a later call produces;
- * others (or a path-bearing tool with no path) → catch-all wildcard.
+ * Bash → command string; MCP → qualified target; everything else → catch-all
+ * wildcard. A path-bearing tool that resolved a path never reaches here — its
+ * suggestion comes from the already-derived {@link ToolPathAccess} pattern.
  */
 function deriveSuggestionValue(
   toolName: string,
   check: PermissionCheckResult,
-  accessPath?: AccessPath,
 ): string {
   switch (classifyToolKind(toolName)) {
     case "bash":
@@ -37,7 +52,7 @@ function deriveSuggestionValue(
     case "mcp":
       return check.target ?? "mcp";
     default:
-      return accessPath ? accessPath.value() : "*";
+      return "*";
   }
 }
 
@@ -51,7 +66,7 @@ export function describeToolGate(
   tcc: ToolCallContext,
   check: PermissionCheckResult,
   formatter: ToolPreviewFormatter,
-  accessPath?: AccessPath,
+  pathAccess?: ToolPathAccess,
   shell?: ShellInvocation | null,
 ): GateDescriptor {
   // A shell invocation (native `bash` or an aliased shell tool) is gated on the
@@ -67,10 +82,12 @@ export function describeToolGate(
   );
 
   // Compute session approval suggestion for the "for this session" option.
-  const suggestion = suggestSessionPattern(
-    gateSurface,
-    deriveSuggestionValue(gateSurface, check, accessPath),
-  );
+  const suggestion = pathAccess
+    ? suggestPathSessionPattern(gateSurface, pathAccess.approvalPattern)
+    : suggestSessionPattern(
+        gateSurface,
+        deriveSuggestionValue(gateSurface, check),
+      );
 
   const payload = buildToolAskPayload({
     check,
@@ -89,8 +106,8 @@ export function describeToolGate(
 
   // A path-bearing tool carries the AccessPath's alias set; every other surface
   // (bash command, MCP target, plain tool) carries its already-portable value.
-  const accessIntent = accessPath
-    ? accessFactsFromPath(gateSurface, accessPath)
+  const accessIntent = pathAccess
+    ? accessFactsFromPath(gateSurface, pathAccess.path)
     : accessFactsFromValue(gateSurface, decisionValue);
 
   return {

package/src/handlers/tool-call-boundary.ts

@@ -66,7 +66,12 @@ export function createFailClosedToolCall(
  * The block below this must be reached: the SDK does not catch a throwing
  * handler, so an exception escaping the recording work would leave the command
  * ungated. The request id is minted here rather than borrowed — the throw may
- * have come from anywhere in the pipeline, so no gate's id is available.
+ * have come from anywhere in the pipeline, so no gate's id is available — and
+ * shared by both records, so the terminal broadcast joins the review entry.
+ *
+ * The broadcast carries what the raw event yields and nothing inferred: no
+ * rule won, and the boundary holds no session, so `origin`, `matchedPattern`,
+ * and `agentName` are `null` (#753).
  */
 function recordGateError(
   reporter: DecisionReporter,
@@ -77,15 +82,28 @@ function recordGateError(
   try {
     audit.recordError();
     const reason = errorMessage(error);
+    const requestId = createPermissionRequestId();
+    const toolName = bestEffortToolName(event);
+    const command = bestEffortCommand(event);
     reporter.writeReviewLog("permission_request.blocked", {
-      requestId: createPermissionRequestId(),
-      toolName: bestEffortToolName(event),
-      command: bestEffortCommand(event),
+      requestId,
+      toolName,
+      command,
       resolution: "gate_error",
       error: reason,
       // The boundary decided, by failing closed -- no rule and no human did.
       decidedBy: { kind: "gate_error", reason },
     });
+    reporter.emitDecision({
+      requestId,
+      surface: toolName,
+      value: command ?? toolName,
+      result: "deny",
+      resolution: "gate_error",
+      origin: null,
+      agentName: null,
+      matchedPattern: null,
+    });
   } catch {
     // The block is the guarantee; its bookkeeping is not.
   }

package/src/index.ts

@@ -181,11 +181,19 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       ),
   };
 
+  // Constructed here rather than beside the gate runner below: the serving
+  // side broadcasts its own decisions, so both readers share one reporter over
+  // this session's event bus.
+  const reporter = new GateDecisionReporter(logger, pi.events);
+
   const requestServer = new ForwardedRequestServer({
     forwardingDir: paths.forwardingDir,
     logger,
     policy: servingPolicy,
     escalator: authorizerSelection,
+    // The forwarded ask's own gate lives in the requesting session, so the
+    // serving side announces the terminal decision on this session's bus.
+    broadcaster: reporter,
     // Records a whole-session grant into the same SessionRules the resolver and
     // gate runner read, so a serving-scope grant governs the parent and future
     // forwarded resolutions.
@@ -275,7 +283,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     },
   );
 
-  const reporter = new GateDecisionReporter(logger, pi.events);
   const gateRunner = new GateRunner(
     resolver,
     sessionRules,

package/src/path/approval-pattern.ts

@@ -0,0 +1,27 @@
+import type { PathFlavor } from "#src/path/path-flavor";
+
+/**
+ * Derive the wildcard glob to record when a user approves an accessed path for
+ * the session: the path's directory scope, with `*` appended.
+ *
+ * The scope is the value up to and including its last path separator, so the
+ * pattern is spelled with the separator the value itself carries. That matters
+ * on a win32 host, where Git Bash tokens are POSIX-shaped while Node's own
+ * `sep` is a backslash: deriving `/tmp/logs\*` from `/tmp/logs/` widens the
+ * grant to the parent directory once the `windowsSeparators` fold (#653)
+ * normalizes both operands. A value carrying no separator falls back to the
+ * current directory, which is what callers see only if they skipped resolving
+ * the path to its absolute form first (#438).
+ *
+ * The platform's separator alphabet arrives as an injected {@link PathFlavor},
+ * never an ambient `node:path` read, so win32 derivation is decidable — and
+ * testable — on a POSIX host (#655).
+ */
+export function deriveApprovalPattern(
+  pathValue: string,
+  flavor: PathFlavor,
+): string {
+  const lastSeparator = flavor.lastSeparatorIndex(pathValue);
+  if (lastSeparator < 0) return `.${flavor.impl.sep}*`;
+  return `${pathValue.slice(0, lastSeparator + 1)}*`;
+}

package/src/path/path-flavor.ts

@@ -17,7 +17,8 @@ import type { WildcardMatchOptions } from "#src/wildcard-matcher";
  * fold or separator fold is a silent bypass (the #382 / #508 class). `PathFlavor`
  * captures that mapping once so the leaves consume the resolved capability
  * instead of re-interpreting a raw `NodeJS.Platform` string. It owns platform
- * **semantics** — syntax ({@link hasPathSeparator}), token shape
+ * **semantics** — syntax ({@link hasPathSeparator} /
+ * {@link lastSeparatorIndex}), token shape
  * ({@link bashTokenShape}), and the equivalence relation ({@link fold} /
  * {@link comparable} / {@link isWithin} / {@link matchOptions}); domain policy
  * (lexical cleanup, alias generation, safe-system-path exclusions, rule
@@ -50,6 +51,15 @@ export interface PathFlavor {
    * POSIX; `/` or `\` on win32 (where a backslash is a separator, #520).
    */
   hasPathSeparator(token: string): boolean;
+  /**
+   * Index of the last path separator in `value`, or `-1` when it holds none.
+   *
+   * Reads the same separator alphabet as {@link hasPathSeparator}, so a caller
+   * that must split a path at its directory boundary uses the separator the
+   * value was written with rather than this platform's default `sep` — the two
+   * differ for a Git Bash token on a win32 host (`/dev/null`, `/tmp/logs/`).
+   */
+  lastSeparatorIndex(value: string): number;
   /**
    * The MSYS/Git-Bash interpretation of a bash-command token. On win32 this
    * carries device / drive-mount / posix-absolute / plain semantics; on POSIX
@@ -60,6 +70,8 @@ export interface PathFlavor {
 
 class PlatformPathFlavor implements PathFlavor {
   readonly matchOptions: WildcardMatchOptions | undefined;
+  /** Every separator spelling this platform recognizes, the one alphabet both separator answers read. */
+  private readonly separators: readonly string[];
 
   constructor(
     readonly impl: PlatformPath,
@@ -68,6 +80,7 @@ class PlatformPathFlavor implements PathFlavor {
     this.matchOptions = windows
       ? { caseInsensitive: true, windowsSeparators: true }
       : undefined;
+    this.separators = windows ? ["/", "\\"] : ["/"];
   }
 
   fold(value: string): string {
@@ -91,7 +104,14 @@ class PlatformPathFlavor implements PathFlavor {
   }
 
   hasPathSeparator(token: string): boolean {
-    return token.includes("/") || (this.windows && token.includes("\\"));
+    return this.lastSeparatorIndex(token) >= 0;
+  }
+
+  lastSeparatorIndex(value: string): number {
+    return this.separators.reduce(
+      (last, separator) => Math.max(last, value.lastIndexOf(separator)),
+      -1,
+    );
   }
 
   bashTokenShape(token: string): BashTokenShape {

package/src/path-normalizer.ts

@@ -8,6 +8,7 @@ import {
   normalizePathForComparison,
   normalizePathPolicyLiteral,
 } from "./access-intent/path-normalization";
+import { deriveApprovalPattern } from "./path/approval-pattern";
 import { isPathOutsideWorkingDirectory } from "./path/path-containment";
 import { isPiInfrastructureRead } from "./path/pi-infrastructure-read";
 
@@ -99,6 +100,20 @@ export class PathNormalizer {
     }
   }
 
+  /**
+   * The session-approval glob for an accessed path: its directory scope plus
+   * `*`, derived through the baked flavor.
+   *
+   * Takes the already-built {@link AccessPath} — the lexical form is what a
+   * later tool call is matched on, so the pattern must be derived from the
+   * same representation the decision displayed (#438). Deriving it here rather
+   * than at each gate keeps the platform's separator alphabet with the object
+   * that owns the flavor, instead of an ambient `node:path` read (#655).
+   */
+  approvalPatternFor(accessPath: AccessPath): string {
+    return deriveApprovalPattern(accessPath.value(), this.flavor);
+  }
+
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
   isAbsolute(pathValue: string): boolean {
     return this.flavor.impl.isAbsolute(pathValue);

package/src/pattern-suggest.ts

@@ -1,6 +1,5 @@
 import { PATH_BEARING_TOOLS } from "./access-intent/path-surfaces";
 import { prefix, stripBashCommentLines } from "./bash-arity";
-import { deriveApprovalPattern } from "./session-rules";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {
@@ -115,14 +114,16 @@ function buildLabel(pattern: string, surface: string): string {
 }
 
 /**
- * Suggest a session-approval pattern for the given permission surface and value.
+ * Suggest a session-approval pattern from a surface's own value vocabulary —
+ * a bash command, an MCP target, a skill name.
  *
  * Returns a `SessionApprovalSuggestion` with the surface, the wildcard pattern
- * to store in `SessionRules`, and a human-readable dialog label.
+ * to store in `SessionRules`, and a human-readable dialog label. Any surface
+ * with no vocabulary of its own falls back to the catch-all wildcard, which is
+ * also what a path-bearing tool invoked without a path resolves to.
  *
- * `value` is expected to be the canonical (cwd-resolved, absolute) path for
- * path surfaces — callers resolve it before suggesting, so the derived pattern
- * matches the policy values a later tool call produces.
+ * A path surface goes through {@link suggestPathSessionPattern} instead: its
+ * pattern is a path-language product, and this module holds no path semantics.
  */
 export function suggestSessionPattern(
   surface: string,
@@ -140,22 +141,30 @@ export function suggestSessionPattern(
     case "skill":
       pattern = value;
       break;
-    case "external_directory":
-      pattern = deriveApprovalPattern(value);
-      break;
-    case "path":
-      pattern = deriveApprovalPattern(value);
-      break;
     default:
-      // Path-bearing tools: derive a directory-scoped pattern from the path.
-      if (PATH_BEARING_TOOLS.has(surface) && value !== "*") {
-        pattern = deriveApprovalPattern(value);
-        break;
-      }
-      // Extension tools / fallback.
+      // Extension tools, and path-bearing tools invoked without a path.
       pattern = "*";
       break;
   }
 
   return { surface, pattern, label: buildLabel(pattern, surface) };
 }
+
+/**
+ * Build the suggestion for a path surface from a pattern the caller already
+ * derived through its `PathNormalizer` (#655).
+ *
+ * The derivation belongs to the normalizer, which owns the session's
+ * `PathFlavor`; this module labels the result and must not re-interpret the
+ * separators it is handed.
+ */
+export function suggestPathSessionPattern(
+  surface: string,
+  approvalPattern: string,
+): SessionApprovalSuggestion {
+  return {
+    surface,
+    pattern: approvalPattern,
+    label: buildLabel(approvalPattern, surface),
+  };
+}

package/src/permission-events.ts

@@ -110,7 +110,9 @@ export type PermissionDecisionResolution =
   | "user_approved_for_session"
   | "user_denied"
   | "auto_approved"
-  | "confirmation_unavailable";
+  | "confirmation_unavailable"
+  /** The gate threw, or an escalation failed, and the request was blocked. */
+  | "gate_error";
 
 /** Payload emitted on `permissions:decision`. */
 export interface PermissionDecisionEvent {
@@ -134,6 +136,16 @@ export interface PermissionDecisionEvent {
   agentName: string | null;
   /** Matched pattern from the winning rule (when available). */
   matchedPattern: string | null;
+  /**
+   * Forwarding context for a decision this session made while serving another
+   * session's forwarded request; absent on an ordinary local decision.
+   *
+   * The same `ForwardedPromptContext` the request's `permissions:ui_prompt`
+   * carried, so a consumer that never saw the prompt can still tell a served
+   * ask from a local one. Requester identity beyond it — the requester's cwd
+   * and principal — stays off the bus.
+   */
+  forwarding?: ForwardedPromptContext | null;
 }
 
 // ── Emit helpers ───────────────────────────────────────────────────────────

package/src/session-rules.ts

@@ -1,5 +1,3 @@
-import { dirname, sep } from "node:path";
-
 import type { Ruleset } from "./rule";
 import type { SessionApproval } from "./session-approval";
 import type { SessionApprovalRecorder } from "./session-approval-recorder";
@@ -48,32 +46,3 @@ export class SessionRules implements SessionApprovalRecorder {
     this.rules = [];
   }
 }
-
-/**
- * Derive the wildcard glob pattern to approve from a normalized path.
- *
- * Returns `<parent-dir>/*` so that `evaluate()` / `wildcardMatch()` matches
- * all paths under the approved directory — identical semantics to the former
- * `SessionApprovalCache` prefix matching, using the unified wildcard engine.
- *
- * For paths that already end with a separator (directories), the separator
- * is treated as the directory boundary and `*` is appended directly.
- *
- * The path is expected to be the canonical (cwd-resolved, absolute) form used
- * for policy matching, so the derived pattern matches the same policy values a
- * later tool call produces. Callers that hold a working directory resolve the
- * path to that form first; the function itself stays free of cwd state.
- */
-export function deriveApprovalPattern(normalizedPath: string): string {
-  // If the path already ends with a separator, it's a directory — glob its contents.
-  if (normalizedPath.endsWith(sep)) {
-    return `${normalizedPath}*`;
-  }
-  const dir = dirname(normalizedPath);
-  if (dir === normalizedPath) {
-    // Root path — dirname('/') === '/'
-    return `${dir}*`;
-  }
-  const prefix = dir.endsWith(sep) ? dir : `${dir}${sep}`;
-  return `${prefix}*`;
-}