@gotgenes/pi-permission-system 31.0.2 → 31.1.1

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [31.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v31.1.0...pi-permission-system-v31.1.1) (2026-09-05)
+
+
+### Documentation
+
+* **pi-permission-system:** record the directory vocabulary and mark Phase 14 Step 13 ([72a3c0d](https://github.com/gotgenes/pi-packages/commit/72a3c0d83eed5489874d93404f4277797e193649)), closes [#837](https://github.com/gotgenes/pi-packages/issues/837)
+
+## [31.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v31.0.2...pi-permission-system-v31.1.0) (2026-09-04)
+
+
+### Features
+
+* **pi-permission-system:** record every change to the effective tool surface in the debug log ([bf0331a](https://github.com/gotgenes/pi-packages/commit/bf0331a26ace5dcee7f6a26064af1251fecaaa41))
+
+### Bug Fixes
+
+* **pi-permission-system:** restore a tool when its deny rule is relaxed mid-session ([190a25e](https://github.com/gotgenes/pi-packages/commit/190a25eccdcd5101badf6266f10142c809296983))
+* **pi-permission-system:** forget a withheld tool that pi has unregistered ([404d819](https://github.com/gotgenes/pi-packages/commit/404d8194f9763ee8a228bd36176c5adbb944464c)), closes [#873](https://github.com/gotgenes/pi-packages/issues/873)
+
+### Documentation
+
+* **pi-permission-system:** document the tool-surface baseline ([0997065](https://github.com/gotgenes/pi-packages/commit/09970655c60bfe14c5a38b986301c480ed19f316))
+
 ## [31.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v31.0.1...pi-permission-system-v31.0.2) (2026-09-04)
 
 

package/dist/public.d.ts

@@ -1,20 +1,5 @@
 import { z } from 'zod';
 
-/**
- * One session-approval grant: a wildcard pattern approved on one surface.
- *
- * A gate proves a direction per accessed path (ADR 0013 §7), so an ask whose
- * paths disagree records a surface per pattern rather than one for all of them
- * (#810). This lives in its own module because both the {@link SessionApproval}
- * value object and the forwarded wire type name it, and those two already
- * import in one direction.
- */
-
-interface ApprovalGrant {
-    readonly surface: string;
-    readonly pattern: string;
-}
-
 declare const permissionStateSchema: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
 /** A permission decision. */
 type PermissionState = z.infer<typeof permissionStateSchema>;
@@ -329,6 +314,21 @@ interface PermissionDecisionEvent {
     forwarding?: ForwardedPromptContext | null;
 }
 
+/**
+ * One session-approval grant: a wildcard pattern approved on one surface.
+ *
+ * A gate proves a direction per accessed path (ADR 0013 §7), so an ask whose
+ * paths disagree records a surface per pattern rather than one for all of them
+ * (#810). This lives in its own module because both the {@link SessionApproval}
+ * value object and the forwarded wire type name it, and those two already
+ * import in one direction.
+ */
+
+interface ApprovalGrant {
+    readonly surface: string;
+    readonly pattern: string;
+}
+
 /**
  * The child's session-approval suggestion, relayed to the serving node so a
  * human who grants "the whole session" records the same grants the child would

package/docs/configuration.md

@@ -1165,9 +1165,13 @@ Additional behaviors:
 
 - Unknown/unregistered tools are blocked before permission checks (prevents bypass attempts)
 - Tool filtering is restrict-only: the active set starts from pi's already-active tools (`pi.getActiveTools()`) and only ever has denied tools removed — the permission system never activates a tool pi left off by default (e.g. `find`, `grep`, `ls`)
+- Policy is applied to the tool surface pi has activated over the session, not to the previous turn's filtered result, so removing a `deny` rule restores the tool it had hidden without restarting pi.
+  A tool that stops being active for any other reason (another extension deactivating it, pi unregistering it) is not restored.
+- On the turn a tool is restored, it is callable immediately but its `Available tools:` line reappears one turn later: pi builds the prompt an extension receives before the extension runs, so the line is only regenerated once the restored tool is already active
 - A tool is removed only when every value under its surface resolves to `deny`; a surface with any reachable `allow` or `ask` pattern stays available (see [Tool Surfaces](#tool-surfaces))
 - The `Available tools:` system prompt section is narrowed to match the filtered active tool set: denied tools' lines are dropped, the rest are kept, and the section is removed entirely only when no tool is allowed
-- The narrowed prompt is recomputed and returned on every turn but is byte-stable for a stable policy/agent, so the provider's prompt cache (tools + system prefix) is preserved rather than rewritten each turn
+- The narrowed prompt is recomputed and returned on every turn but is byte-stable for a stable policy/agent, so the provider's prompt cache (tools + system prefix) is preserved rather than rewritten each turn.
+  A policy change is an intentional cache transition, as a mid-session agent switch already is.
 - Extension-provided tools like `task`, `mcp`, and third-party tools are handled by exact registered name
 - Generic extension-tool approval prompts include a bounded input preview; built-in file tools use concise human-readable summaries
 - Permission review logs include `toolInputPreview` values for non-bash/non-MCP tool calls, with sensitive-keyed values masked and every value bounded by `reviewLogFieldMaxWidth` (see [Log file sensitivity](#log-file-sensitivity))
@@ -1230,4 +1234,4 @@ npx --yes ajv-cli@5 validate \
 
 The well-known surface keys — `*`, `path`, `external_directory`, `bash`, `mcp`, `skill`, and the four directional keys — are named properties in the schema, so an editor completes them and shows each key's own documentation on hover; any other registered tool name still validates as a surface.
 
-The schema is generated from the extension's zod source of truth (`src/config-schema.ts`); regenerate it with `pnpm run gen:schema` after changing the config shape.
+The schema is generated from the extension's zod source of truth (`src/config/config-schema.ts`); regenerate it with `pnpm run gen:schema` after changing the config shape.

package/docs/cross-extension-api.md

@@ -280,7 +280,7 @@ Re-register on every initialization (as above) rather than once globally; the di
 
 A built-in formatter is registered for the `"mcp"` tool at startup (through this same public API).
 It renders a compact `with key: value, …` summary of the call's `arguments` and returns `undefined` when there are no arguments, leaving the MCP target prompt unchanged.
-This is the reference implementation for the seam — see `src/builtin-tool-input-formatters.ts`.
+This is the reference implementation for the seam — see `src/tool-input/builtin-tool-input-formatters.ts`.
 
 #### `registerToolAccessExtractor`
 

package/docs/session-approvals.md

@@ -62,7 +62,7 @@ The suggested pattern is surface-specific:
 
 ## Bash Arity Table
 
-Bash pattern suggestions use a curated arity dictionary (`src/bash-arity.ts`) to determine how many tokens define the "human-understandable subcommand."
+Bash pattern suggestions use a curated arity dictionary (`src/access-intent/bash/bash-arity.ts`) to determine how many tokens define the "human-understandable subcommand."
 Longest matching prefix wins, so `npm run` (arity 3) takes precedence over `npm` (arity 2).
 Unknown commands default to arity 1 (first word only).
 
@@ -76,7 +76,7 @@ Unknown commands default to arity 1 (first word only).
 | `mytool --verbose`    | (unknown) → 1        | `mytool *`            |
 
 The arity table covers common CLI tools including git, npm/pnpm/yarn/bun, docker, cargo, go, kubectl, gh, and others.
-To add an entry, open `src/bash-arity.ts` and add a key/arity pair to the `ARITY` object.
+To add an entry, open `src/access-intent/bash/bash-arity.ts` and add a key/arity pair to the `ARITY` object.
 Put the most specific multi-word prefix first (e.g. `"npm run": 3`) before the shorter fallback (`"npm": 2`).
 
 ## Review Log Entries

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "31.0.2",
+  "version": "31.1.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/access-intent.ts

@@ -1,4 +1,4 @@
-import type { AccessPath } from "#src/access-intent/access-path";
+import type { AccessPath } from "./access-path";
 
 /**
  * Raw tool input the manager must normalize (path / bash / MCP / extension tools).

package/src/access-intent/bash/bash-path-resolver.ts

@@ -1,29 +1,26 @@
 import type { AccessPath } from "#src/access-intent/access-path";
 import {
-  ARG_NODE_TYPES,
-  SKIP_SUBTREE_TYPES,
-} from "#src/access-intent/bash/node-text";
-import type { TSNode } from "#src/access-intent/bash/parser";
+  mergeTokenEffects,
+  type TokenEffect,
+  UNPROVEN_EFFECT,
+} from "#src/access-intent/effect";
+import { normalizePathPolicyLiteral } from "#src/access-intent/path-normalization";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import { isSafeSystemPath } from "#src/path/safe-system-paths";
+import { ARG_NODE_TYPES, SKIP_SUBTREE_TYPES } from "./node-text";
+import type { TSNode } from "./parser";
 import {
   classifyBareTokenCandidate,
   classifyTokenAsPathCandidate,
   classifyTokenAsRuleCandidate,
-} from "#src/access-intent/bash/token-classification";
+} from "./token-classification";
 import {
   collectCommandTokens,
   collectPathCandidateTokens,
   collectRedirectTokens,
   extractCommandName,
   type PathToken,
-} from "#src/access-intent/bash/token-collection";
-import {
-  mergeTokenEffects,
-  type TokenEffect,
-  UNPROVEN_EFFECT,
-} from "#src/access-intent/effect";
-import { normalizePathPolicyLiteral } from "#src/access-intent/path-normalization";
-import type { PathNormalizer } from "#src/path-normalizer";
-import { isSafeSystemPath } from "#src/safe-system-paths";
+} from "./token-collection";
 
 // ── Internal types ───────────────────────────────────────────────────────────
 

package/src/access-intent/bash/command-enumeration.ts

@@ -1,22 +1,16 @@
-import {
-  EXECUTION_HOST_TYPES,
-  forEachExecutionIn,
-} from "#src/access-intent/bash/nested-execution";
-import {
-  parseUnresolvedWithin,
-  type TSNode,
-} from "#src/access-intent/bash/parser";
-import { redirectMayWriteFile } from "#src/access-intent/bash/redirect-analysis";
+import type { BashCommandContext, FloorExemption } from "#src/types";
+import { EXECUTION_HOST_TYPES, forEachExecutionIn } from "./nested-execution";
+import { parseUnresolvedWithin, type TSNode } from "./parser";
+import { redirectMayWriteFile } from "./redirect-analysis";
 import {
   type CommandWord,
   classifyWrapperWords,
   executedUnitOf,
   isTransparentWrapper,
   type WrapperKind,
-} from "#src/access-intent/bash/wrapper-analysis";
-import type { BashCommandContext, FloorExemption } from "#src/types";
+} from "./wrapper-analysis";
 
-export type { WrapperKind } from "#src/access-intent/bash/wrapper-analysis";
+export type { WrapperKind } from "./wrapper-analysis";
 
 // ── Command type ─────────────────────────────────────────────────────────────
 

package/src/access-intent/bash/msys-bash-tokens.ts

@@ -7,7 +7,7 @@
  * module so the shape knowledge is unit-testable in isolation (no filesystem,
  * no platform read).
  */
-import { isSafeSystemPath } from "#src/safe-system-paths";
+import { isSafeSystemPath } from "#src/path/safe-system-paths";
 
 /**
  * The MSYS interpretation of a win32 bash token:

package/src/access-intent/bash/nested-execution.ts

@@ -1,5 +1,5 @@
-import type { TSNode } from "#src/access-intent/bash/parser";
 import type { BashCommandContext } from "#src/types";
+import type { TSNode } from "./parser";
 
 /**
  * AST node types whose interior commands really execute when the shell runs the

package/src/access-intent/bash/node-text.ts

@@ -1,5 +1,5 @@
-import type { TSNode } from "#src/access-intent/bash/parser";
-import { resolvePlainVariableExpansion } from "#src/access-intent/bash/shell-variable-expansion";
+import type { TSNode } from "./parser";
+import { resolvePlainVariableExpansion } from "./shell-variable-expansion";
 
 /**
  * Node types whose text content is never a command argument, so no path

package/src/access-intent/bash/parser.ts

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { memoizeAsyncWithRetry } from "#src/async-cache";
+import { memoizeAsyncWithRetry } from "./async-cache";
 
 /**
  * Minimal subset of web-tree-sitter's SyntaxNode used by the AST walker.

package/src/access-intent/bash/program.ts

@@ -1,14 +1,11 @@
+import type { PathNormalizer } from "#src/path/path-normalizer";
 import {
   type BashExternalPath,
   BashPathResolver,
   type BashPathRuleCandidate,
-} from "#src/access-intent/bash/bash-path-resolver";
-import {
-  type BashCommand,
-  collectCommands,
-} from "#src/access-intent/bash/command-enumeration";
-import { getParser } from "#src/access-intent/bash/parser";
-import type { PathNormalizer } from "#src/path-normalizer";
+} from "./bash-path-resolver";
+import { type BashCommand, collectCommands } from "./command-enumeration";
+import { getParser } from "./parser";
 
 export type { BashCommand, BashExternalPath, BashPathRuleCandidate };
 

package/src/access-intent/bash/redirect-analysis.ts

@@ -1,6 +1,6 @@
-import { redirectDestinationEffect } from "#src/access-intent/bash/command-effects";
-import { parseUnresolvedAt, type TSNode } from "#src/access-intent/bash/parser";
 import { type TokenEffect, UNPROVEN_EFFECT } from "#src/access-intent/effect";
+import { redirectDestinationEffect } from "./command-effects";
+import { parseUnresolvedAt, type TSNode } from "./parser";
 
 /**
  * What a redirect node in the parse tree proves.

package/src/access-intent/bash/shell-variable-expansion.ts

@@ -18,7 +18,7 @@
  */
 import { homedir } from "node:os";
 
-import type { TSNode } from "#src/access-intent/bash/parser";
+import type { TSNode } from "./parser";
 
 /**
  * The value of a plain `$NAME` / `${NAME}` reference, or `null` when the node

package/src/access-intent/bash/sync-commands.ts

@@ -1,8 +1,5 @@
-import {
-  type BashCommand,
-  collectCommands,
-} from "#src/access-intent/bash/command-enumeration";
-import { getWarmBashParser } from "#src/access-intent/bash/parser";
+import { type BashCommand, collectCommands } from "./command-enumeration";
+import { getWarmBashParser } from "./parser";
 
 /**
  * Synchronously enumerate the command-pattern units of a bash command using the

package/src/access-intent/bash/token-collection.ts

@@ -1,17 +1,14 @@
 import { basename } from "node:path";
-import { proveCommandEffect } from "#src/access-intent/bash/command-effects";
-import {
-  EXECUTION_HOST_TYPES,
-  forEachExecutionIn,
-} from "#src/access-intent/bash/nested-execution";
+import { type TokenEffect, UNPROVEN_EFFECT } from "#src/access-intent/effect";
+import { proveCommandEffect } from "./command-effects";
+import { EXECUTION_HOST_TYPES, forEachExecutionIn } from "./nested-execution";
 import {
   ARG_NODE_TYPES,
   resolveNodeText,
   SKIP_SUBTREE_TYPES,
-} from "#src/access-intent/bash/node-text";
-import type { TSNode } from "#src/access-intent/bash/parser";
-import { redirectEffectForDestination } from "#src/access-intent/bash/redirect-analysis";
-import { type TokenEffect, UNPROVEN_EFFECT } from "#src/access-intent/effect";
+} from "./node-text";
+import type { TSNode } from "./parser";
+import { redirectEffectForDestination } from "./redirect-analysis";
 
 /**
  * A collected path-candidate token paired with the effect its position proved.

package/src/access-intent/bash/wrapper-analysis.ts

@@ -9,7 +9,7 @@
  * classifiers over the same vocabulary would drift.
  */
 
-import { proveCommandEffect } from "#src/access-intent/bash/command-effects";
+import { proveCommandEffect } from "./command-effects";
 
 /** One word of a command unit: its text, and its offset into the unit's text. */
 export interface CommandWord {

package/src/access-intent/input-normalizer.ts

@@ -1,5 +1,5 @@
-import { stripBashCommentLines } from "#src/bash-arity";
-import type { PathNormalizer } from "#src/path-normalizer";
+import { stripBashCommentLines } from "#src/access-intent/bash/bash-arity";
+import type { PathNormalizer } from "#src/path/path-normalizer";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
 import type { AccessIntent, ResolvedAccessIntent } from "./access-intent";
 import { createMcpPermissionTargets } from "./mcp-targets";

package/src/access-intent/path-normalization.ts

@@ -1,5 +1,5 @@
-import { expandHomePath } from "#src/expand-home";
 import { canonicalizePath } from "#src/path/canonicalize-path";
+import { expandHomePath } from "#src/path/expand-home";
 import type { PathFlavor } from "#src/path/path-flavor";
 
 /**

package/src/access-intent/path-surfaces.ts

@@ -1,4 +1,4 @@
-import type { AttributedEffect } from "#src/access-intent/effect";
+import type { AttributedEffect } from "./effect";
 
 /**
  * File tools that only read — never write — the filesystem.

package/src/access-intent/tool-input-path.ts

@@ -1,4 +1,4 @@
-import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
+import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { classifyToolKind } from "./tool-kind";
 

package/src/access-intent/tool-kind.ts

@@ -1,4 +1,4 @@
-import type { ShellToolsConfig } from "#src/config-schema";
+import type { ShellToolsConfig } from "#src/config/config-schema";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { PATH_BEARING_TOOLS } from "./path-surfaces";
 

package/src/authority/approval-escalator.ts

@@ -1,14 +1,20 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
+import { createPermissionRequestId } from "#src/permission-request-id";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { buildUiPrompt } from "#src/service/permission-ui-prompt";
 import {
   getActiveAgentName,
   getActiveAgentNameFromSystemPrompt,
-} from "#src/active-agent";
+} from "#src/session/active-agent";
+import { toRecord } from "#src/value-guards";
+import type { TerminalAuthorizer } from "./authorizer";
 import {
   type ForwarderContext,
   getCwd,
   getSessionId,
-} from "#src/authority/forwarder-context";
+} from "./forwarder-context";
 import {
   cleanupPermissionForwardingLocationIfEmpty,
   ensurePermissionForwardingLocation,
@@ -18,9 +24,9 @@ import {
   safeDeleteFile,
   sleep,
   writeJsonFileAtomic,
-} from "#src/authority/forwarding-io";
-import type { TargetServingLookup } from "#src/authority/forwarding-liveness";
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
+} from "./forwarding-io";
+import type { TargetServingLookup } from "./forwarding-liveness";
+import type { PermissionPromptDecision } from "./permission-dialog";
 import {
   type ForwardedAccessFacts,
   type ForwardedPermissionRequest,
@@ -33,15 +39,9 @@ import {
   type PermissionForwardingTarget,
   resolvePermissionForwardingTarget,
   SUBAGENT_PARENT_SESSION_ENV_CANDIDATES,
-} from "#src/authority/permission-forwarding";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
-import { createPermissionRequestId } from "#src/permission-request-id";
-import { buildUiPrompt } from "#src/permission-ui-prompt";
-import type { PromptPayload } from "#src/presentation/prompt-payload";
-import type { DebugReviewLogger } from "#src/session-logger";
-import { toRecord } from "#src/value-guards";
-import type { TerminalAuthorizer } from "./authorizer";
+} from "./permission-forwarding";
 import type { PromptPermissionDetails } from "./permission-prompter";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 // ── Module-private helpers ────────────────────────────────────────────────
 

package/src/authority/authorizer-chain.ts

@@ -1,10 +1,10 @@
-import type { DecisionSource } from "#src/authority/decision-source";
 import type { AuthorizerLog, PermissionQuery } from "#src/service";
 import type {
   AuthorizerVerdict,
   NamedAuthorizer,
   TerminalAuthorizer,
 } from "./authorizer";
+import type { DecisionSource } from "./decision-source";
 import {
   createDeniedPermissionDecision,
   type PermissionPromptDecision,

package/src/authority/authorizer-registry.ts

@@ -17,7 +17,7 @@
  * the registration (ADR 0012 decision 4).
  */
 
-import type { ReviewLogger } from "#src/session-logger";
+import type { ReviewLogger } from "#src/logging/session-logger";
 import type { Authorizer } from "./authorizer";
 import type { AdjudicationRole } from "./authorizer-selection";
 

package/src/authority/authorizer-selection.ts

@@ -1,5 +1,4 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type { PermissionQuery } from "#src/service";
 import {
   type AuthorizerSelectionDeps,
@@ -10,6 +9,7 @@ import {
 import { composeAuthorizerChain } from "./authorizer-chain";
 import type { AuthorizerLookup } from "./authorizer-registry";
 import { encloseInDelegationEnvelope } from "./delegation-envelope";
+import type { PermissionPromptDecision } from "./permission-dialog";
 import type {
   PermissionPrompterApi,
   PromptPermissionDetails,

package/src/authority/authorizer.ts

@@ -1,19 +1,19 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { TargetServingLookup } from "#src/authority/forwarding-liveness";
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type {
-  PromptPreferences,
-  requestPermissionDecision,
-} from "#src/authority/permission-prompt-component";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
-import type { PermissionEventBus } from "#src/permission-events";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import type { AuthorizerLog, PermissionQuery } from "#src/service";
-import type { DebugReviewLogger } from "#src/session-logger";
+import type { PermissionEventBus } from "#src/service/permission-events";
 import { ParentAuthorizer } from "./approval-escalator";
 import { DenyingAuthorizer } from "./denying-authorizer";
+import type { TargetServingLookup } from "./forwarding-liveness";
 import { LocalUserAuthorizer } from "./local-user-authorizer";
+import type { PermissionPromptDecision } from "./permission-dialog";
+import type {
+  PromptPreferences,
+  requestPermissionDecision,
+} from "./permission-prompt-component";
 import type { PromptPermissionDetails } from "./permission-prompter";
 import type { SubagentDetector } from "./subagent-detection";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * A non-terminal chain link's ruling on an `ask`: decide (`allow`/`deny`) or

package/src/authority/decision-resolution.ts

@@ -1,8 +1,5 @@
-import {
-  type DecisionSource,
-  effectiveDecider,
-} from "#src/authority/decision-source";
-import type { PermissionDecisionResolution } from "#src/permission-events";
+import type { PermissionDecisionResolution } from "#src/service/permission-events";
+import { type DecisionSource, effectiveDecider } from "./decision-source";
 
 /** What became of the request, as the gate that ran it observed. */
 export interface DecisionOutcome {

package/src/authority/denying-authorizer.ts

@@ -1,5 +1,5 @@
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import type { TerminalAuthorizer } from "./authorizer";
+import type { PermissionPromptDecision } from "./permission-dialog";
 
 /** Why this authorizer denies; the provenance record's `reason` (#726). */
 const NO_AUTHORITY_REASON = "No live authority was reachable for this session";

package/src/authority/forwarded-request-server.ts

@@ -1,31 +1,15 @@
 import { join } from "node:path";
-import { resolutionFor } from "#src/authority/decision-resolution";
-import type { DecisionSource } from "#src/authority/decision-source";
-import {
-  type ForwarderContext,
-  getSessionId,
-} from "#src/authority/forwarder-context";
-import {
-  createDeniedPermissionDecision,
-  type PermissionPromptDecision,
-} from "#src/authority/permission-dialog";
-import {
-  type ForwardedAccessFacts,
-  type ForwardedAccessIntent,
-  type ForwardedPermissionRequest,
-  type ForwardedPermissionResponse,
-  isForwardedPermissionRequestForSession,
-  type PermissionForwardingLocation,
-} from "#src/authority/permission-forwarding";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
-import type { DecisionBroadcaster } from "#src/decision-reporter";
-import type { PermissionDecisionEvent } from "#src/permission-events";
+import type { DecisionBroadcaster } from "#src/logging/decision-reporter";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import { buildForwardedAskPayload } from "#src/presentation/forwarded-ask-payload";
-import { SessionApproval } from "#src/session-approval";
-import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
-import type { DebugReviewLogger } from "#src/session-logger";
+import type { PermissionDecisionEvent } from "#src/service/permission-events";
+import { SessionApproval } from "#src/session/session-approval";
+import type { SessionApprovalRecorder } from "#src/session/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
 import type { AskEscalator } from "./authorizer-selection";
+import { resolutionFor } from "./decision-resolution";
+import type { DecisionSource } from "./decision-source";
+import { type ForwarderContext, getSessionId } from "./forwarder-context";
 import {
   cleanupPermissionForwardingLocationIfEmpty,
   ensureDirectoryExists,
@@ -38,7 +22,20 @@ import {
   safeDeleteFile,
   writeJsonFileAtomic,
 } from "./forwarding-io";
+import {
+  createDeniedPermissionDecision,
+  type PermissionPromptDecision,
+} from "./permission-dialog";
+import {
+  type ForwardedAccessFacts,
+  type ForwardedAccessIntent,
+  type ForwardedPermissionRequest,
+  type ForwardedPermissionResponse,
+  isForwardedPermissionRequestForSession,
+  type PermissionForwardingLocation,
+} from "./permission-forwarding";
 import type { PromptPermissionDetails } from "./permission-prompter";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * Narrow seam describing what `ForwardingManager` needs from the server: a

package/src/authority/forwarder-context.ts

@@ -1,5 +1,5 @@
-import type { SessionEntryView } from "#src/active-agent";
-import type { PermissionDecisionUi } from "#src/authority/permission-dialog";
+import type { SessionEntryView } from "#src/session/active-agent";
+import type { PermissionDecisionUi } from "./permission-dialog";
 
 /**
  * Narrow context the forwarding subsystem reads: the UI gate (`hasUI`), the

package/src/authority/forwarding-io.ts

@@ -8,10 +8,19 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-
-import { type ApprovalGrant, isSessionGrantWidth } from "#src/approval-grant";
-import { asDecisionSource } from "#src/authority/decision-source";
-import { isPermissionDecisionState } from "#src/authority/permission-dialog";
+import {
+  OWNER_ONLY_DIRECTORY_MODE,
+  OWNER_ONLY_FILE_MODE,
+} from "#src/logging/log-file-permissions";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
+import { asPromptPayload } from "#src/presentation/prompt-payload";
+import type { PermissionUiPromptSource } from "#src/service/permission-events";
+import {
+  type ApprovalGrant,
+  isSessionGrantWidth,
+} from "#src/session/approval-grant";
+import { asDecisionSource } from "./decision-source";
+import { isPermissionDecisionState } from "./permission-dialog";
 import {
   createPermissionForwardingLocation,
   type ForwardedAccessIntent,
@@ -19,14 +28,7 @@ import {
   type ForwardedPermissionResponse,
   type ForwardedSessionApproval,
   type PermissionForwardingLocation,
-} from "#src/authority/permission-forwarding";
-import {
-  OWNER_ONLY_DIRECTORY_MODE,
-  OWNER_ONLY_FILE_MODE,
-} from "#src/log-file-permissions";
-import type { PermissionUiPromptSource } from "#src/permission-events";
-import { asPromptPayload } from "#src/presentation/prompt-payload";
-import type { DebugReviewLogger } from "#src/session-logger";
+} from "./permission-forwarding";
 
 /** Valid `permissions:ui_prompt` source values, for tolerant request reads. */
 const UI_PROMPT_SOURCES = [