@gotgenes/pi-permission-system 31.0.2 → 31.1.1

package/src/authority/forwarding-liveness.ts

@@ -18,23 +18,20 @@
 
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import {
   ensureDirectoryExists,
   isErrnoCode,
   logPermissionForwardingError,
   safeDeleteFile,
   writeJsonFileAtomic,
-} from "#src/authority/forwarding-io";
-import type { PermissionForwardingTarget } from "#src/authority/permission-forwarding";
+} from "./forwarding-io";
+import type { PermissionForwardingTarget } from "./permission-forwarding";
 import {
   encodeSessionIdForPath,
   PERMISSION_FORWARDING_POLL_INTERVAL_MS,
-} from "#src/authority/permission-forwarding";
-import type {
-  ServingAnnouncer,
-  ServingLookup,
-} from "#src/authority/serving-registry";
-import type { DebugReviewLogger } from "#src/session-logger";
+} from "./permission-forwarding";
+import type { ServingAnnouncer, ServingLookup } from "./serving-registry";
 
 /**
  * How often a serving session rewrites its heartbeat — four poll ticks.

package/src/authority/forwarding-manager.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { DebugReviewLogger } from "#src/session-logger";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import type { InboxProcessor } from "./forwarded-request-server";
 import { getSessionId } from "./forwarder-context";
 import { PERMISSION_FORWARDING_POLL_INTERVAL_MS } from "./permission-forwarding";

package/src/authority/inherited-registrations.ts

@@ -36,11 +36,11 @@ import type { PermissionsService } from "#src/service";
 import type {
   ResolvedToolAccessExtractor,
   ToolAccessExtractorLookup,
-} from "#src/tool-access-extractor-registry";
+} from "#src/tool-input/tool-access-extractor-registry";
 import type {
   ToolInputFormatter,
   ToolInputFormatterLookup,
-} from "#src/tool-input-formatter-registry";
+} from "#src/tool-input/tool-input-formatter-registry";
 
 /** This node's own session id, or `null` when the host exposes none. */
 export interface NodeIdentity {

package/src/authority/local-user-authorizer.ts

@@ -1,25 +1,25 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { provenDirectionOf } from "#src/approval-grant";
-import type {
-  PermissionPromptDecision,
-  RequestPermissionOptions,
-} from "#src/authority/permission-dialog";
-import type {
-  PermissionPromptUi,
-  PromptPreferences,
-  requestPermissionDecision,
-} from "#src/authority/permission-prompt-component";
 import {
   buildDirectionalSessionLabels,
   buildForwardedScopeLabels,
   describeGrantTarget,
-} from "#src/pattern-suggest";
+} from "#src/presentation/pattern-suggest";
 import {
   emitUiPromptEvent,
   type PermissionEventBus,
-} from "#src/permission-events";
-import { buildUiPrompt } from "#src/permission-ui-prompt";
+} from "#src/service/permission-events";
+import { buildUiPrompt } from "#src/service/permission-ui-prompt";
+import { provenDirectionOf } from "#src/session/approval-grant";
 import type { TerminalAuthorizer } from "./authorizer";
+import type {
+  PermissionPromptDecision,
+  RequestPermissionOptions,
+} from "./permission-dialog";
+import type {
+  PermissionPromptUi,
+  PromptPreferences,
+  requestPermissionDecision,
+} from "./permission-prompt-component";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */

package/src/authority/permission-dialog.ts

@@ -1,5 +1,5 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
+import type { DecisionSource } from "./decision-source";
 
 export type PermissionDecisionState =
   | "approved"

package/src/authority/permission-forwarding.ts

@@ -1,8 +1,11 @@
 import { join } from "node:path";
-import type { ApprovalGrant, SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
-import type { PermissionUiPromptSource } from "#src/permission-events";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import type { PermissionUiPromptSource } from "#src/service/permission-events";
+import type {
+  ApprovalGrant,
+  SessionGrantWidth,
+} from "#src/session/approval-grant";
+import type { DecisionSource } from "./decision-source";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
 

package/src/authority/permission-prompt-component.ts

@@ -4,17 +4,22 @@ import type {
   KeybindingsManager,
 } from "@earendil-works/pi-coding-agent";
 import { type Component, Input, matchesKey } from "@earendil-works/pi-tui";
-import { collapsePastedNewlines } from "#src/authority/bracketed-paste";
-import type {
-  DecisionSource,
-  UserDecisionSurface,
-} from "#src/authority/decision-source";
+import {
+  completeViewBudget,
+  type DialogView,
+  type RenderBudget,
+  renderPromptDialog,
+} from "#src/presentation/dialog-renderer";
+import { fitLinesToWidth } from "#src/presentation/line-fitting";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { collapsePastedNewlines } from "./bracketed-paste";
+import type { DecisionSource, UserDecisionSurface } from "./decision-source";
 import {
   type PermissionPromptDecision,
   type RequestPermissionOptions,
   requestPermissionDecisionFromUi,
   type UnattributedDecision,
-} from "#src/authority/permission-dialog";
+} from "./permission-dialog";
 import {
   initialPromptState,
   type PromptEvent,
@@ -23,15 +28,7 @@ import {
   type PromptViewState,
   reducePrompt,
   visibleOptionKeys,
-} from "#src/authority/permission-prompt-decision";
-import {
-  completeViewBudget,
-  type DialogView,
-  type RenderBudget,
-  renderPromptDialog,
-} from "#src/presentation/dialog-renderer";
-import { fitLinesToWidth } from "#src/presentation/line-fitting";
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+} from "./permission-prompt-decision";
 
 /**
  * Inline `ctx.ui.custom` permission dialog for TUI sessions.

package/src/authority/permission-prompt-decision.ts

@@ -1,10 +1,10 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
 import {
   createDeniedPermissionDecision,
   normalizePermissionDenialReason,
   type RequestPermissionOptions,
   type UnattributedDecision,
-} from "#src/authority/permission-dialog";
+} from "./permission-dialog";
 
 /**
  * Pure decision model for the inline keybind permission dialog.

package/src/authority/permission-prompter.ts

@@ -1,14 +1,14 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type {
-  ForwardedAccessFacts,
-  ForwardedSessionApproval,
-} from "#src/authority/permission-forwarding";
+import type { ReviewLogger } from "#src/logging/session-logger";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
 import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
-import type { ReviewLogger } from "#src/session-logger";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
 import type { TerminalAuthorizer } from "./authorizer";
+import type { DecisionSource } from "./decision-source";
+import type { PermissionPromptDecision } from "./permission-dialog";
+import type {
+  ForwardedAccessFacts,
+  ForwardedSessionApproval,
+} from "./permission-forwarding";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 

package/src/authority/subagent-context.ts

@@ -1,7 +1,7 @@
-import { SUBAGENT_ENV_HINT_KEYS } from "#src/authority/permission-forwarding";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PathFlavor } from "#src/path/path-flavor";
-import { readSessionId } from "#src/session-identity";
+import { readSessionId } from "#src/session/session-identity";
+import { SUBAGENT_ENV_HINT_KEYS } from "./permission-forwarding";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * Narrow context for subagent detection — the only session-manager readers

package/src/authority/subagent-detection.ts

@@ -1,9 +1,9 @@
+import type { PathFlavor } from "#src/path/path-flavor";
 import {
   isSubagentExecutionContext,
   type SubagentDetectionContext,
-} from "#src/authority/subagent-context";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
-import type { PathFlavor } from "#src/path/path-flavor";
+} from "./subagent-context";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * Narrow seam for the ask-path consumers: "is the current session a subagent?"

package/src/{config-loader.ts → config/config-loader.ts}

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
 import { normalize } from "node:path";
 import type { ZodError } from "zod";
+import { mergeFlatPermissions } from "#src/policy/permission-merge";
+import type { FlatPermissionConfig, PatternValue } from "#src/types";
+import { isDenyWithReason, isPermissionState } from "#src/types";
 import {
   getGlobalConfigPath,
   getLegacyExtensionConfigPath,
@@ -13,9 +16,6 @@ import {
   type UnifiedPermissionConfig,
   unifiedConfigSchema,
 } from "./config-schema";
-import { mergeFlatPermissions } from "./permission-merge";
-import type { FlatPermissionConfig, PatternValue } from "./types";
-import { isDenyWithReason, isPermissionState } from "./types";
 
 // The unified config shape is derived from the zod schema (config-schema.ts,
 // the single source of truth) and re-exported so existing importers keep their

package/src/{config-modal.ts → config/config-modal.ts}

@@ -4,13 +4,12 @@ import {
   getSettingsListTheme,
 } from "@earendil-works/pi-coding-agent";
 import { type SettingItem, SettingsList } from "@earendil-works/pi-tui";
-
+import type { Ruleset } from "#src/policy/rule";
 import type { CommandConfigStore } from "./config-store";
 import {
   DEFAULT_EXTENSION_CONFIG,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
-import type { Ruleset } from "./rule";
 
 interface PermissionSystemConfigController {
   config: CommandConfigStore;

package/src/{config-reporter.ts → config/config-reporter.ts}

@@ -1,4 +1,4 @@
-import type { ResolvedPolicyPaths } from "./permission-manager";
+import type { ResolvedPolicyPaths } from "#src/policy/permission-manager";
 
 export interface ResolvedConfigLogEntry {
   globalConfigPath: string;

package/src/{config-store.ts → config/config-store.ts}

@@ -10,7 +10,7 @@ import type {
   ExtensionCommandContext,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import { loadAndMergeConfigs, loadUnifiedConfig } from "./config-loader";
 import {
   getGlobalConfigPath,
@@ -26,7 +26,6 @@ import {
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
 import type { ResolvedPolicyPaths } from "./policy-loader";
-import type { DebugReviewLogger } from "./session-logger";
 import { syncPermissionSystemStatus } from "./status";
 
 /** Read-only view of the current config — for consumers that only read. */

package/src/{extension-config.ts → config/extension-config.ts}

@@ -1,14 +1,14 @@
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  OWNER_ONLY_DIRECTORY_MODE,
+  restrictExistingPathToOwner,
+} from "#src/logging/log-file-permissions";
 import type {
   ShellToolsConfig,
   UnifiedPermissionConfig,
 } from "./config-loader";
-import {
-  OWNER_ONLY_DIRECTORY_MODE,
-  restrictExistingPathToOwner,
-} from "./log-file-permissions";
 
 export const EXTENSION_ID = "pi-permission-system";
 

package/src/{extension-paths.ts → config/extension-paths.ts}

@@ -1,6 +1,6 @@
 import { join } from "node:path";
+import { discoverGlobalNodeModulesRoot } from "#src/path/node-modules-discovery";
 import { getGlobalLogsDir } from "./config-paths";
-import { discoverGlobalNodeModulesRoot } from "./node-modules-discovery";
 
 /**
  * Immutable path constants derived from `agentDir` at construction time.

package/src/{policy-loader.ts → config/policy-loader.ts}

@@ -1,14 +1,14 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { ScopeConfig } from "#src/types";
+import { toRecord } from "#src/value-guards";
 import {
   loadUnifiedConfig,
   normalizeFlatPermissionValue,
   stripJsonComments,
 } from "./config-loader";
 import { getGlobalConfigPath } from "./config-paths";
-import type { ScopeConfig } from "./types";
-import { toRecord } from "./value-guards";
 import { extractFrontmatter, parseSimpleYamlMap } from "./yaml-frontmatter";
 
 // ---------------------------------------------------------------------------

package/src/{skill-prompt-sanitizer.ts → exposure/skill-prompt-sanitizer.ts}

@@ -1,7 +1,7 @@
 import { dirname } from "node:path";
 
-import type { PathNormalizer } from "./path-normalizer";
-import type { PermissionCheckResult, PermissionState } from "./types";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 /**
  * Narrow interface for the raw (no-session-rules) permission checker used by

package/src/{tool-registry.ts → exposure/tool-registry.ts}

@@ -1,4 +1,4 @@
-import { getNonEmptyString, toRecord } from "./value-guards";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 
 /** Narrow interface for the Pi tool API subset used by handler classes. */
 export interface ToolRegistry {

package/src/exposure/tool-surface-baseline.ts

@@ -0,0 +1,101 @@
+/** What a turn observed about pi's tool surface. */
+export interface ToolSurfaceObservation {
+  /** Names pi reports active right now (`pi.getActiveTools()`). */
+  readonly active: readonly string[];
+  /** Names pi currently has registered (`pi.getAllTools()`). */
+  readonly registered: ReadonlySet<string>;
+}
+
+/** The effective tool surface for one turn, and what changed to produce it. */
+export interface ToolSurfaceResolution {
+  /** Names to hand to `setActive`, in baseline order. */
+  readonly exposed: readonly string[];
+  /** Baseline members the current policy withholds. */
+  readonly withheld: readonly string[];
+  /** Names withheld on an earlier turn that the current policy exposes again. */
+  readonly restored: readonly string[];
+  /** Whether the withheld set differs from the previous turn's. */
+  readonly changed: boolean;
+}
+
+/** Decides whether the current policy lets the agent see a tool. */
+type ToolExposurePolicy = (toolName: string) => boolean;
+
+/**
+ * The runtime tool surface a session has, independent of what policy withholds.
+ *
+ * Filtering writes its result back through `setActive`, so reading the active
+ * set again next turn returns the *filtered* set. Applying policy to that makes
+ * the surface monotonically shrink and leaves a tool stranded once its rule is
+ * relaxed (#873). This baseline is the stable input policy is applied to
+ * instead: `exposed = baseline ∩ policy`, recomputed every turn.
+ *
+ * The baseline only ever grows from tools observed **active**, never from the
+ * whole registry, so a tool pi deliberately left inactive is never activated
+ * (#385). A tool that stops being active without this extension withholding it
+ * — another extension deactivating it — leaves the baseline with it.
+ */
+export class ToolSurfaceBaseline {
+  private baseline: readonly string[] = [];
+  private withheld: ReadonlySet<string> = new Set();
+
+  resolveExposed(
+    observation: ToolSurfaceObservation,
+    isExposed: ToolExposurePolicy,
+  ): ToolSurfaceResolution {
+    const baseline = this.rebuild(observation);
+    const exposed: string[] = [];
+    const withheld: string[] = [];
+    for (const toolName of baseline) {
+      (isExposed(toolName) ? exposed : withheld).push(toolName);
+    }
+    const restored = exposed.filter((toolName) => this.withheld.has(toolName));
+    const changed = !holdsExactly(this.withheld, withheld);
+
+    this.baseline = baseline;
+    this.withheld = new Set(withheld);
+    return { exposed, withheld, restored, changed };
+  }
+
+  /** Forget the surface, so the next turn reseeds from what pi reports. */
+  reset(): void {
+    this.baseline = [];
+    this.withheld = new Set();
+  }
+
+  /**
+   * Reconstruct the pre-filter surface: the tools still active, plus the ones
+   * only this extension's own filtering removed, plus anything newly active.
+   *
+   * A withheld tool that has left the registry is forgotten rather than kept as
+   * a restoration candidate, so re-registering it inactive cannot activate it.
+   * The registry is consulted for withheld tools only — an active tool is real
+   * by definition — and an active tool is adopted whatever the registry says,
+   * so a registry that reports nothing can cost restoration candidates but
+   * never removes a tool pi has active.
+   */
+  private rebuild(observation: ToolSurfaceObservation): readonly string[] {
+    const active = new Set(observation.active);
+    const baseline = this.baseline.filter(
+      (toolName) =>
+        active.has(toolName) ||
+        (this.withheld.has(toolName) && observation.registered.has(toolName)),
+    );
+
+    const known = new Set(baseline);
+    for (const toolName of observation.active) {
+      if (!known.has(toolName)) {
+        known.add(toolName);
+        baseline.push(toolName);
+      }
+    }
+    return baseline;
+  }
+}
+
+function holdsExactly(
+  set: ReadonlySet<string>,
+  members: readonly string[],
+): boolean {
+  return set.size === members.length && members.every((m) => set.has(m));
+}

package/src/handlers/before-agent-start.ts

@@ -2,12 +2,17 @@ import type {
   BeforeAgentStartEventResult,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import type { TurnPreparation } from "#src/handlers/session-turn-prep";
-import type { PermissionResolver } from "#src/permission-resolver";
-import type { PermissionSession } from "#src/permission-session";
-import { resolveSkillPromptEntries } from "#src/skill-prompt-sanitizer";
-import { sanitizeAvailableToolsSection } from "#src/system-prompt-sanitizer";
-import { getToolNameFromValue, type ToolRegistry } from "#src/tool-registry";
+import { resolveSkillPromptEntries } from "#src/exposure/skill-prompt-sanitizer";
+import { sanitizeAvailableToolsSection } from "#src/exposure/system-prompt-sanitizer";
+import {
+  getToolNameFromValue,
+  type ToolRegistry,
+} from "#src/exposure/tool-registry";
+import type { ToolSurfaceObservation } from "#src/exposure/tool-surface-baseline";
+import type { DebugLogger } from "#src/logging/session-logger";
+import type { PermissionResolver } from "#src/policy/permission-resolver";
+import type { PermissionSession } from "#src/session/permission-session";
+import type { TurnPreparation } from "./session-turn-prep";
 
 /** Minimal subset of BeforeAgentStartEvent used by this handler. */
 interface BeforeAgentStartPayload {
@@ -42,7 +47,11 @@ export function shouldExposeTool(
  *   session state
  * - `session` — encapsulates all mutable session state and lifecycle operations
  * - `resolver` — owns permission-query surface: `isToolFullyDenied`, skill check
- * - `toolRegistry` — Pi tool API subset (getActive + setActive)
+ * - `toolRegistry` — Pi tool API subset (getAll + getActive + setActive)
+ * - `logger` — records each change to the effective tool surface
+ *
+ * The active set is recomputed from the session's pre-filter tool surface
+ * every turn, so relaxing a rule restores the tool it had withheld (#873).
  */
 export class AgentPrepHandler {
   constructor(
@@ -50,6 +59,7 @@ export class AgentPrepHandler {
     private readonly session: PermissionSession,
     private readonly resolver: PermissionResolver,
     private readonly toolRegistry: ToolRegistry,
+    private readonly logger: DebugLogger,
   ) {}
 
   // eslint-disable-next-line @typescript-eslint/require-await
@@ -60,24 +70,23 @@ export class AgentPrepHandler {
     this.turnPrep.prepare(ctx);
 
     const agentName = this.session.resolveAgentName(ctx, event.systemPrompt);
-    const activeTools = this.toolRegistry.getActive();
-    const allowedTools: string[] = [];
-
-    for (const tool of activeTools) {
-      const toolName = getToolNameFromValue(tool);
-      if (!toolName) {
-        continue;
-      }
-      if (
+    const surface = this.session.resolveExposedTools(
+      this.observeToolSurface(),
+      (toolName) =>
         shouldExposeTool(toolName, agentName, (t, a) =>
           this.resolver.isToolFullyDenied(t, a),
-        )
-      ) {
-        allowedTools.push(toolName);
-      }
-    }
+        ),
+    );
+    const allowedTools = [...surface.exposed];
 
     this.toolRegistry.setActive(allowedTools);
+    if (surface.changed) {
+      this.logger.debug("tool_surface.changed", {
+        exposed: surface.exposed,
+        withheld: surface.withheld,
+        restored: surface.restored,
+      });
+    }
 
     const toolPromptResult = sanitizeAvailableToolsSection(
       event.systemPrompt,
@@ -94,4 +103,22 @@ export class AgentPrepHandler {
       ? { systemPrompt: skillPromptResult.prompt }
       : {};
   }
+
+  private observeToolSurface(): ToolSurfaceObservation {
+    return {
+      active: toolNamesOf(this.toolRegistry.getActive()),
+      registered: new Set(toolNamesOf(this.toolRegistry.getAll())),
+    };
+  }
+}
+
+function toolNamesOf(tools: readonly unknown[]): string[] {
+  const names: string[] = [];
+  for (const tool of tools) {
+    const toolName = getToolNameFromValue(tool);
+    if (toolName) {
+      names.push(toolName);
+    }
+  }
+  return names;
 }

package/src/handlers/gates/bash-command.ts

@@ -2,8 +2,8 @@ import type {
   BashCommand,
   WrapperKind,
 } from "#src/access-intent/bash/command-enumeration";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { pickMostRestrictive } from "#src/restrictiveness";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import type { PermissionCheckResult } from "#src/types";
 
 /**

package/src/handlers/gates/bash-external-directory.ts

@@ -1,8 +1,8 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
-import { SessionApproval } from "#src/session-approval";
+import { SessionApproval } from "#src/session/session-approval";
 import type { GateResult } from "./descriptor";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";

package/src/handlers/gates/bash-path-extractor.ts

@@ -1,5 +1,5 @@
 import { BashProgram } from "#src/access-intent/bash/program";
-import type { PathNormalizer } from "#src/path-normalizer";
+import type { PathNormalizer } from "#src/path/path-normalizer";
 
 /**
  * Extract paths from a bash command that resolve outside CWD.

package/src/handlers/gates/bash-path.ts

@@ -2,11 +2,11 @@ import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { TokenEffect } from "#src/access-intent/effect";
 import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
-import { pickMostRestrictive } from "#src/restrictiveness";
-import { SessionApproval } from "#src/session-approval";
+import { SessionApproval } from "#src/session/session-approval";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";

package/src/handlers/gates/descriptor.ts

@@ -1,8 +1,8 @@
 import type { DecisionSource } from "#src/authority/decision-source";
 import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
-import type { PermissionDecisionEvent } from "#src/permission-events";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
-import type { SessionApproval } from "#src/session-approval";
+import type { PermissionDecisionEvent } from "#src/service/permission-events";
+import type { SessionApproval } from "#src/session/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 // ── Descriptor types ───────────────────────────────────────────────────────

package/src/handlers/gates/external-directory-policy.ts

@@ -2,8 +2,8 @@ import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashExternalPath } from "#src/access-intent/bash/bash-path-resolver";
 import type { TokenEffect } from "#src/access-intent/effect";
 import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { pickMostRestrictive } from "#src/restrictiveness";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import type { PermissionCheckResult } from "#src/types";
 
 /** An external path whose resolved `external_directory` state is not "allow". */