@gotgenes/pi-permission-system 31.0.2 → 31.1.1

package/src/presentation/dialog-renderer.ts

@@ -2,9 +2,9 @@ import {
   describeBashCommandContext,
   flaggedElements,
   valueLabel,
-} from "#src/presentation/fact-vocabulary";
-import { fitLinesToWidth } from "#src/presentation/line-fitting";
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+} from "./fact-vocabulary";
+import { fitLinesToWidth } from "./line-fitting";
+import type { PromptPayload } from "./prompt-payload";
 
 /**
  * Render a {@link PromptPayload} for a human deciding an ask (ADR 0011 §5).

package/src/presentation/fact-vocabulary.ts

@@ -1,8 +1,5 @@
-import {
-  allEvidence,
-  type PromptPayload,
-} from "#src/presentation/prompt-payload";
 import type { BashCommandContext } from "#src/types";
+import { allEvidence, type PromptPayload } from "./prompt-payload";
 
 /**
  * The render vocabulary shared by every renderer over a {@link PromptPayload}.

package/src/presentation/forwarded-ask-payload.ts

@@ -1,8 +1,5 @@
 import type { ForwardedPermissionRequest } from "#src/authority/permission-forwarding";
-import type {
-  PromptPayload,
-  PromptRequester,
-} from "#src/presentation/prompt-payload";
+import type { PromptPayload, PromptRequester } from "./prompt-payload";
 
 /**
  * Build the payload for an ask forwarded up from a subagent.

package/src/presentation/path-ask-payload.ts

@@ -1,8 +1,5 @@
-import type {
-  PromptEvidence,
-  PromptPayload,
-} from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
+import type { PromptEvidence, PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** A displayed external path paired with its resolved target, when distinct. */
 export interface ExternalPathDisclosure {

package/src/{pattern-suggest.ts → presentation/pattern-suggest.ts}

@@ -1,10 +1,13 @@
+import {
+  prefix,
+  stripBashCommentLines,
+} from "#src/access-intent/bash/bash-arity";
 import {
   type CapabilityDirection,
   PATH_BEARING_TOOLS,
   surfaceFamilyOf,
-} from "./access-intent/path-surfaces";
-import type { ApprovalGrant } from "./approval-grant";
-import { prefix, stripBashCommentLines } from "./bash-arity";
+} from "#src/access-intent/path-surfaces";
+import type { ApprovalGrant } from "#src/session/approval-grant";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {

package/src/{permission-prompts.ts → presentation/permission-prompts.ts}

@@ -1,4 +1,4 @@
-import { classifyToolKind } from "./access-intent/tool-kind";
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 
 // NOTE: the ask prompts are now payload builders under src/presentation/, and
 // denial text is a render over the payload (presentation/agent-renderer.ts).

package/src/presentation/review-log-renderer.ts

@@ -1,4 +1,4 @@
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+import type { PromptPayload } from "./prompt-payload";
 
 /**
  * The payload facts the permission review log persists (ADR 0011 §6).

package/src/presentation/skill-ask-payload.ts

@@ -1,6 +1,6 @@
-import type { PromptPayload } from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
-import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
+import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
+import type { PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** A request to load a skill. */
 export function buildSkillAskPayload(

package/src/presentation/tool-ask-payload.ts

@@ -1,12 +1,9 @@
 import { classifyToolKind, isMcpCheck } from "#src/access-intent/tool-kind";
-import type {
-  PromptEvidence,
-  PromptPayload,
-} from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
-import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
+import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
+import type { PromptEvidence, PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** The facts the per-tool gate holds when it raises an ask. */
 export interface ToolAskFacts {

package/src/{bash-advisory-check.ts → service/bash-advisory-check.ts}

@@ -1,6 +1,6 @@
 import { parseBashCommandsSync } from "#src/access-intent/bash/sync-commands";
 import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import type { PermissionCheckResult } from "#src/types";
 
 /**

package/src/{permissions-service.ts → service/permissions-service.ts}

@@ -1,21 +1,21 @@
-import type { AccessIntent } from "./access-intent/access-intent";
-import { buildAccessIntentForSurface } from "./access-intent/input-normalizer";
-import type { Authorizer } from "./authority/authorizer";
-import type { AuthorizerRegistrar } from "./authority/authorizer-registry";
-import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
-import type { PathNormalizer } from "./path-normalizer";
-import type { PermissionsService } from "./service";
+import type { AccessIntent } from "#src/access-intent/access-intent";
+import { buildAccessIntentForSurface } from "#src/access-intent/input-normalizer";
+import type { Authorizer } from "#src/authority/authorizer";
+import type { AuthorizerRegistrar } from "#src/authority/authorizer-registry";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { PermissionsService } from "#src/service";
 import type {
   ToolAccessExtractor,
   ToolAccessExtractorLookup,
   ToolAccessExtractorRegistrar,
-} from "./tool-access-extractor-registry";
+} from "#src/tool-input/tool-access-extractor-registry";
 import type {
   ToolInputFormatter,
   ToolInputFormatterLookup,
   ToolInputFormatterRegistrar,
-} from "./tool-input-formatter-registry";
-import type { PermissionCheckResult, PermissionState } from "./types";
+} from "#src/tool-input/tool-input-formatter-registry";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
+import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
 
 /**
  * Resolution surface the service needs: answer a gate-style {@link AccessIntent}

package/src/{service-lifecycle.ts → service/service-lifecycle.ts}

@@ -1,13 +1,13 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { AdjudicationRole } from "./authority/authorizer-selection";
-import type { NodeIdentity } from "./authority/inherited-registrations";
-import { emitReadyEvent, type PermissionEventBus } from "./permission-events";
+import type { AdjudicationRole } from "#src/authority/authorizer-selection";
+import type { NodeIdentity } from "#src/authority/inherited-registrations";
 import {
   type PermissionsService,
   publishPermissionsService,
   unpublishPermissionsService,
-} from "./service";
-import { readSessionId } from "./session-identity";
+} from "#src/service";
+import { readSessionId } from "#src/session/session-identity";
+import { emitReadyEvent, type PermissionEventBus } from "./permission-events";
 
 /** The session-scoped service lifecycle that the lifecycle handler drives. */
 export interface ServiceLifecycle {

package/src/service.ts

@@ -18,15 +18,15 @@
  * ensures resilience across `/reload` and load-order edge cases.
  */
 
-import type { Authorizer } from "./authority/authorizer";
-import type { ToolAccessExtractor } from "./tool-access-extractor-registry";
-import type { ToolInputFormatter } from "./tool-input-formatter-registry";
+import type { Authorizer } from "#src/authority/authorizer";
+import type { ToolAccessExtractor } from "#src/tool-input/tool-access-extractor-registry";
+import type { ToolInputFormatter } from "#src/tool-input/tool-input-formatter-registry";
 import type { PermissionCheckResult, PermissionState } from "./types";
 
 export type {
   Authorizer,
   AuthorizerVerdict,
-} from "./authority/authorizer";
+} from "#src/authority/authorizer";
 
 /**
  * The narrow review-log seam handed to a chain link at `authorize` time
@@ -43,19 +43,7 @@ export interface AuthorizerLog {
   review(event: string, details?: Record<string, unknown>): void;
   debug(event: string, details?: Record<string, unknown>): void;
 }
-export type { PromptPermissionDetails } from "./authority/permission-prompter";
-export type {
-  ForwardedPromptContext,
-  PermissionDecisionEvent,
-  PermissionsReadyEvent,
-  PermissionUiPromptEvent,
-  PermissionUiPromptSource,
-} from "./permission-events";
-export {
-  PERMISSIONS_DECISION_CHANNEL,
-  PERMISSIONS_READY_CHANNEL,
-  PERMISSIONS_UI_PROMPT_CHANNEL,
-} from "./permission-events";
+export type { PromptPermissionDetails } from "#src/authority/permission-prompter";
 // The declaration bundle already inlines these through `PromptPermissionDetails`
 // and `PermissionUiPromptEvent`; the named exports are what a consumer needs to
 // annotate a variable of their own.
@@ -66,7 +54,19 @@ export type {
   PromptPayloadKind,
   PromptRequester,
   PromptRequestFacts,
-} from "./presentation/prompt-payload";
+} from "#src/presentation/prompt-payload";
+export type {
+  ForwardedPromptContext,
+  PermissionDecisionEvent,
+  PermissionsReadyEvent,
+  PermissionUiPromptEvent,
+  PermissionUiPromptSource,
+} from "#src/service/permission-events";
+export {
+  PERMISSIONS_DECISION_CHANNEL,
+  PERMISSIONS_READY_CHANNEL,
+  PERMISSIONS_UI_PROMPT_CHANNEL,
+} from "#src/service/permission-events";
 export type { PermissionCheckResult, PermissionState, ToolInputFormatter };
 
 /** Process-global key for the session-keyed service map (ADR 0012 decision 2). */

package/src/{permission-session.ts → session/permission-session.ts}

@@ -1,25 +1,29 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { AuthorizerSelectionLifecycle } from "#src/authority/authorizer-selection";
 import type { ForwardingController } from "#src/authority/forwarding-manager";
+import type { ShellToolsConfig } from "#src/config/config-schema";
+import type { SessionConfigStore } from "#src/config/config-store";
+import type { PermissionSystemExtensionConfig } from "#src/config/extension-config";
+import type { ExtensionPaths } from "#src/config/extension-paths";
+import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
+import {
+  ToolSurfaceBaseline,
+  type ToolSurfaceObservation,
+  type ToolSurfaceResolution,
+} from "#src/exposure/tool-surface-baseline";
+import type { ToolCallGateInputs } from "#src/handlers/gates/tool-call-gate-pipeline";
+import type { PathFlavor } from "#src/path/path-flavor";
+import { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionManager } from "#src/policy/permission-manager";
+import {
+  resolveToolPreviewLimits,
+  type ToolPreviewFormatterOptions,
+} from "#src/tool-input/tool-preview-formatter";
 import {
   getActiveAgentName,
   getActiveAgentNameFromSystemPrompt,
 } from "./active-agent";
-import type { AuthorizerSelectionLifecycle } from "./authority/authorizer-selection";
-import type { ShellToolsConfig } from "./config-schema";
-import type { SessionConfigStore } from "./config-store";
-import type { PermissionSystemExtensionConfig } from "./extension-config";
-import type { ExtensionPaths } from "./extension-paths";
-import type { ToolCallGateInputs } from "./handlers/gates/tool-call-gate-pipeline";
-import type { PathFlavor } from "./path/path-flavor";
-import { PathNormalizer } from "./path-normalizer";
-import type { ScopedPermissionManager } from "./permission-manager";
-
 import type { SessionRules } from "./session-rules";
-import type { SkillPromptEntry } from "./skill-prompt-sanitizer";
-import {
-  resolveToolPreviewLimits,
-  type ToolPreviewFormatterOptions,
-} from "./tool-preview-formatter";
 
 /**
  * Encapsulates all mutable session state and exposes operations instead of
@@ -40,6 +44,7 @@ export class PermissionSession implements ToolCallGateInputs {
   private skillEntries: SkillPromptEntry[] = [];
   private knownAgentName: string | null = null;
   private pathNormalizer: PathNormalizer;
+  private readonly toolSurfaceBaseline = new ToolSurfaceBaseline();
 
   constructor(
     private readonly paths: ExtensionPaths,
@@ -108,6 +113,7 @@ export class PermissionSession implements ToolCallGateInputs {
       projectTrusted ? ctx.cwd : undefined,
     );
     this.skillEntries = [];
+    this.toolSurfaceBaseline.reset();
     this.activate(ctx);
   }
 
@@ -118,6 +124,7 @@ export class PermissionSession implements ToolCallGateInputs {
   shutdown(): void {
     this.sessionRules.clear();
     this.skillEntries = [];
+    this.toolSurfaceBaseline.reset();
     this.deactivate();
   }
 
@@ -134,6 +141,23 @@ export class PermissionSession implements ToolCallGateInputs {
       projectTrusted ? this.context?.cwd : undefined,
     );
     this.skillEntries = [];
+    // The tool-surface baseline deliberately survives a reload: a reload is
+    // when a relaxed policy arrives, and reseeding from the already-filtered
+    // active set would strand the tool it just un-denied (#873).
+  }
+
+  // ── Tool surface ───────────────────────────────────────────────────────
+
+  /**
+   * Answer which tools the agent may see this turn, applying `isExposed` to
+   * the session's pre-filter tool surface rather than to the previous turn's
+   * filtered result.
+   */
+  resolveExposedTools(
+    observation: ToolSurfaceObservation,
+    isExposed: (toolName: string) => boolean,
+  ): ToolSurfaceResolution {
+    return this.toolSurfaceBaseline.resolveExposed(observation, isExposed);
   }
 
   // ── Skill entries ──────────────────────────────────────────────────────

package/src/{session-approval.ts → session/session-approval.ts}

@@ -1,9 +1,9 @@
+import type { ForwardedSessionApproval } from "#src/authority/permission-forwarding";
 import {
   type ApprovalGrant,
   type SessionGrantWidth,
   widenGrant,
-} from "#src/approval-grant";
-import type { ForwardedSessionApproval } from "#src/authority/permission-forwarding";
+} from "./approval-grant";
 
 /**
  * Value object for a session-scoped approval: one or more

package/src/{session-rules.ts → session/session-rules.ts}

@@ -1,5 +1,5 @@
 import { surfaceFamilyMembers } from "#src/access-intent/path-surfaces";
-import type { Ruleset } from "./rule";
+import type { Ruleset } from "#src/policy/rule";
 import type { SessionApproval } from "./session-approval";
 import type { SessionApprovalRecorder } from "./session-approval-recorder";
 

package/src/{builtin-tool-input-formatters.ts → tool-input/builtin-tool-input-formatters.ts}

@@ -5,12 +5,12 @@
  * through exactly the same path a third-party extension would use.
  */
 
+import { toRecord } from "#src/value-guards";
 import type {
   ToolInputFormatter,
   ToolInputFormatterRegistry,
 } from "./tool-input-formatter-registry";
 import { truncateInlineText } from "./tool-input-preview";
-import { toRecord } from "./value-guards";
 
 /** Maximum total length of the generated argument summary (before "with " prefix). */
 const MCP_ARGS_SUMMARY_MAX_LENGTH = 160;

package/src/{tool-input-preview.ts → tool-input/tool-input-preview.ts}

@@ -1,5 +1,5 @@
-import { safeJsonStringify } from "./json-safe-stringify";
-import { redactedJsonStringify } from "./log-redaction";
+import { safeJsonStringify } from "#src/logging/json-safe-stringify";
+import { redactedJsonStringify } from "#src/logging/log-redaction";
 
 export const TOOL_INPUT_PREVIEW_MAX_LENGTH = 200;
 export const TOOL_TEXT_SUMMARY_MAX_LENGTH = 80;

package/src/{tool-input-prompt-formatters.ts → tool-input/tool-input-prompt-formatters.ts}

@@ -1,5 +1,5 @@
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 import { countTextLines, formatCount } from "./tool-input-preview";
-import { getNonEmptyString, toRecord } from "./value-guards";
 
 export function getPromptPath(input: Record<string, unknown>): string | null {
   return getNonEmptyString(input.path) ?? getNonEmptyString(input.file_path);

package/src/{tool-preview-formatter.ts → tool-input/tool-preview-formatter.ts}

@@ -1,4 +1,6 @@
-import { classifyToolKind, isMcpCheck } from "./access-intent/tool-kind";
+import { classifyToolKind, isMcpCheck } from "#src/access-intent/tool-kind";
+import type { PermissionCheckResult } from "#src/types";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 import type { ToolInputFormatterLookup } from "./tool-input-formatter-registry";
 import {
   serializeRedactedToolInputPreview,
@@ -13,8 +15,6 @@ import {
   formatWriteInputForPrompt,
   getPromptPath,
 } from "./tool-input-prompt-formatters";
-import type { PermissionCheckResult } from "./types";
-import { getNonEmptyString, toRecord } from "./value-guards";
 
 export interface ToolPreviewFormatterOptions {
   toolInputPreviewMaxLength: number;

package/src/types.ts

@@ -3,8 +3,8 @@ import type {
   FlatPermissionConfig,
   PatternValue,
   PermissionState,
-} from "./config-schema";
-import type { RuleOrigin } from "./rule";
+} from "#src/config/config-schema";
+import type { RuleOrigin } from "#src/policy/rule";
 
 // The config-file shape types are derived from the zod schema
 // (config-schema.ts) — the single source of truth — and re-exported here so