@gotgenes/pi-permission-system 31.1.0 → 31.1.2

package/src/authority/forwarding-liveness.ts

@@ -18,23 +18,20 @@
 
 import { readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import {
   ensureDirectoryExists,
   isErrnoCode,
   logPermissionForwardingError,
   safeDeleteFile,
   writeJsonFileAtomic,
-} from "#src/authority/forwarding-io";
-import type { PermissionForwardingTarget } from "#src/authority/permission-forwarding";
+} from "./forwarding-io";
+import type { PermissionForwardingTarget } from "./permission-forwarding";
 import {
   encodeSessionIdForPath,
   PERMISSION_FORWARDING_POLL_INTERVAL_MS,
-} from "#src/authority/permission-forwarding";
-import type {
-  ServingAnnouncer,
-  ServingLookup,
-} from "#src/authority/serving-registry";
-import type { DebugReviewLogger } from "#src/session-logger";
+} from "./permission-forwarding";
+import type { ServingAnnouncer, ServingLookup } from "./serving-registry";
 
 /**
  * How often a serving session rewrites its heartbeat — four poll ticks.

package/src/authority/forwarding-manager.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { DebugReviewLogger } from "#src/session-logger";
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import type { InboxProcessor } from "./forwarded-request-server";
 import { getSessionId } from "./forwarder-context";
 import { PERMISSION_FORWARDING_POLL_INTERVAL_MS } from "./permission-forwarding";

package/src/authority/inherited-registrations.ts

@@ -36,11 +36,11 @@ import type { PermissionsService } from "#src/service";
 import type {
   ResolvedToolAccessExtractor,
   ToolAccessExtractorLookup,
-} from "#src/tool-access-extractor-registry";
+} from "#src/tool-input/tool-access-extractor-registry";
 import type {
   ToolInputFormatter,
   ToolInputFormatterLookup,
-} from "#src/tool-input-formatter-registry";
+} from "#src/tool-input/tool-input-formatter-registry";
 
 /** This node's own session id, or `null` when the host exposes none. */
 export interface NodeIdentity {

package/src/authority/local-user-authorizer.ts

@@ -1,25 +1,25 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { provenDirectionOf } from "#src/approval-grant";
-import type {
-  PermissionPromptDecision,
-  RequestPermissionOptions,
-} from "#src/authority/permission-dialog";
-import type {
-  PermissionPromptUi,
-  PromptPreferences,
-  requestPermissionDecision,
-} from "#src/authority/permission-prompt-component";
 import {
   buildDirectionalSessionLabels,
   buildForwardedScopeLabels,
   describeGrantTarget,
-} from "#src/pattern-suggest";
+} from "#src/presentation/pattern-suggest";
 import {
   emitUiPromptEvent,
   type PermissionEventBus,
-} from "#src/permission-events";
-import { buildUiPrompt } from "#src/permission-ui-prompt";
+} from "#src/service/permission-events";
+import { buildUiPrompt } from "#src/service/permission-ui-prompt";
+import { provenDirectionOf } from "#src/session/approval-grant";
 import type { TerminalAuthorizer } from "./authorizer";
+import type {
+  PermissionPromptDecision,
+  RequestPermissionOptions,
+} from "./permission-dialog";
+import type {
+  PermissionPromptUi,
+  PromptPreferences,
+  requestPermissionDecision,
+} from "./permission-prompt-component";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */

package/src/authority/permission-dialog.ts

@@ -1,5 +1,5 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
+import type { DecisionSource } from "./decision-source";
 
 export type PermissionDecisionState =
   | "approved"

package/src/authority/permission-forwarding.ts

@@ -1,8 +1,11 @@
 import { join } from "node:path";
-import type { ApprovalGrant, SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
-import type { PermissionUiPromptSource } from "#src/permission-events";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import type { PermissionUiPromptSource } from "#src/service/permission-events";
+import type {
+  ApprovalGrant,
+  SessionGrantWidth,
+} from "#src/session/approval-grant";
+import type { DecisionSource } from "./decision-source";
 import type { PermissionDecisionState } from "./permission-dialog";
 import type { SubagentSessionRegistry } from "./subagent-registry";
 

package/src/authority/permission-prompt-component.ts

@@ -4,17 +4,22 @@ import type {
   KeybindingsManager,
 } from "@earendil-works/pi-coding-agent";
 import { type Component, Input, matchesKey } from "@earendil-works/pi-tui";
-import { collapsePastedNewlines } from "#src/authority/bracketed-paste";
-import type {
-  DecisionSource,
-  UserDecisionSurface,
-} from "#src/authority/decision-source";
+import {
+  completeViewBudget,
+  type DialogView,
+  type RenderBudget,
+  renderPromptDialog,
+} from "#src/presentation/dialog-renderer";
+import { fitLinesToWidth } from "#src/presentation/line-fitting";
+import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { collapsePastedNewlines } from "./bracketed-paste";
+import type { DecisionSource, UserDecisionSurface } from "./decision-source";
 import {
   type PermissionPromptDecision,
   type RequestPermissionOptions,
   requestPermissionDecisionFromUi,
   type UnattributedDecision,
-} from "#src/authority/permission-dialog";
+} from "./permission-dialog";
 import {
   initialPromptState,
   type PromptEvent,
@@ -23,15 +28,7 @@ import {
   type PromptViewState,
   reducePrompt,
   visibleOptionKeys,
-} from "#src/authority/permission-prompt-decision";
-import {
-  completeViewBudget,
-  type DialogView,
-  type RenderBudget,
-  renderPromptDialog,
-} from "#src/presentation/dialog-renderer";
-import { fitLinesToWidth } from "#src/presentation/line-fitting";
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+} from "./permission-prompt-decision";
 
 /**
  * Inline `ctx.ui.custom` permission dialog for TUI sessions.

package/src/authority/permission-prompt-decision.ts

@@ -1,10 +1,10 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
 import {
   createDeniedPermissionDecision,
   normalizePermissionDenialReason,
   type RequestPermissionOptions,
   type UnattributedDecision,
-} from "#src/authority/permission-dialog";
+} from "./permission-dialog";
 
 /**
  * Pure decision model for the inline keybind permission dialog.

package/src/authority/permission-prompter.ts

@@ -1,14 +1,14 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
-import type { DecisionSource } from "#src/authority/decision-source";
-import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type {
-  ForwardedAccessFacts,
-  ForwardedSessionApproval,
-} from "#src/authority/permission-forwarding";
+import type { ReviewLogger } from "#src/logging/session-logger";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
 import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
-import type { ReviewLogger } from "#src/session-logger";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
 import type { TerminalAuthorizer } from "./authorizer";
+import type { DecisionSource } from "./decision-source";
+import type { PermissionPromptDecision } from "./permission-dialog";
+import type {
+  ForwardedAccessFacts,
+  ForwardedSessionApproval,
+} from "./permission-forwarding";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 

package/src/authority/subagent-context.ts

@@ -1,7 +1,7 @@
-import { SUBAGENT_ENV_HINT_KEYS } from "#src/authority/permission-forwarding";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PathFlavor } from "#src/path/path-flavor";
-import { readSessionId } from "#src/session-identity";
+import { readSessionId } from "#src/session/session-identity";
+import { SUBAGENT_ENV_HINT_KEYS } from "./permission-forwarding";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * Narrow context for subagent detection — the only session-manager readers

package/src/authority/subagent-detection.ts

@@ -1,9 +1,9 @@
+import type { PathFlavor } from "#src/path/path-flavor";
 import {
   isSubagentExecutionContext,
   type SubagentDetectionContext,
-} from "#src/authority/subagent-context";
-import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
-import type { PathFlavor } from "#src/path/path-flavor";
+} from "./subagent-context";
+import type { SubagentSessionRegistry } from "./subagent-registry";
 
 /**
  * Narrow seam for the ask-path consumers: "is the current session a subagent?"

package/src/{config-loader.ts → config/config-loader.ts}

@@ -1,6 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
 import { normalize } from "node:path";
 import type { ZodError } from "zod";
+import { mergeFlatPermissions } from "#src/policy/permission-merge";
+import type { FlatPermissionConfig, PatternValue } from "#src/types";
+import { isDenyWithReason, isPermissionState } from "#src/types";
 import {
   getGlobalConfigPath,
   getLegacyExtensionConfigPath,
@@ -13,9 +16,6 @@ import {
   type UnifiedPermissionConfig,
   unifiedConfigSchema,
 } from "./config-schema";
-import { mergeFlatPermissions } from "./permission-merge";
-import type { FlatPermissionConfig, PatternValue } from "./types";
-import { isDenyWithReason, isPermissionState } from "./types";
 
 // The unified config shape is derived from the zod schema (config-schema.ts,
 // the single source of truth) and re-exported so existing importers keep their

package/src/{config-modal.ts → config/config-modal.ts}

@@ -4,13 +4,12 @@ import {
   getSettingsListTheme,
 } from "@earendil-works/pi-coding-agent";
 import { type SettingItem, SettingsList } from "@earendil-works/pi-tui";
-
+import type { Ruleset } from "#src/policy/rule";
 import type { CommandConfigStore } from "./config-store";
 import {
   DEFAULT_EXTENSION_CONFIG,
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
-import type { Ruleset } from "./rule";
 
 interface PermissionSystemConfigController {
   config: CommandConfigStore;

package/src/{config-reporter.ts → config/config-reporter.ts}

@@ -1,4 +1,4 @@
-import type { ResolvedPolicyPaths } from "./permission-manager";
+import type { ResolvedPolicyPaths } from "#src/policy/permission-manager";
 
 export interface ResolvedConfigLogEntry {
   globalConfigPath: string;

package/src/{config-store.ts → config/config-store.ts}

@@ -10,7 +10,7 @@ import type {
   ExtensionCommandContext,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-
+import type { DebugReviewLogger } from "#src/logging/session-logger";
 import { loadAndMergeConfigs, loadUnifiedConfig } from "./config-loader";
 import {
   getGlobalConfigPath,
@@ -26,7 +26,6 @@ import {
   type PermissionSystemExtensionConfig,
 } from "./extension-config";
 import type { ResolvedPolicyPaths } from "./policy-loader";
-import type { DebugReviewLogger } from "./session-logger";
 import { syncPermissionSystemStatus } from "./status";
 
 /** Read-only view of the current config — for consumers that only read. */

package/src/{extension-config.ts → config/extension-config.ts}

@@ -1,14 +1,14 @@
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  OWNER_ONLY_DIRECTORY_MODE,
+  restrictExistingPathToOwner,
+} from "#src/logging/log-file-permissions";
 import type {
   ShellToolsConfig,
   UnifiedPermissionConfig,
 } from "./config-loader";
-import {
-  OWNER_ONLY_DIRECTORY_MODE,
-  restrictExistingPathToOwner,
-} from "./log-file-permissions";
 
 export const EXTENSION_ID = "pi-permission-system";
 

package/src/{extension-paths.ts → config/extension-paths.ts}

@@ -1,6 +1,6 @@
 import { join } from "node:path";
+import { discoverGlobalNodeModulesRoot } from "#src/path/node-modules-discovery";
 import { getGlobalLogsDir } from "./config-paths";
-import { discoverGlobalNodeModulesRoot } from "./node-modules-discovery";
 
 /**
  * Immutable path constants derived from `agentDir` at construction time.

package/src/{policy-loader.ts → config/policy-loader.ts}

@@ -1,14 +1,14 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { ScopeConfig } from "#src/types";
+import { toRecord } from "#src/value-guards";
 import {
   loadUnifiedConfig,
   normalizeFlatPermissionValue,
   stripJsonComments,
 } from "./config-loader";
 import { getGlobalConfigPath } from "./config-paths";
-import type { ScopeConfig } from "./types";
-import { toRecord } from "./value-guards";
 import { extractFrontmatter, parseSimpleYamlMap } from "./yaml-frontmatter";
 
 // ---------------------------------------------------------------------------

package/src/{skill-prompt-sanitizer.ts → exposure/skill-prompt-sanitizer.ts}

@@ -1,7 +1,7 @@
 import { dirname } from "node:path";
 
-import type { PathNormalizer } from "./path-normalizer";
-import type { PermissionCheckResult, PermissionState } from "./types";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 /**
  * Narrow interface for the raw (no-session-rules) permission checker used by

package/src/{tool-registry.ts → exposure/tool-registry.ts}

@@ -1,4 +1,4 @@
-import { getNonEmptyString, toRecord } from "./value-guards";
+import { getNonEmptyString, toRecord } from "#src/value-guards";
 
 /** Narrow interface for the Pi tool API subset used by handler classes. */
 export interface ToolRegistry {

package/src/handlers/before-agent-start.ts

@@ -2,14 +2,17 @@ import type {
   BeforeAgentStartEventResult,
   ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
-import type { TurnPreparation } from "#src/handlers/session-turn-prep";
-import type { PermissionResolver } from "#src/permission-resolver";
-import type { PermissionSession } from "#src/permission-session";
-import type { DebugLogger } from "#src/session-logger";
-import { resolveSkillPromptEntries } from "#src/skill-prompt-sanitizer";
-import { sanitizeAvailableToolsSection } from "#src/system-prompt-sanitizer";
-import { getToolNameFromValue, type ToolRegistry } from "#src/tool-registry";
-import type { ToolSurfaceObservation } from "#src/tool-surface-baseline";
+import { resolveSkillPromptEntries } from "#src/exposure/skill-prompt-sanitizer";
+import { sanitizeAvailableToolsSection } from "#src/exposure/system-prompt-sanitizer";
+import {
+  getToolNameFromValue,
+  type ToolRegistry,
+} from "#src/exposure/tool-registry";
+import type { ToolSurfaceObservation } from "#src/exposure/tool-surface-baseline";
+import type { DebugLogger } from "#src/logging/session-logger";
+import type { PermissionResolver } from "#src/policy/permission-resolver";
+import type { PermissionSession } from "#src/session/permission-session";
+import type { TurnPreparation } from "./session-turn-prep";
 
 /** Minimal subset of BeforeAgentStartEvent used by this handler. */
 interface BeforeAgentStartPayload {

package/src/handlers/gates/bash-command.ts

@@ -2,8 +2,8 @@ import type {
   BashCommand,
   WrapperKind,
 } from "#src/access-intent/bash/command-enumeration";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { pickMostRestrictive } from "#src/restrictiveness";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import type { PermissionCheckResult } from "#src/types";
 
 /**

package/src/handlers/gates/bash-external-directory.ts

@@ -1,8 +1,8 @@
 import type { BashProgram } from "#src/access-intent/bash/program";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import { buildBashExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
-import { SessionApproval } from "#src/session-approval";
+import { SessionApproval } from "#src/session/session-approval";
 import type { GateResult } from "./descriptor";
 import { selectUncoveredExternalPaths } from "./external-directory-policy";
 import { accessFactsFromPath } from "./helpers";

package/src/handlers/gates/bash-path-extractor.ts

@@ -1,5 +1,5 @@
 import { BashProgram } from "#src/access-intent/bash/program";
-import type { PathNormalizer } from "#src/path-normalizer";
+import type { PathNormalizer } from "#src/path/path-normalizer";
 
 /**
  * Extract paths from a bash command that resolve outside CWD.

package/src/handlers/gates/bash-path.ts

@@ -2,11 +2,11 @@ import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashProgram } from "#src/access-intent/bash/program";
 import type { TokenEffect } from "#src/access-intent/effect";
 import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
-import { pickMostRestrictive } from "#src/restrictiveness";
-import { SessionApproval } from "#src/session-approval";
+import { SessionApproval } from "#src/session/session-approval";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateResult } from "./descriptor";
 import { accessFactsFromPath } from "./helpers";

package/src/handlers/gates/descriptor.ts

@@ -1,8 +1,8 @@
 import type { DecisionSource } from "#src/authority/decision-source";
 import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
-import type { PermissionDecisionEvent } from "#src/permission-events";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
-import type { SessionApproval } from "#src/session-approval";
+import type { PermissionDecisionEvent } from "#src/service/permission-events";
+import type { SessionApproval } from "#src/session/session-approval";
 import type { PermissionCheckResult, PermissionState } from "#src/types";
 
 // ── Descriptor types ───────────────────────────────────────────────────────

package/src/handlers/gates/external-directory-policy.ts

@@ -2,8 +2,8 @@ import type { AccessPath } from "#src/access-intent/access-path";
 import type { BashExternalPath } from "#src/access-intent/bash/bash-path-resolver";
 import type { TokenEffect } from "#src/access-intent/effect";
 import { capabilitySurfaceForEffect } from "#src/access-intent/path-surfaces";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import { pickMostRestrictive } from "#src/restrictiveness";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import { pickMostRestrictive } from "#src/policy/restrictiveness";
 import type { PermissionCheckResult } from "#src/types";
 
 /** An external path whose resolved `external_directory` state is not "allow". */

package/src/handlers/gates/external-directory.ts

@@ -1,10 +1,10 @@
 import { capabilitySurfaceForTool } from "#src/access-intent/path-surfaces";
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
-import { SessionApproval } from "#src/session-approval";
-import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
+import { SessionApproval } from "#src/session/session-approval";
+import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
 import type { GateResult } from "./descriptor";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
 import {

package/src/handlers/gates/helpers.ts

@@ -3,7 +3,7 @@ import type { ToolPathSource } from "#src/access-intent/tool-input-path";
 import { classifyToolKind } from "#src/access-intent/tool-kind";
 import type { ForwardedAccessFacts } from "#src/authority/permission-forwarding";
 import type { PromptPermissionDetails } from "#src/authority/permission-prompter";
-import type { PermissionDecisionResolution } from "#src/permission-events";
+import type { PermissionDecisionResolution } from "#src/service/permission-events";
 import type { PermissionCheckResult } from "#src/types";
 import type { DecisionEventFacts } from "./descriptor";
 import type { ToolCallContext } from "./types";

package/src/handlers/gates/path.ts

@@ -1,10 +1,10 @@
 import { capabilitySurfaceForTool } from "#src/access-intent/path-surfaces";
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import { buildPathAskPayload } from "#src/presentation/path-ask-payload";
-import { SessionApproval } from "#src/session-approval";
-import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
+import { SessionApproval } from "#src/session/session-approval";
+import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
 import type { GateDescriptor, GateResult } from "./descriptor";
 import {
   accessFactsFromPath,

package/src/handlers/gates/runner.ts

@@ -2,16 +2,16 @@ import type { AskEscalator } from "#src/authority/authorizer-selection";
 import { resolutionFor } from "#src/authority/decision-resolution";
 import type { DecisionSource } from "#src/authority/decision-source";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type { DecisionReporter } from "#src/decision-reporter";
-import { applyPermissionGate } from "#src/permission-gate";
+import type { DecisionReporter } from "#src/logging/decision-reporter";
 import { createPermissionRequestId } from "#src/permission-request-id";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import { applyPermissionGate } from "#src/policy/permission-gate";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import {
   renderPolicyDenial,
   renderRefusal,
 } from "#src/presentation/agent-renderer";
 import { renderReviewLogFacts } from "#src/presentation/review-log-renderer";
-import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
+import type { SessionApprovalRecorder } from "#src/session/session-approval-recorder";
 import type { PermissionCheckResult } from "#src/types";
 import type {
   DecisionEventFacts,

package/src/handlers/gates/skill-read.ts

@@ -1,7 +1,7 @@
-import type { PathNormalizer } from "#src/path-normalizer";
+import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
+import { findSkillPathMatch } from "#src/exposure/skill-prompt-sanitizer";
+import type { PathNormalizer } from "#src/path/path-normalizer";
 import { buildSkillPathAskPayload } from "#src/presentation/skill-ask-payload";
-import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
-import { findSkillPathMatch } from "#src/skill-prompt-sanitizer";
 import { toRecord } from "#src/value-guards";
 import type { GateDescriptor } from "./descriptor";
 import { accessFactsFromValue } from "./helpers";

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -4,16 +4,16 @@ import {
   resolveShellInvocation,
   type ShellInvocation,
 } from "#src/access-intent/tool-kind";
-import type { ShellToolsConfig } from "#src/config-schema";
-import type { PathNormalizer } from "#src/path-normalizer";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
-import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
-import type { ToolAccessExtractorLookup } from "#src/tool-access-extractor-registry";
-import type { ToolInputFormatterLookup } from "#src/tool-input-formatter-registry";
+import type { ShellToolsConfig } from "#src/config/config-schema";
+import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
+import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
+import type { ToolInputFormatterLookup } from "#src/tool-input/tool-input-formatter-registry";
 import {
   ToolPreviewFormatter,
   type ToolPreviewFormatterOptions,
-} from "#src/tool-preview-formatter";
+} from "#src/tool-input/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import { resolveBashCommandCheck } from "./bash-command";
 import { describeBashExternalDirectoryGate } from "./bash-external-directory";

package/src/handlers/gates/tool.ts

@@ -8,10 +8,10 @@ import {
 import {
   suggestPathSessionPattern,
   suggestSessionPattern,
-} from "#src/pattern-suggest";
+} from "#src/presentation/pattern-suggest";
 import { buildToolAskPayload } from "#src/presentation/tool-ask-payload";
-import { SessionApproval } from "#src/session-approval";
-import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
+import { SessionApproval } from "#src/session/session-approval";
+import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import type { GateDescriptor } from "./descriptor";
 import {

package/src/handlers/lifecycle.ts

@@ -1,11 +1,10 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-
-import type { DecisionSummaryWriter } from "#src/decision-audit";
-import type { PermissionResolver } from "#src/permission-resolver";
-import type { PermissionSession } from "#src/permission-session";
-import type { ServiceLifecycle } from "#src/service-lifecycle";
-import type { SessionLogger } from "#src/session-logger";
-import { PERMISSION_SYSTEM_STATUS_KEY } from "#src/status";
+import { PERMISSION_SYSTEM_STATUS_KEY } from "#src/config/status";
+import type { DecisionSummaryWriter } from "#src/logging/decision-audit";
+import type { SessionLogger } from "#src/logging/session-logger";
+import type { PermissionResolver } from "#src/policy/permission-resolver";
+import type { ServiceLifecycle } from "#src/service/service-lifecycle";
+import type { PermissionSession } from "#src/session/permission-session";
 
 /** Minimal subset of SessionStartEvent used by this handler. */
 interface SessionStartPayload {