@gotgenes/pi-permission-system 31.1.0 → 31.1.2

package/src/handlers/permission-gate-handler.ts

@@ -2,24 +2,24 @@ import type {
   ExtensionContext,
   InputEventResult,
 } from "@earendil-works/pi-coding-agent";
-import {
-  formatMissingToolNameReason,
-  formatUnknownToolReason,
-} from "#src/permission-prompts";
-import type { PermissionSession } from "#src/permission-session";
 import {
   checkRequestedToolRegistration,
   getToolNameFromValue,
   type ToolRegistry,
-} from "#src/tool-registry";
-import { toRecord } from "#src/value-guards";
-import type { GateRunner } from "./gates/runner";
+} from "#src/exposure/tool-registry";
+import type { GateRunner } from "#src/handlers/gates/runner";
 import type {
   GateNotifier,
   SkillInputGatePipeline,
-} from "./gates/skill-input-gate-pipeline";
-import type { ToolCallGatePipeline } from "./gates/tool-call-gate-pipeline";
-import type { GateOutcome, ToolCallContext } from "./gates/types";
+} from "#src/handlers/gates/skill-input-gate-pipeline";
+import type { ToolCallGatePipeline } from "#src/handlers/gates/tool-call-gate-pipeline";
+import type { GateOutcome, ToolCallContext } from "#src/handlers/gates/types";
+import {
+  formatMissingToolNameReason,
+  formatUnknownToolReason,
+} from "#src/presentation/permission-prompts";
+import type { PermissionSession } from "#src/session/permission-session";
+import { toRecord } from "#src/value-guards";
 
 /** Minimal subset of InputEvent used by handleInput. */
 interface InputPayload {

package/src/handlers/session-turn-prep.ts

@@ -1,5 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { ReadyAnnouncer } from "#src/service-lifecycle";
+import type { ReadyAnnouncer } from "#src/service/service-lifecycle";
 
 /** The session surface the turn-prep routine drives. */
 export interface TurnPrepSession {

package/src/handlers/tool-call-boundary.ts

@@ -1,9 +1,9 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { DecisionRecorder } from "#src/decision-audit";
-import type { DecisionReporter } from "#src/decision-reporter";
+import type { GateOutcome } from "#src/handlers/gates/types";
+import type { DecisionRecorder } from "#src/logging/decision-audit";
+import type { DecisionReporter } from "#src/logging/decision-reporter";
 import { createPermissionRequestId } from "#src/permission-request-id";
 import { toRecord } from "#src/value-guards";
-import type { GateOutcome } from "./gates/types";
 
 /** The SDK-facing result shape for a `tool_call` handler. */
 type ToolCallResult = { block?: true; reason?: string };

package/src/index.ts

@@ -1,67 +1,67 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
-import { warmBashParser } from "./access-intent/bash/parser";
-import { buildResolvedIntentFromMatchValues } from "./access-intent/input-normalizer";
+import { warmBashParser } from "#src/access-intent/bash/parser";
+import { buildResolvedIntentFromMatchValues } from "#src/access-intent/input-normalizer";
 import {
   AuthorizerRegistry,
   ObservedAuthorizerRegistrar,
-} from "./authority/authorizer-registry";
-import { AuthorizerSelection } from "./authority/authorizer-selection";
-import { ChildNodeAudit } from "./authority/child-node-audit";
+} from "#src/authority/authorizer-registry";
+import { AuthorizerSelection } from "#src/authority/authorizer-selection";
+import { ChildNodeAudit } from "#src/authority/child-node-audit";
 import {
   ForwardedRequestServer,
   type ServingPolicy,
-} from "./authority/forwarded-request-server";
+} from "#src/authority/forwarded-request-server";
 import {
   ForwardingLivenessJudge,
   ServingHeartbeatStore,
-} from "./authority/forwarding-liveness";
-import { ForwardingManager } from "./authority/forwarding-manager";
+} from "#src/authority/forwarding-liveness";
+import { ForwardingManager } from "#src/authority/forwarding-manager";
 import {
   AncestorNodes,
   InheritingToolAccessExtractorLookup,
   InheritingToolInputFormatterLookup,
-} from "./authority/inherited-registrations";
-import { PERMISSION_FORWARDING_TIMEOUT_MS } from "./authority/permission-forwarding";
-import { requestPermissionDecision } from "./authority/permission-prompt-component";
-import { PermissionPrompter } from "./authority/permission-prompter";
+} from "#src/authority/inherited-registrations";
+import { PERMISSION_FORWARDING_TIMEOUT_MS } from "#src/authority/permission-forwarding";
+import { requestPermissionDecision } from "#src/authority/permission-prompt-component";
+import { PermissionPrompter } from "#src/authority/permission-prompter";
 import {
   composeServingAnnouncers,
   getServingSessionRegistry,
-} from "./authority/serving-registry";
-import { SubagentDetection } from "./authority/subagent-detection";
-import { subscribeSubagentLifecycle } from "./authority/subagent-lifecycle-events";
-import { getSubagentSessionRegistry } from "./authority/subagent-registry";
-import { registerBuiltinToolInputFormatters } from "./builtin-tool-input-formatters";
-import { registerPermissionSystemCommand } from "./config-modal";
-import { getGlobalConfigPath } from "./config-paths";
-import { ConfigStore } from "./config-store";
-import { DecisionAudit } from "./decision-audit";
-import { GateDecisionReporter } from "./decision-reporter";
-import { isYoloModeEnabled } from "./extension-config";
-import { computeExtensionPaths } from "./extension-paths";
+} from "#src/authority/serving-registry";
+import { SubagentDetection } from "#src/authority/subagent-detection";
+import { subscribeSubagentLifecycle } from "#src/authority/subagent-lifecycle-events";
+import { getSubagentSessionRegistry } from "#src/authority/subagent-registry";
+import { registerPermissionSystemCommand } from "#src/config/config-modal";
+import { getGlobalConfigPath } from "#src/config/config-paths";
+import { ConfigStore } from "#src/config/config-store";
+import { isYoloModeEnabled } from "#src/config/extension-config";
+import { computeExtensionPaths } from "#src/config/extension-paths";
+import { GateRunner } from "#src/handlers/gates/runner";
+import { SkillInputGatePipeline } from "#src/handlers/gates/skill-input-gate-pipeline";
+import { ToolCallGatePipeline } from "#src/handlers/gates/tool-call-gate-pipeline";
+import { createFailClosedToolCall } from "#src/handlers/tool-call-boundary";
+import { DecisionAudit } from "#src/logging/decision-audit";
+import { GateDecisionReporter } from "#src/logging/decision-reporter";
+import { PermissionSessionLogger } from "#src/logging/session-logger";
+import { pathFlavorForPlatform } from "#src/path/path-flavor";
+import { PermissionManager } from "#src/policy/permission-manager";
+import { PermissionResolver } from "#src/policy/permission-resolver";
+import { resolveRenderBudget } from "#src/presentation/dialog-renderer";
+import { LocalPermissionsService } from "#src/service/permissions-service";
+import { PermissionServiceLifecycle } from "#src/service/service-lifecycle";
+import { PermissionSession } from "#src/session/permission-session";
+import { SessionRules } from "#src/session/session-rules";
+import { registerBuiltinToolInputFormatters } from "#src/tool-input/builtin-tool-input-formatters";
+import { ToolAccessExtractorRegistry } from "#src/tool-input/tool-access-extractor-registry";
+import { ToolInputFormatterRegistry } from "#src/tool-input/tool-input-formatter-registry";
 import {
   AgentPrepHandler,
   PermissionGateHandler,
   SessionLifecycleHandler,
   SessionTurnPrep,
 } from "./handlers";
-import { GateRunner } from "./handlers/gates/runner";
-import { SkillInputGatePipeline } from "./handlers/gates/skill-input-gate-pipeline";
-import { ToolCallGatePipeline } from "./handlers/gates/tool-call-gate-pipeline";
-import { createFailClosedToolCall } from "./handlers/tool-call-boundary";
-import { pathFlavorForPlatform } from "./path/path-flavor";
-import { PermissionManager } from "./permission-manager";
-import { PermissionResolver } from "./permission-resolver";
-import { PermissionSession } from "./permission-session";
-import { LocalPermissionsService } from "./permissions-service";
-import { resolveRenderBudget } from "./presentation/dialog-renderer";
 import { getPermissionsService, type PermissionsService } from "./service";
-import { PermissionServiceLifecycle } from "./service-lifecycle";
-import { PermissionSessionLogger } from "./session-logger";
-import { SessionRules } from "./session-rules";
-import { ToolAccessExtractorRegistry } from "./tool-access-extractor-registry";
-import { ToolInputFormatterRegistry } from "./tool-input-formatter-registry";
 
 export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const agentDir = getAgentDir();

package/src/{decision-reporter.ts → logging/decision-reporter.ts}

@@ -2,7 +2,7 @@ import {
   emitDecisionEvent,
   type PermissionDecisionEvent,
   type PermissionEventBus,
-} from "./permission-events";
+} from "#src/service/permission-events";
 import type { SessionLogger } from "./session-logger";
 
 /**

package/src/{logging.ts → logging/logging.ts}

@@ -3,7 +3,7 @@ import { appendFileSync } from "node:fs";
 import {
   EXTENSION_ID,
   type PermissionSystemExtensionConfig,
-} from "./extension-config";
+} from "#src/config/extension-config";
 import { capLogFieldWidths, resolveReviewLogFieldWidth } from "./log-field-cap";
 import {
   OWNER_ONLY_FILE_MODE,

package/src/{session-logger.ts → logging/session-logger.ts}

@@ -1,9 +1,12 @@
 import { join } from "node:path";
-import { DEBUG_LOG_FILENAME, REVIEW_LOG_FILENAME } from "./config-paths";
+import {
+  DEBUG_LOG_FILENAME,
+  REVIEW_LOG_FILENAME,
+} from "#src/config/config-paths";
 import {
   ensurePermissionSystemLogsDirectory,
   type PermissionSystemExtensionConfig,
-} from "./extension-config";
+} from "#src/config/extension-config";
 import {
   createPermissionSystemLogger,
   type PermissionSystemLogger,

package/src/path/approval-pattern.ts

@@ -1,4 +1,4 @@
-import type { PathFlavor } from "#src/path/path-flavor";
+import type { PathFlavor } from "./path-flavor";
 
 /**
  * Derive the wildcard glob to record when a user approves an accessed path for

package/src/path/canonicalize-path.ts

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 
-import type { PathFlavor } from "#src/path/path-flavor";
+import type { PathFlavor } from "./path-flavor";
 
 /**
  * Resolve symlinks in an absolute path, best-effort.

package/src/path/path-containment.ts

@@ -1,5 +1,5 @@
-import type { PathFlavor } from "#src/path/path-flavor";
-import { isSafeSystemPath } from "#src/safe-system-paths";
+import type { PathFlavor } from "./path-flavor";
+import { isSafeSystemPath } from "./safe-system-paths";
 
 /**
  * Pure geometry: is `canonicalPath` outside `canonicalCwd`?

package/src/path/path-flavor.ts

@@ -5,7 +5,7 @@ import {
   type BashTokenShape,
   classifyWin32BashToken,
 } from "#src/access-intent/bash/msys-bash-tokens";
-import type { WildcardMatchOptions } from "#src/wildcard-matcher";
+import type { WildcardMatchOptions } from "#src/policy/wildcard-matcher";
 
 /**
  * The resolved product of the single win32-vs-POSIX platform decision: the

package/src/{path-normalizer.ts → path/path-normalizer.ts}

@@ -1,16 +1,14 @@
 import { lstatSync } from "node:fs";
-
-import type { PathFlavor } from "#src/path/path-flavor";
-
-import { AccessPath } from "./access-intent/access-path";
+import { AccessPath } from "#src/access-intent/access-path";
 import {
   canonicalNormalizePathForComparison,
   normalizePathForComparison,
   normalizePathPolicyLiteral,
-} from "./access-intent/path-normalization";
-import { deriveApprovalPattern } from "./path/approval-pattern";
-import { isPathOutsideWorkingDirectory } from "./path/path-containment";
-import { isPiInfrastructureRead } from "./path/pi-infrastructure-read";
+} from "#src/access-intent/path-normalization";
+import { deriveApprovalPattern } from "./approval-pattern";
+import { isPathOutsideWorkingDirectory } from "./path-containment";
+import type { PathFlavor } from "./path-flavor";
+import { isPiInfrastructureRead } from "./pi-infrastructure-read";
 
 /**
  * The interpreted effect of a literal `cd` target on the effective base, under

package/src/path/pi-infrastructure-read.ts

@@ -1,8 +1,8 @@
 import { join } from "node:path";
 import { READ_ONLY_PATH_BEARING_TOOLS } from "#src/access-intent/path-surfaces";
-import { expandHomePath } from "#src/expand-home";
-import type { PathFlavor } from "#src/path/path-flavor";
-import { wildcardMatch } from "#src/wildcard-matcher";
+import { wildcardMatch } from "#src/policy/wildcard-matcher";
+import { expandHomePath } from "./expand-home";
+import type { PathFlavor } from "./path-flavor";
 
 function containsGlobChars(value: string): boolean {
   return value.includes("*") || value.includes("?");

package/src/{normalize.ts → policy/normalize.ts}

@@ -1,7 +1,7 @@
 import { surfaceFamilyMembers } from "#src/access-intent/path-surfaces";
+import type { FlatPermissionConfig, PatternValue } from "#src/types";
+import { isDenyWithReason, isPermissionState } from "#src/types";
 import type { Rule, Ruleset } from "./rule";
-import type { FlatPermissionConfig, PatternValue } from "./types";
-import { isDenyWithReason, isPermissionState } from "./types";
 
 /**
  * A surface's value in a flat permission config: a catch-all or a pattern map.

package/src/{permission-gate.ts → policy/permission-gate.ts}

@@ -1,6 +1,6 @@
-import type { SessionGrantWidth } from "#src/approval-grant";
 import type { DecisionSource } from "#src/authority/decision-source";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
+import type { SessionGrantWidth } from "#src/session/approval-grant";
 
 /**
  * Result of applying the permission gate.

package/src/{permission-manager.ts → policy/permission-manager.ts}

@@ -1,21 +1,30 @@
 import { join } from "node:path";
-import type { ResolvedAccessIntent } from "./access-intent/access-intent";
-import { normalizeInput } from "./access-intent/input-normalizer";
-import { PATH_SURFACES, surfaceFamilyOf } from "./access-intent/path-surfaces";
-import { classifyToolKind } from "./access-intent/tool-kind";
+import type { ResolvedAccessIntent } from "#src/access-intent/access-intent";
+import { normalizeInput } from "#src/access-intent/input-normalizer";
+import {
+  PATH_SURFACES,
+  surfaceFamilyOf,
+} from "#src/access-intent/path-surfaces";
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 import {
   getGlobalConfigPath,
   getProjectAgentsDir,
   getProjectConfigPath,
-} from "./config-paths";
-import { normalizeFlatConfig } from "./normalize";
-import { type PathFlavor, posixPathFlavor } from "./path/path-flavor";
+} from "#src/config/config-paths";
 import {
   FilePolicyLoader,
   type PolicyLoader,
   type PolicyLoaderOptions,
   type ResolvedPolicyPaths,
-} from "./policy-loader";
+} from "#src/config/policy-loader";
+import { type PathFlavor, posixPathFlavor } from "#src/path/path-flavor";
+import type {
+  FlatPermissionConfig,
+  PermissionCheckResult,
+  PermissionState,
+} from "#src/types";
+import { isPermissionState } from "#src/types";
+import { normalizeFlatConfig } from "./normalize";
 import type { Rule, RuleOrigin, Ruleset } from "./rule";
 import {
   evaluate,
@@ -31,12 +40,6 @@ import {
   synthesizeBaseline,
   synthesizeDefaults,
 } from "./synthesize";
-import type {
-  FlatPermissionConfig,
-  PermissionCheckResult,
-  PermissionState,
-} from "./types";
-import { isPermissionState } from "./types";
 
 const SPECIAL_PERMISSION_KEYS = new Set(["external_directory", "path"]);
 
@@ -448,4 +451,7 @@ function deriveSource(
 }
 
 // Re-export types that external modules import from this file.
-export type { PolicyLoader, ResolvedPolicyPaths } from "./policy-loader";
+export type {
+  PolicyLoader,
+  ResolvedPolicyPaths,
+} from "#src/config/policy-loader";

package/src/{permission-merge.ts → policy/permission-merge.ts}

@@ -1,4 +1,4 @@
-import type { FlatPermissionConfig } from "./types";
+import type { FlatPermissionConfig } from "#src/types";
 
 /**
  * Deep-shallow merge two flat permission configs.

package/src/{permission-resolver.ts → policy/permission-resolver.ts}

@@ -2,14 +2,14 @@ import type {
   AccessIntent,
   PathValuesAccessIntent,
   ResolvedAccessIntent,
-} from "./access-intent/access-intent";
-import { surfaceFamilyMembers } from "./access-intent/path-surfaces";
+} from "#src/access-intent/access-intent";
+import { surfaceFamilyMembers } from "#src/access-intent/path-surfaces";
+import type { SkillPermissionChecker } from "#src/exposure/skill-prompt-sanitizer";
+import type { SessionRules } from "#src/session/session-rules";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
 import type { ScopedPermissionManager } from "./permission-manager";
 import { mostRestrictiveOf } from "./restrictiveness";
 import type { Rule } from "./rule";
-import type { SessionRules } from "./session-rules";
-import type { SkillPermissionChecker } from "./skill-prompt-sanitizer";
-import type { PermissionCheckResult, PermissionState } from "./types";
 
 /**
  * Answers an {@link AccessIntent} a gate emits, applying the current session

package/src/{rule.ts → policy/rule.ts}

@@ -1,8 +1,7 @@
+import { PATH_SURFACES } from "#src/access-intent/path-surfaces";
+import { expandHomePath } from "#src/path/expand-home";
 import type { PathFlavor } from "#src/path/path-flavor";
-
-import { PATH_SURFACES } from "./access-intent/path-surfaces";
-import { expandHomePath } from "./expand-home";
-import type { PermissionState } from "./types";
+import type { PermissionState } from "#src/types";
 import { type WildcardMatchOptions, wildcardMatch } from "./wildcard-matcher";
 
 /**

package/src/{scope-merge.ts → policy/scope-merge.ts}

@@ -1,7 +1,7 @@
-import { expandDirectionalSugar } from "#src/normalize";
-import { mergeFlatPermissions } from "#src/permission-merge";
-import type { RuleOrigin } from "#src/rule";
 import type { FlatPermissionConfig, ScopeConfig } from "#src/types";
+import { expandDirectionalSugar } from "./normalize";
+import { mergeFlatPermissions } from "./permission-merge";
+import type { RuleOrigin } from "./rule";
 
 /** Surface → (pattern → originating scope). */
 type OriginMap = Map<string, Map<string, RuleOrigin>>;

package/src/{synthesize.ts → policy/synthesize.ts}

@@ -1,5 +1,5 @@
+import type { PermissionState } from "#src/types";
 import type { Rule, RuleOrigin, Ruleset } from "./rule";
-import type { PermissionState } from "./types";
 
 /**
  * Synthesize a single universal catch-all rule from the universal default.

package/src/{wildcard-matcher.ts → policy/wildcard-matcher.ts}

@@ -1,4 +1,4 @@
-import { expandHomePath } from "./expand-home";
+import { expandHomePath } from "#src/path/expand-home";
 
 /**
  * A pattern compiled once for repeated matching.

package/src/presentation/agent-renderer.ts

@@ -2,19 +2,19 @@ import {
   type DecisionSource,
   effectiveDecider,
 } from "#src/authority/decision-source";
-import { EXTENSION_ID } from "#src/extension-config";
-import { DEFAULT_RENDER_BUDGET } from "#src/presentation/dialog-renderer";
+import { EXTENSION_ID } from "#src/config/extension-config";
+import type { BashCommandContext } from "#src/types";
+import { DEFAULT_RENDER_BUDGET } from "./dialog-renderer";
 import {
   describeBashCommandContext,
   flaggedElementLabel,
   flaggedElements,
-} from "#src/presentation/fact-vocabulary";
+} from "./fact-vocabulary";
 import {
   allEvidence,
   findEvidence,
   type PromptPayload,
-} from "#src/presentation/prompt-payload";
-import type { BashCommandContext } from "#src/types";
+} from "./prompt-payload";
 
 /**
  * The agent-facing render of a refused permission ask (ADR 0011 §7).

package/src/presentation/dialog-renderer.ts

@@ -2,9 +2,9 @@ import {
   describeBashCommandContext,
   flaggedElements,
   valueLabel,
-} from "#src/presentation/fact-vocabulary";
-import { fitLinesToWidth } from "#src/presentation/line-fitting";
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+} from "./fact-vocabulary";
+import { fitLinesToWidth } from "./line-fitting";
+import type { PromptPayload } from "./prompt-payload";
 
 /**
  * Render a {@link PromptPayload} for a human deciding an ask (ADR 0011 §5).

package/src/presentation/fact-vocabulary.ts

@@ -1,8 +1,5 @@
-import {
-  allEvidence,
-  type PromptPayload,
-} from "#src/presentation/prompt-payload";
 import type { BashCommandContext } from "#src/types";
+import { allEvidence, type PromptPayload } from "./prompt-payload";
 
 /**
  * The render vocabulary shared by every renderer over a {@link PromptPayload}.

package/src/presentation/forwarded-ask-payload.ts

@@ -1,8 +1,5 @@
 import type { ForwardedPermissionRequest } from "#src/authority/permission-forwarding";
-import type {
-  PromptPayload,
-  PromptRequester,
-} from "#src/presentation/prompt-payload";
+import type { PromptPayload, PromptRequester } from "./prompt-payload";
 
 /**
  * Build the payload for an ask forwarded up from a subagent.

package/src/presentation/path-ask-payload.ts

@@ -1,8 +1,5 @@
-import type {
-  PromptEvidence,
-  PromptPayload,
-} from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
+import type { PromptEvidence, PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** A displayed external path paired with its resolved target, when distinct. */
 export interface ExternalPathDisclosure {

package/src/{pattern-suggest.ts → presentation/pattern-suggest.ts}

@@ -1,10 +1,13 @@
+import {
+  prefix,
+  stripBashCommentLines,
+} from "#src/access-intent/bash/bash-arity";
 import {
   type CapabilityDirection,
   PATH_BEARING_TOOLS,
   surfaceFamilyOf,
-} from "./access-intent/path-surfaces";
-import type { ApprovalGrant } from "./approval-grant";
-import { prefix, stripBashCommentLines } from "./bash-arity";
+} from "#src/access-intent/path-surfaces";
+import type { ApprovalGrant } from "#src/session/approval-grant";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {

package/src/{permission-prompts.ts → presentation/permission-prompts.ts}

@@ -1,4 +1,4 @@
-import { classifyToolKind } from "./access-intent/tool-kind";
+import { classifyToolKind } from "#src/access-intent/tool-kind";
 
 // NOTE: the ask prompts are now payload builders under src/presentation/, and
 // denial text is a render over the payload (presentation/agent-renderer.ts).

package/src/presentation/review-log-renderer.ts

@@ -1,4 +1,4 @@
-import type { PromptPayload } from "#src/presentation/prompt-payload";
+import type { PromptPayload } from "./prompt-payload";
 
 /**
  * The payload facts the permission review log persists (ADR 0011 §6).

package/src/presentation/skill-ask-payload.ts

@@ -1,6 +1,6 @@
-import type { PromptPayload } from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
-import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
+import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
+import type { PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** A request to load a skill. */
 export function buildSkillAskPayload(

package/src/presentation/tool-ask-payload.ts

@@ -1,12 +1,9 @@
 import { classifyToolKind, isMcpCheck } from "#src/access-intent/tool-kind";
-import type {
-  PromptEvidence,
-  PromptPayload,
-} from "#src/presentation/prompt-payload";
-import { localRequester } from "#src/presentation/prompt-payload";
-import type { ToolPreviewFormatter } from "#src/tool-preview-formatter";
+import type { ToolPreviewFormatter } from "#src/tool-input/tool-preview-formatter";
 import type { PermissionCheckResult } from "#src/types";
 import { getNonEmptyString, toRecord } from "#src/value-guards";
+import type { PromptEvidence, PromptPayload } from "./prompt-payload";
+import { localRequester } from "./prompt-payload";
 
 /** The facts the per-tool gate holds when it raises an ask. */
 export interface ToolAskFacts {

package/src/{bash-advisory-check.ts → service/bash-advisory-check.ts}

@@ -1,6 +1,6 @@
 import { parseBashCommandsSync } from "#src/access-intent/bash/sync-commands";
 import { resolveBashCommandCheck } from "#src/handlers/gates/bash-command";
-import type { ScopedPermissionResolver } from "#src/permission-resolver";
+import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import type { PermissionCheckResult } from "#src/types";
 
 /**

package/src/{permissions-service.ts → service/permissions-service.ts}

@@ -1,21 +1,21 @@
-import type { AccessIntent } from "./access-intent/access-intent";
-import { buildAccessIntentForSurface } from "./access-intent/input-normalizer";
-import type { Authorizer } from "./authority/authorizer";
-import type { AuthorizerRegistrar } from "./authority/authorizer-registry";
-import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
-import type { PathNormalizer } from "./path-normalizer";
-import type { PermissionsService } from "./service";
+import type { AccessIntent } from "#src/access-intent/access-intent";
+import { buildAccessIntentForSurface } from "#src/access-intent/input-normalizer";
+import type { Authorizer } from "#src/authority/authorizer";
+import type { AuthorizerRegistrar } from "#src/authority/authorizer-registry";
+import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { PermissionsService } from "#src/service";
 import type {
   ToolAccessExtractor,
   ToolAccessExtractorLookup,
   ToolAccessExtractorRegistrar,
-} from "./tool-access-extractor-registry";
+} from "#src/tool-input/tool-access-extractor-registry";
 import type {
   ToolInputFormatter,
   ToolInputFormatterLookup,
   ToolInputFormatterRegistrar,
-} from "./tool-input-formatter-registry";
-import type { PermissionCheckResult, PermissionState } from "./types";
+} from "#src/tool-input/tool-input-formatter-registry";
+import type { PermissionCheckResult, PermissionState } from "#src/types";
+import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
 
 /**
  * Resolution surface the service needs: answer a gate-style {@link AccessIntent}

package/src/{service-lifecycle.ts → service/service-lifecycle.ts}

@@ -1,13 +1,13 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { AdjudicationRole } from "./authority/authorizer-selection";
-import type { NodeIdentity } from "./authority/inherited-registrations";
-import { emitReadyEvent, type PermissionEventBus } from "./permission-events";
+import type { AdjudicationRole } from "#src/authority/authorizer-selection";
+import type { NodeIdentity } from "#src/authority/inherited-registrations";
 import {
   type PermissionsService,
   publishPermissionsService,
   unpublishPermissionsService,
-} from "./service";
-import { readSessionId } from "./session-identity";
+} from "#src/service";
+import { readSessionId } from "#src/session/session-identity";
+import { emitReadyEvent, type PermissionEventBus } from "./permission-events";
 
 /** The session-scoped service lifecycle that the lifecycle handler drives. */
 export interface ServiceLifecycle {