@gotgenes/pi-permission-system 33.0.3 → 33.0.5

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [33.0.5](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.4...pi-permission-system-v33.0.5) (2026-09-20)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** stop projecting an interpreter's inline script as a path ([f919704](https://github.com/gotgenes/pi-packages/commit/f919704d029d6cae6027f50ce89cc49d76f35358)), closes [#863](https://github.com/gotgenes/pi-packages/issues/863)
+
+### Documentation
+
+* **pi-permission-system:** record the interpreter script role in the roadmap and module tree ([630e29f](https://github.com/gotgenes/pi-packages/commit/630e29f2365fb1848a835078f5b28cb5462b0b94))
+
+## [33.0.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.3...pi-permission-system-v33.0.4) (2026-09-20)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** show a config warning present at session start ([65a59f7](https://github.com/gotgenes/pi-packages/commit/65a59f717fba9823cde171c9fbfdcd322dcc6ec7)), closes [#933](https://github.com/gotgenes/pi-packages/issues/933)
+
+### Documentation
+
+* **pi-permission-system:** declare non-Pi hosts a conditional non-goal ([b9d645c](https://github.com/gotgenes/pi-packages/commit/b9d645cdf39df10afe5493ca1817df3a1c99c527)), closes [#922](https://github.com/gotgenes/pi-packages/issues/922)
+* **pi-permission-system:** describe the config warning's delivery ([6a9024f](https://github.com/gotgenes/pi-packages/commit/6a9024f4db193f592a321a32c45979dedc2985e8)), closes [#933](https://github.com/gotgenes/pi-packages/issues/933)
+
 ## [33.0.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v33.0.2...pi-permission-system-v33.0.3) (2026-09-19)
 
 

package/README.md

@@ -183,6 +183,11 @@ Hardening the gates against bypass, fail-closed corrections (breaking ones inclu
 - _Model judgment in the core._
   This package makes no LLM call and holds no model config; model-assisted judging attaches as a chain link over the authorizer seam instead.
   A link decides nothing until you name it in `authorizerChain`, and its `allow` on an excluded surface is downgraded to `defer`.
+- _Supporting a non-Pi host._
+  Built and validated against Pi's extension API and no other: a fork that loads Pi extensions — [Oh My Pi](https://github.com/can1357/oh-my-pi) among them — diverges in payload shape, tool vocabulary, and approval authority, on its own release schedule.
+  Input that violates a contract this package already reads is hardened against anyway, because defensive normalization is correct whoever sent it.
+  Modeling a foreign host's semantics is not, because a guarantee that cannot be executed against is worse than a declined one.
+  This one is conditional rather than permanent — the architecture doc names the five conditions that would make a second host a goal.
 
 The [architecture doc](https://github.com/gotgenes/pi-packages/blob/main/packages/pi-permission-system/docs/architecture/architecture.md#scope-and-non-goals) carries the full inventory, with the decision record behind each entry.
 
@@ -194,6 +199,7 @@ The companion question — whether a capability model replaces the actor-keyed s
 **Where adjacent requests belong.**
 True isolation of a permitted action → an agent sandbox, which this package's scope decisions are exported to rather than duplicated in.
 Model-assisted judging of an `ask` → a chain link over the authorizer seam; [@gotgenes/pi-permission-model-judge](https://www.npmjs.com/package/@gotgenes/pi-permission-model-judge) is the first-party one, and judges mistyped paths.
+A non-Pi host's own payload shapes and tool formats → that host's Pi-compatibility layer, where one fix reaches every Pi extension at once instead of one.
 Approve-and-steer, edit diffs, and risk explanations → a downstream package over the `permissions:decision` event and the presentation seams.
 
 ## Documentation

package/docs/opencode-compatibility.md

@@ -118,6 +118,7 @@ For allowlisted commands, all non-flag positional arguments are assumed to be pa
 **This extension** extracts path candidates from all commands generically, then applies additional intelligence:
 
 - A `PATTERN_FIRST_COMMANDS` map understands flag arity for `sed`, `awk`, `grep`, `rg`, and similar tools, distinguishing inline patterns/scripts from file arguments to avoid false positives.
+  The same table reads an interpreter's inline script (`node -e`, `bun --eval`, `python3 -c`, `perl -e`, `ruby -e`) as a script rather than an operand, while leaving a script *file* (`node build.js`) an operand.
 - Redirect destinations (`> /path/to/file`) are extracted.
 - Heredoc bodies, comments, and variable assignments are skipped.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "33.0.3",
+  "version": "33.0.5",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/token-collection.ts

@@ -36,10 +36,11 @@ export interface PathToken {
  * {@link SKIP_SUBTREE_TYPES} check: `heredoc_body` is in both sets, and the
  * host reading is the one that must win.
  *
- * For commands in `PATTERN_FIRST_COMMANDS`, uses position-based
- * argument skipping to avoid collecting inline patterns/scripts
- * as path candidates. For all other commands, collects all
- * arguments generically.
+ * For commands in `PATTERN_FIRST_COMMANDS`, uses position- and role-based
+ * argument skipping to avoid collecting inline patterns/scripts as path
+ * candidates — a leading pattern positional for a matching tool, a
+ * `script`-role flag's argument for an interpreter. For all other commands,
+ * collects all arguments generically.
  */
 export function collectPathCandidateTokens(node: TSNode): PathToken[] {
   if (node.type === "command") return collectCommandTokens(node);
@@ -499,19 +500,124 @@ const SD_CONFIG: PatternCommandConfig = {
 };
 
 /**
- * Commands whose first N positional arguments are inline patterns/scripts,
- * not filesystem paths. The map stores per-command flag configuration so
- * the walker can correctly identify which arguments are consumed by flags
- * vs. which are positional.
+ * An interpreter takes its inline script from a flag and never from a leading
+ * positional, so `patternPositionals: 0` — `node build.js /tmp/x` names two
+ * real operands and no script.
+ *
+ * Verified by execution on macOS, 2026-09-20, node v26.9.0: `node -e`,
+ * `node --eval`, `node --eval='…'`, `node -p '1+1'` — `2`, and
+ * `node --print '2+2'` — `4` all run their argument as the program.
+ * `node -p t.js` evaluates `t.js` as *source* rather than running the file
+ * (`[eval]:1 / t.js / ^`), so `-p` consumes its argument unconditionally.
+ */
+const NODE_CONFIG: PatternCommandConfig = {
+  flags: new Map<string, PatternFlagRole>([
+    ["-e", "script"],
+    ["--eval", "script"],
+    ["-p", "script"],
+    ["--print", "script"],
+  ]),
+  patternPositionals: 0,
+};
+
+/**
+ * `bun` asserts the same four spellings as `node` and gets its own object
+ * rather than sharing one, because the table's rule is a shared *parser* and
+ * not a shared spelling — the two are different binaries (#823).
+ *
+ * Verified by execution, bun 1.4.2: `bun -e`, `bun --eval`, `bun -p '1+1'`
+ * — `2`, `bun --print '3+3'` — `6`; `bun -p` with no value errors
+ * `The argument '-p' requires a value but none was supplied.`, so it consumes
+ * unconditionally.
+ */
+const BUN_CONFIG: PatternCommandConfig = {
+  flags: new Map<string, PatternFlagRole>([
+    ["-e", "script"],
+    ["--eval", "script"],
+    ["-p", "script"],
+    ["--print", "script"],
+  ]),
+  patternPositionals: 0,
+};
+
+/**
+ * `python` and `python3` share one object because they are the same
+ * interpreter family: every implementation either name reaches is a
+ * CPython-compatible front end where `-c` takes the following argument.
+ *
+ * Verified by execution, python3 3.14.7: `python3 -c 'print("PC-OK")'`, and
+ * `python3 -cu 'print("x")'` raises from `File "<string>", line 1` — the
+ * glued `u` is evaluated as the script, which is the getopt semantics the
+ * existing glued-value rule already models. No `python` binary exists on the
+ * authoring host, so its row rests on the family argument rather than a run.
+ */
+const PYTHON_CONFIG: PatternCommandConfig = {
+  flags: new Map<string, PatternFlagRole>([["-c", "script"]]),
+  patternPositionals: 0,
+};
+
+/**
+ * Verified by execution, perl 5.34.1: `perl -e 'print "PE-OK\n"'` and
+ * `perl -E 'say "PE2-OK"'`; `perl -e` with nothing after it errors
+ * `No code specified for -e.`, so both consume unconditionally.
+ *
+ * `-p` and `-n` are deliberately absent. They take no argument of their own,
+ * and the cluster spelling that carries the script (`perl -pe 's|a|b|'`) is
+ * looked up as `-p` by the glued rule's `text.slice(0, 2)` — so listing `-p`
+ * would consume the following word on the *separated* spelling too and drop a
+ * real operand, the direction ADR 0009 forbids.
+ */
+const PERL_CONFIG: PatternCommandConfig = {
+  flags: new Map<string, PatternFlagRole>([
+    ["-e", "script"],
+    ["-E", "script"],
+  ]),
+  patternPositionals: 0,
+};
+
+/**
+ * Verified by execution, ruby 4.0.7: `ruby -e 'puts "RE-OK"'`.
+ *
+ * `-E` is deliberately **not** listed, though `perl` lists it: on `ruby` it is
+ * `--encoding`, not a script flag. `ruby -E utf-8 -e 'puts "RE2-OK"'` runs,
+ * proving `-E` consumed `utf-8` and left the script to `-e`. Leaving it
+ * unlisted over-surfaces `utf-8` as a token that names nothing, which the
+ * existence probe discards — the recoverable direction.
+ */
+const RUBY_CONFIG: PatternCommandConfig = {
+  flags: new Map<string, PatternFlagRole>([["-e", "script"]]),
+  patternPositionals: 0,
+};
+
+/**
+ * Commands whose leading positional arguments are inline patterns/scripts
+ * rather than filesystem paths, and commands whose inline script arrives
+ * through a flag. The map stores per-command flag configuration so the walker
+ * can identify which arguments a flag consumes and which are positional.
+ *
+ * Two classes share the table because they share the question. A pattern-first
+ * *matching* tool (`sed`, `grep`, `rg`) leads with a pattern and skips one or
+ * two positionals; an **interpreter** (`node`, `bun`, `python`, `perl`,
+ * `ruby`) leads with nothing and skips none, so its script can only ever
+ * arrive through a `script`-role flag and a script *file* stays an operand
+ * (#863).
  *
  * Names share a configuration object only when they share a *parser*, which is
  * narrower than being aliases: `egrep`/`fgrep` are the same binary as `grep`
  * here, and `nawk` is one-true-awk like `awk` — but `gawk` has its own config,
  * because it is the only one of the three that certainly means GNU awk and so
  * the only one whose long options certainly consume (#823).
+ * `node` and `bun` split for the same reason from the other direction: they
+ * assert identical spellings and are different binaries.
  */
 const PATTERN_FIRST_COMMANDS: ReadonlyMap<string, PatternCommandConfig> =
   new Map([
+    ["node", NODE_CONFIG],
+    ["bun", BUN_CONFIG],
+    ["python", PYTHON_CONFIG],
+    ["python3", PYTHON_CONFIG],
+    ["perl", PERL_CONFIG],
+    ["ruby", RUBY_CONFIG],
     ["sed", SED_CONFIG],
     ["awk", AWK_CONFIG],
     ["gawk", GAWK_CONFIG],

package/src/config/config-issue-reporter.ts

@@ -0,0 +1,60 @@
+/**
+ * config-issue-reporter.ts — Tell the operator what is wrong with their config,
+ * once per issue, for as long as it is wrong.
+ *
+ * `ConfigStore` loads and answers; this decides whether the operator has
+ * already heard it. Splitting the two is what fixes #933: the store was primed
+ * at factory time, with no context to notify through, and recorded the warning
+ * as delivered anyway — so the identical warning at `session_start` was deduped
+ * away and every config issue reached the debug log alone.
+ *
+ * Delivery goes through the injected `warn` seam rather than a ctx parameter.
+ * That seam is `SessionLogger.warn`, which reaches the operator through
+ * `PermissionSession.notify` and the context the session owns — the same path
+ * every other session-lifecycle warning in this package takes. A reporter
+ * cannot be handed a context that does not exist, which is the whole point.
+ *
+ * The latch is per issue and the delivery is per report: a config with three
+ * detector hits produces one notification, and a later report announces only
+ * what is new. `reported` is *replaced* on every report rather than added to,
+ * so an issue the operator fixed and then reintroduced is announced again —
+ * which preserves the clearing behavior the store's single-string dedupe had,
+ * at per-issue granularity.
+ *
+ * Driven at both moments the operator is reachable: `session_start`, and every
+ * `before_agent_start` (the config is re-read there, so an issue created
+ * mid-session is caught on the next turn).
+ */
+
+/** The config seam this reads (ISP): the issues current as of the last load. */
+export interface ConfigIssueSource {
+  getConfigIssues(): readonly string[];
+}
+
+/** The log seam this writes (ISP): one operator-facing warning. */
+export interface ConfigIssueWarner {
+  warn(message: string): void;
+}
+
+/** The seam the session-start and turn-prep handlers drive. */
+export interface ConfigIssueReporting {
+  report(): void;
+}
+
+export class ConfigIssueReporter implements ConfigIssueReporting {
+  private reported: ReadonlySet<string> = new Set();
+
+  constructor(
+    private readonly source: ConfigIssueSource,
+    private readonly log: ConfigIssueWarner,
+  ) {}
+
+  report(): void {
+    const current = this.source.getConfigIssues();
+    const unreported = current.filter((issue) => !this.reported.has(issue));
+    if (unreported.length > 0) {
+      this.log.warn(unreported.join("\n"));
+    }
+    this.reported = new Set(current);
+  }
+}

package/src/config/config-loader.ts

@@ -468,11 +468,9 @@ export function detectDeprecatedPreviewCaps(
  * make a display preference a policy event. The decision keeps its default
  * letter, and the message names the entry, the reason, and the letter kept.
  *
- * Where that message surfaces is the caller's problem and is currently a narrow
- * one: `ConfigStore` dedupes against a warning recorded by a factory-time
- * refresh with no ctx to notify, so an issue already on disk reaches the debug
- * log alone. That predates this detector and swallows its two siblings the same
- * way (#933).
+ * Where that message surfaces is the caller's problem: `ConfigIssueReporter`
+ * warns it at session start and on any turn whose refresh first finds it,
+ * latched per issue so a persisting one is not repeated (#933).
  *
  * Pure, following {@link detectPermissiveBashFallback}: it takes the merged
  * config and returns a message; the caller owns pushing it onto the issue list.

package/src/config/config-store.ts

@@ -6,11 +6,9 @@ import {
   writeFileSync,
 } from "node:fs";
 import { dirname, normalize } from "node:path";
-import type {
-  ExtensionCommandContext,
-  ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
+import type { ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import type { DebugReviewLogger } from "#src/logging/session-logger";
+import type { ConfigIssueSource } from "./config-issue-reporter";
 import { loadAndMergeConfigs, loadUnifiedConfig } from "./config-loader";
 import {
   getGlobalConfigPath,
@@ -40,7 +38,7 @@ export interface ConfigReader {
  * coupling between the class and test doubles.
  */
 export interface SessionConfigStore extends ConfigReader {
-  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void;
+  refresh(cwd: string | undefined, projectTrusted: boolean): void;
   logResolvedPaths(cwd?: string): void;
 }
 
@@ -73,14 +71,17 @@ export interface ConfigStoreDeps {
  *
  * Replaces the three `(runtime, …)` config free functions
  * (`refreshExtensionConfig`, `saveExtensionConfig`, `logResolvedConfigPaths`)
- * with methods that privately own `config` and `lastConfigWarning`.
+ * with methods that privately own `config` and the issue list the last load
+ * produced.
  *
  * Implements {@link ConfigReader} so consumers that only read the current config
  * can depend on the narrow interface rather than the full class.
  */
-export class ConfigStore implements SessionConfigStore, CommandConfigStore {
+export class ConfigStore
+  implements SessionConfigStore, CommandConfigStore, ConfigIssueSource
+{
   private config: PermissionSystemExtensionConfig;
-  private lastConfigWarning: string | null = null;
+  private configIssues: readonly string[] = [];
 
   constructor(private readonly deps: ConfigStoreDeps) {
     this.config = { ...DEFAULT_EXTENSION_CONFIG };
@@ -91,16 +92,39 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
     return this.config;
   }
 
+  /**
+   * What is wrong with the config as of the last {@link refresh}.
+   *
+   * Every issue `loadAndMergeConfigs` collects: a legacy-file notice, a zod
+   * field violation, and the cross-cutting detectors (a permissive bash
+   * fallback, a deprecated preview cap, a refused dialog-key binding).
+   *
+   * This store answers; `ConfigIssueReporter` decides whether the operator has
+   * heard it yet (#933). Not to be confused with
+   * `PermissionResolver.getConfigIssues(agentName?)`, which answers for the
+   * *policy* files rather than the extension config.
+   */
+  getConfigIssues(): readonly string[] {
+    return this.configIssues;
+  }
+
   /**
    * Reload merged config from disk.
    *
-   * If `ctx` is provided, uses it to derive the cwd and sync UI status.
+   * `cwd` scopes the project-level lookup; omit it when no session cwd is
+   * known yet (the factory-time priming load).
    * When `projectTrusted` is `false`, the project scope is withheld so an
    * untrusted repository's runtime config (`yoloMode`, `permissionReviewLog`,
    * …) cannot loosen the operator's global config (#644).
+   *
+   * Takes no `ExtensionContext` on purpose: a load that holds one acquires UI
+   * side effects it cannot honor when there is no session yet, which is how a
+   * config warning came to be recorded as delivered without being shown
+   * (#933). `PermissionSession.refreshConfig` syncs the status bar and
+   * `ConfigIssueReporter` tells the operator; this reads files and answers
+   * questions about them.
    */
-  refresh(ctx: ExtensionContext | undefined, projectTrusted: boolean): void {
-    const cwd = ctx?.cwd ?? null;
+  refresh(cwd: string | undefined, projectTrusted: boolean): void {
     const mergeResult = loadAndMergeConfigs(
       this.deps.agentDir,
       cwd ?? "",
@@ -110,20 +134,11 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
     const runtimeConfig = normalizePermissionSystemConfig(mergeResult.merged);
     this.config = runtimeConfig;
 
-    if (ctx?.hasUI) {
-      syncPermissionSystemStatus(ctx, runtimeConfig);
-    }
+    this.configIssues = mergeResult.issues;
 
     const warning =
       mergeResult.issues.length > 0 ? mergeResult.issues.join("\n") : undefined;
 
-    if (warning && warning !== this.lastConfigWarning) {
-      this.lastConfigWarning = warning;
-      ctx?.ui.notify(warning, "warning");
-    } else if (!warning) {
-      this.lastConfigWarning = null;
-    }
-
     this.deps.logger.debug("config.loaded", {
       warning: warning ?? null,
       debugLog: runtimeConfig.debugLog,
@@ -177,7 +192,6 @@ export class ConfigStore implements SessionConfigStore, CommandConfigStore {
 
     this.config = normalized;
     syncPermissionSystemStatus(ctx, normalized);
-    this.lastConfigWarning = null;
 
     this.deps.logger.debug("config.saved", {
       debugLog: normalized.debugLog,

package/src/handlers/lifecycle.ts

@@ -1,4 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ConfigIssueReporting } from "#src/config/config-issue-reporter";
 import { PERMISSION_SYSTEM_STATUS_KEY } from "#src/config/status";
 import type { DecisionSummaryWriter } from "#src/logging/decision-audit";
 import type { SessionLogger } from "#src/logging/session-logger";
@@ -36,6 +37,9 @@ export const UNTRUSTED_PROJECT_MESSAGE =
  *   the ready event; `teardown` unsubscribes all session listeners and unpublishes
  * - `logger` — injected directly; replaces the former `session.logger` reach-through
  * - `audit` — per-session decision counters; its summary is written on shutdown
+ * - `configIssues` — reports what is wrong with the extension config, latched
+ *   per issue; driven here and on every turn, so an issue already on disk when
+ *   the session opens is shown rather than swallowed (#933)
  */
 export class SessionLifecycleHandler {
   constructor(
@@ -44,6 +48,7 @@ export class SessionLifecycleHandler {
     private readonly serviceLifecycle: ServiceLifecycle,
     private readonly logger: SessionLogger,
     private readonly audit: DecisionSummaryWriter,
+    private readonly configIssues: ConfigIssueReporting,
   ) {}
 
   handleSessionStart(
@@ -51,9 +56,16 @@ export class SessionLifecycleHandler {
     ctx: ExtensionContext,
   ): Promise<void> {
     const projectTrusted = ctx.isProjectTrusted();
-    this.session.refreshConfig(ctx, projectTrusted);
+    // Reset first: it activates the session, binding the context that
+    // `PermissionSession.notify` — and therefore `logger.warn` — delivers
+    // through. A refresh before activation has no UI to report into, which is
+    // how a config warning present at session start went unseen (#933).
     this.session.resetForNewSession(ctx, projectTrusted);
+    this.session.refreshConfig(ctx, projectTrusted);
     this.session.logResolvedConfigPaths();
+    // The config was just re-read above, and the session is activated, so a
+    // warning has a UI to reach.
+    this.configIssues.report();
     if (!projectTrusted) {
       this.warnProjectUntrusted(ctx, "session_start");
     }

package/src/handlers/session-turn-prep.ts

@@ -1,4 +1,5 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { ConfigIssueReporting } from "#src/config/config-issue-reporter";
 import type { ReadyAnnouncer } from "#src/service/service-lifecycle";
 
 /** The session surface the turn-prep routine drives. */
@@ -27,6 +28,9 @@ export interface TurnPreparation {
  * - `warmParser` — warms the tree-sitter parser so the synchronous advisory
  *   bash path can decompose at gate parity; `before_agent_start` precedes any
  *   tool call, so triggering it here closes the pre-warm window (#309)
+ * - `configIssues` — reports what the config refresh found, latched per issue,
+ *   so an issue the operator created mid-session is shown on the next turn
+ *   without an unchanged one being repeated every turn (#933)
  * - `readyAnnouncer` — re-announces `permissions:ready` once per session
  *   (ADR 0012 decision 3); `before_agent_start` runs after every extension's
  *   `session_start` and before any ask, so a consumer that registers from the
@@ -37,6 +41,7 @@ export class SessionTurnPrep implements TurnPreparation {
     private readonly session: TurnPrepSession,
     private readonly warmParser: () => void,
     private readonly readyAnnouncer: ReadyAnnouncer,
+    private readonly configIssues: ConfigIssueReporting,
   ) {}
 
   prepare(ctx: ExtensionContext): void {
@@ -50,6 +55,10 @@ export class SessionTurnPrep implements TurnPreparation {
     // right before agent start after session_start withheld it (#644). The
     // session_start handler already warned; do not re-warn on every start.
     this.session.refreshConfig(ctx, ctx.isProjectTrusted());
+    // Say what that refresh found, before the announce below hands this node
+    // to a consumer: the operator hears about a config they just broke on the
+    // next turn, and hears an unchanged issue only once.
+    this.configIssues.report();
     // Announce last: the node is up to date for the turn, so a consumer that
     // resolves the service in its ready handler queries current policy. The
     // once-per-session guard lives in the announcer, not here.

package/src/index.ts

@@ -33,6 +33,7 @@ import {
 import { SubagentDetection } from "#src/authority/subagent-detection";
 import { subscribeSubagentLifecycle } from "#src/authority/subagent-lifecycle-events";
 import { getSubagentSessionRegistry } from "#src/authority/subagent-registry";
+import { ConfigIssueReporter } from "#src/config/config-issue-reporter";
 import { registerPermissionSystemCommand } from "#src/config/config-modal";
 import { getGlobalConfigPath } from "#src/config/config-paths";
 import { ConfigStore } from "#src/config/config-store";
@@ -236,8 +237,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // refresh() must run after `session` is assigned: a debug-write IO failure
   // triggers the logger's notify sink — `session.notify(m)` — which no-ops
   // on the null context but requires `session` to be bound.
-  // No ctx/trust decision exists at factory init, so withhold the project
-  // scope (fail closed); session_start reloads with the real trust decision.
+  // No cwd or trust decision exists at factory init, so there is no project
+  // scope to withhold from (fail closed); session_start reloads with the real
+  // cwd and trust decision. This load reports nothing to the operator: it
+  // cannot, and it used to consume the warning by pretending it had (#933).
   configStore.refresh(undefined, false);
 
   const configPath = getGlobalConfigPath(agentDir);
@@ -305,12 +308,19 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   };
 
   const audit = new DecisionAudit();
+  // Reads the store's issue list and tells the operator what is new, through
+  // the logger's warn sink rather than a ctx parameter — which is what the
+  // factory-time priming refresh lacked, so every config issue already on disk
+  // was recorded as delivered and never shown (#933). Driven at session_start
+  // and on every turn; the latch keeps an unchanged issue quiet.
+  const configIssueReporter = new ConfigIssueReporter(configStore, logger);
   const lifecycle = new SessionLifecycleHandler(
     session,
     resolver,
     serviceLifecycle,
     logger,
     audit,
+    configIssueReporter,
   );
   const turnPrep = new SessionTurnPrep(
     session,
@@ -318,6 +328,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       void warmBashParser();
     },
     serviceLifecycle,
+    configIssueReporter,
   );
   const agentPrep = new AgentPrepHandler(
     turnPrep,

package/src/session/permission-session.ts

@@ -5,6 +5,7 @@ import type { ShellToolsConfig } from "#src/config/config-schema";
 import type { SessionConfigStore } from "#src/config/config-store";
 import type { PermissionSystemExtensionConfig } from "#src/config/extension-config";
 import type { ExtensionPaths } from "#src/config/extension-paths";
+import { syncPermissionSystemStatus } from "#src/config/status";
 import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
 import {
   ToolSurfaceBaseline,
@@ -202,15 +203,25 @@ export class PermissionSession implements ToolCallGateInputs {
   // ── Config ─────────────────────────────────────────────────────────────
 
   /**
-   * Reload merged config from disk; optionally update the stored runtime
-   * context. When `projectTrusted` is `false`, the project scope is withheld
-   * so an untrusted project's runtime config is not merged (#644).
+   * Reload merged config from disk, then bring the status bar in step with it.
+   *
+   * When `projectTrusted` is `false`, the project scope is withheld so an
+   * untrusted project's runtime config is not merged (#644).
+   *
+   * The status sync lives here rather than in `ConfigStore` because it is a UI
+   * side effect of the session, keyed on the session's context: the store
+   * loads and answers, and needs no ctx to do it (#933). Both drivers
+   * (`session_start` and every `before_agent_start`) call this one method, so
+   * the sync has a single home rather than one copy per handler.
    */
   refreshConfig(
     ctx: ExtensionContext | undefined,
     projectTrusted: boolean,
   ): void {
-    this.configStore.refresh(ctx, projectTrusted);
+    this.configStore.refresh(ctx?.cwd, projectTrusted);
+    if (ctx?.hasUI) {
+      syncPermissionSystemStatus(ctx, this.configStore.current());
+    }
   }
 
   /** Write the resolved config path set to the review and debug logs. */