@gotgenes/pi-permission-system 38.0.2 → 39.0.1

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [39.0.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v39.0.0...pi-permission-system-v39.0.1) (2026-10-03)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** label two paths that share one session glob by that glob ([3ebe54f](https://github.com/gotgenes/pi-packages/commit/3ebe54fc5dd1d7900dfe4927f923e0f223dcb65c)), closes [#989](https://github.com/gotgenes/pi-packages/issues/989)
+* **pi-permission-system:** scope a directory's session approval to that directory, not its parent ([a0bcf97](https://github.com/gotgenes/pi-packages/commit/a0bcf979e1e4bdb8b0c1cf9575432cc6e3ce4525)), closes [#989](https://github.com/gotgenes/pi-packages/issues/989)
+* **pi-permission-system:** name the session-approval scope in a path ask that proves no direction ([483a1ef](https://github.com/gotgenes/pi-packages/commit/483a1ef951dc8c4677a9e02e94c5ce7487535cdf)), closes [#989](https://github.com/gotgenes/pi-packages/issues/989)
+
+### Documentation
+
+* **pi-permission-system:** document directory-scoped session approvals ([402cdf7](https://github.com/gotgenes/pi-packages/commit/402cdf721eb628a4eea926e3310acf1f1e07c8df)), closes [#989](https://github.com/gotgenes/pi-packages/issues/989)
+
+## [39.0.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v38.0.2...pi-permission-system-v39.0.0) (2026-10-03)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** **breaking:** a targeted external_directory deny now blocks a Pi infrastructure read ([5c9dc88](https://github.com/gotgenes/pi-packages/commit/5c9dc88f57a68fe87ade2da50ad613b9b9fdcb82)), closes [#955](https://github.com/gotgenes/pi-packages/issues/955)
+* **pi-permission-system:** **breaking:** the Pi infrastructure read bypass no longer covers the permission logs ([0ad3434](https://github.com/gotgenes/pi-packages/commit/0ad34344fb035211adc29317201d6f00cd8c7a76)), closes [#955](https://github.com/gotgenes/pi-packages/issues/955)
+* **pi-permission-system:** **breaking:** the Pi infrastructure read bypass covers only Pi's harness entries, not all of ~/.pi/agent ([7826794](https://github.com/gotgenes/pi-packages/commit/7826794820b0a93257597b4cd14cd36de4193e84)), closes [#955](https://github.com/gotgenes/pi-packages/issues/955)
+
+### Documentation
+
+* **pi-permission-system:** document the narrowed Pi infrastructure read bypass ([7cdfb8f](https://github.com/gotgenes/pi-packages/commit/7cdfb8fb9222bc8917aaa057cc0106d5c6806030)), closes [#955](https://github.com/gotgenes/pi-packages/issues/955)
+
 ## [38.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v38.0.1...pi-permission-system-v38.0.2) (2026-10-02)
 
 

package/README.md

@@ -222,23 +222,24 @@ Approve-and-steer, edit diffs, and risk explanations → a downstream package ov
 
 ## Documentation
 
-| Document                                                                                                                       | Contents                                                                                                             |
-| ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------- |
-| [docs/configuration.md](docs/configuration.md)                                                                                 | Full policy reference, runtime knobs, per-agent overrides, recipes                                                   |
-| [docs/session-approvals.md](docs/session-approvals.md)                                                                         | Session-scoped rules, pattern suggestions, bash arity table                                                          |
-| [docs/cross-extension-api.md](docs/cross-extension-api.md)                                                                     | Cross-extension service accessor, event bus integration, prompt and decision broadcasts                              |
-| [docs/subagent-integration.md](docs/subagent-integration.md)                                                                   | The subagent adapter convention, permission forwarding, coexistence with subagent extensions                         |
-| [docs/guides/permission-frontmatter-for-subagent-extensions.md](docs/guides/permission-frontmatter-for-subagent-extensions.md) | Convention guide for subagent extension authors                                                                      |
-| [docs/opencode-compatibility.md](docs/opencode-compatibility.md)                                                               | OpenCode compatibility — shared concepts, divergences, porting guide                                                 |
-| [docs/troubleshooting.md](docs/troubleshooting.md)                                                                             | Common issues, diagnostic logging, threat model                                                                      |
-| [docs/migration/legacy-to-flat.md](docs/migration/legacy-to-flat.md)                                                           | Migration from pre-v2 config layout                                                                                  |
-| [docs/migration/strict-config-validation.md](docs/migration/strict-config-validation.md)                                       | Strict config validation (breaking) — rejected configs, and the cross-scope fail-closed clamp                        |
-| [docs/migration/0644-project-trust-gating.md](docs/migration/0644-project-trust-gating.md)                                     | Project-trust gating (breaking) — project config loads only after project trust                                      |
-| [docs/migration/0745-prompt-payload-contracts.md](docs/migration/0745-prompt-payload-contracts.md)                             | Prompt payload contracts (breaking) — the forwarded wire, the `ui_prompt` broadcast, and the deprecated preview caps |
-| [docs/migration/0746-review-log-fields.md](docs/migration/0746-review-log-fields.md)                                           | Review-log fields (breaking) — `message` replaced by request facts, and the `reviewLogFieldMaxWidth` bound           |
-| [docs/migration/0794-keyed-service-locator.md](docs/migration/0794-keyed-service-locator.md)                                   | Keyed service locator (breaking) — `getPermissionsService(sessionId)`, and the repeating ready event                 |
-| [docs/migration/0796-remove-process-root-slot.md](docs/migration/0796-remove-process-root-slot.md)                             | Process-root slot removed (breaking) — `getRootPermissionsService()` and its publish/unpublish pair are gone         |
-| [docs/migration/0810-per-pattern-approval-surfaces.md](docs/migration/0810-per-pattern-approval-surfaces.md)                   | Per-pattern approval surfaces (breaking) — `ForwardedSessionApproval.grants` replaces `surface` + `patterns`         |
+| Document                                                                                                                       | Contents                                                                                                                                    |
+| ------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| [docs/configuration.md](docs/configuration.md)                                                                                 | Full policy reference, runtime knobs, per-agent overrides, recipes                                                                          |
+| [docs/session-approvals.md](docs/session-approvals.md)                                                                         | Session-scoped rules, pattern suggestions, bash arity table                                                                                 |
+| [docs/cross-extension-api.md](docs/cross-extension-api.md)                                                                     | Cross-extension service accessor, event bus integration, prompt and decision broadcasts                                                     |
+| [docs/subagent-integration.md](docs/subagent-integration.md)                                                                   | The subagent adapter convention, permission forwarding, coexistence with subagent extensions                                                |
+| [docs/guides/permission-frontmatter-for-subagent-extensions.md](docs/guides/permission-frontmatter-for-subagent-extensions.md) | Convention guide for subagent extension authors                                                                                             |
+| [docs/opencode-compatibility.md](docs/opencode-compatibility.md)                                                               | OpenCode compatibility — shared concepts, divergences, porting guide                                                                        |
+| [docs/troubleshooting.md](docs/troubleshooting.md)                                                                             | Common issues, diagnostic logging, threat model                                                                                             |
+| [docs/migration/legacy-to-flat.md](docs/migration/legacy-to-flat.md)                                                           | Migration from pre-v2 config layout                                                                                                         |
+| [docs/migration/strict-config-validation.md](docs/migration/strict-config-validation.md)                                       | Strict config validation (breaking) — rejected configs, and the cross-scope fail-closed clamp                                               |
+| [docs/migration/0644-project-trust-gating.md](docs/migration/0644-project-trust-gating.md)                                     | Project-trust gating (breaking) — project config loads only after project trust                                                             |
+| [docs/migration/0745-prompt-payload-contracts.md](docs/migration/0745-prompt-payload-contracts.md)                             | Prompt payload contracts (breaking) — the forwarded wire, the `ui_prompt` broadcast, and the deprecated preview caps                        |
+| [docs/migration/0746-review-log-fields.md](docs/migration/0746-review-log-fields.md)                                           | Review-log fields (breaking) — `message` replaced by request facts, and the `reviewLogFieldMaxWidth` bound                                  |
+| [docs/migration/0794-keyed-service-locator.md](docs/migration/0794-keyed-service-locator.md)                                   | Keyed service locator (breaking) — `getPermissionsService(sessionId)`, and the repeating ready event                                        |
+| [docs/migration/0796-remove-process-root-slot.md](docs/migration/0796-remove-process-root-slot.md)                             | Process-root slot removed (breaking) — `getRootPermissionsService()` and its publish/unpublish pair are gone                                |
+| [docs/migration/0810-per-pattern-approval-surfaces.md](docs/migration/0810-per-pattern-approval-surfaces.md)                   | Per-pattern approval surfaces (breaking) — `ForwardedSessionApproval.grants` replaces `surface` + `patterns`                                |
+| [docs/migration/0955-pi-infrastructure-read-narrowed.md](docs/migration/0955-pi-infrastructure-read-narrowed.md)               | Pi infrastructure reads narrowed (breaking): only Pi's harness entries under `~/.pi/agent/`, never the logs, and a targeted deny now blocks |
 
 ## Development
 

package/docs/configuration.md

@@ -850,15 +850,22 @@ For `external_directory`, the decision of whether a path is outside the working
 
 #### Pi Infrastructure Read Auto-Allow
 
-Read-only tools (`read`, `find`, `grep`, `ls`) targeting Pi infrastructure directories are automatically allowed without triggering the gate, even when `external_directory` is `ask` or `deny`.
-Infrastructure directories include:
-
-1. The agent config directory (`~/.pi/agent/` or `$PI_CODING_AGENT_DIR`)
-2. Git-cloned global packages (`<agentDir>/git/`)
-3. The global `node_modules` root (auto-discovered from the extension's own install path; falls back to `npm root -g` when running from a local development checkout)
-4. Pi's own install directory (auto-discovered via the coding-agent `getPackageDir()` API, so Pi's bundled docs and examples are readable regardless of install layout)
-5. Project-local Pi packages (`<cwd>/.pi/npm/` and `<cwd>/.pi/git/`)
-6. Any paths listed in `piInfrastructureReadPaths`
+Read-only tools (`read`, `find`, `grep`, `ls`) targeting Pi infrastructure paths are automatically allowed without triggering the gate, even when `external_directory` is `ask` or a catch-all `deny`.
+Infrastructure paths include:
+
+1. Pi's harness entries under the agent config directory (`~/.pi/agent/` or `$PI_CODING_AGENT_DIR`): the directories `agents/`, `extensions/`, `git/`, `npm/`, `prompts/`, `skills/`, and `themes/`, and the files `settings.json`, `SYSTEM.md`, `APPEND_SYSTEM.md`, and `AGENTS.md`
+2. The global `node_modules` root (auto-discovered from the extension's own install path; falls back to `npm root -g` when running from a local development checkout)
+3. Pi's own install directory (auto-discovered via the coding-agent `getPackageDir()` API, so Pi's bundled docs and examples are readable regardless of install layout)
+4. Project-local Pi packages (`<cwd>/.pi/npm/` and `<cwd>/.pi/git/`)
+5. Any paths listed in `piInfrastructureReadPaths`
+
+Everything else under the agent config directory, such as `auth.json`, `models.json`, `mcp-oauth/`, and `sessions/`, goes through the gate like any other outside path.
+This package's own logs directory (`extensions/pi-permission-system/logs/`) is never auto-allowed, even when a `piInfrastructureReadPaths` entry covers it.
+
+A deny rule on `external_directory` or `external_directory_read` whose pattern names an infrastructure path outranks the auto-allow and blocks the read.
+A catch-all `"*"` deny and the universal `permission["*"]` fallback do not, so a deny-by-default policy keeps its skill and package reads.
+Rules are last-match-wins, so write the catch-all before the targeted deny.
+See [the migration guide](migration/0955-pi-infrastructure-read-narrowed.md) for the change from earlier releases.
 
 Write tools (`write`, `edit`) to infrastructure paths are **not** auto-allowed and still go through the gate.
 

package/docs/migration/0955-pi-infrastructure-read-narrowed.md

@@ -0,0 +1,74 @@
+# Migration guide: the Pi infrastructure read bypass is narrowed
+
+Read-only tools (`read`, `find`, `grep`, `ls`) skip the `external_directory` gate for Pi infrastructure paths.
+Before this change, that bypass covered **everything** under `~/.pi/agent/` (or `$PI_CODING_AGENT_DIR`), including the credential store, and it ran before policy was consulted, so no `external_directory` rule could stop it.
+
+This is a **breaking change** in three ways, each taking effect on upgrade with no config edit.
+
+## What changes
+
+### Only Pi's harness entries stay auto-allowed
+
+The bypass now covers only these entries under `~/.pi/agent/`:
+
+- the directories `agents/`, `extensions/`, `git/`, `npm/`, `prompts/`, `skills/`, and `themes/`;
+- the files `settings.json`, `SYSTEM.md`, `APPEND_SYSTEM.md`, and `AGENTS.md`.
+
+Everything else there now goes through the `external_directory_read` gate like any other outside path.
+That includes `auth.json`, `models.json`, `mcp.json`, `mcp-oauth/`, `trust.json`, `sessions/`, `subagent-sessions/`, `bin/`, and crash logs.
+
+The global `node_modules` root, Pi's own install directory, project-local `.pi/npm/` and `.pi/git/`, and `piInfrastructureReadPaths` entries are unchanged.
+
+### This package's logs are never auto-allowed
+
+`~/.pi/agent/extensions/pi-permission-system/logs/` holds the review and debug logs, which record tool input.
+It sits inside `extensions/`, but the bypass now excludes it, even when a `piInfrastructureReadPaths` entry covers it.
+
+### A deny naming an infrastructure path now blocks
+
+Policy is resolved before the bypass.
+A deny from an `external_directory` or `external_directory_read` rule whose pattern names the path now blocks the read.
+A catch-all `"*"` deny, the universal `permission["*"]` fallback, and any `ask` still leave the bypass in place, so a deny-by-default policy keeps its skill and package reads.
+
+## Before and after
+
+Each row is a `read` of the named path under `~/.pi/agent/`.
+
+| Policy                                                                    | Path                       | Before  | After       |
+| ------------------------------------------------------------------------- | -------------------------- | ------- | ----------- |
+| `"external_directory_read": {"*": "deny"}`                                | `auth.json`                | allowed | **denied**  |
+| `"external_directory_read": {"*": "deny"}`                                | `sessions/<id>.jsonl`      | allowed | **denied**  |
+| `"external_directory_read": {"*": "ask"}`                                 | `sessions/<id>.jsonl`      | allowed | **asked**   |
+| `"external_directory_read": {"*": "deny"}`                                | `extensions/…/logs/…`      | allowed | **denied**  |
+| `"external_directory_read": {"*": "deny"}`                                | `skills/<name>/SKILL.md`   | allowed | allowed     |
+| `"external_directory_read": {"*": "deny"}`                                | `settings.json`            | allowed | allowed     |
+| `"external_directory_read": {"~/.pi/agent/git/x/SKILL.md": "deny"}`       | `git/x/SKILL.md`           | allowed | **denied**  |
+| `"external_directory": {"*": "deny"}`                                     | `git/x/SKILL.md`           | allowed | allowed     |
+
+## Restoring a read
+
+Grant the path on `external_directory_read`, where the grant is visible in your config:
+
+```jsonc
+"permission": {
+  "external_directory_read": { "~/.pi/agent/sessions/*": "allow" }
+}
+```
+
+A `piInfrastructureReadPaths` entry also restores the bypass for any path except this package's logs directory.
+For the logs, only an `external_directory_read` rule re-allows the read.
+
+## Writing a targeted deny
+
+Rules are last-match-wins, so put a catch-all first and the targeted deny after it:
+
+```jsonc
+"permission": {
+  "external_directory_read": {
+    "*": "ask",
+    "~/.pi/agent/skills/untrusted/*": "deny"
+  }
+}
+```
+
+Written the other way round, the catch-all is the matching rule, and a catch-all does not override the bypass.

package/docs/session-approvals.md

@@ -59,6 +59,14 @@ The suggested pattern is surface-specific:
 | tool with path (read, write, …) | `read` for `src/foo.ts`      | `src/*`                   |
 | tool catch-all                  | `read` (no extractable path) | `*`                       |
 | external_directory              | `/other/project/src/foo.ts`  | `/other/project/src/*`    |
+| external_directory (directory)  | `ls /other/project`          | `/other/project/*`        |
+
+A path that names an existing directory (`ls`, `find`, `grep`, or an extension tool's directory argument) is scoped to that directory, not its parent.
+The approval records two rules — the directory itself and `<dir>/*` — so a repeated `ls` of the directory and every file beneath it are covered, while a sibling directory such as `/other/project-b` still asks.
+The dialog names the pair by its contents glob, `"/other/project/*"`.
+A path that does not exist yet, or a bash token whose base directory is unknown, keeps the parent-directory scope.
+
+When a path ask proves no read/write direction (an extension tool, or `edit`), the session option names its scope as `Yes, allow access to "<pattern>" for this session`.
 
 ## Bash Arity Table
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "38.0.2",
+  "version": "39.0.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -128,7 +128,7 @@
     },
     "piInfrastructureReadPaths": {
       "description": "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the external_directory gate. Supports ~ expansion and wildcard patterns (* and ?).",
-      "markdownDescription": "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), `agentDir`, `agentDir/git`, and project-local `.pi/npm/` and `.pi/git/`. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
+      "markdownDescription": "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), Pi's harness entries under `agentDir` (`agents/`, `extensions/`, `git/`, `npm/`, `prompts/`, `skills/`, `themes/`, `settings.json`, `SYSTEM.md`, `APPEND_SYSTEM.md`, `AGENTS.md`), and project-local `.pi/npm/` and `.pi/git/`. The package's own logs directory is never auto-allowed, even when an entry here covers it. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
       "default": [],
       "type": "array",
       "items": {

package/src/authority/local-user-authorizer.ts

@@ -2,6 +2,7 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   buildDirectionalSessionLabels,
   buildForwardedScopeLabels,
+  buildPathAccessSessionLabel,
   describeGrantTarget,
 } from "#src/presentation/pattern-suggest";
 import {
@@ -126,9 +127,10 @@ function unansweredDecision(reason: string): PermissionPromptDecision {
 /**
  * The dialog options this ask offers, composed from three independent groups.
  *
- * The label names what the session grant covers (a gate-supplied one, or one
- * derived from the grants themselves for a path ask). An ask whose grants all
- * prove the same direction additionally offers the both-directions width
+ * The label names what the session grant covers: the proven direction and
+ * target for a directional path ask, else a gate-supplied label, else the
+ * target alone for a path ask that proves no direction. An ask whose grants
+ * all prove the same direction additionally offers the both-directions width
  * (#813). A forwarded ask additionally offers the scope choice (subagent vs
  * whole session).
  *
@@ -144,7 +146,11 @@ function buildRequestOptions(
   const widths = direction
     ? buildDirectionalSessionLabels(direction, describeGrantTarget(grants))
     : null;
-  const sessionLabel = widths?.sessionLabel ?? details.sessionLabel;
+  const sessionLabel =
+    widths?.sessionLabel ??
+    details.sessionLabel ??
+    buildPathAccessSessionLabel(grants) ??
+    undefined;
 
   const options: RequestPermissionOptions = {
     ...(sessionLabel ? { sessionLabel } : {}),

package/src/config/config-schema.ts

@@ -427,7 +427,7 @@ export const unifiedConfigSchema = z
       description:
         "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the external_directory gate. Supports ~ expansion and wildcard patterns (* and ?).",
       markdownDescription:
-        "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), `agentDir`, `agentDir/git`, and project-local `.pi/npm/` and `.pi/git/`. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
+        "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), Pi's harness entries under `agentDir` (`agents/`, `extensions/`, `git/`, `npm/`, `prompts/`, `skills/`, `themes/`, `settings.json`, `SYSTEM.md`, `APPEND_SYSTEM.md`, `AGENTS.md`), and project-local `.pi/npm/` and `.pi/git/`. The package's own logs directory is never auto-allowed, even when an entry here covers it. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
       default: [],
     }),
     authorizerChain: z.array(z.string().min(1)).optional().meta({

package/src/config/extension-paths.ts

@@ -16,16 +16,44 @@ export interface ExtensionPaths {
   readonly forwardingDir: string;
   readonly globalLogsDir: string;
   /**
-   * Static Pi infrastructure directories used for external-directory
-   * read auto-allow. Computed once from `agentDir`,
+   * Static Pi infrastructure roots used for external-directory read
+   * auto-allow; an entry may be a directory or a single file. Computed once
+   * from `agentDir` (only Pi's harness entries, never `agentDir` itself),
    * `discoverGlobalNodeModulesRoot()`, and (when provided) Pi's own
    * install directory (`getPackageDir()`). Config-based extras
    * (`piInfrastructureReadPaths`) are read from `runtime.config` at
    * call time in the handler so they pick up config reloads.
    */
   readonly piInfrastructureDirs: readonly string[];
+  /**
+   * Directories never auto-allowed as infrastructure reads, even inside one of
+   * `piInfrastructureDirs` or a configured `piInfrastructureReadPaths` entry:
+   * this package's own logs directory, whose entries hold tool input.
+   */
+  readonly piInfrastructureExcludedDirs: readonly string[];
 }
 
+/**
+ * The entries under `agentDir` that Pi's harness reads: its resource roots
+ * (`skills`, `prompts`, `themes`, `extensions`, the system-prompt files, the
+ * global `AGENTS.md`), its package install roots (`npm`, `git`), settings, and
+ * subagent definitions. Everything else there (`auth.json`, `sessions/`,
+ * `mcp-oauth/`, and the like) stays behind the `external_directory` gate.
+ */
+const AGENT_DIR_INFRASTRUCTURE_ENTRIES = [
+  "agents",
+  "extensions",
+  "git",
+  "npm",
+  "prompts",
+  "skills",
+  "themes",
+  "settings.json",
+  "SYSTEM.md",
+  "APPEND_SYSTEM.md",
+  "AGENTS.md",
+] as const;
+
 /**
  * Compute all immutable path constants from `agentDir`.
  *
@@ -49,8 +77,7 @@ export function computeExtensionPaths(
 
   const globalNodeModulesRoot = discoverGlobalNodeModulesRoot();
   const piInfrastructureDirs: string[] = [
-    agentDir,
-    join(agentDir, "git"),
+    ...AGENT_DIR_INFRASTRUCTURE_ENTRIES.map((entry) => join(agentDir, entry)),
     ...(globalNodeModulesRoot ? [globalNodeModulesRoot] : []),
     ...(piPackageDir ? [piPackageDir] : []),
   ];
@@ -62,5 +89,6 @@ export function computeExtensionPaths(
     forwardingDir,
     globalLogsDir,
     piInfrastructureDirs,
+    piInfrastructureExcludedDirs: [globalLogsDir],
   };
 }

package/src/handlers/gates/bash-external-directory.ts

@@ -109,10 +109,11 @@ export function describeBashExternalDirectoryGate(
     input: {},
     payload,
     sessionApproval: SessionApproval.forGrants(
-      uncoveredEntries.map((entry) => ({
-        surface: entry.surface,
-        pattern: normalizer.approvalPatternFor(entry.path),
-      })),
+      uncoveredEntries.flatMap((entry) =>
+        normalizer
+          .approvalPatternsFor(entry.path)
+          .map((pattern) => ({ surface: entry.surface, pattern })),
+      ),
     ),
     promptDetails: {
       source: "tool_call",

package/src/handlers/gates/bash-path.ts

@@ -130,10 +130,10 @@ export function describeBashPathGate(
   // All tokens evaluate to allow — no restriction.
   if (!worstCheck || !worstToken || !worstEntry) return null;
 
-  // Derive the pattern from the lexical absolute form (the cd-aware resolved
-  // path), so it matches the values a later call produces. For an unknown base
+  // Derive the patterns from the lexical absolute form (the cd-aware resolved
+  // path), so they match the values a later call produces. For an unknown base
   // (`forLiteral`) `value()` is the raw token.
-  const pattern = normalizer.approvalPatternFor(worstEntry.path);
+  const patterns = normalizer.approvalPatternsFor(worstEntry.path);
   const surface = worstEntry.surface;
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
@@ -147,7 +147,7 @@ export function describeBashPathGate(
     surface,
     input: { path: worstToken },
     payload,
-    sessionApproval: SessionApproval.single(surface, pattern),
+    sessionApproval: SessionApproval.forPatterns(surface, patterns),
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,

package/src/handlers/gates/external-directory.ts

@@ -1,10 +1,12 @@
 import { capabilitySurfaceForTool } from "#src/access-intent/path-surfaces";
 import { getToolInputPath } from "#src/access-intent/tool-input-path";
 import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { InfrastructureReadScope } from "#src/path/pi-infrastructure-read";
 import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import { buildExternalDirectoryAskPayload } from "#src/presentation/path-ask-payload";
 import { SessionApproval } from "#src/session/session-approval";
 import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
+import type { PermissionCheckResult } from "#src/types";
 import type { GateResult } from "./descriptor";
 import { resolveExternalDirectoryPolicy } from "./external-directory-policy";
 import {
@@ -19,12 +21,13 @@ import type { ToolCallContext } from "./types";
  *
  * Returns `null` when the gate does not apply (no CWD, tool is not
  * path-bearing, or path is inside the working directory).
- * Returns a `GateBypass` for Pi infrastructure reads.
+ * Returns a `GateBypass` for Pi infrastructure reads, unless a deny rule
+ * naming the path outranks it.
  * Returns a `GateDescriptor` for external paths needing a permission check.
  */
 export function describeExternalDirectoryGate(
   tcc: ToolCallContext,
-  infraDirs: string[],
+  infraScope: InfrastructureReadScope,
   resolver: ScopedPermissionResolver,
   normalizer: PathNormalizer,
   extractors?: ToolAccessExtractorLookup,
@@ -50,8 +53,24 @@ export function describeExternalDirectoryGate(
     return null;
   }
 
+  // The narrowest `external_directory`-family surface this tool's identity
+  // proves; the bare family name folds both directions (ADR 0013 §10).
+  const surface = capabilitySurfaceForTool("external_directory", tcc.toolName);
+
+  // Resolved before the infrastructure bypass so a rule can be weighed against
+  // it; the runner consumes this preCheck and skips its own resolve.
+  const preCheck = resolveExternalDirectoryPolicy(
+    accessPath,
+    resolver,
+    surface,
+    tcc.agentName ?? undefined,
+  );
+
   // ── Pi infrastructure read bypass ──────────────────────────────────────
-  if (normalizer.isInfrastructureRead(tcc.toolName, accessPath, infraDirs)) {
+  if (
+    normalizer.isInfrastructureRead(tcc.toolName, accessPath, infraScope) &&
+    !isTargetedDeny(preCheck)
+  ) {
     return {
       action: "allow",
       // Containment allowed this, not a rule the operator wrote.
@@ -78,19 +97,7 @@ export function describeExternalDirectoryGate(
 
   // ── Build descriptor for permission check ───────────────────────────────
   const resolvedAlias = accessPath.resolvedAlias();
-
-  // The narrowest `external_directory`-family surface this tool's identity
-  // proves; the bare family name folds both directions (ADR 0013 §10).
-  const surface = capabilitySurfaceForTool("external_directory", tcc.toolName);
-
-  // The runner consumes this preCheck and skips its own resolve.
-  const preCheck = resolveExternalDirectoryPolicy(
-    accessPath,
-    resolver,
-    surface,
-    tcc.agentName ?? undefined,
-  );
-  const pattern = normalizer.approvalPatternFor(accessPath);
+  const patterns = normalizer.approvalPatternsFor(accessPath);
 
   const payload = buildExternalDirectoryAskPayload({
     toolName: tcc.toolName,
@@ -107,7 +114,7 @@ export function describeExternalDirectoryGate(
     input: {},
     preCheck,
     payload,
-    sessionApproval: SessionApproval.single(surface, pattern),
+    sessionApproval: SessionApproval.forPatterns(surface, patterns),
     promptDetails: buildPathGatePromptDetails(
       tcc,
       externalDirectoryPath,
@@ -120,3 +127,21 @@ export function describeExternalDirectoryGate(
     },
   };
 }
+
+/**
+ * True for a deny from a rule naming this path: not the family's catch-all
+ * (`"*"`, or `"**"`, which compiles identically), and not the universal
+ * fallback (no matched pattern). Only such a deny
+ * outranks the Pi infrastructure read bypass, so a deny-by-default policy keeps
+ * its skill and package reads.
+ */
+function isTargetedDeny(check: PermissionCheckResult): boolean {
+  return (
+    check.state === "deny" &&
+    check.matchedPattern !== undefined &&
+    !CATCH_ALL_PATTERN.test(check.matchedPattern)
+  );
+}
+
+/** A pattern of wildcards alone, which matches every path. */
+const CATCH_ALL_PATTERN = /^\*+$/;

package/src/handlers/gates/path.ts

@@ -58,9 +58,9 @@ export function describePathGate(
   // "path" key should not trigger path-level prompts (#58).
   if (check.matchedPattern === undefined) return null;
 
-  // Derive the approval pattern from the lexical absolute form so it matches
+  // Derive the approval patterns from the lexical absolute form so they match
   // the policy values a later call produces.
-  const pattern = normalizer.approvalPatternFor(accessPath);
+  const patterns = normalizer.approvalPatternsFor(accessPath);
 
   const payload = buildPathAskPayload({
     toolName: tcc.toolName,
@@ -75,7 +75,7 @@ export function describePathGate(
     surface,
     input: { path: filePath },
     payload,
-    sessionApproval: SessionApproval.single(surface, pattern),
+    sessionApproval: SessionApproval.forPatterns(surface, patterns),
     promptDetails: buildPathGatePromptDetails(
       tcc,
       filePath,

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -7,6 +7,7 @@ import {
 import type { ShellToolsConfig } from "#src/config/config-schema";
 import type { SkillPromptEntry } from "#src/exposure/skill-prompt-sanitizer";
 import type { PathNormalizer } from "#src/path/path-normalizer";
+import type { InfrastructureReadScope } from "#src/path/pi-infrastructure-read";
 import type { ScopedPermissionResolver } from "#src/policy/permission-resolver";
 import type { ToolAccessExtractorLookup } from "#src/tool-input/tool-access-extractor-registry";
 import type { ToolInputFormatterLookup } from "#src/tool-input/tool-input-formatter-registry";
@@ -39,8 +40,8 @@ import type { GateOutcome, ToolCallContext } from "./types";
 export interface ToolCallGateInputs {
   /** Active skill prompt entries for the skill-read gate. */
   getActiveSkillEntries(): SkillPromptEntry[];
-  /** Combined infrastructure read directories (static + config-derived). */
-  getInfrastructureReadDirs(): string[];
+  /** Where infrastructure reads are auto-allowed (static + config-derived). */
+  getInfrastructureReadScope(): InfrastructureReadScope;
   /** Resolved tool-preview formatter options from the current config. */
   getToolPreviewLimits(): ToolPreviewFormatterOptions;
   /** The session's path normalizer (platform + cwd baked in). */
@@ -60,7 +61,7 @@ export interface ToolCallGateInputs {
  * `PermissionGateHandler`. `evaluate(tcc, runner)` encapsulates:
  * - bash-command extraction and single `BashProgram.parse` (#308)
  * - `ToolPreviewFormatter` construction from `getToolPreviewLimits()`
- * - infrastructure-dir list from `getInfrastructureReadDirs()`
+ * - infrastructure-read scope from `getInfrastructureReadScope()`
  * - all six gate producers in their prescribed order
  * - the run loop, which runs an unconditionally denying gate ahead of the
  *   rest and returns the first block outcome, or allow
@@ -98,7 +99,7 @@ export class ToolCallGatePipeline {
       this.customFormatters,
     );
 
-    const infraDirs = this.inputs.getInfrastructureReadDirs();
+    const infraScope = this.inputs.getInfrastructureReadScope();
 
     const gateProducers: Array<() => GateResult | Promise<GateResult>> = [
       () =>
@@ -110,7 +111,7 @@ export class ToolCallGatePipeline {
       () =>
         describeExternalDirectoryGate(
           tcc,
-          infraDirs,
+          infraScope,
           this.resolver,
           normalizer,
           this.customExtractors,
@@ -209,7 +210,7 @@ export class ToolCallGatePipeline {
       return {
         pathAccess: {
           path: accessPath,
-          approvalPattern: normalizer.approvalPatternFor(accessPath),
+          approvalPatterns: normalizer.approvalPatternsFor(accessPath),
         },
         toolCheck: this.resolver.resolve({
           kind: "access-path",

package/src/handlers/gates/tool.ts

@@ -34,7 +34,7 @@ import type { ToolCallContext } from "./types";
  */
 export interface ToolPathAccess {
   readonly path: AccessPath;
-  readonly approvalPattern: string;
+  readonly approvalPatterns: readonly string[];
 }
 
 /**
@@ -42,7 +42,7 @@ export interface ToolPathAccess {
  *
  * Bash → command string; MCP → qualified target; everything else → catch-all
  * wildcard. A path-bearing tool that resolved a path never reaches here — its
- * suggestion comes from the already-derived {@link ToolPathAccess} pattern.
+ * suggestion comes from the already-derived {@link ToolPathAccess} patterns.
  */
 function deriveSuggestionValue(
   toolName: string,
@@ -76,6 +76,40 @@ function gateSurfaceOf(
   return toolName;
 }
 
+/** A session option: the approval to record and the label offering it. */
+interface SessionOption {
+  readonly approval: SessionApproval;
+  readonly label: string;
+}
+
+/** The session option for a path-bearing tool, from its derived patterns. */
+function pathSessionOption(
+  gateSurface: string,
+  approvalPatterns: readonly string[],
+): SessionOption {
+  const suggestion = suggestPathSessionPattern(gateSurface, approvalPatterns);
+  return {
+    approval: SessionApproval.forPatterns(
+      suggestion.surface,
+      suggestion.patterns,
+    ),
+    label: suggestion.label,
+  };
+}
+
+/** The session option for a gate whose value is not a path. */
+function valueSessionOption(
+  toolName: string,
+  gateSurface: string,
+  check: PermissionCheckResult,
+): SessionOption {
+  const suggestion = suggestValueSessionPattern(toolName, gateSurface, check);
+  return {
+    approval: SessionApproval.single(suggestion.surface, suggestion.pattern),
+    label: suggestion.label,
+  };
+}
+
 /**
  * The session approval for a gate whose value is not a path.
  *
@@ -118,10 +152,10 @@ export function describeToolGate(
     PATH_BEARING_TOOLS,
   );
 
-  // Compute session approval suggestion for the "for this session" option.
-  const suggestion = pathAccess
-    ? suggestPathSessionPattern(gateSurface, pathAccess.approvalPattern)
-    : suggestValueSessionPattern(tcc.toolName, gateSurface, check);
+  // The session approval and label for the "for this session" option.
+  const sessionOption = pathAccess
+    ? pathSessionOption(gateSurface, pathAccess.approvalPatterns)
+    : valueSessionOption(tcc.toolName, gateSurface, check);
 
   const payload = buildToolAskPayload({
     check,
@@ -148,16 +182,13 @@ export function describeToolGate(
     surface: gateSurface,
     input: tcc.input,
     payload,
-    sessionApproval: SessionApproval.single(
-      suggestion.surface,
-      suggestion.pattern,
-    ),
+    sessionApproval: sessionOption.approval,
     promptDetails: {
       source: "tool_call",
       agentName: tcc.agentName,
       toolCallId: tcc.toolCallId,
       toolName: tcc.toolName,
-      sessionLabel: suggestion.label,
+      sessionLabel: sessionOption.label,
       accessIntent,
       ...permissionLogContext,
     },

package/src/path/approval-pattern.ts

@@ -1,13 +1,19 @@
 import type { PathFlavor } from "./path-flavor";
 
 /**
- * Derive the wildcard glob to record when a user approves an accessed path for
- * the session: the path's directory scope, with `*` appended.
+ * Derive the wildcard globs to record when a user approves an accessed path
+ * for the session.
  *
- * The scope is the value up to and including its last path separator, so the
- * pattern is spelled with the separator the value itself carries. That matters
- * on a win32 host, where Git Bash tokens are POSIX-shaped while Node's own
- * `sep` is a backslash: deriving `/tmp/logs\*` from `/tmp/logs/` widens the
+ * A non-directory (or a path the caller could not confirm is a directory) is
+ * scoped to its enclosing directory: the value up to and including its last
+ * path separator, with `*` appended. A directory is scoped to itself and its
+ * contents — `D` and `D<sep>*` — rather than to its parent, which would grant
+ * every sibling directory (#989). Two patterns are needed because `D<sep>*`
+ * does not match `D` itself, and `D*` would also match a sibling `D-evil`.
+ *
+ * Each pattern is spelled with the separator the value itself carries. That
+ * matters on a win32 host, where Git Bash tokens are POSIX-shaped while Node's
+ * own `sep` is a backslash: deriving `/tmp/logs\*` from `/tmp/logs/` widens the
  * grant to the parent directory once the `windowsSeparators` fold (#653)
  * normalizes both operands. A value carrying no separator falls back to the
  * current directory, which is what callers see only if they skipped resolving
@@ -17,11 +23,30 @@ import type { PathFlavor } from "./path-flavor";
  * never an ambient `node:path` read, so win32 derivation is decidable — and
  * testable — on a POSIX host (#655).
  */
-export function deriveApprovalPattern(
+export function deriveApprovalPatterns(
   pathValue: string,
   flavor: PathFlavor,
-): string {
+  isDirectory: boolean,
+): readonly string[] {
+  if (!isDirectory) return [parentScopePattern(pathValue, flavor)];
+  return [pathValue, directoryContentsPattern(pathValue, flavor)];
+}
+
+/** The value's enclosing directory scope (up to its last separator) plus `*`. */
+function parentScopePattern(pathValue: string, flavor: PathFlavor): string {
   const lastSeparator = flavor.lastSeparatorIndex(pathValue);
   if (lastSeparator < 0) return `.${flavor.impl.sep}*`;
   return `${pathValue.slice(0, lastSeparator + 1)}*`;
 }
+
+/** Everything beneath a directory value: the value, a separator, then `*`. */
+function directoryContentsPattern(
+  pathValue: string,
+  flavor: PathFlavor,
+): string {
+  const lastSeparator = flavor.lastSeparatorIndex(pathValue);
+  if (lastSeparator === pathValue.length - 1) return `${pathValue}*`;
+  const separator =
+    lastSeparator < 0 ? flavor.impl.sep : pathValue[lastSeparator];
+  return `${pathValue}${separator}*`;
+}

package/src/path/path-normalizer.ts

@@ -1,4 +1,4 @@
-import { existsSync, lstatSync } from "node:fs";
+import { existsSync, lstatSync, statSync } from "node:fs";
 import { AccessPath } from "#src/access-intent/access-path";
 import {
   canonicalNormalizePathForComparison,
@@ -6,11 +6,14 @@ import {
   normalizePathPolicyLiteral,
 } from "#src/access-intent/path-normalization";
 import { classifyToolKind } from "#src/access-intent/tool-kind";
-import { deriveApprovalPattern } from "./approval-pattern";
+import { deriveApprovalPatterns } from "./approval-pattern";
 import { resolveNativeToolTarget } from "./native-tool-target";
 import { isPathOutsideWorkingDirectory } from "./path-containment";
 import type { PathFlavor } from "./path-flavor";
-import { isPiInfrastructureRead } from "./pi-infrastructure-read";
+import {
+  type InfrastructureReadScope,
+  isPiInfrastructureRead,
+} from "./pi-infrastructure-read";
 
 /**
  * The interpreted effect of a literal `cd` target on the effective base, under
@@ -128,17 +131,41 @@ export class PathNormalizer {
   }
 
   /**
-   * The session-approval glob for an accessed path: its directory scope plus
-   * `*`, derived through the baked flavor.
+   * The session-approval globs for an accessed path, derived through the baked
+   * flavor: an existing directory's own scope (itself and its contents), else
+   * the enclosing directory's scope plus `*`.
    *
    * Takes the already-built {@link AccessPath} — the lexical form is what a
-   * later tool call is matched on, so the pattern must be derived from the
+   * later tool call is matched on, so the patterns must be derived from the
    * same representation the decision displayed (#438). Deriving it here rather
    * than at each gate keeps the platform's separator alphabet with the object
    * that owns the flavor, instead of an ambient `node:path` read (#655).
    */
-  approvalPatternFor(accessPath: AccessPath): string {
-    return deriveApprovalPattern(accessPath.value(), this.flavor);
+  approvalPatternsFor(accessPath: AccessPath): readonly string[] {
+    return deriveApprovalPatterns(
+      accessPath.value(),
+      this.flavor,
+      this.namesDirectory(accessPath),
+    );
+  }
+
+  /**
+   * Whether an accessed path names an existing directory, so its session grant
+   * covers that directory rather than its parent.
+   *
+   * Uses `stat`, following symlinks: a link to a directory is what `ls` lists.
+   * A literal-only path (no canonical form — an unknown base, or a win32
+   * non-mount POSIX absolute) is never probed, since `stat` would resolve it
+   * against the process cwd or a fabricated drive. Any error answers `false`,
+   * which keeps the parent-directory grant callers had before this probe.
+   */
+  private namesDirectory(accessPath: AccessPath): boolean {
+    if (!accessPath.boundaryValue()) return false;
+    try {
+      return statSync(accessPath.value()).isDirectory();
+    } catch {
+      return false;
+    }
   }
 
   /** Platform-aware absoluteness (`win32` vs `posix` rules). */
@@ -219,14 +246,15 @@ export class PathNormalizer {
   isInfrastructureRead(
     toolName: string,
     accessPath: AccessPath,
-    infraDirs: readonly string[],
+    scope: InfrastructureReadScope,
   ): boolean {
     return isPiInfrastructureRead(
       toolName,
       accessPath.boundaryValue(),
-      infraDirs,
+      scope.dirs,
       this.cwd,
       this.flavor,
+      scope.excludedDirs,
     );
   }
 

package/src/path/pi-infrastructure-read.ts

@@ -4,6 +4,18 @@ import { wildcardMatch } from "#src/policy/wildcard-matcher";
 import { expandHomePath } from "./expand-home";
 import type { PathFlavor } from "./path-flavor";
 
+/**
+ * Where Pi infrastructure reads are auto-allowed: the roots a read-only tool
+ * may read without the `external_directory` gate, and the directories never
+ * auto-allowed even inside a root.
+ */
+export interface InfrastructureReadScope {
+  /** Roots (directories, files, or glob patterns) whose reads are auto-allowed. */
+  readonly dirs: readonly string[];
+  /** Directories never auto-allowed, even inside a root; wins over `dirs`. */
+  readonly excludedDirs: readonly string[];
+}
+
 function containsGlobChars(value: string): boolean {
   return value.includes("*") || value.includes("?");
 }
@@ -14,12 +26,15 @@ function containsGlobChars(value: string): boolean {
  *
  * A path qualifies when:
  * 1. The tool is read-only (in READ_ONLY_PATH_BEARING_TOOLS).
- * 2. The normalized path is within one of the provided `infrastructureDirs`
+ * 2. The normalized path is not within any of `excludedDirs`.
+ * 3. The normalized path is within one of the provided `infrastructureDirs`
  *    OR within the project-local Pi package directories
  *    (`<cwd>/.pi/npm/` or `<cwd>/.pi/git/`).
  *
- * `infrastructureDirs` entries may be absolute paths or patterns containing
- * `~`/`$HOME` (expanded at call time) or glob characters (`*`, `?`).
+ * `infrastructureDirs` entries may be absolute paths (a directory, or a file,
+ * which admits only itself) or patterns containing `~`/`$HOME` (expanded at
+ * call time) or glob characters (`*`, `?`). `excludedDirs` entries are
+ * directory prefixes with the same `~`/`$HOME` expansion.
  * Project-local paths are computed fresh from `cwd` on each call so they
  * follow working-directory changes without a runtime rebuild.
  */
@@ -29,11 +44,16 @@ export function isPiInfrastructureRead(
   infrastructureDirs: readonly string[],
   cwd: string,
   flavor: PathFlavor,
+  excludedDirs: readonly string[] = [],
 ): boolean {
   if (!READ_ONLY_PATH_BEARING_TOOLS.has(toolName)) {
     return false;
   }
 
+  for (const dir of excludedDirs) {
+    if (flavor.isWithin(normalizedPath, expandHomePath(dir))) return false;
+  }
+
   // On Windows the path value is canonicalized + lowercased; the flavor's match
   // options fold case (and separators) so mixed-case infra dirs and glob
   // patterns still match.

package/src/presentation/pattern-suggest.ts

@@ -5,9 +5,10 @@ import {
 import {
   type CapabilityDirection,
   PATH_BEARING_TOOLS,
+  surfaceFamilyMembers,
   surfaceFamilyOf,
 } from "#src/access-intent/path-surfaces";
-import type { ApprovalGrant } from "#src/session/approval-grant";
+import { type ApprovalGrant, grantTargets } from "#src/session/approval-grant";
 
 /** The suggestion returned for a "Yes, for this session" dialog option. */
 export interface SessionApprovalSuggestion {
@@ -80,15 +81,16 @@ export interface ForwardedScopeLabels {
 /**
  * What an approval's grants cover, as one phrase.
  *
- * A single grant names its pattern; several name their count, because only the
- * external-directory gate aggregates an ask over many paths and there is no
- * pattern that describes them all. Requires at least one grant — an approval
+ * A single target names its pattern; several name their count, because only
+ * the external-directory gate aggregates an ask over many paths and there is
+ * no pattern that describes them all. Targets, not grants: a directory's
+ * two-grant approval and two paths sharing one glob each count once
+ * ({@link grantTargets}). Requires at least one grant — an approval
  * with none is never offered as a session option.
  */
 export function describeGrantTarget(grants: readonly ApprovalGrant[]): string {
-  return grants.length === 1
-    ? `"${grants[0].pattern}"`
-    : `${grants.length} paths`;
+  const targets = grantTargets(grants);
+  return targets.length === 1 ? `"${targets[0]}"` : `${targets.length} paths`;
 }
 
 /** The two session-option labels for an ask whose grants prove one direction. */
@@ -120,6 +122,25 @@ export function buildDirectionalSessionLabels(
   };
 }
 
+/**
+ * Label a session grant on the `path` / `external_directory` families that
+ * proves no direction (an extension tool, `edit`), so the option still names
+ * its scope instead of the dialog's bare default. Returns `null` when any
+ * grant lies outside those families — their gates supply their own label.
+ */
+export function buildPathAccessSessionLabel(
+  grants: readonly ApprovalGrant[],
+): string | null {
+  const allPathFamily =
+    grants.length > 0 &&
+    grants.every(
+      (grant) => surfaceFamilyMembers(surfaceFamilyOf(grant.surface)) !== null,
+    );
+  return allPathFamily
+    ? `Yes, allow access to ${describeGrantTarget(grants)} for this session`
+    : null;
+}
+
 /**
  * Build the two scope labels shown when a human grants a forwarded request
  * "for this session."
@@ -221,19 +242,37 @@ export function suggestSessionPattern(
   return { surface, pattern, label: buildLabel(pattern, surface) };
 }
 
+/** The suggestion for a path surface: every pattern to record, one label. */
+export interface PathSessionSuggestion {
+  /** The permission surface this approval applies to. */
+  surface: string;
+  /** The wildcard patterns to store as session rules. */
+  patterns: readonly string[];
+  /** Human-readable label for the "for session" dialog option. */
+  label: string;
+}
+
 /**
- * Build the suggestion for a path surface from a pattern the caller already
+ * Build the suggestion for a path surface from patterns the caller already
  * derived through its `PathNormalizer` (#655).
  *
  * The derivation belongs to the normalizer, which owns the session's
  * `PathFlavor`; this module labels the result and must not re-interpret the
- * separators it is handed.
+ * separators it is handed. The label names the approval's target
+ * ({@link grantTargets}), so a directory's pair reads as its contents glob.
  */
 export function suggestPathSessionPattern(
   surface: string,
-  approvalPattern: string,
-): SessionApprovalSuggestion {
-  return suggestExactSessionPattern(surface, approvalPattern);
+  approvalPatterns: readonly string[],
+): PathSessionSuggestion {
+  const targets = grantTargets(
+    approvalPatterns.map((pattern) => ({ surface, pattern })),
+  );
+  return {
+    surface,
+    patterns: approvalPatterns,
+    label: buildLabel(targets.join('", "'), surface),
+  };
 }
 
 /**

package/src/session/approval-grant.ts

@@ -75,3 +75,36 @@ export function provenDirectionOf(
     ? direction
     : null;
 }
+
+/**
+ * The distinct targets an approval covers, for naming it in a prompt.
+ *
+ * A directory approval is recorded as two grants on one surface — the
+ * directory itself (`D`) and its contents (`D/*`) — because no single wildcard
+ * matches both without also matching a sibling like `D-evil`. Here the exact
+ * grant folds into its contents grant, so the pair reads as the one target
+ * `D/*`. Identical patterns (two paths in one directory) collapse to one.
+ */
+export function grantTargets(grants: readonly ApprovalGrant[]): string[] {
+  const targets = grants
+    .filter((grant) => !hasContentsSibling(grant, grants))
+    .map((grant) => grant.pattern);
+  return [...new Set(targets)];
+}
+
+/** Whether `grants` also holds `grant`'s contents pattern on the same surface. */
+function hasContentsSibling(
+  grant: ApprovalGrant,
+  grants: readonly ApprovalGrant[],
+): boolean {
+  return grants.some(
+    (other) =>
+      other.surface === grant.surface &&
+      CONTENTS_SUFFIXES.some(
+        (suffix) => other.pattern === `${grant.pattern}${suffix}`,
+      ),
+  );
+}
+
+/** A separator (either alphabet) followed by the wildcard. */
+const CONTENTS_SUFFIXES = ["/*", "\\*"] as const;

package/src/session/permission-session.ts

@@ -15,6 +15,7 @@ import {
 import type { ToolCallGateInputs } from "#src/handlers/gates/tool-call-gate-pipeline";
 import type { PathFlavor } from "#src/path/path-flavor";
 import { PathNormalizer } from "#src/path/path-normalizer";
+import type { InfrastructureReadScope } from "#src/path/pi-infrastructure-read";
 import type { ScopedPermissionManager } from "#src/policy/permission-manager";
 import {
   resolveToolPreviewLimits,
@@ -237,14 +238,17 @@ export class PermissionSession implements ToolCallGateInputs {
   // ── Infrastructure paths ───────────────────────────────────────────────
 
   /**
-   * Combined infrastructure read directories: static paths from
-   * `ExtensionPaths` plus config-derived paths.
+   * Where infrastructure reads are auto-allowed: the static roots from
+   * `ExtensionPaths` plus the config-derived `piInfrastructureReadPaths`.
    */
-  getInfrastructureReadDirs(): string[] {
-    return [
-      ...this.paths.piInfrastructureDirs,
-      ...(this.config.piInfrastructureReadPaths ?? []),
-    ];
+  getInfrastructureReadScope(): InfrastructureReadScope {
+    return {
+      dirs: [
+        ...this.paths.piInfrastructureDirs,
+        ...(this.config.piInfrastructureReadPaths ?? []),
+      ],
+      excludedDirs: this.paths.piInfrastructureExcludedDirs,
+    };
   }
 
   /**

package/src/session/session-approval.ts

@@ -23,6 +23,19 @@ export class SessionApproval {
     return new SessionApproval([{ surface, pattern }]);
   }
 
+  /**
+   * Create an approval whose patterns were all proven on one surface — a
+   * directory approval records the directory and its contents as two patterns.
+   */
+  static forPatterns(
+    surface: string,
+    patterns: readonly string[],
+  ): SessionApproval {
+    return new SessionApproval(
+      patterns.map((pattern) => ({ surface, pattern })),
+    );
+  }
+
   /**
    * Create an approval from grants that may name different surfaces (e.g. a
    * bash external-directory ask whose uncovered paths proved different