@gotgenes/pi-permission-system 40.1.3 → 40.2.0

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.4...pi-permission-system-v40.2.0) (2026-10-12)
+
+
+### Features
+
+* **pi-permission-system:** deny a permission prompt nobody answers within promptTimeoutMs ([10812e8](https://github.com/gotgenes/pi-packages/commit/10812e83e8c766198d1b8a7eceafee7743bc6b23)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+* **pi-permission-system:** keep a permission prompt open once you start answering it ([39f7e3f](https://github.com/gotgenes/pi-packages/commit/39f7e3fba80d7c7235dc20c574430fb967779f0b)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+
+### Documentation
+
+* **pi-permission-system:** document promptTimeoutMs and the unanswered decider ([38eb4a6](https://github.com/gotgenes/pi-packages/commit/38eb4a6fe651ebc566b4d119a24a1d7645412dd7)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+* **pi-permission-system:** fix stale releasedDecision reference and note the fallback window spans follow-up dialogs ([4cc6b10](https://github.com/gotgenes/pi-packages/commit/4cc6b10327a504823d921fa11bc1b6bfa5bbb82e)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+
+## [40.1.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.3...pi-permission-system-v40.1.4) (2026-10-10)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** scope a wrapper's session approval to its inner command ([97f805f](https://github.com/gotgenes/pi-packages/commit/97f805fc7f07be93ef0fc054310755bddabada24)), closes [#1055](https://github.com/gotgenes/pi-packages/issues/1055), closes [#1054](https://github.com/gotgenes/pi-packages/issues/1054)
+* **pi-permission-system:** keep an xargs replacement template exact in session approvals ([b4a4d06](https://github.com/gotgenes/pi-packages/commit/b4a4d0648c9cf4e873a7679e8f701925232cd5aa)), closes [#1055](https://github.com/gotgenes/pi-packages/issues/1055), closes [#1054](https://github.com/gotgenes/pi-packages/issues/1054)
+* **pi-permission-system:** keep a wrapped command exact when a word holds a non-breaking space ([f16aa96](https://github.com/gotgenes/pi-packages/commit/f16aa968dbeed76b23967838b88fff0d18e93cde)), closes [#1055](https://github.com/gotgenes/pi-packages/issues/1055), closes [#1054](https://github.com/gotgenes/pi-packages/issues/1054)
+
+### Documentation
+
+* **pi-permission-system:** describe wrapper session-approval suggestions ([a999c58](https://github.com/gotgenes/pi-packages/commit/a999c585e60c8d4d8836de744788440712c9d099)), closes [#1055](https://github.com/gotgenes/pi-packages/issues/1055), closes [#1054](https://github.com/gotgenes/pi-packages/issues/1054)
+* **pi-permission-system:** note that a bare inline-shell payload keeps its exact session pattern ([3d53393](https://github.com/gotgenes/pi-packages/commit/3d53393c9da27c74c900902d2f0ec2453df1055d)), closes [#1055](https://github.com/gotgenes/pi-packages/issues/1055), closes [#1054](https://github.com/gotgenes/pi-packages/issues/1054)
+
 ## [40.1.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.2...pi-permission-system-v40.1.3) (2026-10-10)
 
 

package/README.md

@@ -68,6 +68,7 @@ When the dialog prompts, you can approve once or approve a pattern for the rest
 In an interactive TUI session the prompt is an inline keybind dialog — `y` approve, `s` approve for this session, `n` deny, `r` deny with a reason — where each hotkey arms and a second press confirms (configurable via `doublePressToConfirm`).
 The hotkeys themselves are remappable through `permissionDialogKeys`, which matters if you type with an input method editor: composition mode swallows letter keys before they reach the terminal, and digits do not.
 Set `promptNotifications` (for example `["bell"]`) and the dialog also rings the terminal as it opens, so a session waiting on you in another tab or pane gets flagged.
+For an unattended run, set `promptTimeoutMs` and a prompt nobody answers within that window is denied, with the agent told nobody answered; by default a prompt waits indefinitely, and pressing any key stops the clock ([details](docs/configuration.md#unanswered-prompts)).
 A file-access ask that proves a single direction offers `b` as well, granting the session both directions instead of only the one the gate proved.
 The prompt shows one fact per line — who is asking, the tool, the matched rule, the value being decided — within a row budget, so a large tool input cannot take over the transcript; `Ctrl+O` (`app.tools.expand`) expands it to the complete request.
 See [docs/configuration.md](docs/configuration.md#inline-permission-dialog-tui) for the hotkeys and [docs/session-approvals.md](docs/session-approvals.md) for session-scoped rules and pattern suggestions.

package/dist/public.d.ts

@@ -313,6 +313,11 @@ interface PermissionUiPromptEvent {
 }
 /** How a permission decision was reached. */
 type PermissionDecisionResolution = "policy_allow" | "policy_deny" | "session_approved" | "infrastructure_auto_allowed" | "user_approved" | "user_approved_for_session" | "user_denied" | "auto_approved" | "confirmation_unavailable"
+/**
+ * A human was shown the prompt and nobody answered within the configured
+ * `promptTimeoutMs`, so the request was denied.
+ */
+ | "prompt_unanswered"
 /** A registered `authorizerChain` link granted the ask; no human was asked. */
  | "authorizer_allowed"
 /** A registered `authorizerChain` link refused the ask; no human was asked. */

package/docs/configuration.md

@@ -36,7 +36,7 @@ See [migration/0644-project-trust-gating.md](migration/0644-project-trust-gating
 4. Project agent frontmatter
 
 The `permission` object uses deep-shallow merge: string-vs-string replaces; both-object shallow-merges pattern maps; string-vs-object the override wins entirely.
-Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`, `forwardingTimeoutMs`, `promptMaxRows`, `promptFieldMaxWidth`) use simple replacement.
+Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`, `forwardingTimeoutMs`, `promptTimeoutMs`, `promptMaxRows`, `promptFieldMaxWidth`) use simple replacement.
 `permissionDialogKeys` replaces the whole map rather than merging entry by entry, so the map that was validated is the map that applies.
 `promptNotifications` likewise replaces the whole list, so a project `[]` turns off a global list.
 
@@ -60,6 +60,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
   "yoloMode": false,
   "doublePressToConfirm": true,
   "forwardingTimeoutMs": 600000,
+  // "promptTimeoutMs": 60000, // opt-in: deny a prompt nobody answers (unset = no timer)
   "piInfrastructureReadPaths": [],
 
   // Non-bash tools that carry shell semantics
@@ -108,6 +109,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
 | `permissionDialogKeys`      | —        | Remaps the inline TUI dialog's decision hotkeys (see below). One printable character per decision; omitted decisions keep `y` / `s` / `b` / `n` / `r`.                                                                                       |
 | `promptNotifications`       | `[]`     | Terminal notifications to emit when the inline TUI dialog opens: `"bell"`, `"osc9"`, `"osc777"` (see below). Empty for none.                                                                                                                 |
 | `forwardingTimeoutMs`       | `600000` | How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds. A child whose parent is not draining its inbox gives up in ~2 s regardless, whether that parent runs in this process or its own. |
+| `promptTimeoutMs`           | —        | How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Unset (the default) means no timer. See [Unanswered prompts](#unanswered-prompts).                             |
 | `promptMaxRows`             | `24`     | Max rows a permission prompt renders before eliding its evidence. The request's own facts are never elided by this budget; `Ctrl+O` expands the prompt to the complete request.                                                              |
 | `promptFieldMaxWidth`       | `400`    | Max characters of any one field shown in a permission prompt. This is what bounds a single long field (a here-string command, say) that would otherwise fill the prompt through wrapping.                                                    |
 | `reviewLogFieldMaxWidth`    | `1000`   | Max characters of any one value written to the review log. A longer value is stored shortened, marked with an ellipsis. Raise it to keep longer values; this is a length bound, not redaction.                                               |
@@ -229,6 +231,29 @@ Inside tmux, prefer `"bell"`: tmux passes a BEL through to its own bell handling
 
 To run a program instead (Herdr, `cmux notify`, a push to your phone), write a small extension on the `permissions:ui_prompt` and `permissions:decision` broadcasts; see the [recipe](cross-extension-api.md#recipe-bridging-a-prompt-to-an-external-notifier).
 
+### Unanswered prompts
+
+By default a permission prompt waits until someone answers it.
+For a run you leave unattended, set `promptTimeoutMs` so a prompt nobody answers is denied instead of holding the agent indefinitely:
+
+```jsonc
+{
+  "promptTimeoutMs": 60000
+}
+```
+
+When the window expires, the prompt is dismissed and the request is **denied**; the timeout never approves anything.
+The agent is told that nobody answered the approval prompt within the window, not that you refused it, so it can try another approach or carry on with other work.
+The review log records the decision as `decidedBy: { "kind": "unanswered", "timeoutMs": 60000 }`, and the `permissions:decision` broadcast reports `prompt_unanswered`.
+
+The clock starts when a prompt is shown, not when the request is raised.
+A request waiting behind another open prompt gets its own full window once it is shown, so several unanswered requests take about one window each.
+In the inline TUI dialog, the hint row names the window while it runs, and pressing any key stops the clock: once you start answering (moving the highlight, typing a denial reason), the dialog waits for you to finish.
+The `select` fallback outside TUI mode has no keystroke to watch, so its window runs until you finish answering or it expires, and it spans the follow-up dialogs too: a window that expires while the grant-scope choice or the denial-reason input is open discards the half-made answer and denies the request as unanswered.
+
+A request forwarded from a subagent is shown in the parent session, so the **parent's** `promptTimeoutMs` applies to it, and the subagent receives the same unanswered denial.
+The subagent separately stops waiting after `forwardingTimeoutMs`; keep `promptTimeoutMs` below it, or the subagent can give up while the parent's prompt is still open.
+
 ### What a prompt shows
 
 The prompt renders one fact per line, with the requesting agent (and, for a forwarded subagent ask, its session), the tool, the gate surface, the matched rule, the decision-relevant value, and — for a wrapper such as `xargs` — the command that will actually run.

package/docs/cross-extension-api.md

@@ -502,20 +502,21 @@ pi.events.on("permissions:decision", (raw) => {
 
 ### Resolution Values
 
-| Value                         | Meaning                                                              |
-| ----------------------------- | -------------------------------------------------------------------- |
-| `policy_allow`                | Config rule said allow — no prompt shown                             |
-| `policy_deny`                 | Config rule said deny — blocked immediately                          |
-| `session_approved`            | Covered by a session-level approval from earlier in the same session |
-| `infrastructure_auto_allowed` | Read of a Pi infrastructure path — auto-allowed                      |
-| `user_approved`               | User approved once via dialog                                        |
-| `user_approved_for_session`   | User approved for the rest of the session                            |
-| `user_denied`                 | User denied via dialog                                               |
-| `authorizer_allowed`          | A registered `authorizerChain` link granted the ask — no human asked |
-| `authorizer_denied`           | A registered `authorizerChain` link refused the ask — no human asked |
-| `auto_approved`               | Yolo mode — approved automatically without dialog                    |
-| `confirmation_unavailable`    | State was `ask` but no UI was available — blocked                    |
-| `gate_error`                  | The gate threw, or an escalation failed — blocked, fail-closed       |
+| Value                         | Meaning                                                                  |
+| ----------------------------- | ------------------------------------------------------------------------ |
+| `policy_allow`                | Config rule said allow — no prompt shown                                 |
+| `policy_deny`                 | Config rule said deny — blocked immediately                              |
+| `session_approved`            | Covered by a session-level approval from earlier in the same session     |
+| `infrastructure_auto_allowed` | Read of a Pi infrastructure path — auto-allowed                          |
+| `user_approved`               | User approved once via dialog                                            |
+| `user_approved_for_session`   | User approved for the rest of the session                                |
+| `user_denied`                 | User denied via dialog                                                   |
+| `authorizer_allowed`          | A registered `authorizerChain` link granted the ask — no human asked     |
+| `authorizer_denied`           | A registered `authorizerChain` link refused the ask — no human asked     |
+| `auto_approved`               | Yolo mode — approved automatically without dialog                        |
+| `confirmation_unavailable`    | State was `ask` but no UI was available — blocked                        |
+| `prompt_unanswered`           | A prompt was shown and nobody answered within `promptTimeoutMs` — denied |
+| `gate_error`                  | The gate threw, or an escalation failed — blocked, fail-closed           |
 
 ### Recipe: bridging a prompt to an external notifier
 

package/docs/session-approvals.md

@@ -87,6 +87,31 @@ The arity table covers common CLI tools including git, npm/pnpm/yarn/bun, docker
 To add an entry, open `src/access-intent/bash/bash-arity.ts` and add a key/arity pair to the `ARITY` object.
 Put the most specific multi-word prefix first (e.g. `"npm run": 3`) before the shorter fallback (`"npm": 2`).
 
+### Wrapped commands
+
+A command behind an indirection wrapper (`sudo`, `env`, `xargs`, `nohup`, `timeout`, `nice`, and the rest of the wrapper vocabulary) is approved by its inner command, not by the wrapper.
+A session approval skips the wrapper's floor, so the suggestion keeps every wrapper word literally (options, operands, nested wrappers) and lets only the inner command's arguments vary.
+
+| Example command                      | Suggested pattern             |
+| ------------------------------------ | ----------------------------- |
+| `nohup mytool argument`              | `nohup mytool *`              |
+| `sudo aws s3 rm s3://bucket`         | `sudo aws s3 rm *`            |
+| `env FOO=bar mytool argument`        | `env FOO=bar mytool *`        |
+| `timeout 5 mytool argument`          | `timeout 5 mytool *`          |
+| `sudo -u root nohup mytool argument` | `sudo -u root nohup mytool *` |
+
+A wrapped pattern always puts a space before its wildcard, so approving `nohup mytool` covers `nohup mytool` and `nohup mytool <args>` but not `nohup mytool-other`.
+
+When the inner command cannot be established from the words alone, the suggestion is the whole command with no wildcard:
+
+- Shell syntax in any word: quoting, `$` expansion, a glob, `~`, grouping, or an operator (`sudo mytool $HOME`).
+- An inline shell payload, bare or wrapped (`bash -c …`, `eval …`, `sudo bash -c …`), or a wrapper that hands its command line to a shell or template (`watch`, `parallel`, `rush`, `rust-parallel`).
+- A wrapper mode in which the peeled command is not what runs (`sudo -s`, `env -C`), an option the wrapper's table does not admit (`timeout --sig KILL 5 …`, `flock -w 5 …`), or a `find`/`fd` exec clause.
+- An `xargs` replacement option (`-I`, `-i`, `--replace`), since standard input then rewrites the inner command's arguments (`xargs -I X nohup X first`).
+- Wrappers nested deeper than the gate peels.
+
+This changes only the suggested pattern; the wrapper floors and their exemptions are unchanged.
+
 ## Review Log Entries
 
 The review log records session approval decisions:

package/docs/subagent-integration.md

@@ -186,6 +186,8 @@ permission requests.
 The grace window exists so a request that arrives while the parent is switching sessions is not abandoned in the gap.
 Absence of a record is deliberately **not** read as unknown: a cleanly exited parent leaves nothing behind, so treating absence as "maybe serving" would restore the full-timeout stall that the heartbeat exists to end.
 A target that *is* draining its inbox is waited on for the full `forwardingTimeoutMs`, however long the human takes to decide.
+The exception is the serving session's own `promptTimeoutMs`: when it is set and nobody answers the forwarded prompt within it, the serving session denies the request as unanswered and the child receives that decision, telling its agent that nobody answered rather than that the user refused.
+Keep `promptTimeoutMs` below `forwardingTimeoutMs`, or the child can give up while the parent's prompt is still open.
 That includes a parent whose human is still deliberating at an earlier forwarded prompt: it keeps refreshing its heartbeat throughout, so a second child does not read it as gone.
 
 Every other way the forwarding path can give up — an unresolvable parent session, forwarding directories that cannot be created, a request that cannot be written, an unreadable response, and the timeout itself — is reported the same way: as approval being unavailable, with a reason naming the specific failure.

package/docs/troubleshooting.md

@@ -11,6 +11,7 @@
 | External file path blocked                                                                              | `external_directory` is `ask` without UI or `deny`                                      | Allow/ask the permission or keep file tools inside the active working directory.                                                                                                                                                                                            |
 | Spurious external-path prompt for `cd <subdir> && grep … ../path`                                       | Relative path was resolved against cwd instead of the `cd` target                       | Fixed in current version — paths after a leading `cd <subdir> &&` are resolved against the cd target, matching actual shell behavior.                                                                                                                                       |
 | Permission prompt is too verbose                                                                        | Generic extension tool input is large                                                   | Built-in file tools are summarized automatically; third-party tools are capped to a bounded one-line JSON preview.                                                                                                                                                          |
+| Tool blocked with "Nobody answered the approval prompt … within Ns"                                     | `promptTimeoutMs` is set and the prompt was left unanswered for that long               | Answer prompts within the window, press any key in the inline dialog to stop its clock, or raise or unset `promptTimeoutMs` (see [Unanswered prompts](configuration.md#unanswered-prompts)).                                                                                |
 | Windows: `permission_forwarding.error — EPERM … rename` in the logs, and a subagent's tool call refused | An antivirus scanner or the search indexer held a transient handle on a forwarding file | The write is retried automatically for a short window. If it still fails, enable `debugLog` and look for `permission_forwarding.fs_retried` entries — their `attempts` and `code` say whether retrying is helping — then exclude the forwarding directory from the scanner. |
 
 ## Diagnostic Logging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.1.3",
+  "version": "40.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -86,6 +86,13 @@
       "minimum": 1,
       "maximum": 9007199254740991
     },
+    "promptTimeoutMs": {
+      "description": "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Omit for no timer (the default). Pressing any key in the inline dialog stops the timer.",
+      "markdownDescription": "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds.\n\nOmit for no timer (the default): a prompt waits until someone answers it. The clock starts when the prompt is shown, not when the request is raised, so a request queued behind another prompt gets its own full window. In the inline TUI dialog, pressing any key stops the timer, so a prompt you have started answering is never cut off.\n\nThe timeout only ever **denies**, and the agent is told nobody answered. It applies to prompts this session shows, including requests forwarded from its subagents; keep it below `forwardingTimeoutMs` so a forwarded request is answered before the subagent stops waiting.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
     "promptMaxRows": {
       "description": "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",
       "markdownDescription": "Maximum rows a permission prompt renders before eliding its evidence.\n\nOmit to use the default (24). The request's own facts — the requesting agent, the tool, the matched rule, the decision-relevant value — are never elided by this budget; what gives way is the supporting evidence, and `Ctrl+O` expands the prompt to the complete request.",

package/src/access-intent/bash/wrapper-analysis.ts

@@ -3,10 +3,11 @@
  * what it actually runs, and whether its floor still has a reason to hold.
  *
  * Pure and word-based; the AST walk that produces the words lives in
- * `command-enumeration.ts`. The three questions live here together
- * deliberately: the shape that floors a unit to `ask`, the shape that names its
- * inner command, and the shape that exempts it must agree, and separate
- * classifiers over the same vocabulary would drift.
+ * `command-enumeration.ts`. The questions live here together deliberately:
+ * the shape that floors a unit to `ask`, the shape that names its inner
+ * command, the shape that exempts it, and how far a session approval may
+ * generalize past it must agree, and separate classifiers over the same
+ * vocabulary would drift.
  */
 
 import type { FloorExemption } from "#src/types";
@@ -245,8 +246,16 @@ function onlyModifiesExecution(
   peeled: readonly (readonly CommandWord[])[],
   inner: readonly CommandWord[],
 ): boolean {
+  return peeled.every(isAdmittedModifierLayer) && reachedLiteralCommand(inner);
+}
+
+/**
+ * True when a peel ended at an ordinary command spelled as a literal name: not
+ * a wrapper it could not see past, and not shell syntax standing where the
+ * command name should be.
+ */
+function reachedLiteralCommand(inner: readonly CommandWord[]): boolean {
   return (
-    peeled.every(isAdmittedModifierLayer) &&
     classifyWrapperWords(inner) === undefined &&
     isLiteralCommandName(inner.at(0)?.text ?? "")
   );
@@ -309,6 +318,90 @@ function isLiteralCommandName(text: string): boolean {
   return LITERAL_COMMAND_NAME.test(text) && !RESERVED_WORDS.has(text);
 }
 
+// ── Session patterns ─────────────────────────────────────────────────────────
+
+/**
+ * Where the inner command starts for a session-approval pattern: `0` for an
+ * ordinary command, the count of peeled wrapper words when every layer may be
+ * generalized past, or `null` to keep the whole command.
+ *
+ * A session grant skips the wrapper floor, so the pattern built from this
+ * index is the grant's whole width: everything before the index stays literal,
+ * and only the inner command's arguments may vary. Each `null` is a shape where
+ * a pattern ending in a wildcard could name a command the human never saw —
+ * shell syntax the whitespace split cannot read, an opaque payload, a peel
+ * that stopped short, or a layer {@link generalizesLayer} refuses.
+ *
+ * The count is summed over the peeled layers rather than taken from the inner
+ * command's length, since the walk trims an exec terminator off the end.
+ */
+export function sessionCommandIndex(tokens: readonly string[]): number | null {
+  const words = literalWordsOf(tokens);
+  if (classifyWrapperWords(words) === undefined) return 0;
+  if (words.some((word) => word.computed)) return null;
+  const unwrapped = unwrapIndirection(words, "");
+  if (unwrapped.kind === "opaque") return null;
+  if (!unwrapped.peeled.every(generalizesLayer)) return null;
+  if (!reachedLiteralCommand(unwrapped.words)) return null;
+  return unwrapped.peeled.reduce((count, layer) => count + layer.length, 0);
+}
+
+/**
+ * True when a session pattern may keep a peeled layer literal and vary what
+ * follows its inner command.
+ *
+ * A getopt-read wrapper's peel already refuses an unlisted or mode-changing
+ * option. A table-read wrapper skips an unknown option as a flag, so it is
+ * admitted only by the floor exemption's own admission or with no option at
+ * all; that also refuses a `find`/`fd` exec flag, after which `find`'s own
+ * options may follow the inner command.
+ */
+function generalizesLayer(layer: readonly CommandWord[]): boolean {
+  const name = wrapperName(layer);
+  if (name === undefined || runsOpaqueCommandLine(layer)) return false;
+  if (name === "xargs") return !mayReplaceArguments(layer);
+  if (GETOPT_GRAMMARS.has(name)) return true;
+  return (
+    isAdmittedModifierLayer(layer) ||
+    layer.slice(1).every((word) => !word.text.startsWith("-"))
+  );
+}
+
+/**
+ * True when an `xargs` layer may carry a replacement option (`-I`, `-i`,
+ * `--replace`), which lets standard input rewrite the inner command's
+ * arguments, a nested wrapper's executable included.
+ *
+ * Deliberately wider than the grammar: any short cluster holding `I` or `i`
+ * and any long option opening `--r` counts, since a false positive only keeps
+ * the whole command.
+ */
+function mayReplaceArguments(layer: readonly CommandWord[]): boolean {
+  return layer
+    .slice(1)
+    .some(({ text }) => /^-[^-]*[Ii]/.test(text) || text.startsWith("--r"));
+}
+
+/**
+ * A command's whitespace tokens as command words, each marked `computed` when
+ * it carries shell syntax the split cannot read: quoting, expansion, a glob,
+ * grouping, an operator, or a comment.
+ */
+function literalWordsOf(tokens: readonly string[]): CommandWord[] {
+  let offset = 0;
+  return tokens.map((text) => {
+    const word: CommandWord = {
+      text,
+      value: text,
+      computed: SHELL_SYNTAX.test(text),
+      mayLeadWithDash: text.startsWith("-"),
+      offset,
+    };
+    offset += text.length + 1;
+    return word;
+  });
+}
+
 // ── Unwrapping ───────────────────────────────────────────────────────────────
 
 /**
@@ -959,6 +1052,12 @@ const WRITING_OPTIONS = new Map<string, ReadonlySet<string>>([
  */
 const LITERAL_COMMAND_NAME = /^[A-Za-z0-9_./+@%,:][A-Za-z0-9_./+@%,:-]*$/;
 
+/**
+ * A character that makes a whitespace token something other than the literal
+ * word a program receives.
+ */
+const SHELL_SYNTAX = /['"\\$`|&;<>(){}[\]*?!~#]/;
+
 /** Bash reserved words, which open syntax rather than name a command. */
 const RESERVED_WORDS: ReadonlySet<string> = new Set([
   "!",

package/src/authority/answer-window.ts

@@ -0,0 +1,86 @@
+import type { PermissionPromptDecision } from "./permission-dialog";
+
+/**
+ * How long a shown permission prompt waits for a human before it denies.
+ *
+ * Opened when a prompt is presented — never when its ask is admitted, so an
+ * ask queued behind another dialog gets its own full window — and closed when
+ * a human answers. A human who starts answering engages it, which stops the
+ * clock without settling anything: the window bounds an unattended prompt and
+ * never cuts off someone mid-answer. If neither happens first, the window aborts its signal,
+ * which dismisses the prompt, and the window itself is what decided: it stamps
+ * the `unanswered` decider rather than leaving the caller to infer one.
+ *
+ * The timer is `unref`ed, so a window still open when the session ends never
+ * holds the process alive.
+ */
+export class AnswerWindow {
+  private timer: NodeJS.Timeout | undefined;
+
+  private constructor(
+    private readonly timeoutMs: number | undefined,
+    private readonly controller: AbortController | undefined,
+  ) {
+    if (timeoutMs !== undefined && controller !== undefined) {
+      this.timer = setTimeout(() => {
+        this.timer = undefined;
+        controller.abort();
+      }, timeoutMs);
+      this.timer.unref();
+    }
+  }
+
+  /** Opens a window, or a null window that never expires when `timeoutMs` is undefined. */
+  static open(timeoutMs: number | undefined): AnswerWindow {
+    return timeoutMs === undefined
+      ? new AnswerWindow(undefined, undefined)
+      : new AnswerWindow(timeoutMs, new AbortController());
+  }
+
+  /** Aborts when the window expires; `undefined` when no window is configured. */
+  get signal(): AbortSignal | undefined {
+    return this.controller?.signal;
+  }
+
+  /** The window's length while its clock is running; `undefined` once stopped, expired, or never opened. */
+  get pendingTimeoutMs(): number | undefined {
+    return this.timer === undefined ? undefined : this.timeoutMs;
+  }
+
+  /** A human answered: stop the clock. Idempotent. */
+  close(): void {
+    this.stopClock();
+  }
+
+  /** A human started answering: stop the clock and let them finish. Idempotent. */
+  engage(): void {
+    this.stopClock();
+  }
+
+  /**
+   * The decision for a prompt this window dismissed.
+   *
+   * `confirmationUnavailable` holds because no human ruled. A null window
+   * cannot have dismissed anything, so asking it is a caller defect, and the
+   * throw fails the ask closed at the gate boundary rather than inventing a
+   * decider.
+   */
+  expiredDecision(): PermissionPromptDecision {
+    if (this.timeoutMs === undefined) {
+      throw new Error(
+        "no answer window was open, so no prompt can have expired",
+      );
+    }
+    return {
+      approved: false,
+      state: "denied",
+      confirmationUnavailable: true,
+      decidedBy: { kind: "unanswered", timeoutMs: this.timeoutMs },
+    };
+  }
+
+  private stopClock(): void {
+    clearTimeout(this.timer);
+    this.timer = undefined;
+  }
+}

package/src/authority/decision-resolution.ts

@@ -47,6 +47,8 @@ export function resolutionFor(
       return "confirmation_unavailable";
     case "gate_error":
       return "gate_error";
+    case "unanswered":
+      return "prompt_unanswered";
     case "user":
     // A `forwarded` frame reaches here only when the responder named no
     // decider — an older parent — so the hop is the only fact available and

package/src/authority/decision-source.ts

@@ -51,6 +51,12 @@ export type DecisionSource =
   | { kind: "unavailable"; reason: string }
   /** A gate threw, and the boundary blocked rather than allowed. */
   | { kind: "gate_error"; reason: string }
+  /**
+   * A human was shown the prompt and nobody answered it within the configured
+   * `promptTimeoutMs` window, so the window denied. Distinct from
+   * `unavailable`, where no prompt could be shown at all.
+   */
+  | { kind: "unanswered"; timeoutMs: number }
   /**
    * Another session decided. Recursive by design: the requesting side records
    * both that the decider was elsewhere and what, within that session, decided
@@ -147,6 +153,8 @@ function narrowSource(
       return typeof candidate.reason === "string"
         ? { kind: "gate_error", reason: candidate.reason }
         : undefined;
+    case "unanswered":
+      return narrowUnanswered(candidate);
     case "forwarded":
       return narrowForwarded(candidate, depthBudget);
     default:
@@ -161,6 +169,17 @@ function narrowUser(
   return via ? { kind: "user", via } : undefined;
 }
 
+function narrowUnanswered(
+  candidate: Record<string, unknown>,
+): DecisionSource | undefined {
+  const { timeoutMs } = candidate;
+  return typeof timeoutMs === "number" &&
+    Number.isFinite(timeoutMs) &&
+    timeoutMs > 0
+    ? { kind: "unanswered", timeoutMs }
+    : undefined;
+}
+
 function narrowAuthorizer(
   candidate: Record<string, unknown>,
 ): DecisionSource | undefined {

package/src/authority/local-user-authorizer.ts

@@ -66,10 +66,7 @@ export class LocalUserAuthorizer implements TerminalAuthorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    return this.deps.dialogs.run(
-      () => this.present(details),
-      unansweredDecision,
-    );
+    return this.deps.dialogs.run(() => this.present(details), releasedDecision);
   }
 
   /**
@@ -114,7 +111,7 @@ export class LocalUserAuthorizer implements TerminalAuthorizer {
  * one string so what the model is told and what the log attributes cannot
  * drift (#726).
  */
-function unansweredDecision(reason: string): PermissionPromptDecision {
+function releasedDecision(reason: string): PermissionPromptDecision {
   return {
     approved: false,
     state: "denied",

package/src/authority/permission-dialog.ts

@@ -17,7 +17,8 @@ export type PermissionPromptDecision = {
    * reachable at all (`DenyingAuthorizer`, a no-UI non-subagent session) or the
    * forwarding path gave up before reaching one (`ParentAuthorizer` — target
    * unresolvable, request undeliverable, target not serving, or no answer
-   * within the timeout). Consumed by the gate (block reason) and
+   * within the timeout), or a prompt was shown and nobody answered it within
+   * its `promptTimeoutMs` window (`AnswerWindow`). Consumed by the gate (block reason) and
    * `PermissionPrompter` (review-entry resolution) to report
    * "confirmation_unavailable" rather than a plain user denial — a user who
    * was never asked denied nothing (#719). The decision-event resolution
@@ -55,9 +56,22 @@ export type PermissionPromptDecision = {
  */
 export type UnattributedDecision = Omit<PermissionPromptDecision, "decidedBy">;
 
+/** What the fallback hands each host dialog: the signal that may dismiss it. */
+export interface PermissionDialogOptions {
+  signal?: AbortSignal;
+}
+
 export interface PermissionDecisionUi {
-  select(title: string, options: string[]): Promise<string | undefined>;
-  input(title: string, placeholder?: string): Promise<string | undefined>;
+  select(
+    title: string,
+    options: string[],
+    opts?: PermissionDialogOptions,
+  ): Promise<string | undefined>;
+  input(
+    title: string,
+    placeholder?: string,
+    opts?: PermissionDialogOptions,
+  ): Promise<string | undefined>;
 }
 
 const APPROVE_OPTION = "Yes";
@@ -140,12 +154,25 @@ export interface RequestPermissionOptions {
   };
 }
 
+/**
+ * Ask through the host's `select`/`input` dialogs.
+ *
+ * `signal` reaches every dialog, and the host resolves a dismissed one
+ * `undefined` — the same value a human cancel produces. The two are told apart
+ * by the signal: an `undefined` while it is aborted answers `undefined` (the
+ * prompt was dismissed, so no human ruled), and one while it is live keeps its
+ * meaning as the human's cancel.
+ */
 export async function requestPermissionDecisionFromUi(
   ui: PermissionDecisionUi,
   title: string,
   message: string,
   options?: RequestPermissionOptions,
-): Promise<UnattributedDecision> {
+  signal?: AbortSignal,
+): Promise<UnattributedDecision | undefined> {
+  const dialogOptions: PermissionDialogOptions = { signal };
+  const dismissed = (answer: string | undefined): boolean =>
+    answer === undefined && signal?.aborted === true;
   const sessionOption = options?.sessionLabel ?? APPROVE_FOR_SESSION_OPTION;
   const widthOption = options?.sessionWidth?.label;
   const decisionOptions = [
@@ -156,7 +183,14 @@ export async function requestPermissionDecisionFromUi(
     DENY_WITH_REASON_OPTION,
   ];
 
-  const selected = await ui.select(`${title}\n${message}`, decisionOptions);
+  const selected = await ui.select(
+    `${title}\n${message}`,
+    decisionOptions,
+    dialogOptions,
+  );
+  if (dismissed(selected)) {
+    return undefined;
+  }
 
   if (selected === APPROVE_OPTION) {
     return {
@@ -171,10 +205,17 @@ export async function requestPermissionDecisionFromUi(
     const width: SessionGrantWidth =
       selected === widthOption ? "family" : "proven";
     if (options?.sessionScope) {
-      const scope = await ui.select(`${title}\nApply this session grant to:`, [
-        options.sessionScope.subagentLabel,
-        options.sessionScope.servingSessionLabel,
-      ]);
+      const scope = await ui.select(
+        `${title}\nApply this session grant to:`,
+        [
+          options.sessionScope.subagentLabel,
+          options.sessionScope.servingSessionLabel,
+        ],
+        dialogOptions,
+      );
+      if (dismissed(scope)) {
+        return undefined;
+      }
       return sessionApproval(
         // A cancelled scope select (undefined) falls back to the
         // least-privilege subagent scope.
@@ -188,12 +229,15 @@ export async function requestPermissionDecisionFromUi(
   }
 
   if (selected === DENY_WITH_REASON_OPTION) {
-    const denialReason = normalizePermissionDenialReason(
-      await ui.input(
-        `${title}\nShare why this request was denied (optional).`,
-        "Reason shown back to the agent",
-      ),
+    const typed = await ui.input(
+      `${title}\nShare why this request was denied (optional).`,
+      "Reason shown back to the agent",
+      dialogOptions,
     );
+    if (dismissed(typed)) {
+      return undefined;
+    }
+    const denialReason = normalizePermissionDenialReason(typed);
 
     return createDeniedPermissionDecision(denialReason);
   }

package/src/authority/permission-prompt-component.ts

@@ -23,6 +23,7 @@ import {
   renderPromptNotification,
 } from "#src/presentation/prompt-notification";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { AnswerWindow } from "./answer-window";
 import { collapsePastedNewlines } from "./bracketed-paste";
 import type { DecisionSource, UserDecisionSurface } from "./decision-source";
 import {
@@ -76,6 +77,8 @@ export interface PromptPreferences {
   dialogKeys: DialogKeyBindings;
   /** Terminal notifications the inline dialog emits as it opens; empty for none. */
   promptNotifications: readonly PromptNotificationChannel[];
+  /** How long a shown prompt waits for an answer before it denies; absent for no timer. */
+  promptTimeoutMs?: number;
 }
 
 /**
@@ -89,6 +92,10 @@ export interface PromptPreferences {
  * answered on, so it is where the decision is attributed to that surface
  * (#726). Having the dialog model and the fallback each name themselves would
  * be two sites that must agree with this branch.
+ *
+ * It also opens the prompt's {@link AnswerWindow} as the prompt is shown. A
+ * surface the window dismissed answers `undefined`, and the window, which is
+ * what decided, stamps the `unanswered` decision itself.
  */
 export async function requestPermissionDecision(
   view: PermissionPromptView,
@@ -96,12 +103,65 @@ export async function requestPermissionDecision(
   payload: PromptPayload,
   options?: RequestPermissionOptions,
 ): Promise<PermissionPromptDecision> {
+  const window = AnswerWindow.open(view.promptTimeoutMs);
+  const surface = chooseDecisionSurface(view, title, payload, options);
+  try {
+    const answer = await surface.ask(window);
+    return answer === undefined
+      ? window.expiredDecision()
+      : attributeToHuman(answer, surface.via);
+  } finally {
+    window.close();
+  }
+}
+
+/**
+ * One human-facing surface: how to ask on it, and the name it answers under.
+ *
+ * `ask` answers `undefined` only when the window dismissed the prompt.
+ */
+interface DecisionSurface {
+  via: UserDecisionSurface;
+  ask: (window: DialogClock) => Promise<UnattributedDecision | undefined>;
+}
+
+/**
+ * The answer window as a surface uses it: the signal that dismisses the
+ * prompt, and — for the inline dialog, which sees keystrokes — the
+ * running length to show and the means to stop it once the human engages.
+ */
+export type DialogClock = Pick<
+  AnswerWindow,
+  "signal" | "pendingTimeoutMs" | "engage"
+>;
+
+function chooseDecisionSurface(
+  view: PermissionPromptView,
+  title: string,
+  payload: PromptPayload,
+  options?: RequestPermissionOptions,
+): DecisionSurface {
   if (view.mode === "tui") {
-    return attributeToHuman(
-      await presentInlinePermissionPrompt(view, title, payload, options),
-      "dialog",
-    );
+    return {
+      via: "dialog",
+      ask: (window) =>
+        presentInlinePermissionPrompt(view, title, payload, options, window),
+    };
   }
+  return {
+    via: "select",
+    ask: (window) =>
+      askThroughFallback(view, title, payload, options, window.signal),
+  };
+}
+
+function askThroughFallback(
+  view: PermissionPromptView,
+  title: string,
+  payload: PromptPayload,
+  options: RequestPermissionOptions | undefined,
+  signal: AbortSignal | undefined,
+): Promise<UnattributedDecision | undefined> {
   // The fallback renders once and cannot re-render, so it neither paints nor
   // offers an expansion; it substitutes a nominal width for the terminal size
   // it is never told, and the host's own select wraps from there.
@@ -109,14 +169,12 @@ export async function requestPermissionDecision(
     ...view.budget,
     width: FALLBACK_RENDER_WIDTH,
   });
-  return attributeToHuman(
-    await requestPermissionDecisionFromUi(
-      view.ui,
-      title,
-      rendered.lines.join("\n"),
-      options,
-    ),
-    "select",
+  return requestPermissionDecisionFromUi(
+    view.ui,
+    title,
+    rendered.lines.join("\n"),
+    options,
+    signal,
   );
 }
 
@@ -146,12 +204,18 @@ const OPTION_LABELS: Record<PromptAction, string> = {
   denyWithReason: "No, provide reason",
 };
 
+/**
+ * Show the inline dialog. The clock's signal dismisses it: an abort closes the
+ * dialog and answers `undefined`, so a caller can tell a dismissal from a
+ * human answer. The first keystroke engages the clock, stopping it.
+ */
 export function presentInlinePermissionPrompt(
   view: PermissionPromptView,
   title: string,
   payload: PromptPayload,
   options?: RequestPermissionOptions,
-): Promise<UnattributedDecision> {
+  clock?: DialogClock,
+): Promise<UnattributedDecision | undefined> {
   const config: PromptModelConfig = {
     doublePressToConfirm: view.doublePressToConfirm,
     sessionLabel: options?.sessionLabel ?? DEFAULT_SESSION_LABEL,
@@ -159,8 +223,17 @@ export function presentInlinePermissionPrompt(
     sessionScope: options?.sessionScope,
     keys: view.dialogKeys,
   };
-  return view.ui.custom<UnattributedDecision>(
+  return view.ui.custom<UnattributedDecision | undefined>(
     (tui, theme, keybindings, done) => {
+      // The host's `done` is idempotent, so a human answer racing the abort
+      // settles whichever arrives first.
+      clock?.signal?.addEventListener(
+        "abort",
+        () => {
+          done(undefined);
+        },
+        { once: true },
+      );
       // The factory runs once, as the dialog mounts, which is the moment the
       // human is being asked; a re-render does not come back through here.
       const notification = renderPromptNotification(
@@ -181,6 +254,7 @@ export function presentInlinePermissionPrompt(
           tui.requestRender();
         },
         done,
+        clock,
       );
     },
     { overlay: false },
@@ -228,6 +302,7 @@ class PermissionPromptComponent implements Component {
     private readonly handleAppAction: (data: string) => boolean,
     private readonly requestRender: () => void,
     private readonly done: (decision: UnattributedDecision) => void,
+    private readonly clock: DialogClock | undefined,
   ) {
     this.state = initialPromptState(config);
     this.reason = this.createReasonEditor();
@@ -306,10 +381,15 @@ class PermissionPromptComponent implements Component {
     } else if (view.elided) {
       keys.push("ctrl+o full request");
     }
+    const pendingTimeoutMs = this.clock?.pendingTimeoutMs;
+    if (pendingTimeoutMs !== undefined) {
+      keys.push(`unanswered, denies in ${pendingTimeoutMs / 1000}s`);
+    }
     return this.theme.fg("muted", keys.join(" · "));
   }
 
   handleInput(data: string): void {
+    this.engageClock();
     if (this.state.step === "reason") {
       this.handleReasonInput(data);
       return;
@@ -327,6 +407,21 @@ class PermissionPromptComponent implements Component {
     }
   }
 
+  /**
+   * Stop the answer window on the human's first keystroke.
+   *
+   * The window bounds a prompt nobody is attending to; a keystroke proves
+   * someone is, so the dialog waits for them to finish rather than vanishing
+   * mid-answer. Re-renders so the hint stops advertising a deadline.
+   */
+  private engageClock(): void {
+    if (this.clock?.pendingTimeoutMs === undefined) {
+      return;
+    }
+    this.clock.engage();
+    this.requestRender();
+  }
+
   /**
    * Hand the keystroke to the framework line editor.
    *

package/src/config/config-loader.ts

@@ -225,6 +225,7 @@ export function mergeUnifiedConfigs(
   // Number scalars: override replaces base when defined
   for (const key of [
     "forwardingTimeoutMs",
+    "promptTimeoutMs",
     "promptMaxRows",
     "promptFieldMaxWidth",
     "reviewLogFieldMaxWidth",

package/src/config/config-schema.ts

@@ -388,6 +388,12 @@ export const unifiedConfigSchema = z
         "How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds.\n\nOmit to use the default (`600000`, ten minutes). A child whose in-process parent is not draining its inbox at all gives up in a couple of seconds regardless of this value, so lower it only to bound how long you are willing to leave an *unanswered* prompt pending.",
       default: 600000,
     }),
+    promptTimeoutMs: z.number().int().min(1).optional().meta({
+      description:
+        "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Omit for no timer (the default). Pressing any key in the inline dialog stops the timer.",
+      markdownDescription:
+        "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds.\n\nOmit for no timer (the default): a prompt waits until someone answers it. The clock starts when the prompt is shown, not when the request is raised, so a request queued behind another prompt gets its own full window. In the inline TUI dialog, pressing any key stops the timer, so a prompt you have started answering is never cut off.\n\nThe timeout only ever **denies**, and the agent is told nobody answered. It applies to prompts this session shows, including requests forwarded from its subagents; keep it below `forwardingTimeoutMs` so a forwarded request is answered before the subagent stops waiting.",
+    }),
     promptMaxRows: z.number().int().min(1).optional().meta({
       description:
         "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",

package/src/config/extension-config.ts

@@ -24,6 +24,8 @@ export interface PermissionSystemExtensionConfig {
   piInfrastructureReadPaths?: string[];
   /** How long a subagent waits for the parent's answer to a forwarded ask, in ms. Defaults to 600000. */
   forwardingTimeoutMs?: number;
+  /** How long a shown permission prompt waits for an answer before denying, in ms. Absent means no timer. */
+  promptTimeoutMs?: number;
   /** Max rows a permission prompt renders before eliding its evidence. Defaults to 24. */
   promptMaxRows?: number;
   /** Max characters of any one field shown in a permission prompt. Defaults to 400. */
@@ -84,6 +86,9 @@ export function normalizePermissionSystemConfig(
   if (raw.forwardingTimeoutMs !== undefined) {
     result.forwardingTimeoutMs = raw.forwardingTimeoutMs;
   }
+  if (raw.promptTimeoutMs !== undefined) {
+    result.promptTimeoutMs = raw.promptTimeoutMs;
+  }
   if (raw.promptMaxRows !== undefined) {
     result.promptMaxRows = raw.promptMaxRows;
   }

package/src/index.ts

@@ -159,6 +159,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       budget: resolveRenderBudget(configStore.current()),
       dialogKeys: resolveDialogKeys(configStore.current()).keys,
       promptNotifications: configStore.current().promptNotifications ?? [],
+      promptTimeoutMs: configStore.current().promptTimeoutMs,
     }),
     requestPermissionDecision,
     forwardingDir: paths.forwardingDir,

package/src/presentation/agent-renderer.ts

@@ -82,6 +82,13 @@ export function renderRefusal(
       );
     case "unavailable":
       return renderUnavailableDenial(payload, denialReason, budget);
+    case "unanswered":
+      return renderUnansweredDenial(
+        payload,
+        { timeoutMs: decider.timeoutMs, decidedElsewhere },
+        denialReason,
+        budget,
+      );
     case "rule":
       return renderEscalatedPolicyDenial(
         payload,
@@ -231,6 +238,35 @@ export function renderUnavailableDenial(
   );
 }
 
+/** The prompt window that expired, and where the prompt was shown. */
+export interface UnansweredPrompt {
+  /** How long the prompt stayed open unanswered, in milliseconds. */
+  readonly timeoutMs: number;
+  /** Whether the prompt was shown in a session reached through a forwarding hop. */
+  readonly decidedElsewhere: boolean;
+}
+
+/**
+ * The agent-facing render of a prompt nobody answered within its window.
+ *
+ * Unlike {@link renderUnavailableDenial}, a prompt *was* shown, so the sentence
+ * says nobody answered rather than that no UI exists; unlike
+ * {@link renderUserDenial}, it never claims the user refused. Like the
+ * unavailable render, it omits the escaped boundary: no rule ruled, so no
+ * retry shape would change the outcome.
+ */
+export function renderUnansweredDenial(
+  payload: PromptPayload,
+  prompt: UnansweredPrompt,
+  denialReason: string | null,
+  budget: AgentRenderBudget = DEFAULT_RENDER_BUDGET,
+): string {
+  return tagged(
+    `Nobody${servingClause(prompt.decidedElsewhere)} answered the approval prompt for this ${identification(payload, budget, "call", askRuleClause(payload))} within ${prompt.timeoutMs / 1000}s.`,
+    denialReason,
+  );
+}
+
 // ── Sentence assembly ──────────────────────────────────────────────────────
 
 /**

package/src/presentation/pattern-suggest.ts

@@ -2,6 +2,7 @@ import {
   prefix,
   stripBashCommentLines,
 } from "#src/access-intent/bash/bash-arity";
+import { sessionCommandIndex } from "#src/access-intent/bash/wrapper-analysis";
 import {
   type CapabilityDirection,
   PATH_BEARING_TOOLS,
@@ -30,6 +31,10 @@ export interface SessionApprovalSuggestion {
  * - Arity prefix covers all tokens: trailing wildcard (`npm run build*`).
  * - Arity prefix shorter than token list: space + wildcard (`git checkout *`).
  * - Unknown command: first token + space wildcard (`mytool *`).
+ * - Recognized wrapper: its words, then the inner command's arity prefix,
+ *   then a space wildcard (`sudo -u root nohup mytool *`).
+ * - Wrapper whose inner command cannot be proven: the exact command, with no
+ *   wildcard (`watch mytool x`).
  */
 export function suggestBashPattern(command: string): string {
   const trimmed = command.trim();
@@ -40,6 +45,12 @@ export function suggestBashPattern(command: string): string {
   if (!stripped) return "";
   const tokens = stripped.split(/\s+/);
   if (tokens.length === 1) return stripped;
+  // A wrapper's words are split only where bash splits them: `\s` also splits
+  // on a non-breaking space or `\r`, which would read `rm<NBSP>-rf` as `rm`.
+  const words = stripped.split(BASH_BLANKS);
+  const commandIndex = sessionCommandIndex(words);
+  if (commandIndex === null) return stripped;
+  if (commandIndex > 0) return wrappedPattern(words, commandIndex);
   const meaningful = prefix(tokens);
   if (meaningful.length >= tokens.length) {
     return `${stripped}*`;
@@ -47,6 +58,28 @@ export function suggestBashPattern(command: string): string {
   return `${meaningful.join(" ")} *`;
 }
 
+/** The blanks bash splits a command's words on. */
+const BASH_BLANKS = /[ \t\n]+/;
+
+/**
+ * The wrapper words kept literally, then the inner command's arity prefix.
+ *
+ * The wildcard always follows a space, even when the arity prefix covers every
+ * token, so approving `nohup mytool` never approves `nohup mytool-other`; the
+ * matcher treats a trailing space and wildcard as optional, so the bare
+ * command is still covered.
+ */
+function wrappedPattern(
+  tokens: readonly string[],
+  commandIndex: number,
+): string {
+  const meaningful = [
+    ...tokens.slice(0, commandIndex),
+    ...prefix(tokens.slice(commandIndex)),
+  ];
+  return `${meaningful.join(" ")} *`;
+}
+
 /**
  * Suggest an MCP session-approval pattern from a resolved target string.
  *

package/src/service/permission-events.ts

@@ -139,6 +139,11 @@ export type PermissionDecisionResolution =
   | "user_denied"
   | "auto_approved"
   | "confirmation_unavailable"
+  /**
+   * A human was shown the prompt and nobody answered within the configured
+   * `promptTimeoutMs`, so the request was denied.
+   */
+  | "prompt_unanswered"
   /** A registered `authorizerChain` link granted the ask; no human was asked. */
   | "authorizer_allowed"
   /** A registered `authorizerChain` link refused the ask; no human was asked. */