@gotgenes/pi-permission-system 40.1.4 → 40.2.1

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.2.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.2.0...pi-permission-system-v40.2.1) (2026-10-14)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** a computed word in a wrapper's options keeps the indirection floor ([754a5fa](https://github.com/gotgenes/pi-packages/commit/754a5fadcab0aeac765ecb8cf423b1fb55e8d4d5))
+
+### Documentation
+
+* **pi-permission-system:** one literal-word rule for both wrapper floor exemptions ([334318a](https://github.com/gotgenes/pi-packages/commit/334318a0a918557e92741d442cba7728b66cc92e))
+
+## [40.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.4...pi-permission-system-v40.2.0) (2026-10-12)
+
+
+### Features
+
+* **pi-permission-system:** deny a permission prompt nobody answers within promptTimeoutMs ([10812e8](https://github.com/gotgenes/pi-packages/commit/10812e83e8c766198d1b8a7eceafee7743bc6b23)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+* **pi-permission-system:** keep a permission prompt open once you start answering it ([39f7e3f](https://github.com/gotgenes/pi-packages/commit/39f7e3fba80d7c7235dc20c574430fb967779f0b)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+
+### Documentation
+
+* **pi-permission-system:** document promptTimeoutMs and the unanswered decider ([38eb4a6](https://github.com/gotgenes/pi-packages/commit/38eb4a6fe651ebc566b4d119a24a1d7645412dd7)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+* **pi-permission-system:** fix stale releasedDecision reference and note the fallback window spans follow-up dialogs ([4cc6b10](https://github.com/gotgenes/pi-packages/commit/4cc6b10327a504823d921fa11bc1b6bfa5bbb82e)), closes [#735](https://github.com/gotgenes/pi-packages/issues/735)
+
 ## [40.1.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.3...pi-permission-system-v40.1.4) (2026-10-10)
 
 

package/README.md

@@ -68,6 +68,7 @@ When the dialog prompts, you can approve once or approve a pattern for the rest
 In an interactive TUI session the prompt is an inline keybind dialog — `y` approve, `s` approve for this session, `n` deny, `r` deny with a reason — where each hotkey arms and a second press confirms (configurable via `doublePressToConfirm`).
 The hotkeys themselves are remappable through `permissionDialogKeys`, which matters if you type with an input method editor: composition mode swallows letter keys before they reach the terminal, and digits do not.
 Set `promptNotifications` (for example `["bell"]`) and the dialog also rings the terminal as it opens, so a session waiting on you in another tab or pane gets flagged.
+For an unattended run, set `promptTimeoutMs` and a prompt nobody answers within that window is denied, with the agent told nobody answered; by default a prompt waits indefinitely, and pressing any key stops the clock ([details](docs/configuration.md#unanswered-prompts)).
 A file-access ask that proves a single direction offers `b` as well, granting the session both directions instead of only the one the gate proved.
 The prompt shows one fact per line — who is asking, the tool, the matched rule, the value being decided — within a row budget, so a large tool input cannot take over the transcript; `Ctrl+O` (`app.tools.expand`) expands it to the complete request.
 See [docs/configuration.md](docs/configuration.md#inline-permission-dialog-tui) for the hotkeys and [docs/session-approvals.md](docs/session-approvals.md) for session-scoped rules and pattern suggestions.

package/dist/public.d.ts

@@ -313,6 +313,11 @@ interface PermissionUiPromptEvent {
 }
 /** How a permission decision was reached. */
 type PermissionDecisionResolution = "policy_allow" | "policy_deny" | "session_approved" | "infrastructure_auto_allowed" | "user_approved" | "user_approved_for_session" | "user_denied" | "auto_approved" | "confirmation_unavailable"
+/**
+ * A human was shown the prompt and nobody answered within the configured
+ * `promptTimeoutMs`, so the request was denied.
+ */
+ | "prompt_unanswered"
 /** A registered `authorizerChain` link granted the ask; no human was asked. */
  | "authorizer_allowed"
 /** A registered `authorizerChain` link refused the ask; no human was asked. */

package/docs/configuration.md

@@ -36,7 +36,7 @@ See [migration/0644-project-trust-gating.md](migration/0644-project-trust-gating
 4. Project agent frontmatter
 
 The `permission` object uses deep-shallow merge: string-vs-string replaces; both-object shallow-merges pattern maps; string-vs-object the override wins entirely.
-Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`, `forwardingTimeoutMs`, `promptMaxRows`, `promptFieldMaxWidth`) use simple replacement.
+Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConfirm`, `forwardingTimeoutMs`, `promptTimeoutMs`, `promptMaxRows`, `promptFieldMaxWidth`) use simple replacement.
 `permissionDialogKeys` replaces the whole map rather than merging entry by entry, so the map that was validated is the map that applies.
 `promptNotifications` likewise replaces the whole list, so a project `[]` turns off a global list.
 
@@ -60,6 +60,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
   "yoloMode": false,
   "doublePressToConfirm": true,
   "forwardingTimeoutMs": 600000,
+  // "promptTimeoutMs": 60000, // opt-in: deny a prompt nobody answers (unset = no timer)
   "piInfrastructureReadPaths": [],
 
   // Non-bash tools that carry shell semantics
@@ -108,6 +109,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
 | `permissionDialogKeys`      | —        | Remaps the inline TUI dialog's decision hotkeys (see below). One printable character per decision; omitted decisions keep `y` / `s` / `b` / `n` / `r`.                                                                                       |
 | `promptNotifications`       | `[]`     | Terminal notifications to emit when the inline TUI dialog opens: `"bell"`, `"osc9"`, `"osc777"` (see below). Empty for none.                                                                                                                 |
 | `forwardingTimeoutMs`       | `600000` | How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds. A child whose parent is not draining its inbox gives up in ~2 s regardless, whether that parent runs in this process or its own. |
+| `promptTimeoutMs`           | —        | How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Unset (the default) means no timer. See [Unanswered prompts](#unanswered-prompts).                             |
 | `promptMaxRows`             | `24`     | Max rows a permission prompt renders before eliding its evidence. The request's own facts are never elided by this budget; `Ctrl+O` expands the prompt to the complete request.                                                              |
 | `promptFieldMaxWidth`       | `400`    | Max characters of any one field shown in a permission prompt. This is what bounds a single long field (a here-string command, say) that would otherwise fill the prompt through wrapping.                                                    |
 | `reviewLogFieldMaxWidth`    | `1000`   | Max characters of any one value written to the review log. A longer value is stored shortened, marked with an ellipsis. Raise it to keep longer values; this is a length bound, not redaction.                                               |
@@ -229,6 +231,29 @@ Inside tmux, prefer `"bell"`: tmux passes a BEL through to its own bell handling
 
 To run a program instead (Herdr, `cmux notify`, a push to your phone), write a small extension on the `permissions:ui_prompt` and `permissions:decision` broadcasts; see the [recipe](cross-extension-api.md#recipe-bridging-a-prompt-to-an-external-notifier).
 
+### Unanswered prompts
+
+By default a permission prompt waits until someone answers it.
+For a run you leave unattended, set `promptTimeoutMs` so a prompt nobody answers is denied instead of holding the agent indefinitely:
+
+```jsonc
+{
+  "promptTimeoutMs": 60000
+}
+```
+
+When the window expires, the prompt is dismissed and the request is **denied**; the timeout never approves anything.
+The agent is told that nobody answered the approval prompt within the window, not that you refused it, so it can try another approach or carry on with other work.
+The review log records the decision as `decidedBy: { "kind": "unanswered", "timeoutMs": 60000 }`, and the `permissions:decision` broadcast reports `prompt_unanswered`.
+
+The clock starts when a prompt is shown, not when the request is raised.
+A request waiting behind another open prompt gets its own full window once it is shown, so several unanswered requests take about one window each.
+In the inline TUI dialog, the hint row names the window while it runs, and pressing any key stops the clock: once you start answering (moving the highlight, typing a denial reason), the dialog waits for you to finish.
+The `select` fallback outside TUI mode has no keystroke to watch, so its window runs until you finish answering or it expires, and it spans the follow-up dialogs too: a window that expires while the grant-scope choice or the denial-reason input is open discards the half-made answer and denies the request as unanswered.
+
+A request forwarded from a subagent is shown in the parent session, so the **parent's** `promptTimeoutMs` applies to it, and the subagent receives the same unanswered denial.
+The subagent separately stops waiting after `forwardingTimeoutMs`; keep `promptTimeoutMs` below it, or the subagent can give up while the parent's prompt is still open.
+
 ### What a prompt shows
 
 The prompt renders one fact per line, with the requesting agent (and, for a forwarded subagent ask, its session), the tool, the gate surface, the matched rule, the decision-relevant value, and — for a wrapper such as `xargs` — the command that will actually run.
@@ -1069,15 +1094,18 @@ The floor guards unknowability of *scope*, and scope stays the path surfaces' jo
 Such a unit is therefore **not** floored.
 It resolves by the inner command's own `bash` rules instead, and the review log records `floorExemption: "core-reader"` beside the rule that decided, so an allow the floor would once have prompted for is auditable to the reason that let it through.
 
-All four of these must hold, and each is a way the floor's reason could still apply:
+All five of these must hold, and each is a way the floor's reason could still apply:
 
 1. The unit is an indirection wrapper.
    An `sh -c`/`eval` payload is not one — see below.
 2. The command it runs can be established without passing through an inline shell.
    `watch` and `parallel` hand their whole command line to a shell, and `rush` and `rust-parallel` build theirs from a template, so a unit with any of the four as a layer never qualifies: `watch cat x \; rm y` runs `rm`.
-3. That command **proves** a read: a bare-basename core word with no option that withdraws the claim.
+3. Every word the wrapper itself takes (an option, its value, an operand, a `NAME=value` word) is written literally.
+   The shell splits or expands a computed word before the wrapper runs, so `sudo -u $U cat x` with `U="root rm y"` runs `rm y cat x`; quoting does not exempt it, since `"$@"` can vanish and a quoted variable can name an array.
+   A computed word of the command it runs is fine: `sudo -u root cat $X` still qualifies.
+4. That command **proves** a read: a bare-basename core word with no option that withdraws the claim.
    So `xargs sort -o /tmp/x` and `xargs find . -delete` stay floored, and so does `xargs ./grep foo`.
-4. The enclosing statement provably writes no file through a redirect.
+5. The enclosing statement provably writes no file through a redirect.
    A destination the parse cannot resolve — `> $OUT`, `> $(mktemp)` — counts against the exemption rather than for it.
 
 So `xargs grep -l foo`, `xargs wc -l`, `xargs sed -n 1p`, `find . -name '*.ts' -exec cat {} +`, and the no-op probe `sudo -n true` stop prompting under a matching `bash` allow, while `xargs rm`, `xargs sed -i`, and `find . -exec sh -c '…' \;` still prompt.
@@ -1090,7 +1118,7 @@ Three things this does **not** change:
   Under `bash: {"*": "allow", "grep *": "deny"}`, `xargs grep foo` is denied rather than merely prompted.
 - Path gating is untouched.
   The exemption decides the `bash` surface only, and every path token the command projects still goes through `path` and `external_directory` with the direction its command proved.
-  Clause 4 is what keeps that from being a weaker promise than it sounds: a redirect destination the parse cannot resolve (`> $OUT`, `> $(mktemp)`) is not projected onto those surfaces either, so the wrapper keeps its floor rather than relying on a gate that would not see the write.
+  Clause 5 is what keeps that from being a weaker promise than it sounds: a redirect destination the parse cannot resolve (`> $OUT`, `> $(mktemp)`) is not projected onto those surfaces either, so the wrapper keeps its floor rather than relying on a gate that would not see the write.
 
 ##### A wrapper that only modifies execution
 
@@ -1102,7 +1130,7 @@ All four of these must hold, and each keeps the decision about the command that
 
 1. **Every** wrapper layer is one of the five.
    `time sudo rm -rf x` and `sudo time pnpm test` stay floored, as do `nohup` (it may write `nohup.out`) and `flock` (it creates its lock file).
-2. Every option on each layer is one that wrapper is known to take, spelled in full, and every option, value, and operand is written literally (an environment assignment, which the shell does not split, may be computed).
+2. Every option on each layer is one that wrapper is known to take, spelled in full, and every option, value, operand, and `NAME=value` word is written literally.
    A word the shell rewrites (`timeout $D …`, `timeout {5,sudo} …`) may become several, one of them a wrapper, so it keeps the floor.
    So `timeout --sig KILL 5 …` (an abbreviation) and `nice -5 …` stay floored, and so do `time`'s file-writing `-o`, `--output`, and `-a`.
    The admitted options are `time -p`/`-l`/`-h`/`-f`; `timeout -s`/`-k`/`-f`/`-p`/`-v` and their long forms; `nice -n`/`--adjustment`; and `stdbuf -i`/`-o`/`-e` and their long forms.

package/docs/cross-extension-api.md

@@ -502,20 +502,21 @@ pi.events.on("permissions:decision", (raw) => {
 
 ### Resolution Values
 
-| Value                         | Meaning                                                              |
-| ----------------------------- | -------------------------------------------------------------------- |
-| `policy_allow`                | Config rule said allow — no prompt shown                             |
-| `policy_deny`                 | Config rule said deny — blocked immediately                          |
-| `session_approved`            | Covered by a session-level approval from earlier in the same session |
-| `infrastructure_auto_allowed` | Read of a Pi infrastructure path — auto-allowed                      |
-| `user_approved`               | User approved once via dialog                                        |
-| `user_approved_for_session`   | User approved for the rest of the session                            |
-| `user_denied`                 | User denied via dialog                                               |
-| `authorizer_allowed`          | A registered `authorizerChain` link granted the ask — no human asked |
-| `authorizer_denied`           | A registered `authorizerChain` link refused the ask — no human asked |
-| `auto_approved`               | Yolo mode — approved automatically without dialog                    |
-| `confirmation_unavailable`    | State was `ask` but no UI was available — blocked                    |
-| `gate_error`                  | The gate threw, or an escalation failed — blocked, fail-closed       |
+| Value                         | Meaning                                                                  |
+| ----------------------------- | ------------------------------------------------------------------------ |
+| `policy_allow`                | Config rule said allow — no prompt shown                                 |
+| `policy_deny`                 | Config rule said deny — blocked immediately                              |
+| `session_approved`            | Covered by a session-level approval from earlier in the same session     |
+| `infrastructure_auto_allowed` | Read of a Pi infrastructure path — auto-allowed                          |
+| `user_approved`               | User approved once via dialog                                            |
+| `user_approved_for_session`   | User approved for the rest of the session                                |
+| `user_denied`                 | User denied via dialog                                                   |
+| `authorizer_allowed`          | A registered `authorizerChain` link granted the ask — no human asked     |
+| `authorizer_denied`           | A registered `authorizerChain` link refused the ask — no human asked     |
+| `auto_approved`               | Yolo mode — approved automatically without dialog                        |
+| `confirmation_unavailable`    | State was `ask` but no UI was available — blocked                        |
+| `prompt_unanswered`           | A prompt was shown and nobody answered within `promptTimeoutMs` — denied |
+| `gate_error`                  | The gate threw, or an escalation failed — blocked, fail-closed           |
 
 ### Recipe: bridging a prompt to an external notifier
 

package/docs/subagent-integration.md

@@ -186,6 +186,8 @@ permission requests.
 The grace window exists so a request that arrives while the parent is switching sessions is not abandoned in the gap.
 Absence of a record is deliberately **not** read as unknown: a cleanly exited parent leaves nothing behind, so treating absence as "maybe serving" would restore the full-timeout stall that the heartbeat exists to end.
 A target that *is* draining its inbox is waited on for the full `forwardingTimeoutMs`, however long the human takes to decide.
+The exception is the serving session's own `promptTimeoutMs`: when it is set and nobody answers the forwarded prompt within it, the serving session denies the request as unanswered and the child receives that decision, telling its agent that nobody answered rather than that the user refused.
+Keep `promptTimeoutMs` below `forwardingTimeoutMs`, or the child can give up while the parent's prompt is still open.
 That includes a parent whose human is still deliberating at an earlier forwarded prompt: it keeps refreshing its heartbeat throughout, so a second child does not read it as gone.
 
 Every other way the forwarding path can give up — an unresolvable parent session, forwarding directories that cannot be created, a request that cannot be written, an unreadable response, and the timeout itself — is reported the same way: as approval being unavailable, with a reason naming the specific failure.

package/docs/troubleshooting.md

@@ -11,6 +11,7 @@
 | External file path blocked                                                                              | `external_directory` is `ask` without UI or `deny`                                      | Allow/ask the permission or keep file tools inside the active working directory.                                                                                                                                                                                            |
 | Spurious external-path prompt for `cd <subdir> && grep … ../path`                                       | Relative path was resolved against cwd instead of the `cd` target                       | Fixed in current version — paths after a leading `cd <subdir> &&` are resolved against the cd target, matching actual shell behavior.                                                                                                                                       |
 | Permission prompt is too verbose                                                                        | Generic extension tool input is large                                                   | Built-in file tools are summarized automatically; third-party tools are capped to a bounded one-line JSON preview.                                                                                                                                                          |
+| Tool blocked with "Nobody answered the approval prompt … within Ns"                                     | `promptTimeoutMs` is set and the prompt was left unanswered for that long               | Answer prompts within the window, press any key in the inline dialog to stop its clock, or raise or unset `promptTimeoutMs` (see [Unanswered prompts](configuration.md#unanswered-prompts)).                                                                                |
 | Windows: `permission_forwarding.error — EPERM … rename` in the logs, and a subagent's tool call refused | An antivirus scanner or the search indexer held a transient handle on a forwarding file | The write is retried automatically for a short window. If it still fails, enable `debugLog` and look for `permission_forwarding.fs_retried` entries — their `attempts` and `code` say whether retrying is helping — then exclude the forwarding directory from the scanner. |
 
 ## Diagnostic Logging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.1.4",
+  "version": "40.2.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -86,6 +86,13 @@
       "minimum": 1,
       "maximum": 9007199254740991
     },
+    "promptTimeoutMs": {
+      "description": "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Omit for no timer (the default). Pressing any key in the inline dialog stops the timer.",
+      "markdownDescription": "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds.\n\nOmit for no timer (the default): a prompt waits until someone answers it. The clock starts when the prompt is shown, not when the request is raised, so a request queued behind another prompt gets its own full window. In the inline TUI dialog, pressing any key stops the timer, so a prompt you have started answering is never cut off.\n\nThe timeout only ever **denies**, and the agent is told nobody answered. It applies to prompts this session shows, including requests forwarded from its subagents; keep it below `forwardingTimeoutMs` so a forwarded request is answered before the subagent stops waiting.",
+      "type": "integer",
+      "minimum": 1,
+      "maximum": 9007199254740991
+    },
     "promptMaxRows": {
       "description": "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",
       "markdownDescription": "Maximum rows a permission prompt renders before eliding its evidence.\n\nOmit to use the default (24). The request's own facts — the requesting agent, the tool, the matched rule, the decision-relevant value — are never elided by this budget; what gives way is the supporting evidence, and `Ctrl+O` expands the prompt to the complete request.",

package/src/access-intent/bash/wrapper-analysis.ts

@@ -158,7 +158,7 @@ export function executedUnitOf(
  * alike. Argument-independence is the core's admission bar, so there are no
  * arguments that make `grep` write a file.
  *
- * Four things must hold for it, and each is a way the reason could still hold:
+ * Five things must hold for it, and each is a way the reason could still hold:
  *
  * 1. The unit is an indirection wrapper — an ordinary command has no floor.
  * 2. Unwrapping reached the inner command without passing through an opaque
@@ -168,16 +168,21 @@ export function executedUnitOf(
  *    line to a shell or builds it from a template
  *    ({@link OPAQUE_COMMAND_LINE_WRAPPERS}) is that payload in another shape:
  *    `watch cat x \; rm y` runs `rm`, so no layer may be one.
- * 3. The inner command *proves* a read — bare-basename core word, retraction
+ * 3. Every word a peeled layer passes its wrapper is literal: each option,
+ *    value, operand, and `NAME=value` word. The shell splits or expands a
+ *    computed one before the wrapper runs, so one of the words it becomes may
+ *    be the command that really runs — `sudo -u $U cat x` with
+ *    `U="root rm y"` runs `rm y cat x` as root.
+ * 4. The inner command *proves* a read — bare-basename core word, retraction
  *    guards applied, so `xargs sort -o /tmp/x` and `xargs find . -delete` are
  *    not transparent.
- * 4. The unit writes no file through a redirect, which the caller reads off
+ * 5. The unit writes no file through a redirect, which the caller reads off
  *    the parse tree and this module never sees.
  *
  * `"execution-modifier"`: every wrapper layer only changes *how* the visible
  * inner command runs, so the unit resolves by that command's own rule whatever
- * it does (see {@link onlyModifiesExecution}). The first two conditions above
- * hold for it too; the core-reader reason is preferred when both apply.
+ * it does (see {@link onlyModifiesExecution}). The first three conditions
+ * above hold for it too; the core-reader reason is preferred when both apply.
  */
 export function floorExemptionOf(
   words: readonly CommandWord[],
@@ -191,7 +196,8 @@ export function floorExemptionOf(
   if (
     unwrapped.kind === "opaque" ||
     unwrapped.peeled.length === 0 ||
-    unwrapped.peeled.some(runsOpaqueCommandLine)
+    unwrapped.peeled.some(runsOpaqueCommandLine) ||
+    unwrapped.peeled.some(carriesComputedWord)
   ) {
     return undefined;
   }
@@ -211,6 +217,17 @@ function runsOpaqueCommandLine(layer: readonly CommandWord[]): boolean {
   return name !== undefined && OPAQUE_COMMAND_LINE_WRAPPERS.has(name);
 }
 
+/**
+ * True when the shell may rewrite a word a peeled layer passes its wrapper.
+ *
+ * The wrapper name is skipped: it is matched by its text against a fixed
+ * vocabulary, so a computed spelling never classifies as a wrapper, and the
+ * word adapter reads a `command_name` node as computed whatever it spells.
+ */
+function carriesComputedWord(layer: readonly CommandWord[]): boolean {
+  return layer.slice(1).some((word) => word.computed);
+}
+
 /**
  * True when every peeled layer only changes *how* the inner command runs, and
  * that command is a literal name the gate can resolve by its own rule.
@@ -230,9 +247,9 @@ function runsOpaqueCommandLine(layer: readonly CommandWord[]): boolean {
  * 2. Every option in every layer is on that modifier's allowlist. The real
  *    tools accept abbreviations (`timeout --sig KILL 5 rm`) the inner-command
  *    search does not know, and one of them misplaces where the command starts.
- *    Each option, value, and operand must also be literal: the shell splits
- *    `timeout $D pnpm` or expands `timeout {5,sudo} rm` into extra words before
- *    the modifier runs, and one of those may be a wrapper or the real command.
+ *    That every word is also literal is {@link floorExemptionOf}'s condition,
+ *    shared with the core-reader reason: the shell splits `timeout $D pnpm` or
+ *    expands `timeout {5,sudo} rm` into extra words before the modifier runs.
  * 3. The peel ended at an ordinary command, not a wrapper it could not see
  *    past.
  * 4. The inner head is a literal command name. The grammar has no `time`
@@ -267,6 +284,9 @@ function reachedLiteralCommand(inner: readonly CommandWord[]): boolean {
  *
  * Walks the words with the same value-taking table {@link innerCommandIndex}
  * skips by, so an admitted option's value can never be taken for the command.
+ * It reads option shapes only: each caller refuses a computed word before it
+ * gets here ({@link floorExemptionOf}'s literal-layer condition, and
+ * {@link sessionCommandIndex}'s refusal of any token with shell syntax).
  */
 function isAdmittedModifierLayer(layer: readonly CommandWord[]): boolean {
   const name = wrapperName(layer);
@@ -278,15 +298,11 @@ function isAdmittedModifierLayer(layer: readonly CommandWord[]): boolean {
   for (let index = 1; index < layer.length; index++) {
     const word = layer[index].text;
     if (isEnvironmentAssignment(word)) continue;
-    // A word the shell rewrites (`$D`, `{5,sudo}`, `*`) may become several, one
-    // of them a wrapper or the real command, so only a literal word is admitted.
-    if (layer[index].computed) return false;
     if (word === "--") continue;
     if (!word.startsWith("-")) continue;
     if (flags.has(word)) continue;
     if (valueTaking.has(word)) {
       index++;
-      if (layer[index]?.computed) return false;
       continue;
     }
     if (!hasAttachedValue(word, valueTaking)) return false;

package/src/authority/answer-window.ts

@@ -0,0 +1,86 @@
+import type { PermissionPromptDecision } from "./permission-dialog";
+
+/**
+ * How long a shown permission prompt waits for a human before it denies.
+ *
+ * Opened when a prompt is presented — never when its ask is admitted, so an
+ * ask queued behind another dialog gets its own full window — and closed when
+ * a human answers. A human who starts answering engages it, which stops the
+ * clock without settling anything: the window bounds an unattended prompt and
+ * never cuts off someone mid-answer. If neither happens first, the window aborts its signal,
+ * which dismisses the prompt, and the window itself is what decided: it stamps
+ * the `unanswered` decider rather than leaving the caller to infer one.
+ *
+ * The timer is `unref`ed, so a window still open when the session ends never
+ * holds the process alive.
+ */
+export class AnswerWindow {
+  private timer: NodeJS.Timeout | undefined;
+
+  private constructor(
+    private readonly timeoutMs: number | undefined,
+    private readonly controller: AbortController | undefined,
+  ) {
+    if (timeoutMs !== undefined && controller !== undefined) {
+      this.timer = setTimeout(() => {
+        this.timer = undefined;
+        controller.abort();
+      }, timeoutMs);
+      this.timer.unref();
+    }
+  }
+
+  /** Opens a window, or a null window that never expires when `timeoutMs` is undefined. */
+  static open(timeoutMs: number | undefined): AnswerWindow {
+    return timeoutMs === undefined
+      ? new AnswerWindow(undefined, undefined)
+      : new AnswerWindow(timeoutMs, new AbortController());
+  }
+
+  /** Aborts when the window expires; `undefined` when no window is configured. */
+  get signal(): AbortSignal | undefined {
+    return this.controller?.signal;
+  }
+
+  /** The window's length while its clock is running; `undefined` once stopped, expired, or never opened. */
+  get pendingTimeoutMs(): number | undefined {
+    return this.timer === undefined ? undefined : this.timeoutMs;
+  }
+
+  /** A human answered: stop the clock. Idempotent. */
+  close(): void {
+    this.stopClock();
+  }
+
+  /** A human started answering: stop the clock and let them finish. Idempotent. */
+  engage(): void {
+    this.stopClock();
+  }
+
+  /**
+   * The decision for a prompt this window dismissed.
+   *
+   * `confirmationUnavailable` holds because no human ruled. A null window
+   * cannot have dismissed anything, so asking it is a caller defect, and the
+   * throw fails the ask closed at the gate boundary rather than inventing a
+   * decider.
+   */
+  expiredDecision(): PermissionPromptDecision {
+    if (this.timeoutMs === undefined) {
+      throw new Error(
+        "no answer window was open, so no prompt can have expired",
+      );
+    }
+    return {
+      approved: false,
+      state: "denied",
+      confirmationUnavailable: true,
+      decidedBy: { kind: "unanswered", timeoutMs: this.timeoutMs },
+    };
+  }
+
+  private stopClock(): void {
+    clearTimeout(this.timer);
+    this.timer = undefined;
+  }
+}

package/src/authority/decision-resolution.ts

@@ -47,6 +47,8 @@ export function resolutionFor(
       return "confirmation_unavailable";
     case "gate_error":
       return "gate_error";
+    case "unanswered":
+      return "prompt_unanswered";
     case "user":
     // A `forwarded` frame reaches here only when the responder named no
     // decider — an older parent — so the hop is the only fact available and

package/src/authority/decision-source.ts

@@ -51,6 +51,12 @@ export type DecisionSource =
   | { kind: "unavailable"; reason: string }
   /** A gate threw, and the boundary blocked rather than allowed. */
   | { kind: "gate_error"; reason: string }
+  /**
+   * A human was shown the prompt and nobody answered it within the configured
+   * `promptTimeoutMs` window, so the window denied. Distinct from
+   * `unavailable`, where no prompt could be shown at all.
+   */
+  | { kind: "unanswered"; timeoutMs: number }
   /**
    * Another session decided. Recursive by design: the requesting side records
    * both that the decider was elsewhere and what, within that session, decided
@@ -147,6 +153,8 @@ function narrowSource(
       return typeof candidate.reason === "string"
         ? { kind: "gate_error", reason: candidate.reason }
         : undefined;
+    case "unanswered":
+      return narrowUnanswered(candidate);
     case "forwarded":
       return narrowForwarded(candidate, depthBudget);
     default:
@@ -161,6 +169,17 @@ function narrowUser(
   return via ? { kind: "user", via } : undefined;
 }
 
+function narrowUnanswered(
+  candidate: Record<string, unknown>,
+): DecisionSource | undefined {
+  const { timeoutMs } = candidate;
+  return typeof timeoutMs === "number" &&
+    Number.isFinite(timeoutMs) &&
+    timeoutMs > 0
+    ? { kind: "unanswered", timeoutMs }
+    : undefined;
+}
+
 function narrowAuthorizer(
   candidate: Record<string, unknown>,
 ): DecisionSource | undefined {

package/src/authority/local-user-authorizer.ts

@@ -66,10 +66,7 @@ export class LocalUserAuthorizer implements TerminalAuthorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    return this.deps.dialogs.run(
-      () => this.present(details),
-      unansweredDecision,
-    );
+    return this.deps.dialogs.run(() => this.present(details), releasedDecision);
   }
 
   /**
@@ -114,7 +111,7 @@ export class LocalUserAuthorizer implements TerminalAuthorizer {
  * one string so what the model is told and what the log attributes cannot
  * drift (#726).
  */
-function unansweredDecision(reason: string): PermissionPromptDecision {
+function releasedDecision(reason: string): PermissionPromptDecision {
   return {
     approved: false,
     state: "denied",

package/src/authority/permission-dialog.ts

@@ -17,7 +17,8 @@ export type PermissionPromptDecision = {
    * reachable at all (`DenyingAuthorizer`, a no-UI non-subagent session) or the
    * forwarding path gave up before reaching one (`ParentAuthorizer` — target
    * unresolvable, request undeliverable, target not serving, or no answer
-   * within the timeout). Consumed by the gate (block reason) and
+   * within the timeout), or a prompt was shown and nobody answered it within
+   * its `promptTimeoutMs` window (`AnswerWindow`). Consumed by the gate (block reason) and
    * `PermissionPrompter` (review-entry resolution) to report
    * "confirmation_unavailable" rather than a plain user denial — a user who
    * was never asked denied nothing (#719). The decision-event resolution
@@ -55,9 +56,22 @@ export type PermissionPromptDecision = {
  */
 export type UnattributedDecision = Omit<PermissionPromptDecision, "decidedBy">;
 
+/** What the fallback hands each host dialog: the signal that may dismiss it. */
+export interface PermissionDialogOptions {
+  signal?: AbortSignal;
+}
+
 export interface PermissionDecisionUi {
-  select(title: string, options: string[]): Promise<string | undefined>;
-  input(title: string, placeholder?: string): Promise<string | undefined>;
+  select(
+    title: string,
+    options: string[],
+    opts?: PermissionDialogOptions,
+  ): Promise<string | undefined>;
+  input(
+    title: string,
+    placeholder?: string,
+    opts?: PermissionDialogOptions,
+  ): Promise<string | undefined>;
 }
 
 const APPROVE_OPTION = "Yes";
@@ -140,12 +154,25 @@ export interface RequestPermissionOptions {
   };
 }
 
+/**
+ * Ask through the host's `select`/`input` dialogs.
+ *
+ * `signal` reaches every dialog, and the host resolves a dismissed one
+ * `undefined` — the same value a human cancel produces. The two are told apart
+ * by the signal: an `undefined` while it is aborted answers `undefined` (the
+ * prompt was dismissed, so no human ruled), and one while it is live keeps its
+ * meaning as the human's cancel.
+ */
 export async function requestPermissionDecisionFromUi(
   ui: PermissionDecisionUi,
   title: string,
   message: string,
   options?: RequestPermissionOptions,
-): Promise<UnattributedDecision> {
+  signal?: AbortSignal,
+): Promise<UnattributedDecision | undefined> {
+  const dialogOptions: PermissionDialogOptions = { signal };
+  const dismissed = (answer: string | undefined): boolean =>
+    answer === undefined && signal?.aborted === true;
   const sessionOption = options?.sessionLabel ?? APPROVE_FOR_SESSION_OPTION;
   const widthOption = options?.sessionWidth?.label;
   const decisionOptions = [
@@ -156,7 +183,14 @@ export async function requestPermissionDecisionFromUi(
     DENY_WITH_REASON_OPTION,
   ];
 
-  const selected = await ui.select(`${title}\n${message}`, decisionOptions);
+  const selected = await ui.select(
+    `${title}\n${message}`,
+    decisionOptions,
+    dialogOptions,
+  );
+  if (dismissed(selected)) {
+    return undefined;
+  }
 
   if (selected === APPROVE_OPTION) {
     return {
@@ -171,10 +205,17 @@ export async function requestPermissionDecisionFromUi(
     const width: SessionGrantWidth =
       selected === widthOption ? "family" : "proven";
     if (options?.sessionScope) {
-      const scope = await ui.select(`${title}\nApply this session grant to:`, [
-        options.sessionScope.subagentLabel,
-        options.sessionScope.servingSessionLabel,
-      ]);
+      const scope = await ui.select(
+        `${title}\nApply this session grant to:`,
+        [
+          options.sessionScope.subagentLabel,
+          options.sessionScope.servingSessionLabel,
+        ],
+        dialogOptions,
+      );
+      if (dismissed(scope)) {
+        return undefined;
+      }
       return sessionApproval(
         // A cancelled scope select (undefined) falls back to the
         // least-privilege subagent scope.
@@ -188,12 +229,15 @@ export async function requestPermissionDecisionFromUi(
   }
 
   if (selected === DENY_WITH_REASON_OPTION) {
-    const denialReason = normalizePermissionDenialReason(
-      await ui.input(
-        `${title}\nShare why this request was denied (optional).`,
-        "Reason shown back to the agent",
-      ),
+    const typed = await ui.input(
+      `${title}\nShare why this request was denied (optional).`,
+      "Reason shown back to the agent",
+      dialogOptions,
     );
+    if (dismissed(typed)) {
+      return undefined;
+    }
+    const denialReason = normalizePermissionDenialReason(typed);
 
     return createDeniedPermissionDecision(denialReason);
   }

package/src/authority/permission-prompt-component.ts

@@ -23,6 +23,7 @@ import {
   renderPromptNotification,
 } from "#src/presentation/prompt-notification";
 import type { PromptPayload } from "#src/presentation/prompt-payload";
+import { AnswerWindow } from "./answer-window";
 import { collapsePastedNewlines } from "./bracketed-paste";
 import type { DecisionSource, UserDecisionSurface } from "./decision-source";
 import {
@@ -76,6 +77,8 @@ export interface PromptPreferences {
   dialogKeys: DialogKeyBindings;
   /** Terminal notifications the inline dialog emits as it opens; empty for none. */
   promptNotifications: readonly PromptNotificationChannel[];
+  /** How long a shown prompt waits for an answer before it denies; absent for no timer. */
+  promptTimeoutMs?: number;
 }
 
 /**
@@ -89,6 +92,10 @@ export interface PromptPreferences {
  * answered on, so it is where the decision is attributed to that surface
  * (#726). Having the dialog model and the fallback each name themselves would
  * be two sites that must agree with this branch.
+ *
+ * It also opens the prompt's {@link AnswerWindow} as the prompt is shown. A
+ * surface the window dismissed answers `undefined`, and the window, which is
+ * what decided, stamps the `unanswered` decision itself.
  */
 export async function requestPermissionDecision(
   view: PermissionPromptView,
@@ -96,12 +103,65 @@ export async function requestPermissionDecision(
   payload: PromptPayload,
   options?: RequestPermissionOptions,
 ): Promise<PermissionPromptDecision> {
+  const window = AnswerWindow.open(view.promptTimeoutMs);
+  const surface = chooseDecisionSurface(view, title, payload, options);
+  try {
+    const answer = await surface.ask(window);
+    return answer === undefined
+      ? window.expiredDecision()
+      : attributeToHuman(answer, surface.via);
+  } finally {
+    window.close();
+  }
+}
+
+/**
+ * One human-facing surface: how to ask on it, and the name it answers under.
+ *
+ * `ask` answers `undefined` only when the window dismissed the prompt.
+ */
+interface DecisionSurface {
+  via: UserDecisionSurface;
+  ask: (window: DialogClock) => Promise<UnattributedDecision | undefined>;
+}
+
+/**
+ * The answer window as a surface uses it: the signal that dismisses the
+ * prompt, and — for the inline dialog, which sees keystrokes — the
+ * running length to show and the means to stop it once the human engages.
+ */
+export type DialogClock = Pick<
+  AnswerWindow,
+  "signal" | "pendingTimeoutMs" | "engage"
+>;
+
+function chooseDecisionSurface(
+  view: PermissionPromptView,
+  title: string,
+  payload: PromptPayload,
+  options?: RequestPermissionOptions,
+): DecisionSurface {
   if (view.mode === "tui") {
-    return attributeToHuman(
-      await presentInlinePermissionPrompt(view, title, payload, options),
-      "dialog",
-    );
+    return {
+      via: "dialog",
+      ask: (window) =>
+        presentInlinePermissionPrompt(view, title, payload, options, window),
+    };
   }
+  return {
+    via: "select",
+    ask: (window) =>
+      askThroughFallback(view, title, payload, options, window.signal),
+  };
+}
+
+function askThroughFallback(
+  view: PermissionPromptView,
+  title: string,
+  payload: PromptPayload,
+  options: RequestPermissionOptions | undefined,
+  signal: AbortSignal | undefined,
+): Promise<UnattributedDecision | undefined> {
   // The fallback renders once and cannot re-render, so it neither paints nor
   // offers an expansion; it substitutes a nominal width for the terminal size
   // it is never told, and the host's own select wraps from there.
@@ -109,14 +169,12 @@ export async function requestPermissionDecision(
     ...view.budget,
     width: FALLBACK_RENDER_WIDTH,
   });
-  return attributeToHuman(
-    await requestPermissionDecisionFromUi(
-      view.ui,
-      title,
-      rendered.lines.join("\n"),
-      options,
-    ),
-    "select",
+  return requestPermissionDecisionFromUi(
+    view.ui,
+    title,
+    rendered.lines.join("\n"),
+    options,
+    signal,
   );
 }
 
@@ -146,12 +204,18 @@ const OPTION_LABELS: Record<PromptAction, string> = {
   denyWithReason: "No, provide reason",
 };
 
+/**
+ * Show the inline dialog. The clock's signal dismisses it: an abort closes the
+ * dialog and answers `undefined`, so a caller can tell a dismissal from a
+ * human answer. The first keystroke engages the clock, stopping it.
+ */
 export function presentInlinePermissionPrompt(
   view: PermissionPromptView,
   title: string,
   payload: PromptPayload,
   options?: RequestPermissionOptions,
-): Promise<UnattributedDecision> {
+  clock?: DialogClock,
+): Promise<UnattributedDecision | undefined> {
   const config: PromptModelConfig = {
     doublePressToConfirm: view.doublePressToConfirm,
     sessionLabel: options?.sessionLabel ?? DEFAULT_SESSION_LABEL,
@@ -159,8 +223,17 @@ export function presentInlinePermissionPrompt(
     sessionScope: options?.sessionScope,
     keys: view.dialogKeys,
   };
-  return view.ui.custom<UnattributedDecision>(
+  return view.ui.custom<UnattributedDecision | undefined>(
     (tui, theme, keybindings, done) => {
+      // The host's `done` is idempotent, so a human answer racing the abort
+      // settles whichever arrives first.
+      clock?.signal?.addEventListener(
+        "abort",
+        () => {
+          done(undefined);
+        },
+        { once: true },
+      );
       // The factory runs once, as the dialog mounts, which is the moment the
       // human is being asked; a re-render does not come back through here.
       const notification = renderPromptNotification(
@@ -181,6 +254,7 @@ export function presentInlinePermissionPrompt(
           tui.requestRender();
         },
         done,
+        clock,
       );
     },
     { overlay: false },
@@ -228,6 +302,7 @@ class PermissionPromptComponent implements Component {
     private readonly handleAppAction: (data: string) => boolean,
     private readonly requestRender: () => void,
     private readonly done: (decision: UnattributedDecision) => void,
+    private readonly clock: DialogClock | undefined,
   ) {
     this.state = initialPromptState(config);
     this.reason = this.createReasonEditor();
@@ -306,10 +381,15 @@ class PermissionPromptComponent implements Component {
     } else if (view.elided) {
       keys.push("ctrl+o full request");
     }
+    const pendingTimeoutMs = this.clock?.pendingTimeoutMs;
+    if (pendingTimeoutMs !== undefined) {
+      keys.push(`unanswered, denies in ${pendingTimeoutMs / 1000}s`);
+    }
     return this.theme.fg("muted", keys.join(" · "));
   }
 
   handleInput(data: string): void {
+    this.engageClock();
     if (this.state.step === "reason") {
       this.handleReasonInput(data);
       return;
@@ -327,6 +407,21 @@ class PermissionPromptComponent implements Component {
     }
   }
 
+  /**
+   * Stop the answer window on the human's first keystroke.
+   *
+   * The window bounds a prompt nobody is attending to; a keystroke proves
+   * someone is, so the dialog waits for them to finish rather than vanishing
+   * mid-answer. Re-renders so the hint stops advertising a deadline.
+   */
+  private engageClock(): void {
+    if (this.clock?.pendingTimeoutMs === undefined) {
+      return;
+    }
+    this.clock.engage();
+    this.requestRender();
+  }
+
   /**
    * Hand the keystroke to the framework line editor.
    *

package/src/config/config-loader.ts

@@ -225,6 +225,7 @@ export function mergeUnifiedConfigs(
   // Number scalars: override replaces base when defined
   for (const key of [
     "forwardingTimeoutMs",
+    "promptTimeoutMs",
     "promptMaxRows",
     "promptFieldMaxWidth",
     "reviewLogFieldMaxWidth",

package/src/config/config-schema.ts

@@ -388,6 +388,12 @@ export const unifiedConfigSchema = z
         "How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds.\n\nOmit to use the default (`600000`, ten minutes). A child whose in-process parent is not draining its inbox at all gives up in a couple of seconds regardless of this value, so lower it only to bound how long you are willing to leave an *unanswered* prompt pending.",
       default: 600000,
     }),
+    promptTimeoutMs: z.number().int().min(1).optional().meta({
+      description:
+        "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds. Omit for no timer (the default). Pressing any key in the inline dialog stops the timer.",
+      markdownDescription:
+        "How long a permission prompt, once shown, waits for an answer before it is dismissed and the request denied, in milliseconds.\n\nOmit for no timer (the default): a prompt waits until someone answers it. The clock starts when the prompt is shown, not when the request is raised, so a request queued behind another prompt gets its own full window. In the inline TUI dialog, pressing any key stops the timer, so a prompt you have started answering is never cut off.\n\nThe timeout only ever **denies**, and the agent is told nobody answered. It applies to prompts this session shows, including requests forwarded from its subagents; keep it below `forwardingTimeoutMs` so a forwarded request is answered before the subagent stops waiting.",
+    }),
     promptMaxRows: z.number().int().min(1).optional().meta({
       description:
         "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",

package/src/config/extension-config.ts

@@ -24,6 +24,8 @@ export interface PermissionSystemExtensionConfig {
   piInfrastructureReadPaths?: string[];
   /** How long a subagent waits for the parent's answer to a forwarded ask, in ms. Defaults to 600000. */
   forwardingTimeoutMs?: number;
+  /** How long a shown permission prompt waits for an answer before denying, in ms. Absent means no timer. */
+  promptTimeoutMs?: number;
   /** Max rows a permission prompt renders before eliding its evidence. Defaults to 24. */
   promptMaxRows?: number;
   /** Max characters of any one field shown in a permission prompt. Defaults to 400. */
@@ -84,6 +86,9 @@ export function normalizePermissionSystemConfig(
   if (raw.forwardingTimeoutMs !== undefined) {
     result.forwardingTimeoutMs = raw.forwardingTimeoutMs;
   }
+  if (raw.promptTimeoutMs !== undefined) {
+    result.promptTimeoutMs = raw.promptTimeoutMs;
+  }
   if (raw.promptMaxRows !== undefined) {
     result.promptMaxRows = raw.promptMaxRows;
   }

package/src/index.ts

@@ -159,6 +159,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       budget: resolveRenderBudget(configStore.current()),
       dialogKeys: resolveDialogKeys(configStore.current()).keys,
       promptNotifications: configStore.current().promptNotifications ?? [],
+      promptTimeoutMs: configStore.current().promptTimeoutMs,
     }),
     requestPermissionDecision,
     forwardingDir: paths.forwardingDir,

package/src/presentation/agent-renderer.ts

@@ -82,6 +82,13 @@ export function renderRefusal(
       );
     case "unavailable":
       return renderUnavailableDenial(payload, denialReason, budget);
+    case "unanswered":
+      return renderUnansweredDenial(
+        payload,
+        { timeoutMs: decider.timeoutMs, decidedElsewhere },
+        denialReason,
+        budget,
+      );
     case "rule":
       return renderEscalatedPolicyDenial(
         payload,
@@ -231,6 +238,35 @@ export function renderUnavailableDenial(
   );
 }
 
+/** The prompt window that expired, and where the prompt was shown. */
+export interface UnansweredPrompt {
+  /** How long the prompt stayed open unanswered, in milliseconds. */
+  readonly timeoutMs: number;
+  /** Whether the prompt was shown in a session reached through a forwarding hop. */
+  readonly decidedElsewhere: boolean;
+}
+
+/**
+ * The agent-facing render of a prompt nobody answered within its window.
+ *
+ * Unlike {@link renderUnavailableDenial}, a prompt *was* shown, so the sentence
+ * says nobody answered rather than that no UI exists; unlike
+ * {@link renderUserDenial}, it never claims the user refused. Like the
+ * unavailable render, it omits the escaped boundary: no rule ruled, so no
+ * retry shape would change the outcome.
+ */
+export function renderUnansweredDenial(
+  payload: PromptPayload,
+  prompt: UnansweredPrompt,
+  denialReason: string | null,
+  budget: AgentRenderBudget = DEFAULT_RENDER_BUDGET,
+): string {
+  return tagged(
+    `Nobody${servingClause(prompt.decidedElsewhere)} answered the approval prompt for this ${identification(payload, budget, "call", askRuleClause(payload))} within ${prompt.timeoutMs / 1000}s.`,
+    denialReason,
+  );
+}
+
 // ── Sentence assembly ──────────────────────────────────────────────────────
 
 /**

package/src/service/permission-events.ts

@@ -139,6 +139,11 @@ export type PermissionDecisionResolution =
   | "user_denied"
   | "auto_approved"
   | "confirmation_unavailable"
+  /**
+   * A human was shown the prompt and nobody answered within the configured
+   * `promptTimeoutMs`, so the request was denied.
+   */
+  | "prompt_unanswered"
   /** A registered `authorizerChain` link granted the ask; no human was asked. */
   | "authorizer_allowed"
   /** A registered `authorizerChain` link refused the ask; no human was asked. */