@gotgenes/pi-permission-system 5.3.3 → 5.4.0

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.4.0](https://github.com/gotgenes/pi-permission-system/compare/v5.3.4...v5.4.0) (2026-05-07)
+
+
+### Features
+
+* add npm shim to enforce pnpm usage via mise ([6a446b2](https://github.com/gotgenes/pi-permission-system/commit/6a446b2e94c125f36377a2388dba2adbd0305459))
+
+
+### Documentation
+
+* add redundant integration test cleanup step ([#107](https://github.com/gotgenes/pi-permission-system/issues/107)) ([236d812](https://github.com/gotgenes/pi-permission-system/commit/236d812f35821860fd5253fedb0e8b26386a34ac))
+* expand gate test surfaces in plan ([#107](https://github.com/gotgenes/pi-permission-system/issues/107)) ([d671556](https://github.com/gotgenes/pi-permission-system/commit/d671556054d35c4d542f9501600c546cb3574207))
+* plan extract per-gate functions from handleToolCall ([#107](https://github.com/gotgenes/pi-permission-system/issues/107)) ([c867d34](https://github.com/gotgenes/pi-permission-system/commit/c867d345e70aad0be953275e5712270e154f4f0a))
+* update architecture for gate extraction ([#107](https://github.com/gotgenes/pi-permission-system/issues/107)) ([fe4c967](https://github.com/gotgenes/pi-permission-system/commit/fe4c967d683be96031a7070390a8b8687dbb28ba))
+
+## [5.3.4](https://github.com/gotgenes/pi-permission-system/compare/v5.3.3...v5.3.4) (2026-05-06)
+
+
+### Documentation
+
+* center logo with HTML align ([707f3e7](https://github.com/gotgenes/pi-permission-system/commit/707f3e7b6dead1d7f82942e4925ca137248e77ab))
+* convert logo to PNG for npm compatibility ([c81e094](https://github.com/gotgenes/pi-permission-system/commit/c81e0949bcb6bd7acd11950050fcd4eb678d6e51))
+* remove width constraint on logo ([d50930a](https://github.com/gotgenes/pi-permission-system/commit/d50930ac4e6dd7fe6e94f42338775b8e3a0093eb))
+
 ## [5.3.3](https://github.com/gotgenes/pi-permission-system/compare/v5.3.2...v5.3.3) (2026-05-06)
 
 

package/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="docs/assets/logo.svg" alt="pi-permission-system logo" width="200" height="200">
+  <img src="docs/assets/logo.png" alt="pi-permission-system logo">
 </p>
 
 # @gotgenes/pi-permission-system

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "5.3.3",
+  "version": "5.4.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "files": [

package/src/handlers/gates/bash-external-directory.ts

@@ -0,0 +1,134 @@
+import { getNonEmptyString, toRecord } from "../../common";
+import {
+  extractExternalPathsFromBashCommand,
+  formatBashExternalDirectoryAskPrompt,
+  formatBashExternalDirectoryDenyReason,
+  formatExternalDirectoryHardStopHint,
+} from "../../external-directory";
+import type { PermissionPromptDecision } from "../../permission-dialog";
+import { applyPermissionGate } from "../../permission-gate";
+import { deriveApprovalPattern } from "../../session-rules";
+import type { HandlerDeps } from "../types";
+import type { GateOutcome, ToolCallContext } from "./types";
+
+/**
+ * Evaluate the bash external-directory permission gate.
+ *
+ * Extracts paths from a bash command and checks whether any reference
+ * directories outside the working directory. Returns `null` when the gate
+ * does not apply (tool is not bash, no CWD, or no external paths found).
+ */
+export async function evaluateBashExternalDirectoryGate(
+  tcc: ToolCallContext,
+  deps: HandlerDeps,
+): Promise<GateOutcome | null> {
+  if (tcc.toolName !== "bash" || !tcc.cwd) return null;
+
+  const command = getNonEmptyString(toRecord(tcc.input).command);
+  if (!command) return null;
+
+  const externalPaths = await extractExternalPathsFromBashCommand(
+    command,
+    tcc.cwd,
+  );
+  if (externalPaths.length === 0) return null;
+
+  const bashSessionRules = deps.runtime.sessionRules.getRuleset();
+  const uncoveredPaths = externalPaths.filter(
+    (p) =>
+      deps.runtime.permissionManager.checkPermission(
+        "external_directory",
+        { path: p },
+        tcc.agentName ?? undefined,
+        bashSessionRules,
+      ).source !== "session",
+  );
+
+  if (uncoveredPaths.length === 0) {
+    deps.runtime.writeReviewLog("permission_request.session_approved", {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      command,
+      externalPaths,
+      resolution: "session_approved",
+    });
+    return null;
+  }
+
+  // Get the config-level policy (no path → no session check).
+  const extCheck = deps.runtime.permissionManager.checkPermission(
+    "external_directory",
+    {},
+    tcc.agentName ?? undefined,
+  );
+
+  let bashExtDecision: PermissionPromptDecision | null = null;
+  const bashExtMessage = formatBashExternalDirectoryAskPrompt(
+    command,
+    uncoveredPaths,
+    tcc.cwd,
+    tcc.agentName ?? undefined,
+  );
+  const bashExtGate = await applyPermissionGate({
+    state: extCheck.state,
+    canConfirm: deps.canRequestPermissionConfirmation(
+      deps.runtime.runtimeContext!,
+    ),
+    promptForApproval: async () => {
+      const decision = await deps.promptPermission(
+        deps.runtime.runtimeContext!,
+        {
+          requestId: tcc.toolCallId,
+          source: "tool_call",
+          agentName: tcc.agentName,
+          message: bashExtMessage,
+          toolCallId: tcc.toolCallId,
+          toolName: tcc.toolName,
+          command,
+        },
+      );
+      bashExtDecision = decision;
+      return decision;
+    },
+    writeLog: deps.runtime.writeReviewLog,
+    logContext: {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      command,
+      externalPaths: uncoveredPaths,
+      message: bashExtMessage,
+    },
+    messages: {
+      denyReason: formatBashExternalDirectoryDenyReason(
+        command,
+        uncoveredPaths,
+        tcc.cwd,
+        tcc.agentName ?? undefined,
+      ),
+      unavailableReason: `Bash command '${command}' references path(s) outside the working directory and requires approval, but no interactive UI is available.`,
+      userDeniedReason: (decision) => {
+        const reasonSuffix = decision.denialReason
+          ? ` Reason: ${decision.denialReason}.`
+          : "";
+        return `User denied external directory access for bash command '${command}'.${reasonSuffix} ${formatExternalDirectoryHardStopHint()}`;
+      },
+    },
+  });
+
+  if (bashExtGate.action === "block") {
+    return { action: "block", reason: bashExtGate.reason };
+  }
+
+  if (bashExtDecision?.state === "approved_for_session") {
+    for (const extPath of uncoveredPaths) {
+      const pattern = deriveApprovalPattern(extPath);
+      deps.runtime.sessionRules.approve("external_directory", pattern);
+    }
+  }
+
+  return { action: "allow" };
+}

package/src/handlers/gates/external-directory.ts

@@ -0,0 +1,189 @@
+import {
+  formatExternalDirectoryAskPrompt,
+  formatExternalDirectoryDenyReason,
+  formatExternalDirectoryUserDeniedReason,
+  getPathBearingToolPath,
+  isPathOutsideWorkingDirectory,
+  isPiInfrastructureRead,
+  normalizePathForComparison,
+} from "../../external-directory";
+import type { PermissionPromptDecision } from "../../permission-dialog";
+import { emitDecisionEvent } from "../../permission-events";
+import { applyPermissionGate } from "../../permission-gate";
+import { deriveApprovalPattern } from "../../session-rules";
+import type { HandlerDeps } from "../types";
+import { deriveResolution } from "./helpers";
+import type { GateOutcome, ToolCallContext } from "./types";
+
+/**
+ * Evaluate the external-directory permission gate for file tools.
+ *
+ * Returns `null` when the gate does not apply (no CWD, tool is not
+ * path-bearing, or path is inside the working directory).
+ */
+export async function evaluateExternalDirectoryGate(
+  tcc: ToolCallContext,
+  deps: HandlerDeps,
+): Promise<GateOutcome | null> {
+  if (!tcc.cwd) return null;
+
+  const externalDirectoryPath = getPathBearingToolPath(tcc.toolName, tcc.input);
+  if (!externalDirectoryPath) return null;
+
+  if (!isPathOutsideWorkingDirectory(externalDirectoryPath, tcc.cwd)) {
+    return null;
+  }
+
+  const normalizedExtPath = normalizePathForComparison(
+    externalDirectoryPath,
+    tcc.cwd,
+  );
+
+  // ── Pi infrastructure read bypass ──────────────────────────────────────
+  const allInfraDirs = [
+    ...deps.runtime.piInfrastructureDirs,
+    ...(deps.runtime.config.piInfrastructureReadPaths ?? []),
+  ];
+  if (
+    isPiInfrastructureRead(
+      tcc.toolName,
+      normalizedExtPath,
+      allInfraDirs,
+      tcc.cwd,
+    )
+  ) {
+    deps.runtime.writeReviewLog(
+      "permission_request.infrastructure_auto_allowed",
+      {
+        source: "tool_call",
+        toolCallId: tcc.toolCallId,
+        toolName: tcc.toolName,
+        agentName: tcc.agentName,
+        path: externalDirectoryPath,
+      },
+    );
+    emitDecisionEvent(deps.events, {
+      surface: tcc.toolName,
+      value: externalDirectoryPath,
+      result: "allow",
+      resolution: "infrastructure_auto_allowed",
+      origin: null,
+      agentName: tcc.agentName ?? null,
+      matchedPattern: null,
+    });
+    return { action: "allow" };
+  }
+
+  // ── Policy check ───────────────────────────────────────────────────────
+  const extCheck = deps.runtime.permissionManager.checkPermission(
+    "external_directory",
+    { path: normalizedExtPath },
+    tcc.agentName ?? undefined,
+    deps.runtime.sessionRules.getRuleset(),
+  );
+
+  // Session-rule hit
+  if (extCheck.source === "session") {
+    deps.runtime.writeReviewLog("permission_request.session_approved", {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      path: externalDirectoryPath,
+      resolution: "session_approved",
+      sessionApprovalPattern: extCheck.matchedPattern,
+    });
+    emitDecisionEvent(deps.events, {
+      surface: "external_directory",
+      value: externalDirectoryPath,
+      result: "allow",
+      resolution: "session_approved",
+      origin: extCheck.origin ?? null,
+      agentName: tcc.agentName ?? null,
+      matchedPattern: extCheck.matchedPattern ?? null,
+    });
+    return { action: "allow" };
+  }
+
+  // ── Interactive gate ───────────────────────────────────────────────────
+  let extDirDecision: PermissionPromptDecision | null = null;
+  const extDirMessage = formatExternalDirectoryAskPrompt(
+    tcc.toolName,
+    externalDirectoryPath,
+    tcc.cwd,
+    tcc.agentName ?? undefined,
+  );
+  const extDirCanConfirm = deps.canRequestPermissionConfirmation(
+    deps.runtime.runtimeContext!,
+  );
+  const extDirGateResult = await applyPermissionGate({
+    state: extCheck.state,
+    canConfirm: extDirCanConfirm,
+    promptForApproval: async () => {
+      const decision = await deps.promptPermission(
+        deps.runtime.runtimeContext!,
+        {
+          requestId: tcc.toolCallId,
+          source: "tool_call",
+          agentName: tcc.agentName,
+          message: extDirMessage,
+          toolCallId: tcc.toolCallId,
+          toolName: tcc.toolName,
+          path: externalDirectoryPath,
+        },
+      );
+      extDirDecision = decision;
+      return decision;
+    },
+    writeLog: deps.runtime.writeReviewLog,
+    logContext: {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      path: externalDirectoryPath,
+      message: extDirMessage,
+    },
+    messages: {
+      denyReason: formatExternalDirectoryDenyReason(
+        tcc.toolName,
+        externalDirectoryPath,
+        tcc.cwd,
+        tcc.agentName ?? undefined,
+      ),
+      unavailableReason: `Accessing '${externalDirectoryPath}' outside the working directory requires approval, but no interactive UI is available.`,
+      userDeniedReason: (decision) =>
+        formatExternalDirectoryUserDeniedReason(
+          tcc.toolName,
+          externalDirectoryPath,
+          decision.denialReason,
+        ),
+    },
+  });
+
+  emitDecisionEvent(deps.events, {
+    surface: "external_directory",
+    value: externalDirectoryPath,
+    result: extDirGateResult.action === "allow" ? "allow" : "deny",
+    resolution: deriveResolution(
+      extCheck.state,
+      extDirGateResult.action,
+      extDirDecision?.state === "approved_for_session",
+      extDirCanConfirm,
+    ),
+    origin: extCheck.origin ?? null,
+    agentName: tcc.agentName ?? null,
+    matchedPattern: extCheck.matchedPattern ?? null,
+  });
+
+  if (extDirGateResult.action === "block") {
+    return { action: "block", reason: extDirGateResult.reason };
+  }
+
+  if (extDirDecision?.state === "approved_for_session") {
+    const pattern = deriveApprovalPattern(normalizedExtPath);
+    deps.runtime.sessionRules.approve("external_directory", pattern);
+  }
+
+  return { action: "allow" };
+}

package/src/handlers/gates/helpers.ts

@@ -0,0 +1,41 @@
+import type { PermissionDecisionResolution } from "../../permission-events";
+import type { PermissionCheckResult } from "../../types";
+
+/**
+ * Derive the human-readable value for a decision event from a check result.
+ * Bash → extracted command; MCP → qualified target; others → tool name.
+ */
+export function deriveDecisionValue(
+  toolName: string,
+  check: Pick<PermissionCheckResult, "command" | "target">,
+): string {
+  if (toolName === "bash") return check.command ?? toolName;
+  if (toolName === "mcp") return check.target ?? toolName;
+  return toolName;
+}
+
+/**
+ * Map the gate outcome back to a PermissionDecisionResolution.
+ *
+ * @param state     - The permission state passed to the gate.
+ * @param action    - The gate's resulting action ("allow" | "block").
+ * @param hasSession - True when the gate result carries a sessionApproval
+ *                    (indicates the user chose "for this session").
+ * @param canConfirm - Whether an interactive prompt was available.
+ */
+export function deriveResolution(
+  state: "allow" | "deny" | "ask",
+  action: "allow" | "block",
+  hasSession: boolean,
+  canConfirm: boolean,
+  autoApproved = false,
+): PermissionDecisionResolution {
+  if (state === "allow") return "policy_allow";
+  if (state === "deny") return "policy_deny";
+  // state === "ask"
+  if (action === "allow") {
+    if (autoApproved) return "auto_approved";
+    return hasSession ? "user_approved_for_session" : "user_approved";
+  }
+  return canConfirm ? "user_denied" : "confirmation_unavailable";
+}

package/src/handlers/gates/index.ts

@@ -0,0 +1,6 @@
+export { evaluateBashExternalDirectoryGate } from "./bash-external-directory";
+export { evaluateExternalDirectoryGate } from "./external-directory";
+export { deriveDecisionValue, deriveResolution } from "./helpers";
+export { evaluateSkillReadGate } from "./skill-read";
+export { evaluateToolGate } from "./tool";
+export type { GateOutcome, ToolCallContext } from "./types";

package/src/handlers/gates/skill-read.ts

@@ -0,0 +1,111 @@
+import { toRecord } from "../../common";
+import { normalizePathForComparison } from "../../external-directory";
+import { emitDecisionEvent } from "../../permission-events";
+import { applyPermissionGate } from "../../permission-gate";
+import {
+  formatSkillPathAskPrompt,
+  formatSkillPathDenyReason,
+} from "../../permission-prompts";
+import { findSkillPathMatch } from "../../skill-prompt-sanitizer";
+import type { HandlerDeps } from "../types";
+import { deriveResolution } from "./helpers";
+import type { GateOutcome, ToolCallContext } from "./types";
+
+/**
+ * Evaluate the skill-read permission gate.
+ *
+ * Returns `null` when the gate does not apply (tool is not `read`, no active
+ * skill entries, or the read path does not match any skill).
+ */
+export async function evaluateSkillReadGate(
+  tcc: ToolCallContext,
+  deps: HandlerDeps,
+): Promise<GateOutcome | null> {
+  // Only applies to read tool calls with active skill entries
+  if (tcc.toolName !== "read" || deps.runtime.activeSkillEntries.length === 0) {
+    return null;
+  }
+
+  const inputRecord = toRecord(tcc.input);
+  const path = typeof inputRecord.path === "string" ? inputRecord.path : "";
+  if (!path) {
+    return null;
+  }
+
+  const normalizedReadPath = normalizePathForComparison(path, tcc.cwd);
+  const matchedSkill = findSkillPathMatch(
+    normalizedReadPath,
+    deps.runtime.activeSkillEntries,
+  );
+
+  if (!matchedSkill) {
+    return null;
+  }
+
+  const skillReadMessage = formatSkillPathAskPrompt(
+    matchedSkill,
+    path,
+    tcc.agentName ?? undefined,
+  );
+  const skillReadCanConfirm = deps.canRequestPermissionConfirmation(
+    deps.runtime.runtimeContext!,
+  );
+  const skillReadGate = await applyPermissionGate({
+    state: matchedSkill.state,
+    canConfirm: skillReadCanConfirm,
+    promptForApproval: () =>
+      deps.promptPermission(deps.runtime.runtimeContext!, {
+        requestId: tcc.toolCallId,
+        source: "skill_read",
+        agentName: tcc.agentName,
+        message: skillReadMessage,
+        toolCallId: tcc.toolCallId,
+        toolName: tcc.toolName,
+        skillName: matchedSkill.name,
+        path,
+      }),
+    writeLog: deps.runtime.writeReviewLog,
+    logContext: {
+      source: "skill_read",
+      skillName: matchedSkill.name,
+      agentName: tcc.agentName,
+      path,
+      message: skillReadMessage,
+    },
+    messages: {
+      denyReason: formatSkillPathDenyReason(
+        matchedSkill,
+        path,
+        tcc.agentName ?? undefined,
+      ),
+      unavailableReason: `Accessing skill '${matchedSkill.name}' requires approval, but no interactive UI is available.`,
+      userDeniedReason: (decision) => {
+        const denialReason = decision.denialReason
+          ? ` Reason: ${decision.denialReason}.`
+          : "";
+        return `User denied access to skill '${matchedSkill.name}'.${denialReason}`;
+      },
+    },
+  });
+
+  emitDecisionEvent(deps.events, {
+    surface: "skill",
+    value: matchedSkill.name,
+    result: skillReadGate.action === "allow" ? "allow" : "deny",
+    resolution: deriveResolution(
+      matchedSkill.state,
+      skillReadGate.action,
+      false,
+      skillReadCanConfirm,
+    ),
+    origin: null,
+    agentName: tcc.agentName ?? null,
+    matchedPattern: null,
+  });
+
+  if (skillReadGate.action === "block") {
+    return { action: "block", reason: skillReadGate.reason };
+  }
+
+  return { action: "allow" };
+}

package/src/handlers/gates/tool.ts

@@ -0,0 +1,160 @@
+import { PATH_BEARING_TOOLS } from "../../external-directory";
+import { suggestSessionPattern } from "../../pattern-suggest";
+import { emitDecisionEvent } from "../../permission-events";
+import { applyPermissionGate } from "../../permission-gate";
+import {
+  formatAskPrompt,
+  formatDenyReason,
+  formatUserDeniedReason,
+} from "../../permission-prompts";
+import { getPermissionLogContext } from "../../tool-input-preview";
+import type { HandlerDeps } from "../types";
+import { deriveDecisionValue, deriveResolution } from "./helpers";
+import type { GateOutcome, ToolCallContext } from "./types";
+
+/**
+ * Evaluate the normal tool permission gate.
+ *
+ * Unlike the other gates this one always applies — it never returns `null`.
+ */
+export async function evaluateToolGate(
+  tcc: ToolCallContext,
+  deps: HandlerDeps,
+): Promise<GateOutcome> {
+  const check = deps.runtime.permissionManager.checkPermission(
+    tcc.toolName,
+    tcc.input,
+    tcc.agentName ?? undefined,
+    deps.runtime.sessionRules.getRuleset(),
+  );
+
+  // Session-hit: already approved by a session rule — skip the gate entirely.
+  if (check.source === "session") {
+    deps.runtime.writeReviewLog("permission_request.session_approved", {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      resolution: "session_approved",
+      sessionApprovalPattern: check.matchedPattern,
+    });
+    emitDecisionEvent(deps.events, {
+      surface: tcc.toolName,
+      value: deriveDecisionValue(tcc.toolName, check),
+      result: "allow",
+      resolution: "session_approved",
+      origin: check.origin ?? null,
+      agentName: tcc.agentName ?? null,
+      matchedPattern: check.matchedPattern ?? null,
+    });
+    return { action: "allow" };
+  }
+
+  const permissionLogContext = getPermissionLogContext(
+    check,
+    tcc.input,
+    PATH_BEARING_TOOLS,
+  );
+
+  // Compute session approval suggestion for the "for this session" option.
+  const suggestionValue =
+    tcc.toolName === "bash"
+      ? (check.command ?? "")
+      : tcc.toolName === "mcp"
+        ? (check.target ?? "mcp")
+        : "*";
+  const suggestion = suggestSessionPattern(tcc.toolName, suggestionValue);
+
+  // Build the unavailable-reason message. Bash gets the command embedded.
+  const inputCommand =
+    tcc.toolName === "bash" &&
+    typeof (tcc.input as Record<string, unknown>)?.command === "string"
+      ? ((tcc.input as Record<string, unknown>).command as string)
+      : null;
+  const toolUnavailableReason = inputCommand
+    ? `Running bash command '${inputCommand}' requires approval, but no interactive UI is available.`
+    : tcc.toolName === "mcp"
+      ? "Using tool 'mcp' requires approval, but no interactive UI is available."
+      : `Using tool '${tcc.toolName}' requires approval, but no interactive UI is available.`;
+
+  const toolAskMessage = formatAskPrompt(
+    check,
+    tcc.agentName ?? undefined,
+    tcc.input,
+  );
+  const toolCanConfirm = deps.canRequestPermissionConfirmation(
+    deps.runtime.runtimeContext!,
+  );
+  let toolDecisionAutoApproved = false;
+  const toolGate = await applyPermissionGate({
+    state: check.state,
+    canConfirm: toolCanConfirm,
+    sessionApproval: {
+      surface: suggestion.surface,
+      pattern: suggestion.pattern,
+    },
+    promptForApproval: async () => {
+      const decision = await deps.promptPermission(
+        deps.runtime.runtimeContext!,
+        {
+          requestId: tcc.toolCallId,
+          source: "tool_call",
+          agentName: tcc.agentName,
+          message: toolAskMessage,
+          toolCallId: tcc.toolCallId,
+          toolName: tcc.toolName,
+          sessionLabel: suggestion.label,
+          ...permissionLogContext,
+        },
+      );
+      toolDecisionAutoApproved = decision.autoApproved === true;
+      return decision;
+    },
+    writeLog: deps.runtime.writeReviewLog,
+    logContext: {
+      source: "tool_call",
+      toolCallId: tcc.toolCallId,
+      toolName: tcc.toolName,
+      agentName: tcc.agentName,
+      message: toolAskMessage,
+      ...permissionLogContext,
+    },
+    messages: {
+      denyReason: formatDenyReason(check, tcc.agentName ?? undefined),
+      unavailableReason: toolUnavailableReason,
+      userDeniedReason: (decision) =>
+        formatUserDeniedReason(check, decision.denialReason),
+    },
+  });
+
+  const toolGateHasSession =
+    toolGate.action === "allow" && toolGate.sessionApproval !== undefined;
+  emitDecisionEvent(deps.events, {
+    surface: tcc.toolName,
+    value: deriveDecisionValue(tcc.toolName, check),
+    result: toolGate.action === "allow" ? "allow" : "deny",
+    resolution: deriveResolution(
+      check.state,
+      toolGate.action,
+      toolGateHasSession,
+      toolCanConfirm,
+      toolDecisionAutoApproved,
+    ),
+    origin: check.origin ?? null,
+    agentName: tcc.agentName ?? null,
+    matchedPattern: check.matchedPattern ?? null,
+  });
+
+  if (toolGate.action === "block") {
+    return { action: "block", reason: toolGate.reason };
+  }
+
+  if (toolGate.sessionApproval) {
+    deps.runtime.sessionRules.approve(
+      toolGate.sessionApproval.surface,
+      toolGate.sessionApproval.pattern,
+    );
+  }
+
+  return { action: "allow" };
+}