@hank-warren/pi-auto-permissions 0.12.0 → 0.13.0

package/index.ts

@@ -10,6 +10,7 @@ import {
 } from "./loop-revise-budget.js";
 import * as PiCodingAgent from "@earendil-works/pi-coding-agent";
 import {
+  getAgentDir,
   getSelectListTheme,
   getSettingsListTheme,
   type ExtensionAPI,
@@ -29,13 +30,30 @@ import { patchAutoPermissionsConfig } from "./config-writer.js";
 import {
   applySettingChange,
   buildSettingItems,
+  createDenialsSubmenu,
   createModelSubmenu,
   createTimeoutSubmenu,
+  type DenialsSubmenuHost,
+  type DenialSummary,
   type MenuModel,
   type ReviewerSettings,
   type SettingChange,
   type SubmenuHost,
 } from "./settings-menu.js";
+import {
+  appendDenialRecord,
+  buildDenialRecord,
+  readRecentDenials,
+  type DenialSource,
+  type DenialVerdict,
+} from "./denial-log.js";
+import {
+  buildSetupDraftRequest,
+  parseSetupDraft,
+  scanProject,
+  scanRecentSessionCommands,
+  SETUP_DRAFT_SYSTEM_PROMPT,
+} from "./setup-scan.js";
 import {
   appendPromptEvaluation,
   classifyPromptChoice,
@@ -43,7 +61,7 @@ import {
   permissionPromptOptions,
   type PromptEvaluationUserChoice,
 } from "./evaluation-log.js";
-import { findGates, type Gate } from "./gates.js";
+import { ALL_SHELL_GATE, findGates, type Gate } from "./gates.js";
 import { appendUsageRecord, buildUsageLogRecord } from "./usage-log.js";
 import {
   reviewFrameIntervalMs,
@@ -54,17 +72,26 @@ import {
 } from "./widget-status.js";
 import {
   applyFullRebuildEviction,
+  buildGuardianPolicySection,
   buildReviewEnvelope,
   collectReviewEvidence,
   LOOP_CONTEXT_SYSTEM_PROMPT,
+  INJECTED_USER_MESSAGE_SYSTEM_PROMPT,
   OVERRIDE_FEEDBACK_SYSTEM_PROMPT,
   parsePermissionVerdict,
+  parsePrefilterVerdict,
+  PREFILTER_INSTRUCTION,
   SUBAGENT_CONTEXT_SYSTEM_PROMPT,
   type EvidenceCaps,
   type PermissionVerdict,
   type ReviewEvidenceRecord,
 } from "./review.js";
 import { mergeOverrideEvidence, type PermissionOverride } from "./override-evidence.js";
+import {
+  buildSessionEnvironmentSection,
+  captureSessionEnvironment,
+  type SessionEnvironmentSnapshot,
+} from "./session-environment.js";
 import { OptionSelector } from "@hank-warren/pi-permission-selector/selector.ts";
 import { PulsingApprovalIndicator } from "./approval-pulse.js";
 
@@ -134,6 +161,12 @@ function reviewerFingerprint(
     userAnswerTools: config.reviewEvidence.userAnswerTools.length
       ? [...config.reviewEvidence.userAnswerTools].sort()
       : undefined,
+    // Widening or narrowing the allowlist changes which records exist and
+    // whether they are user-source, so a cached lineage built under the old
+    // one is not a base the new one may append to.
+    userMessageTypes: config.reviewEvidence.userMessageTypes.length
+      ? [...config.reviewEvidence.userMessageTypes].sort()
+      : undefined,
   });
 }
 
@@ -236,6 +269,10 @@ function loadTrustedGroups(cwd: string): Set<string> {
   return groups;
 }
 
+function denyReason(gate: Gate): string {
+  return `Blocked by policy: ${gate.label}\n\n${gate.message ?? "This operation is denied by rule."}\n\nThis is a deny rule: it cannot be overridden with request_override, trusted groups, or user approval. Choose a different approach.`;
+}
+
 function conventionReason(gate: Gate, command: string): string {
   let reason = `Convention violation: ${gate.label}\n\n${gate.message ?? "Use the configured project tooling."}`;
   const suggestion = gate.suggest?.(command);
@@ -270,6 +307,109 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
   let activeReviewerSessionId: string | undefined;
   const permissionOverrides: PermissionOverride[] = [];
   let overrideSeq = 0;
+  /** Captured once per session; see session-environment.ts for why once. */
+  let sessionEnvironment: SessionEnvironmentSnapshot | undefined;
+
+  /**
+   * Overrides persist as custom session entries the way the loop budget does,
+   * so a resumed session keeps the user's prompt decisions instead of
+   * forgetting every allow and standing block constraint.
+   */
+  const OVERRIDES_ENTRY_TYPE = "auto-permissions-overrides";
+
+  function persistOverrides(): void {
+    try {
+      pi.appendEntry(OVERRIDES_ENTRY_TYPE, {
+        seq: overrideSeq,
+        overrides: permissionOverrides.map((override) => ({ ...override })),
+      });
+    } catch {
+      // Persistence is best-effort; the in-memory records still apply now.
+    }
+  }
+
+  /** Fail-open like the loop budget: unreadable state means no overrides. */
+  function restoreOverrides(entries: readonly unknown[]): void {
+    permissionOverrides.length = 0;
+    overrideSeq = 0;
+    for (let index = entries.length - 1; index >= 0; index -= 1) {
+      const entry = entries[index] as { type?: string; customType?: string; data?: unknown } | undefined;
+      if (entry?.type !== "custom" || entry.customType !== OVERRIDES_ENTRY_TYPE) continue;
+      const data = entry.data as { seq?: unknown; overrides?: unknown } | undefined;
+      if (Array.isArray(data?.overrides)) {
+        for (const raw of data.overrides) {
+          if (!raw || typeof raw !== "object") continue;
+          const candidate = raw as PermissionOverride;
+          if (
+            typeof candidate.seq !== "number"
+            || typeof candidate.gateLabel !== "string"
+            || typeof candidate.command !== "string"
+            || typeof candidate.reviewerReason !== "string"
+            || !["allow", "allow_unnecessary", "allow_appropriate", "block"].includes(candidate.choice)
+          ) {
+            continue;
+          }
+          permissionOverrides.push({
+            seq: candidate.seq,
+            ...(typeof candidate.anchorKey === "string" ? { anchorKey: candidate.anchorKey } : {}),
+            gateLabel: candidate.gateLabel,
+            command: candidate.command,
+            reviewerReason: candidate.reviewerReason,
+            choice: candidate.choice,
+          });
+        }
+      }
+      if (typeof data?.seq === "number" && Number.isSafeInteger(data.seq) && data.seq >= 0) {
+        overrideSeq = data.seq;
+      }
+      return;
+    }
+  }
+
+  /**
+   * Record a non-approved outcome: a `pi.events` emit (the PermissionDenied
+   * hook equivalent) always, plus a denial-log line when enabled. Never blocks
+   * the decision itself.
+   */
+  function recordDenial(
+    config: AutoPermissionsConfig,
+    ctx: ExtensionContext,
+    target: ReviewTarget,
+    gate: Gate,
+    command: string,
+    verdict: DenialVerdict,
+    reason: string,
+    decisionSource: DenialSource,
+  ): void {
+    try {
+      pi.events.emit("auto-permissions:denied", {
+        tool: target.toolName,
+        command,
+        gate: gate.label,
+        group: gate.group,
+        verdict,
+        reason,
+        decisionSource,
+      });
+    } catch {
+      // Event fan-out is observability, never part of the decision.
+    }
+    if (!config.denialLog.enabled) return;
+    try {
+      appendDenialRecord(config.denialLog.path, buildDenialRecord({
+        sessionId: ctx.sessionManager.getSessionId(),
+        cwd: ctx.cwd,
+        tool: target.toolName,
+        gate: { label: gate.label, group: gate.group },
+        command,
+        verdict,
+        reason,
+        decisionSource,
+      }));
+    } catch {
+      // The denial log is best-effort observability.
+    }
+  }
   let reviewerGeneration = 0;
   let reviewerLifecycleController = new AbortController();
 
@@ -372,8 +512,21 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       ...(loopContext ? [LOOP_CONTEXT_SYSTEM_PROMPT] : []),
     ].join("\n\n");
     // Appended outside config.systemPrompt so sessions using a customized
-    // systemPromptFile still learn how to weigh override records.
-    const policyPrompt = `${basePolicyPrompt}\n\n${OVERRIDE_FEEDBACK_SYSTEM_PROMPT}`;
+    // systemPromptFile still learn how to weigh override records. The injected
+    // section joins it on the same reasoning, keyed on the configured
+    // allowlist rather than on whether this turn's evidence happens to contain
+    // one: the system prompt has to be identical across the turns of a review
+    // lineage, and "did an injected record appear yet" is not.
+    const guardianPolicySection = buildGuardianPolicySection(config.guardianPolicy);
+    // Lazy in case a review lands before session_start ran; still once only.
+    sessionEnvironment ??= captureSessionEnvironment(ctx.cwd);
+    const policyPrompt = [
+      basePolicyPrompt,
+      ...(guardianPolicySection ? [guardianPolicySection] : []),
+      buildSessionEnvironmentSection(sessionEnvironment),
+      OVERRIDE_FEEDBACK_SYSTEM_PROMPT,
+      ...(config.reviewEvidence.userMessageTypes.length ? [INJECTED_USER_MESSAGE_SYSTEM_PROMPT] : []),
+    ].join("\n\n");
     const systemPrompt = buildReviewerSystemPrompt(policyPrompt, projectInstructions);
     const fingerprint = reviewerFingerprint(mainSessionId, model, config, systemPrompt, projectTrusted);
     const evidence = mergeOverrideEvidence(
@@ -382,6 +535,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         toolCallId,
         config.reviewEvidence.userAnswerTools,
         evidenceCaps(config),
+        config.reviewEvidence.userMessageTypes,
       ),
       permissionOverrides,
     );
@@ -418,6 +572,84 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     });
 
     const fullEvidence = () => applyFullRebuildEviction(evidence, config.reviewEvidence.fullRebuildKeepToolRecords);
+
+    // Stage one: an optional stateless single-token prefilter at minimal
+    // reasoning. SAFE approves; REVIEW and every failure fall through to the
+    // full lineage review below, which is untouched — the prefilter uses its
+    // own throwaway session, so the append-only lineage invariant holds. The
+    // envelope text matches a full-rebuild review's, so when the full review
+    // does run without a lineage base its prompt is largely a provider cache
+    // hit of this call.
+    if (config.reviewer?.prefilter) {
+      const prefilterSessionId = reviewerSessionId(model);
+      const prefilterSignal = AbortSignal.any([
+        AbortSignal.timeout(config.reviewer.timeoutMs),
+        reviewerLifecycleController.signal,
+        ...(signal ? [signal] : []),
+      ]);
+      let safe = false;
+      try {
+        const auth = await waitForSignal(ctx.modelRegistry.getApiKeyAndHeaders(model), prefilterSignal);
+        if (!auth.ok) throw new Error(auth.error);
+        const response = await resolveGuardianCompleteSimple(ctx.modelRegistry, "pi-auto-permissions")(
+          model,
+          {
+            systemPrompt,
+            messages: [{
+              role: "user",
+              content: [{ type: "text", text: `${buildReviewEnvelope(fullEvidence(), request, "full")}\n\n${PREFILTER_INSTRUCTION}` }],
+              timestamp: Date.now(),
+            }],
+          },
+          {
+            apiKey: auth.apiKey,
+            headers: auth.headers,
+            env: auth.env,
+            signal: prefilterSignal,
+            reasoning: "minimal",
+            sessionId: prefilterSessionId,
+            transport: isOpenAICodexModel(model) ? "websocket" : "auto",
+            cacheRetention: "long",
+          },
+        );
+        if (response.stopReason !== "aborted" && response.stopReason !== "error" && !prefilterSignal.aborted) {
+          recordReviewerUsage(config, model, response.usage, subagentContext !== undefined, "prefilter");
+          safe = parsePrefilterVerdict(assistantText(response.content)) === "safe";
+        }
+      } catch {
+        // Fail closed into the full review: a prefilter that cannot answer
+        // flags for review, it never approves and never blocks by itself.
+      } finally {
+        cleanupReviewerSession(prefilterSessionId);
+      }
+      if (!sessionActive || signal?.aborted) throw new Error("review timed out or was cancelled");
+      if (safe) {
+        if (config.evaluationLog.enabled) {
+          try {
+            appendPromptEvaluation(config.evaluationLog.path, {
+              version: 2,
+              timestamp: new Date().toISOString(),
+              sessionId: mainSessionId,
+              cwd: ctx.cwd,
+              tool: toolName,
+              gate: { label: gate.label, group: gate.group },
+              userRequest: evidence
+                .filter((record) => record.source === "user")
+                .map((record) => record.text)
+                .join("\n"),
+              command: typeof input.command === "string" ? input.command : JSON.stringify(input),
+              relevantContext: [...evidence],
+              actualDecision: "approve",
+              actualReason: "prefilter",
+              decisionSource: "prefilter",
+            });
+          } catch {
+            // Evaluation logging must never block a permission decision.
+          }
+        }
+        return { decision: "approve", reason: "prefilter" };
+      }
+    }
     let userMessage = makeUserMessage(base ? evidence.slice(base.evidenceKeys.length) : fullEvidence(), base ? "delta" : "full");
     let messages = base ? [...base.messages, userMessage] : [userMessage];
     if (base && estimateReviewTokens(systemPrompt, messages) >= budget) {
@@ -497,17 +729,22 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
    * Reviewer calls never reach the session transcript, so their usage is invisible to
    * tooling that reads session files. Record content-free counters in a sidecar instead.
    */
-  function recordReviewerUsage(config: AutoPermissionsConfig, model: { provider: string; id: string }, usage: unknown, subagent: boolean): void {
+  function recordReviewerUsage(config: AutoPermissionsConfig, model: { provider: string; id: string }, usage: unknown, subagent: boolean, label: "guardian" | "prefilter" | "setup" = "guardian"): void {
     if (!config.usageLog.enabled) return;
     try {
-      appendUsageRecord(config.usageLog.path, buildUsageLogRecord(model.provider, model.id, usage, "guardian", "auto-permissions", subagent));
+      appendUsageRecord(config.usageLog.path, buildUsageLogRecord(model.provider, model.id, usage, label, "auto-permissions", subagent));
     } catch {
       // Usage accounting is optional and must never block a permission decision.
     }
   }
 
   function untrustedMatches(command: string, config: AutoPermissionsConfig): Gate[] {
-    return findGates(command, config.rules).filter((gate) => !trustedGroups.has(gate.group));
+    // Deny rules are hard policy boundaries: a project-scoped trusted-ops file
+    // must not be able to lift one, or a checked-in file could disarm the
+    // circuit breaker. Only guarded and convention matches honor the bypass.
+    return findGates(command, config.rules).filter(
+      (gate) => gate.level === "deny" || !trustedGroups.has(gate.group),
+    );
   }
 
   function evidenceCaps(config: AutoPermissionsConfig): EvidenceCaps {
@@ -840,6 +1077,16 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     }
     showReviewDisplay(ctx, config, gate, command, target, "ask_user", detail);
     if (!ctx.hasUI) {
+      recordDenial(
+        config,
+        ctx,
+        target,
+        gate,
+        command,
+        "block",
+        detail,
+        decisionSource === "guardian" ? "guardian" : "review_failure",
+      );
       showReviewDisplay(ctx, config, gate, command, target, "blocked", detail, true);
       return {
         block: true,
@@ -854,6 +1101,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
           target.toolCallId,
           config.reviewEvidence.userAnswerTools,
           evidenceCaps(config),
+          config.reviewEvidence.userMessageTypes,
         ),
         permissionOverrides,
       )
@@ -895,6 +1143,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
             reviewerReason: detail,
             choice: overrideChoice,
           });
+          persistOverrides();
         }
       }
       if (config.evaluationLog.enabled && classification?.userChoice) {
@@ -914,6 +1163,16 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         showReviewDisplay(ctx, config, gate, command, target, "approved", "approved by user", true);
         return undefined;
       }
+      recordDenial(
+        config,
+        ctx,
+        target,
+        gate,
+        command,
+        "block",
+        detail,
+        decisionSource === "guardian" ? "user" : "review_failure",
+      );
       showReviewDisplay(ctx, config, gate, command, target, "blocked", "blocked by user", true);
       return { block: true, reason: "Blocked by user" };
     } finally {
@@ -935,17 +1194,44 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       return { block: true, reason: error instanceof Error ? error.message : String(error) };
     }
     if (!config.enabled) return;
-    const matches = untrustedMatches(command, config);
-    if (!matches.length) return;
+    const target: ReviewTarget = { toolName: event.toolName, toolCallId: event.toolCallId };
+    const ruleMatches = findGates(command, config.rules);
+    const matches = ruleMatches.filter(
+      (gate) => gate.level === "deny" || !trustedGroups.has(gate.group),
+    );
+    // Level priority across all matches, never first-match: a convention or
+    // guarded rule earlier in config order must not shadow a deny rule later.
+    const deny = matches.find((gate) => gate.level === "deny");
+    if (deny) {
+      recordDenial(config, ctx, target, deny, command, "block", deny.message ?? deny.label, "deny");
+      return { block: true, reason: denyReason(deny) };
+    }
     const convention = matches.find((gate) => gate.level === "convention");
     if (convention && !allowedConventionCommands.has(command)) {
+      recordDenial(
+        config,
+        ctx,
+        target,
+        convention,
+        command,
+        "block",
+        convention.message ?? convention.label,
+        "convention",
+      );
       return { block: true, reason: conventionReason(convention, command) };
     }
-    const gate = matches.find((candidate) => candidate.level === "guarded");
+    let gate = matches.find((candidate) => candidate.level === "guarded");
+    // With reviewAllShell on, a command no rule names at all still gets a
+    // guardian review under the generic gate. "No rule" is judged before the
+    // trusted-groups filter: a command whose matching group the project
+    // trusts was explicitly waved through, not left unnamed, and must not be
+    // re-captured by the blanket gate.
+    if (!gate && !ruleMatches.length && config.reviewAllShell && !trustedGroups.has(ALL_SHELL_GATE.group)) {
+      gate = ALL_SHELL_GATE;
+    }
     if (!gate) return;
 
     const signal = ctx.signal;
-    const target = { toolName: event.toolName, toolCallId: event.toolCallId };
     showReviewDisplay(ctx, config, gate, command, target, "waiting");
     try {
       const verdict = await reviewCommand(
@@ -979,6 +1265,16 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       const loopContext = detectLoopContext();
       if (loopContext) {
         const charge = chargeLoopRevision(loopContext.loopId, gate.label, verdict.reason);
+        recordDenial(
+          config,
+          ctx,
+          target,
+          gate,
+          command,
+          verdict.decision === "revise" ? "revise" : "block",
+          verdict.reason,
+          "loop",
+        );
         showReviewDisplay(
           ctx,
           config,
@@ -991,10 +1287,16 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         );
         return {
           block: true,
-          reason: loopBlockReason({ gateLabel: gate.label, reason: verdict.reason, ...charge }),
+          reason: loopBlockReason({
+            gateLabel: gate.label,
+            reason: verdict.reason,
+            decision: verdict.decision,
+            ...charge,
+          }),
         };
       }
       if (verdict.decision === "revise") {
+        recordDenial(config, ctx, target, gate, command, "revise", verdict.reason, "guardian");
         showReviewDisplay(ctx, config, gate, command, target, "revise", verdict.reason, true);
         return {
           block: true,
@@ -1012,6 +1314,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       // judgment, so it charges no revision round — but it still must not open
       // a modal in a session with nobody to answer it.
       if (detectLoopContext()) {
+        recordDenial(config, ctx, target, gate, command, "block", reason, "review_failure");
         showReviewDisplay(ctx, config, gate, command, target, "blocked", reason, true);
         return {
           block: true,
@@ -1041,7 +1344,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     name: "request_override",
     executionMode: "sequential",
     label: "Request Override",
-    description: "Request a one-session exception for a command that violates a tooling convention. This cannot bypass guarded commands.",
+    description: "Request a one-session exception for a command that violates a tooling convention. This cannot bypass guarded commands or deny rules.",
     parameters: Type.Object({
       command: Type.String({ description: "Exact command to allow" }),
       reason: Type.String({ description: "Why the convention does not apply" }),
@@ -1057,6 +1360,12 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         };
       }
       const matches = untrustedMatches(params.command, config);
+      if (matches.some((gate) => gate.level === "deny")) {
+        return {
+          content: [{ type: "text", text: "The command matches a deny rule, which is a hard policy boundary. Deny rules cannot be bypassed with request_override; choose a different approach." }],
+          details: { success: false },
+        };
+      }
       if (!matches.length || matches.some((gate) => gate.level === "guarded")) {
         return {
           content: [{ type: "text", text: "The command is not a convention violation. Guarded commands cannot be bypassed with request_override." }],
@@ -1123,16 +1432,132 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
    * and in every other one. reviewerFingerprint() covers provider, model and
    * reasoning effort, so the cached reviewer lineage self-invalidates too.
    */
+  /**
+   * `/auto-permissions setup`: scan the project (git remotes, AGENTS.md or
+   * README.md, lockfiles) and recent session files — command strings only,
+   * never user messages — then draft guardianPolicy.environment entries plus
+   * suggested trusted-ops groups with one model call. The draft is accepted
+   * or discarded as a whole; accepting appends the environment entries via
+   * the narrow config writer. Trusted-ops suggestions are displayed only:
+   * a wizard must not widen a project-level bypass file on its own.
+   */
+  async function runSetupWizard(ctx: ExtensionContext): Promise<void> {
+    const path = autoPermissionsConfigPath();
+    let config: AutoPermissionsConfig;
+    try {
+      config = loadAutoPermissionsConfig(path);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      ctx.ui.notify(`Auto Permissions config error: ${message} — fix ${path} first`, "warning");
+      return;
+    }
+    const model = config.reviewer
+      ? ctx.modelRegistry.find(config.reviewer.provider, config.reviewer.model)
+      : ctx.model;
+    if (!model) {
+      ctx.ui.notify("Auto Permissions setup needs a reviewer model (or an active session model).", "warning");
+      return;
+    }
+
+    ctx.ui.notify("Auto Permissions setup: scanning project facts and recent session commands…", "info");
+    const project = scanProject(ctx.cwd);
+    const commands = scanRecentSessionCommands(join(getAgentDir(), "sessions"));
+    const availableGroups = [...new Set(config.rules.map((rule) => rule.group))].sort();
+
+    const sessionId = reviewerSessionId(model);
+    let draftText: string;
+    try {
+      const setupSignal = AbortSignal.any([AbortSignal.timeout(60_000), reviewerLifecycleController.signal]);
+      const auth = await waitForSignal(ctx.modelRegistry.getApiKeyAndHeaders(model), setupSignal);
+      if (!auth.ok) throw new Error(auth.error);
+      const response = await resolveGuardianCompleteSimple(ctx.modelRegistry, "pi-auto-permissions")(
+        model,
+        {
+          systemPrompt: SETUP_DRAFT_SYSTEM_PROMPT,
+          messages: [{
+            role: "user",
+            content: [{ type: "text", text: buildSetupDraftRequest(project, commands, availableGroups) }],
+            timestamp: Date.now(),
+          }],
+        },
+        {
+          apiKey: auth.apiKey,
+          headers: auth.headers,
+          env: auth.env,
+          signal: setupSignal,
+          reasoning: "low",
+          sessionId,
+          transport: isOpenAICodexModel(model) ? "websocket" : "auto",
+        },
+      );
+      if (response.stopReason === "aborted") throw new Error("setup draft timed out or was cancelled");
+      if (response.stopReason === "error") throw new Error(response.errorMessage ?? "setup draft request failed");
+      recordReviewerUsage(config, model, response.usage, false, "setup");
+      draftText = assistantText(response.content);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      ctx.ui.notify(`Auto Permissions setup failed: ${message}`, "warning");
+      return;
+    } finally {
+      cleanupReviewerSession(sessionId);
+    }
+
+    let draft: ReturnType<typeof parseSetupDraft>;
+    try {
+      draft = parseSetupDraft(draftText, availableGroups);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      ctx.ui.notify(`Auto Permissions setup failed: ${message}`, "warning");
+      return;
+    }
+    if (!draft.environment.length && !draft.trustedGroups.length) {
+      ctx.ui.notify("Auto Permissions setup found nothing to suggest for this project.", "info");
+      return;
+    }
+
+    const lines = ["Auto Permissions setup — proposed trust configuration", ""];
+    if (draft.environment.length) {
+      lines.push("guardianPolicy.environment entries to append:");
+      for (const entry of draft.environment) lines.push(`  - ${entry}`);
+    }
+    if (draft.trustedGroups.length) {
+      if (draft.environment.length) lines.push("");
+      lines.push("Suggested .pi/trusted-ops groups (shown only — add them to the project file yourself):");
+      for (const group of draft.trustedGroups) lines.push(`  - ${group}`);
+    }
+
+    const choice = await promptSelect(
+      ctx,
+      lines.join("\n"),
+      draft.environment.length ? ["Accept and save", "Discard"] : ["Done"],
+      reviewerLifecycleController.signal,
+      { allowComment: false },
+    );
+    if (choice !== "Accept and save" || !draft.environment.length) return;
+    try {
+      patchAutoPermissionsConfig(path, { appendEnvironment: draft.environment });
+      ctx.ui.notify(`Saved ${draft.environment.length} environment entr${draft.environment.length === 1 ? "y" : "ies"} to guardianPolicy.`, "info");
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      ctx.ui.notify(`Could not save Auto Permissions setup draft: ${message}`, "warning");
+    }
+  }
+
   pi.registerCommand("auto-permissions", {
-    description: "Configure Auto Permissions",
-    handler: async (_args, ctx) => {
+    description: "Configure Auto Permissions (\"setup\" drafts trust configuration from your project)",
+    handler: async (args, ctx) => {
       if (ctx.mode !== "tui") {
         ctx.ui.notify("/auto-permissions requires interactive TUI mode", "warning");
         return;
       }
+      if ((args ?? "").trim() === "setup") {
+        await runSetupWizard(ctx);
+        return;
+      }
 
       const path = autoPermissionsConfigPath();
       let settings: ReviewerSettings;
+      let denialLog: AutoPermissionsConfig["denialLog"];
       try {
         const config = loadAutoPermissionsConfig(path);
         settings = {
@@ -1140,6 +1565,7 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
           reviewer: config.reviewer,
           systemPromptSource: config.systemPromptSource,
         };
+        denialLog = config.denialLog;
       } catch (error) {
         // Editing a file we cannot validate is the one way this writer could
         // quietly make things worse, so refuse rather than open.
@@ -1181,6 +1607,52 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
         return ctx.modelRegistry.find(settings.reviewer.provider, settings.reviewer.model) as MenuModel | undefined;
       };
 
+      const recentDenials = (): DenialSummary[] => {
+        if (!denialLog.enabled) return [];
+        try {
+          return readRecentDenials(denialLog.path, 20).map((record) => ({
+            id: record.id,
+            ts: record.ts,
+            gateLabel: record.gate.label,
+            command: record.command,
+            verdict: record.verdict,
+            reason: record.reason,
+          }));
+        } catch {
+          return [];
+        }
+      };
+
+      /**
+       * "Allow on retry": the existing override machinery, driven from the
+       * denial ledger. An exact-command allow override (which already
+       * generalizes correctly and survives via evidence re-injection and the
+       * session entry), plus a visible injected message telling the agent it
+       * may retry. No new authorization pathway.
+       */
+      const allowRetry = (denial: DenialSummary): void => {
+        permissionOverrides.push({
+          seq: overrideSeq++,
+          anchorKey: reviewerLineage?.evidenceKeys.at(-1),
+          gateLabel: denial.gateLabel,
+          command: denial.command,
+          reviewerReason: denial.reason,
+          choice: "allow",
+        });
+        persistOverrides();
+        try {
+          // The same channel a prompt note uses. This is a real user decision
+          // made in the menu, so a user message is honest provenance — and it
+          // gives the agent a turn to actually retry.
+          pi.sendUserMessage(
+            `Auto Permissions: I reviewed the denied command in /auto-permissions and allowed it on retry:\n\n  ${denial.command}\n\nYou may run this exact command again; a session override now authorizes it.`,
+          );
+        } catch {
+          // The override itself is already in force; the nudge is best-effort.
+        }
+        ctx.ui.notify("Override added for the exact command; the agent may retry it.", "info");
+      };
+
       await ctx.ui.custom<void>((tui, _theme, _keybindings, done) => {
         const host: SubmenuHost = {
           getSettings: () => settings,
@@ -1190,11 +1662,19 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
           settingsTheme: getSettingsListTheme(),
           selectTheme: getSelectListTheme(),
         };
+        const denialsHost: DenialsSubmenuHost = {
+          recentDenials,
+          allowRetry,
+          settingsTheme: getSettingsListTheme(),
+          selectTheme: getSelectListTheme(),
+          requestRender: () => tui.requestRender(),
+        };
         const list = new SettingsList(
           buildSettingItems(settings, {
             reviewerModel: createModelSubmenu(host),
             timeout: createTimeoutSubmenu(host),
-          }),
+            ...(denialLog.enabled ? { recentDenials: createDenialsSubmenu(denialsHost) } : {}),
+          }, undefined, denialLog.enabled ? recentDenials().length : undefined),
           10,
           host.settingsTheme,
           (id, value) => {
@@ -1238,8 +1718,9 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
     reviewerLifecycleController = new AbortController();
     sessionActive = true;
     allowedConventionCommands.clear();
-    permissionOverrides.length = 0;
-    overrideSeq = 0;
+    // Restore prompt decisions from the branch: a resumed session keeps its
+    // allows and standing block constraints (parity with the loop budget).
+    restoreOverrides(ctx.sessionManager.getBranch());
     // Rebuild the revise budget before the first tool call: a resumed session
     // that forgot its spent rounds would hand the agent a fresh set of them.
     loopReviseBudget.restore(ctx.sessionManager.getBranch());
@@ -1251,6 +1732,11 @@ export default function autoPermissionsExtension(pi: ExtensionAPI) {
       if (details?.success && details.command) allowedConventionCommands.add(details.command);
     }
     trustedGroups = ctx.isProjectTrusted() ? loadTrustedGroups(ctx.cwd) : new Set();
+    // Snapshot the trust baseline at session start: remotes configured now are
+    // inside the boundary, anything added or repointed later is not. Re-capture
+    // on every session_start (resume, branch switch) so the baseline follows
+    // the session the reviews belong to; the fingerprint covers the change.
+    sessionEnvironment = captureSessionEnvironment(ctx.cwd);
     try {
       const config = currentConfig(ctx);
       if (config.ui.placement === "toolRow") registerGuardedBash(ctx);