auto-permission-system 3.15.0 → 3.18.0

package/extensions/guard.ts

@@ -65,7 +65,7 @@ async function askDetection(
 	if (choice === "session") {
 		detectionGrants.add(key);
 		audit({ layer: 2, tool: kind, subject, reason, decision: "session", note: "advanced-secure", cwd: ctx.cwd });
-		ctx.ui.notify(`security-guard: allowed for this conversation (not saved) → ${subject}`, "info");
+		ctx.ui.notify(`Allowed for this conversation: ${subject}`, "info");
 		return null;
 	}
 	audit({ layer: 2, tool: kind, subject, reason, decision: "no", note: "advanced-secure", cwd: ctx.cwd });
@@ -130,24 +130,23 @@ export default function (pi: ExtensionAPI) {
 			if (!err) continue;
 			audit({ layer: 2, event: "policy-parse-error", file: p, error: err, cwd: ctx.cwd });
 			console.error(`security-guard: ${p} does not parse (${err}); its rules are NOT applied`);
-			ctx.ui.notify(`⚠️  security-guard: ${p} does not parse, so neither layer applies its rules (built-in defaults instead).\n${err}`, "error");
+			const isProject = p === `${ctx.cwd}/.pi/sandbox.json`;
+			const msg = isProject
+				? "⚠️  Syntax error in settings file — project configuration not loaded."
+				: "⚠️  Syntax error in settings file — global configuration not loaded.";
+			ctx.ui.notify(msg, "error");
 		}
 		setPiDeclinedTrust((ctx as { isProjectTrusted?: () => boolean }).isProjectTrusted?.() === false);
 		const changes = untrustedProjectChanges(ctx.cwd);
 		if (changes.length && !isProjectFileDeclined(projectPolicyPath(ctx.cwd), TRUST_STORE)) {
 			audit({ layer: 2, event: "untrusted-project-policy", file: projectPolicyPath(ctx.cwd), changes, cwd: ctx.cwd });
-			ctx.ui.notify(
-				`⚠️  This folder has a .pi/sandbox.json that tries to make your security weaker:\n${bullets(changes)}\n` +
-					"auto-permission-system ignores these changes. Its block rules still apply.\n" +
-					"Did you write this file? Then type /security trust.",
-				"warning",
-			);
+			ctx.ui.notify("🛡️  Project-level configuration detected: run /security trust to approve.", "warning");
 		}
 		const policy = loadPolicy(ctx.cwd);
 		if (!policy.enabled) {
 			policyEnabled = false;
 			applyActive();
-			ctx.ui.notify("security-guard (Layer 2) disabled: enabled=false in sandbox.json", "info");
+			ctx.ui.notify("Tool guard is disabled in your sandbox.json settings.", "info");
 			return;
 		}
 		policyEnabled = true;
@@ -316,15 +315,15 @@ export default function (pi: ExtensionAPI) {
 			if (choice === "program-session" && programId) {
 				grantProgramOutputSession(programId);
 				audit({ layer: 2, tool: event.toolName, decision: "session", grant: programId, note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🧠 Advanced Secure: you allowed all ${programId} output for the rest of this conversation.`, "info");
+				ctx.ui.notify(`Output permitted: allowed all ${programId} output for this conversation.`, "info");
 			} else {
 				audit({ layer: 2, tool: event.toolName, decision: "yes", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-				ctx.ui.notify(`🧠 Advanced Secure: you allowed ${event.toolName} output to be sent.`, "warning");
+				ctx.ui.notify(`Output permitted: allowed ${event.toolName} output for this call.`, "info");
 			}
 			return;
 		}
 		audit({ layer: 2, tool: event.toolName, decision: "no", note: "advanced-secure-output", findings, cwd: ctx.cwd });
-		ctx.ui.notify(`🧠 Advanced Secure: blocked ${event.toolName} output — it may contain sensitive information. Nothing was sent to the model.`, "warning");
+		ctx.ui.notify(`Sensitive data protected: withheld ${event.toolName} output from the AI (potential secrets detected).`, "warning");
 		return { content: [{ type: "text", text: withheldNotice(subject) }] };
 	});
 

package/extensions/permission-mode.ts

@@ -39,7 +39,7 @@ const MODE_DEFS: Array<{
 	},
 	{
 		value: "yolo",
-		icon: "⚠️",
+		icon: "🚨",
 		name: "YOLO",
 		desc: "Turns off all file sandboxing and leak protections",
 	},
@@ -67,7 +67,7 @@ function renderSandboxChip(ctx: ExtensionContext): void {
 }
 
 function modeNotice(mode: PermissionMode): { text: string; level: "info" | "warning" } {
-	if (mode === "yolo") return { text: "⚠️  YOLO — all security layers disabled. Saved; new conversations start this way too.", level: "warning" };
+	if (mode === "yolo") return { text: "🚨  YOLO — all security layers disabled. Saved; new conversations start this way too.", level: "warning" };
 	if (mode === "advanced-secure") return { text: "🧠 Advanced Secure on. File reads, MCP calls, and tool output are checked for secrets.", level: "info" };
 	return { text: "🛡 Default mode. Rule-based policy only.", level: "info" };
 }
@@ -97,7 +97,7 @@ async function pickMode(pi: ExtensionAPI, ctx: ExtensionContext, yolo: { active:
 			emitYolo(pi.events, true);
 			audit({ layer: 0, event: "permission-mode", mode: "yolo", cwd: ctx.cwd, note: "runtime-sync" });
 			renderSandboxChip(ctx);
-			ctx.ui.notify("⚠️  YOLO — all security layers disabled for this conversation.", "warning");
+			ctx.ui.notify("🚨  YOLO — all security layers disabled for this conversation.", "warning");
 			return;
 		}
 		ctx.ui.notify(`Permission mode is already ${modeLabel(next)}.`, "info");

package/extensions/sandbox.ts

@@ -169,7 +169,7 @@ export default function (pi: ExtensionAPI) {
 		if (runtimeYolo) {
 			await stopSandbox();
 			ctx.ui.setStatus("sandbox", ctx.ui.theme.fg("error", YOLO_STATUS));
-			ctx.ui.notify(ctx.ui.theme.fg("error", "⚠️  YOLO mode — all pi security layers disabled."), "info");
+			ctx.ui.notify(ctx.ui.theme.fg("error", "🚨  YOLO mode — all pi security layers disabled."), "info");
 			return;
 		}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-permission-system",
-  "version": "3.15.0",
+  "version": "3.18.0",
   "description": "Claude auto mode for Pi & security for Pi. A zero-trust permission system for Pi coding agent powered by Advanced Secure mode to scan files, content, and tools to prevent data breaches.",
   "type": "module",
   "author": "Navin Kumar",

package/src/core/policy/patterns.ts

@@ -86,8 +86,10 @@ export function extractLoopbackEndpoint(output: string, command?: string): Loopb
 
 /** A shell-name/empty token is not a path; everything else resolves against cwd unless absolute. */
 function toAbsolutePath(rawToken: string, cwd: string, home: string): string | undefined {
-	let token = rawToken.trim().replace(/[.,;]+$/, "");
-	if (!token || /^(bash|sh|zsh)$/.test(token)) return undefined;
+	let token = rawToken.trim().replace(/[.,;:]+$/, "");
+	if (!token || /^(bash|sh|zsh|EROFS)$/i.test(token)) return undefined;
+	token = token.replace(/\/EROFS$/i, "");
+	if (!token) return undefined;
 	if (token === "~" || token.startsWith("~/")) token = home + token.slice(1);
 	const absolute = token.startsWith("/") ? token : `${cwd.replace(/\/+$/, "")}/${token}`;
 	return normalizeAbs(absolute);

package/src/l1-sandbox/bash-ops.ts

@@ -30,7 +30,7 @@ export interface SandboxedBashOpts {
 
 /** One denial shape for Layer 1, mirroring denyMessage() in Layer 2. */
 function blockedLine(action: "Read" | "Write", why: string, outcome: "read" | "written" | "run"): string {
-	return `🛡️  pi-sandbox: ${action} blocked by policy: ${why}. Nothing was ${outcome}. Assistant guideline: Inform the user and ask if they wish to adjust the permission mode (/permission-mode); do not attempt workarounds or inspect plugin internals.`;
+	return `[Security Policy Notice] ${action} blocked by policy: ${why}. Nothing was ${outcome}. Inform the user; do not attempt workarounds.`;
 }
 
 /** `Link` body row for a symlinked block path; empty when the spellings agree (ADR-035). */
@@ -93,7 +93,7 @@ async function preflightSensitiveCommands(
 		return undefined;
 	}
 	auditL1({ subject, decision: "no", note: "sensitive-command", cwd });
-	onData(Buffer.from(`\n❌ pi-sandbox: command blocked — it can print secrets: ${subject}. Nothing was run — ask the user.\n`));
+	onData(Buffer.from(`\n[Security Block] sandbox: command execution was denied by user: ${subject}. Command was not executed.\n`));
 	return { exitCode: 1 };
 }
 
@@ -109,14 +109,15 @@ async function preflightAskReads(
 ): Promise<{ exitCode: number } | undefined> {
 	const cfg = loadConfig(cwd).filesystem;
 	if (!cfg?.askRead?.length) return undefined;
-	const paths = askReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
-	if (!paths.length) return undefined;
+	const rawPaths = askReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
+	if (!rawPaths.length) return undefined;
+	const paths = Array.from(new Set(rawPaths.map((p) => canonicalize(p, cwd))));
 	const ui = opts?.ctx as AskCtx | undefined;
 	for (const absPath of paths) {
 		if (sessionAskReadGrants.includes(absPath)) continue;
 		if (!ui?.hasUI || !ui.ui?.select) {
 			auditL1({ subject: absPath, decision: "no", note: "ask-read-headless", cwd });
-			onData(Buffer.from(`\n❌ pi-sandbox: sensitive file read blocked: ${absPath}. Nothing was run — ask the user.\n`));
+			onData(Buffer.from(`\n[Security Block] sandbox: read access to ${absPath} was blocked (automated environment). Command was not executed.\n`));
 			return { exitCode: 1 };
 		}
 		const choice = await askMain(ui, "Let this command read your .env file?", [`File     ${absPath}`, `Why      .env files usually hold passwords and API keys`, `Risk     the AI will see any keys in it`, `Note     can't be saved as a permanent rule (it holds secrets)`].join("\n"), { session: true, remember: false, icon: "cred" });
@@ -126,7 +127,7 @@ async function preflightAskReads(
 			continue;
 		}
 		auditL1({ subject: absPath, decision: "no", note: "ask-read", cwd });
-		onData(Buffer.from(`\n❌ pi-sandbox: sensitive file read blocked: ${absPath}. Nothing was run — ask the user.\n`));
+		onData(Buffer.from(`\n[Security Block] sandbox: read access to ${absPath} was denied by user. Command was not executed.\n`));
 		return { exitCode: 1 };
 	}
 	return undefined;
@@ -143,7 +144,9 @@ async function preflightOutsideReads(
 		return undefined;
 	}
 	const once: string[] = [];
-	for (const absPath of outsideProjectReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd))) {
+	const rawCandidates = outsideProjectReadCandidates(command, cwd, homedir(), cfg, undefined, (absPath) => canonicalize(absPath, cwd));
+	const candidates = Array.from(new Set(rawCandidates.map((p) => canonicalize(p, cwd))));
+	for (const absPath of candidates) {
 		if (sessionReadGrants.includes(absPath)) continue;
 		const ui = opts.ctx as AskCtx;
 		const parent = dirname(absPath);
@@ -327,21 +330,10 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 								}
 								readDenied = hardDenied || outsideDenied;
 							}
-							blockedHint = `\n🛡️  Security Policy Notice: filesystem access blocked by sandbox policy.\n`;
-							if (offending) {
-								let why = "";
-								if (writeDenied && !hardDenied) why = " (writes outside allowWrite are read-only)";
-								else if (hardDenied) why = ` (${hardWhy})`;
-								else if (outsideDenied) why = " (outside the project directory)";
-								blockedHint += `   Target: ${offending}${why}\n`;
-								if (spelledOffending && spelledOffending !== offending) blockedHint += `   Link:   ${spelledOffending}\n`;
-							}
-							blockedHint +=
-								`   Explanation: The current sandbox policy restricts this operation to protect your system.\n` +
-								`   Guideline for Assistant:\n` +
-								`   • Stop and inform the user clearly about what was blocked.\n` +
-								`   • Ask the user if they wish to adjust the permission mode (/permission-mode) to allow this action.\n` +
-								`   • Do not inspect security plugin internals or attempt unauthorized bypasses.\n`;
+							let reason = "writes outside allowWrite are read-only";
+							if (hardDenied) reason = hardWhy;
+							else if (outsideDenied) reason = "target is outside the project directory";
+							blockedHint = `\n[Security Policy Notice] filesystem access blocked by sandbox policy: ${writeDenied ? "Write" : "Read"} access to ${offending ?? "target"} is restricted.\nReason: ${reason}. Inform the user; do not attempt workarounds.\n`;
 						} else if (code !== 0 && isLoopbackConnectionRefused(outputTail)) {
 							const endpointInfo = extractLoopbackEndpoint(outputTail, command);
 							const endpointStr = endpointInfo?.port ? `${endpointInfo.host}:${endpointInfo.port}` : (endpointInfo?.host ?? "127.0.0.1");
@@ -356,17 +348,11 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							});
 
 							const notifyMsg = serviceName
-								? `pi-sandbox: connection to ${serviceName} on ${endpointStr} was restricted by the sandbox.`
-								: `pi-sandbox: connection to host ${endpointStr} was restricted by the sandbox.`;
+								? `Local network notice: connection to ${serviceName} (${endpointStr}) was blocked by security policy.`
+								: `Local network notice: connection to host ${endpointStr} was blocked by security policy.`;
 							opts?.ctx?.ui?.notify?.(notifyMsg, "warning");
 
-							blockedHint = `\n🛡️  Security Policy Notice: Local network connection restricted.\n` +
-								`   Target: ${endpointStr}${serviceName ? ` (${serviceName})` : ""}\n` +
-								`   Explanation: The sandbox policy restricted access to this local host address.\n` +
-								`   Guideline for Assistant:\n` +
-								`   • Stop and inform the user clearly about what connection was restricted.\n` +
-								`   • Ask the user if they wish to adjust the permission mode (/permission-mode) to allow this action.\n` +
-								`   • Do not inspect security plugin internals or attempt unauthorized bypasses.\n`;
+							blockedHint = `\n[Security Policy Notice] Connection to ${endpointStr}${serviceName ? ` (${serviceName})` : ""} blocked by sandbox policy.\nReason: Local network connections are restricted. Inform the user; do not attempt workarounds.\n`;
 						}
 						/**
 						 * Emit the block explanation only when the command is not re-run with a
@@ -386,8 +372,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 						if (sandboxSetupError && !hardDenied && !outsideDenied && (!offending || offending === cwd || offending.startsWith(`${cwd}/`))) {
 							blockedHint = "";
 							auditL1({ subject: offending ?? spelledOffending, decision: "write-denied", reason: "the OS sandbox could not start (bwrap mount setup)", cwd: opts?.ctx?.cwd, note: "sandbox-setup-error" });
-							opts?.ctx?.ui?.notify?.(`pi-sandbox: the OS sandbox could not start (bwrap could not create ${offending ?? spelledOffending ?? "a protected mount point"}). This is a sandbox setup problem, not a policy denial.`, "warning");
-							decisionHint = `\n❌ pi-sandbox: the OS sandbox could not start (bwrap could not create a protected mount point), so nothing was permission-prompted. This is a sandbox setup problem, not a policy denial.\n`;
+							opts?.ctx?.ui?.notify?.(`Sandbox setup notice: could not prepare folder isolation for ${offending ?? spelledOffending ?? "the sandbox"}. System defaults will be used.`, "warning");
+							decisionHint = `\n[System Error] pi-sandbox: the OS sandbox could not start (bwrap could not create a protected mount point), so nothing was permission-prompted. This is a sandbox setup problem, not a policy denial.\n`;
 							onData(Buffer.from(decisionHint));
 						} else if (offending && outsideDenied && !hardDenied && outsideMode === "ask" && opts?.ctx?.hasUI && opts.ctx.ui?.select && opts.onAlwaysRead) {
 							const absPath = offending;
@@ -407,8 +393,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									if (choice === MainChoice.Once) readOnce.push(absPath);
 									else sessionReadGrants.push(absPath);
 									auditL1({ subject: absPath, decision: choice, scope: choice === MainChoice.Once ? "invocation" : "session", cwd: opts.ctx.cwd, note: "outside-project-read" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this conversation"} — re-running the command`, "warning");
-									onData(Buffer.from(`\n✅ pi-sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this conversation"}. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${absPath} ${choice === MainChoice.Once ? "once" : "for this conversation"}`, "info");
+									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: read of ${absPath} allowed ${choice === MainChoice.Once ? "once" : "for this conversation"}. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}
@@ -417,13 +403,13 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									try {
 										const persistedTo = await opts.onAlwaysRead(subject, grant.scope);
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, decision: grant.scope === "cwd" ? "always-cwd" : "always-global", scope: grant.scope, cwd: opts.ctx.cwd, persisted_to: persistedTo, note: "outside-project-read" });
-										opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${subject} (${grant.scope}${grant.folder ? ", folder" : ""}) — re-running the command`, "warning");
-										onData(Buffer.from(`\n✅ pi-sandbox: read of ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
+										opts.ctx.ui?.notify?.(`pi-sandbox: allowed read of ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
+										onData(Buffer.from(`\n[Permission Granted] pi-sandbox: read of ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
 										resolve(attempt([]));
 										return;
 									} catch (e) {
 										auditL1({ subject, scope: grant.scope, cwd: opts.ctx.cwd, error: String(e), note: "outside-project-read" });
-										decisionHint = `\n❌ pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
+										decisionHint = `\n[Security Notice] pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
 									}
 								}
 							} catch (e) {
@@ -445,12 +431,13 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							const action: "Read" | "Write" = writeDenied ? "Write" : "Read";
 							const outcome = action === "Write" ? "written" : "read";
 							auditL1({ subject: offending, decision: readDenied && !writeDenied ? "read-denied" : "write-denied", reason: why, cwd });
-							opts?.ctx?.ui?.notify?.(`pi-sandbox: bash was refused a ${action.toLowerCase()} of ${offending} (${why}). Edit sandbox.json if that is wrong.`, "warning");
+							opts?.ctx?.ui?.notify?.(`Folder protected: unable to ${action.toLowerCase()} ${offending}. Location is restricted under current policy.`, "warning");
 							decisionHint = `\n${blockedLine(action, why, outcome)}\n`;
 							onData(Buffer.from(decisionHint));
 						} else if (offending && writeGrantRepeated && writeGrantParent) {
 							auditL1({ subject: offending, decision: "write-denied", reason: `grant for ${writeGrantParent} did not take effect`, cwd: opts?.ctx?.cwd, note: "grant-ineffective" });
-							opts?.ctx?.ui?.notify?.(`pi-sandbox: the write grant for ${writeGrantParent} did not take effect — the sandbox still refuses ${offending}.`, "warning");
+							const targetFolder = (writeGrantParent || offending || "").replace(/\/EROFS$/i, "");
+							opts?.ctx?.ui?.notify?.(`🚧  Folder protected: unable to write to ${targetFolder} under sandbox policy. Review sandbox.json or /permission-mode.`, "warning");
 							decisionHint = `\n${blockedLine("Write", `the grant for ${writeGrantParent} did not take effect`, "written")}\n`;
 							onData(Buffer.from(decisionHint));
 						} else if (offending && opts?.ctx?.hasUI && opts.ctx.ui?.select && opts.onAlways) {
@@ -472,8 +459,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 								if (choice === MainChoice.Once) {
 									grantedWriteFolders.add(parentDir);
 									auditL1({ subject: absPath, granularity: "folder", original: absPath, decision: "once", scope: "invocation", cwd: opts.ctx.cwd, note: "write-once" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed ${absPath} once — re-running the command`, "warning");
-									onData(Buffer.from(`\n✅ pi-sandbox: write to ${absPath} allowed once. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${absPath} once`, "info");
+									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${absPath} allowed once. Command output with the new permission follows.\n`));
 									resolve(attempt([...writeOnce, parentDir]));
 									return;
 								}
@@ -482,8 +469,8 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 									sessionWriteGrants.push(value);
 									(value === parentDir ? grantedWriteFolders : grantedWriteFiles).add(value);
 									auditL1({ subject: value, granularity: value === parentDir ? "folder" : "file", original: absPath, decision: "session", scope: "session", cwd: opts.ctx.cwd, note: "write-session" });
-									opts.ctx.ui?.notify?.(`pi-sandbox: allowed ${value} for this conversation (not saved) — re-running the command`, "info");
-									onData(Buffer.from(`\n✅ pi-sandbox: write to ${value} allowed for this conversation. Command output with the new permission follows.\n`));
+									opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${value} for this conversation`, "info");
+									onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${value} allowed for this conversation. Command output with the new permission follows.\n`));
 									resolve(attempt([]));
 									return;
 								}
@@ -493,14 +480,14 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 										const persistedTo = await opts.onAlways(subject, grant.scope);
 										(grant.folder ? grantedWriteFolders : grantedWriteFiles).add(subject);
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, decision: grant.scope === "cwd" ? "always-cwd" : "always-global", scope: grant.scope, cwd: opts.ctx.cwd, persisted_to: persistedTo });
-										opts.ctx.ui?.notify?.(`pi-sandbox: allowed ${subject} (${grant.scope}${grant.folder ? ", folder" : ""}) — re-running the command`, "warning");
-										onData(Buffer.from(`\n✅ pi-sandbox: write to ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
+										opts.ctx.ui?.notify?.(`pi-sandbox: allowed write to ${subject} (${grant.scope}${grant.folder ? ", folder" : ""})`, "info");
+										onData(Buffer.from(`\n[Permission Granted] pi-sandbox: write to ${subject} allowed (${grant.scope}${grant.folder ? ", folder" : ""}). Command output with the new permission follows.\n`));
 										resolve(attempt([]));
 										return;
 									} catch (e) {
 										auditL1({ subject, granularity: grant.folder ? "folder" : "file", original: absPath, scope: grant.scope, cwd: opts.ctx.cwd, error: String(e) });
 										opts.ctx.ui?.notify?.(`pi-sandbox: could not save the permission (${e})`, "error");
-										decisionHint = `\n❌ pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
+										decisionHint = `\n[Security Notice] pi-sandbox: could not save the permission (${e}). ${subject} remains blocked.\n`;
 									}
 								}
 							} catch (e) {
@@ -519,7 +506,7 @@ export function createSandboxedBashOps(opts?: SandboxedBashOpts): BashOperations
 							onData(Buffer.from(decisionHint));
 						} else if (offending && writeDenied) {
 							auditL1({ subject: offending, decision: "write-denied", reason: "not under any allowWrite root", cwd });
-							opts?.ctx?.ui?.notify?.(`pi-sandbox: bash was refused a write of ${offending} (not under any allowWrite root).`, "warning");
+							opts?.ctx?.ui?.notify?.(`Folder protected: unable to write to ${offending}. Location is outside allowed project folders.`, "warning");
 							onData(Buffer.from(`\n${blockedLine("Write", "not under any allowWrite root", "written")}\n`));
 						}
 

package/src/l1-sandbox/network-ask.ts

@@ -161,7 +161,7 @@ async function decide(deps: NetworkAskDeps, host: string, port: number | undefin
 	if (mainChoice === MainChoice.Session) {
 		sessionGrants.push(wildcard);
 		deps.audit({ ...base, decision: "session", grant: wildcard, requested: host });
-		ctx.ui.notify?.(`pi-sandbox: allowed for this conversation (not saved) → ${wildcard}`, "info");
+		ctx.ui.notify?.(`Allowed for this conversation: ${wildcard}`, "info");
 		return true;
 	}
 
@@ -176,11 +176,12 @@ async function decide(deps: NetworkAskDeps, host: string, port: number | undefin
 		const path = await deps.persist(pattern, scope);
 		deps.applyLive(pattern);
 		deps.audit({ ...base, decision: scope === GrantScope.Cwd ? "always-cwd" : "always-global", scope, persisted_to: path, pattern, requested: host });
-		ctx.ui.notify?.(`pi-sandbox: persisted ${scope} override → ${path}`, "warning");
+		const scopeLabel = scope === GrantScope.Cwd ? "this project (stored in project settings)" : "all projects (stored in global settings)";
+		ctx.ui.notify?.(`Rule saved for ${scopeLabel}.`, "info");
 	} catch (error) {
 		commandGrants?.add(host);
 		deps.audit({ ...base, decision: "yes", note: `always-persist-failed: ${error}`, scope });
-		ctx.ui.notify?.(`pi-sandbox: could not persist ${scope} override (${error}); allowing this command only`, "warning");
+		ctx.ui.notify?.(`Could not save rule for ${scope === GrantScope.Cwd ? "this project" : "all projects"} (${error}); allowing this command only.`, "warning");
 	}
 	return true;
 }

package/src/l2-guard/prompts.ts

@@ -87,7 +87,7 @@ export async function askOrBlock(
 			const named = userNamedOutside(ctx as SessionCtx, ask);
 			if (named) {
 				audit({ layer: 2, tool: ask.tool, subject: ask.subject, reason: ask.reason, decision: "user-named", named, cwd: ctx.cwd });
-				ctx.ui.notify(`security-guard: read outside the project allowed once → ${ask.subject} (you named "${named}")`, "info");
+				ctx.ui.notify(`Allowed reading ${ask.subject} once (mentioned in your prompt).`, "info");
 				return null;
 			}
 		}
@@ -102,7 +102,7 @@ export async function askOrBlock(
 		const value = ask.overrideKind === OverrideKind.AllowDomains || isSafeFolderGrant(parent, homedir()) ? parent : ask.overrideValue;
 		sessionGrants.push({ kind: ask.overrideKind, value });
 		audit({ layer: 2, tool: ask.tool, subject: ask.subject, reason: ask.reason, decision, grant: value, cwd: ctx.cwd });
-		ctx.ui.notify(`security-guard: allowed for this conversation (not saved) → ${value}`, "info");
+		ctx.ui.notify(`Allowed for this conversation: ${value}`, "info");
 		return null;
 	}
 	if (decision === Decision.AlwaysCwd || decision === Decision.AlwaysGlobal || decision === Decision.AlwaysCwdFolder || decision === Decision.AlwaysGlobalFolder) {
@@ -117,10 +117,11 @@ export async function askOrBlock(
 			const path = persistOverride(scope, ctx.cwd, ask.overrideKind, value);
 			onPersist?.(ask.overrideKind, value, scope);
 			audit({ layer: 2, tool: ask.tool, subject: ask.subject, reason: ask.reason, decision, scope, granularity: useFolder ? "folder" : "file", cwd: ctx.cwd, persisted_to: path, override: { [ask.overrideKind]: value } });
-			ctx.ui.notify(`security-guard: persisted ${scope}${useFolder ? " (folder)" : ""} override → ${path}`, "warning");
+			const scopeLabel = scope === GrantScope.Cwd ? "this project (stored in project settings)" : "all projects (stored in global settings)";
+			ctx.ui.notify(`Rule saved for ${scopeLabel}.`, "info");
 		} catch (error) {
 			audit({ layer: 2, tool: ask.tool, subject: ask.subject, reason: ask.reason, decision: "yes", note: `always-persist-failed: ${error}`, scope, cwd: ctx.cwd });
-			ctx.ui.notify(`security-guard: could not persist ${scope} override (${error}); allowing this call only`, "warning");
+			ctx.ui.notify(`Could not save rule for ${scope === GrantScope.Cwd ? "this project" : "all projects"} (${error}); allowing this call only.`, "warning");
 		}
 		return null;
 	}

package/src/l2-guard/subagent.ts

@@ -21,7 +21,7 @@ export function subagentNetworkBlock(ctx: { hasUI?: boolean; sessionManager?: un
 	if (ctx.hasUI !== false) return null;
 	const mode = policy.subagent?.network ?? SubagentNetwork.Allow;
 	if (mode === SubagentNetwork.Allow) return null;
-	if (mode === SubagentNetwork.Deny) return "Network blocked by policy: subagent.network=deny. Nothing was fetched — ask the user.";
+	if (mode === SubagentNetwork.Deny) return "[Security Policy Notice] Network access blocked: automated subagent network connections are restricted. Nothing was fetched. Inform the user; do not attempt workarounds.";
 	if (mode === SubagentNetwork.ResearchOnly) {
 		const sessionManager = ctx.sessionManager as { getBranch?: () => Array<{ type: string; text?: string }> } | undefined;
 		const branch = sessionManager?.getBranch?.() ?? [];
@@ -31,7 +31,7 @@ export function subagentNetworkBlock(ctx: { hasUI?: boolean; sessionManager?: un
 			.join(" ")
 			.toLowerCase();
 		for (const agent of RESEARCH_AGENTS) if (recentText.includes(agent)) return null;
-		return "Network blocked by policy: subagent.network=research-only. Nothing was fetched — ask the user.";
+		return "[Security Policy Notice] Network access restricted: subagents may only connect to approved research domains. Nothing was fetched. Inform the user; do not attempt workarounds.";
 	}
 	return null;
 }

package/src/shared/yolo.ts

@@ -26,7 +26,7 @@
 export const YOLO_CHANNEL = "auto-permission-system:yolo";
 
 /** Footer text shown while every layer is disabled. */
-export const YOLO_STATUS = "⚠️  YOLO — all security layers disabled";
+export const YOLO_STATUS = "🚨  YOLO — all security layers disabled";
 
 /** The pi APIs this module needs; kept structural so tests can fake them. */
 export interface YoloFlagPI {

package/src/ui/ask-flow.ts

@@ -482,7 +482,7 @@ export async function askExposure(ctx: AskCtx, hits: string[], programId?: strin
  */
 export function withheldNotice(subject: string): string {
 	return [
-		`\u26a0 Output from \`${subject}\` was withheld because it may contain sensitive information.`,
+		`[Security Policy Notice] Output from \`${subject}\` was withheld because it contains sensitive credentials.`,
 		"",
 		"The tool completed successfully, but the output is unavailable.",
 		"Continue with the available information, or ask the user to allow access if the output is needed.",