one-code-extension 0.4.1 → 0.6.0

package/extensions/permissions/index.ts

@@ -22,14 +22,20 @@ import { join } from "node:path";
 import type { Api, Model } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { type ChildAction, SUBAGENT_ACTIONS_CHANNEL, type SubagentActionsPayload } from "../auto-mode/actions.ts";
-import type { HandBackVerdict } from "../lib/notifications.ts";
+import { guideDocsDirs } from "../lib/guide-docs.ts";
+import { TURN_FAILED_CHANNEL, type TurnFailedEvent } from "../lib/interrupt.ts";
+import { handBackWarning, type HandBackVerdict } from "../lib/notifications.ts";
 import { MODEL_UNUSABLE_CHANNEL, type ModelUnusableEvent } from "../lib/model-unusable.ts";
 
-import { classify, createClassifierState } from "../auto-mode/classifier.ts";
+import { classifierCacheKey, classifierChain, classify, createClassifierState, releaseClassifierResources } from "../auto-mode/classifier.ts";
 import {
 	type AutoModeConfig,
 	autoModeSettingsPaths,
+	listAutoModeEntries,
 	loadAutoModeConfig,
+	oneCodeEnvironmentExtendsDefault,
+	type SourcedAutoModeEntry,
+	updateOneCodeAutoModeList,
 	claudeUserPermissionAllow,
 	loadAutoModeConfigWithDiagnostics,
 	oneCodePermissionAllow,
@@ -37,28 +43,43 @@ import {
 	persistClassifierModel,
 	removeOneCodePermissionAllow,
 } from "../auto-mode/config.ts";
+import { modelPickerComponent, type PickerEntry, pickerSpec, toPickerEntries } from "../lib/model-picker.ts";
+import { findConfigured, modelIdentity } from "../lib/model-policy.ts";
+import { CLASSIFIER_SETTING_CHANGED_CHANNEL } from "../lib/settings-channels.ts";
+import { readSuggestNewerModels } from "../lib/one-code-settings.ts";
 import { auditPermissionAllow, renderProposal, settingsPatch } from "../auto-mode/setup.ts";
 import { draftSetup, gatherFacts } from "../auto-mode/setup-run.ts";
-import { modelPickerComponent, type PickerEntry, pickerSpec, toPickerEntries } from "../auto-mode/model-picker.ts";
 import { DEFAULT_ENVIRONMENT } from "../auto-mode/defaults.ts";
+import { buildRuleset } from "../auto-mode/classifier-prompt.ts";
 import type { TranscriptEntry } from "../auto-mode/transcript.ts";
+import { childHistoryCursor, classifierHistory, CLASSIFIER_TOOL_META, CLASSIFIER_USER_INPUT, type HistoryCursor, messageText, userMessageDigest } from "../auto-mode/history.ts";
 import { appendDecision, type DecisionEntry, decisionEntry } from "../auto-mode/decision-log.ts";
 import { loadProjectInstructions } from "../auto-mode/instructions.ts";
-import { classifierCandidates, describeCandidate, findConfigured } from "../auto-mode/model-select.ts";
-import { modelIdentity } from "../lib/model-policy.ts";
-import { isWithin, resolveForContainment, toAbsolute } from "../auto-mode/paths.ts";
-import { PauseTracker } from "../auto-mode/pause.ts";
-import { checkRecoverability } from "../auto-mode/recoverability.ts";
-import { safetyControlWrite } from "../auto-mode/safety-floor.ts";
+import { describeCandidate } from "../auto-mode/model-select.ts";
+import { conflictingPathArguments, isWithin, resolveForContainment, toAbsolute } from "../auto-mode/paths.ts";
+import { DenialStore, denialInputKey, permissionGrantedMessage } from "../auto-mode/denials.ts";
+import { PauseTracker, unattendedPromptNotice, unattendedPromptTimeoutMs } from "../auto-mode/pause.ts";
+import { safetyControlWrite, safetyFloorBlockText } from "../auto-mode/safety-floor.ts";
 import { isExecutionPrimitivePath, isSensitivePath } from "../auto-mode/sensitive.ts";
-import { analyzeShellCommand, type ShellEvidence } from "../auto-mode/shell-analysis.ts";
-import { isGitStatusCommand, powershellReadOnly } from "./powershell-rules.ts";
+import { analyzeShellCommand } from "../auto-mode/shell-analysis.ts";
+import { bashParserReady, bashParserUnavailable } from "../lib/bash-parser.ts";
+import type { PowerShellParse } from "../lib/powershell-parser.ts";
+import { powerShellParser } from "../lib/shell-spawn.ts";
+import { powershellReadOnly } from "./powershell-rules.ts";
 import { isShellTool } from "./matcher.ts";
-import { gitStatusClean } from "../lib/git.ts";
+import { gitStatusOutput } from "../lib/git.ts";
+import { gitStatusMeta, gitStatusMetaArgs, reachesIgnoredFiles, wantsGitStatusMeta } from "../auto-mode/git-status-meta.ts";
+import { actionResolvedPaths } from "../auto-mode/resolved-paths-meta.ts";
+import { autoMemoryEnabled } from "../lib/auto-memory.ts";
 import { projectMemoryDir } from "../lib/memory.ts";
+import { queueNotice } from "../lib/notices.ts";
+import { canShowCustomUi, rpcReadOnlyText } from "../lib/headless-output.ts";
 import { sessionResultsDir } from "../lib/persisted-output.ts";
-import { sessionScratchpadDir } from "../lib/scratchpad.ts";
-import { REMINDER_CHANNEL } from "../lib/reminders.ts";
+import { privateSessionScratchpadDir } from "../lib/scratchpad.ts";
+import { CONTEXT_ORDER, REMINDER_CHANNEL, type ReminderPayload } from "../lib/reminders.ts";
+import { readState, readStringsState, recordState } from "../lib/ledger/state.ts";
+import { processState } from "../lib/process-state.ts";
+import { type EntryLike, readRecord } from "../lib/ledger/records.ts";
 import {
 	decide,
 	extractSubject,
@@ -70,23 +91,65 @@ import {
 	isPathSubjectTool,
 } from "./matcher.ts";
 import { type SessionGrant, sessionGrant } from "./session-grant.ts";
-import { modeBadge, nextMode, PERMISSION_STATUS_CHANNEL, type PermissionStatus, CYCLE_KEY } from "./modes.ts";
-import { type ChildToolCall, type ChildGateDecision, SUBAGENT_GATE_CHANNEL } from "./subagent-gate.ts";
+import { formatModel, modeBadge, nextMode, PERMISSION_MODE_STATE, PERMISSION_STATUS_CHANNEL, type PermissionStatus, CYCLE_KEY } from "./modes.ts";
+import { intrinsicTier, usesClaudeCodeFastPaths } from "../lib/model-tier.ts";
+import { type ChildToolCall, type ChildGateDecision, sessionPermissionBridge, SUBAGENT_GATE_CHANNEL } from "./subagent-gate.ts";
 import { trackOriginalCommands } from "../lib/original-command.ts";
+import { followWorkCwd } from "../lib/worktree-channel.ts";
 import { MODE_CHANNEL, PLAN_FILE_CHANNEL } from "../lib/plan-mode-channels.ts";
 import { isWritingTool } from "./protected-paths.ts";
 import { denyRuleLines } from "./rule-prose.ts";
-import { loadPermissionSettings, normalizePermissionMode, persistAllowRule, resolveStartupMode } from "./settings.ts";
-import { MODE_ENV, resolvedOrSelf, runtimeProtectedDirs } from "../lib/permission-gate.ts";
-import { CLASSIFIER_SETTING_CHANGED_CHANNEL } from "../lib/settings-channels.ts";
-import { describeProjectAllow, persistProjectAllowApproval, projectAllowApproved } from "./project-trust.ts";
+import {
+	listPermissionRules,
+	listWorkspaceDirectories,
+	loadPermissionSettings,
+	markOutsideReadPromptSeen,
+	normalizePermissionMode,
+	outsideReadPromptSeen,
+	persistBlockOutsideReads,
+	persistAllowRule,
+	persistPermissionRule,
+	removePermissionRule,
+	resolveStartupMode,
+	type RuleSource,
+	persistWorkspaceDirectory,
+	removeWorkspaceDirectory,
+	type SourcedDirectory,
+	type SourcedRule,
+} from "./settings.ts";
+import { MODE_ENV, parsePowerShell, resolvedOrSelf, runtimeProtectedDirs, runtimeSecretPaths } from "../lib/permission-gate.ts";
+import { describeProjectAllow, persistProjectAllowApproval, projectAllowApproved, projectDirectoryConsentEntry, type TrustFiring } from "./project-trust.ts";
+import { parseAddDirFlag, tooBroadForWorkspace, validateWorkspaceDirectory } from "./workspace.ts";
+import { WORKSPACE_CHANNEL, type WorkspaceAnnouncement } from "../lib/workspace-channel.ts";
 import { findProjectRoot } from "../lib/git.ts";
 import { oneCodeProjectSettingsPath, oneCodeSettingsPath } from "../lib/one-code-settings.ts";
 import { recordUsage } from "../lib/usage-bus.ts";
-import { registerLocalCommand } from "../lib/local-command.ts";
+import { announceLocalCommand, registerLocalCommand } from "../lib/local-command.ts";
+import { claudeSourcesOn } from "../lib/config-mode.ts";
+import { claudeJsonPath, tildify, tryRealpath } from "../lib/paths.ts";
+import { openPermissionsPanel, type PermissionsPanelHost } from "./panel/host.ts";
+import { PANEL_FOCUS_CHANNEL, PanelFocus, panelUi } from "../lib/panel-focus.ts";
+import {
+	AUTO_SECTION_LABELS,
+	AUTO_SECTIONS,
+	type AutoEntryRow,
+	type AutoModeView,
+	type Destination,
+	type PanelState,
+	RULE_TABS,
+	type RuleRow,
+	type RuleTab,
+	type WorkspaceDirRow,
+} from "./panel/state.ts";
+import { builtinRuleCounts } from "../auto-mode/rules.ts";
+import { autoModeSystemNote } from "../auto-mode/system-note.ts";
+import { announceArgumentHint } from "../lib/argument-hints.ts";
+import { userDenialText } from "../lib/user-denial.ts";
+import { liveUiCtx } from "../lib/tui-render.ts";
+
+/** Shown when a permission prompt is held behind an open panel (serializePrompt). */
+const PROMPT_WAITS_FOR_PANEL = "A permission request is waiting. Close this panel to answer it.";
 
-const DENIED_BY_USER =
-	"The user doesn't want to proceed with this tool use. The tool use was rejected. Adjust your approach based on the user's feedback instead of retrying the same call.";
 const DENIED_NON_INTERACTIVE =
 	"Permission required but this session is non-interactive, so the user cannot approve the call. It was blocked. Only pre-approved tools can run here; work within those, or ask the user to re-run interactively or with an allow rule / --dangerously-skip-permissions.";
 // Must agree with the plan-mode reminder (plan-mode/reminder.ts): the plan is
@@ -99,6 +162,26 @@ const DENIED_DONT_ASK =
 	"Permission mode is dontAsk: anything that would normally prompt the user is denied instead. Only pre-approved tools can run; work within those, or tell the user which allow rule would unblock you.";
 const DENIED_PROTECTED_PATH =
 	"That path is protected: it configures the user's tooling or this agent itself, so writes to it are never auto-approved and allow rules do not cover them. Achieve the goal another way, or ask the user to make the change.";
+/** A timed resume prompt nobody answered (Claude Code's denial-limit fallback timing). */
+const DENIED_UNANSWERED_RESUME =
+	"Auto mode is paused after repeated blocks, and nobody answered the approval prompt for this call in time, so it was denied to avoid blocking an unattended session. Do not retry it; continue with work that does not need it, or stop and wait for the user.";
+/** Claude Code's refusal when `blockReadsOutsideWorkingDirectories` is set. */
+const DENIED_BLOCKED_OUTSIDE_READ =
+	"That path is outside the working directories; the permissions.blockReadsOutsideWorkingDirectories setting blocks reads outside the working directories. Ask the user to add the directory with /add-dir, or to remove that setting.";
+/** Claude Code's refusal right after the user picks "block" in the first-read prompt. */
+const DENIED_CHOSE_BLOCK_OUTSIDE_READS =
+	"The user chose to block reads outside the working directories (permissions.blockReadsOutsideWorkingDirectories). Ask the user to add the directory with /add-dir, or to remove that setting.";
+/** Claude Code's first outside-read prompt in auto mode (2.1.282): title, question, answers. */
+const OUTSIDE_READ_TITLE = "Read outside the working directories";
+const OUTSIDE_READ_QUESTION = "Allow reads outside the working directories?";
+const OUTSIDE_READ_ANSWERS = {
+	allow: "Yes, keep allowing reads outside the working directories",
+	block: "No, block reads outside the working directories from now on",
+	ask_again: "No, ask again next time",
+} as const;
+/** Claude Code's explainer, without its sandbox sentences (One Code has no sandbox) and with One Code's settings file. */
+const OUTSIDE_READ_EXPLAINER = (settingsFile: string) =>
+	`Auto mode reads outside the working directories without asking. Yes or Block settles this question; Ask again asks on the next outside read. Block: the file tools refuse reads outside the working directories in every project. To undo, remove permissions.blockReadsOutsideWorkingDirectories from ${settingsFile}.`;
 const DENIED_OUTSIDE_WORKING_DIR =
 	"That path is outside the working directory, which needs the user's approval, and permission mode is dontAsk (anything that would prompt is denied instead). Work inside the project, or tell the user which allow rule (e.g. Read(~/dir/**)) would unblock you.";
 // Returned to the MODEL, not the user: auto mode exists to run unattended, so a
@@ -111,9 +194,21 @@ const BLOCKED_BY_TIMEOUT = (reason: string) =>
 	`${reason}\n\nThis was not a judgement that the call is unsafe. Wait a moment and try this action again. ` +
 	"If it keeps failing, continue with other tasks that do not require this action and come back to it later — " +
 	"reading files, searching code, and other read-only operations do not require the classifier and can still be used. " +
-	"Do not try to route around the gate; if this specific action is essential, tell the user what you were about to do so they can re-run interactively or pin a faster classifier with /auto-mode model.";
-const DENIED_SAFETY_FLOOR = (reason: string) =>
-	`Auto mode blocked this call without consulting the classifier: ${reason}. Writes to the gate's own configuration are never auto-approved. Do not retry or route around this; ask the user to make the change themselves.`;
+	"Do not try to route around the gate; if this specific action is essential, tell the user what you were about to do so they can re-run interactively or switch the session model.";
+// The classifier ran but gave no verdict (a provider refusal or error, a
+// truncated reply, no usable model): not a denial, and nothing to route around.
+const BLOCKED_NOT_JUDGED = (reason: string) =>
+	`${reason}\n\nThis was not a judgement that the call is unsafe: the approval classifier gave no verdict, so the call did not run. ` +
+	"Do not rephrase it or route around the gate. Continue with other tasks that do not require this action — " +
+	"reading files, searching code, and other read-only operations do not require the classifier. " +
+	"If this action is essential, tell the user what you were about to do so they can re-run interactively or set another classifier model.";
+/** The text a classifier block hands the model: a timeout, a call never judged, or a denial. */
+const classifierBlockReason = (outcome: { tier?: string; noVerdict?: boolean; reason: string }): string =>
+	outcome.tier === "timeout"
+		? BLOCKED_BY_TIMEOUT(outcome.reason)
+		: outcome.noVerdict
+			? BLOCKED_NOT_JUDGED(outcome.reason)
+			: DENIED_BY_CLASSIFIER(outcome.reason);
 // "Choose a different approach" is exactly what a literal reader does with a
 // second command of the same effect: a tiny-tier model met `Bash(rm:*)` and
 // deleted the file with `python3 -c "import os; os.remove(…)"` 3/3 times
@@ -123,6 +218,11 @@ const DENIED_SAFETY_FLOOR = (reason: string) =>
 const DENIED_BY_RULE = (rule: string) =>
 	`This tool call is denied by the permission rule "${rule}" in the user's settings. The rule is the user's standing decision about this class of action: do not retry it, and do not achieve the same effect another way (a different command, a script, or another tool). Continue with work that does not depend on it, and tell the user what was denied and by which rule.`;
 
+/** The hidden message a /permissions retry starts its turn with. */
+const PERMISSION_RETRY_TYPE = "one-code:permission-retry";
+/** Claude Code's denial notification: the tool, the reason cut to 80 columns, and where to act on it. */
+const deniedNotice = (toolName: string, reason: string): string =>
+	`${toolName} denied by auto mode · ${reason.length > 80 ? `${reason.slice(0, 79)}…` : reason} · /permissions`;
 /** Truncate a subject for a permission prompt — shared by the main gate and the subagent bridge. */
 const previewSubject = (subject: string) => (subject.length > 200 ? `${subject.slice(0, 200)}…` : subject);
 
@@ -140,16 +240,22 @@ const askTitle = (actor: string, preview: string, cause: string, pausedResume: b
 };
 
 /** Map a `decide()` deny result to its model-facing reason — shared by both gate paths. */
-const denyReason = (result: { cause?: string; rule?: { raw?: string } }): string =>
-	result.cause === "plan-mode"
-		? DENIED_PLAN_MODE
-		: result.cause === "protected-path"
-			? DENIED_PROTECTED_PATH
-			: result.cause === "working-dir"
-				? DENIED_OUTSIDE_WORKING_DIR
-				: result.cause === "mode"
-					? DENIED_DONT_ASK
-					: DENIED_BY_RULE(result.rule?.raw ?? "deny");
+const denyReason = (result: { cause?: string; rule?: { raw?: string } }): string => {
+	switch (result.cause) {
+		case "plan-mode":
+			return DENIED_PLAN_MODE;
+		case "protected-path":
+			return DENIED_PROTECTED_PATH;
+		case "blocked-outside-read":
+			return DENIED_BLOCKED_OUTSIDE_READ;
+		case "working-dir":
+			return DENIED_OUTSIDE_WORKING_DIR;
+		case "mode":
+			return DENIED_DONT_ASK;
+		default:
+			return DENIED_BY_RULE(result.rule?.raw ?? "deny");
+	}
+};
 
 /** Ask-prompt option labels — shared by both gate paths. */
 /**
@@ -160,6 +266,24 @@ const denyReason = (result: { cause?: string; rule?: { raw?: string } }): string
  * here, next to the emitter it belongs to.
  */
 const STANDING_REMINDER_MODES: ReadonlySet<PermissionMode> = new Set<PermissionMode>(["plan", "auto"]);
+/** The `one-code:state` key for the directories added to the workspace for this session. */
+const WORKSPACE_DIRS_STATE = "workspace-dirs";
+
+/**
+ * What the user granted "for this session" and what auto mode's loop-breaker
+ * counted. This is process state (lib/process-state.ts): pi re-runs this
+ * factory at a /reload, which is the same conversation and keeps them
+ * (decisions/modes.md), and every other session start clears them. Only the
+ * main session loads this extension (children reach it through the bridge),
+ * so one slot per process is one per conversation.
+ */
+interface SessionGate {
+	/** Rules minted by "Yes, and don't ask again … this session" (session-grant.ts). */
+	allows: PermissionRule[];
+	pause: PauseTracker;
+	/** Classifier denials, and the one-shot grants `/permissions` mints from them. */
+	denials: DenialStore;
+}
 
 const YES = "Yes";
 const NO = "No, tell the agent what to do differently";
@@ -180,6 +304,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			"Permission mode: default (alias: manual) | acceptEdits | plan | auto | bypassPermissions | dontAsk",
 		type: "string",
 	});
+	pi.registerFlag("add-dir", {
+		description: `Additional workspace directories: readable without a prompt, writable in acceptEdits (separate several with "${process.platform === "win32" ? ";" : ":"}")`,
+		type: "string",
+	});
 	pi.registerFlag("dangerously-skip-permissions", {
 		description: "Skip all permission prompts (Claude Code compatible)",
 		type: "boolean",
@@ -197,19 +325,32 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	// an OS sandbox for outside-cwd reads; One Code flips the default directly and
 	// has no sandbox yet (reads outside the working directory are still
 	// classified/asked, never auto-read). The auto-mode safety architecture still
-	// holds — the deterministic safety floor, classifier-verdicts-verified, the
-	// git-recoverability gate, and the classifier tier floor — and with no
+	// holds — the deterministic safety floor, classifier-verdicts-verified and
+	// the classifier tier floor — and with no
 	// classifier model reachable the classifier fails closed. A user or project
 	// `defaultMode` (or `--permission-mode`) still overrides this; `auto` from a
-	// project file is still refused. See docs/decisions/auto-mode.md.
+	// project file is still refused. See working-docs/decisions/auto-mode.md.
 	let mode: PermissionMode = "auto";
+	/** Whether the session model gets Claude Code's fast paths, for the model-switch notice. */
+	let gateFastPaths: boolean | undefined;
+	/** `permissions.blockReadsOutsideWorkingDirectories` from any settings source. */
+	let blockOutsideReads = false;
+	/** The first outside-read prompt was answered on this machine (read once, then kept). */
+	let outsideReadSeen: boolean | undefined;
 	// Worktree-wrapped bash calls publish the model's original command here,
 	// keyed by pi's toolCallId (never read from `event.input` — model-writable).
 	const originalCommands = trackOriginalCommands(pi);
+	// Worktree restores publish before this extension's session_start. Keep
+	// that state until worktree publishes its next enter, exit or branch reset.
+	const workCwd = followWorkCwd(pi.events);
 	/** Whether bypassPermissions is a stop on the cycle — only when the session started with it (Claude Code semantics). */
 	let bypassInCycle = false;
 	/** Whether auto mode is a stop on the cycle — only when a classifier model is reachable. */
 	let autoInCycle = false;
+	/** The mode the branch's latest `one-code:state` entry holds: the mode follows the branch. */
+	let branchMode: PermissionMode | undefined;
+	/** Whether a request went out on this branch: only then was its model told the branch's mode. */
+	let requestOnBranch = false;
 	let deny: PermissionRule[] = [];
 	let ask: PermissionRule[] = [];
 	let allow: PermissionRule[] = [];
@@ -227,12 +368,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	 * Rules minted by "Yes, and don't ask again … this session" (session-grant.ts).
 	 * Never applied in auto mode: there the classifier is the boundary and a
 	 * standing grant would be a bypass of it (PERMISSIONS-REVIEW-2026-09-05 M2).
-	 * Cleared with the session (L1).
+	 * Cleared with the session (L1), kept by a reload (SessionGate).
 	 */
-	const sessionAllows: PermissionRule[] = [];
+	const sessionGate = processState<SessionGate>("permissions:session-gate", () => ({ allows: [], pause: new PauseTracker(), denials: new DenialStore() }));
+	const sessionAllows = sessionGate.allows;
 	const activeSessionAllows = () => (mode === "auto" ? [] : sessionAllows);
 	let unparsableRules: string[] = [];
 	let warnedUnparsable = "";
+	let warnedTooBroad = "";
 	/** Plan mode's one writable file, announced by the plan-mode extension. */
 	let planFilePath: string | undefined;
 	/**
@@ -258,6 +401,69 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	let oneCodeProjectSettingsFile: string | undefined;
 	/** pi's own agent directory, protected like the static list (lib/permission-gate.ts runtimeProtectedDirs). */
 	let protectedDirs: string[] = [];
+	/** The harness's own secret stores, never read unclassified outside the working space (runtimeSecretPaths). */
+	let secretPaths: string[] = [];
+	/** The harness's readable session dirs, resolved at session start; `readableRoots` adds the workspace to them. */
+	let harnessReadableRoots: string[] = [];
+	/** The shipped docs the `one-code-guide` agent reads (lib/guide-docs.ts): readable, never writable. */
+	let docsDirPaths: string[] = [];
+	/**
+	 * Workspace directories (workspace.ts): from settings, where the
+	 * repository's own files apply only once the user trusts them, from
+	 * `--add-dir`, and added for this session in /permissions or with /add-dir.
+	 */
+	let settingsWorkspaceDirs: SourcedDirectory[] = [];
+	let flagWorkspaceDirs: string[] = [];
+	/**
+	 * Added for this session. This is branch state: the /add-dir breadcrumb told
+	 * the branch's model they are in its workspace. Recorded on every change and
+	 * read back, validated again, at every session start and /tree switch.
+	 */
+	const sessionWorkspaceDirs: string[] = [];
+	/** The workspace directories in force, as real paths: what the user and the system prompt see. */
+	let workspacePaths: string[] = [];
+	/** The same directories in containment's comparison form: what decide() and both shell pre-gates see. */
+	let workspaceDirs: string[] = [];
+	const isRepoSource = (source: RuleSource) => source === "project" || source === "project-local";
+	const repoWorkspaceDirs = () => settingsWorkspaceDirs.filter((dir) => isRepoSource(dir.source));
+	/** What the repository-trust consent covers: its allow rules and its workspace directories. */
+	const projectTrustList = () => [...projectAllowRaw, ...repoWorkspaceDirs().map((dir) => projectDirectoryConsentEntry(dir.raw))];
+	const refreshWorkspace = () => {
+		const trusted = settingsWorkspaceDirs.filter((dir) => projectAllowTrusted || !isRepoSource(dir.source)).map((dir) => dir.path);
+		workspacePaths = [...new Set([...trusted, ...flagWorkspaceDirs, ...sessionWorkspaceDirs].map((dir) => tryRealpath(dir) ?? dir))];
+		workspaceDirs = [...new Set(workspacePaths.map(resolvedOrSelf))];
+		readableRoots = [...harnessReadableRoots, ...docsDirPaths, ...workspaceDirs];
+		if (sessionStarted) announceWorkspace();
+	};
+	/** What the system prompt was last told the workspace is (lib/workspace-channel.ts). */
+	let announcedWorkspace: string | undefined;
+	let sessionStarted = false;
+	/**
+	 * The environment block lists the workspace: a change mid-session reaches
+	 * the next epoch's message 1 (a compaction), while inside the epoch the
+	 * /add-dir output already told the model (R3-L4).
+	 */
+	const announceWorkspace = () => {
+		const key = workspacePaths.join("\0");
+		if (key === announcedWorkspace) return;
+		announcedWorkspace = key;
+		pi.events.emit(WORKSPACE_CHANNEL, { dirs: workspacePaths } satisfies WorkspaceAnnouncement);
+	};
+	const recordSessionWorkspace = () => recordState(pi, WORKSPACE_DIRS_STATE, [...sessionWorkspaceDirs]);
+	/**
+	 * Take the branch's session directories. Each is validated again, as a live
+	 * /add-dir is: the stored list says only that the user once added it, so a
+	 * directory that is gone, or one too broad for a workspace, is not applied.
+	 */
+	const restoreSessionWorkspace = (ctx: ExtensionContext) => {
+		const restored: string[] = [];
+		for (const dir of readStringsState(ctx, WORKSPACE_DIRS_STATE)) {
+			const checked = validateWorkspaceDirectory(dir, ctx.cwd, os.homedir(), restored);
+			if ("path" in checked) restored.push(checked.path);
+			else if (ctx.hasUI) ctx.ui.notify(`${dir}, added earlier in this conversation, is no longer in the workspace: ${checked.error}`, "warning");
+		}
+		sessionWorkspaceDirs.splice(0, sessionWorkspaceDirs.length, ...restored);
+	};
 
 	/**
 	 * Mode changes arrive over the event bus too (plan-mode tools), where no ctx
@@ -279,18 +485,22 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			return { classifier: `${classifierState.pinned.provider}/${classifierState.pinned.id}`, pinned: true };
 		}
 		if (!badgeCtx) return { pinned: false };
-		autoConfig ??= loadAutoModeConfig(os.homedir());
-		const chain = classifierCandidates({
-			available: badgeCtx.modelRegistry.getAvailable(),
-			sessionModel: sessionModel ?? badgeCtx.model,
-			configured: autoConfig.classifierModel,
-			configuredSetForContainment: autoConfig.classifierModelSetFor,
-		}).candidates.filter((entry) => !classifierState.rejected.has(`${entry.model.provider}/${entry.model.id}`));
-		const first = chain[0];
+		const first = selectionChain(badgeCtx, sessionModel).candidates.find((entry) => !classifierState.rejected.has(`${entry.model.provider}/${entry.model.id}`));
 		return { classifier: first ? `${first.model.provider}/${first.model.id}` : undefined, pinned: false };
 	};
 
-	const applyBadge = (sessionModel?: Model<Api>) => {
+	/**
+	 * The classifier chain for `sessionModel` (the ctx's by default), cached on
+	 * the classifier state by the same signature the gate uses, so a repaint
+	 * does not rank the catalog again (auto-mode/classifier.ts classifierChain).
+	 */
+	const selectionChain = (ctx: ExtensionContext, sessionModel?: Model<Api>) => {
+		autoConfig ??= loadAutoModeConfig(os.homedir());
+		const registry = ctx.modelRegistry;
+		return classifierChain(classifierState, { available: () => registry.getAvailable(), sessionModel: sessionModel ?? ctx.model, config: autoConfig });
+	};
+
+	const applyBadge = (sessionModel?: Model<Api>, toolCallId?: string) => {
 		// A below-editor widget, not a footer status: Claude Code renders the
 		// mode line directly under the input box, and the workflow status strip
 		// sorts itself below this line by re-setting on the status channel
@@ -301,7 +511,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			[
 				modeBadge(mode, {
 					paused: pauseTracker.isPaused(),
-					classifierModel: classifierState.pinned?.id,
+					classifier: classifierState.pinned?.id,
 					streaming,
 				}),
 			],
@@ -315,6 +525,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			paused: pauseTracker.isPaused(),
 			classifier: display.classifier,
 			pinned: display.pinned,
+			bypassAvailable: bypassInCycle,
+			...(toolCallId ? { toolCallId } : {}),
 		} satisfies PermissionStatus);
 	};
 
@@ -330,19 +542,27 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		mode === "auto" ? (autoConfig ??= loadAutoModeConfig(os.homedir())).classifyAllShell : undefined;
 
 	// Drop the cached config and classifier selection state, then refresh the badge.
-	// Shared by the "set classifier model" and "clear" paths.
-	const resetClassifierChoice = (sessionModel?: Model<Api>) => {
-		autoConfig = undefined; // reloaded lazily, now carrying any new model
+	// A model switch must re-evaluate the capability and context-window requirements.
+	// `"batched"` (session_start, model_select) joins the info line with other
+	// extensions' lifecycle notices (lib/notices.ts).
+	const resetClassifierChoice = (sessionModel?: Model<Api>, announce: boolean | "batched" = true) => {
+		autoConfig = undefined; // reloaded lazily
 		classifierState.pinned = undefined;
 		classifierState.rejected.clear();
+		// A subset of `rejected`: kept alone it would block the retry and blame a
+		// refusal from the previous choice.
+		classifierState.refused.clear();
 		classifierState.notified.clear();
 		classifierState.timeoutStreak = 0;
 		classifierState.chainCache = undefined;
 		applyBadge(sessionModel);
+		if (announce) announceClassifierChoice(sessionModel, { batched: announce === "batched" });
 	};
 	// Keyed by cwd: a worktree-isolated child classifies against ITS checkout's
 	// CLAUDE.md/AGENTS.md, and must not poison the cache the main agent's own
-	// calls (a different cwd) read for the rest of the session.
+	// calls (a different cwd) read for the rest of the session. The main
+	// session's calls read the entered worktree's. Dropped where the agent's own
+	// instructions are read again: a session start and a compaction.
 	const projectInstructionsByCwd = new Map<string, string | undefined>();
 	const instructionsFor = (cwd: string): string | undefined => {
 		if (!projectInstructionsByCwd.has(cwd)) {
@@ -350,7 +570,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 		return projectInstructionsByCwd.get(cwd);
 	};
-	const pauseTracker = new PauseTracker();
+	const pauseTracker = sessionGate.pause;
+	const denials = sessionGate.denials;
 	/**
 	 * Which model the classifier settled on. Held here so the choice is pinned for
 	 * the session rather than re-resolved per call, and so a model that turns out
@@ -384,14 +605,41 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 	};
 
+	/**
+	 * Announce the choice, and any warning about a chosen classifier, before any
+	 * tool needs screening. Warnings first, then ONE info line: pi folds
+	 * back-to-back info notices into a single status line (findings §63), so a
+	 * second one would overwrite the first. `lead` opens that line (the
+	 * confirmation `/auto-mode model` gives); `force` announces outside auto mode;
+	 * `batched` hands the info line to the lifecycle notice owner (lib/notices.ts).
+	 */
+	const announceClassifierChoice = (sessionModel?: Model<Api>, opts: { lead?: string; force?: boolean; batched?: boolean } = {}) => {
+		if ((mode !== "auto" && !opts.force) || !badgeCtx) return;
+		const choice = selectionChain(badgeCtx, sessionModel);
+		const suggestNewer = readSuggestNewerModels(os.homedir());
+		// Keyed by text, the same keys classify() uses, so each shows once.
+		const info: string[] = opts.lead ? [opts.lead] : [];
+		for (const notice of choice.notices) {
+			if (notice.fallbackReason || classifierState.notified.has(notice.text) || (!suggestNewer && notice.choiceWarning === "newer")) continue;
+			classifierState.notified.add(notice.text);
+			if (notice.level === "warning") badgeCtx.ui.notify(notice.text, "warning");
+			else info.push(notice.text);
+		}
+		const first = choice.candidates.find((entry) => !classifierState.rejected.has(`${entry.model.provider}/${entry.model.id}`));
+		const key = first ? `using:${first.model.provider}/${first.model.id}` : undefined;
+		if (first && key && !classifierState.notified.has(key)) {
+			classifierState.notified.add(key);
+			if (choice.fallback) classifierState.notified.add(choice.fallback.text);
+			info.push(choice.fallback?.text ?? `Auto mode will screen calls with ${describeCandidate(first)}.`);
+		}
+		if (info.length === 0) return;
+		if (opts.batched) queueNotice(pi.events, badgeCtx, "info", info.join("\n"));
+		else badgeCtx.ui.notify(info.join("\n"), "info");
+	};
+
 	/** What would be tried, in order, before anything has been pinned. */
 	const describeChain = (ctx: ExtensionContext): string => {
-		const { candidates } = classifierCandidates({
-			available: ctx.modelRegistry.getAvailable(),
-			sessionModel: ctx.model,
-			configured: autoConfig?.classifierModel,
-			configuredSetForContainment: autoConfig?.classifierModelSetFor,
-		});
+		const { candidates } = selectionChain(ctx);
 		return candidates.length > 0 ? candidates.map(describeCandidate).join(" → ") : "(no model available)";
 	};
 
@@ -404,19 +652,17 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 	})();
 
+	// Only a cursor into pi's live branch, not a separate classifier history.
+	// A parent assistant message can contain calls not yet executed when a child
+	// asks for approval; those later calls must not become creation evidence.
+	let currentMainToolCallId: string | undefined;
 	/**
-	 * The classifier's `<transcript>`: user messages and tool inputs, in order,
-	 * results stripped (transcript.ts renders it). The last entry is always the
-	 * action under review — the tool_call handler appends the call being judged.
+	 * The main calls of the turn in flight, in order: pi persists them with their
+	 * assistant message before any runs. Cleared when the turn ends, when every
+	 * one has a result (auto-mode/history.ts childHistoryCursor).
 	 */
-	const transcript: TranscriptEntry[] = [];
-	const capTranscript = () => {
-		// Bound memory on a long unattended run; the renderer also caps by chars,
-		// and intent verification reads userMessages, not this, so trimming old
-		// lines here never weakens that check. Trim down to a lower watermark so the
-		// O(n) splice is amortized over the next ~100 pushes on the tool_call path.
-		if (transcript.length > 500) transcript.splice(0, transcript.length - 400);
-	};
+	let inFlightMainCalls: string[] = [];
+	const childCursor = (startedBy: string | undefined) => childHistoryCursor(startedBy, inFlightMainCalls, currentMainToolCallId);
 
 	/**
 	 * Record a rule denial as its own `denied` transcript line, so the classifier
@@ -426,11 +672,10 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	 * user decision about a class of action, and each already has its own
 	 * model-facing text.
 	 */
-	const recordRuleDenial = (result: { cause?: string; rule?: { raw?: string } }, toolName: string, subject: string) => {
+	const recordRuleDenial = (result: { cause?: string; rule?: { raw?: string } }, toolCallId: string, subject: string) => {
 		if (mode !== "auto") return;
 		if (result.cause === "plan-mode" || result.cause === "protected-path" || result.cause === "working-dir" || result.cause === "mode") return;
-		transcript.push({ kind: "denied", tool: normalizeToolName(toolName), subject, rule: result.rule?.raw ?? "deny" });
-		capTranscript();
+		pi.appendEntry(CLASSIFIER_TOOL_META, { toolCallId, deniedSubject: subject, rule: result.rule?.raw ?? "deny" });
 	};
 
 	/**
@@ -453,37 +698,37 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		return { ...autoConfig, hardDeny: [...(autoConfig?.hardDeny ?? []), ...renderedDeny.lines] };
 	};
 
-	/**
-	 * The user's own messages, and only those — the classifier's "explicit intent"
-	 * tier must not be reachable from file contents or command output, or a prompt
-	 * injection could manufacture its own authorisation. pi's `input` event fires
-	 * for real user input, which is exactly that boundary. Carried in FULL (not a
-	 * rolling window): in a long unattended run the authorizing setup message must
-	 * still clear a later action (decision 2 in docs/decisions/auto-mode.md).
-	 */
-	const userMessages: string[] = [];
+	// Persist input provenance beside the user message, not another transcript.
+	// pi stores extension-generated user turns in the same role; without this
+	// marker a resume could promote a skill body into the user's own intent.
+	const pendingInputs: { text: string; user: boolean }[] = [];
 	pi.on("input", (event) => {
-		// Only what the user typed. A plugin command or skill body arrives as
-		// source "extension" and must not become "the user's own words" that an
-		// intent quote can cite (review P12; hooks make the same distinction).
-		if (event.source === "extension") return;
 		const text = event.text?.trim();
 		if (!text) return;
-		userMessages.push(text);
-		if (userMessages.length > 1000) userMessages.shift();
-		transcript.push({ kind: "user", text });
-		capTranscript();
+		pendingInputs.push({ text, user: event.source !== "extension" });
+		// Handled commands never produce a user message. Bound only this pending
+		// association queue; the active conversation itself is never truncated.
+		if (pendingInputs.length > 256) pendingInputs.shift();
+	});
+	pi.on("message_end", (event) => {
+		if (event.message.role !== "user") return;
+		const text = messageText(event.message.content);
+		const at = pendingInputs.findIndex((input) => text.trim() === input.text || text.trim().startsWith(`${input.text}\n`));
+		const input = at >= 0 ? pendingInputs.splice(at, 1)[0] : undefined;
+		// A digest identifies the message; the text is already in the session.
+		pi.appendEntry(CLASSIFIER_USER_INPUT, { timestamp: event.message.timestamp, messageDigest: userMessageDigest(text), userText: input?.user ? input.text : null });
 	});
 
 	/**
 	 * Run the deterministic pre-gate, then the classifier. The pre-gate may only
 	 * ever conclude "safe" (see auto-mode/shell-analysis.ts); when it does, the
-	 * classifier call is skipped entirely, which is what keeps read-heavy work
-	 * from paying classifier latency on every call.
+	 * classifier call is skipped entirely. A read-only command never gets here:
+	 * `decide()` allows it as the shell tools' own check, in every mode. What the
+	 * pre-gate still clears here is a safe line that writes inside the project
+	 * (a redirect).
 	 */
 	const runClassifier = async (
 		toolName: string,
-		input: Record<string, unknown>,
 		subject: string,
 		ctx: ExtensionContext,
 		/**
@@ -500,7 +745,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		 * aborted). All default to the parent's own values, so the main path is
 		 * unchanged.
 		 */
-		opts?: { cwd?: string; appendEntry?: TranscriptEntry; signal?: AbortSignal },
+		opts?: { cwd?: string; appendEntry?: TranscriptEntry; toolCallId?: string; history?: HistoryCursor; signal?: AbortSignal; powershellParse?: PowerShellParse },
 	) => {
 		const cwd = opts?.cwd ?? ctx.cwd;
 		autoConfig ??= loadAutoModeConfig(os.homedir());
@@ -508,37 +753,17 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		const home = os.homedir();
 		const allow = () => ({ decision: "allow" as const, reason: "", tier: undefined });
 
-		let evidence: ShellEvidence | undefined;
 		if (normalizeToolName(toolName) === "bash" && subject) {
-			evidence = analyzeShellCommand({ command: subject, cwd, home, protectedDirs, readableRoots });
-			if (evidence.verdict === "safe") {
+			if (analyzeShellCommand({ command: subject, cwd, home, protectedDirs, readableRoots }).verdict === "safe") {
 				logDecision(ctx, { tool: toolName, subject, outcome: "allow", source: "pre-gate" });
 				return allow();
 			}
-			// The command's only risk is an in-project delete or whole-tree reset.
-			// Auto mode trusts the project as the agent's sandbox — but, unlike Claude
-			// Code, only when git can put the bytes back. A recoverable destruction
-			// runs unattended with no classifier call; an unrecoverable one (untracked,
-			// dirty, not a repo) still reaches the classifier.
-			if (containmentEligible && evidence.containedNonNetwork) {
-				const targets = evidence.writes.filter((w) => !w.outsideCwd && w.resolved).map((w) => w.resolved as string);
-				// The same cwd the evidence resolved against — for a worktree-isolated
-				// child that is the worktree, not the parent checkout (ctx.cwd).
-				const rec = checkRecoverability(cwd, { targets, wholeTree: evidence.wholeTree });
-				if (rec.verdict === "recoverable") {
-					logDecision(ctx, { tool: toolName, subject, outcome: "allow", source: "pre-gate", reason: rec.reason });
-					return allow();
-				}
-				evidence.notes.push(`git recoverability: ${rec.reason}`);
-			}
 		} else if (normalizeToolName(toolName) === "powershell" && subject) {
-			// PowerShell has no pre-gate in v1 beyond Claude Code's read-only cmdlet
-			// allowlist (powershell-rules.ts): a read-only line runs unclassified,
-			// everything else — every write, delete or unknown executable — goes to
-			// the classifier. No containment fast path either: the recoverability
-			// judge understands bash deletes, not `Remove-Item`, so PowerShell
-			// destruction is always classified (docs/decisions/windows.md).
-			if (powershellReadOnly(subject, { cwd, home, readableRoots }).readOnly) {
+			// A line PowerShell's own parse proves read-only runs unclassified;
+			// contained edits were cleared in decide() where the model's tier allows
+			// them, and everything else goes to the classifier
+			// (decisions/windows.md "The PowerShell pre-gate reads PowerShell's own parse").
+			if (powershellReadOnly({ parse: opts?.powershellParse, cwd, home, readableRoots }).readOnly) {
 				logDecision(ctx, { tool: toolName, subject, outcome: "allow", source: "pre-gate" });
 				return allow();
 			}
@@ -546,16 +771,16 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			// A write/edit whose target is inside the project and not a credential
 			// path is ordinary sandbox work — Claude Code auto-approves it, and so do
 			// we (protected paths never reach here: decide() routes them with
-			// containmentEligible=false). Overwrites are not recoverability-gated the
-			// way deletes are: the file still exists, and edit-then-iterate is the
-			// core of unattended coding autonomy. Execution-primitive paths (build
+			// containmentEligible=false). Edit-then-iterate is the core of
+			// unattended coding autonomy. Execution-primitive paths (build
 			// wrappers, CI workflows, editor auto-run config) are excluded exactly as
 			// the bash pre-gate excludes them — being in-project does not make a file
 			// that runs later without further approval safe to write unclassified.
-			const raw = input.file_path ?? input.path;
-			const target = typeof raw === "string" ? raw : undefined;
-			if (target) {
-				const absolute = toAbsolute(cwd, target, home);
+			// `subject` is pathArgument's pick, the field every other gate judged;
+			// picking a field again here once approved a different file from the
+			// one written (AUTO-MODE-SECURITY-REVIEW-2026-09-24 H1).
+			if (subject) {
+				const absolute = toAbsolute(cwd, subject, home);
 				const resolved = resolveForContainment(absolute);
 				const root = resolveForContainment(cwd) ?? cwd;
 				if (resolved && isWithin(root, resolved) && !isSensitivePath(absolute) && !isExecutionPrimitivePath(absolute)) {
@@ -565,14 +790,26 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			}
 		}
 
-		// The current call was pushed onto `transcript` by the tool_call handler, so
-		// it is already the last entry — the action under review. `evidence` is used
-		// only for the containment fast-path above; CC's payload carries no separate
-		// static-analysis block, so it is not sent to the classifier.
+		// Project pi's active context on every call. Compaction, resume and /tree
+		// therefore change classifier context at the same boundary as the agent's.
+		const { transcript: history, userMessages } = classifierHistory(ctx.sessionManager.getBranch(), opts?.toolCallId
+			? { beforeToolCallId: opts.toolCallId }
+			: (opts?.history ?? { throughToolCallId: currentMainToolCallId }));
+		const action = opts?.appendEntry;
+		const shell = normalizeToolName(toolName) === "powershell" ? "powershell" : isShellTool(normalizeToolName(toolName)) || normalizeToolName(toolName) === "monitor" ? "bash" : undefined;
+		if (shell && subject && wantsGitStatusMeta(shell, subject)) {
+			const porcelain = await gitStatusOutput(cwd, gitStatusMetaArgs(reachesIgnoredFiles(shell, subject)));
+			const gitStatus = porcelain === undefined ? undefined : gitStatusMeta(porcelain);
+			if (gitStatus) {
+				history.push({ kind: "meta", gitStatus });
+				if (opts?.toolCallId) pi.appendEntry(CLASSIFIER_TOOL_META, { toolCallId: opts.toolCallId, gitStatus });
+			}
+		}
+		const resolvedPaths = actionResolvedPaths(normalizeToolName(toolName), subject, opts?.powershellParse, { cwd, home, roots: [cwd, ...workspaceDirs] });
 		const verdict = await classify(
 			{
 				toolName,
-				transcript: opts?.appendEntry ? [...transcript, opts.appendEntry] : [...transcript],
+				transcript: [...history, ...(resolvedPaths ? [{ kind: "resolved-paths" as const, resolvedPaths }] : []), ...(action ? [action] : [])],
 				userMessages: [...userMessages],
 				claudeMd: instructionsFor(cwd),
 				username: classifierUsername,
@@ -587,6 +824,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				config: autoConfig,
 				signal: opts?.signal ?? ctx.signal,
 				state: classifierState,
+				cacheKey: classifierCacheKey(ctx.sessionManager.getSessionId()),
 				onUsage: onClassifierUsage,
 				onModelUnusable: onClassifierModelUnusable,
 				onNotice: (message, level) => {
@@ -607,56 +845,79 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			ruleId: verdict.ruleId,
 			reason: verdict.reason || undefined,
 			raw: verdict.raw,
+			transcriptTooLong: verdict.transcriptTooLong,
 			model: classifierState.pinned ? `${classifierState.pinned.provider}/${classifierState.pinned.id}` : undefined,
 		});
 		return verdict;
 	};
 
-	const setMode = (next: PermissionMode) => {
+	/** `startup`: the session opens in this mode, so there is no switch to announce, only the mode's standing block. */
+	const setMode = (next: PermissionMode, startup = false, toolCallId?: string) => {
+		const changed = mode !== next;
+		/** The mode the branch recorded before this switch; its model was told it once a request went out. */
+		const told = branchMode;
 		mode = next;
 		process.env[MODE_ENV] = next;
-		// The standing block of the mode being left goes first, BEFORE the status
+		// Close the standing block of the mode being left BEFORE the status
 		// broadcast in applyBadge: the plan-mode extension owns the shared
 		// "permission-mode" key while planning (it knows the plan file) and
 		// re-installs its block synchronously from that broadcast when the mode
 		// becomes plan — removing the key afterwards would undo that re-add and
 		// leave a turn entered mid-stream with no plan reminder until the next
 		// prompt (STEERING-REVIEW-2026-09-05 M3). Auto installs its own block below.
-		if (mode !== "auto") pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "permission-mode" });
-		applyBadge();
+		if (mode !== "auto" && !(mode === "plan" && (startup ? branchMode === "plan" : !changed))) {
+			pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "permission-mode" });
+		}
+		// The mode follows the branch: recorded on every change, so a resume, a
+		// fork, /reload or a /tree switch starts from it (decisions/modes.md).
+		if (mode !== branchMode) {
+			recordState(pi, PERMISSION_MODE_STATE, mode);
+			branchMode = mode;
+		}
+		applyBadge(undefined, toolCallId);
 		// Every switch is announced once on the tail of the next request (the next
 		// tool result mid-turn, the prompt between turns), so the model learns of
 		// the change where it reads next. The standing block carries the rules
-		// but rides the turn's user message, behind the model's own actions — so
-		// for plan mode the announcement, the one thing guaranteed to land
-		// mid-turn, also names the plan file (published by plan-mode's refresh
-		// inside the applyBadge broadcast above).
+		// from that point forward; the announcement also names the plan file
+		// (published by plan-mode's refresh inside the applyBadge broadcast above).
 		const planNote =
 			mode === "plan"
 				? planFilePath
 					? ` Only read-only tools are available now, plus one writable file: your plan file at ${planFilePath}. Build the plan there, then call exit_plan_mode.`
 					: " Only read-only tools are available now, plus the plan file named in the plan-mode reminder."
 				: "";
-		pi.events.emit(REMINDER_CHANNEL, {
-			text: `The user's permission mode is now "${mode}".${planNote}`,
-			key: "permission-mode-change",
-		});
+		// Not at startup: "is now" beside the mode's own standing block read as a
+		// duplicate to both GPT-6 models in the 2026-10-04 self-test, and Claude
+		// Code announces only a switch. A startup that leaves the mode the branch
+		// recorded (a flag, a stored bypass that needs its flag again) is one.
+		if (!startup || (told !== undefined && told !== mode && requestOnBranch)) {
+			pi.events.emit(REMINDER_CHANNEL, {
+				text: `The user's permission mode is now "${mode}".${planNote}`,
+				key: "permission-mode-change",
+				toolCallId,
+			});
+		}
 		if (mode === "auto") {
 			pi.events.emit(REMINDER_CHANNEL, {
 				text:
 					"Auto mode is active: your tool calls run without per-action prompts, but each one is screened by an approval classifier that blocks anything irreversible, destructive, or aimed outside this environment. " +
-					"Work normally — do not narrate the classifier or try to phrase calls to get past it. If a call is blocked, take the block at face value: explain what you were trying to do and let the user decide, rather than retrying it a different way. " +
+					"Work normally — do not narrate the classifier or try to phrase calls to get past it. If a call is blocked, take the block at face value: do not retry it, and do not reach the same result another way. Continue with work that does not depend on it, or explain what you were trying to do and let the user decide. " +
 					"Attempting to weaken this gate (editing permission settings, changing the mode, or routing work around it) is itself blocked.",
-				scope: "every-turn",
 				key: "permission-mode",
 				// Session state: rides every user message since auto mode came on, so
 				// the cached prefix holds turn to turn (lib/reminders.ts).
 				placement: "sticky-append",
+				toolCallId,
 			});
 		}
 	};
 
-	const reloadSettings = (ctx: ExtensionContext) => {
+	/**
+	 * Re-read the permission rules only: what a rule edit in /permissions needs.
+	 * The mode, a declined project-rule prompt and auto mode's cached config are
+	 * left alone (reloadSettings resets those for a new session).
+	 */
+	const reloadRules = (ctx: ExtensionContext) => {
 		const settings = loadPermissionSettings(ctx.cwd, os.homedir());
 		const parsed = {
 			deny: parseRulesReport(settings.deny),
@@ -669,10 +930,24 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		allow = parsed.allow.rules;
 		projectAllow = parsed.projectAllow.rules;
 		projectAllowRaw = settings.projectAllow;
+		blockOutsideReads = settings.blockReadsOutsideWorkingDirectories === true;
 		// A linked worktree shares its main checkout's consent (findProjectRoot).
 		projectRoot = findProjectRoot(ctx.cwd) ?? ctx.cwd;
-		projectAllowTrusted = projectAllowApproved(projectRoot, projectAllowRaw);
-		projectAllowDeclined = false;
+		// A settings file is held to what /add-dir and --add-dir refuse: `/` or `~`
+		// there would make almost the whole disk working space.
+		const tooBroad: string[] = [];
+		settingsWorkspaceDirs = listWorkspaceDirectories(ctx.cwd, os.homedir()).filter((dir) => {
+			const refusal = tooBroadForWorkspace(tryRealpath(dir.path) ?? dir.path, os.homedir());
+			if (refusal) tooBroad.push(`${dir.raw} in ${tildify(dir.settingsPath, os.homedir())}: ${refusal}`);
+			return !refusal;
+		});
+		const tooBroadSignature = tooBroad.join("\n");
+		if (tooBroad.length > 0 && ctx.hasUI && tooBroadSignature !== warnedTooBroad) {
+			warnedTooBroad = tooBroadSignature;
+			ctx.ui.notify(`Ignored permissions.additionalDirectories entries: ${tooBroad.join("; ")}`, "warning");
+		}
+		projectAllowTrusted = projectAllowApproved(projectRoot, projectTrustList());
+		refreshWorkspace();
 		// A rule that fails to parse is a rule the user believes is in force and is
 		// not. Say so (once per distinct set) and list them in /permissions.
 		unparsableRules = [...parsed.deny.dropped, ...parsed.ask.dropped, ...parsed.allow.dropped, ...parsed.projectAllow.dropped];
@@ -684,6 +959,16 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				"warning",
 			);
 		}
+		return settings;
+	};
+
+	/**
+	 * `launching`: the process is starting (reason "startup"), when its flags
+	 * pick the mode. `carried`: the mode a /clear or /new carries onto its empty branch.
+	 */
+	const reloadSettings = (ctx: ExtensionContext, launching: boolean, carried: PermissionMode | undefined) => {
+		const settings = reloadRules(ctx);
+		projectAllowDeclined = false;
 		// Dropped so edited autoMode rules and instruction files are picked up on
 		// reload rather than staying cached for the life of the process.
 		autoConfig = undefined;
@@ -692,68 +977,184 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// Claude Code's resolution order (flags, then settings' defaultMode), with
 		// bypassPermissions refused wherever a settings source disabled it — before
 		// 2026-09-05 (H3) that policy was silently not in force here.
-		const startup = resolveStartupMode(
-			[
-				pi.getFlag("dangerously-skip-permissions") === true ? "bypassPermissions" : undefined,
-				normalizePermissionMode(pi.getFlag("permission-mode")),
-				settings.defaultMode,
-			],
-			settings,
-		);
+		// The mode follows the branch: at launch the flags win over it, and after
+		// that (/reload, /resume, /fork, /clear in the same process) the branch's
+		// own mode wins over the launch flags, so a switch the user made is kept.
+		// A stored bypassPermissions is never restored by itself: it needs its flag.
+		const bypassFlag = pi.getFlag("dangerously-skip-permissions") === true ? ("bypassPermissions" as const) : undefined;
+		const modeFlag = normalizePermissionMode(pi.getFlag("permission-mode"));
+		const fromBranch = branchMode ?? carried;
+		const restored = fromBranch === "bypassPermissions" ? undefined : fromBranch;
+		const startup = resolveStartupMode(launching ? [bypassFlag, modeFlag, restored, settings.defaultMode] : [restored, bypassFlag, modeFlag, settings.defaultMode], settings);
 		if (startup.mode) mode = startup.mode;
 		if (startup.bypassRefused && ctx.hasUI) ctx.ui.notify("Bypass permissions mode was disabled by settings", "warning");
 		bypassInCycle = mode === "bypassPermissions";
 		// Auto mode needs a model to run its classifier on; with none reachable it
 		// would block every call, so it stays out of the cycle instead — the same
 		// thing Claude Code does when auto mode's requirements aren't met. The
-		// candidate chain ends in an unconditional fallback to any available model
-		// (model-select.ts), so "a model exists" is exactly "a classifier exists".
+		// classifier stays on this session's provider, falling back to the session
+		// model when no capable window-compatible alternative is available.
 		autoInCycle = ctx.modelRegistry.getAvailable().length > 0;
 		// A mode that owns a standing reminder must be announced when the session
 		// STARTS in it, not only when the user switches into it. setMode is the
 		// only emitter of the block; until 2026-09-05 startup called it for plan
 		// alone, so `--permission-mode auto` / `defaultMode: "auto"` sessions ran
 		// with no auto-mode reminder at all (STEERING-REVIEW-2026-09-05 H2).
-		if (STANDING_REMINDER_MODES.has(mode)) setMode(mode);
+		if (STANDING_REMINDER_MODES.has(mode)) setMode(mode, true);
 		process.env[MODE_ENV] = mode;
 	};
 
+	// Claude Code's auto-mode note joins the mid-conversation system message
+	// when the conversation opens in auto mode (auto-mode/system-note.ts). It is
+	// live state, rendered only by a request that opens an epoch, so message 1
+	// never changes inside one; a compaction or a model switch decides it again.
+	pi.on("turn_start", (_event, ctx) => {
+		const note = mode === "auto" && ctx.model ? autoModeSystemNote(ctx.model) : undefined;
+		if (!note) {
+			pi.events.emit(REMINDER_CHANNEL, { remove: true, key: "auto-mode-note" });
+			return;
+		}
+		pi.events.emit(REMINDER_CHANNEL, {
+			text: note,
+			key: "auto-mode-note",
+			placement: "first-prepend",
+			order: CONTEXT_ORDER.autoModeNote,
+			systemRoleOnly: true,
+		} satisfies ReminderPayload);
+	});
+
+	// A turn's calls are all persisted before the first runs, and all have a
+	// result by turn_end (an aborted run ends the agent instead).
+	pi.on("turn_start", () => {
+		inFlightMainCalls = [];
+	});
+	pi.on("turn_end", () => {
+		inFlightMainCalls = [];
+	});
+	pi.on("agent_end", () => {
+		inFlightMainCalls = [];
+	});
+
 	pi.on("session_start", (event, ctx) => {
+		childPermissionSession?.abort();
+		childPermissionSession = new AbortController();
 		badgeCtx = ctx;
 		lastReviewCtx = ctx;
 		sessionEpoch++;
+		panels.reset();
+		gateFastPaths = usesClaudeCodeFastPaths(ctx.model);
+		// Not awaited: the grammar loads in a few milliseconds, and the gate
+		// awaits it per call. Only a failed load is worth telling the user about.
+		void bashParserReady().then(() => {
+			const why = bashParserUnavailable();
+			if (why && ctx.hasUI) ctx.ui.notify(`One Code: ${why}. Every bash command will be escalated or prompted.`, "error");
+		});
 		// A new session (`/clear`, `/resume`, a fork) starts with a clean gate: the
 		// previous conversation's user messages are not intent evidence for this
-		// one, its "don't ask again" grants and its pause state do not carry over
-		// (PERMISSIONS-REVIEW-2026-09-05 L1). A reload keeps them — same conversation.
+		// one, and its "don't ask again" grants, approved denials and pause state
+		// do not carry over (PERMISSIONS-REVIEW-2026-09-05 L1). A reload keeps
+		// them, the same conversation: they are process state (SessionGate),
+		// which the factory pi re-runs there does not reset.
 		if (event.reason !== "reload") {
 			sessionAllows.length = 0;
-			transcript.length = 0;
-			userMessages.length = 0;
+			currentMainToolCallId = undefined;
+			inFlightMainCalls = [];
+			pendingInputs.length = 0;
 			pauseTracker.reset();
+			denials.reset();
 		}
-		memoryDirPath = projectMemoryDir(ctx.cwd);
-		scratchpadDirPath = sessionScratchpadDir(ctx.cwd, ctx.sessionManager.getSessionId());
+		// The directories this branch was told it added follow it, so a reload, a
+		// resume and a fork keep them and a /clear starts without.
+		restoreSessionWorkspace(ctx);
+		// With auto-memory off the folder is nobody's working space: no grant.
+		memoryDirPath = autoMemoryEnabled(ctx.cwd) ? projectMemoryDir(ctx.cwd) : undefined;
+		// Working space only when it is private to this user: another local user
+		// who owns the directory on a shared /tmp could swap what is written there.
+		scratchpadDirPath = privateSessionScratchpadDir(ctx.cwd, ctx.sessionManager.getSessionId());
 		// Resolved like the subjects compared against it (a symlinked parent, macOS /var).
 		resultsDirPath = resolvedOrSelf(sessionResultsDir(ctx));
 		sessionDirPath = resolvedOrSelf(ctx.sessionManager.getSessionDir());
-		readableRoots = [memoryDirPath, scratchpadDirPath, resultsDirPath, sessionDirPath].filter((d): d is string => !!d).map(resolvedOrSelf);
+		harnessReadableRoots = [memoryDirPath, scratchpadDirPath, resultsDirPath, sessionDirPath].filter((d): d is string => !!d).map(resolvedOrSelf);
+		docsDirPaths = guideDocsDirs().map(resolvedOrSelf);
+		// `--add-dir`: each directory is validated like one added in the panel.
+		flagWorkspaceDirs = [];
+		for (const entry of parseAddDirFlag(pi.getFlag("add-dir") as string | undefined)) {
+			const checked = validateWorkspaceDirectory(entry, ctx.cwd, os.homedir(), flagWorkspaceDirs);
+			if ("path" in checked) flagWorkspaceDirs.push(checked.path);
+			else if (ctx.hasUI) ctx.ui.notify(`--add-dir ${entry}: ${checked.error}`, "warning");
+		}
 		resolvedCwd = resolveForContainment(ctx.cwd);
 		oneCodeProjectSettingsFile = oneCodeProjectSettingsPath(ctx.cwd, os.homedir());
 		protectedDirs = runtimeProtectedDirs();
-		reloadSettings(ctx);
-		applyBadge();
-		// Publish the subagent permission bridge (see subagent-gate.ts). The closure
-		// reads live parent state on each call, so emitting once at session start is
-		// enough; subagents captures it and threads it into child sessions.
-		pi.events.emit(SUBAGENT_GATE_CHANNEL, { decide: evaluateChildToolCall });
+		secretPaths = runtimeSecretPaths(os.homedir());
+		branchMode = normalizePermissionMode(readState(ctx, PERMISSION_MODE_STATE));
+		requestOnBranch = (ctx.sessionManager.getBranch() as EntryLike[]).some((entry) => readRecord(entry)?.kind === "request");
+		// Claude Code keeps the mode across /clear: the new branch starts from the
+		// mode this process last published (MODE_ENV), and records it.
+		const carried = event.reason === "new" && !branchMode ? normalizePermissionMode(process.env[MODE_ENV]) : undefined;
+		reloadSettings(ctx, event.reason === "startup", carried);
+		if (!STANDING_REMINDER_MODES.has(mode)) setMode(mode, true);
+		// The system prompt lists the workspace as the session starts (lib/workspace-channel.ts).
+		sessionStarted = true;
+		announcedWorkspace = undefined;
+		announceWorkspace();
+		resetClassifierChoice(ctx.model, "batched");
+		// The bridge reads live mode/rules, but belongs to this parent session only.
+		pi.events.emit(SUBAGENT_GATE_CHANNEL, { decide: sessionPermissionBridge(evaluateChildToolCall, childPermissionSession.signal) });
+	});
+
+	// A /tree switch selects a branch whose model was told that branch's mode:
+	// take it, as a resume would, without announcing a switch. A stored
+	// bypassPermissions is never taken.
+	pi.on("session_tree", (_event, ctx) => {
+		// The selected branch's model was told its own session directories.
+		restoreSessionWorkspace(ctx);
+		refreshWorkspace();
+		const onBranch = normalizePermissionMode(readState(ctx, PERMISSION_MODE_STATE));
+		if (!onBranch || onBranch === "bypassPermissions" || onBranch === mode) return;
+		branchMode = onBranch;
+		setMode(onBranch, true);
+	});
+
+	// claude-context re-reads the instruction files at a compaction, and the
+	// summary's epoch renders them, so the classifier judges against the same
+	// set from then on. Unchanged files give the same bytes, so its cache holds;
+	// an edit costs one classifier cache write at this boundary.
+	pi.on("session_compact", () => {
+		projectInstructionsByCwd.clear();
+	});
+
+	// The published bridge stays: aborted, it denies every call a retained child
+	// makes, while a parent without this extension keeps the local gate.
+	pi.on("session_shutdown", (_event, ctx) => {
+		childPermissionSession?.abort();
+		lastReviewCtx = undefined;
+		sessionEpoch++;
+		// Children screen through this session's key too (evaluateChildToolCall
+		// uses lastReviewCtx), so one release covers their calls.
+		releaseClassifierResources(ctx.sessionManager.getSessionId());
 	});
 
 	pi.on("model_select", (event, ctx) => {
 		badgeCtx = ctx;
 		lastReviewCtx = ctx;
 		autoInCycle = ctx.modelRegistry.getAvailable().length > 0;
-		resetClassifierChoice(event.model);
+		resetClassifierChoice(event.model, "batched");
+		// The gate reads the model's tier on every call, so a switch takes effect
+		// on the next one; a switch across the workhorse/cheap line says so.
+		const fastPaths = usesClaudeCodeFastPaths(event.model);
+		if (gateFastPaths !== undefined && fastPaths !== gateFastPaths && event.model) {
+			const name = `${formatModel(event.model.provider, event.model.id)} (${intrinsicTier(event.model)} tier)`;
+			queueNotice(
+				pi.events,
+				ctx,
+				"info",
+				fastPaths
+					? `${name}: permissions now follow Claude Code's fast paths.`
+					: `${name}: permissions now use One Code's stricter checks, so more calls prompt or go to the auto-mode classifier.`,
+			);
+		}
+		gateFastPaths = fastPaths;
 	});
 
 	// The badge carries "· esc to interrupt" only while the model works (CC's
@@ -763,6 +1164,9 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		lastReviewCtx = ctx;
 		streaming = true;
 		applyBadge();
+		// Start the PowerShell parser before the first PowerShell call needs it,
+		// never awaited: its first start can take seconds on Windows.
+		if (mode !== "bypassPermissions" && pi.getActiveTools().includes("powershell")) void powerShellParser()?.parse("");
 	});
 	// Settle, not agent_end: `agent_end` fires per run, so flipping there made
 	// the badge's "· esc to interrupt" suffix flicker off and back on across a
@@ -778,8 +1182,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	// `/auto-mode model` does after its own write, so the next call re-plans.
 	pi.events.on(CLASSIFIER_SETTING_CHANGED_CHANNEL, () => resetClassifierChoice(badgeCtx?.model));
 	pi.events.on(MODE_CHANNEL, (data) => {
-		const requested = normalizePermissionMode((data as { mode?: unknown })?.mode);
-		if (requested) setMode(requested);
+		const request = data as { mode?: unknown; toolCallId?: unknown } | undefined;
+		const requested = normalizePermissionMode(request?.mode);
+		if (!requested) return;
+		// Another extension asks (plan mode's exit restores the mode it came from,
+		// read from the branch). A stored value never grants a permission by
+		// itself: bypass only where this session has it, else the default mode.
+		const allowed = requested === "bypassPermissions" && !bypassInCycle ? "default" : requested;
+		setMode(allowed, false, typeof request?.toolCallId === "string" ? request.toolCallId : undefined);
 	});
 
 	// The plan-mode extension announces the plan file on PLAN_FILE_CHANNEL;
@@ -794,7 +1204,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	// that terminals don't already own (ctrl+m *is* Enter's byte, alt needs
 	// option-as-meta configured on macOS) — except on Windows and WSL, where
 	// pi binds ctrl+q itself and the key is alt+m (lib/keys.ts) — see
-	// docs/decisions.md.
+	// working-docs/decisions.md.
 	pi.registerShortcut(CYCLE_KEY, {
 		description: "Cycle permission mode",
 		handler: (ctx) => {
@@ -809,13 +1219,29 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	let lastReviewCtx: ExtensionContext | undefined;
 	/** Bumped per session_start: an async review that finishes after a /clear must not post into the new session. */
 	let sessionEpoch = 0;
+	let childPermissionSession: AbortController | undefined;
 
 	// Serialize interactive prompts: a background/resident subagent can hit an "ask"
 	// while the main turn (or another child) is already awaiting one, and driving
 	// ctx.ui.select concurrently on one terminal is unverified. This chains them.
+	// A prompt also waits while a panel holds the keyboard (/permissions, the
+	// agent view, a picker): pi would put the prompt in the panel's place, the
+	// panel would not come back, and an Enter meant for the panel would answer
+	// the prompt. Claude Code holds its permission dialog the same way.
 	let promptChain: Promise<unknown> = Promise.resolve();
-	const serializePrompt = <T>(fn: () => Promise<T>): Promise<T> => {
-		const run = promptChain.then(fn, fn);
+	/** Calls the user rejected without a reason: the turn stops once pi records their result. */
+	const abortAfterResult = new Set<string>();
+	const panels = new PanelFocus();
+	pi.events.on(PANEL_FOCUS_CHANNEL, (data) => panels.note(data));
+	const serializePrompt = <T>(fn: () => Promise<T>, signal?: AbortSignal): Promise<T> => {
+		const show = async () => {
+			if (panels.busy && !signal?.aborted) {
+				liveUiCtx(lastReviewCtx)?.ui.notify(PROMPT_WAITS_FOR_PANEL, "info");
+				await panels.whenClear(signal);
+			}
+			return fn();
+		};
+		const run = promptChain.then(show, show);
 		promptChain = run.then(
 			() => {},
 			() => {},
@@ -823,53 +1249,143 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		return run;
 	};
 
+	/** A context overflow judged nothing: ask once, or stop a headless turn. */
+	const transcriptOverflow = async (ctx: ExtensionContext, toolName: string, subject: string, signal = ctx.signal): Promise<ChildGateDecision> => {
+		if (!ctx.hasUI || ctx.mode === "print") {
+			const reason = "auto mode classifier transcript exceeded context window in headless mode";
+			ctx.ui.notify(`${reason}. Compact the session (/compact) and continue.`, "error");
+			// A failed one-shot run, not a user cancel (exit/index.ts).
+			pi.events.emit(TURN_FAILED_CHANNEL, { reason } satisfies TurnFailedEvent);
+			ctx.abort();
+			return { block: true, reason };
+		}
+		const reason = "Auto mode classifier transcript exceeded context window — falling back to manual approval";
+		ctx.ui.notify(reason, "warning");
+		logDecision(ctx, { tool: toolName, subject, outcome: "prompt", source: "user", transcriptTooLong: true, reason });
+		const choice = await serializePrompt(() => signal?.aborted ? Promise.resolve(undefined) : ctx.ui.select(
+			`${reason}\n\n${askTitle(toolName, previewSubject(subject), "mode", false)}`,
+			askOptions(undefined), { signal },
+		), signal);
+		const allowed = !signal?.aborted && choice === YES;
+		logDecision(ctx, { tool: toolName, subject, outcome: allowed ? "allow" : "block", source: "user", transcriptTooLong: true, reason });
+		if (allowed) return undefined;
+		if (!signal?.aborted && choice === NO) {
+			const feedback = await serializePrompt(() => signal?.aborted ? Promise.resolve(undefined) : ctx.ui.input(
+				"What should the agent do instead?", "Optional — press Esc to skip", { signal },
+			), signal);
+			return { block: true, reason: userDenialText(feedback) };
+		}
+		return { block: true, reason: "Manual approval was not granted after the auto-mode classifier transcript exceeded its context window." };
+	};
+
+	/**
+	 * Show an ask prompt through `queue`, timed when it is a paused-auto-mode
+	 * resume prompt that Claude Code's denial-limit fallback times (the first
+	 * after a consecutive-limit pause). pi shows a live countdown and resolves
+	 * an expired dialog as dismissed, so `unanswered` tells the two apart,
+	 * measured from when the dialog showed (not when it queued); the caller
+	 * then denies the call without asking for feedback. Shared by both gate paths.
+	 */
+	const askMaybeTimed = async (
+		pausedResume: boolean,
+		title: string,
+		queue: (show: () => Promise<string | undefined>) => Promise<string | undefined>,
+		select: (title: string, timeout: number | undefined) => Promise<string | undefined>,
+	): Promise<{ choice: string | undefined; unanswered: boolean }> => {
+		if (!pausedResume || !pauseTracker.takeTimedPrompt()) return { choice: await queue(() => select(title, undefined)), unanswered: false };
+		const timeout = unattendedPromptTimeoutMs();
+		let shownAt: number | undefined;
+		const choice = await queue(() => {
+			shownAt = Date.now();
+			return select(`${title}\n\n${unattendedPromptNotice(timeout)}`, timeout);
+		});
+		return { choice, unanswered: choice === undefined && shownAt !== undefined && Date.now() - shownAt >= timeout - Math.min(1500, timeout / 10) };
+	};
+
+	/**
+	 * Claude Code's one-time prompt before auto mode's first read outside the
+	 * working directories (2.1.282, findings §33): raised only in an interactive
+	 * session that has not answered it, on this machine or in Claude Code. Yes
+	 * and Block settle it for good; Ask again, or dismissing, refuses this read
+	 * and asks on the next. Queued behind other prompts, and re-checked once its
+	 * turn comes, so parallel outside reads ask once.
+	 */
+	const firstOutsideRead = (ctx: ExtensionContext, toolName: string, path: string, signal = ctx.signal): Promise<"allow" | "block" | "ask_again"> => {
+		const home = os.homedir();
+		const settled = () => (outsideReadSeen ??= outsideReadPromptSeen(oneCodeSettingsPath(home), claudeSourcesOn() ? claudeJsonPath(home) : undefined));
+		if (!ctx.hasUI) return Promise.resolve("allow");
+		// Settled while this call waited (a parallel read's Block included).
+		if (settled()) return Promise.resolve(blockOutsideReads ? "block" : "allow");
+		return serializePrompt(async () => {
+			if (signal?.aborted) return "ask_again";
+			if (settled()) return blockOutsideReads ? "block" : "allow";
+			const settingsFile = tildify(oneCodeSettingsPath(home), home);
+			const title = `${OUTSIDE_READ_TITLE}\n\n  ${toolName} ${path}\n\n${OUTSIDE_READ_QUESTION}\n\n${OUTSIDE_READ_EXPLAINER(settingsFile)}`;
+			const choice = await ctx.ui.select(title, Object.values(OUTSIDE_READ_ANSWERS), { signal });
+			if (signal?.aborted || (choice !== OUTSIDE_READ_ANSWERS.allow && choice !== OUTSIDE_READ_ANSWERS.block)) return "ask_again";
+			outsideReadSeen = true;
+			markOutsideReadPromptSeen(oneCodeSettingsPath(home));
+			if (choice === OUTSIDE_READ_ANSWERS.allow) return "allow";
+			persistBlockOutsideReads(oneCodeSettingsPath(home));
+			blockOutsideReads = true;
+			return "block";
+		}, signal);
+	};
+
+	/** The block reason for a first-read prompt answered with Block or Ask again; undefined to run the read. */
+	const outsideReadRefusal = async (ctx: ExtensionContext, toolName: string, path: string, signal = ctx.signal): Promise<string | undefined> => {
+		const answer = await firstOutsideRead(ctx, toolName, path, signal);
+		return answer === "allow" ? undefined : answer === "block" ? DENIED_CHOSE_BLOCK_OUTSIDE_READS : userDenialText();
+	};
+
+	/**
+	 * An allowed call in auto mode breaks the block streak and ends a
+	 * consecutive-limit pause (`PauseTracker.recordAllow`), whatever allowed
+	 * it: a rule, a read, a fast path, the classifier or a /permissions grant.
+	 * A subagent's calls never touch the streak, as its blocks never count.
+	 */
+	const noteAllow = () => {
+		if (pauseTracker.recordAllow()) applyBadge();
+	};
+
 	pi.on("tool_call", async (event, ctx) => {
 		lastReviewCtx = ctx;
+		// Settled long before the first call; a failed load leaves every bash
+		// command unparseable, which escalates or prompts.
+		await bashParserReady();
 		const normalizedTool = normalizeToolName(event.toolName);
+		const conflict = isPathSubjectTool(normalizedTool) ? conflictingPathArguments(event.input as Record<string, unknown>) : undefined;
+		if (conflict) return { block: true, reason: conflict };
 		const subject = extractSubject(normalizedTool, event.input as Record<string, unknown>);
-		// Resolved through symlinks so the protected-path and working-directory
-		// checks see where a write lands or a read comes from, not how the path
-		// is spelled. Path tools only: a bash subject is a command line.
-		const resolvedSubject =
-			isPathSubjectTool(normalizedTool) && subject
-				? resolveForContainment(toAbsolute(ctx.cwd, subject, os.homedir()))
-				: undefined;
 		// In a worktree session, worktree's tool_call handler (which runs before this
 		// one) cd-wraps bash commands for execution and publishes the model's
 		// original command — and the worktree it runs in — over the bus under this
-		// call's id. Rule matching, the shell pre-gate, the recoverability judge and
-		// the prompt all evaluate that original against the worktree cwd: matched
-		// against the wrapper every configured Bash rule stopped matching, and
-		// analysed as the wrapper (a `cd` plus a newline) every call escalated to
-		// the classifier and the prompt showed `cd '…' && (…)` (PERMISSIONS-REVIEW-
-		// 2026-09-05 L3). The safety floor keeps reading event.input (the wrapped
+		// call's id. Rule matching, the shell pre-gate and the prompt all evaluate
+		// that original against the worktree cwd: matched against the wrapper
+		// every configured Bash rule stopped matching, and analysed as the wrapper
+		// (a `cd` plus a newline) every call escalated to the classifier and the
+		// prompt showed `cd '…' && (…)` (PERMISSIONS-REVIEW-2026-09-05 L3). The safety floor keeps reading event.input (the wrapped
 		// command that actually runs). The lookup is by toolCallId on purpose: a
 		// value inside `event.input` would be the model's to write, and rules would
 		// match a string of its choosing.
-		const original = isShellTool(normalizedTool) ? originalCommands.get(event.toolCallId) : undefined;
+		// `monitor` is cd-wrapped the same way (worktree/rewrite.ts).
+		const original = isShellTool(normalizedTool) || normalizedTool === "monitor" ? originalCommands.get(event.toolCallId) : undefined;
 		const matchSubject = original?.command ?? subject;
-		const callCwd = original?.cwd ?? ctx.cwd;
+		const callCwd = original?.cwd ?? workCwd(ctx.cwd);
+		// File tools are rewritten to absolute worktree paths too. Both the
+		// lexical and resolved working roots must follow entry; keeping the
+		// main checkout's resolved root would still fast-path writes there.
+		const resolvedCallCwd = callCwd === ctx.cwd ? resolvedCwd : resolveForContainment(callCwd);
+		const resolvedSubject =
+			isPathSubjectTool(normalizedTool) && subject
+				? resolveForContainment(toAbsolute(callCwd, subject, os.homedir()))
+				: undefined;
+		const powershellParse = await parsePowerShell(normalizedTool, matchSubject, mode);
 
-		// Record every tool call into the classifier transcript (inputs only). In
-		// auto mode this is the running <transcript> the classifier reads, and this
-		// call is now its last entry — the action under review. For bash, record the
-		// model's original command, not the worktree cd-wrapper that actually runs.
-		if (mode === "auto") {
-			const recordedInput =
-				original !== undefined ? { command: original.command } : (event.input as Record<string, unknown>);
-			transcript.push({ kind: "tool", tool: normalizedTool, input: recordedInput });
-			// Claude Code follows a `git status` call with a ground-truth line the
-			// classifier can trust over the model's account of the tree
-			// (`{"meta":{"gitStatus":{"clean":…}}}`, captured 2.1.276 — findings §22).
-			const recordedCommand = typeof recordedInput.command === "string" ? recordedInput.command : undefined;
-			if (isShellTool(normalizedTool) && recordedCommand && isGitStatusCommand(recordedCommand)) {
-				const clean = await gitStatusClean(callCwd);
-				if (clean !== undefined) transcript.push({ kind: "meta", gitStatus: { clean } });
-			}
-			capTranscript();
-		}
+		currentMainToolCallId = event.toolCallId;
+		inFlightMainCalls.push(event.toolCallId);
 
-		const decideWith = (allowRules: PermissionRule[]) =>
+		const decideWith = (allowRules: PermissionRule[], dirs: string[] = workspaceDirs) =>
 			decide({
 				toolName: event.toolName,
 				subject: matchSubject,
@@ -880,32 +1396,53 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				allow: allowRules,
 				classifyAllShell: classifyAllShell(),
 				resolvedSubject,
-				resolvedCwd,
+				resolvedCwd: resolvedCallCwd,
 				planFilePath,
 				memoryDirPath,
 				scratchpadDirPath,
 				resultsDirPath,
 				sessionDirPath,
 				protectedDirs,
+				secretPaths,
+				workspaceDirs: dirs,
+				claudeCodeFastPaths: usesClaudeCodeFastPaths(ctx.model),
+				blockReadsOutsideWorkingDirectories: blockOutsideReads,
+				readOnlyDirs: docsDirPaths,
+				powershellParse,
 			});
 		let result = decideWith([...allow, ...activeSessionAllows(), ...(projectAllowTrusted ? projectAllow : [])]);
 
-		// A repo-shipped allow rule would decide this call: ask the user to trust
-		// the repository's rule list first (once per list; project-trust.ts). No UI
-		// → the rules stay off and the call takes the normal path (fail closed).
-		if (result.decision !== "allow" && !projectAllowTrusted && !projectAllowDeclined && projectAllow.length > 0 && ctx.hasUI) {
-			const withProject = decideWith([...allow, ...activeSessionAllows(), ...projectAllow]);
-			if (withProject.decision === "allow" && withProject.rule && projectAllow.includes(withProject.rule)) {
-				const firing = withProject.rule.raw;
-				const { title, message } = describeProjectAllow(projectAllowRaw, firing);
-				const approved = (await serializePrompt(() => ctx.ui.confirm(title, message))) === true;
-				if (approved) {
-					projectAllowTrusted = true;
-					persistProjectAllowApproval(projectRoot, projectAllowRaw);
-					result = withProject;
-				} else {
-					projectAllowDeclined = true;
-					ctx.ui.notify("This repository's allow rules stay off for this session (its deny/ask rules still apply).", "info");
+		// A repo-shipped allow rule or workspace directory would decide this call:
+		// ask the user to trust the repository's settings first (once per list;
+		// project-trust.ts). No UI → they stay off and the call takes the normal
+		// path (fail closed).
+		const trustProject = async (withProject: typeof result, firing: TrustFiring) => {
+			const repoDirs = repoWorkspaceDirs().map((dir) => dir.raw);
+			const { title, message } = describeProjectAllow(projectAllowRaw, firing, repoDirs);
+			const approved = (await serializePrompt(() => ctx.ui.confirm(title, message, { signal: ctx.signal }), ctx.signal)) === true;
+			if (ctx.signal?.aborted) return;
+			if (approved) {
+				projectAllowTrusted = true;
+				persistProjectAllowApproval(projectRoot, projectTrustList());
+				refreshWorkspace();
+				result = withProject;
+			} else {
+				projectAllowDeclined = true;
+				ctx.ui.notify("This repository's allow rules and workspace directories stay off for this session (its deny/ask rules still apply).", "info");
+			}
+		};
+		if (result.decision !== "allow" && !projectAllowTrusted && !projectAllowDeclined && ctx.hasUI) {
+			const withRules = projectAllow.length > 0 ? decideWith([...allow, ...activeSessionAllows(), ...projectAllow]) : undefined;
+			const repoDirs = repoWorkspaceDirs();
+			if (withRules?.decision === "allow" && withRules.rule && projectAllow.includes(withRules.rule)) {
+				await trustProject(withRules, { rule: withRules.rule.raw });
+			} else if (repoDirs.length > 0) {
+				const withDirs = decideWith([...allow, ...activeSessionAllows()], [...workspaceDirs, ...repoDirs.map((dir) => resolvedOrSelf(dir.path))]);
+				// A read tool's allow is "tier" or "mode"; a shell read's is "read-only" ("plan-readonly" in plan mode).
+				if (withDirs.decision === "allow" && (withDirs.cause === "tier" || withDirs.cause === "mode" || withDirs.cause === "read-only" || withDirs.cause === "plan-readonly")) {
+					const target = resolvedSubject ?? toAbsolute(callCwd, matchSubject, os.homedir());
+					const firing = repoDirs.find((dir) => isWithin(resolvedOrSelf(dir.path), target))?.raw ?? repoDirs[0].raw;
+					await trustProject(withDirs, { dir: firing });
 				}
 			}
 		}
@@ -924,17 +1461,28 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				? safetyControlWrite({
 						toolName: normalizeToolName(event.toolName),
 						input: event.input as Record<string, unknown>,
-						cwd: ctx.cwd,
+						cwd: callCwd,
 						home: os.homedir(),
 						oneCodeProjectSettings: oneCodeProjectSettingsFile,
 					})
 				: undefined;
 
-		if (result.decision === "allow" && !floorReason) return undefined;
+		if (result.decision === "allow" && result.cause === "outside-read") {
+			const refusal = await outsideReadRefusal(ctx, normalizedTool, matchSubject);
+			if (refusal) return { block: true, reason: refusal };
+		}
+
+		if (result.decision === "allow" && !floorReason) {
+			if (mode === "auto") {
+				if (result.cause === "read-only") logDecision(ctx, { tool: event.toolName, subject: matchSubject, outcome: "allow", source: "pre-gate" });
+				noteAllow();
+			}
+			return undefined;
+		}
 
 		// (dontAsk is the only mode that denies rather than allows unmatched calls.)
 		if (result.decision === "deny") {
-			recordRuleDenial(result, event.toolName, matchSubject);
+			recordRuleDenial(result, event.toolCallId, matchSubject);
 			return { block: true, reason: denyReason(result) };
 		}
 
@@ -946,10 +1494,24 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			autoConfig ??= loadAutoModeConfig(os.homedir());
 			if (mode === "auto" || !ctx.hasUI) {
 				logDecision(ctx, { tool: event.toolName, subject, outcome: "block", source: "floor", reason: floorReason });
-				return { block: true, reason: DENIED_SAFETY_FLOOR(floorReason) };
+				return { block: true, reason: safetyFloorBlockText(floorReason) };
 			}
 			logDecision(ctx, { tool: event.toolName, subject, outcome: "prompt", source: "floor", reason: floorReason });
 		} else if (result.decision === "classify") {
+			// The exact call the user approved in /permissions after the classifier
+			// denied it runs once without the classifier (auto-mode/denials.ts). Deny
+			// rules and the safety floor were checked above, so no grant reaches them.
+			const inputKey = denialInputKey(
+				normalizedTool,
+				original !== undefined ? { command: original.command } : (event.input as Record<string, unknown>),
+				callCwd,
+				isShellTool(normalizedTool),
+			);
+			if (denials.takeGrant(inputKey)) {
+				logDecision(ctx, { tool: event.toolName, subject: matchSubject, outcome: "allow", source: "user", reason: "approved in /permissions" });
+				noteAllow();
+				return undefined;
+			}
 			// Auto mode is for unattended runs: a block is returned to the MODEL so it
 			// can try a safe alternative — it is never raised as a per-action user
 			// prompt. The one exception is the loop-breaker: after repeated blocks the
@@ -959,7 +1521,6 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			if (!pauseTracker.isPaused()) {
 				const outcome = await runClassifier(
 					event.toolName,
-					event.input as Record<string, unknown>,
 					matchSubject,
 					ctx,
 					// Protected paths must always be judged; everything else may be cleared
@@ -967,20 +1528,24 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 					result.cause !== "protected-path",
 					// A worktree-wrapped command is analysed as the model wrote it, in the
 					// worktree it runs in (the classifier transcript already holds it).
-					original?.cwd ? { cwd: original.cwd } : undefined,
+					{
+						cwd: callCwd, powershellParse, toolCallId: event.toolCallId,
+						appendEntry: { kind: "tool", tool: normalizedTool, input: original !== undefined ? { command: original.command } : event.input as Record<string, unknown> },
+					},
 				);
 				if (outcome.decision === "allow") {
-					pauseTracker.recordAllow();
+					noteAllow();
+					denials.settle(inputKey);
 					return undefined;
 				}
 
+				if (outcome.transcriptTooLong) return transcriptOverflow(ctx, event.toolName, matchSubject);
+
 				// A timeout was not earned by looping against the gate, so it does not
 				// count toward the auto-pause. It is returned to the model as retryable
 				// (the call was never judged) rather than prompting — a prompt would
 				// hang an unattended session waiting on a classifier that was slow.
-				if (outcome.tier === "timeout") {
-					return { block: true, reason: BLOCKED_BY_TIMEOUT(outcome.reason) };
-				}
+				if (outcome.tier === "timeout") return { block: true, reason: classifierBlockReason(outcome) };
 
 				const tripped = pauseTracker.recordBlock({
 					toolName: event.toolName,
@@ -990,6 +1555,19 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 					ruleId: outcome.ruleId,
 					raw: outcome.raw,
 				});
+				// A verdict, not a failure to reach one, can be approved in /permissions.
+				if (!outcome.noVerdict) {
+					denials.record({
+						toolName: normalizedTool,
+						display: `${event.toolName}(${previewSubject(matchSubject)})`,
+						fullDisplay: `${event.toolName}(${matchSubject})`,
+						inputKey,
+						reason: outcome.reason,
+						...(outcome.ruleId ? { rule: outcome.ruleId } : {}),
+						timestamp: Date.now(),
+					});
+					if (ctx.hasUI) ctx.ui.notify(deniedNotice(event.toolName, outcome.reason), "warning");
+				}
 				if (tripped) {
 					const { lifetime } = pauseTracker.stats();
 					ctx.ui.notify(
@@ -1000,8 +1578,9 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				}
 				// Every classifier block (hard or soft) goes back to the model with the
 				// classifier's own reason, so it can find a safe alternative. Auto mode
-				// does not hand a soft block to the user as a per-action prompt.
-				return { block: true, reason: DENIED_BY_CLASSIFIER(outcome.reason) };
+				// does not hand a soft block to the user as a per-action prompt. A call
+				// the classifier never judged is said to be one, not a denial.
+				return { block: true, reason: classifierBlockReason(outcome) };
 			}
 			// Paused: fall through to the resume prompt below.
 		}
@@ -1027,7 +1606,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			floor: floorReason !== undefined,
 			home: os.homedir(),
 		});
-		const choice = await serializePrompt(() => ctx.ui.select(title, askOptions(grant)));
+		const { choice, unanswered } = await askMaybeTimed(pausedResume, title, (show) => serializePrompt(show, ctx.signal), (text, timeout) =>
+			ctx.ui.select(text, askOptions(grant), { signal: ctx.signal, timeout }),
+		);
+		if (ctx.signal?.aborted) return { block: true, reason: "The turn was stopped while waiting for the user's approval." };
+		if (unanswered) {
+			logDecision(ctx, { tool: event.toolName, subject: matchSubject, outcome: "block", source: "user", reason: "resume prompt unanswered" });
+			return { block: true, reason: DENIED_UNANSWERED_RESUME };
+		}
 
 		// The user's answer is itself a gate decision worth recording — it is the
 		// ground truth a drifting classifier gets calibrated against.
@@ -1055,12 +1641,27 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 
 		// The "tell the agent what to do differently" option has to actually carry
-		// the user's words, or the model is left guessing why it was stopped.
-		const feedback = await serializePrompt(() => ctx.ui.input("What should the agent do instead?", "Optional — press Esc to skip"));
-		return {
-			block: true,
-			reason: feedback?.trim() ? `${DENIED_BY_USER}\n\nThe user said: ${feedback.trim()}` : DENIED_BY_USER,
-		};
+		// the user's words, or the model is left guessing why it was stopped. Esc
+		// on the prompt (no choice) rejects without asking.
+		const feedback =
+			choice === undefined
+				? undefined
+				: await serializePrompt(() => ctx.ui.input("What should the agent do instead?", "Optional — press Esc to skip", { signal: ctx.signal }), ctx.signal);
+		// Claude Code's cancelAndAbort: a rejection without the user's words stops
+		// the turn and waits for them; with words, the model acts on them. pi reads
+		// an abort before the block (the result would say "Operation aborted"), so
+		// the abort waits for the recorded result; the run then ends as an abort,
+		// which every reader of the run's outcome treats as the user's interrupt.
+		// `terminate` ends pi's loop after the batch: otherwise it sent one more
+		// request on the aborted signal, which came back as an error and printed
+		// "Error: This operation was aborted" above the Interrupted line.
+		const stop = !feedback?.trim();
+		if (stop) abortAfterResult.add(event.toolCallId);
+		return { block: true, reason: userDenialText(feedback), terminate: stop };
+	});
+
+	pi.on("tool_execution_end", (event, ctx) => {
+		if (abortAfterResult.delete(event.toolCallId)) ctx.abort();
 	});
 
 	/**
@@ -1081,11 +1682,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		const ctx = lastReviewCtx;
 		const { toolName, input, cwd } = call;
 		const normalizedTool = normalizeToolName(toolName);
+		const conflict = isPathSubjectTool(normalizedTool) ? conflictingPathArguments(input) : undefined;
+		if (conflict) return { block: true, reason: conflict };
 		const subject = extractSubject(normalizedTool, input);
 		const resolvedSubject =
 			isPathSubjectTool(normalizedTool) && subject
 				? resolveForContainment(toAbsolute(cwd, subject, os.homedir()))
 				: undefined;
+		const powershellParse = await parsePowerShell(normalizedTool, subject, mode);
 
 		const result = decide({
 			toolName,
@@ -1108,6 +1712,13 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			resultsDirPath,
 			sessionDirPath,
 			protectedDirs,
+			secretPaths,
+			workspaceDirs,
+			// The child's own model: a cheaper subagent gets the stricter gate.
+			claudeCodeFastPaths: usesClaudeCodeFastPaths(call.model),
+			blockReadsOutsideWorkingDirectories: blockOutsideReads,
+			readOnlyDirs: docsDirPaths,
+			powershellParse,
 		});
 
 		// A child's cwd can be a worktree (different project → different per-repo
@@ -1120,11 +1731,17 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				? safetyControlWrite({ toolName: normalizedTool, input, cwd, home: os.homedir() })
 				: undefined;
 
+		// A child's first outside read raises the prompt on the parent's terminal;
+		// with no parent context there is no one to ask, as in a one-shot run.
+		if (result.decision === "allow" && result.cause === "outside-read" && ctx) {
+			const refusal = await outsideReadRefusal(ctx, normalizedTool, subject, call.signal);
+			if (refusal) return { block: true, reason: refusal };
+		}
 		if (result.decision === "allow" && !floorReason) return undefined;
 
 		if (result.decision === "deny") {
 			// A child's rule denial must NOT be recorded here: the child path never
-			// mutates the parent's live transcript (docs/decisions/subagents-workflows.md
+			// mutates the parent's live transcript (working-docs/decisions/subagents-workflows.md
 			// — child calls stay out of it). Pushing a `denied` entry would leak the
 			// child's action into the parent and flip `afterRuleDenial` on for every
 			// later MAIN classification. The child's classifier already learns the
@@ -1146,17 +1763,20 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				tool: normalizedTool,
 				input: isShellTool(normalizedTool) ? { command: subject } : input,
 			};
-			const outcome = await runClassifier(toolName, input, subject, ctx, result.cause !== "protected-path", {
+			const outcome = await runClassifier(toolName, subject, ctx, result.cause !== "protected-path", {
 				cwd,
 				appendEntry,
+				// The main session as far as the call that started this child's turn.
+				history: childCursor(call.parentToolCallId),
 				// The child's own turn signal, so an aborted child turn cancels the
 				// classifier call; a fresh (never-aborted) signal only if the child
 				// didn't supply one, so classify() still gets the signal it expects.
 				signal: call.signal ?? new AbortController().signal,
+				powershellParse,
 			});
 			if (outcome.decision === "allow") return undefined;
-			if (outcome.tier === "timeout") return { block: true, reason: BLOCKED_BY_TIMEOUT(outcome.reason) };
-			return { block: true, reason: DENIED_BY_CLASSIFIER(outcome.reason) };
+			if (outcome.transcriptTooLong) return transcriptOverflow(ctx, toolName, subject, call.signal);
+			return { block: true, reason: classifierBlockReason(outcome) };
 		}
 
 		// Safety floor: a write to the gate's own config is NEVER auto-approved and
@@ -1166,7 +1786,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// control the classifier itself can't be trusted to enforce.
 		if (floorReason) {
 			if (ctx) logDecision(ctx, { tool: toolName, subject, outcome: "block", source: "floor", reason: floorReason });
-			return { block: true, reason: DENIED_SAFETY_FLOOR(floorReason) };
+			return { block: true, reason: safetyFloorBlockText(floorReason) };
 		}
 
 		// ask: needs the user. Bubble it to the parent's terminal; no UI → fail closed.
@@ -1184,10 +1804,16 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// its turn in the chain comes is skipped outright. Otherwise a dead agent's
 		// dialog stays on screen and every later prompt waits behind it (M5).
 		const childPrompt = <T>(show: () => Promise<T>): Promise<T | undefined> =>
-			serializePrompt(() => (call.signal?.aborted ? Promise.resolve(undefined) : show()));
+			serializePrompt(() => (call.signal?.aborted ? Promise.resolve(undefined) : show()), call.signal);
 		const grant = sessionGrant({ toolName: normalizedTool, subject, cwd, mode, cause: result.cause, home: os.homedir() });
-		const choice = await childPrompt(() => ctx.ui.select(title, askOptions(grant), { signal: call.signal }));
+		const { choice, unanswered } = await askMaybeTimed(pausedResume, title, childPrompt, (text, timeout) =>
+			ctx.ui.select(text, askOptions(grant), { signal: call.signal, timeout }),
+		);
 		if (call.signal?.aborted) return { block: true, reason: "The agent was stopped while waiting for the user's approval." };
+		if (unanswered) {
+			logDecision(ctx, { tool: toolName, subject, outcome: "block", source: "user", reason: "resume prompt unanswered" });
+			return { block: true, reason: DENIED_UNANSWERED_RESUME };
+		}
 
 		if (pausedResume) {
 			logDecision(ctx, {
@@ -1212,46 +1838,430 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		const feedback = await childPrompt(() => ctx.ui.input("What should the agent do instead?", "Optional — press Esc to skip", { signal: call.signal }));
 		return {
 			block: true,
-			reason: feedback?.trim() ? `${DENIED_BY_USER}\n\nThe user said: ${feedback.trim()}` : DENIED_BY_USER,
+			reason: userDenialText(feedback),
 		};
 	};
 
-	registerLocalCommand(pi, "permissions", {
-		description: "Show permission mode and loaded rules",
-		handler: async (args, ctx) => {
-			const fmt = (rules: PermissionRule[]) => (rules.length ? rules.map((r) => r.raw).join(", ") : "(none)");
-			const denials = pauseTracker.recentDenials();
-			const autoLines =
-				mode === "auto" || denials.length > 0
-					? [
-							`auto mode: ${pauseTracker.isPaused() ? "paused (approve a prompt to resume)" : "active"}, ${
-								pauseTracker.stats().lifetime
-							} blocked this session`,
-							...(denials.length > 0
-								? [
-										"recently denied:",
-										...denials.map((d) => `  ${d.toolName}(${d.subject.slice(0, 60)}) — ${d.reason}`),
-									]
-								: []),
-						]
-					: [];
-			ctx.ui.notify(
-				[
-					`mode: ${mode}`,
-					`deny: ${fmt(deny)}`,
-					`ask: ${fmt(ask)}`,
-					`allow: ${fmt(allow)}`,
-					...(projectAllow.length > 0
-						? [
-								`project allow (${projectAllowTrusted ? "trusted" : projectAllowDeclined ? "declined this session" : "awaiting consent"}): ${fmt(projectAllow)}`,
-							]
-						: []),
-					`session allows: ${fmt(sessionAllows)}`,
-					...(unparsableRules.length > 0 ? [`unparsable rules (ignored): ${unparsableRules.join(", ")}`] : []),
-					...autoLines,
-				].join("\n"),
-				"info",
+	/** Where a rule came from, and why the panel cannot edit it when it cannot. */
+	const describeSource = (rule: SourcedRule, home: string): { label: string; editable: boolean; note?: string } => {
+		const where = tildify(rule.path, home);
+		const readOnly = (label: string, note: string) => ({ label: `From ${label}`, editable: false, note });
+		switch (rule.source) {
+			case "onecode-user":
+				return { label: `From One Code user settings (${where})`, editable: true };
+			case "onecode-project":
+				return { label: `From One Code project settings (${where})`, editable: true };
+			case "claude-user":
+				return readOnly(`Claude Code user settings (${where})`, `One Code does not edit Claude Code's files. Change this rule in ${where}.`);
+			case "project":
+			case "project-local": {
+				const file = rule.source === "project" ? ".claude/settings.json" : ".claude/settings.local.json";
+				const consent =
+					rule.behavior !== "allow" ? "" : projectAllowTrusted ? " You trusted this repository's allow rules." : projectAllowDeclined ? " Its allow rules are off this session." : " Its allow rules apply only after you trust them.";
+				return readOnly(`the repository's ${file}`, `This rule ships with the repository. Change it in ${file}.${consent}`);
+			}
+			case "managed":
+				return readOnly("managed settings", "This rule is configured by managed settings and cannot be modified. Contact your system administrator for more information.");
+		}
+	};
+
+	const ruleRows = (cwd: string, home: string): Record<RuleTab, RuleRow[]> => {
+		const rows: Record<RuleTab, RuleRow[]> = { allow: [], ask: [], deny: [] };
+		for (const rule of listPermissionRules(cwd, home)) {
+			const source = describeSource(rule, home);
+			rows[rule.behavior].push({
+				key: `${rule.source}\0${rule.path}\0${rule.raw}`,
+				behavior: rule.behavior,
+				raw: rule.raw,
+				sourceLabel: source.label,
+				editable: source.editable,
+				...(source.note ? { readOnlyNote: source.note } : {}),
+			});
+		}
+		// "Don't ask again" grants live in memory for this session; deleting one ends it.
+		for (const grant of sessionAllows) {
+			rows.allow.push({ key: `session\0\0${grant.raw}`, behavior: "allow", raw: grant.raw, sourceLabel: "From this session (don't ask again)", editable: true });
+		}
+		for (const tab of RULE_TABS) rows[tab].sort((a, b) => a.raw.toLowerCase().localeCompare(b.raw.toLowerCase()));
+		return rows;
+	};
+
+	const ruleDestinations = (cwd: string, home: string): Destination[] => [
+		{ id: "onecode-project", label: "One Code project settings", description: `Saved in ${tildify(oneCodeProjectSettingsPath(cwd, home), home)}, for this project only` },
+		{ id: "onecode-user", label: "One Code user settings", description: `Saved in ${tildify(oneCodeSettingsPath(home), home)}, for every project` },
+	];
+
+	/** The status line under the panel's tabs. */
+	const panelStatus = (): string => {
+		const parts = [`Mode: ${mode}`];
+		if (mode === "auto" || pauseTracker.stats().lifetime > 0) {
+			parts.push(`${pauseTracker.stats().lifetime} blocked by auto mode this session`);
+			if (pauseTracker.isPaused()) parts.push("auto mode paused (approve a prompt to resume)");
+		}
+		if (unparsableRules.length > 0) parts.push(`${unparsableRules.length} rule(s) could not be parsed and are ignored`);
+		return parts.join(" · ");
+	};
+
+	/** The text summary /permissions prints where no panel can open. */
+	const permissionsSummary = (): string => {
+		const fmt = (rules: PermissionRule[]) => (rules.length ? rules.map((r) => r.raw).join(", ") : "(none)");
+		return [
+			`mode: ${mode}`,
+			`deny: ${fmt(deny)}`,
+			`ask: ${fmt(ask)}`,
+			`allow: ${fmt(allow)}`,
+			...(projectAllow.length > 0
+				? [`project allow (${projectAllowTrusted ? "trusted" : projectAllowDeclined ? "declined this session" : "awaiting consent"}): ${fmt(projectAllow)}`]
+				: []),
+			`session allows: ${fmt(sessionAllows)}`,
+			...(unparsableRules.length > 0 ? [`unparsable rules (ignored): ${unparsableRules.join(", ")}`] : []),
+			...(denials.list().length > 0 ? ["recently denied:", ...denials.list().map((d) => `  ${d.display} — ${d.reason}`)] : []),
+		].join("\n");
+	};
+
+	/** Built-in rules per auto-mode section, counted once from the embedded ruleset. */
+	let builtinCounts: ReturnType<typeof builtinRuleCounts> | undefined;
+
+	const autoSource = (entry: SourcedAutoModeEntry, home: string): { label: string; editable: boolean; note?: string } => {
+		const where = tildify(entry.path, home);
+		if (entry.source === "onecode-user") return { label: `From One Code user settings (${where})`, editable: true };
+		if (entry.source === "claude-user") {
+			return { label: `From Claude Code user settings (${where})`, editable: false, note: `One Code does not edit Claude Code's files. Change this entry in ${where}; it stays in effect here.` };
+		}
+		return { label: "From managed settings", editable: false, note: "This entry is configured by managed settings and cannot be modified. Contact your system administrator for more information." };
+	};
+
+	const autoModeView = (home: string): AutoModeView => {
+		const listed = listAutoModeEntries(home);
+		const entries: AutoEntryRow[] = [];
+		for (const section of AUTO_SECTIONS) {
+			for (const entry of listed.filter((e) => e.key === section)) {
+				const source = autoSource(entry, home);
+				entries.push({
+					key: `${entry.source}\0${entry.path}\0${section}\0${entry.text}`,
+					section,
+					text: entry.text,
+					sourceLabel: source.label,
+					editable: source.editable,
+					...(source.note ? { readOnlyNote: source.note } : {}),
+				});
+			}
+		}
+		const environment = loadAutoModeConfig(home).environment;
+		const envSources = [...new Set(listed.filter((e) => e.key === "environment").map((e) => autoSource(e, home).label.replace(/^From /, "").replace(/ \(.*\)$/, "")))];
+		const isDefault = envSources.length === 0;
+		const extendsDefault = !isDefault && DEFAULT_ENVIRONMENT.every((line) => environment.includes(line));
+		builtinCounts ??= builtinRuleCounts(buildRuleset(DEFAULT_ENVIRONMENT));
+		return {
+			builtins: builtinCounts,
+			entries,
+			environment: {
+				lines: environment,
+				summary: isDefault ? "Built-in default" : `${extendsDefault ? "Extends" : "Replaces"} the built-in default · from ${envSources.join(" and ")}`,
+				isDefault,
+			},
+		};
+	};
+
+	/** A panel row key for an auto-mode entry: source, file, section, text. */
+	const parseAutoKey = (key: string) => {
+		const [source, path, section, text] = key.split("\0");
+		if (source !== "onecode-user") throw new Error(`One Code can only change auto mode rules in its own settings file; this one is in ${tildify(path, os.homedir())}.`);
+		return { section: section as (typeof AUTO_SECTIONS)[number], text };
+	};
+	const autoLabel = (section: (typeof AUTO_SECTIONS)[number]) => AUTO_SECTION_LABELS[section].toLowerCase();
+
+	/**
+	 * Edit One Code's own `autoMode.environment` in pi's editor. It starts from
+	 * One Code's entries, or from the built-in default when nothing else sets
+	 * one (Claude Code starts from the full default text too). Saving it empty
+	 * removes the key, which restores the default. Returns the change line.
+	 */
+	const editEnvironment = async (ctx: ExtensionContext, home: string): Promise<string | undefined> => {
+		const listed = listAutoModeEntries(home).filter((e) => e.key === "environment");
+		const own = listed.filter((e) => e.source === "onecode-user").map((e) => e.text);
+		const others = listed.length - own.length;
+		// `"$defaults"` in the list: the user's lines extend the built-in default,
+		// which stays out of the editor and is kept on save.
+		const extendsDefault = oneCodeEnvironmentExtendsDefault(home);
+		const start = own.length > 0 ? own : others > 0 || extendsDefault ? [] : DEFAULT_ENVIRONMENT;
+		const title =
+			"Auto mode environment: one entry per line, `### ` lines are section headers. Save it empty to restore the built-in default." +
+			(extendsDefault ? " These lines are added to the built-in default." : "") +
+			(others > 0 ? ` These lines are added to the ${others} entries from Claude Code's user or managed settings.` : "");
+		const edited = await ctx.ui.editor(title, start.join("\n"));
+		if (edited === undefined) return undefined;
+		const lines = edited.split("\n").map((line) => line.trimEnd()).filter((line) => line.trim().length > 0);
+		if (lines.join("\n") === start.join("\n")) return undefined;
+		updateOneCodeAutoModeList(
+			"environment",
+			(entries) => {
+				const at = entries.findIndex((entry) => entry.trim() === "$defaults");
+				if (at < 0 || lines.length === 0) return lines;
+				return [...lines.slice(0, at), entries[at], ...lines.slice(at)];
+			},
+			home,
+		);
+		autoConfig = undefined;
+		return lines.length > 0 ? `Saved your auto mode environment to ${tildify(oneCodeSettingsPath(home), home)}` : "Restored the built-in auto mode environment";
+	};
+
+	/** Where a workspace directory came from, and why the panel cannot remove it when it cannot. */
+	const workspaceRows = (home: string): WorkspaceDirRow[] => {
+		const rows: WorkspaceDirRow[] = [];
+		for (const dir of settingsWorkspaceDirs) {
+			const where = tildify(dir.settingsPath, home);
+			const key = `${dir.source}\0${dir.settingsPath}\0${dir.raw}`;
+			if (dir.source === "onecode-user" || dir.source === "onecode-project") {
+				rows.push({ key, path: dir.path, sourceLabel: `From One Code ${dir.source === "onecode-user" ? "user" : "project"} settings (${where})`, editable: true });
+			} else if (isRepoSource(dir.source)) {
+				const file = dir.source === "project" ? ".claude/settings.json" : ".claude/settings.local.json";
+				const state = projectAllowTrusted ? "" : projectAllowDeclined ? ", off this session" : ", awaiting your trust";
+				rows.push({
+					key,
+					path: dir.path,
+					sourceLabel: `From the repository's ${file}${state}`,
+					editable: false,
+					readOnlyNote: `This directory ships with the repository. Change it in ${file}.${projectAllowTrusted ? "" : " It applies only after you trust the repository's settings, which you are asked the first time a call needs it."}`,
+				});
+			} else {
+				const label = dir.source === "claude-user" ? `Claude Code user settings (${where})` : "managed settings";
+				rows.push({ key, path: dir.path, sourceLabel: `From ${label}`, editable: false, readOnlyNote: dir.source === "claude-user" ? `One Code does not edit Claude Code's files. Change it in ${where}.` : "This directory is configured by managed settings and cannot be modified here." });
+			}
+		}
+		for (const path of flagWorkspaceDirs) rows.push({ key: `flag\0\0${path}`, path, sourceLabel: "From --add-dir", editable: false, readOnlyNote: "Added with --add-dir for this run. Start One Code without it to leave it out." });
+		for (const path of sessionWorkspaceDirs) rows.push({ key: `session\0\0${path}`, path, sourceLabel: "Added for this session", editable: true });
+		return rows;
+	};
+
+	/** Add a validated directory for this session, or remember it in One Code's project settings. Returns the change line. */
+	const addWorkspaceDirectory = (ctx: ExtensionContext, path: string, remember: boolean): string => {
+		const home = os.homedir();
+		if (remember) {
+			const target = oneCodeProjectSettingsPath(ctx.cwd, home);
+			persistWorkspaceDirectory(path, target);
+			reloadRules(ctx);
+			return `Added directory ${path} to workspace and saved to ${tildify(target, home)}`;
+		}
+		if (!sessionWorkspaceDirs.includes(path)) {
+			sessionWorkspaceDirs.push(path);
+			recordSessionWorkspace();
+		}
+		refreshWorkspace();
+		return `Added directory ${path} to workspace for this session`;
+	};
+
+	/** The panel's I/O over the gate's state (panel/host.ts). */
+	const panelHost = (ctx: ExtensionContext, home: string): PermissionsPanelHost => {
+		return {
+			view: () => ({
+				denials: denials.list().map((d) => ({ id: d.id, display: d.display, ...(d.rule ? { rule: d.rule } : {}) })),
+				rules: ruleRows(ctx.cwd, home),
+				autoMode: autoModeView(home),
+				destinations: ruleDestinations(ctx.cwd, home),
+				ruleError: (raw) =>
+					parseRule(raw) ? undefined : `Could not parse "${raw}". A rule is a tool name, optionally followed by a pattern in parentheses: Bash(npm test:*).`,
+				workspace: { cwd: ctx.cwd, dirs: workspaceRows(home) },
+				validateDir: (input) => validateWorkspaceDirectory(input, ctx.cwd, home, workspacePaths),
+			}),
+			status: panelStatus,
+			addRule: (behavior, rule, destination) => {
+				const target = destination === "onecode-user" ? oneCodeSettingsPath(home) : oneCodeProjectSettingsPath(ctx.cwd, home);
+				if (!persistPermissionRule(behavior, rule, target)) throw new Error(`That ${behavior} rule is already in ${tildify(target, home)}.`);
+				reloadRules(ctx);
+				return `Added ${behavior} rule ${rule} to ${tildify(target, home)}`;
+			},
+			deleteRule: (behavior, key) => {
+				const [source, path, raw] = key.split("\0");
+				if (source === "session") {
+					const index = sessionAllows.findIndex((grant) => grant.raw === raw);
+					if (index >= 0) sessionAllows.splice(index, 1);
+				} else if (source === ("onecode-user" satisfies RuleSource) || source === ("onecode-project" satisfies RuleSource)) {
+					if (!removePermissionRule(behavior, raw, path)) throw new Error(`${raw} is no longer in ${tildify(path, home)}.`);
+					reloadRules(ctx);
+				} else {
+					throw new Error(`One Code can only delete rules from its own settings files; ${raw} is in ${tildify(path, home)}.`);
+				}
+				return `Deleted ${behavior} rule ${raw}`;
+			},
+			// Auto mode rules go to One Code's user settings: autoMode is never read
+			// from project settings (decisions/modes.md). The cached config is dropped
+			// so the next classifier call reads the change.
+			addAutoRule: (section, text) => {
+				updateOneCodeAutoModeList(
+					section,
+					(entries) => {
+						if (entries.includes(text)) throw new Error(`That ${autoLabel(section)} rule is already in your settings.`);
+						return [...entries, text];
+					},
+					home,
+				);
+				autoConfig = undefined;
+				return `Added auto mode ${autoLabel(section)} rule: ${text}`;
+			},
+			editAutoRule: (key, text) => {
+				const { section, text: old } = parseAutoKey(key);
+				updateOneCodeAutoModeList(
+					section,
+					(entries) => {
+						const index = entries.indexOf(old);
+						if (index < 0) throw new Error("That rule is no longer in your settings.");
+						return entries.map((entry, i) => (i === index ? text : entry));
+					},
+					home,
+				);
+				autoConfig = undefined;
+				return `Updated auto mode ${autoLabel(section)} rule: ${text}`;
+			},
+			deleteAutoRule: (key) => {
+				const { section, text } = parseAutoKey(key);
+				updateOneCodeAutoModeList(
+					section,
+					(entries) => {
+						if (!entries.includes(text)) throw new Error("That rule is no longer in your settings.");
+						return entries.filter((entry) => entry !== text);
+					},
+					home,
+				);
+				autoConfig = undefined;
+				return `Deleted auto mode ${autoLabel(section)} rule: ${text}`;
+			},
+			addDir: (path, remember) => addWorkspaceDirectory(ctx, path, remember),
+			removeDir: (key) => {
+				const [source, settingsPath, raw] = key.split("\0");
+				if (source === "session") {
+					const index = sessionWorkspaceDirs.indexOf(raw);
+					if (index >= 0) {
+						sessionWorkspaceDirs.splice(index, 1);
+						recordSessionWorkspace();
+					}
+					refreshWorkspace();
+				} else if (source === ("onecode-user" satisfies RuleSource) || source === ("onecode-project" satisfies RuleSource)) {
+					if (!removeWorkspaceDirectory(raw, settingsPath)) throw new Error(`${raw} is no longer in ${tildify(settingsPath, home)}.`);
+					reloadRules(ctx);
+				} else {
+					throw new Error(`One Code can only remove directories it added; ${raw} comes from elsewhere.`);
+				}
+				return `Removed directory ${raw} from workspace`;
+			},
+		};
+	};
+
+	/**
+	 * Open the panel, run the environment editor round trips, then tell the
+	 * model what happened: approvals mint their grants here, once, as in Claude
+	 * Code (a row toggled on and off again grants nothing). `command` names the
+	 * breadcrumb (`permissions`, `add-dir`).
+	 */
+	/** `dismissed`: the command's stdout when the panel closes with nothing changed. */
+	const runPermissionsPanel = async (ctx: ExtensionContext, command: string, args: string, prepare?: (state: PanelState) => void, dismissed?: string) => {
+		const home = os.homedir();
+		const host = panelHost(ctx, home);
+		// The environment editor cannot open over the panel: close, edit, reopen.
+		let session = await openPermissionsPanel(ctx, pi.events, host, undefined, prepare);
+		while (session.editEnvironment) {
+			session.editEnvironment = false;
+			try {
+				const change = await editEnvironment(ctx, home);
+				if (change) session.changes.push(change);
+			} catch (error) {
+				session.state.notice = `Could not save the environment: ${(error as Error).message}`;
+			}
+			session = await openPermissionsPanel(ctx, pi.events, host, session);
+		}
+		const { state, changes } = session;
+
+		const approved = denials.approve(state.approved);
+		const retried = approved.filter((d) => state.retry.has(d.id));
+		// Model-facing: never the panel's clipped preview.
+		const displays = approved.map((d) => d.fullDisplay);
+		if (retried.length > 0) {
+			// Claude Code's retry: a banner says what was allowed, and a turn starts
+			// with the grant message.
+			announceLocalCommand(pi, { name: command, args, stdout: changes.join("\n") });
+			ctx.ui.notify(`Allowed ${retried.map((d) => d.display).join(", ")}`, "info");
+			pi.sendMessage(
+				{ customType: PERMISSION_RETRY_TYPE, content: permissionGrantedMessage(displays), display: false },
+				ctx.isIdle() ? { triggerTurn: true } : { deliverAs: "followUp", triggerTurn: true },
 			);
+			return;
+		}
+		if (approved.length === 0 && changes.length === 0) {
+			if (dismissed) announceLocalCommand(pi, { name: command, args, stdout: dismissed });
+			return;
+		}
+		const stdout = [...(approved.length > 0 ? [`Approved ${displays.join(", ")}`] : []), ...changes].join("\n");
+		announceLocalCommand(pi, { name: command, args, stdout });
+		// The grant message rides with the breadcrumb on the next prompt; no turn starts.
+		if (approved.length > 0) pi.events.emit(REMINDER_CHANNEL, { text: `${permissionGrantedMessage(displays)}\n`, placement: "user-prepend", raw: true });
+	};
+
+	/**
+	 * /permissions — Claude Code's panel (findings §33): approve or retry calls
+	 * the classifier denied, list, add or delete permission rules, manage auto
+	 * mode's own rules and environment, and the workspace directories.
+	 * Registered plainly, not through registerLocalCommand: the breadcrumb
+	 * carries what the panel did, so it is announced after the panel closes,
+	 * not before it opens.
+	 */
+	pi.registerCommand("permissions", {
+		description: "Review recently denied calls and manage permission rules, auto mode rules and workspace directories",
+		handler: async (args: string, ctx: ExtensionContext) => {
+			if (!canShowCustomUi(ctx)) {
+				// One notice with the summary, not notifyRpcReadOnly's separate one:
+				// pi shows only the last of back-to-back info notices (findings §63).
+				const limitation = ctx.mode === "rpc" ? `${rpcReadOnlyText("/permissions", "manage rules or approve recently denied calls")}\n\n` : "";
+				announceLocalCommand(pi, { name: "permissions", args, stdout: limitation.trim() });
+				ctx.ui.notify(`${limitation}${permissionsSummary()}`, "info");
+				return;
+			}
+			await runPermissionsPanel(ctx, "permissions", args, undefined, "Permissions dialog dismissed");
+		},
+	});
+
+	/**
+	 * /add-dir — Claude Code's: add a workspace directory. With a path it asks
+	 * whether to keep it for this session or remember it; without one it opens
+	 * the panel's Workspace tab on the path input.
+	 */
+	announceArgumentHint(pi, "add-dir", "<path>");
+	pi.registerCommand("add-dir", {
+		description: "Add a workspace directory: /add-dir <path>",
+		handler: async (args: string, ctx: ExtensionContext) => {
+			const input = args.trim();
+			if (!ctx.hasUI) {
+				announceLocalCommand(pi, { name: "add-dir", args });
+				ctx.ui.notify("/add-dir needs the interactive UI; start One Code with --add-dir instead.", "warning");
+				return;
+			}
+			if (!input) {
+				if (!canShowCustomUi(ctx)) {
+					const message = "The workspace panel is unavailable in RPC. Use /add-dir <path> to add a directory.";
+					announceLocalCommand(pi, { name: "add-dir", args, stdout: message });
+					ctx.ui.notify(message, "info");
+					return;
+				}
+				await runPermissionsPanel(ctx, "add-dir", args, (state) => {
+					state.tab = "workspace";
+					state.dialog = { kind: "addDir", draft: "" };
+				});
+				return;
+			}
+			const checked = validateWorkspaceDirectory(input, ctx.cwd, os.homedir(), workspacePaths);
+			if ("error" in checked) {
+				announceLocalCommand(pi, { name: "add-dir", args, stdout: checked.error });
+				ctx.ui.notify(checked.error, "warning");
+				return;
+			}
+			const choice = await ctx.ui.select(`Add ${checked.path} to the workspace? One Code will be able to read files in it and make edits when auto-accept edits is on.`, [
+				"Yes, for this session",
+				"Yes, and remember this directory",
+				"No",
+			]);
+			if (choice !== "Yes, for this session" && choice !== "Yes, and remember this directory") return;
+			const change = addWorkspaceDirectory(ctx, checked.path, choice === "Yes, and remember this directory");
+			announceLocalCommand(pi, { name: "add-dir", args, stdout: change });
+			ctx.ui.notify(change, "info");
 		},
 	});
 
@@ -1263,18 +2273,21 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 	 * surfaces a warning rather than blocking it: the work has already happened, so
 	 * the useful move is to make sure the model and the user see it.
 	 */
-	const reviewFlagged = (reason: string) =>
-		`<system-reminder>\nAuto mode reviewed this subagent's actions after it finished and flagged a concern: ${reason}\n\nTreat its output as unverified, do not act on it without checking, and tell the user what it did.\n</system-reminder>`;
+	const reviewFlagged = (verdict: HandBackVerdict) => `<system-reminder>\n${handBackWarning(verdict)}\n</system-reminder>`;
 
-	// Classify a finished run's action sequence as a whole. Returns the concern to
+	// Classify a finished run's action sequence as a whole. Returns the verdict to
 	// surface, or undefined when the sequence is fine. Shared by the foreground
-	// (tool_result) and background (channel) paths.
+	// (tool_result) and background (channel) paths. A review that reached no
+	// verdict (an unreadable reply, a transcript past the limit, a timeout) is an
+	// unreviewed run, not a finding.
 	const reviewCompletedRun = async (
 		actions: ChildAction[],
 		ctx: ExtensionContext,
 		subject: string,
 		signal: AbortSignal | undefined,
-	): Promise<string | undefined> => {
+		/** The main-session call that started the reviewed turn, when known. */
+		startedBy: string | undefined,
+	): Promise<HandBackVerdict | undefined> => {
 		autoConfig ??= loadAutoModeConfig(os.homedir());
 		// Present the child's actions as tool entries appended to the session
 		// transcript, so the reviewer judges the sequence with the parent's context
@@ -1284,12 +2297,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			const tool = normalizeToolName(action.toolName);
 			return { kind: "tool", tool, input: isShellTool(tool) ? { command: action.subject } : { subject: action.subject } };
 		});
+		const { transcript, userMessages } = classifierHistory(ctx.sessionManager.getBranch(), childCursor(startedBy));
 		const verdict = await classify(
 			{
 				toolName: "subagent-review",
 				transcript: [...transcript, ...childEntries],
 				userMessages: [...userMessages],
-				claudeMd: instructionsFor(ctx.cwd),
+				// The main session's instructions, read where its own calls read them.
+				claudeMd: instructionsFor(workCwd(ctx.cwd)),
 				username: classifierUsername,
 				environment: autoConfig.environment,
 				// AutoModeConfig is structurally a RuleExtras; the user's own deny rules
@@ -1302,6 +2317,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 				config: autoConfig,
 				signal,
 				state: classifierState,
+				cacheKey: classifierCacheKey(ctx.sessionManager.getSessionId()),
 				onNotice: (message, level) => ctx.ui.notify(message, level),
 				onUsage: onClassifierUsage,
 				onModelUnusable: onClassifierModelUnusable,
@@ -1313,20 +2329,18 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			subject,
 			outcome: verdict.decision,
 			source: "review",
+			transcriptTooLong: verdict.transcriptTooLong,
+			model: classifierState.pinned ? `${classifierState.pinned.provider}/${classifierState.pinned.id}` : undefined,
 			tier: verdict.tier,
 			ruleId: verdict.ruleId,
 			reason: verdict.reason || undefined,
 		});
 		if (verdict.decision === "allow") return undefined;
-		pauseTracker.recordBlock({
-			toolName: "Agent",
-			subject,
-			reason: verdict.reason,
-			tier: verdict.tier,
-			ruleId: verdict.ruleId,
-			raw: verdict.raw,
-		});
-		return verdict.reason;
+		// A completed run cannot be approved retroactively, so a review only warns.
+		// It never counts toward the auto-mode pause: as in Claude Code, denials
+		// are counted on the main permission path alone.
+		const unavailable = verdict.transcriptTooLong || verdict.noVerdict || verdict.tier === "timeout";
+		return { kind: unavailable ? "unavailable" : "blocked", reason: verdict.reason };
 	};
 
 	const childActions = new Map<string, ChildAction[]>();
@@ -1343,11 +2357,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// we answer `onReview`, so the verdict travels with the report. Answer
 		// synchronously when no review will run, so the report is never delayed
 		// for nothing. A review that throws fails closed: the report goes out
-		// flagged, not clean.
+		// flagged, not clean. A pause does not skip it: the pause is about the
+		// main loop's blocks, and a child already running when it tripped still
+		// hands back a sequence nobody judged whole (PERMISSIONS-AUTOMODE-REVIEW
+		// -2026-09-26 L1).
 		const respond = payload.onReview;
 		if (!respond) return; // every background emitter supplies the callback (hand-back-review.ts)
 		const ctx = lastReviewCtx;
-		if (mode !== "auto" || payload.actions.length === 0 || pauseTracker.isPaused() || !ctx) {
+		if (mode !== "auto" || payload.actions.length === 0 || !ctx) {
 			respond(undefined);
 			return;
 		}
@@ -1358,8 +2375,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		const respondIfCurrent = (verdict: HandBackVerdict | undefined) => {
 			if (epoch === sessionEpoch) respond(verdict);
 		};
-		reviewCompletedRun(payload.actions, ctx, label, new AbortController().signal)
-			.then((reason) => respondIfCurrent(reason ? { kind: "blocked", reason } : undefined))
+		reviewCompletedRun(payload.actions, ctx, label, new AbortController().signal, payload.startedBy)
+			.then(respondIfCurrent)
 			.catch((error) => respondIfCurrent({ kind: "unavailable", reason: `the review itself failed (${(error as Error).message})` }));
 	});
 
@@ -1367,86 +2384,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		lastReviewCtx = ctx;
 		const actions = childActions.get(event.toolCallId);
 		if (actions) childActions.delete(event.toolCallId);
-		if (mode !== "auto" || !actions?.length || pauseTracker.isPaused()) return undefined;
-		const reason = await reviewCompletedRun(actions, ctx, "completed run", ctx.signal);
-		if (!reason) return undefined;
-		return { content: [{ type: "text" as const, text: reviewFlagged(reason) }, ...event.content] };
+		// Reviewed while paused too, as the background path above is.
+		if (mode !== "auto" || !actions?.length) return undefined;
+		// The spawning call is this tool result's own: the run happened inside it.
+		const verdict = await reviewCompletedRun(actions, ctx, "completed run", ctx.signal, event.toolCallId);
+		if (!verdict) return undefined;
+		return { content: [{ type: "text" as const, text: reviewFlagged(verdict) }, ...event.content] };
 	});
 
-	/**
-	 * Apply a chosen classifier model: validate auth first (a persisted model
-	 * with no credentials would fail every call), persist to user scope, and
-	 * release the session pin so the choice takes effect on the next call
-	 * rather than after a restart.
-	 */
-	const applyClassifierChoice = async (spec: string, ctx: ExtensionContext): Promise<void> => {
-		const model = findConfigured(ctx.modelRegistry.getAvailable(), spec);
-		if (!model) {
-			ctx.ui.notify(`No available model matches "${spec}" — check /auto-mode config for the catalog name.`, "error");
-			return;
-		}
-		const resolved = `${model.provider}/${model.id}`;
-		const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
-		if (!auth.ok) {
-			ctx.ui.notify(`Cannot use ${resolved}: ${auth.error}. Not saved.`, "error");
-			return;
-		}
-		try {
-			// Stamp the session's containment so a later session on another provider
-			// treats this cross-provider setting as stale (parity with /subagent).
-			persistClassifierModel(resolved, os.homedir(), ctx.model ? modelIdentity(ctx.model).containment : undefined);
-		} catch (error) {
-			ctx.ui.notify(`Could not save classifier model: ${error instanceof Error ? error.message : String(error)}`, "error");
-			return;
-		}
-		resetClassifierChoice();
-		ctx.ui.notify(`Auto-mode classifier set to ${resolved} (saved to ~/.onecode/settings.json).`, "info");
-	};
-
-	/** `/auto-mode model` — show the picker, or apply a named model / `clear`. */
-	const handleModelSubcommand = async (remainder: string, ctx: ExtensionContext): Promise<void> => {
-		if (remainder === "clear") {
-			try {
-				persistClassifierModel(undefined, os.homedir());
-			} catch (error) {
-				ctx.ui.notify(`Could not update settings: ${error instanceof Error ? error.message : String(error)}`, "error");
-				return;
-			}
-			resetClassifierChoice();
-			ctx.ui.notify(`autoMode.classifierModel cleared. Auto mode will choose: ${describeChain(ctx)}`, "info");
-			return;
-		}
-		if (remainder) {
-			await applyClassifierChoice(remainder, ctx);
-			return;
-		}
-
-		const available = ctx.modelRegistry.getAvailable();
-		if (available.length === 0) {
-			ctx.ui.notify("No models are available — authenticate a provider first.", "warning");
-			return;
-		}
-		// The picker needs focus and a terminal; elsewhere say what to type.
-		if (!ctx.hasUI || ctx.mode !== "tui") {
-			autoConfig ??= loadAutoModeConfig(os.homedir());
-			ctx.ui.notify(
-				`classifierModel: ${autoConfig.classifierModel ?? "(not set)"}. Set one with /auto-mode model <provider/model-id>, or clear it with /auto-mode model clear.`,
-				"info",
-			);
-			return;
-		}
-
-		autoConfig ??= loadAutoModeConfig(os.homedir());
-		const current = autoConfig.classifierModel;
-		const entries = toPickerEntries(available);
-
-		const chosen = await ctx.ui.custom<PickerEntry | null>((tui, theme, _keybindings, done) =>
-			modelPickerComponent({ entries, current }, tui, theme, done),
-		);
-
-		if (chosen) await applyClassifierChoice(pickerSpec(chosen), ctx);
-	};
-
 	/**
 	 * `/auto-mode setup` — Claude Code's setup-wizard flow: ask how this
 	 * environment is used, gather facts (git/gh/CLAUDE.md, opt-in shell
@@ -1525,7 +2470,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		// must appear in both lists (removing the One Code copy alone would leave the
 		// exposure and a false "fixed" impression).
 		const oneCodeAllow = new Set(oneCodePermissionAllow(os.homedir()));
-		const claudeAllow = new Set(claudeUserPermissionAllow(os.homedir()));
+		// Independent mode reads no ~/.claude rule, so none of them is in force.
+		const claudeAllow = new Set(claudeSourcesOn() ? claudeUserPermissionAllow(os.homedir()) : []);
 		const removable = flagged.filter((entry) => oneCodeAllow.has(entry.rule));
 		const claudeSide = flagged.filter((entry) => claudeAllow.has(entry.rule));
 
@@ -1562,8 +2508,89 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 		}
 	};
 
+	/**
+	 * Apply a chosen classifier model: validate auth first (a persisted model
+	 * with no credentials would fail every call), persist to user scope, release
+	 * the session pin so the choice takes effect on the next call, and say what
+	 * it costs (`lib/model-choice-warnings.ts`).
+	 */
+	const applyClassifierChoice = async (spec: string, ctx: ExtensionContext): Promise<void> => {
+		const model = findConfigured(ctx.modelRegistry.getAvailable(), spec);
+		if (!model) {
+			ctx.ui.notify(`No available model matches "${spec}". Run /auto-mode model for the list.`, "error");
+			return;
+		}
+		const resolved = `${model.provider}/${model.id}`;
+		const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
+		if (!auth.ok) {
+			ctx.ui.notify(`Cannot use ${resolved}: ${auth.error}. Not saved.`, "error");
+			return;
+		}
+		try {
+			// Stamp the session's containment so a later session on another provider
+			// treats this cross-provider setting as stale (parity with /subagent).
+			persistClassifierModel(resolved, os.homedir(), ctx.model ? modelIdentity(ctx.model).containment : undefined);
+		} catch (error) {
+			ctx.ui.notify(`Could not save classifier model: ${error instanceof Error ? error.message : String(error)}`, "error");
+			return;
+		}
+		// Re-plan, then announce the choice with its warnings, in any mode: the
+		// setting applies whenever auto mode is on.
+		resetClassifierChoice(ctx.model, false);
+		announceClassifierChoice(ctx.model, { lead: `Auto-mode classifier set to ${resolved} (saved to ~/.onecode/settings.json).`, force: true });
+	};
+
+	/** `/auto-mode model` — show the picker, or apply a named model / `clear`. */
+	const handleModelSubcommand = async (remainder: string, ctx: ExtensionContext): Promise<void> => {
+		if (remainder === "clear") {
+			try {
+				persistClassifierModel(undefined, os.homedir());
+			} catch (error) {
+				ctx.ui.notify(`Could not update settings: ${error instanceof Error ? error.message : String(error)}`, "error");
+				return;
+			}
+			// One info line: pi folds back-to-back info notices (findings §63).
+			resetClassifierChoice(ctx.model, false);
+			announceClassifierChoice(ctx.model, { lead: `autoMode.classifierModel cleared. Auto mode chooses automatically: ${describeChain(ctx)}`, force: true });
+			return;
+		}
+		if (remainder) {
+			await applyClassifierChoice(remainder, ctx);
+			return;
+		}
+		const available = ctx.modelRegistry.getAvailable();
+		if (available.length === 0) {
+			ctx.ui.notify("No models are available — authenticate a provider first.", "warning");
+			return;
+		}
+		autoConfig ??= loadAutoModeConfig(os.homedir());
+		// The picker needs focus and a terminal; elsewhere say what to type.
+		if (!ctx.hasUI || ctx.mode !== "tui") {
+			ctx.ui.notify(
+				`classifierModel: ${autoConfig.classifierModel ?? "(not set: chosen automatically)"}. Set one with /auto-mode model <provider/model-id>, or clear it with /auto-mode model clear.`,
+				"info",
+			);
+			return;
+		}
+		const chosen = await panelUi(pi.events, ctx.ui).custom<PickerEntry | null>((tui, theme, _keybindings, done) =>
+			modelPickerComponent(
+				{
+					entries: toPickerEntries(available),
+					current: autoConfig?.classifierModel,
+					title: "Select the auto-mode classifier model",
+					subtitle: "Screens auto-mode tool calls; /auto-mode model clear returns to the automatic choice",
+				},
+				tui,
+				theme,
+				done,
+			),
+		);
+		if (chosen) await applyClassifierChoice(pickerSpec(chosen), ctx);
+	};
+
 	registerLocalCommand(pi, "auto-mode", {
 		description: "Auto-mode classifier: /auto-mode [setup|defaults|config|model [provider/model-id|clear]]",
+		argumentHint: "[setup|defaults|config|model [provider/model-id|clear]]",
 		getArgumentCompletions: () =>
 			[
 				{ value: "setup", label: "analyze this environment and draft the config" },
@@ -1573,14 +2600,14 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 			],
 		handler: async (args, ctx) => {
 			const [sub, ...rest] = args.trim().split(/\s+/).filter(Boolean);
-			if (sub === "model") {
-				await handleModelSubcommand(rest.join(" ").trim(), ctx);
-				return;
-			}
 			if (sub === "setup") {
 				await handleSetupSubcommand(ctx);
 				return;
 			}
+			if (sub === "model") {
+				await handleModelSubcommand(rest.join(" ").trim(), ctx);
+				return;
+			}
 			const which = sub ?? "config";
 			if (which !== "defaults" && which !== "config") {
 				ctx.ui.notify(
@@ -1625,8 +2652,8 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 					...(which === "config" && "classifyAllShell" in shown
 						? [
 								`classifyAllShell: ${shown.classifyAllShell}`,
+								`classifierModel: ${"classifierModel" in shown && shown.classifierModel ? shown.classifierModel : "(not set: chosen automatically; /auto-mode model chooses one)"}`,
 								`logDecisions: ${shown.logDecisions} (auto-mode-decisions.jsonl next to the session files)`,
-								`classifierModel: ${shown.classifierModel ?? "(not set — /auto-mode model chooses one)"}`,
 								// Which model actually screens calls, and why — this reads the
 								// user's prompts, so it should not take knowing the code to find out.
 								`classifier in use: ${
@@ -1650,6 +2677,7 @@ export default function permissionsExtension(pi: ExtensionAPI) {
 
 	registerLocalCommand(pi, "allow", {
 		description: 'Persist an allow rule: /allow Bash(npm test:*) [global]',
+		argumentHint: "<rule> [global]",
 		handler: async (args, ctx) => {
 			const global = /\s+global$/.test(args.trim());
 			const raw = args.trim().replace(/\s+global$/, "");