pi-auto-permissions 0.1.0 → 0.1.1

package/README.md

@@ -15,8 +15,9 @@ Permission denied. This action was not executed. No override will be requested.
 ```
 
 The model cannot appeal that result inside the action. It must issue a new,
-materially safer action. The user can still deliberately change the session's
-mode with `/perm`.
+materially safer action. The user also receives a passive warning notice naming
+the denied tool; it never asks for approval. The user can still deliberately
+change the session's mode with `/perm`.
 
 ## Requirements and installation
 

package/docs/implementation-plan.md

@@ -20,7 +20,8 @@ The package has eight narrow components:
 8. `extension.ts`: lifecycle wiring only.
 
 No component may open a human approval dialog. UI selection belongs only to the
-three explicit command handlers.
+three explicit command handlers. Denial paths may emit a passive warning notice,
+but that notice never requests approval.
 
 ## 2. Stepwise construction
 
@@ -264,7 +265,8 @@ Cover:
 - explicit user commands can change settings;
 - Off/on and reviewer changes observed by already-running sibling runtime
   simulations;
-- denial is an `isError` tool result visible to the model, with no UI dialog;
+- denial is an `isError` tool result visible to the model, with a passive user
+  warning notice and no UI dialog;
 - the model can continue with a safer call after denial;
 - the shipped TypeScript entrypoint loads through Pi's resource loader and the
   no-dialog path completes in print mode.

package/docs/invariants.md

@@ -412,7 +412,9 @@ API. Denial returns a fixed tool result to the model:
 > Permission denied. This action was not executed. No override will be requested.
 > Choose a materially safer action.
 
-User-facing selection UI exists only inside explicit user slash commands.
+User-facing selection UI exists only inside explicit user slash commands. A
+permission denial may additionally emit a passive warning notification naming
+the denied tool; that notification is not an approval request.
 
 ### I12. Direct-tool no-self-elevation invariant
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-auto-permissions",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "A minimal Codex-style Auto/Unrestricted permission guardrail for Pi",
   "type": "module",
   "license": "Apache-2.0",

package/src/tools/bash.ts

@@ -9,6 +9,7 @@ import {
   type GuardianTranscriptItem,
 } from "../guardian/index.ts";
 import type { PermissionEngine } from "../runtime/index.ts";
+import { notifyPermissionDenied } from "./denial-notice.ts";
 
 export const GUARDED_BASH_METADATA = Object.freeze({
   kind: "pi-auto-permissions-bash",
@@ -56,7 +57,10 @@ export function registerGuardedBashTool(
     executionMode: "sequential",
     async execute(toolCallId, params, signal, onUpdate, ctx) {
       const runtime = getRuntime();
-      if (runtime === null) throw new Error(GUARDIAN_DENIAL_MESSAGE);
+      if (runtime === null) {
+        notifyPermissionDenied(ctx, "bash");
+        throw new Error(GUARDIAN_DENIAL_MESSAGE);
+      }
       await runtime.refreshBackend(ctx);
       const reviewSignal = runtime.signal(signal);
 
@@ -71,6 +75,7 @@ export function registerGuardedBashTool(
         ...(reviewSignal === undefined ? {} : { signal: reviewSignal }),
       });
       if (decision.outcome === "deny") {
+        notifyPermissionDenied(ctx, "bash");
         if (decision.interruptTurn) ctx.abort();
         throw new Error(decision.message);
       }

package/src/tools/denial-notice.ts

@@ -0,0 +1,16 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+/**
+ * Keep denial feedback visible to the user without exposing tool arguments in
+ * a notification. The model still receives the fixed denial result separately.
+ */
+export function notifyPermissionDenied(
+  ctx: Pick<ExtensionContext, "ui">,
+  toolName: string,
+): void {
+  try {
+    ctx.ui.notify(`Permission denied: ${toolName} action was not executed.`, "warning");
+  } catch {
+    // A notification failure must not change the fixed fail-closed denial.
+  }
+}

package/src/tools/gate.ts

@@ -7,6 +7,7 @@ import type {
 import type { GuardianTranscriptItem } from "../guardian/index.ts";
 import { GUARDIAN_DENIAL_MESSAGE } from "../guardian/index.ts";
 import type { PermissionEngine } from "../runtime/index.ts";
+import { notifyPermissionDenied } from "./denial-notice.ts";
 
 const DIRECT_FILE_TOOL_NAMES = new Set(["read", "grep", "find", "ls", "write", "edit"]);
 
@@ -26,7 +27,10 @@ export function registerPermissionToolGate(
   pi.on("tool_call", async (event, ctx) => {
     if (event.toolName === "bash") return;
     const runtime = getRuntime();
-    if (runtime === null) return { block: true, reason: GUARDIAN_DENIAL_MESSAGE };
+    if (runtime === null) {
+      notifyPermissionDenied(ctx, event.toolName);
+      return { block: true, reason: GUARDIAN_DENIAL_MESSAGE };
+    }
 
     await runtime.refreshStatus(ctx);
     const info = findToolInfo(pi, event.toolName);
@@ -43,6 +47,7 @@ export function registerPermissionToolGate(
       ...(reviewSignal === undefined ? {} : { signal: reviewSignal }),
     });
     if (decision.outcome === "admit") return;
+    notifyPermissionDenied(ctx, event.toolName);
     if (decision.interruptTurn) ctx.abort();
     return { block: true, reason: decision.message };
   });