Adds pi.external_access_ask (on by default) so Pi asks about outside-project file access only in its terminal UI, and headless sessions allow it instead of refusing it.
Print, JSON, and RPC sessions now read/write outside files without asking; previously they failed with a "no screen to show a prompt on" denial. Engine floors (sandbox.read_deny, restrict_to_project_root: true, credentials) still refuse in every mode.
Only the user config can turn the setting off; a project config may turn it on but never off, and is warned when it tries.
On OMP, AFT tools now declare approval tiers (read/write/exec) as a function of their arguments, so OMP's own tools.approvalMode decides when to prompt; calls naming a path outside the project report exec. The tier check follows symbolic links and parses hashline and apply_patch targets; unparseable or unresolvable cases report exec.
Tools registered after session start (the powershell slot and bash on live config reloads) now go through the registration funnel, keeping their OMP loadMode and approval tier.
Non-outside-path engine asks (bash rules, escalations, unknown kinds) are never auto-approved.
The Pi plugin config schema now accepts a pi block at all; previously any pi key failed validation and was dropped.
Confidence Score: 5/5
The latest changes appear safe to merge; no new actionable issues were found.
Summary
Adds pi.external_access_ask and lets OMP decide when to ask through each tool’s declared tier.
Pi asks about outside-project access only in its terminal UI.
OMP asks based on each AFT tool call’s approval tier.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Initial registration, late PowerShell, or bash reload] --> B[Shared registration funnel]
B --> C{Host}
C -->|OMP| D[Attach loadMode and approval tier]
C -->|Pi| E[Keep Pi tool metadata]
D --> F[Register tool]
E --> F
