[TheGreatAxios]

Summary

Follow-up to CL-10749: documents that --permissions replaces only the global + provider-model grant layers (session + project layers still apply; project entries still need trust confirmation), and logs the canonical realpath grant-file target with approval count on every load (startup validation, seed, /permissions reseed).

Verification

• New src/permission/permissions-file.test.ts: 4 pass
• Full related suite: 1475 pass
• Full bun run check gate: green

Fixes CL-10754

[linear-code]

CL-10754

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

[TheGreatAxios]

Review · Comment

--permissions still leaves session and project grants in place, and a successful load logs the realpath plus the approval count. One change. The tests match the loader.

Findings

• src/permission/store.ts:344 — the comment says those calls produce one log line for the process lifetime. loadConfig, seed, and /permissions list each call loadPermissionsFile, so each load logs.
• docs/IMPLEMENTATION.md:440 — the flag table only says the file replaces user-global and provider-model grants. CLI_HELP_TEXT also says session and project grants still apply, and project entries still need trust confirmation. The same doc says that table stays in sync with help.

[TheGreatAxios]

Review · Approve

--permissions still leaves session and project grants in place, and every grant-file load logs the realpath and the approval count. The help table matches that.

No findings.