fix(deps): adapt to pi-permission-system 32 session-keyed services

- resolve the permissions service by the live session id in both
  tryRegister paths, so a mid-session republish re-keys via the re-emitted
  permissions:ready channel
- read the session probe instead of the start-time snapshot for inner-cmd
- pass the session key to publish/unpublishPermissionsService in tests and
  drop the removed PromptPermissionDetails.message field
- raise the ai-judge peer floor to @gotgenes/pi-permission-system >=32.0.0
- bump dev deps: pi-coding-agent 0.85.1, vitest 5, typescript 7

packages/pi-permission-inner-cmd/package.json

@@ -12,7 +12,7 @@
     ]
   },
   "dependencies": {
-    "@gotgenes/pi-permission-system": "^25.4.0"
+    "@gotgenes/pi-permission-system": "^32.0.2"
   },
   "bundledDependencies": [
     "@gotgenes/pi-permission-system"
@@ -21,12 +21,12 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "*",
-    "@types/node": "^26.0.0",
-    "@vitest/coverage-istanbul": "3.2.7",
-    "@vitest/coverage-v8": "^3.2.7",
-    "typescript": "^5",
-    "vitest": "^3"
+    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@types/node": "^26.5.1",
+    "@vitest/coverage-istanbul": "5.0.1",
+    "@vitest/coverage-v8": "^5.0.1",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.1"
   },
   "scripts": {
     "check": "tsc --noEmit",

packages/pi-permission-inner-cmd/src/index.ts

@@ -32,7 +32,12 @@ export default function permissionInnerCmd(pi: ExtensionAPI): void {
             return;
         }
 
-        const service = getPermissionsService();
+        // Resolve by the live session id, not the start-time snapshot: a
+        // mid-session id change republishes under the new key and re-emits
+        // the ready channel, so the dynamic read re-keys onto it.
+        const service = getPermissionsService(
+            rootSession.session.getSessionId(),
+        );
         if (!service) {
             return;
         }

packages/pi-permission-inner-cmd/test/authorizer.test.ts

@@ -67,7 +67,6 @@ function bashDetails(
         requestId: "req-1",
         source: "tool_call",
         agentName,
-        message: "May I run bash?",
         payload: {
             kind: "bash",
             request: {

packages/pi-permission-inner-cmd/test/lifecycle.test.ts

@@ -76,6 +76,9 @@ function createFakeSessionManager(
     } as unknown as ExtensionContext["sessionManager"];
 }
 
+/** The default fake session id — the key the service publishes under. */
+const SESSION_ID = "session-root";
+
 describe("permissions:ready -> registerAuthorizer lifecycle", () => {
     let registerAuthorizer: ReturnType<typeof vi.fn>;
     let disposer: ReturnType<typeof vi.fn>;
@@ -104,7 +107,7 @@ describe("permissions:ready -> registerAuthorizer lifecycle", () => {
     });
 
     afterEach(() => {
-        if (published) unpublishPermissionsService(service);
+        if (published) unpublishPermissionsService(SESSION_ID, service);
     });
 
     /**
@@ -113,7 +116,7 @@ describe("permissions:ready -> registerAuthorizer lifecycle", () => {
      * available, so an early `session_start` cannot register yet.
      */
     function becomeReady(): void {
-        publishPermissionsService(service);
+        publishPermissionsService(SESSION_ID, service);
         published = true;
     }
 
@@ -228,7 +231,6 @@ describe("permissions:ready -> registerAuthorizer lifecycle", () => {
                 requestId: "req-1",
                 source: "tool_call",
                 agentName: "child",
-                message: "forwarded ask",
                 payload: {
                     kind: "forwarded",
                     request: {