@@ -52,6 +52,7 @@ import { readProviderReplayTranscript } from "@t3tools/provider-testing/replayTr
 import { KiroSettings } from "@t3tools/provider-kiro/settings";
 import {
   KIRO_PROVIDER,
+  kiroApprovalOptions,
   kiroAutopilotValue,
   kiroPermissionDisposition,
   makeKiroAdapterV2,
@@ -1332,16 +1333,15 @@ describe("Kiro permission policy", () => {
       "allow",
     );
     // With no one-time choice, approving would save a rule beyond the thread,
-    // so the request goes to the user instead.
-    assert.equal(
-      kiroPermissionDisposition(
-        fullAccess,
-        writeRequest([
-          { optionId: "always-accept", name: "Always allow", kind: "allow_always" },
-          { optionId: "reject", name: "Deny", kind: "reject_once" },
-        ]),
-      ),
-      "ask",
+    // so the request goes to the user, whose card can still allow it.
+    const alwaysOnly = writeRequest([
+      { optionId: "always-accept", name: "Always allow", kind: "allow_always" },
+      { optionId: "reject", name: "Deny", kind: "reject_once" },
+    ]);
+    assert.equal(kiroPermissionDisposition(fullAccess, alwaysOnly), "ask");
+    assert.deepEqual(
+      kiroApprovalOptions(alwaysOnly).map((option) => option.decision),
+      ["acceptForSession", "decline", "cancel"],
     );
   });
 });
@@ -88,18 +88,21 @@ export function buildKiroAcpSpawnInput(
 }
 
 /**
- * Approval choices a Kiro permission request can honor. V3 sends its options
- * as authoritative, so only the kinds it offered appear. `allow_always` in V3
- * persists a consent rule (workspace or wider) rather than a session grant, so
- * it is not offered as "this session".
+ * Approval choices a Kiro permission request can honor; V3's options are
+ * authoritative. Its `allow_always` saves a consent rule for the workspace or
+ * wider, so it is offered, as "Always allow", only without a one-time choice.
  */
 export function kiroApprovalOptions(
   request: EffectAcpSchema.RequestPermissionRequest,
 ): ReadonlyArray<ProviderApprovalOption> {
   const has = (kind: EffectAcpSchema.PermissionOption["kind"]) =>
     request.options.some((option) => option.kind === kind && option.optionId.trim().length > 0);
   return [
-    ...(has("allow_once") ? [{ decision: "accept", label: "Allow once" } as const] : []),
+    ...(has("allow_once")
+      ? [{ decision: "accept", label: "Allow once" } as const]
+      : has("allow_always")
+        ? [{ decision: "acceptForSession", label: "Always allow" } as const]
+        : []),
     ...(has("reject_once") ? [{ decision: "decline", label: "Deny" } as const] : []),
     { decision: "cancel", label: "Cancel" },
   ];
 
@@ -1,5 +1,6 @@
 export { KIRO_PROVIDER, makeKiroAdapterV2, type KiroAdapterV2Options } from "./server/adapter.ts";
 export {
+  kiroApprovalOptions,
   kiroAutopilotValue,
   kiroPermissionDisposition,
   makeKiroAcpRuntime,