@erichll/pi-auto-review 0.10.0 → 0.11.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.11.1 - 2026-08-25
+
+- Align the package version with `@erichll/pi-sandbox` `0.11.1`. No
+  pi-auto-review runtime or public API changes.
+
+## 0.11.0 - 2026-08-24
+
+- **Structured network destination.** Network approval requests now carry
+  separate host, port, and protocol fields alongside the existing combined
+  destination string. One-shot grants bind each component independently, so a
+  grant issued for one host-port-protocol combination cannot be reused for a
+  different one.
+- **Deferred reviews are more visible.** The review widget now highlights
+  deferred verdicts with a warning accent instead of the previous muted style,
+  making pending human decisions easier to spot.
+
 ## 0.10.0 - 2026-08-22
 
 - Replace the review footer and newly appended transcript entries with one

package/README.md

@@ -11,6 +11,20 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
 - authorizer: `pi-auto-review`
 - default reviewer model: `codex-auto-review`
 
+## Contents
+
+- [Install and enable](#install-and-enable)
+- [Security model](#security-model)
+- [Configuration](#configuration)
+  - [Deadlines and retries](#deadlines-and-retries)
+- [Operator feedback and exact retry](#operator-feedback-and-exact-retry)
+- [Boundary broker API](#boundary-broker-api)
+- [Reviewer context and token budgets](#reviewer-context-and-token-budgets)
+- [Sandbox integration](#sandbox-integration)
+- [Trust boundary](#trust-boundary)
+- [Telemetry](#telemetry)
+- [Real-model smoke test](#real-model-smoke-test)
+
 ## Install and enable
 
 > **Prerequisite:** pi-auto-review is an authorizer inside
@@ -23,7 +37,8 @@ pi install npm:@gotgenes/pi-permission-system
 pi install npm:@erichll/pi-auto-review
 ```
 
-Install the package outside the agent-writable workspace:
+Install the package outside the agent-writable workspace (see
+[Trust boundary](#trust-boundary)):
 
 Add it to the permission-system authorizer chain:
 
@@ -85,6 +100,12 @@ Use the user-global file for normal customization. It may set any legal key:
 }
 ```
 
+For a complete `@gotgenes/pi-permission-system` config that wires
+`pi-auto-review` into the authorizer chain — a copyable baseline covering
+read/write/edit, a read-only bash allowlist, an MCP discovery policy, and a
+`path` deny block for secret and credential files — see
+[`examples/pi-permission-system.config.example.json`](examples/pi-permission-system.config.example.json).
+
 Package defaults:
 
 ```json
@@ -292,7 +313,7 @@ Writes to the installed reviewer package, its user-global configuration,
 project and global security configuration, and the global audit directory are
 deterministically denied.
 
-## Telemetry and smoke testing
+## Telemetry
 
 Every actual model call emits an internal `review_attempt`; each approval emits
 one `review_complete`. Events contain stable status/error classes, timings,
@@ -301,6 +322,8 @@ prompt or response text, provider errors, credentials, headers, or URL query
 values. Usage is marked `unknown_provenance` when pi-ai cannot distinguish
 provider counters from initialized values, and `unavailable` when absent.
 
+## Real-model smoke test
+
 For a controlled real-model smoke test, load only the provider, reviewer,
 sandbox, and audit listener:
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.10.0",
-  "description": "Model-backed boundary approval broker for Pi",
+  "version": "0.11.1",
+  "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
   "keywords": [

package/src/broker/grants.ts

@@ -22,6 +22,9 @@ export function boundaryRequestHash(request: BoundaryRequest): string {
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,
+    destinationHost: request.destinationHost,
+    destinationPort: request.destinationPort,
+    destinationProtocol: request.destinationProtocol,
     toolCallId: request.toolCallId,
     toolName: request.toolName,
     skillName: request.skillName,

package/src/broker/types.ts

@@ -22,6 +22,9 @@ export type BoundaryRequest = {
   path?: string;
   resolvedPath?: string;
   destination?: string;
+  destinationHost?: string;
+  destinationPort?: number;
+  destinationProtocol?: string;
   toolCallId?: string;
   toolName?: string;
   skillName?: string;

package/src/index.ts

@@ -64,6 +64,8 @@ export {
   type SandboxNetworkTrap,
   type SandboxRequestContext,
 } from "./integrations/sandbox.ts";
+import { parseHostPort } from "./integrations/sandbox.ts";
+export { parseHostPort };
 
 type ReasoningLevel =
   | "off"
@@ -749,6 +751,7 @@ function boundaryRequest(
     typeof deterministicPolicy === "string"
       ? deterministicPolicy
       : JSON.stringify(deterministicPolicy);
+  const destParsed = parseHostPort(evidence.destination);
   return {
     id: details.requestId,
     source: "permission-system",
@@ -759,6 +762,8 @@ function boundaryRequest(
     path: evidence.path,
     resolvedPath: evidence.resolvedPath,
     destination: evidence.destination,
+    destinationHost: destParsed?.host,
+    destinationPort: destParsed?.port,
     toolCallId:
       typeof (details as unknown as Record<string, unknown>).toolCallId ===
       "string"

package/src/integrations/sandbox.ts

@@ -36,6 +36,21 @@ export type SandboxRequestContext = {
   agentName?: string;
 };
 
+export function parseHostPort(target: string | undefined): {
+  host: string;
+  port: number | undefined;
+} | undefined {
+  if (!target) return undefined;
+  const lastColon = target.lastIndexOf(":");
+  if (lastColon <= 0) return { host: target, port: undefined };
+  const portStr = target.slice(lastColon + 1);
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return { host: target, port: undefined };
+  }
+  return { host: target.slice(0, lastColon), port };
+}
+
 export function sandboxTrapToBoundaryRequest(
   trap: SandboxBoundaryTrap,
   context: SandboxRequestContext,
@@ -66,6 +81,7 @@ export function sandboxTrapToBoundaryRequest(
       },
     };
   }
+  const parsed = parseHostPort(trap.target);
   return {
     id,
     source: "sandbox-runtime",
@@ -74,6 +90,8 @@ export function sandboxTrapToBoundaryRequest(
     cwd: trap.process?.cwd || context.cwd,
     command: context.command,
     destination: trap.target,
+    destinationHost: parsed?.host,
+    destinationPort: parsed?.port,
     toolName: trap.process?.exe || undefined,
     agentName: context.agentName,
     matchedPolicy: { decision: "ask" },

package/src/policy.ts

@@ -156,6 +156,9 @@ export type RelevantBoundaryRequest = {
   path?: string;
   resolvedPath?: string;
   destination?: string;
+  destinationHost?: string;
+  destinationPort?: number;
+  destinationProtocol?: string;
   toolCallId?: string;
   toolName?: string;
   toolInputPreview?: string;
@@ -1098,6 +1101,9 @@ function toolArgumentCoveredByRequest(
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,
+    destinationHost: request.destinationHost,
+    destinationPort: request.destinationPort,
+    destinationProtocol: request.destinationProtocol,
     cwd: request.cwd,
     agentName: request.agentName,
     requesterSessionId: request.requesterSessionId,

package/src/user-feedback.ts

@@ -265,8 +265,10 @@ function outcomeAccent(
     case "auto_confirm":
     case "needs_confirmation":
       return "success";
+    // Deferred also warns: it awaits a human decision, so it must be clearly
+    // visible (theme warning) and stand out until resolved.
     case "defer":
-      return "muted";
+      return "warning";
     case "deny":
     case "circuit_breaker":
       return "warning";