@erichll/pi-auto-review 0.13.0 → 0.15.0

package/src/policy-audit/report.ts

@@ -1,20 +1,33 @@
 import type { PolicyAuditAggregateRow, PolicyAuditQueryResult } from "./store.ts";
 
-export const POLICY_AUDIT_REPORT_VERSION = 1 as const;
+export const POLICY_AUDIT_REPORT_VERSION = 2 as const;
 
 export type PolicyAuditReportItem = { name: string; count: number; denied: number; denialRate: number };
+export type SuggestedAllowRule = {
+  surface: string; pattern?: string; action: "allow"; safetyClass: string;
+  successfulEvidence: number; denied: 0; rationale: string;
+};
+export type PolicyRecommendationItem = {
+  surface: string; pattern?: string; successfulEvidence: number; denied: number; reason: string;
+};
 
 export type PolicyAuditReport = {
   version: typeof POLICY_AUDIT_REPORT_VERSION;
   scope: "current" | "all";
   days: number;
   collectingSince: string;
+  recommendationsSince: string;
   fromDay: string;
   throughDay: string;
   total: number;
   allowed: number;
   denied: number;
   denialRate: number;
+  configTarget: string;
+  configFragment: string;
+  suggestedAllowRules: SuggestedAllowRule[];
+  keepAskRules: PolicyRecommendationItem[];
+  insufficientEvidence: PolicyRecommendationItem[];
   surfaces: PolicyAuditReportItem[];
   tools: PolicyAuditReportItem[];
   bashCategories: PolicyAuditReportItem[];
@@ -26,21 +39,21 @@ export type PolicyAuditReport = {
 };
 
 export type PolicyAuditReportOptions = {
-  scope: "current" | "all";
-  days: number;
-  top: number;
-  minCount: number;
+  scope: "current" | "all"; days: number; top: number; minCount: number;
 };
 
+const SUCCESS_RESOLUTIONS = new Set([
+  "user_approved", "user_approved_for_session", "session_approved", "auto_approved",
+]);
+const FAILURE_RESOLUTIONS = new Set(["confirmation_unavailable", "gate_error"]);
+
 function rate(denied: number, total: number): number {
   return total === 0 ? 0 : Math.round((denied / total) * 10_000) / 100;
 }
 
 function rank(
-  rows: readonly PolicyAuditAggregateRow[],
-  key: (row: PolicyAuditAggregateRow) => string,
-  top: number,
-  minCount: number,
+  rows: readonly PolicyAuditAggregateRow[], key: (row: PolicyAuditAggregateRow) => string,
+  top: number, minCount: number,
 ): PolicyAuditReportItem[] {
   const grouped = new Map<string, { count: number; denied: number }>();
   for (const row of rows) {
@@ -61,16 +74,128 @@ function reviewed(row: PolicyAuditAggregateRow): boolean {
   return ["user_approved", "user_approved_for_session", "user_denied", "auto_approved"].includes(row.resolution);
 }
 
+type CandidateGroup = {
+  surface: string; pattern?: string; safetyClass: string; successfulEvidence: number;
+  denied: number; blockers: Set<string>;
+};
+
+function recommendationGroups(rows: readonly PolicyAuditAggregateRow[]): CandidateGroup[] {
+  const groups = new Map<string, CandidateGroup>();
+  for (const row of rows) {
+    if (!row.candidateSurface) continue;
+    // Forwarded evidence is reported separately: it cannot prove either the
+    // current project's cwd or a safe global scope, and must not poison local
+    // evidence for the same observed candidate.
+    const key = `${row.candidateSurface}\0${row.candidatePattern}\0${row.forwarded ? "forwarded" : "local"}`;
+    const group = groups.get(key) ?? {
+      surface: row.candidateSurface,
+      ...(row.candidatePattern ? { pattern: row.candidatePattern } : {}),
+      safetyClass: row.candidateSafetyClass,
+      successfulEvidence: 0,
+      denied: 0,
+      blockers: new Set<string>(),
+    };
+    if (row.result === "allow" && SUCCESS_RESOLUTIONS.has(row.resolution)) group.successfulEvidence += row.count;
+    if (row.result === "deny") group.denied += row.count;
+    if (row.forwarded) group.blockers.add("forwarded requests lack the requesting cwd");
+    if (!row.candidateEligible) group.blockers.add(row.candidateBlocker || "unsafe or unparseable variant observed");
+    if (FAILURE_RESOLUTIONS.has(row.resolution)) group.blockers.add(`authorization failure: ${row.resolution}`);
+    groups.set(key, group);
+  }
+  return [...groups.values()].sort((a, b) =>
+    b.successfulEvidence - a.successfulEvidence || a.surface.localeCompare(b.surface) ||
+      (a.pattern ?? "").localeCompare(b.pattern ?? "")
+  );
+}
+
+function displayRule(item: { surface: string; pattern?: string }): string {
+  return item.pattern ? `${item.surface}[${JSON.stringify(item.pattern)}]` : item.surface;
+}
+
+function buildConfigFragment(rules: readonly SuggestedAllowRule[]): string {
+  const bash: Record<string, "allow"> = {};
+  const permission: Record<string, "allow" | Record<string, "allow">> = {};
+  for (const rule of rules) {
+    if (rule.surface === "bash" && rule.pattern) bash[rule.pattern] = "allow";
+  }
+  if (Object.keys(bash).length > 0) permission.bash = bash;
+  for (const rule of rules) {
+    if (rule.surface !== "bash") permission[rule.surface] = "allow";
+  }
+  return JSON.stringify({ permission }, null, 2);
+}
+
+function genericKeepAskRules(
+  rows: readonly PolicyAuditAggregateRow[], minCount: number, top: number,
+): PolicyRecommendationItem[] {
+  const grouped = new Map<string, { surface: string; risk: string; total: number; successful: number; denied: number }>();
+  for (const row of rows) {
+    if (row.candidateSurface) continue;
+    const surface = row.surface === "custom_tool" ? row.signature : `${row.surface}:${row.signature}`;
+    const key = `${surface}\0${row.risk}`;
+    const group = grouped.get(key) ?? { surface, risk: row.risk, total: 0, successful: 0, denied: 0 };
+    group.total += row.count;
+    if (row.result === "allow" && SUCCESS_RESOLUTIONS.has(row.resolution)) group.successful += row.count;
+    if (row.result === "deny") group.denied += row.count;
+    grouped.set(key, group);
+  }
+  return [...grouped.values()]
+    .filter((group) => group.total >= minCount)
+    .sort((a, b) => b.total - a.total || a.surface.localeCompare(b.surface))
+    .slice(0, top)
+    .map((group) => ({
+      surface: group.surface,
+      successfulEvidence: group.successful,
+      denied: group.denied,
+      reason: `${group.total} observed but no valid copyable permission rule could be derived (${group.risk})`,
+    }));
+}
+
 export function buildPolicyAuditReport(
-  result: PolicyAuditQueryResult,
-  options: PolicyAuditReportOptions,
+  result: PolicyAuditQueryResult, options: PolicyAuditReportOptions,
 ): PolicyAuditReport {
   const total = result.rows.reduce((sum, row) => sum + row.count, 0);
   const denied = result.rows.filter((row) => row.result === "deny").reduce((sum, row) => sum + row.count, 0);
   const lowRisk = result.rows.filter((row) => row.risk === "read_only" && reviewed(row));
-  const keepAsk = result.rows.filter((row) =>
-    ["workspace_mutation", "project_code_execution", "network", "network_mutation", "arbitrary_shell", "unknown"].includes(row.risk)
-  );
+  const keepAsk = result.rows.filter((row) => !row.candidateSurface);
+  const groups = recommendationGroups(result.rows);
+  const suggestedAllowRules: SuggestedAllowRule[] = groups
+    .filter((group) => group.successfulEvidence >= options.minCount && group.denied === 0 && group.blockers.size === 0)
+    .slice(0, options.top)
+    .map((group) => ({
+      surface: group.surface,
+      ...(group.pattern ? { pattern: group.pattern } : {}),
+      action: "allow",
+      safetyClass: group.safetyClass,
+      successfulEvidence: group.successfulEvidence,
+      denied: 0,
+      rationale: group.safetyClass === "observed_bash_template"
+        ? "observed Bash template; zero denials, failures, and structurally unsafe variants"
+        : "observed permission surface; zero denials and authorization failures",
+    }));
+  const candidateKeepAskRules: PolicyRecommendationItem[] = groups
+    .filter((group) => group.denied > 0 || group.blockers.size > 0)
+    .map((group) => ({
+      surface: group.surface,
+      ...(group.pattern ? { pattern: group.pattern } : {}),
+      successfulEvidence: group.successfulEvidence,
+      denied: group.denied,
+      reason: [group.denied ? `${group.denied} denied` : "", ...group.blockers].filter(Boolean).join("; "),
+    }));
+  const keepAskRules = [
+    ...candidateKeepAskRules,
+    ...genericKeepAskRules(keepAsk, options.minCount, options.top),
+  ].slice(0, options.top);
+  const insufficientEvidence: PolicyRecommendationItem[] = groups
+    .filter((group) => group.successfulEvidence > 0 && group.successfulEvidence < options.minCount && group.denied === 0 && group.blockers.size === 0)
+    .slice(0, options.top)
+    .map((group) => ({
+      surface: group.surface,
+      ...(group.pattern ? { pattern: group.pattern } : {}),
+      successfulEvidence: group.successfulEvidence,
+      denied: 0,
+      reason: `needs ${options.minCount - group.successfulEvidence} more successful ask-path sample(s)`,
+    }));
   const fingerprintCounts = new Map<string, number>();
   for (const row of result.rows) {
     if (row.ruleFingerprint === "none") continue;
@@ -78,8 +203,10 @@ export function buildPolicyAuditReport(
   }
   const warnings = [
     "Counts begin at first successful enablement; no historical logs are imported.",
+    "Suggestions are evidence-based decision aids and never modify permission configuration.",
+    "Migrated pre-v2 counts remain in statistics but cannot contribute recommendation evidence.",
     "Rule fingerprints are anonymous hit indicators, not proof that unlisted rules are unused.",
-    "High frequency alone must not be used to relax mutation, network, arbitrary-shell, unknown, or custom-tool policy.",
+    "A suggestion reflects repeated approval history, not an independent proof that the capability is safe.",
   ];
   if (total === 0) warnings.unshift("No matching permission decisions were collected for this window and scope.");
   return {
@@ -87,12 +214,20 @@ export function buildPolicyAuditReport(
     scope: options.scope,
     days: options.days,
     collectingSince: result.collectingSince,
+    recommendationsSince: result.recommendationsSince,
     fromDay: result.fromDay,
     throughDay: result.throughDay,
     total,
     allowed: total - denied,
     denied,
     denialRate: rate(denied, total),
+    configTarget: options.scope === "current"
+      ? ".pi/extensions/pi-permission-system/config.json"
+      : "~/.pi/agent/extensions/pi-permission-system/config.json",
+    configFragment: buildConfigFragment(suggestedAllowRules),
+    suggestedAllowRules,
+    keepAskRules,
+    insufficientEvidence,
     surfaces: rank(result.rows, (row) => row.surface, options.top, options.minCount),
     tools: rank(result.rows, (row) => row.signature, options.top, options.minCount),
     bashCategories: rank(result.rows.filter((row) => row.bashCategory !== "not_bash"), (row) => row.bashCategory, options.top, options.minCount),
@@ -108,33 +243,83 @@ export function buildPolicyAuditReport(
   };
 }
 
-function itemLines(items: readonly PolicyAuditReportItem[]): string[] {
+// Shared renderer helpers — kept terse so the TUI can fit one full report
+// on a typical screen without scrolling past statistics.
+type Row = { label: string; count: number; denied: number; denialRate: number };
+
+function itemLines(items: readonly Row[]): string[] {
   return items.length === 0
     ? ["- None above the minimum count."]
-    : items.map((item) => `- ${item.name}: ${item.count} (${item.denied} denied, ${item.denialRate}% denial)`);
+    : items.map((item) => `- ${item.label}: ${item.count} (${item.denied} denied, ${item.denialRate}% denial)`);
+}
+
+function recommendationLines(items: readonly PolicyRecommendationItem[]): string[] {
+  return items.length === 0
+    ? ["- None."]
+    : items.map((item) => `- ${displayRule(item)}: ${item.successfulEvidence} successful, ${item.denied} denied — ${item.reason}`);
+}
+
+// Compress the five "hotspot" rankings (surface / signature / bash category /
+// approval source / low-risk) into one table-like section. Each row keeps the
+// original three fields (count, denied, denial rate); zero-denied rows drop
+// the redundant denial-rate field so the eye can scan allowed-only traffic.
+function hotspotRow(item: PolicyAuditReportItem): string {
+  const denied = `${item.denied} denied`;
+  const rate = item.denied === 0 ? "" : `, ${item.denialRate}% denial`;
+  return `- ${item.name}: ${item.count} (${denied}${rate})`;
+}
+
+function renderHotspotSections(report: PolicyAuditReport): string[] {
+  // Approval sources already encodes the same count as surfaces via a
+  // different key, so skip it when nothing was denied — it is allowed-only
+  // noise in that case. Low-risk review candidates overlap with the generic
+  // keep-ask section and are dropped entirely; the keep-ask section is the
+  // authoritative place for "what still asks".
+  const groups: Array<{ title: string; items: PolicyAuditReportItem[] }> = [
+    { title: "Surface hotspots", items: report.surfaces },
+    { title: "Tool and command signatures", items: report.tools },
+    { title: "Bash semantic categories", items: report.bashCategories },
+  ];
+  if (report.approvalSources.some((item) => item.denied > 0)) {
+    groups.push({ title: "Approval sources with denials", items: report.approvalSources });
+  }
+  if (report.ruleFingerprints.length > 0) {
+    groups.push({ title: "Anonymous rule-hit fingerprints",
+      items: report.ruleFingerprints.map((f) => ({ name: f.fingerprint, count: f.count, denied: 0, denialRate: 0 })) });
+  }
+  return groups.flatMap((group) => ["", `## ${group.title}`, "", ...group.items.map(hotspotRow)]);
 }
 
 export function renderPolicyAuditMarkdown(report: PolicyAuditReport): string {
-  const fingerprints = report.ruleFingerprints.length === 0
-    ? ["- None above the minimum count."]
-    : report.ruleFingerprints.map((item) => `- ${item.fingerprint}: ${item.count}`);
+  const suggested = report.suggestedAllowRules.length === 0
+    ? ["- None."]
+    : report.suggestedAllowRules.map((item) =>
+      `- ${displayRule(item)} = allow: ${item.successfulEvidence} successful ask-path samples, zero denials — ${item.rationale}`
+    );
+  // The candidate keep-ask list (denied / blocked candidates) is the
+  // actionable one; the generic keep-ask and the ranked recommendations
+  // overlap heavily and are kept only as a single fallback line so the
+  // user sees they exist without a wall of duplicates.
+  const candidateKeepAsk = report.keepAskRules.filter((item) => item.denied > 0 ||
+    /denied|forwarded|unsafe|unparseable|authorization failure|parse_failed/i.test(item.reason));
+  const genericKeepAsk = report.keepAskRules.filter((item) => !candidateKeepAsk.includes(item));
+  const keepAskFallback = genericKeepAsk.length > 0
+    ? [`- ${genericKeepAsk.length} more surface(s) remain ask-by-default with no copyable rule; see full report for details.`]
+    : [];
   return [
-    "# Permission policy audit",
-    "",
+    "# Permission policy audit", "",
     `Scope: **${report.scope}** · Window: **${report.fromDay}–${report.throughDay}** · Collecting since: **${report.collectingSince}**`,
-    `Decisions: **${report.total}** · Allowed: **${report.allowed}** · Denied: **${report.denied}** · Denial rate: **${report.denialRate}%**`,
-    "",
-    "## Surface hotspots", "", ...itemLines(report.surfaces), "",
-    "## Tool and command signatures", "", ...itemLines(report.tools), "",
-    "## Bash semantic categories", "", ...itemLines(report.bashCategories), "",
-    "## Approval sources", "", ...itemLines(report.approvalSources), "",
-    "## Low-risk review candidates", "",
-    "These read-only requests were still reviewed; inspect them before considering a narrower allow rule.",
-    ...itemLines(report.lowRiskReviewCandidates), "",
-    "## Keep-ask recommendations", "",
-    "These mutation, execution, network, shell, or unknown requests should remain ask-by-default.",
-    ...itemLines(report.keepAskRecommendations), "",
-    "## Anonymous rule-hit fingerprints", "", ...fingerprints, "",
-    "## Warnings", "", ...report.warnings.map((warning) => `- ${warning}`),
+    `Decisions: **${report.total}** · Allowed: **${report.allowed}** · Denied: **${report.denied}** · Denial rate: **${report.denialRate}%**`, "",
+    "## Suggested allow rules", "", ...suggested, "",
+    "## Copyable permission config", "", `Target: \`${report.configTarget}\``,
+    "Place narrow allow entries after broader matching ask entries (last-match-wins).", "",
+    "```json", report.configFragment, "```", "",
+    "## Keep ask",
+    "Denied candidates, authorization failures, unsafe Bash variants, and forwarded requests remain ask-by-default.",
+    ...recommendationLines(candidateKeepAsk), ...keepAskFallback, "",
+    "## Insufficient evidence", "", ...recommendationLines(report.insufficientEvidence),
+    ...renderHotspotSections(report), "",
+    "## Warnings", "",
+    "- Suggestions are evidence-based decision aids and never modify permission configuration. See the package README for the full list of caveats.",
   ].join("\n");
 }

package/src/policy-audit/store.ts

@@ -12,7 +12,7 @@ import {
 import { dirname, join, resolve } from "node:path";
 import type { ClassifiedPermission } from "./classifier.ts";
 
-export const POLICY_AUDIT_SCHEMA_VERSION = 1;
+export const POLICY_AUDIT_SCHEMA_VERSION = 2;
 export const POLICY_AUDIT_DATABASE_NAME = "policy-audit.sqlite";
 export const POLICY_AUDIT_KEY_NAME = "policy-audit.key";
 
@@ -65,11 +65,17 @@ export type PolicyAuditAggregateRow = {
   forwarded: boolean;
   features: string;
   ruleFingerprint: string;
+  candidateSurface: string;
+  candidatePattern: string;
+  candidateSafetyClass: string;
+  candidateEligible: boolean;
+  candidateBlocker: string;
   count: number;
 };
 
 export type PolicyAuditQueryResult = {
   collectingSince: string;
+  recommendationsSince: string;
   fromDay: string;
   throughDay: string;
   rows: PolicyAuditAggregateRow[];
@@ -149,6 +155,22 @@ export class PolicyAuditStore {
         request_hash TEXT PRIMARY KEY,
         seen_day TEXT NOT NULL
       ) STRICT;
+    `);
+    const version = this.db.prepare("SELECT value FROM meta WHERE key='schema_version'").get()?.value;
+    const now = this.now().toISOString();
+    if (version !== undefined && version !== "1" && version !== String(POLICY_AUDIT_SCHEMA_VERSION)) {
+      throw new Error("unsupported policy audit schema version");
+    }
+    if (version === "1") this.migrateV1(now);
+    else this.createV2Table();
+    this.db.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES('schema_version',?)").run(String(POLICY_AUDIT_SCHEMA_VERSION));
+    this.db.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES('collecting_since',?)").run(now);
+    this.db.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES('recommendations_since',?)").run(now);
+    this.secureSidecars();
+  }
+
+  private createV2Table(): void {
+    this.db.exec(`
       CREATE TABLE IF NOT EXISTS daily_permission_stats (
         day TEXT NOT NULL,
         project_hash TEXT NOT NULL,
@@ -163,19 +185,45 @@ export class PolicyAuditStore {
         forwarded INTEGER NOT NULL,
         features TEXT NOT NULL,
         rule_fingerprint TEXT NOT NULL,
+        candidate_surface TEXT NOT NULL,
+        candidate_pattern TEXT NOT NULL,
+        candidate_safety_class TEXT NOT NULL,
+        candidate_eligible INTEGER NOT NULL,
+        candidate_blocker TEXT NOT NULL,
         count INTEGER NOT NULL,
-        PRIMARY KEY (day, project_hash, surface, signature, bash_category, risk, path_class, result, resolution, origin, forwarded, features, rule_fingerprint)
+        PRIMARY KEY (day, project_hash, surface, signature, bash_category, risk, path_class, result, resolution, origin, forwarded, features, rule_fingerprint, candidate_surface, candidate_pattern, candidate_safety_class, candidate_eligible, candidate_blocker)
       ) STRICT;
       CREATE INDEX IF NOT EXISTS daily_permission_stats_project_day ON daily_permission_stats(project_hash, day);
     `);
-    const version = this.db.prepare("SELECT value FROM meta WHERE key='schema_version'").get()?.value;
-    if (version !== undefined && version !== String(POLICY_AUDIT_SCHEMA_VERSION)) {
-      throw new Error("unsupported policy audit schema version");
+  }
+
+  private migrateV1(now: string): void {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      this.db.exec(`
+        CREATE TABLE daily_permission_stats_v2 (
+          day TEXT NOT NULL, project_hash TEXT NOT NULL, surface TEXT NOT NULL, signature TEXT NOT NULL,
+          bash_category TEXT NOT NULL, risk TEXT NOT NULL, path_class TEXT NOT NULL, result TEXT NOT NULL,
+          resolution TEXT NOT NULL, origin TEXT NOT NULL, forwarded INTEGER NOT NULL, features TEXT NOT NULL,
+          rule_fingerprint TEXT NOT NULL, candidate_surface TEXT NOT NULL, candidate_pattern TEXT NOT NULL,
+          candidate_safety_class TEXT NOT NULL, candidate_eligible INTEGER NOT NULL, candidate_blocker TEXT NOT NULL,
+          count INTEGER NOT NULL,
+          PRIMARY KEY (day, project_hash, surface, signature, bash_category, risk, path_class, result, resolution, origin, forwarded, features, rule_fingerprint, candidate_surface, candidate_pattern, candidate_safety_class, candidate_eligible, candidate_blocker)
+        ) STRICT;
+        INSERT INTO daily_permission_stats_v2
+          SELECT day,project_hash,surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,'','','',0,'',count
+          FROM daily_permission_stats;
+        DROP TABLE daily_permission_stats;
+        ALTER TABLE daily_permission_stats_v2 RENAME TO daily_permission_stats;
+        CREATE INDEX daily_permission_stats_project_day ON daily_permission_stats(project_hash, day);
+      `);
+      this.db.prepare("UPDATE meta SET value=? WHERE key='schema_version'").run(String(POLICY_AUDIT_SCHEMA_VERSION));
+      this.db.prepare("INSERT OR REPLACE INTO meta(key,value) VALUES('recommendations_since',?)").run(now);
+      this.db.exec("COMMIT");
+    } catch (error) {
+      try { this.db.exec("ROLLBACK"); } catch { /* preserve migration error */ }
+      throw error;
     }
-    const now = this.now().toISOString();
-    this.db.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES('schema_version',?)").run(String(POLICY_AUDIT_SCHEMA_VERSION));
-    this.db.prepare("INSERT OR IGNORE INTO meta(key,value) VALUES('collecting_since',?)").run(now);
-    this.secureSidecars();
   }
 
   private hash(kind: string, value: string): string {
@@ -219,8 +267,9 @@ export class PolicyAuditStore {
         }
         this.db.prepare(`
           INSERT INTO daily_permission_stats(
-            day,project_hash,surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,count
-          ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,1)
+            day,project_hash,surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,
+            candidate_surface,candidate_pattern,candidate_safety_class,candidate_eligible,candidate_blocker,count
+          ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1)
           ON CONFLICT DO UPDATE SET count=count+1
         `).run(
           day,
@@ -236,6 +285,11 @@ export class PolicyAuditStore {
           event.forwarded ? 1 : 0,
           event.features.join(","),
           this.ruleFingerprint(event.matchedPattern),
+          event.candidate?.surface ?? "",
+          event.candidate?.pattern ?? "",
+          event.candidate?.safetyClass ?? "",
+          event.candidate?.eligible ? 1 : 0,
+          event.candidate?.blocker ?? "",
         );
         this.db.exec("COMMIT");
         this.secureSidecars();
@@ -264,18 +318,24 @@ export class PolicyAuditStore {
       const params: unknown[] = [fromDay];
       if (input.scope === "current") params.push(this.projectHash(input.projectPath));
       const rows = this.db.prepare(`
-        SELECT surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,SUM(count) AS count
+        SELECT surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,
+          candidate_surface,candidate_pattern,candidate_safety_class,candidate_eligible,candidate_blocker,SUM(count) AS count
         FROM daily_permission_stats
         WHERE day >= ? ${projectClause}
-        GROUP BY surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint
+        GROUP BY surface,signature,bash_category,risk,path_class,result,resolution,origin,forwarded,features,rule_fingerprint,
+          candidate_surface,candidate_pattern,candidate_safety_class,candidate_eligible,candidate_blocker
       `).all(...params).map((row) => ({
         surface: String(row.surface), signature: String(row.signature), bashCategory: String(row.bash_category),
         risk: String(row.risk), pathClass: String(row.path_class), result: String(row.result),
         resolution: String(row.resolution), origin: String(row.origin), forwarded: Number(row.forwarded) === 1,
         features: String(row.features), ruleFingerprint: String(row.rule_fingerprint), count: Number(row.count),
+        candidateSurface: String(row.candidate_surface), candidatePattern: String(row.candidate_pattern),
+        candidateSafetyClass: String(row.candidate_safety_class), candidateEligible: Number(row.candidate_eligible) === 1,
+        candidateBlocker: String(row.candidate_blocker),
       }));
       const collectingSince = String(this.db.prepare("SELECT value FROM meta WHERE key='collecting_since'").get()?.value ?? "unknown");
-      return { collectingSince, fromDay, throughDay, rows };
+      const recommendationsSince = String(this.db.prepare("SELECT value FROM meta WHERE key='recommendations_since'").get()?.value ?? "unknown");
+      return { collectingSince, recommendationsSince, fromDay, throughDay, rows };
     });
   }
 

package/src/user-feedback.ts

@@ -543,9 +543,33 @@ export function notifyUserReview(
 }
 
 export type UserReviewWidgetData = UserReviewEntryData & {
-  phase: "reviewing" | "complete";
+  phase: "reviewing" | "waiting_user" | "complete";
 };
 
+/**
+ * Overlay shown while a `ctx.ui` prompt blocks the session during an active
+ * review. Without it the widget kept claiming "Waiting for <model>…" while
+ * pi was actually waiting on the user (permission dialog, /review-denials,
+ * break-glass challenge, ...). Driven by the notification-only
+ * `ui_prompt_start` / `ui_prompt_end` events (pi >= 0.84.4).
+ */
+export function buildUserWaitingWidgetData(input: {
+  kind?: unknown;
+  title?: unknown;
+}): UserReviewWidgetData {
+  const kind = typeof input.kind === "string" ? input.kind.trim() : "";
+  const title = typeof input.title === "string" ? input.title.trim() : "";
+  const label = truncateReviewText(title || kind || "input", 48);
+  return {
+    phase: "waiting_user",
+    outcome: "defer",
+    type: "info",
+    lines: joinNoticeLines([
+      `Auto-review · waiting for you · ${label}`,
+    ]),
+  };
+}
+
 export function buildUserReviewingWidgetData(input: {
   surface: string;
   target?: string;
@@ -582,10 +606,12 @@ export function renderUserReviewWidgetLines(
   const rendered: string[] = [];
   const verb = data.phase === "reviewing"
     ? "reviewing"
+    : data.phase === "waiting_user"
+    ? "waiting"
     : outcomeVerb(data.outcome);
-  const accent = data.phase === "reviewing"
-    ? "muted"
-    : outcomeAccent(data.outcome);
+  const accent = data.phase === "complete"
+    ? outcomeAccent(data.outcome)
+    : "muted";
   const verbAnsi = theme.getFgAnsi(accent);
   const mutedAnsi = theme.getFgAnsi("muted");
   for (const [index, line] of data.lines.entries()) {
@@ -629,6 +655,8 @@ function setWidget(
 /** Owns the single live widget and rejects stale concurrent completions. */
 export class UserReviewWidgetController {
   #generation = 0;
+  /** Set while a `ctx.ui` prompt blocks the session (ui_prompt span). */
+  #waiting?: { kind?: unknown; title?: unknown };
   #current?: {
     requestId: string;
     generation: number;
@@ -643,11 +671,38 @@ export class UserReviewWidgetController {
     input: { surface: string; target?: string; model?: string },
   ): number {
     const generation = ++this.#generation;
-    this.#current = { requestId, generation, ctx };
-    setWidget(ctx, buildUserReviewingWidgetData(input));
+    this.#current = { requestId, generation, ctx, data: buildUserReviewingWidgetData(input) };
+    this.#render();
     return generation;
   }
 
+  /**
+   * Flip the reviewing widget to a "waiting for you" state while a
+   * `ctx.ui` prompt blocks the session. Only overlays the reviewing phase:
+   * completed outcome summaries make no running claim, and without a live
+   * widget there is nothing misleading to correct.
+   */
+  promptStart(event: { kind?: unknown; title?: unknown }): void {
+    this.#waiting = { kind: event?.kind, title: event?.title };
+    this.#render();
+  }
+
+  promptEnd(): void {
+    if (!this.#waiting) return;
+    this.#waiting = undefined;
+    this.#render();
+  }
+
+  /** Single render path; ordering of begin/complete/prompt events is irrelevant. */
+  #render(): void {
+    const current = this.#current;
+    if (!current) return;
+    const data = this.#waiting && current.data?.phase === "reviewing"
+      ? buildUserWaitingWidgetData(this.#waiting)
+      : current.data;
+    if (data) setWidget(current.ctx, data);
+  }
+
   complete(
     requestId: string,
     generation: number,
@@ -689,6 +744,7 @@ export class UserReviewWidgetController {
 
   clear(ctx?: ExtensionContext): void {
     ++this.#generation;
+    this.#waiting = undefined;
     const current = this.#current;
     this.#current = undefined;
     if (current) setWidget(ctx ?? current.ctx, undefined);