@erichll/pi-auto-review 0.22.1 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # Changelog
 
+## 0.24.0 - 2026-10-03
+
+- Raise the `@earendil-works/pi-ai` and `@earendil-works/pi-coding-agent`
+  peer floors to `^1.0.0` and the development baselines to `^1.0.0`, plus
+  `@types/node` to `^26.6.4`. Raise the
+  `@gotgenes/pi-permission-system` development baseline to `^38.0.2`; the peer
+  floor stays `>=36.0.0`. Validated against Pi 1.0.0 with
+  pi-permission-system 38.0.2 via `tsc --noEmit` and the full test suite: no
+  source changes were required, and the authorizer seam this package consumes
+  is unchanged.
+- Move the example's Pi MCP tool rules under `mcp` (`mcp__atlassian__*`,
+  `mcp__pencil__*`) and update the README's MCP guidance to match, because
+  pi-permission-system 38.0.0 gates Pi's built-in MCP tools on the `mcp`
+  surface instead of their top-level names.
+
+## 0.23.0 - 2026-10-02
+
+- Add opt-in `model: "current"` to review approval requests with the active Pi
+  session model and provider, reflecting model changes on subsequent reviews.
+- Decide, authorize, and hard-deny on the command that will actually execute,
+  not only the rule-matched unit. The permission-system ask payload is now
+  normalized into `executedUnit` (what a sudo/env/xargs/inline-shell wrapper
+  runs), `fullCommand` (the whole program), and `matchedPattern` (the rule or a
+  sentinel such as `<opaque-bash-wrapper>`), and those facts flow into the
+  reviewer context and the public `BoundaryRequest`.
+- Split deterministic hard denies by family. Structural rules (recursive forced
+  wipes of `/`, `~`, or `$HOME`, and TLS/certificate weakening) scan a
+  skeleton with quoted literals masked, plus nested shell payloads (`bash -c`,
+  `eval`), including shells with options before `-c`. Literal path components
+  retain placeholders so named cleanup targets cannot become root/home wipes.
+  Other interpreter payloads (`python -c`, `node -e`, `perl -e`, `ruby -e`) and
+  heredoc bodies stay raw because shell quoting cannot establish whether their
+  strings execute. Inert mentions in shell commit messages and `echo` arguments
+  remain excluded. Hard denies scan the full program, outer unit, and executed
+  unit independently, preserving wrapper environment settings. Credential and
+  redirect rules keep scanning raw text, including quoted credential operands.
+- Bound nested interpreter expansion to 32 payloads and 32 KiB of cumulative
+  payload text per command fact, shared across recursion levels. Lazy
+  extraction stops repeated `eval` chains from producing megabytes of
+  overlapping suffixes. On exhaustion, raw-command hard denies retain priority;
+  otherwise the request defers to a human without calling the model, including
+  on a trusted reviewer retry.
+- Bind grants and the exact-retry match to the execution text, so two different
+  heredoc bodies gated by the same wrapper unit no longer share one request
+  hash. Denial labels and surface inference (`git-push`, `delete`) use the same
+  text.
+- Bound the reviewer view: `command`, `executedUnit`, and `fullCommand` are each
+  cut to 10 KiB, and any cut sets `fullCommandTruncated`. An incomplete program
+  now deterministically defers to a human before the model is called; a trusted
+  exact-retry override still reaches the reviewer, and local hard denies keep
+  priority. Hashing, hard denies, retry matching, and denial labels always use
+  the untruncated text.
+
 ## 0.22.1 - 2026-10-01
 
 - Fix permission-policy auditing being disabled on Bun with

package/README.md

@@ -31,8 +31,9 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
 > **Prerequisite:** pi-auto-review is an authorizer inside
 > `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
 > install the permission system separately (once per machine) before this
-> extension. This release line requires Pi 0.99.1 or later and supports
-> permission-system 36.0.0 and later:
+> extension. This release line requires Pi 1.0.0 or later and supports
+> permission-system 36.0.0 and later (development baseline validated against
+> permission-system 38.0.2):
 
 Node-based Pi requires Node.js 22.13.0 or newer. Permission auditing uses the
 host runtime's built-in SQLite: `node:sqlite` on Node and `bun:sqlite` on Bun,
@@ -95,6 +96,24 @@ Deterministic hard denies cover recursive forced wipes of `/`, `~`, and
 `$HOME`. A named path under `/home/...` is reviewed by the model as high-risk,
 not treated as a home-directory wipe.
 
+Review and authorization use the command that will actually execute, not only
+the unit the matched rule names. When a wrapper (`sudo`, `env`, `xargs`,
+`bash -c`, `eval`, or an interpreter payload) hides the real program, the
+permission-system ask payload supplies the executed unit, the complete command,
+and the matched rule, and those facts are what get hashed, reviewed, and
+hard-denied. Hard denies check the complete command, outer unit, and executed
+unit independently. Structural rules mask inert shell literals without turning
+named paths into root/home targets, and follow nested shell payloads. Other
+interpreter payloads and heredoc bodies are conservatively scanned as raw text;
+credential rules also keep scanning raw text. When a command fact exceeds the
+reviewer bound (10 KiB), the ask defers to a human instead of being reviewed from
+a truncated program.
+
+Nested interpreter expansion is limited to 32 payloads and 32 KiB of cumulative
+payload text per command fact, across all recursion levels. Exceeding either
+budget keeps the raw-command hard-deny checks and otherwise defers to a human
+without calling the model. A reviewer-retry override does not bypass this limit.
+
 ## Configuration
 
 Configuration is resolved in this order:
@@ -113,21 +132,45 @@ Use the user-global file for normal customization. It may set any legal key:
 }
 ```
 
+To use the model currently selected in the Pi session, set the trusted
+user-global config to:
+
+```json
+{
+  "model": "current"
+}
+```
+
+Each review reads the active session model, including its provider, so changing
+models during a session affects subsequent approval reviews. Retries within
+one review use the same selected model. Reviewer reasoning, token limits, and
+timeouts still come from this extension's configuration.
+
+The reviewer makes a separate provider request without tools and uses Pi's
+authentication resolution. If no session model is selected, authentication
+fails, or the provider cannot serve this auxiliary request, the existing
+`failureMode` applies (`"deny"` by default, or `"defer"` to the human terminal).
+The default remains `"codex-auto-review"`; explicit model IDs and
+`"provider/reviewer-model"` values continue to select a dedicated reviewer.
+The bare value `"current"` is reserved for this mode; use `"provider/current"`
+to select a model whose ID is literally `current`.
+
 For a complete `@gotgenes/pi-permission-system` config that wires
 `pi-auto-review` into the authorizer chain — a copyable baseline covering
-read/write/edit, a read-only bash allowlist, an MCP discovery policy, and a
+read/write/edit, a read-only bash allowlist, MCP tool access, and a
 `path` deny block for secret and credential files — see
 [`examples/pi-permission-system.config.example.json`](examples/pi-permission-system.config.example.json).
 
-MCP rules are evaluated last-match-wins across the candidates derived for one
-call: the tool name, its bare server, and `mcp_call`. Keep `"*"` first in the
-`mcp` block and narrower server or tool entries after it, as the example does,
-so a specific rule cannot be shadowed by the catch-all. A bare server entry
-such as `"atlassian": "allow"` also matches the `mcp connect <server>`
-candidate list, so it auto-allows starting that server — prefer the `server_*`
-and `server:*` forms for tool calls. Any entry meant to narrow a broad allow
-(such as a destructive-tool pattern) must be written after it, or
-last-match-wins shadows it.
+Permission-system 38.0.0 gates Pi's built-in MCP tools on the `mcp` surface, so
+the example writes its `mcp__<server>__*` rules inside a `mcp` block instead of
+as top-level tool names. MCP rules are evaluated last-match-wins across the
+candidates derived for one call: the tool name, its bare server, and `mcp_call`.
+A call the `mcp` block does not match falls through to the universal
+`"*": "ask"`, and any broad catch-all must be written before a narrower
+override or last-match-wins shadows it. A bare server entry such as
+`"atlassian": "allow"` also matches the `mcp connect <server>` candidate list,
+so it auto-allows starting that server — prefer the `server_*` and `server:*`
+forms for tool calls.
 
 Package defaults:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.22.1",
+  "version": "0.24.0",
   "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
@@ -47,16 +47,16 @@
     "test": "node --disable-warning=ExperimentalWarning --experimental-transform-types --import ./test/register-external-ts.mjs --test test/*.test.ts"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "^0.99.1",
-    "@earendil-works/pi-coding-agent": "^0.99.1",
+    "@earendil-works/pi-ai": "^1.0.0",
+    "@earendil-works/pi-coding-agent": "^1.0.0",
     "@gotgenes/pi-permission-system": ">=36.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.99.1",
-    "@earendil-works/pi-coding-agent": "^0.99.1",
-    "@earendil-works/pi-server": "^0.99.1",
-    "@gotgenes/pi-permission-system": "^36.0.0",
-    "@types/node": "^26.6.2",
+    "@earendil-works/pi-ai": "^1.0.0",
+    "@earendil-works/pi-coding-agent": "^1.0.0",
+    "@earendil-works/pi-server": "^1.0.0",
+    "@gotgenes/pi-permission-system": "^38.0.2",
+    "@types/node": "^26.6.4",
     "typescript": "^7.0.2"
   }
 }

package/src/broker/grants.ts

@@ -22,6 +22,9 @@ export function boundaryRequestHash(request: BoundaryRequest): string {
     operation: request.operation,
     cwd: request.cwd,
     command: request.command,
+    executedUnit: request.executedUnit,
+    fullCommand: request.fullCommand,
+    matchedPattern: request.matchedPattern,
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,

package/src/broker/types.ts

@@ -19,6 +19,17 @@ export type BoundaryRequest = {
   operation: string;
   cwd: string;
   command?: string;
+  /** Command the rule-matched unit actually runs after unwrapping a wrapper. */
+  executedUnit?: string;
+  /** The complete program that will execute, when it differs from `command`. */
+  fullCommand?: string;
+  /** Rule (or synthetic sentinel) that produced this ask. */
+  matchedPattern?: string;
+  /**
+   * Set only on the bounded reviewer view when a command fact was truncated;
+   * never set on the stored request used for hashing or hard denies.
+   */
+  fullCommandTruncated?: boolean;
   path?: string;
   resolvedPath?: string;
   destination?: string;

package/src/index.ts

@@ -41,7 +41,7 @@ export {
   buildUserReviewStatus,
 } from "./user-feedback.ts";
 
-export { parseDecision } from "./policy.ts";
+export { executionText, parseDecision } from "./policy.ts";
 export * from "./broker/index.ts";
 export {
   sandboxTrapToBoundaryRequest,
@@ -353,6 +353,9 @@ export function createPiAutoReviewExtension(
         deterministicHardDeny({
           surface: "bash_escalated",
           command: request.command,
+          executedUnit: request.executedUnit,
+          fullCommand: request.fullCommand,
+          matchedPattern: request.matchedPattern,
           path: request.path,
           target: request.destination,
           toolName: request.toolName,

package/src/policy.ts

@@ -1,4 +1,8 @@
 import { isPathSurface } from "./path-surfaces.ts";
+import {
+  shellExpansionLimitExceeded,
+  structuralScanText,
+} from "./review/shell-text.ts";
 
 export type RiskLevel = "low" | "medium" | "high" | "critical";
 
@@ -21,12 +25,21 @@ export type PermissionDetailsLike = {
   toolInputPreview?: unknown;
   accessIntent?: unknown;
   forwarding?: unknown;
+  /** Structured permission-system ask; the only source of the execution facts. */
+  payload?: unknown;
+  /** Pre-projected execution facts (broker hard-deny entry). */
+  executedUnit?: unknown;
+  fullCommand?: unknown;
+  matchedPattern?: unknown;
 };
 
 export type NormalizedPermissionEvidence = {
   surface: string;
   value?: string;
   command?: string;
+  executedUnit?: string;
+  fullCommand?: string;
+  matchedPattern?: string;
   path?: string;
   resolvedPath?: string;
   destination?: string;
@@ -155,6 +168,9 @@ export type RelevantBoundaryRequest = {
   operation?: string;
   cwd?: string;
   command?: string;
+  executedUnit?: string;
+  fullCommand?: string;
+  matchedPattern?: string;
   path?: string;
   resolvedPath?: string;
   destination?: string;
@@ -310,6 +326,20 @@ function parsedPreviewCommand(value: unknown): string | undefined {
   }
 }
 
+function payloadFullCommand(
+  payload: Record<string, unknown> | undefined,
+): string | undefined {
+  const evidence = payload?.evidence;
+  if (!Array.isArray(evidence)) return undefined;
+  for (const entry of evidence) {
+    const candidate = record(entry);
+    if (candidate?.label !== "full command") continue;
+    const text = nonEmptyString(candidate.text);
+    if (text) return text;
+  }
+  return undefined;
+}
+
 /** Normalize direct and forwarded permission-system evidence without trusting it. */
 export function normalizePermissionEvidence(
   details: PermissionDetailsLike,
@@ -355,10 +385,33 @@ export function normalizePermissionEvidence(
     nonEmptyString(details.agentName) ??
     nonEmptyString(forwarding?.requesterAgentName);
   const sessionId = nonEmptyString(forwarding?.requesterSessionId);
+  const payload = record(details.payload);
+  const payloadRequest = record(payload?.request);
+  const matchedPattern =
+    nonEmptyString(payloadRequest?.matchedPattern) ??
+    nonEmptyString(details.matchedPattern);
+  const executedUnitCandidate =
+    nonEmptyString(payloadRequest?.executedUnit) ??
+    nonEmptyString(details.executedUnit);
+  const fullCommandCandidate =
+    payloadFullCommand(payload) ?? nonEmptyString(details.fullCommand);
+  // Suppress facts that add nothing over the gated unit: duplicating the same
+  // text would only widen the reviewer view and add hash noise.
+  const executedUnit =
+    executedUnitCandidate && executedUnitCandidate !== value
+      ? executedUnitCandidate
+      : undefined;
+  const fullCommand =
+    fullCommandCandidate && fullCommandCandidate !== command
+      ? fullCommandCandidate
+      : undefined;
   return {
     surface,
     value,
     command,
+    ...(executedUnit ? { executedUnit } : {}),
+    ...(fullCommand ? { fullCommand } : {}),
+    ...(matchedPattern ? { matchedPattern } : {}),
     path,
     resolvedPath: accessIntent?.boundaryValue,
     destination,
@@ -368,6 +421,22 @@ export function normalizePermissionEvidence(
   };
 }
 
+/**
+ * The text that will actually execute, most complete fact first.
+ *
+ * Used for transcript matching, denial labels, and surface inference. Keep
+ * the outer command ahead of its extracted payload: wrapper options and
+ * environment assignments are part of execution too. Hard denies scan all
+ * three facts independently, and grant hashes bind all three.
+ */
+export function executionText(source: {
+  command?: string;
+  executedUnit?: string;
+  fullCommand?: string;
+}): string | undefined {
+  return source.fullCommand ?? source.command ?? source.executedUnit;
+}
+
 export function effectiveCommand(details: PermissionDetailsLike): string | undefined {
   return normalizePermissionEvidence(details).command;
 }
@@ -377,6 +446,20 @@ export type HardDeny = {
   reason: string;
 };
 
+function executionCommands(details: PermissionDetailsLike): string[] {
+  const evidence = normalizePermissionEvidence(details);
+  return [...new Set([
+    evidence.fullCommand,
+    evidence.command,
+    evidence.executedUnit,
+  ].flatMap((command) => command?.trim() ? [command.trim()] : []))];
+}
+
+/** Hard denies run first; incomplete expansion then requires a human decision. */
+export function commandExpansionLimitExceeded(details: PermissionDetailsLike): boolean {
+  return executionCommands(details).some(shellExpansionLimitExceeded);
+}
+
 /**
  * Keep this list narrow: these checks are terminal and cannot be overridden by
  * the model or the user prompt. Ambiguous or merely high-risk actions belong in
@@ -385,10 +468,26 @@ export type HardDeny = {
 export function deterministicHardDeny(
   details: PermissionDetailsLike,
 ): HardDeny | undefined {
-  const command = effectiveCommand(details)?.trim();
-  if (!command) return undefined;
+  // These facts are complementary. Unwrapping can omit an env assignment,
+  // while the full program can contain syntax our shell scanner cannot peel.
+  // Scan independently so unrelated projections cannot form a synthetic pipe
+  // or staged credential upload when concatenated.
+  for (const command of executionCommands(details)) {
+    const denial = hardDenyCommand(command);
+    if (denial) return denial;
+  }
+  return undefined;
+}
 
-  for (const segment of command.split(/&&|\|\||;|\n/)) {
+function hardDenyCommand(command: string): HardDeny | undefined {
+  // Structural rules run on the literal-masked skeleton so a literal mention
+  // inside a commit message or an `echo` argument is not a wipe, while nested
+  // interpreter payloads are still scanned. Credential/data rules below stay
+  // on the raw text: a quoted `"$HOME/.aws/credentials"` is still the operand
+  // of a real upload.
+  const structural = structuralScanText(command);
+
+  for (const segment of structural.split(/&&|\|\||;|\n/)) {
     const isRm = /(?:^|\s)(?:\/[^\s/]+)*\/?rm(?:\s|$)/i.test(segment);
     const recursive =
       /(?:^|\s)--recursive(?:\s|$)/i.test(segment) ||
@@ -411,12 +510,12 @@ export function deterministicHardDeny(
 
   if (
     /\bcurl\b[^;\n]*(?:--insecure\b|-[A-Za-z]*k[A-Za-z]*(?:\s|$))/i.test(
-      command,
+      structural,
     ) ||
-    /\bwget\b[^;\n]*--no-check-certificate\b/i.test(command) ||
-    /\bgit\s+config\b[^;\n]*http\.sslverify\s+false\b/i.test(command) ||
-    /\bnpm\s+config\s+set\s+strict-ssl\s+false\b/i.test(command) ||
-    /\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0\b/i.test(command)
+    /\bwget\b[^;\n]*--no-check-certificate\b/i.test(structural) ||
+    /\bgit\s+config\b[^;\n]*http\.sslverify\s+false\b/i.test(structural) ||
+    /\bnpm\s+config\s+set\s+strict-ssl\s+false\b/i.test(structural) ||
+    /\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0\b/i.test(structural)
   ) {
     return {
       rule: "transport-security-weakening",
@@ -840,7 +939,7 @@ function relevanceReason(
   | "provider-branch-protection"
   | undefined {
   if (request.toolCallId && call.id === request.toolCallId) return "same-tool";
-  const currentCommand = request.command || "";
+  const currentCommand = executionText(request) || "";
   const priorCommand = commandArgument(call);
   const pushedBranch = explicitPushBranch(currentCommand);
   const providerQuery = providerBranchQuery(priorCommand);
@@ -997,8 +1096,9 @@ function surfaceProfile(
 ): EvidenceSurfaceProfile {
   if (request.agentName || request.requesterSessionId) return "forwarded";
   if (request.surface === "network" || request.destination) return "network";
-  if (/\bgit\b[\s\S]*\bpush\b/i.test(request.command ?? "")) return "git-push";
-  if (/\b(?:rm|rmdir|unlink|trash|delete)\b/i.test(request.command ?? "")) {
+  const command = executionText(request) ?? "";
+  if (/\bgit\b[\s\S]*\bpush\b/i.test(command)) return "git-push";
+  if (/\b(?:rm|rmdir|unlink|trash|delete)\b/i.test(command)) {
     return "delete";
   }
   return "generic";
@@ -1043,7 +1143,7 @@ function exactStructuredMatch(
   }
   const args = call.arguments as Record<string, unknown>;
   const pairs: Array<[unknown, unknown]> = [
-    [args.command, request.command],
+    [args.command, executionText(request)],
     [args.path, request.path],
     [args.resolvedPath, request.resolvedPath],
     [args.destination, request.destination],
@@ -1100,7 +1200,7 @@ function toolArgumentCoveredByRequest(
     return sameReviewerField(actual, request.destination ?? request.path);
   }
   if (key === "value") {
-    return [request.command, request.path, request.destination].some(
+    return [executionText(request), request.path, request.destination].some(
       (expected) => sameReviewerField(actual, expected),
     );
   }
@@ -1112,7 +1212,7 @@ function toolArgumentCoveredByRequest(
     });
   }
   const expected = ({
-    command: request.command,
+    command: executionText(request),
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,

package/src/review/complete.ts

@@ -4,6 +4,8 @@ import {
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   buildClassifierTranscript,
+  commandExpansionLimitExceeded,
+  executionText,
   parseDecision,
   type ModelDecision,
 } from "../policy.ts";
@@ -29,6 +31,7 @@ import {
   applyReviewerInputBudget,
   preflightPart,
   reviewPreflight,
+  reviewerRequestView,
   sharedReviewContext,
   textFromAssistant,
 } from "./input.ts";
@@ -87,6 +90,37 @@ export async function complete(
     sharedContext,
     config.maxReviewerInputTokens,
   );
+  // Hard denies already ran on the raw text plus bounded payloads. An
+  // incomplete expansion must reach the human terminal, even with a trusted
+  // reviewer-retry override. The older display-truncation fallback can still
+  // be lifted by that override.
+  const deferralReason = commandExpansionLimitExceeded(request)
+    ? "Nested command expansion exceeds the local scan budget; a human must decide."
+    : reviewerRequestView(request).fullCommandTruncated && !reviewerContext?.userOverride
+      ? "The complete command exceeds the reviewer input bound and was truncated; a human must decide."
+      : undefined;
+  if (deferralReason) {
+    const deferredSummary: ReviewExecutionSummary = {
+      attempts: [],
+      errorCounts: {},
+      durationMs: Date.now() - started,
+      transcript,
+      preflight,
+    };
+    return {
+      decision: {
+        outcome: "defer",
+        risk_level: "high",
+        user_authorization: "unknown",
+        rationale: deferralReason,
+      },
+      attempts: 0,
+      retryErrors: [],
+      durationMs: deferredSummary.durationMs,
+      transcript,
+      summary: deferredSummary,
+    };
+  }
   const deadlineAt = started + config.timeoutMs;
   const controller = new AbortController();
   const onSessionAbort = () => controller.abort();
@@ -338,10 +372,9 @@ export function denialLabel(
     denial.request.resolvedPath ??
     denial.request.path ??
     denial.request.destination ??
-    denial.request.command ??
+    executionText(denial.request) ??
     denial.request.toolName ??
     denial.request.operation;
   const compact = String(target).replace(/\s+/g, " ").slice(0, 90);
   return `${index + 1}. ${denial.request.surface}: ${compact} — ${denial.review.rationale.slice(0, 70)}`;
 }
-

package/src/review/config.ts

@@ -70,7 +70,7 @@ export function validateConfig(value: unknown, source: string): Config {
     config.model.split("/").some((segment) => !segment.trim())
   ) {
     throw new Error(
-      `${EXTENSION_NAME}: model must be a model id or provider/model`,
+      `${EXTENSION_NAME}: model must be current, a model id, or provider/model`,
     );
   }
   if (

package/src/review/input.ts

@@ -27,6 +27,10 @@ import {
   REVIEWER_FRAMING_RESERVE_TOKENS,
 } from "./consts.ts";
 import { REVIEWER_SYSTEM_PROMPT } from "./prompts.ts";
+import {
+  MAX_REVIEWER_COMMAND_BYTES,
+  truncateUtf8,
+} from "./shell-text.ts";
 import { applyProjectConfig } from "./config.ts";
 import { assertTrustedInstallation } from "./guards.ts";
 
@@ -110,6 +114,11 @@ export function boundaryRequest(
     operation: details.source || surface,
     cwd: ctx.cwd,
     command: evidence.command,
+    ...(evidence.executedUnit ? { executedUnit: evidence.executedUnit } : {}),
+    ...(evidence.fullCommand ? { fullCommand: evidence.fullCommand } : {}),
+    ...(evidence.matchedPattern
+      ? { matchedPattern: evidence.matchedPattern }
+      : {}),
     path: evidence.path,
     resolvedPath: evidence.resolvedPath,
     destination: evidence.destination,
@@ -184,10 +193,43 @@ export function sharedReviewContext(
         }
       : {}),
     profile: transcript.surfaceProfile,
-    request,
+    request: reviewerRequestView(request),
   });
 }
 
+/**
+ * The bounded projection of a request that the reviewer model sees.
+ *
+ * `command`, `executedUnit`, and `fullCommand` are each cut to
+ * {@link MAX_REVIEWER_COMMAND_BYTES}; any cut sets `fullCommandTruncated` so the
+ * caller can fail closed instead of reviewing an incomplete program. Hashing,
+ * hard denies, retry matching, and denial labels keep using the untruncated
+ * request.
+ */
+export function reviewerRequestView(request: BoundaryRequest): BoundaryRequest {
+  let truncated = false;
+  const cut = (value: string | undefined): string | undefined => {
+    if (value === undefined) return undefined;
+    if (Buffer.byteLength(value, "utf8") <= MAX_REVIEWER_COMMAND_BYTES) {
+      return value;
+    }
+    truncated = true;
+    return truncateUtf8(value, MAX_REVIEWER_COMMAND_BYTES);
+  };
+  const view: BoundaryRequest = { ...request };
+  const command = cut(request.command);
+  const executedUnit = cut(request.executedUnit);
+  const fullCommand = cut(request.fullCommand);
+  if (command === undefined) delete view.command;
+  else view.command = command;
+  if (executedUnit === undefined) delete view.executedUnit;
+  else view.executedUnit = executedUnit;
+  if (fullCommand === undefined) delete view.fullCommand;
+  else view.fullCommand = fullCommand;
+  if (truncated) view.fullCommandTruncated = true;
+  return view;
+}
+
 /**
  * Conservative token estimate for reviewer prompt sizing.
  *
@@ -255,7 +297,9 @@ export function reviewPreflight(
   maxReviewerInputTokens: number,
 ): ReviewPreflight {
   const fixedPrompt = preflightPart(REVIEWER_SYSTEM_PROMPT);
-  const canonicalRequest = preflightPart(canonicalReviewerJson(request));
+  const canonicalRequest = preflightPart(
+    canonicalReviewerJson(reviewerRequestView(request)),
+  );
   const override = preflightPart(
     reviewerContext?.userOverride
       ? canonicalReviewerJson(reviewerContext.userOverride)

package/src/review/prompts.ts

@@ -19,6 +19,12 @@ Policy:
   a sandbox boundary.
 - Defer when a human must decide or evidence is missing, conflicting,
   truncated, or materially uncertain. User intent cannot override a hard deny.
+- Request facts: command is the rule-matched unit; executedUnit is what that
+  unit runs after unwrapping sudo/env/xargs/inline shells; fullCommand is the
+  whole program; matchedPattern names the rule or a sentinel such as
+  <opaque-bash-wrapper>, <indirection-bash-wrapper>, or <unparsed-bash-subtree>.
+  When fullCommandTruncated is true or a wrapper payload is unresolved, defer;
+  never assume unseen text is safe.
 
 Return exactly one JSON object and no markdown:
 {"outcome":"allow|deny|defer","risk_level":"low|medium|high|critical","user_authorization":"unknown|low|medium|high","rationale":"short concrete reason"}

package/src/review/provider.ts

@@ -469,11 +469,11 @@ export function reviewerSessionId(
   return `pi-auto-review-${fingerprint}`;
 }
 
-export async function resolveReviewerMeta(
+function resolveConfiguredModel(
   ctx: ExtensionContext,
-  config: Config,
-): Promise<ReviewerMeta> {
-  const { provider, modelId } = parseModelRef(config.model);
+  modelRef: string,
+): ReviewerMeta["model"] {
+  const { provider, modelId } = parseModelRef(modelRef);
   const available = ctx.modelRegistry.getAvailable();
   const registeredModel = provider
     ? ctx.modelRegistry.find(provider, modelId)
@@ -492,10 +492,23 @@ export async function resolveReviewerMeta(
   if (!model) {
     throw new Error(
       provider
-        ? `provider ${provider} is unavailable for custom model ${config.model}`
-        : `model ${config.model} is unavailable`,
+        ? `provider ${provider} is unavailable for custom model ${modelRef}`
+        : `model ${modelRef} is unavailable`,
     );
   }
+  return model;
+}
+
+export async function resolveReviewerMeta(
+  ctx: ExtensionContext,
+  config: Config,
+): Promise<ReviewerMeta> {
+  // Pi exposes model as a live getter, including on the retained session
+  // context. Read it once per review and keep retries on that same model.
+  const model = config.model === "current"
+    ? ctx.model
+    : resolveConfiguredModel(ctx, config.model);
+  if (!model) throw new Error("current Pi session model is unavailable");
 
   const registered = (
     ctx.modelRegistry as ExtensionContext["modelRegistry"] & {
@@ -513,7 +526,7 @@ export async function resolveReviewerMeta(
   return {
     model,
     streamSimple:
-      registered?.api === model.api ? registered.streamSimple : undefined,
+      registered && registered.api === model.api ? registered.streamSimple : undefined,
   };
 }
 
@@ -572,6 +585,8 @@ export async function modelCall(
       metadata.retryAfterMs = parseRetryAfterMs(response.headers);
     },
   };
+  // Call the provider directly with no tools, outside Pi's agent/tool loop,
+  // so using the session model cannot re-enter permission review.
   // 0.86 moved the provider-facing request to a normalized transcript: the
   // system prompt and tool declarations now travel as the transcript's leading
   // system message. Providers registered by extensions receive that shape, so

package/src/review/shell-text.ts

@@ -0,0 +1,496 @@
+/**
+ * Shell-text helpers for the deterministic hard-deny scan.
+ *
+ * `@gotgenes/pi-permission-system` decides one *command unit* at a time, so a
+ * wrapper such as `bash -c "…"`, `sudo …`, or `python3 - <<'PY'` reports only
+ * the wrapper as the gated command while the payload carries the program that
+ * actually runs. The reviewer and the deterministic rules need a bounded view
+ * of that real execution text.
+ *
+ * `structuralScanText` builds the "skeleton" used by structural rules
+ * (destructive deletion, transport weakening): quoted literals that merely
+ * *mention* a dangerous command are inert data and are masked, while shell
+ * expansions (`$HOME`, `$(…)`, backticks) and target-significant characters
+ * (`/`, `*`, `~`) are preserved because a quoted value can still be the target
+ * of a real command. Literal placeholders keep named paths from collapsing
+ * into root/home targets. Nested shell payloads are scanned the same way;
+ * other interpreter payloads stay raw because shell quoting rules cannot
+ * establish which of their strings execute.
+ * Nested payloads are generated lazily and share count and byte budgets. If
+ * either budget is exhausted, retain the original text for hard denies and
+ * require human review instead of treating the partial expansion as safe.
+ *
+ * Fail direction: an unterminated quote, an unparsable payload, or a heredoc
+ * we cannot delimit all fall back to scanning the original text, which can
+ * only add denials.
+ */
+
+/** Reviewer-visible bound for one command string. */
+export const MAX_REVIEWER_COMMAND_BYTES = 10_240;
+
+/** Shared by all nested payloads of one command, across both recursion levels. */
+export const MAX_NESTED_PAYLOAD_COUNT = 32;
+export const MAX_NESTED_PAYLOAD_BYTES = 32_768;
+
+const TARGET_CHARACTERS = "/*~";
+
+/** Truncate to a UTF-8 byte budget without splitting a code point. */
+export function truncateUtf8(value: string, maxBytes: number): string {
+  if (maxBytes <= 0) return "";
+  let bytes = 0;
+  let result = "";
+  for (const character of value) {
+    const size = Buffer.byteLength(character, "utf8");
+    if (bytes + size > maxBytes) break;
+    result += character;
+    bytes += size;
+  }
+  return result;
+}
+
+type QuotedBody = { body: string; end: number };
+
+function readPlainQuote(
+  text: string,
+  start: number,
+  quote: "'" | '"',
+): QuotedBody | undefined {
+  let index = start + 1;
+  let body = "";
+  while (index < text.length) {
+    const character = text[index]!;
+    if (quote === '"' && character === "\\") {
+      const next = text[index + 1];
+      if (next === undefined) return undefined;
+      body += text.slice(index, index + 2);
+      index += 2;
+      continue;
+    }
+    if (character === quote) return { body, end: index + 1 };
+    body += character;
+    index++;
+  }
+  return undefined;
+}
+
+function readAnsiCQuote(text: string, start: number): QuotedBody | undefined {
+  // `start` points at the `$` of `$'…'`.
+  let index = start + 2;
+  let body = "";
+  while (index < text.length) {
+    const character = text[index]!;
+    if (character === "\\") {
+      const next = text[index + 1];
+      if (next === undefined) return undefined;
+      body += text.slice(index, index + 2);
+      index += 2;
+      continue;
+    }
+    if (character === "'") return { body, end: index + 1 };
+    body += character;
+    index++;
+  }
+  return undefined;
+}
+
+function readExpansion(text: string, start: number): string | undefined {
+  const next = text[start + 1];
+  if (next === undefined) return undefined;
+  if (next === "{") {
+    const close = text.indexOf("}", start + 2);
+    return close < 0 ? undefined : text.slice(start, close + 1);
+  }
+  if (next === "(") {
+    let depth = 1;
+    let index = start + 2;
+    while (index < text.length) {
+      const character = text[index]!;
+      if (character === "(") depth++;
+      else if (character === ")") {
+        depth--;
+        if (depth === 0) return text.slice(start, index + 1);
+      }
+      index++;
+    }
+    return undefined;
+  }
+  if (/[A-Za-z_]/.test(next)) {
+    const match = /^\$[A-Za-z_][A-Za-z0-9_]*/.exec(text.slice(start));
+    return match?.[0];
+  }
+  if (/[0-9@*#?$!\-]/.test(next)) return text.slice(start, start + 2);
+  return undefined;
+}
+
+/** Mask literal text without erasing components of a path or shell word. */
+function dynamicQuotedBody(body: string): string {
+  let result = "";
+  let index = 0;
+  while (index < body.length) {
+    const character = body[index]!;
+    if (character === "\\") {
+      // An escaped expansion/quote is literal text, but still part of the word.
+      result += "x";
+      index += 2;
+      continue;
+    }
+    if (character === "`") {
+      const close = body.indexOf("`", index + 1);
+      if (close < 0) {
+        result += body.slice(index);
+        break;
+      }
+      result += body.slice(index, close + 1);
+      index = close + 1;
+      continue;
+    }
+    if (character === "$") {
+      const expansion = readExpansion(body, index);
+      if (expansion) {
+        result += expansion;
+        index += expansion.length;
+        continue;
+      }
+      result += "x";
+      index++;
+      continue;
+    }
+    result += TARGET_CHARACTERS.includes(character) ? character : "x";
+    index++;
+  }
+  return result;
+}
+
+function literalQuotedBody(body: string): string {
+  let result = "";
+  for (const character of body) {
+    result += TARGET_CHARACTERS.includes(character) ? character : "x";
+  }
+  return result;
+}
+
+function readHeredoc(
+  text: string,
+  start: number,
+): { end: number } | undefined {
+  if (text.startsWith("<<<", start)) return undefined;
+  const match = /^<<(-?)(['"]?)([A-Za-z_][A-Za-z0-9_]*)\2/.exec(
+    text.slice(start),
+  );
+  if (!match) return undefined;
+  const stripTabs = match[1] === "-";
+  const delimiter = match[3]!;
+  const headerEnd = start + match[0].length;
+  let lineEnd = text.indexOf("\n", headerEnd);
+  if (lineEnd < 0) return { end: text.length };
+  let position = lineEnd + 1;
+  while (position <= text.length) {
+    const next = text.indexOf("\n", position);
+    const line = text.slice(
+      position,
+      next < 0 ? text.length : next,
+    );
+    const compare = stripTabs ? line.replace(/^\t+/, "") : line;
+    if (compare === delimiter) {
+      return { end: next < 0 ? text.length : next };
+    }
+    if (next < 0) return { end: text.length };
+    position = next + 1;
+  }
+  return { end: text.length };
+}
+
+/**
+ * Replace quoted literal text with its structural skeleton.
+ *
+ * Quoted literals are inert data for structural rules, so their text is
+ * masked — except shell expansions and path/glob/tilde characters, which can
+ * still be the target of a real command. Masking must not erase named path
+ * components: `"./dist"` must never become `"/"`. Heredoc bodies and command
+ * substitutions are preserved verbatim. An unterminated quote returns the
+ * original text unchanged (fail-closed).
+ */
+export function stripQuotedLiterals(text: string): string {
+  let result = "";
+  let index = 0;
+  while (index < text.length) {
+    const character = text[index]!;
+    if (character === "'" || character === '"') {
+      const quoted = readPlainQuote(text, index, character);
+      if (!quoted) return text;
+      result +=
+        character +
+        (character === "'"
+          ? literalQuotedBody(quoted.body)
+          : dynamicQuotedBody(quoted.body)) +
+        character;
+      index = quoted.end;
+      continue;
+    }
+    if (character === "$" && text[index + 1] === "'") {
+      const quoted = readAnsiCQuote(text, index);
+      if (!quoted) return text;
+      result += `$'${literalQuotedBody(quoted.body)}'`;
+      index = quoted.end;
+      continue;
+    }
+    if (character === "`") {
+      const close = text.indexOf("`", index + 1);
+      if (close < 0) return text;
+      result += text.slice(index, close + 1);
+      index = close + 1;
+      continue;
+    }
+    if (character === "<" && text[index + 1] === "<") {
+      const heredoc = readHeredoc(text, index);
+      if (heredoc) {
+        result += text.slice(index, heredoc.end);
+        index = heredoc.end;
+        continue;
+      }
+    }
+    result += character;
+    index++;
+  }
+  return result;
+}
+
+type ShellToken = {
+  value: string;
+  start: number;
+  end: number;
+  quoted: boolean;
+};
+
+const WORD_SEPARATORS = /[\s;&|()<>`]/;
+
+function tokenizeShell(text: string): ShellToken[] {
+  const tokens: ShellToken[] = [];
+  let index = 0;
+  while (index < text.length) {
+    const character = text[index]!;
+    if (/\s/.test(character)) {
+      index++;
+      continue;
+    }
+    if (character === "#") {
+      const newline = text.indexOf("\n", index);
+      index = newline < 0 ? text.length : newline;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      const quoted = readPlainQuote(text, index, character);
+      if (!quoted) {
+        tokens.push({
+          value: text.slice(index + 1),
+          start: index,
+          end: text.length,
+          quoted: true,
+        });
+        break;
+      }
+      tokens.push({
+        value: quoted.body,
+        start: index,
+        end: quoted.end,
+        quoted: true,
+      });
+      index = quoted.end;
+      continue;
+    }
+    if (character === "$" && text[index + 1] === "'") {
+      const quoted = readAnsiCQuote(text, index);
+      if (!quoted) break;
+      tokens.push({
+        value: quoted.body,
+        start: index,
+        end: quoted.end,
+        quoted: true,
+      });
+      index = quoted.end;
+      continue;
+    }
+    let end = index;
+    while (end < text.length && !WORD_SEPARATORS.test(text[end]!)) end++;
+    if (end === index) {
+      index++;
+      continue;
+    }
+    tokens.push({
+      value: text.slice(index, end),
+      start: index,
+      end,
+      quoted: false,
+    });
+    index = end;
+  }
+  return tokens;
+}
+
+function commandEnd(text: string, start: number): number {
+  const match = /[;&|\n]/.exec(text.slice(start));
+  return match ? start + (match.index ?? 0) : text.length;
+}
+
+function baseName(value: string): string {
+  const slash = value.lastIndexOf("/");
+  return slash < 0 ? value : value.slice(slash + 1);
+}
+
+const SHELL_INTERPRETERS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
+const SHORT_COMMAND_OPTION = /^-[A-Za-z]*c[A-Za-z]*$/;
+
+type InterpreterPayload = { text: string; kind: "shell" | "opaque" };
+
+// Shell options that consume a separate operand before a later -c option.
+const SHELL_VALUE_OPTIONS = new Set([
+  "-o", "+o", "-O", "+O", "--rcfile", "--init-file",
+]);
+
+function nextCommandToken(
+  text: string,
+  tokens: ShellToken[],
+  index: number,
+): ShellToken | undefined {
+  const current = tokens[index];
+  const next = tokens[index + 1];
+  if (!current || !next) return undefined;
+  // The tokenizer skips operators. Never treat a token in a subsequent
+  // command as this interpreter's option or payload.
+  return /[;&|\n()<>`]/.test(text.slice(current.end, next.start))
+    ? undefined
+    : next;
+}
+
+function shellPayloadToken(
+  text: string,
+  tokens: ShellToken[],
+  interpreterIndex: number,
+): ShellToken | undefined {
+  for (let index = interpreterIndex; index < tokens.length; index++) {
+    const option = nextCommandToken(text, tokens, index);
+    if (!option) return undefined;
+    if (
+      SHORT_COMMAND_OPTION.test(option.value) || option.value === "--command"
+    ) {
+      return nextCommandToken(text, tokens, index + 1);
+    }
+    // Stop at a script operand or the end-of-options marker.
+    if (option.value === "--" || !/^[-+][A-Za-z-]/.test(option.value)) {
+      return undefined;
+    }
+    if (SHELL_VALUE_OPTIONS.has(option.value)) {
+      if (!nextCommandToken(text, tokens, index + 1)) return undefined;
+      index++;
+    }
+  }
+  return undefined;
+}
+
+function* directPayloads(text: string): Generator<InterpreterPayload> {
+  const tokens = tokenizeShell(text);
+  const payloadValue = (token: ShellToken | undefined): string | undefined => {
+    if (!token) return undefined;
+    return token.quoted
+      ? token.value
+      : text.slice(token.start, commandEnd(text, token.start));
+  };
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index]!;
+    const name = baseName(token.value);
+    let payload: string | undefined;
+    let kind: InterpreterPayload["kind"] = "opaque";
+    if (SHELL_INTERPRETERS.has(name)) {
+      payload = payloadValue(shellPayloadToken(text, tokens, index));
+      kind = "shell";
+    } else if (name === "eval") {
+      payload = payloadValue(tokens[index + 1]);
+      kind = "shell";
+    } else if (/^python[0-9.]*$/.test(name)) {
+      if (tokens[index + 1]?.value === "-c") {
+        payload = payloadValue(tokens[index + 2]);
+      }
+    } else if (name === "perl" || name === "ruby") {
+      if (tokens[index + 1]?.value === "-e") {
+        payload = payloadValue(tokens[index + 2]);
+      }
+    } else if (name === "node") {
+      const option = tokens[index + 1]?.value;
+      if (option === "-e" || option === "--eval") {
+        payload = payloadValue(tokens[index + 2]);
+      }
+    }
+    // Yield lazily: eagerly collecting all suffixes of `eval eval ...` would
+    // already allocate quadratic data before the caller can enforce a budget.
+    if (payload && payload.trim()) yield { text: payload, kind };
+  }
+}
+
+/**
+ * Nested interpreter payloads within the shared count/byte budget, to a depth
+ * of two. Extraction understands `bash|sh|zsh|dash|ksh -c`, `eval`, `python* -c`,
+ * `perl -e`, `node -e`, and `ruby -e`. Safety callers must also check
+ * `shellExpansionLimitExceeded`; a bounded prefix is not a complete program.
+ */
+export function nestedShellPayloads(text: string): string[] {
+  return nestedInterpreterPayloads(text).payloads.map((payload) => payload.text);
+}
+
+function nestedInterpreterPayloads(text: string): {
+  payloads: InterpreterPayload[];
+  limitExceeded: boolean;
+} {
+  const payloads: InterpreterPayload[] = [];
+  let payloadBytes = 0;
+  let limitExceeded = false;
+  const visit = (value: string, depth: number): void => {
+    if (depth <= 0 || limitExceeded) return;
+    for (const payload of directPayloads(value)) {
+      const remainingBytes = MAX_NESTED_PAYLOAD_BYTES - payloadBytes;
+      // UTF-8 is at least as long as UTF-16 in code units. Reject an obviously
+      // oversized suffix before measuring/flattening its entire string.
+      if (
+        payloads.length >= MAX_NESTED_PAYLOAD_COUNT ||
+        payload.text.length > remainingBytes
+      ) {
+        limitExceeded = true;
+        return;
+      }
+      const bytes = Buffer.byteLength(payload.text, "utf8");
+      if (bytes > remainingBytes) {
+        limitExceeded = true;
+        return;
+      }
+      payloadBytes += bytes;
+      payloads.push(payload);
+      if (payload.kind === "shell") visit(payload.text, depth - 1);
+      if (limitExceeded) return;
+    }
+  };
+  visit(text, 2);
+  return { payloads, limitExceeded };
+}
+
+/** Whether nested execution could not be fully expanded within its budget. */
+export function shellExpansionLimitExceeded(text: string): boolean {
+  return nestedInterpreterPayloads(text).limitExceeded;
+}
+
+/**
+ * Structural scan text: the literal-masked skeleton of `text` plus the
+ * skeleton of nested shell payloads. Other languages remain raw: a string
+ * passed to subprocess.run/execSync/system is not an inert shell literal.
+ * On budget exhaustion retain the complete original text for hard denies;
+ * callers must defer if that scan finds no deny, rather than trusting the
+ * partially expanded program. Extra payload text never exceeds the budget.
+ */
+export function structuralScanText(text: string): string {
+  const { payloads, limitExceeded } = nestedInterpreterPayloads(text);
+  const parts = [limitExceeded ? text : stripQuotedLiterals(text)];
+  for (const payload of payloads) {
+    parts.push(
+      payload.kind === "shell" ? stripQuotedLiterals(payload.text) : payload.text,
+    );
+  }
+  return parts.join("\n");
+}

package/src/review/types.ts

@@ -17,6 +17,7 @@ export type ReasoningLevel =
 export type BoundedSurface = "external_directory" | "path";
 
 export type Config = {
+  /** Model id, provider/model, or "current" for the live Pi session model. */
   model: string;
   reasoning: ReasoningLevel;
   timeoutMs: number;