@erichll/pi-auto-review 0.3.1 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 0.3.3 - 2026-07-30
+
+- Fix config validation rejecting multi-segment model ids (`provider/group/model`).
+  `validateConfig` no longer restricts a model to exactly one `/`; it only rejects
+  ids with empty segments. Segments are resolved as before: the first segment is
+  the provider and the rest is the model id.
+
+## 0.3.2 - 2026-07-29
+
+- Load an optional user-global trusted config from
+  `~/.pi/agent/extensions/pi-auto-review/config.json` as a full overlay on the
+  package defaults (model, `autoConfirmBoundedAllows`, and other legal keys).
+- Keep project `.pi/pi-auto-review.json` tighten-only on top of that trusted
+  layer.
+- Deterministically deny writes to the user-global reviewer config directory.
+- Default reviewer model is the bare id `codex-auto-review`; `provider/model`
+  remains supported. Bare ids resolve against registered available models.
+- Show user-facing review feedback in interactive UI: a footer status while the
+  model is reviewing, then a short toast for allow / deny / defer / auto-confirm
+  / circuit-breaker outcomes (separate from agent denial reasons).
+
 ## 0.3.1 - 2026-07-29
 
 - Bind one-shot approval grants to matched policy evidence as well as the

package/README.md

@@ -12,7 +12,7 @@ The package name and model name are intentionally separate:
 
 - npm package: `@erichll/pi-auto-review`
 - Authorizer: `pi-auto-review`
-- Default reviewer model: `cliproxyapi/codex-auto-review`
+- Default reviewer model: `codex-auto-review`
 
 ## Security model
 
@@ -44,6 +44,24 @@ or ten denials in the rolling last fifty reviews. An explicit denial is
 returned to the agent with an instruction not to pursue the same outcome
 through a workaround.
 
+## User-facing feedback
+
+In interactive UI sessions, the extension shows short operator feedback that is
+separate from agent denial reasons:
+
+1. Footer status while review is in flight:
+   `auto-review: reviewing <surface> · <target>`
+2. A toast when the decision lands:
+   - allowed
+   - allowed + auto-confirming the local dialog
+   - allowed but local confirmation still required
+   - deferred to you
+   - denied
+   - circuit-breaker stopped after repeated denials
+
+These notices are best-effort UX only; missing or broken UI delivery never
+changes the security decision.
+
 ## Exact human retry override
 
 In interactive TUI mode, `/approve` shows up to ten recent model denials from
@@ -64,12 +82,30 @@ cannot be issued again for the same request semantics in that session.
 
 ## Configure
 
-Edit `src/config.json`, using `config/config.example.json` as the reference:
+Trusted configuration is resolved in this order:
+
+1. Package defaults from the installed `src/config.json`
+2. Optional user-global overlay at
+   `~/.pi/agent/extensions/pi-auto-review/config.json`
+3. Optional project tighten-only file at `.pi/pi-auto-review.json`
+
+Prefer the user-global file for day-to-day overrides (same location style as
+`pi-permission-system`). It may set any legal key, including `model` and
+`autoConfirmBoundedAllows`. A partial file overlays the package defaults.
+
+```json
+// ~/.pi/agent/extensions/pi-auto-review/config.json
+{
+  "autoConfirmBoundedAllows": ["external_directory", "path"]
+}
+```
+
+Package-shipped defaults live in `src/config.json`:
 
 ```json
 {
-  "model": "cliproxyapi/codex-auto-review",
-  "reasoning": "medium",
+  "model": "codex-auto-review",
+  "reasoning": "low",
   "timeoutMs": 45000,
   "maxTokens": 1600,
   "retries": 1,
@@ -78,7 +114,7 @@ Edit `src/config.json`, using `config/config.example.json` as the reference:
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
   "grantTtlMs": 60000,
-  "autoConfirmBoundedAllows": ["external_directory"]
+  "autoConfirmBoundedAllows": ["external_directory", "path"]
 }
 ```
 
@@ -199,17 +235,19 @@ Pi places user npm packages under `~/.pi/agent/npm/` and Git packages under
 PI_AUTO_REVIEW_ALLOW_UNTRUSTED_DEV=1 pi --approve
 ```
 
-The trusted package configuration is copied and frozen at `session_start`.
-An optional workspace file at `.pi/pi-auto-review.json` may only lower
-timeouts, token/evidence limits, retries, and grant TTL, or set `failureMode`
-to `deny`. It may remove entries from `autoConfirmBoundedAllows`, but cannot
-add a surface not enabled by the trusted package configuration. It cannot
-select a model, weaken fail-closed behavior, or raise a trusted limit. Invalid
-project configuration disables the reviewer for that session.
+The trusted configuration (package defaults plus optional user-global overlay)
+is copied and frozen at `session_start`. An optional workspace file at
+`.pi/pi-auto-review.json` may only lower timeouts, token/evidence limits,
+retries, and grant TTL, or set `failureMode` to `deny`. It may remove entries
+from `autoConfirmBoundedAllows`, but cannot add a surface not enabled by the
+trusted configuration. It cannot select a model, weaken fail-closed behavior,
+or raise a trusted limit. Invalid user-global or project configuration disables
+the reviewer for that session.
 
-Writes to the installed reviewer package, project security configuration,
-global Pi security configuration, and the global audit directory are
-deterministically denied.
+Writes to the installed reviewer package, the user-global reviewer config
+directory (`~/.pi/agent/extensions/pi-auto-review/`), project security
+configuration, global Pi security configuration, and the global audit directory
+are deterministically denied.
 
 ## Real-model smoke test
 
@@ -221,11 +259,11 @@ PI_AUTO_REVIEW_ALLOW_UNTRUSTED_DEV=1 \
 PI_AUTO_REVIEW_SMOKE_AUDIT_PATH=/tmp/pi-auto-review-smoke-audit.jsonl \
 pi --no-extensions --no-skills --no-prompt-templates --no-context-files \
   --no-builtin-tools --no-session --print \
-  --extension /trusted/path/to/cliproxyapi-provider/extensions/index.ts \
+  --extension /trusted/path/to/your-model-provider/extensions/index.ts \
   --extension ./packages/pi-auto-review/src/index.ts \
   --extension ./packages/pi-sandbox/src/index.ts \
   --extension ./scripts/real-model-smoke-audit.ts \
-  --model cliproxyapi/gpt-5.6-sol \
+  --model provider/your-available-model \
   "Use bash once to write a fixed marker outside the workspace."
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Model-backed boundary approval broker for Pi",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,6 @@
   },
   "files": [
     "src",
-    "config/config.example.json",
     "CHANGELOG.md",
     "README.md",
     "LICENSE"
@@ -53,8 +52,8 @@
     "@gotgenes/pi-permission-system": ">=23.0.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.82.1",
-    "@earendil-works/pi-coding-agent": "0.82.1",
+    "@earendil-works/pi-ai": "0.83.0",
+    "@earendil-works/pi-coding-agent": "0.83.0",
     "@gotgenes/pi-permission-system": "24.0.0",
     "@types/node": "^22.15.3",
     "typescript": "^6.0.3"

package/src/config.json

@@ -1,6 +1,6 @@
 {
-  "model": "cliproxyapi/codex-auto-review",
-  "reasoning": "medium",
+  "model": "codex-auto-review",
+  "reasoning": "low",
   "timeoutMs": 45000,
   "maxTokens": 1600,
   "retries": 1,
@@ -9,5 +9,5 @@
   "maxRelevantResultTokens": 800,
   "failureMode": "deny",
   "grantTtlMs": 60000,
-  "autoConfirmBoundedAllows": ["external_directory"]
+  "autoConfirmBoundedAllows": ["external_directory", "path"]
 }

package/src/index.ts

@@ -34,6 +34,19 @@ import {
   type BoundaryReviewerContext,
 } from "./broker/index.ts";
 import { PermissionUiAutoConfirmer } from "./ui-auto-confirm.ts";
+import {
+  buildUserReviewNotice,
+  buildUserReviewStatus,
+  notifyUserReview,
+  reviewTargetFromRequest,
+  setUserReviewStatus,
+  type UserReviewOutcome,
+} from "./user-feedback.ts";
+
+export {
+  buildUserReviewNotice,
+  buildUserReviewStatus,
+} from "./user-feedback.ts";
 
 export { parseDecision } from "./policy.ts";
 export * from "./broker/index.ts";
@@ -98,13 +111,20 @@ type ReviewResult = {
 const EXTENSION_NAME = "pi-auto-review";
 const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const PROJECT_CONFIG_PATH = join(".pi", "pi-auto-review.json");
+const USER_CONFIG_RELATIVE_PATH = join(
+  ".pi",
+  "agent",
+  "extensions",
+  "pi-auto-review",
+  "config.json",
+);
 const PERMISSIONS_SERVICE_KEY = Symbol.for(
   "@gotgenes/pi-permission-system:service",
 );
 const BOUNDED_SURFACES = new Set(["path", "external_directory"]);
 const DEFAULT_CONFIG: Config = {
-  model: "cliproxyapi/codex-auto-review",
-  reasoning: "medium",
+  model: "codex-auto-review",
+  reasoning: "low",
   timeoutMs: 45_000,
   maxTokens: 1_600,
   retries: 1,
@@ -113,7 +133,7 @@ const DEFAULT_CONFIG: Config = {
   maxRelevantResultTokens: 800,
   failureMode: "deny",
   grantTtlMs: 60_000,
-  autoConfirmBoundedAllows: Object.freeze(["external_directory"]),
+  autoConfirmBoundedAllows: Object.freeze(["external_directory", "path"]),
 };
 
 const REVIEWER_SYSTEM_PROMPT = `You are a fail-closed permission reviewer.
@@ -177,8 +197,15 @@ function validateConfig(value: unknown, source: string): Config {
     );
   }
   const config = { ...DEFAULT_CONFIG, ...raw };
-  if (!/^[^/]+\/[^/]+$/.test(config.model)) {
-    throw new Error(`${EXTENSION_NAME}: model must be provider/model`);
+  if (
+    typeof config.model !== "string" ||
+    !config.model.trim() ||
+    /\s/.test(config.model) ||
+    config.model.split("/").some((segment) => !segment.trim())
+  ) {
+    throw new Error(
+      `${EXTENSION_NAME}: model must be a model id or provider/model`,
+    );
   }
   if (
     !["off", "minimal", "low", "medium", "high", "xhigh", "max"].includes(
@@ -247,19 +274,88 @@ function validateConfig(value: unknown, source: string): Config {
   };
 }
 
+export function packageConfigPath(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), "config.json");
+}
+
+export function userConfigPath(home = homedir()): string {
+  return join(home, USER_CONFIG_RELATIVE_PATH);
+}
+
+function readJsonConfig(path: string): unknown {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `${EXTENSION_NAME}: cannot load ${path}: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+  }
+}
+
+/** Package-shipped defaults from `src/config.json`. */
 export function loadConfig(): Config {
-  const path = join(dirname(fileURLToPath(import.meta.url)), "config.json");
+  const path = packageConfigPath();
+  return validateConfig(readJsonConfig(path), path);
+}
+
+/**
+ * User-global trusted overlay at
+ * `~/.pi/agent/extensions/pi-auto-review/config.json`.
+ * May set any legal config key, including model and autoConfirmBoundedAllows.
+ */
+export function applyUserConfig(
+  packageConfig: Config,
+  value: unknown,
+  source = "user config",
+): Config {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${EXTENSION_NAME}: ${source} must be an object`);
+  }
+  return validateConfig(
+    {
+      ...packageConfig,
+      autoConfirmBoundedAllows: [...packageConfig.autoConfirmBoundedAllows],
+      ...(value as Record<string, unknown>),
+    },
+    source,
+  );
+}
+
+export type LoadTrustedConfigOptions = {
+  packageConfig?: Config;
+  userConfigPath?: string;
+};
+
+/**
+ * Trusted config = package defaults, optionally fully overlaid by the user
+ * global file. Project config is applied later and may only tighten.
+ */
+export function loadTrustedConfig(
+  options: LoadTrustedConfigOptions = {},
+): Config {
+  const packageConfig = options.packageConfig ?? loadConfig();
+  const path = options.userConfigPath ?? userConfigPath();
   let value: unknown;
   try {
     value = JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
+    if (
+      error &&
+      typeof error === "object" &&
+      "code" in error &&
+      error.code === "ENOENT"
+    ) {
+      return packageConfig;
+    }
     throw new Error(
       `${EXTENSION_NAME}: cannot load ${path}: ${
         error instanceof Error ? error.message : String(error)
       }`,
     );
   }
-  return validateConfig(value, path);
+  return applyUserConfig(packageConfig, value, path);
 }
 
 const TIGHTENABLE_NUMBER_KEYS = [
@@ -356,6 +452,7 @@ function protectedWriteHardDeny(
   const protectedDirectories = [
     PACKAGE_ROOT,
     join(agentDir, "logs"),
+    join(agentDir, "extensions", "pi-auto-review"),
   ];
   const protectedFiles = [
     join(request.cwd, ".pi", "settings.json"),
@@ -364,6 +461,7 @@ function protectedWriteHardDeny(
     join(agentDir, "settings.json"),
     join(agentDir, "permissions.json"),
     join(agentDir, "sandbox.json"),
+    userConfigPath(),
   ];
   if (
     protectedDirectories.some((path) => isWithin(path, resolvedTarget)) ||
@@ -538,16 +636,32 @@ ${transcript.text}
 </selected-transcript>`;
 }
 
+function parseModelRef(modelRef: string): {
+  provider?: string;
+  modelId: string;
+} {
+  if (!modelRef.includes("/")) {
+    return { modelId: modelRef };
+  }
+  const [provider, ...idParts] = modelRef.split("/");
+  return { provider, modelId: idParts.join("/") };
+}
+
 async function resolveReviewer(
   ctx: ExtensionContext,
   config: Config,
 ): Promise<ReviewerRuntime> {
-  const [provider, ...idParts] = config.model.split("/");
-  const modelId = idParts.join("/");
-  const registeredModel = ctx.modelRegistry.find(provider, modelId);
-  const providerFallback = ctx.modelRegistry
-    .getAvailable()
-    .find((candidate) => candidate.provider === provider);
+  const { provider, modelId } = parseModelRef(config.model);
+  const available = ctx.modelRegistry.getAvailable();
+  const registeredModel = provider
+    ? ctx.modelRegistry.find(provider, modelId)
+    : available.find(
+        (candidate) =>
+          candidate.id === modelId || candidate.name === modelId,
+      );
+  const providerFallback = provider
+    ? available.find((candidate) => candidate.provider === provider)
+    : undefined;
   const model =
     registeredModel ||
     (providerFallback
@@ -555,7 +669,9 @@ async function resolveReviewer(
       : undefined);
   if (!model) {
     throw new Error(
-      `provider ${provider} is unavailable for custom model ${config.model}`,
+      provider
+        ? `provider ${provider} is unavailable for custom model ${config.model}`
+        : `model ${config.model} is unavailable`,
     );
   }
   const auth = await ctx.modelRegistry.getApiKeyAndHeaders(model);
@@ -757,7 +873,9 @@ export function createPiAutoReviewExtension(
   options: PiAutoReviewExtensionOptions = {},
 ): (pi: ExtensionAPI) => void {
   const trustedConfig = Object.freeze(
-    validateConfig(options.config ?? loadConfig(), "trusted config"),
+    options.config !== undefined
+      ? validateConfig(options.config, "trusted config")
+      : loadTrustedConfig(),
   );
   const allowUntrustedWorkspace =
     options.allowUntrustedWorkspace === true ||
@@ -897,11 +1015,14 @@ export function createPiAutoReviewExtension(
       context = undefined;
       broker = undefined;
       disposeBrokerService = undefined;
-      console.error(
-        `${EXTENSION_NAME}: session disabled: ${
-          error instanceof Error ? error.message : String(error)
-        }`,
-      );
+      const message = `${EXTENSION_NAME}: session disabled: ${
+        error instanceof Error ? error.message : String(error)
+      }`;
+      console.error(message);
+      notifyUserReview(ctx, {
+        type: "error",
+        message,
+      });
     }
   });
 
@@ -925,56 +1046,100 @@ export function createPiAutoReviewExtension(
               surface,
               reason,
             });
+            notifyUserReview(
+              context,
+              buildUserReviewNotice({
+                outcome: "unavailable",
+                surface,
+                rationale: reason,
+              }),
+            );
             return { kind: "deny", reason };
           }
 
           const request = boundaryRequest(context, details, query);
-          const decision = await broker.review(request, {
-            sessionId: context.sessionManager.getSessionId(),
-            scopeKey: currentTurnScope(context),
-            issueGrant: false,
-          });
-          const result = reviewResults.get(request.id);
-          reviewResults.delete(request.id);
-          const allowCapped = decision.kind === "allow" && boundedRequest(details);
-          const autoConfirmQueued =
-            allowCapped &&
-            context.mode === "tui" &&
-            context.hasUI &&
-            uiAutoConfirmer.stage(request.id, surface);
-          log.review("pi_auto_review_decision", {
-            requestId: request.id,
-            surface,
-            model: config.model,
-            outcome: allowCapped ? "defer" : decision.kind,
-            reviewerOutcome: decision.review.outcome,
-            riskLevel: decision.review.riskLevel,
-            userAuthorization: decision.review.userAuthorization,
-            rationale: decision.review.rationale,
-            allowCapped,
-            autoConfirmQueued,
-            circuitBreakerTripped:
-              decision.kind === "deny"
-                ? decision.circuitBreakerTripped
-                : false,
-            attempts: result?.attempts ?? 0,
-            retryErrors: result?.retryErrors ?? [],
-            durationMs: result?.durationMs,
-            transcriptUserCharacters: result?.transcript.userCharacters,
-            transcriptToolCharacters: result?.transcript.toolCharacters,
-            transcriptRelevantResultCharacters:
-              result?.transcript.relevantResultCharacters,
-            transcriptTruncated: result?.transcript.truncated,
-          });
-
-          if (allowCapped || decision.kind === "defer") {
-            return { kind: "defer" };
+          const target = reviewTargetFromRequest(request);
+          setUserReviewStatus(
+            context,
+            buildUserReviewStatus(surface, target),
+          );
+          try {
+            const decision = await broker.review(request, {
+              sessionId: context.sessionManager.getSessionId(),
+              scopeKey: currentTurnScope(context),
+              issueGrant: false,
+            });
+            const result = reviewResults.get(request.id);
+            reviewResults.delete(request.id);
+            const allowCapped =
+              decision.kind === "allow" && boundedRequest(details);
+            const autoConfirmQueued =
+              allowCapped &&
+              context.mode === "tui" &&
+              context.hasUI &&
+              uiAutoConfirmer.stage(request.id, surface);
+
+            let userOutcome: UserReviewOutcome;
+            if (decision.kind === "deny" && decision.circuitBreakerTripped) {
+              userOutcome = "circuit_breaker";
+            } else if (allowCapped && autoConfirmQueued) {
+              userOutcome = "auto_confirm";
+            } else if (allowCapped) {
+              userOutcome = "needs_confirmation";
+            } else if (decision.kind === "allow") {
+              userOutcome = "allow";
+            } else if (decision.kind === "defer") {
+              userOutcome = "defer";
+            } else {
+              userOutcome = "deny";
+            }
+            notifyUserReview(
+              context,
+              buildUserReviewNotice({
+                outcome: userOutcome,
+                surface,
+                target,
+                rationale: decision.review.rationale,
+              }),
+            );
+
+            log.review("pi_auto_review_decision", {
+              requestId: request.id,
+              surface,
+              model: config.model,
+              outcome: allowCapped ? "defer" : decision.kind,
+              reviewerOutcome: decision.review.outcome,
+              riskLevel: decision.review.riskLevel,
+              userAuthorization: decision.review.userAuthorization,
+              rationale: decision.review.rationale,
+              allowCapped,
+              autoConfirmQueued,
+              userOutcome,
+              circuitBreakerTripped:
+                decision.kind === "deny"
+                  ? decision.circuitBreakerTripped
+                  : false,
+              attempts: result?.attempts ?? 0,
+              retryErrors: result?.retryErrors ?? [],
+              durationMs: result?.durationMs,
+              transcriptUserCharacters: result?.transcript.userCharacters,
+              transcriptToolCharacters: result?.transcript.toolCharacters,
+              transcriptRelevantResultCharacters:
+                result?.transcript.relevantResultCharacters,
+              transcriptTruncated: result?.transcript.truncated,
+            });
+
+            if (allowCapped || decision.kind === "defer") {
+              return { kind: "defer" };
+            }
+            if (decision.kind === "allow") return { kind: "allow" };
+            return {
+              kind: "deny",
+              reason: `${decision.review.rationale} Do not retry this outcome through a workaround or policy circumvention; use a materially safer alternative or ask the user.`,
+            };
+          } finally {
+            setUserReviewStatus(context, undefined);
           }
-          if (decision.kind === "allow") return { kind: "allow" };
-          return {
-            kind: "deny",
-            reason: `${decision.review.rationale} Do not retry this outcome through a workaround or policy circumvention; use a materially safer alternative or ask the user.`,
-          };
         },
       );
     } catch (error) {
@@ -987,6 +1152,7 @@ export function createPiAutoReviewExtension(
   });
 
   pi.on("session_shutdown", () => {
+    setUserReviewStatus(context, undefined);
     disposeAuthorizer?.();
     disposeAuthorizer = undefined;
     disposeBrokerService?.();

package/src/user-feedback.ts

@@ -0,0 +1,140 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+export const USER_REVIEW_STATUS_KEY = "pi-auto-review";
+
+export type UserReviewOutcome =
+  | "allow"
+  | "deny"
+  | "defer"
+  | "auto_confirm"
+  | "needs_confirmation"
+  | "circuit_breaker"
+  | "unavailable";
+
+export type UserReviewNotice = {
+  message: string;
+  type: "info" | "warning" | "error";
+};
+
+/** Collapse whitespace and bound length for status/notify text. */
+export function compactReviewText(value: unknown, max = 90): string {
+  return String(value ?? "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, max);
+}
+
+export function reviewTargetFromRequest(request: {
+  resolvedPath?: string;
+  path?: string;
+  destination?: string;
+  command?: string;
+  toolName?: string;
+  skillName?: string;
+  operation?: string;
+}): string | undefined {
+  const target =
+    request.resolvedPath ??
+    request.path ??
+    request.destination ??
+    request.command ??
+    request.toolName ??
+    request.skillName ??
+    request.operation;
+  const compact = compactReviewText(target, 90);
+  return compact || undefined;
+}
+
+/** Footer/status bar text while the model review is in flight. */
+export function buildUserReviewStatus(
+  surface: string,
+  target?: string,
+): string {
+  const compact = compactReviewText(target, 48);
+  return compact
+    ? `auto-review: reviewing ${surface} · ${compact}`
+    : `auto-review: reviewing ${surface}`;
+}
+
+/**
+ * User-facing (not agent-facing) notice after a review decision.
+ * Kept short so TUI toasts remain readable.
+ */
+export function buildUserReviewNotice(input: {
+  outcome: UserReviewOutcome;
+  surface: string;
+  target?: string;
+  rationale?: string;
+}): UserReviewNotice {
+  const target = compactReviewText(input.target, 70);
+  const rationale = compactReviewText(input.rationale, 120);
+  const subject = target ? `${input.surface} · ${target}` : input.surface;
+  const why = rationale ? ` — ${rationale}` : "";
+
+  switch (input.outcome) {
+    case "allow":
+      return {
+        type: "info",
+        message: `Auto-review allowed ${subject}${why}`,
+      };
+    case "auto_confirm":
+      return {
+        type: "info",
+        message: `Auto-review allowed ${subject}; auto-confirming the local dialog${why}`,
+      };
+    case "needs_confirmation":
+      return {
+        type: "info",
+        message: `Auto-review allowed ${subject}; local confirmation is still required${why}`,
+      };
+    case "defer":
+      return {
+        type: "info",
+        message: `Auto-review deferred ${subject} to you${why}`,
+      };
+    case "deny":
+      return {
+        type: "warning",
+        message: `Auto-review denied ${subject}${why}`,
+      };
+    case "circuit_breaker":
+      return {
+        type: "warning",
+        message: `Auto-review stopped after repeated denials this turn${
+          why || " — use /approve for one exact retry"
+        }`,
+      };
+    case "unavailable":
+      return {
+        type: "error",
+        message: `Auto-review is unavailable${why}`,
+      };
+  }
+}
+
+/** Best-effort toast; never throws into the authorizer path. */
+export function notifyUserReview(
+  ctx: ExtensionContext | undefined,
+  notice: UserReviewNotice,
+): void {
+  if (!ctx?.hasUI) return;
+  try {
+    ctx.ui.notify(notice.message, notice.type);
+  } catch {
+    // UI delivery is observational and must not change a decision.
+  }
+}
+
+/** Best-effort footer status; pass undefined to clear. */
+export function setUserReviewStatus(
+  ctx: ExtensionContext | undefined,
+  text: string | undefined,
+  key = USER_REVIEW_STATUS_KEY,
+): void {
+  if (!ctx?.hasUI) return;
+  try {
+    ctx.ui.setStatus?.(key, text);
+  } catch {
+    // UI delivery is observational and must not change a decision.
+  }
+}

package/config/config.example.json

@@ -1,13 +0,0 @@
-{
-  "model": "cliproxyapi/codex-auto-review",
-  "reasoning": "medium",
-  "timeoutMs": 45000,
-  "maxTokens": 1600,
-  "retries": 1,
-  "maxUserTranscriptTokens": 1200,
-  "maxToolTranscriptTokens": 1200,
-  "maxRelevantResultTokens": 800,
-  "failureMode": "deny",
-  "grantTtlMs": 60000,
-  "autoConfirmBoundedAllows": ["external_directory"]
-}