@erichll/pi-auto-review 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.11.0 - 2026-08-24
+
+- **Structured network destination.** Network approval requests now carry
+  separate host, port, and protocol fields alongside the existing combined
+  destination string. One-shot grants bind each component independently, so a
+  grant issued for one host-port-protocol combination cannot be reused for a
+  different one.
+- **Deferred reviews are more visible.** The review widget now highlights
+  deferred verdicts with a warning accent instead of the previous muted style,
+  making pending human decisions easier to spot.
+
+## 0.10.0 - 2026-08-22
+
+- Replace the review footer and newly appended transcript entries with one
+  above-editor `pi-auto-review` widget. Each permission check independently
+  replaces the previous display, shows the configured reviewer model while it
+  runs, and updates in place with its final outcome and metadata. The latest
+  result remains until the next check and is cleared on session change or
+  shutdown.
+- Prevent late concurrent completions and permission decisions from overwriting
+  a newer check. A current local denial adds `Local confirmation · denied` to
+  that result only. Widget failures fall back to notifications without changing
+  authorization behavior.
+- Remove tool-call grouping, timers, capacity eviction, and tool/turn flush
+  wiring for new feedback while retaining the historical entry renderer. Bound
+  target and rationale text with visible ellipses, preserve width-aware wrapping,
+  and keep token, duration, and call-count numbers in the normal metadata color.
+
 ## 0.9.0 - 2026-08-22
 
 - Require `@gotgenes/pi-permission-system` `^27.0.0` and register through the

package/README.md

@@ -11,19 +11,34 @@ that dependency is a hard prerequisite (see [Install and enable](#install-and-en
 - authorizer: `pi-auto-review`
 - default reviewer model: `codex-auto-review`
 
+## Contents
+
+- [Install and enable](#install-and-enable)
+- [Security model](#security-model)
+- [Configuration](#configuration)
+  - [Deadlines and retries](#deadlines-and-retries)
+- [Operator feedback and exact retry](#operator-feedback-and-exact-retry)
+- [Boundary broker API](#boundary-broker-api)
+- [Reviewer context and token budgets](#reviewer-context-and-token-budgets)
+- [Sandbox integration](#sandbox-integration)
+- [Trust boundary](#trust-boundary)
+- [Telemetry](#telemetry)
+- [Real-model smoke test](#real-model-smoke-test)
+
 ## Install and enable
 
 > **Prerequisite:** pi-auto-review is an authorizer inside
 > `@gotgenes/pi-permission-system`. Pi does not auto-install peer packages, so
 > install the permission system separately (once per machine) before this
-> extension. Version 0.9.0 requires permission-system 27.x:
+> extension. Version 0.10.0 requires permission-system 27.x:
 
 ```bash
 pi install npm:@gotgenes/pi-permission-system
 pi install npm:@erichll/pi-auto-review
 ```
 
-Install the package outside the agent-writable workspace:
+Install the package outside the agent-writable workspace (see
+[Trust boundary](#trust-boundary)):
 
 Add it to the permission-system authorizer chain:
 
@@ -132,16 +147,20 @@ only a fixed, budget-checked schema correction.
 
 ## Operator feedback and exact retry
 
-Interactive sessions show a best-effort footer while review is running and
-structured results for allow, local confirmation, defer, deny, or circuit
-breaker outcomes. Local permission-system asks that belong to the same tool
-call are grouped into one TUI entry; each request still has its own model call,
-verdict, grant, local confirmation, and audit record. Forwarded asks and
-non-TUI modes remain immediate and ungrouped. Group members retain their own
-surface, outcome, target, rationale, model, token usage, and duration. UI
-entries use unbordered muted text and place each target and rationale together
-on the same line as that member's surface and outcome. UI delivery never
-changes the authorization result.
+Interactive sessions show the current permission check in a single widget
+above the editor. Each check first shows its surface, compact target, and the
+dynamically configured reviewer model, then replaces that content in place
+with the outcome, target and rationale, model, token usage, duration, and any
+extra call count. A new check replaces the previous result; the latest result
+remains visible until then and is cleared when the session changes or shuts
+down. Concurrent older checks cannot overwrite the most recently started one.
+
+Every request still has its own model call, verdict, grant, local confirmation,
+and audit record. No new review-result transcript entries are written. Existing
+`pi-auto-review` entries in historical sessions remain renderable. Non-TUI
+modes retain best-effort notifications, and a failed TUI widget update falls
+back to the same notification path. UI delivery never changes the authorization
+result.
 
 In an interactive TUI, `/auto-review-approve` lists up to ten recent
 non-critical model denials from the current session. Selecting one asks the
@@ -288,7 +307,7 @@ Writes to the installed reviewer package, its user-global configuration,
 project and global security configuration, and the global audit directory are
 deterministically denied.
 
-## Telemetry and smoke testing
+## Telemetry
 
 Every actual model call emits an internal `review_attempt`; each approval emits
 one `review_complete`. Events contain stable status/error classes, timings,
@@ -297,6 +316,8 @@ prompt or response text, provider errors, credentials, headers, or URL query
 values. Usage is marked `unknown_provenance` when pi-ai cannot distinguish
 provider counters from initialized values, and `unavailable` when absent.
 
+## Real-model smoke test
+
 For a controlled real-model smoke test, load only the provider, reviewer,
 sandbox, and audit listener:
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@erichll/pi-auto-review",
-  "version": "0.9.0",
-  "description": "Model-backed boundary approval broker for Pi",
+  "version": "0.11.0",
+  "description": "Fail-closed, model-backed approval broker for Pi: deterministically hard-denies dangerous operations, reviews dangerous boundaries with a reviewer model, and issues one-shot expiring grants that OS sandbox adapters must consume before retrying.",
   "type": "module",
   "license": "MIT",
   "keywords": [

package/src/broker/grants.ts

@@ -22,6 +22,9 @@ export function boundaryRequestHash(request: BoundaryRequest): string {
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,
+    destinationHost: request.destinationHost,
+    destinationPort: request.destinationPort,
+    destinationProtocol: request.destinationProtocol,
     toolCallId: request.toolCallId,
     toolName: request.toolName,
     skillName: request.skillName,

package/src/broker/types.ts

@@ -22,6 +22,9 @@ export type BoundaryRequest = {
   path?: string;
   resolvedPath?: string;
   destination?: string;
+  destinationHost?: string;
+  destinationPort?: number;
+  destinationProtocol?: string;
   toolCallId?: string;
   toolName?: string;
   skillName?: string;

package/src/index.ts

@@ -11,11 +11,12 @@ import {
   completeSimple,
   type ApiStreamSimpleFunction,
 } from "@earendil-works/pi-ai/compat";
-import type {
-  AuthorizerLog,
-  AuthorizerVerdict,
-  PermissionQuery,
-  PromptPermissionDetails,
+import {
+  getPermissionsService,
+  type AuthorizerLog,
+  type AuthorizerVerdict,
+  type PermissionQuery,
+  type PromptPermissionDetails,
 } from "@gotgenes/pi-permission-system";
 import {
   buildClassifierTranscript,
@@ -37,15 +38,13 @@ import {
 } from "./broker/index.ts";
 import { PermissionUiAutoConfirmer } from "./ui-auto-confirm.ts";
 import {
-  buildUserReviewEntryData,
   buildUserReviewNotice,
   buildUserReviewStatus,
+  buildUserReviewWidgetData,
   notifyUserReview,
-  presentUserReview,
-  ReviewEntryBatcher,
   renderUserReviewEntry,
   reviewTargetFromRequest,
-  setUserReviewStatus,
+  UserReviewWidgetController,
   USER_REVIEW_ENTRY_TYPE,
   type UserReviewOutcome,
   type UserReviewUsage,
@@ -65,6 +64,8 @@ export {
   type SandboxNetworkTrap,
   type SandboxRequestContext,
 } from "./integrations/sandbox.ts";
+import { parseHostPort } from "./integrations/sandbox.ts";
+export { parseHostPort };
 
 type ReasoningLevel =
   | "off"
@@ -252,6 +253,7 @@ type ReviewResult = {
   durationMs: number;
   transcript: TranscriptResult;
   summary: ReviewExecutionSummary;
+  unavailable?: boolean;
 };
 
 class ReviewExecutionError extends Error {
@@ -726,52 +728,6 @@ type PermissionsService = {
   ): () => void;
 };
 
-function promptPayloadRecord(
-  details: PromptPermissionDetails,
-): Record<string, unknown> | undefined {
-  const payload = (details as unknown as Record<string, unknown>).payload;
-  return payload && typeof payload === "object" && !Array.isArray(payload)
-    ? payload as Record<string, unknown>
-    : undefined;
-}
-
-function promptIsForwarded(details: PromptPermissionDetails): boolean {
-  if ((details as unknown as Record<string, unknown>).forwarding) return true;
-  const request = promptPayloadRecord(details)?.request;
-  if (!request || typeof request !== "object" || Array.isArray(request)) {
-    return false;
-  }
-  const requester = (request as Record<string, unknown>).requester;
-  return Boolean(
-    requester && typeof requester === "object" && !Array.isArray(requester) &&
-    (requester as Record<string, unknown>).forwarded === true
-  );
-}
-
-function reliableFullCommand(
-  details: PromptPermissionDetails,
-): string | undefined {
-  const payload = promptPayloadRecord(details);
-  const evidence = payload?.evidence;
-  if (Array.isArray(evidence)) {
-    for (const item of evidence) {
-      if (!item || typeof item !== "object" || Array.isArray(item)) continue;
-      const entry = item as Record<string, unknown>;
-      if (entry.label === "full command" && typeof entry.text === "string" &&
-          entry.text.trim()) {
-        return entry.text;
-      }
-    }
-  }
-  if (payload?.kind !== "bash_external_directory") return undefined;
-  const request = payload.request;
-  if (!request || typeof request !== "object" || Array.isArray(request)) {
-    return undefined;
-  }
-  const value = (request as Record<string, unknown>).value;
-  return typeof value === "string" && value.trim() ? value : undefined;
-}
-
 function boundaryRequest(
   ctx: ExtensionContext,
   details: PromptPermissionDetails,
@@ -795,6 +751,7 @@ function boundaryRequest(
     typeof deterministicPolicy === "string"
       ? deterministicPolicy
       : JSON.stringify(deterministicPolicy);
+  const destParsed = parseHostPort(evidence.destination);
   return {
     id: details.requestId,
     source: "permission-system",
@@ -805,6 +762,8 @@ function boundaryRequest(
     path: evidence.path,
     resolvedPath: evidence.resolvedPath,
     destination: evidence.destination,
+    destinationHost: destParsed?.host,
+    destinationPort: destParsed?.port,
     toolCallId:
       typeof (details as unknown as Record<string, unknown>).toolCallId ===
       "string"
@@ -1976,7 +1935,7 @@ export function createPiAutoReviewExtension(
   const uiAutoConfirmer = new PermissionUiAutoConfirmer(
     () => config.autoConfirmBoundedAllows,
   );
-  const reviewEntryBatcher = new ReviewEntryBatcher(pi);
+  const reviewWidget = new UserReviewWidgetController();
 
   const emitTelemetry = (event: ReviewerTelemetryEvent): void => {
     writeOptionalAuditFile(event);
@@ -2032,6 +1991,7 @@ export function createPiAutoReviewExtension(
               durationMs: execution.summary.durationMs,
               transcript: execution.summary.transcript,
               summary: execution.summary,
+              unavailable: true,
             });
           }
           emitTelemetry(
@@ -2314,7 +2274,7 @@ export function createPiAutoReviewExtension(
     disposeAuthorizer?.();
     disposeAuthorizer = undefined;
     registeredSessionId = undefined;
-    reviewEntryBatcher.flushAll();
+    reviewWidget.clear(context ?? ctx);
     disposeBrokerService?.();
     broker?.clear();
     reviewResults.clear();
@@ -2359,18 +2319,8 @@ export function createPiAutoReviewExtension(
   });
 
   pi.events.on("permissions:decision", (event) => {
-    reviewEntryBatcher.permissionDecision(event);
-  });
-
-  pi.on("tool_execution_start", (event, ctx) => {
-    reviewEntryBatcher.toolExecutionStarted(
-      ctx.sessionManager.getSessionId(),
-      event.toolCallId,
-      event.args,
-    );
+    reviewWidget.permissionDecision(event);
   });
-  pi.on("turn_end", () => reviewEntryBatcher.flushAll());
-  pi.on("agent_end", () => reviewEntryBatcher.flushAll());
 
   pi.events.on("permissions:ready", (event) => {
     const ready = event && typeof event === "object" && !Array.isArray(event)
@@ -2395,20 +2345,19 @@ export function createPiAutoReviewExtension(
       registeredSessionId = undefined;
     }
 
-    void import("@gotgenes/pi-permission-system").then((module) => {
-      if (shuttingDown || epoch !== registrationEpoch || !context) return;
-      const service = module.getPermissionsService(sessionId) as
-        | PermissionsService
-        | undefined;
-      if (!service) {
-        console.error(
-          `${EXTENSION_NAME}: permissions service unavailable for session ${sessionId}`,
-        );
-        return;
-      }
-      let dispose: (() => void) | undefined;
-      try {
-        dispose = service.registerAuthorizer(
+    if (shuttingDown || epoch !== registrationEpoch || !context) return;
+    const service = getPermissionsService(sessionId) as
+      | PermissionsService
+      | undefined;
+    if (!service) {
+      console.error(
+        `${EXTENSION_NAME}: permissions service unavailable for session ${sessionId}`,
+      );
+      return;
+    }
+    let dispose: (() => void) | undefined;
+    try {
+      dispose = service.registerAuthorizer(
         EXTENSION_NAME,
         async (details, query, log: AuthorizerLog) => {
           const evidence = normalizePermissionEvidence(details);
@@ -2425,185 +2374,152 @@ export function createPiAutoReviewExtension(
               surface,
               rationale: reason,
             };
-            presentUserReview(
-              pi,
-              context,
-              buildUserReviewNotice(unavailable),
-              buildUserReviewEntryData(unavailable),
-            );
+            notifyUserReview(context, buildUserReviewNotice(unavailable));
             return { kind: "deny", reason };
           }
 
           const request = boundaryRequest(context, details, query);
           const target = reviewTargetFromRequest(request);
-          setUserReviewStatus(
-            context,
-            buildUserReviewStatus(surface, target),
+          const reviewContext = context;
+          const widgetGeneration = reviewWidget.begin(request.id, reviewContext, {
+            surface,
+            target,
+            model: config.model,
+          });
+          const decision = await broker.review(request, {
+            sessionId: reviewContext.sessionManager.getSessionId(),
+            scopeKey: currentTurnScope(reviewContext),
+            issueGrant: false,
+          });
+          const result = reviewResults.get(request.id);
+          reviewResults.delete(request.id);
+          const allowCapped =
+            decision.kind === "allow" && boundedRequest(surface);
+          const autoConfirmQueued =
+            allowCapped &&
+            reviewContext.mode === "tui" &&
+            reviewContext.hasUI &&
+            uiAutoConfirmer.stage(request.id, surface);
+
+          let userOutcome: UserReviewOutcome;
+          if (decision.kind === "deny" && decision.circuitBreakerTripped) {
+            userOutcome = "circuit_breaker";
+          } else if (allowCapped && autoConfirmQueued) {
+            userOutcome = "auto_confirm";
+          } else if (allowCapped) {
+            userOutcome = "needs_confirmation";
+          } else if (decision.kind === "allow") {
+            userOutcome = "allow";
+          } else if (decision.kind === "defer") {
+            userOutcome = "defer";
+          } else {
+            userOutcome = "deny";
+          }
+          const reviewMeta = userReviewMetaFromResult(result, config.model);
+          const noticeInput = {
+            outcome: result?.unavailable ? "unavailable" as const : userOutcome,
+            surface,
+            target,
+            rationale: decision.review.rationale,
+            recoveryCommand:
+              decision.kind === "deny"
+                ? decision.recoveryCommand
+                : undefined,
+            ...reviewMeta,
+          };
+          const notice = buildUserReviewNotice(noticeInput);
+          reviewWidget.complete(
+            request.id,
+            widgetGeneration,
+            reviewContext,
+            notice,
+            buildUserReviewWidgetData(noticeInput),
           );
-          try {
-            const decision = await broker.review(request, {
-              sessionId: context.sessionManager.getSessionId(),
-              scopeKey: currentTurnScope(context),
-              issueGrant: false,
-            });
-            const result = reviewResults.get(request.id);
-            reviewResults.delete(request.id);
-            const allowCapped =
-              decision.kind === "allow" && boundedRequest(surface);
-            const autoConfirmQueued =
-              allowCapped &&
-              context.mode === "tui" &&
-              context.hasUI &&
-              uiAutoConfirmer.stage(request.id, surface);
-
-            let userOutcome: UserReviewOutcome;
-            if (decision.kind === "deny" && decision.circuitBreakerTripped) {
-              userOutcome = "circuit_breaker";
-            } else if (allowCapped && autoConfirmQueued) {
-              userOutcome = "auto_confirm";
-            } else if (allowCapped) {
-              userOutcome = "needs_confirmation";
-            } else if (decision.kind === "allow") {
-              userOutcome = "allow";
-            } else if (decision.kind === "defer") {
-              userOutcome = "defer";
-            } else {
-              userOutcome = "deny";
-            }
-            const reviewMeta = userReviewMetaFromResult(result, config.model);
-            const noticeInput = {
-              outcome: userOutcome,
-              surface,
-              target,
-              rationale: decision.review.rationale,
-              recoveryCommand:
-                decision.kind === "deny"
-                  ? decision.recoveryCommand
-                  : undefined,
-              ...reviewMeta,
-            };
-            const notice = buildUserReviewNotice(noticeInput);
-            const entryData = buildUserReviewEntryData(noticeInput);
-            const localSessionId = context.sessionManager.getSessionId();
-            if (
-              context.mode === "tui" &&
-              context.hasUI &&
-              request.toolCallId &&
-              localSessionId &&
-              !promptIsForwarded(details)
-            ) {
-              reviewEntryBatcher.enqueue({
-                sessionId: localSessionId,
-                toolCallId: request.toolCallId,
-                fullCommand: reliableFullCommand(details),
-                member: {
-                  requestId: request.id,
-                  ...noticeInput,
-                },
-                notice,
-                data: entryData,
-                ctx: context,
-              });
-            } else {
-              presentUserReview(pi, context, notice, entryData);
-            }
-
-            log.review("pi_auto_review_decision", {
-              requestId: request.id,
-              toolCallId: request.toolCallId,
-              surface,
-              model: config.model,
-              reviewerModel: reviewMeta.model,
-              outcome: allowCapped ? "defer" : decision.kind,
-              reviewerOutcome: decision.review.outcome,
-              riskLevel: decision.review.riskLevel,
-              userAuthorization: decision.review.userAuthorization,
-              rationale: decision.review.rationale,
-              allowCapped,
-              autoConfirmQueued,
-              userOutcome,
-              circuitBreakerTripped:
-                decision.kind === "deny"
-                  ? decision.circuitBreakerTripped
-                  : false,
-              attempts: result?.attempts ?? 0,
-              retryErrors: result?.retryErrors ?? [],
-              durationMs: result?.durationMs,
-              usageAvailability: reviewMeta.usage?.availability,
-              usage: reviewMeta.usage,
-              transcriptUserCharacters: result?.transcript.userCharacters,
-              transcriptToolCharacters: result?.transcript.toolCharacters,
-              transcriptRelevantResultCharacters:
-                result?.transcript.relevantResultCharacters,
-              transcriptTruncated: result?.transcript.truncated,
-              command: request.command,
-              path: request.path,
-              resolvedPath: request.resolvedPath,
-              destination: request.destination,
-              agentName: request.agentName,
-              requesterSessionId: request.requesterSessionId,
-              accessIntent: request.accessIntent,
-              authorization:
-                decision.kind === "allow"
-                  ? decision.authorization
-                  : undefined,
-            });
 
-            if (allowCapped || decision.kind === "defer") {
-              return { kind: "defer" };
-            }
-            if (decision.kind === "allow") return { kind: "allow" };
-            const denyInstruction =
-              decision.denialSource === "hard-deny"
-                ? LOCAL_HARD_DENY_AGENT_INSTRUCTION
-                : decision.recoveryCommand === "/auto-review-break-glass"
-                  ? REVIEWER_CRITICAL_DENY_AGENT_INSTRUCTION
-                  : decision.recoveryCommand === "/auto-review-approve"
-                    ? REVIEWER_NONCRITICAL_DENY_AGENT_INSTRUCTION
-                    : "Automatic policy critically denied this action and break-glass authorization is disabled. Do not retry, rephrase, or circumvent it.";
-            return {
-              kind: "deny",
-              reason: `${decision.review.rationale} ${denyInstruction}`,
-            };
-          } finally {
-            setUserReviewStatus(context, undefined);
+          log.review("pi_auto_review_decision", {
+            requestId: request.id,
+            toolCallId: request.toolCallId,
+            surface,
+            model: config.model,
+            reviewerModel: reviewMeta.model,
+            outcome: allowCapped ? "defer" : decision.kind,
+            reviewerOutcome: decision.review.outcome,
+            riskLevel: decision.review.riskLevel,
+            userAuthorization: decision.review.userAuthorization,
+            rationale: decision.review.rationale,
+            allowCapped,
+            autoConfirmQueued,
+            userOutcome,
+            circuitBreakerTripped:
+              decision.kind === "deny"
+                ? decision.circuitBreakerTripped
+                : false,
+            attempts: result?.attempts ?? 0,
+            retryErrors: result?.retryErrors ?? [],
+            durationMs: result?.durationMs,
+            usageAvailability: reviewMeta.usage?.availability,
+            usage: reviewMeta.usage,
+            transcriptUserCharacters: result?.transcript.userCharacters,
+            transcriptToolCharacters: result?.transcript.toolCharacters,
+            transcriptRelevantResultCharacters:
+              result?.transcript.relevantResultCharacters,
+            transcriptTruncated: result?.transcript.truncated,
+            command: request.command,
+            path: request.path,
+            resolvedPath: request.resolvedPath,
+            destination: request.destination,
+            agentName: request.agentName,
+            requesterSessionId: request.requesterSessionId,
+            accessIntent: request.accessIntent,
+            authorization:
+              decision.kind === "allow"
+                ? decision.authorization
+                : undefined,
+          });
+
+          if (allowCapped || decision.kind === "defer") {
+            return { kind: "defer" };
           }
-          },
-        );
-        if (shuttingDown || epoch !== registrationEpoch || !context) {
-          dispose();
-          return;
-        }
-        disposeAuthorizer?.();
-        disposeAuthorizer = dispose;
-        registeredSessionId = sessionId;
-        writeOptionalAuditFile({
-          type: "authorizer_registered",
-          sessionId,
-        });
-      } catch (error) {
-        dispose?.();
-        console.error(
-          `${EXTENSION_NAME}: authorizer registration failed: ${
-            error instanceof Error ? error.message : String(error)
-          }`,
-        );
+          if (decision.kind === "allow") return { kind: "allow" };
+          const denyInstruction =
+            decision.denialSource === "hard-deny"
+              ? LOCAL_HARD_DENY_AGENT_INSTRUCTION
+              : decision.recoveryCommand === "/auto-review-break-glass"
+                ? REVIEWER_CRITICAL_DENY_AGENT_INSTRUCTION
+                : decision.recoveryCommand === "/auto-review-approve"
+                  ? REVIEWER_NONCRITICAL_DENY_AGENT_INSTRUCTION
+                  : "Automatic policy critically denied this action and break-glass authorization is disabled. Do not retry, rephrase, or circumvent it.";
+          return {
+            kind: "deny",
+            reason: `${decision.review.rationale} ${denyInstruction}`,
+          };
+        },
+      );
+      if (shuttingDown || epoch !== registrationEpoch || !context) {
+        dispose();
+        return;
       }
-    }).catch((error) => {
-      if (shuttingDown || epoch !== registrationEpoch) return;
+      disposeAuthorizer?.();
+      disposeAuthorizer = dispose;
+      registeredSessionId = sessionId;
+      writeOptionalAuditFile({
+        type: "authorizer_registered",
+        sessionId,
+      });
+    } catch (error) {
+      dispose?.();
       console.error(
-        `${EXTENSION_NAME}: permission-system import failed: ${
+        `${EXTENSION_NAME}: authorizer registration failed: ${
           error instanceof Error ? error.message : String(error)
         }`,
       );
-    });
+    }
   });
 
   pi.on("session_shutdown", () => {
     shuttingDown = true;
     registrationEpoch++;
-    setUserReviewStatus(context, undefined);
-    reviewEntryBatcher.flushAll();
+    reviewWidget.clear(context);
     disposeAuthorizer?.();
     disposeAuthorizer = undefined;
     registeredSessionId = undefined;

package/src/integrations/sandbox.ts

@@ -36,6 +36,21 @@ export type SandboxRequestContext = {
   agentName?: string;
 };
 
+export function parseHostPort(target: string | undefined): {
+  host: string;
+  port: number | undefined;
+} | undefined {
+  if (!target) return undefined;
+  const lastColon = target.lastIndexOf(":");
+  if (lastColon <= 0) return { host: target, port: undefined };
+  const portStr = target.slice(lastColon + 1);
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    return { host: target, port: undefined };
+  }
+  return { host: target.slice(0, lastColon), port };
+}
+
 export function sandboxTrapToBoundaryRequest(
   trap: SandboxBoundaryTrap,
   context: SandboxRequestContext,
@@ -66,6 +81,7 @@ export function sandboxTrapToBoundaryRequest(
       },
     };
   }
+  const parsed = parseHostPort(trap.target);
   return {
     id,
     source: "sandbox-runtime",
@@ -74,6 +90,8 @@ export function sandboxTrapToBoundaryRequest(
     cwd: trap.process?.cwd || context.cwd,
     command: context.command,
     destination: trap.target,
+    destinationHost: parsed?.host,
+    destinationPort: parsed?.port,
     toolName: trap.process?.exe || undefined,
     agentName: context.agentName,
     matchedPolicy: { decision: "ask" },

package/src/policy.ts

@@ -156,6 +156,9 @@ export type RelevantBoundaryRequest = {
   path?: string;
   resolvedPath?: string;
   destination?: string;
+  destinationHost?: string;
+  destinationPort?: number;
+  destinationProtocol?: string;
   toolCallId?: string;
   toolName?: string;
   toolInputPreview?: string;
@@ -1098,6 +1101,9 @@ function toolArgumentCoveredByRequest(
     path: request.path,
     resolvedPath: request.resolvedPath,
     destination: request.destination,
+    destinationHost: request.destinationHost,
+    destinationPort: request.destinationPort,
+    destinationProtocol: request.destinationProtocol,
     cwd: request.cwd,
     agentName: request.agentName,
     requesterSessionId: request.requesterSessionId,

package/src/user-feedback.ts

@@ -1,10 +1,8 @@
-import type {
-  ExtensionAPI,
-  ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 export const USER_REVIEW_STATUS_KEY = "pi-auto-review";
 export const USER_REVIEW_ENTRY_TYPE = "pi-auto-review";
+export const USER_REVIEW_WIDGET_KEY = "pi-auto-review";
 
 export type UserReviewOutcome =
   | "allow"
@@ -45,6 +43,14 @@ export function compactReviewText(value: unknown, max = 90): string {
     .slice(0, max);
 }
 
+/** Collapse whitespace and visibly truncate bounded widget text. */
+export function truncateReviewText(value: unknown, max: number): string {
+  const compact = String(value ?? "").replace(/\s+/g, " ").trim();
+  if (compact.length <= max) return compact;
+  if (max <= 1) return "…".slice(0, max);
+  return `${compact.slice(0, max - 1).trimEnd()}…`;
+}
+
 export function reviewTargetFromRequest(request: {
   resolvedPath?: string;
   path?: string;
@@ -62,7 +68,7 @@ export function reviewTargetFromRequest(request: {
     request.toolName ??
     request.skillName ??
     request.operation;
-  const compact = compactReviewText(target, 100);
+  const compact = truncateReviewText(target, 100);
   return compact || undefined;
 }
 
@@ -197,8 +203,8 @@ function reviewTargetRationaleLine(input: {
   target?: string;
   rationale?: string;
 }): string | undefined {
-  const target = compactReviewText(input.target, 100);
-  const rationale = compactReviewText(input.rationale, 180);
+  const target = truncateReviewText(input.target, 100);
+  const rationale = truncateReviewText(input.rationale, 180);
   if (target && rationale) return `${target} · ${rationale}`;
   return target || rationale || undefined;
 }
@@ -259,8 +265,10 @@ function outcomeAccent(
     case "auto_confirm":
     case "needs_confirmation":
       return "success";
+    // Deferred also warns: it awaits a human decision, so it must be clearly
+    // visible (theme warning) and stand out until resolved.
     case "defer":
-      return "muted";
+      return "warning";
     case "deny":
     case "circuit_breaker":
       return "warning";
@@ -400,7 +408,6 @@ export function renderUserReviewQuoteLines(
   const contentWidth = Math.max(1, width);
   const verb = outcomeVerb(data.outcome);
   const verbAnsi = theme.getFgAnsi(outcomeAccent(data.outcome));
-  const numberAnsi = theme.getFgAnsi("success");
   const rendered: string[] = [];
   for (const [index, line] of data.lines.entries()) {
     for (const visual of wrapReviewDisplayText(line, contentWidth)) {
@@ -411,12 +418,6 @@ export function renderUserReviewQuoteLines(
           `${verbAnsi}${verb}\x1b[0m`,
         );
       }
-      if (index === data.lines.length - 1) {
-        painted = painted.replace(
-          /(\d+(?:\.\d+)?[kM]?)(?=\s(?:toks|calls)|ms\b|s\b)/g,
-          `${numberAnsi}$1\x1b[0m`,
-        );
-      }
       rendered.push(withQuoteStyle(theme, painted));
     }
   }
@@ -528,34 +529,6 @@ export function renderUserReviewEntry(
   };
 }
 
-function presentUserReviewGroupEntry(
-  pi: ExtensionAPI | undefined,
-  ctx: ExtensionContext | undefined,
-  data: UserReviewGroupEntryData,
-): boolean {
-  if (!pi || !ctx?.hasUI || ctx.mode !== "tui") return false;
-  try {
-    pi.appendEntry(USER_REVIEW_ENTRY_TYPE, data);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function presentUserReviewEntry(
-  pi: ExtensionAPI | undefined,
-  ctx: ExtensionContext | undefined,
-  data: UserReviewEntryData,
-): boolean {
-  if (!pi || !ctx?.hasUI || ctx.mode !== "tui") return false;
-  try {
-    pi.appendEntry(USER_REVIEW_ENTRY_TYPE, data);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /** Best-effort toast; never throws into the authorizer path. */
 export function notifyUserReview(
   ctx: ExtensionContext | undefined,
@@ -569,184 +542,160 @@ export function notifyUserReview(
   }
 }
 
-/** TUI structured entry when possible; otherwise a plain notify toast. */
-export function presentUserReview(
-  pi: ExtensionAPI | undefined,
-  ctx: ExtensionContext | undefined,
-  notice: UserReviewNotice,
-  data: UserReviewEntryData,
-): void {
-  if (presentUserReviewEntry(pi, ctx, data)) return;
-  notifyUserReview(ctx, notice);
-}
-
-type PendingReviewGroup = {
-  sessionId: string;
-  toolCallId: string;
-  fullCommand?: string;
-  members: Map<string, {
-    member: UserReviewGroupMember;
-    notice: UserReviewNotice;
-    data: UserReviewEntryData;
-  }>;
-  ctx: ExtensionContext;
-  createdAt: number;
-  timer: ReturnType<typeof setTimeout>;
+export type UserReviewWidgetData = UserReviewEntryData & {
+  phase: "reviewing" | "complete";
 };
 
-export type ReviewEntryBatcherOptions = {
-  maxGroups?: number;
-  maxMembers?: number;
-  ttlMs?: number;
-  now?: () => number;
-};
+export function buildUserReviewingWidgetData(input: {
+  surface: string;
+  target?: string;
+  model?: string;
+}): UserReviewWidgetData {
+  const target = truncateReviewText(input.target, 100);
+  const model = formatReviewModelName(input.model) ?? "reviewer";
+  return {
+    phase: "reviewing",
+    outcome: "defer",
+    type: "info",
+    lines: joinNoticeLines([
+      `Auto-review · reviewing · ${input.surface}`,
+      target,
+      `Waiting for ${model}…`,
+    ]),
+  };
+}
 
-/** Buffers only transcript presentation; permission requests remain independent. */
-export class ReviewEntryBatcher {
-  readonly #groups = new Map<string, PendingReviewGroup>();
-  readonly #maxGroups: number;
-  readonly #maxMembers: number;
-  readonly #ttlMs: number;
-  readonly #now: () => number;
-
-  constructor(
-    private readonly pi: ExtensionAPI,
-    options: ReviewEntryBatcherOptions = {},
-  ) {
-    this.#maxGroups = options.maxGroups ?? 32;
-    this.#maxMembers = options.maxMembers ?? 8;
-    this.#ttlMs = options.ttlMs ?? 60_000;
-    this.#now = options.now ?? Date.now;
-  }
+export function buildUserReviewWidgetData(
+  input: UserReviewNoticeInput,
+): UserReviewWidgetData {
+  return {
+    phase: "complete",
+    ...buildUserReviewEntryData(input),
+  };
+}
 
-  enqueue(input: {
-    sessionId: string;
-    toolCallId: string;
-    fullCommand?: string;
-    member: UserReviewGroupMember;
-    notice: UserReviewNotice;
-    data: UserReviewEntryData;
-    ctx: ExtensionContext;
-  }): void {
-    try {
-      const key = this.#key(input.sessionId, input.toolCallId);
-      let group = this.#groups.get(key);
-      if (group?.members.has(input.member.requestId)) return;
-      if (group && group.members.size >= this.#maxMembers) {
-        this.#flushKey(key);
-        group = undefined;
-      }
-      if (!group) {
-        if (this.#groups.size >= this.#maxGroups) {
-          const oldest = [...this.#groups.entries()].sort(
-            (left, right) => left[1].createdAt - right[1].createdAt,
-          )[0]?.[0];
-          if (oldest) this.#flushKey(oldest);
-        }
-        const timer = setTimeout(() => this.#flushKey(key), this.#ttlMs);
-        timer.unref?.();
-        group = {
-          sessionId: input.sessionId,
-          toolCallId: input.toolCallId,
-          fullCommand: input.fullCommand,
-          members: new Map(),
-          ctx: input.ctx,
-          createdAt: this.#now(),
-          timer,
-        };
-        this.#groups.set(key, group);
-      } else if (!group.fullCommand && input.fullCommand) {
-        group.fullCommand = input.fullCommand;
-      }
-      group.members.set(input.member.requestId, {
-        member: input.member,
-        notice: input.notice,
-        data: input.data,
-      });
-      if (input.member.outcome === "deny" ||
-          input.member.outcome === "circuit_breaker") {
-        this.#flushKey(key);
+export function renderUserReviewWidgetLines(
+  data: UserReviewWidgetData,
+  theme: UserReviewTheme,
+  width: number,
+): string[] {
+  const rendered: string[] = [];
+  const verb = data.phase === "reviewing"
+    ? "reviewing"
+    : outcomeVerb(data.outcome);
+  const accent = data.phase === "reviewing"
+    ? "muted"
+    : outcomeAccent(data.outcome);
+  const verbAnsi = theme.getFgAnsi(accent);
+  const mutedAnsi = theme.getFgAnsi("muted");
+  for (const [index, line] of data.lines.entries()) {
+    for (const visual of wrapReviewDisplayText(line, Math.max(1, width))) {
+      let painted = `${mutedAnsi}${visual}\x1b[0m`;
+      if (index === 0) {
+        painted = painted.replace(
+          verb,
+          `${verbAnsi}${verb}\x1b[0m${mutedAnsi}`,
+        );
       }
-    } catch {
-      presentUserReview(this.pi, input.ctx, input.notice, input.data);
+      rendered.push(painted);
     }
   }
+  return rendered;
+}
+
+function setWidget(
+  ctx: ExtensionContext | undefined,
+  data: UserReviewWidgetData | undefined,
+): boolean {
+  if (!ctx?.hasUI || ctx.mode !== "tui") return false;
+  try {
+    ctx.ui.setWidget(
+      USER_REVIEW_WIDGET_KEY,
+      data
+        ? (_tui, theme) => ({
+            render: (width: number) =>
+              renderUserReviewWidgetLines(data, theme, width),
+            invalidate() {},
+          })
+        : undefined,
+      { placement: "aboveEditor" },
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 
-  toolExecutionStarted(
-    sessionId: string,
-    toolCallId: string,
-    args: unknown,
+/** Owns the single live widget and rejects stale concurrent completions. */
+export class UserReviewWidgetController {
+  #generation = 0;
+  #current?: {
+    requestId: string;
+    generation: number;
+    ctx: ExtensionContext;
+    data?: UserReviewWidgetData;
+    notice?: UserReviewNotice;
+  };
+
+  begin(
+    requestId: string,
+    ctx: ExtensionContext,
+    input: { surface: string; target?: string; model?: string },
+  ): number {
+    const generation = ++this.#generation;
+    this.#current = { requestId, generation, ctx };
+    setWidget(ctx, buildUserReviewingWidgetData(input));
+    return generation;
+  }
+
+  complete(
+    requestId: string,
+    generation: number,
+    ctx: ExtensionContext,
+    notice: UserReviewNotice,
+    data: UserReviewWidgetData,
   ): void {
-    const key = this.#key(sessionId, toolCallId);
-    const group = this.#groups.get(key);
-    if (!group) return;
-    if (!group.fullCommand && args && typeof args === "object" &&
-        !Array.isArray(args) &&
-        typeof (args as Record<string, unknown>).command === "string") {
-      group.fullCommand = String((args as Record<string, unknown>).command);
+    if (!ctx.hasUI || ctx.mode !== "tui") {
+      notifyUserReview(ctx, notice);
+      return;
     }
-    this.#flushKey(key);
+    if (!this.#isCurrent(requestId, generation)) return;
+    this.#current = { requestId, generation, ctx, notice, data };
+    if (!setWidget(ctx, data)) notifyUserReview(ctx, notice);
   }
 
   permissionDecision(event: unknown): void {
     if (!event || typeof event !== "object" || Array.isArray(event)) return;
     const record = event as Record<string, unknown>;
-    if (typeof record.requestId !== "string" ||
-        (record.result !== "allow" && record.result !== "deny")) return;
-    for (const [key, group] of this.#groups) {
-      const pending = group.members.get(record.requestId);
-      if (!pending) continue;
-      pending.member.permissionResult = record.result;
-      if (record.result === "deny") this.#flushKey(key);
-      return;
-    }
-  }
-
-  flushAll(): void {
-    for (const key of [...this.#groups.keys()]) this.#flushKey(key);
-  }
-
-  get pendingGroups(): number {
-    return this.#groups.size;
-  }
-
-  #key(sessionId: string, toolCallId: string): string {
-    return `${sessionId}\u0000${toolCallId}`;
+    const current = this.#current;
+    if (
+      record.result !== "deny" ||
+      typeof record.requestId !== "string" ||
+      record.requestId !== current?.requestId ||
+      !current.data ||
+      current.data.lines.includes("Local confirmation · denied")
+    ) return;
+    const data = {
+      ...current.data,
+      lines: [...current.data.lines, "Local confirmation · denied"],
+    };
+    const notice = {
+      type: current.notice?.type ?? data.type,
+      message: data.lines.join("\n"),
+    };
+    this.#current = { ...current, data, notice };
+    if (!setWidget(current.ctx, data)) notifyUserReview(current.ctx, notice);
   }
 
-  #flushKey(key: string): void {
-    const group = this.#groups.get(key);
-    if (!group) return;
-    this.#groups.delete(key);
-    clearTimeout(group.timer);
-    const pending = [...group.members.values()];
-    if (pending.length === 0) return;
-    const members = pending.map((entry) => entry.member);
-    const data: UserReviewGroupEntryData = {
-      kind: "group",
-      type: noticeType(groupOutcome(members)),
-      sessionId: group.sessionId,
-      toolCallId: group.toolCallId,
-      ...(group.fullCommand ? { fullCommand: group.fullCommand } : {}),
-      members,
-    };
-    if (presentUserReviewGroupEntry(this.pi, group.ctx, data)) return;
-    for (const entry of pending) {
-      presentUserReview(this.pi, group.ctx, entry.notice, entry.data);
-    }
+  clear(ctx?: ExtensionContext): void {
+    ++this.#generation;
+    const current = this.#current;
+    this.#current = undefined;
+    if (current) setWidget(ctx ?? current.ctx, undefined);
   }
-}
 
-/** Best-effort footer status; pass undefined to clear. */
-export function setUserReviewStatus(
-  ctx: ExtensionContext | undefined,
-  text: string | undefined,
-  key = USER_REVIEW_STATUS_KEY,
-): void {
-  if (!ctx?.hasUI) return;
-  try {
-    ctx.ui.setStatus?.(key, text);
-  } catch {
-    // UI delivery is observational and must not change a decision.
+  #isCurrent(requestId: string, generation: number): boolean {
+    return this.#current?.requestId === requestId &&
+      this.#current.generation === generation;
   }
 }