@zhushanwen/pi-permission 1.1.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhushanwen/pi-permission",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Pi permission extension — four permission modes (yolo/auto/approve/strict) with three-layer pipeline (AST + rules + AI classifier).",
   "type": "module",
   "main": "src/index.ts",
@@ -29,7 +29,7 @@
   "dependencies": {
     "tree-sitter-bash": "^0.25.1",
     "web-tree-sitter": "^0.26.11",
-    "@zhushanwen/pi-llm-shared": "0.2.0"
+    "@zhushanwen/pi-llm-shared": "0.3.0"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",

package/skills/permission-ext-config/SKILL.md

@@ -48,6 +48,7 @@ interface ClassifierConfig {
   timeout: number;            // 超时秒，默认 90
   autoApproveLowRisk: boolean;   // 低风险自动放行，默认 true
   autoDenyHighRisk: boolean;     // 高风险转人工审批，默认 true
+  thinkingLevel: ModelThinkingLevel;  // thinking 级别，默认 "off"（直接透传，llm-shared 映射为不传）；"minimal"~"max" 透传
 }
 ```
 
@@ -64,8 +65,8 @@ interface ClassifierConfig {
 
 ### classifier.model（只接受 string）
 
-- `"auto"`（默认）→ scoped：读 settings.json enabledModels 取首个可用；空则 fallback available（getAvailable 首个）
-- `"provider/model-id"`（如 `"zhipu/glm-4-flash"`）→ 精确匹配
+- `"auto"`（默认）→ permission 本地取 `ctx.modelRegistry.getAvailable()` 首个（不经过 llm-shared 的非精确 selector）
+- `"provider/model-id"`（如 `"zhipu/glm-4-flash"`）→ 精确匹配（llm-shared `ModelSelector` 仅支持 ref）
 - 传对象形式会被 console.warn 忽略，回落 auto
 
 ### auto 模式的风险判定（autoApproveLowRisk / autoDenyHighRisk）
@@ -91,7 +92,8 @@ AI classifier 输出三档风险，对应处理：
     "model": "auto",
     "timeout": 90,
     "autoApproveLowRisk": true,
-    "autoDenyHighRisk": true
+    "autoDenyHighRisk": true,
+    "thinkingLevel": "off"
   },
   "userRules": []
 }

package/src/__tests__/production.test.ts

@@ -91,16 +91,10 @@ beforeEach(() => {
 
 // ──────────────────────── TC1/TC2: toSelector 映射 ────────────────────────
 
-describe("toSelector（C2：'auto'→scoped 向后兼容）", () => {
-	it("TC1: 'auto' 映射为 scoped", () => {
-		expect(toSelector("auto")).toEqual({ type: "scoped" });
-	});
-
-	it("TC2: 'provider/model-id' 映射为 ref", () => {
+describe("toSelector（仅 ref 精确指定）", () => {
+	it("任意字符串都映射为 ref（auto 由 production resolveModel 层自行处理，不走 selector）", () => {
+		expect(toSelector("auto")).toEqual({ type: "ref", ref: "auto" });
 		expect(toSelector("anthropic/claude-sonnet")).toEqual({ type: "ref", ref: "anthropic/claude-sonnet" });
-	});
-
-	it("任意非 'auto' 字符串都视为 ref（含边角格式，由 resolveRef 判合法性）", () => {
 		expect(toSelector("openai/gpt-4o")).toEqual({ type: "ref", ref: "openai/gpt-4o" });
 	});
 });
@@ -129,16 +123,17 @@ describe("createProductionClassifier", () => {
 
 describe("resolveModel 装配（resolveModel + callLLM）", () => {
 	const CTX = { toolName: "bash", command: "ls", cwd: "/tmp" };
-	const CFG = { enabled: true, model: "auto", timeout: 5, autoApproveLowRisk: false, autoDenyHighRisk: true };
+	const CFG_AUTO = { enabled: true, model: "auto", timeout: 5, autoApproveLowRisk: false, autoDenyHighRisk: true };
+	const CFG_REF = { enabled: true, model: "test-co/model-a", timeout: 5, autoApproveLowRisk: false, autoDenyHighRisk: true };
 
-	it("TC3: scoped enabledModels 空 + available 空 → resolveModel null → fail-closed ask（不触达 callLLM）", async () => {
-		vi.mocked(resolveModelShared).mockReturnValue(null);
-		const ctx = makeMockCtx();
+	it("TC3: auto 且 getAvailable 空 → resolveModel null → fail-closed ask（不触达 callLLM）", async () => {
+		const ctx = makeMockCtx({ getAvailable: () => [] });
 		const classifier = createProductionClassifier(ctx);
-		const result = await classifier.classifyRisk(CTX, CFG);
+		const result = await classifier.classifyRisk(CTX, CFG_AUTO);
 		expect(result.outcome).toBe("ask");
 		expect(result.confidence).toBe(0);
-		// 关键：resolveModel null 时不应触达 callLLM（LLM 调用层）
+		// auto 是 permission 本地解析，不经过 llm-shared resolveModel
+		expect(resolveModelShared).not.toHaveBeenCalled();
 		expect(callLLMShared).not.toHaveBeenCalled();
 	});
 
@@ -154,16 +149,14 @@ describe("resolveModel 装配（resolveModel + callLLM）", () => {
 		expect(source).toContain('from "@zhushanwen/pi-llm-shared"');
 	});
 
-	it("TC4（装配）: resolveModel 命中 → callLLM 收到 model → ok:true 正常分类（收口链路通）", async () => {
-		vi.mocked(resolveModelShared).mockImplementation((_ctx, selector) =>
-			selector.type === "scoped" ? MOCK_MODEL_A : null,
-		);
+	it("TC4（装配）: ref resolveModel 命中 → callLLM 收到 model → ok:true 正常分类（收口链路通）", async () => {
+		vi.mocked(resolveModelShared).mockReturnValue(MOCK_MODEL_A);
 		vi.mocked(callLLMShared).mockResolvedValue({
 			ok: true,
 			content: '{"outcome":"allow","risk_level":"low","reasoning":"safe","confidence":0.9}',
 		});
 		const classifier = createProductionClassifier(makeMockCtx());
-		const result = await classifier.classifyRisk(CTX, CFG);
+		const result = await classifier.classifyRisk(CTX, CFG_REF);
 		expect(result.outcome).toBe("allow");
 		// 关键：resolveModel 返回 model 后，callLLM 被调用且收到该 model（收口链路 resolve→callLLM 通）
 		expect(callLLMShared).toHaveBeenCalledOnce();
@@ -172,19 +165,18 @@ describe("resolveModel 装配（resolveModel + callLLM）", () => {
 		expect(opts.model).toBe(MOCK_MODEL_A);
 		expect(opts.messages).toHaveLength(1);
 		expect(opts.systemPrompt.length).toBeGreaterThan(0);
-		// scoped 命中只调 1 次 resolveModel（不走 available fallback）
+		// ref 精确指定只调 1 次 resolveModel
 		expect(vi.mocked(resolveModelShared)).toHaveBeenCalledTimes(1);
+		expect(vi.mocked(resolveModelShared)).toHaveBeenCalledWith(expect.anything(), { type: "ref", ref: "test-co/model-a" });
 	});
 
-	it("TC4b: resolveModel 成功（scoped 命中）→ onLog 输出 '[pi-permission] classifier: using model <modelId>'（契约 C2，R2 验收前提）", async () => {
-		vi.mocked(resolveModelShared).mockImplementation((_ctx, selector) =>
-			selector.type === "scoped" ? MOCK_MODEL_A : null,
-		);
+	it("TC4b: ref resolveModel 成功 → onLog 输出 '[pi-permission] classifier: using model <modelId>'（契约 C2，R2 验收前提）", async () => {
+		vi.mocked(resolveModelShared).mockReturnValue(MOCK_MODEL_A);
 		vi.mocked(callLLMShared).mockResolvedValue({ ok: true, content: "x" });
 		const classifier = createProductionClassifier(makeMockCtx());
 		const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 		try {
-			await classifier.classifyRisk(CTX, CFG);
+			await classifier.classifyRisk(CTX, CFG_REF);
 			// onLog 实装为 console.warn（production.ts），成功路径日志在 LLM 调用前输出
 			expect(warnSpy).toHaveBeenCalledWith("[pi-permission] classifier: using model model-a");
 		} finally {
@@ -196,26 +188,22 @@ describe("resolveModel 装配（resolveModel + callLLM）", () => {
 		vi.mocked(resolveModelShared).mockReturnValue(MOCK_MODEL_A);
 		vi.mocked(callLLMShared).mockResolvedValue({ ok: false, error: "token expired", recoverable: true });
 		const classifier = createProductionClassifier(makeMockCtx());
-		const result = await classifier.classifyRisk(CTX, CFG);
+		const result = await classifier.classifyRisk(CTX, CFG_REF);
 		expect(result.outcome).toBe("ask");
 		expect(result.confidence).toBe(0);
 		expect(callLLMShared).toHaveBeenCalledOnce();
 	});
 
-	it("TC7: scoped 空 fallback available 命中（CL-scoped-fallback：有 auth provider 但无 enabledModels 不退化）", async () => {
-		// scoped（首次）返回 null，available（fallback）返回 MOCK_MODEL_A
-		vi.mocked(resolveModelShared).mockImplementation((_ctx, selector) =>
-			selector.type === "available" ? MOCK_MODEL_A : null,
-		);
+	it("TC7: auto 直接取 getAvailable 首个（permission 本地兼容，不经过非精确 ModelSelector）", async () => {
+		const ctx = makeMockCtx({ getAvailable: () => [MOCK_MODEL_A] });
 		vi.mocked(callLLMShared).mockResolvedValue({ ok: true, content: "x" });
-		const classifier = createProductionClassifier(makeMockCtx());
-		const result = await classifier.classifyRisk(CTX, CFG);
-		// fallback 命中 available → callLLM 收到 available model（非 scoped 的 null 直接返回）
+		const classifier = createProductionClassifier(ctx);
+		const result = await classifier.classifyRisk(CTX, CFG_AUTO);
 		expect(callLLMShared).toHaveBeenCalledOnce();
 		const opts = vi.mocked(callLLMShared).mock.calls[0]![1];
 		expect(opts.model).toBe(MOCK_MODEL_A);
-		// scoped 调 1 次（null）+ available fallback 调 1 次 = 2 次
-		expect(vi.mocked(resolveModelShared)).toHaveBeenCalledTimes(2);
+		// auto 不经过 llm-shared resolveModel
+		expect(resolveModelShared).not.toHaveBeenCalled();
 		// callLLM ok:true 但 content 非 JSON → parser fallback ask（链路已证明 resolve→callLLM 非 null）
 		expect(result.outcome).toBe("ask");
 	});

package/src/ast/loader.ts

@@ -22,6 +22,7 @@
 import { createRequire } from "node:module";
 import { existsSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 
 import { Language, Parser } from "web-tree-sitter";
 
@@ -45,9 +46,25 @@ export interface WasmPaths {
  * 所以这里只定位 .js 所在目录，不硬编码 wasm 文件名（跨版本健壮）。
  *
  * 任一不存在则 throw（fail-loud，由 getBashParser 捕获后 fail-closed）。
+ *
+ * 双模式（R1，bundle 适配）：builtin extension 经 esbuild bundle 成自包含 index.js 后，
+ * web-tree-sitter 被 inline、staged 产物无 node_modules，nodeRequire.resolve 必然失败。
+ * 故优先尝试 bundle 模式 —— 用 fileURLToPath(import.meta.url) 定位 index.js 所在目录，
+ * 查同目录的 tree-sitter-bash.wasm；命中则返回（wasm 由 bundle-extensions.mjs 拷至此）。
+ * 未命中则 fallback 到 nodeRequire.resolve（开发期 dev-link，源码 node_modules 完整）。
  */
 export function resolveWasmPaths(): WasmPaths {
-	// 1. tree-sitter-bash.wasm —— grammar wasm 在包根目录
+	// bundle 模式：bundle 后 wasm 与 index.js 同目录（bundle-extensions.mjs 拷贝至此）。
+	// 查两个 wasm 都存在才返回，避免不对称 guard（bash.wasm 在但 web-tree-sitter.wasm
+	// 缺失时 emscripten locateFile 会失败，虽 fail-closed 但不如入口 guard 显式拦截）。
+	const bundleDir = dirname(fileURLToPath(import.meta.url));
+	const bundleBashWasm = join(bundleDir, "tree-sitter-bash.wasm");
+	const bundleRuntimeWasm = join(bundleDir, "web-tree-sitter.wasm");
+	if (existsSync(bundleBashWasm) && existsSync(bundleRuntimeWasm)) {
+		return { bashWasmPath: bundleBashWasm, runtimeWasmDir: bundleDir };
+	}
+
+	// fallback：开发期从 node_modules 解析（dev-link，源码目录完整）
 	const bashPkgDir = dirname(nodeRequire.resolve("tree-sitter-bash/package.json"));
 	const bashWasmPath = join(bashPkgDir, "tree-sitter-bash.wasm");
 	if (!existsSync(bashWasmPath)) {
@@ -56,8 +73,6 @@ export function resolveWasmPaths(): WasmPaths {
 		);
 	}
 
-	// 2. 运行时 wasm 目录 —— web-tree-sitter 的 .js / .wasm 同目录
-	// 用 resolve("web-tree-sitter") 定位 .js 入口，取其 dirname。
 	const runtimeEntry = nodeRequire.resolve("web-tree-sitter");
 	const runtimeWasmDir = dirname(runtimeEntry);
 	if (!existsSync(runtimeWasmDir)) {

package/src/classifier/classifier.ts

@@ -157,6 +157,8 @@ export function createClassifier(deps: ClassifierDeps): {
 			messages: buildMessages(ctx),
 			...(timeoutMs !== undefined ? { timeoutMs } : {}),
 			...(signal !== undefined ? { signal } : {}),
+			// thinkingLevel 直接透传（含 "off"）；llm-shared 内部会把 "off" 映射为不传 reasoning（provider 默认）
+			reasoning: config.thinkingLevel,
 		});
 
 		// 3. 等待 callLLM + 外层超时/中止兜底（provider 不支持 timeoutMs/signal 时防永挂）

package/src/config.ts

@@ -17,6 +17,7 @@
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 
+import type { ModelThinkingLevel } from "@earendil-works/pi-ai";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import {
 	clearConfigCache,
@@ -50,6 +51,20 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+const THINKING_LEVELS: ReadonlySet<string> = new Set([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max",
+]);
+
+function isModelThinkingLevel(value: unknown): value is ModelThinkingLevel {
+	return typeof value === "string" && THINKING_LEVELS.has(value);
+}
+
 function normalizeClassifierConfig(raw: unknown): ClassifierConfig {
 	const record = isPlainObject(raw) ? raw : {};
 	const timeout = Number(record.timeout);
@@ -58,12 +73,17 @@ function normalizeClassifierConfig(raw: unknown): ClassifierConfig {
 	if (record.model !== undefined && !(typeof record.model === "string" && record.model.length > 0)) {
 		console.warn("[pi-permission] Ignoring invalid classifier.model (expected string 'auto' or 'provider/model-id'), using default auto");
 	}
+	// thinkingLevel 校验：合法值为 'off'|'minimal'|'low'|'medium'|'high'|'xhigh'|'max'
+	const thinkingLevel = isModelThinkingLevel(record.thinkingLevel)
+		? record.thinkingLevel
+		: DEFAULT_CLASSIFIER_CONFIG.thinkingLevel;
 	return {
 		enabled: record.enabled !== false,
 		model: typeof record.model === "string" && record.model.length > 0 ? record.model : DEFAULT_CLASSIFIER_CONFIG.model,
 		timeout: Number.isFinite(timeout) && timeout > 0 ? timeout : DEFAULT_CLASSIFIER_CONFIG.timeout,
 		autoApproveLowRisk: record.autoApproveLowRisk !== false,
 		autoDenyHighRisk: record.autoDenyHighRisk !== false,
+		thinkingLevel,
 	};
 }
 

package/src/production.ts

@@ -27,20 +27,15 @@ import { createClassifier } from "./classifier/index.js";
 import type { CheckPermissionDeps } from "./pipeline.js";
 import { getDefaultRules, matchRulesForArgv } from "./rules/index.js";
 
-// ──────────────────────── toSelector（'auto'→scoped 向后兼容，C2） ────────────────────────
+// ──────────────────────── toSelector（仅 ref 精确指定） ────────────────────────
 
 /**
  * 把 ClassifierConfig.model 字符串映射为 llm-shared ModelSelector。
  *
- * - 'auto' → { type: 'scoped' }：读 settings.json enabledModels 取首个可用 model
- *   （用户显式排序），取代旧的 findCheapestModel（cost 排序）。
- * - 其余视为 'provider/model-id' → { type: 'ref', ref: modelSpec }：精确匹配。
- *
- * 注：toSelector 只负责 selector 映射；'auto' 的向后兼容（scoped 空 fallback available）
- * 在下方 resolveModel 注入层处理（CL-scoped-fallback），toSelector 本身不感知 fallback。
+ * llm-shared 只支持 ref 精确指定；permission 的 "auto" 在 resolveModel 注入层自行处理，
+ * 不通过 ModelSelector 表达。
  */
 export function toSelector(modelSpec: string): ModelSelector {
-	if (modelSpec === "auto") return { type: "scoped" };
 	return { type: "ref", ref: modelSpec };
 }
 
@@ -49,12 +44,11 @@ export function toSelector(modelSpec: string): ModelSelector {
 /**
  * 创建生产环境 AI Classifier。
  *
- * resolveModel 注入（C3，含 scoped-null fallback available CL-scoped-fallback）：
- *  1. toSelector(config.model) → selector
- *  2. resolveModelShared(ctx, selector) → model（scoped 走 enabledModels，ref 走 find + hasConfiguredAuth）
- *  3. scoped 返回 null → fallback resolveModelShared(ctx, {type:'available'})（getAvailable 首个，
- *     等价旧 auto「有 apiKey 的首个」，向后兼容）
- *  4. model 仍 null → 返回 null（fail-closed）
+ * resolveModel 注入：
+ *  - config.model === "auto"：直接取 ctx.modelRegistry.getAvailable()[0]（permission 本地
+ *    向后兼容行为，不经过 llm-shared 的非精确 selector）。
+ *  - 其余：toSelector(config.model) → resolveModelShared(ctx, selector)（仅 ref 精确匹配）。
+ *  - model 仍 null → 返回 null（fail-closed）。
  *
  * callLLM 注入（C1a）：闭包捕获 ctx，把 llm-shared callLLM 绑定为 classifier 的 LLM 调用。
  * 凭证获取（getApiKeyAndHeaders）在 callLLM 内部完成（C1a 收口后不再在 resolveModel 层预检）。
@@ -64,14 +58,11 @@ export function createProductionClassifier(ctx: ExtensionContext): {
 } {
 	return createClassifier({
 		resolveModel: async (config) => {
-			const selector = toSelector(config.model);
-			let model = resolveModelShared(ctx, selector);
-			// CL-scoped-fallback：scoped（'auto'）在 enabledModels 空/无 auth 时 fallback available，
-			// 保证「有 apiKey provider 但没配 enabledModels」的用户不退化（旧 auto 行为）。
-			if (!model && selector.type === "scoped") {
-				model = resolveModelShared(ctx, { type: "available" });
+			if (config.model === "auto") {
+				const available = ctx.modelRegistry.getAvailable();
+				return available.length > 0 ? available[0] : null;
 			}
-			return model;
+			return resolveModelShared(ctx, toSelector(config.model));
 		},
 		callLLM: (opts) => callLLM(ctx, opts),
 		onLog: (msg: string) => console.warn(msg),

package/src/types.ts

@@ -5,6 +5,8 @@
  * 对应 slice plan 的 DM1-DM5 数据模型。
  */
 
+import type { ModelThinkingLevel } from "@earendil-works/pi-ai";
+
 // ──────────────────────── DM1: PermissionMode ────────────────────────
 
 /** 四档权限模式，按严格等级排序（yolo 最低，strict 最高） */
@@ -96,6 +98,12 @@ export interface ClassifierConfig {
 	autoApproveLowRisk: boolean;
 	/** 高风险是否自动拦截（转人工审批） */
 	autoDenyHighRisk: boolean;
+	/**
+	 * 标题生成 LLM 的 thinking 级别（pi 的 ModelThinkingLevel，THINKING_ORDER SSOT）。
+	 * 默认 "off"：不传 pi-ai reasoning（provider 默认行为）；
+	 * "minimal"~"max" 透传给 SimpleStreamOptions.reasoning（provider 不支持时静默忽略）。
+	 */
+	thinkingLevel: ModelThinkingLevel;
 }
 
 // ──────────────────────── DM5: PermissionConfig ────────────────────────
@@ -120,6 +128,7 @@ export const DEFAULT_CLASSIFIER_CONFIG: ClassifierConfig = {
 	timeout: 90,
 	autoApproveLowRisk: true,
 	autoDenyHighRisk: true,
+	thinkingLevel: "off",
 };
 
 export const DEFAULT_CONFIG: PermissionConfig = {