pi-jev-guard 0.3.3 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-jev-guard",
-  "version": "0.3.3",
+  "version": "0.5.0",
   "type": "module",
   "description": "Jev validation guard for pi: on-demand tool + automatic provider gate. Dual backend: TypeSafe direct + OpenRouter.",
   "keywords": [

package/src/automatic/guardian.ts

@@ -62,6 +62,8 @@ export interface PostPublishCheckResult {
   holdText?: string;
   /** Dettaglio per il report (publish con nota, hold). */
   grounding?: GateVerdictReport["grounding"];
+  /** Stato deterministico delle verifiche progetto osservate. */
+  verification?: GateVerdictReport["verification"];
 }
 
 /** Esito finale del gate con verdetto, per `/jev last` e diagnostica. */
@@ -76,6 +78,12 @@ export interface GateVerdictReport {
     action: "warned" | "repaired" | "held";
     reasons: string[];
   };
+  /** Mai generato dal modello: file edit/write + check configurati osservati. */
+  verification?: {
+    action: "passed" | "warned" | "repaired" | "held";
+    changedFiles: string[];
+    checks: Array<{ id: string; state: "passed" | "failed" | "pending" }>;
+  };
 }
 
 export class GuardianLimitError extends Error {
@@ -183,6 +191,10 @@ function withNotice(message: AssistantMessage, notice: string): AssistantMessage
   return { ...message, content };
 }
 
+function hasToolCalls(message: AssistantMessage): boolean {
+  return message.content.some((block) => block.type === "toolCall");
+}
+
 function assertCompleteCandidate(message: AssistantMessage): void {
   // Rifiuta terminali non supportati per pubblicazione.
   if (
@@ -284,12 +296,14 @@ export function runGuardedStream(
         const publishCandidate = async (
           notice?: string,
           grounding?: GateVerdictReport["grounding"],
+          verification?: GateVerdictReport["verification"],
         ): Promise<void> => {
           deps.onVerdict?.({
             verdict,
             attempts: attempt + 1,
             outcome: "published",
             ...(grounding ? { grounding } : {}),
+            ...(verification ? { verification } : {}),
           });
           const approved = notice ? withNotice(candidate, notice) : candidate;
           const aggregated = aggregateUsage(usages);
@@ -339,6 +353,15 @@ export function runGuardedStream(
         const runPostCheck = async (
           baseNotice?: string,
         ): Promise<"published" | "held" | undefined> => {
+          // I toolcall devono raggiungere il runtime: un post-check su una
+          // risposta intermedia potrebbe rigenerarla/holdarla e impedire il
+          // check stesso (es. `jev_verify`) prima che venga eseguito. Safety
+          // e tool policy restano già applicate; il post-check corre sul
+          // successivo messaggio finale dopo i tool result.
+          if (hasToolCalls(candidate)) {
+            await publishCandidate(baseNotice);
+            return "published";
+          }
           if (!deps.postPublishCheck) {
             await publishCandidate(baseNotice);
             return "published";
@@ -357,7 +380,7 @@ export function runGuardedStream(
           signal?.throwIfAborted();
           if (check.action === "publish") {
             const notice = [baseNotice, check.notice].filter(Boolean).join("") || undefined;
-            await publishCandidate(notice, check.grounding);
+            await publishCandidate(notice, check.grounding, check.verification);
             return "published";
           }
           if (check.action === "hold") {
@@ -367,6 +390,7 @@ export function runGuardedStream(
               attempts,
               outcome: "held",
               ...(check.grounding ? { grounding: check.grounding } : {}),
+              ...(check.verification ? { verification: check.verification } : {}),
             });
             await publishHoldText(check.holdText ?? "[JEV — OUTPUT NON PUBBLICATO]");
             return "held";
@@ -376,7 +400,7 @@ export function runGuardedStream(
             rejectedText: rawCandidate,
             feedback:
               check.feedback ??
-              "Grounding check failed; only assert session activities supported by evidence.",
+              "Post-publication check failed; correct the draft using the supplied evidence.",
           });
           return undefined;
         };

package/src/automatic/overlay.ts

@@ -128,54 +128,129 @@ function stripTwins(models: readonly Model<Api>[]): Model<Api>[] {
 }
 
 /**
- * Costruisce l'overlay. Non registra nulla: la registrazione spetta al
- * chiamante (pi.registerProvider), così può fallire senza toccare nulla.
+ * Patch in-place del gate gemellato sullo STESSO oggetto provider.
+ *
+ * Nessuna (ri-)registrazione nel registry: l'identità dell'oggetto e la sua
+ * config restano quelle pubblicate dal proprietario (builtin o altre
+ * estensioni come pi-accounts), quindi i loro controlli di ownership e i
+ * loro snapshot non vedono mai una "configuration changed" e non armano
+ * abort. Rieseguibile: se l'oggetto è già patchato riparte dai metodi
+ * originali con la nuova lista twin. Ritorna gli id gemello pubblicati.
  */
-export function buildOverlaidProvider(deps: OverlayDeps): Provider {
-  const upstream = deps.upstream;
-  // Mappa twin-id -> modello originale (ricostruita a ogni refresh).
-  let twinToOriginal = new Map<string, Model<Api>>();
-  let currentModels: Model<Api>[] = [];
+export interface PatchDeps {
+  /** Id modelli (originali) da gemellare. */
+  twinModelIds: string[];
+  getConfig: () => JevConfig;
+  getReview: () => ReviewFn;
+  /** Riceve l'esito finale di ogni turno sul twin (per `/jev last`). */
+  onVerdict?: (report: GateVerdictReport) => void;
+  /**
+   * Factory del controllo post-safety, una per richiesta: il budget repair
+   * vive nella closure restituita, non nel loop del guardian.
+   */
+  createPostCheck?: () => PostPublishCheckFn | undefined;
+}
+
+/** Metodi originali prima della patch (per ripristino su unpatch). */
+interface PatchedOriginals {
+  getModels: Provider["getModels"];
+  stream: Provider["stream"] | undefined;
+  streamSimple: Provider["streamSimple"];
+  refreshModels?: Provider["refreshModels"];
+  filterModels?: Provider["filterModels"];
+}
+
+interface PatchRecord {
+  /** Originali veri (mai i nostri wrapper): evolve con le adozioni. */
+  orig: PatchedOriginals;
+  /** I nostri wrapper, per distinguerli dalle riassegnazioni altrui. */
+  wrapGetModels: Provider["getModels"];
+}
+
+const patchedOriginals = new WeakMap<object, PatchRecord>();
+
+/** True se l'oggetto provider è attualmente patchato da noi. */
+export function isPatched(provider: Provider): boolean {
+  return patchedOriginals.has(provider);
+}
 
-  function rebuildTwins(rawOriginals: readonly Model<Api>[]): Model<Api>[] {
-    twinToOriginal = new Map();
-    const chosen = new Set(deps.twinModelIds);
-    // Dedup per id: sorgenti miste (builtin + store + statica) possono
-    // ripetere lo stesso modello e produrrebbero twin duplicati.
-    const originals = mergeModelsById(stripTwins(rawOriginals), []);
+export function patchProvider(provider: Provider, deps: PatchDeps): string[] {
+  const previous = patchedOriginals.get(provider);
+  const rawStream: unknown = previous
+    ? previous.orig.stream
+    : (provider as { stream?: unknown }).stream;
+  const base: PatchedOriginals = previous?.orig ?? {
+    // Raw, mai bind: invocati con this=provider al momento della chiamata.
+    getModels: provider.getModels,
+    stream: typeof rawStream === "function"
+      ? (rawStream as NonNullable<Provider["stream"]>)
+      : undefined,
+    streamSimple: provider.streamSimple,
+    ...(provider.refreshModels
+      ? { refreshModels: provider.refreshModels }
+      : {}),
+    ...(provider.filterModels
+      ? { filterModels: provider.filterModels }
+      : {}),
+  };
+  const twinIds = [...deps.twinModelIds];
+  const providerId = provider.id;
+
+  // Risoluzione pigra: legge SEMPRE i modelli correnti (nessuna snapshot
+  // che diventa stale dopo refresh altrui o cataloghi dinamici). Se il
+  // proprietario riassegna getModels dopo la patch, la nuova fn viene
+  // adottata come base (i nostri wrapper si riconoscono e non si adottano).
+  function currentBase(): PatchedOriginals {
+    const rec = patchedOriginals.get(provider);
+    const orig = rec?.orig ?? base;
+    const cur = provider.getModels as Provider["getModels"];
+    if (rec && cur !== rec.wrapGetModels && cur !== orig.getModels) {
+      orig.getModels = cur;
+    }
+    return orig;
+  }
+
+  function currentOriginals(): Model<Api>[] {
+    return mergeModelsById(stripTwins(currentBase().getModels.call(provider)), []);
+  }
+
+  function resolveTwin(modelId: string): Model<Api> | undefined {
+    if (!isTwinId(modelId)) return undefined;
+    const wanted = untwinId(modelId);
+    if (!twinIds.includes(wanted)) return undefined;
+    return currentOriginals().find((m) => m.id === wanted);
+  }
+
+  function twinEntries(): Model<Api>[] {
+    const originals = currentOriginals();
+    const chosen = new Set(twinIds);
     const twins: Model<Api>[] = [];
+    const seen = new Set<string>();
     for (const original of originals) {
-      if (chosen.has(original.id)) {
-        const twin = twinModelFor(original, upstream.id);
-        if (twinToOriginal.has(twin.id)) continue;
-        twinToOriginal.set(twin.id, original);
-        twins.push(twin);
-      }
+      if (!chosen.has(original.id)) continue;
+      const twin = twinModelFor(original, providerId);
+      if (seen.has(twin.id)) continue;
+      seen.add(twin.id);
+      twins.push(twin);
     }
-    currentModels = [...originals.map((m) => ({ ...m })), ...twins];
-    return currentModels;
+    return twins;
   }
 
-  rebuildTwins(upstream.getModels());
-
   function upstreamCall(
     model: Model<Api>,
     context: Context,
     options?: SimpleStreamOptions,
   ): AssistantMessageEventStream {
-    // Public aliases are not model changes. Preserve reasoning signatures,
-    // response phases and tool ids when replaying the transcript upstream.
+    // Gli alias pubblici non sono cambi di modello: normalizza la cronologia
+    // preservando firme reasoning e tool id nel transcript upstream.
     const originalContext: Context = {
       ...context,
       messages: context.messages.map((message) =>
-        message.role === "assistant" && message.provider === upstream.id && isTwinId(message.model)
+        message.role === "assistant" && message.provider === providerId && isTwinId(message.model)
           ? { ...message, model: untwinId(message.model) }
           : message),
     };
-    if (deps.upstreamStreams) {
-      return deps.upstreamStreams.streamSimple(model, originalContext, options);
-    }
-    return upstream.streamSimple(model, originalContext, options);
+    return base.streamSimple.call(provider, model, originalContext, options);
   }
 
   function guardedStreamSimple(
@@ -183,9 +258,9 @@ export function buildOverlaidProvider(deps: OverlayDeps): Provider {
     context: Context,
     options?: SimpleStreamOptions,
   ): AssistantMessageEventStream {
-    const twinOf = twinToOriginal.get(model.id);
-    // A stale/unknown alias must never leak to the upstream API, even if a
-    // dynamic refresh removed its original from the catalogue.
+    const twinOf = resolveTwin(model.id);
+    // Un alias stale/sconosciuto non deve mai arrivare all'API upstream,
+    // anche se un refresh ha rimosso l'originale dal catalogo.
     if (!twinOf) {
       if (!isTwinId(model.id)) return upstreamCall(model, context, options);
       const stream = createAssistantMessageEventStream();
@@ -221,31 +296,29 @@ export function buildOverlaidProvider(deps: OverlayDeps): Provider {
     });
   }
 
-  const overlay: Provider = {
-    id: upstream.id,
-    name: upstream.name,
-    baseUrl: upstream.baseUrl,
-    headers: upstream.headers,
-    // STESSO oggetto auth: stesso slot credenziale, stesso login/OAuth.
-    auth: upstream.auth,
-    getModels: () => currentModels,
-    stream: (model, context, options) =>
+  const wrapGetModels: Provider["getModels"] = () => [
+    ...currentOriginals().map((m) => ({ ...m })),
+    ...twinEntries(),
+  ];
+  provider.getModels = wrapGetModels;
+  if (base.stream) {
+    provider.stream = ((model: any, context: any, options: any) =>
       guardedStreamSimple(
         model as Model<Api>,
         context,
         options as SimpleStreamOptions | undefined,
-      ),
-    streamSimple: (model, context, options) =>
-      guardedStreamSimple(model as Model<Api>, context, options),
-  };
+      )) as Provider["stream"];
+  }
+  provider.streamSimple = ((model: any, context: any, options: any) =>
+    guardedStreamSimple(model as Model<Api>, context, options)) as Provider["streamSimple"];
 
-  // Forward refresh con re-gemellamento. Il persist va depurato dai twin:
-  // lo store è letto anche dal builtin a overlay assente, che li
-  // scambierebbe per modelli normali (senza gate!).
-  if (upstream.refreshModels) {
-    const upstreamRefresh = upstream.refreshModels.bind(upstream);
-    overlay.refreshModels = async (ctx: RefreshModelsContext): Promise<void> => {
-      await upstreamRefresh({
+  // Forward refresh con persist depurato dai twin: lo store è letto anche
+  // dal builtin a overlay assente, che li scambierebbe per modelli normali
+  // (senza gate!). La risoluzione pigra non ha snapshot da ricostruire.
+  if (base.refreshModels) {
+    const upstreamRefresh = base.refreshModels;
+    provider.refreshModels = (async (ctx: RefreshModelsContext): Promise<void> => {
+      await upstreamRefresh.call(provider, {
         ...ctx,
         publish: (publication) =>
           ctx.publish({
@@ -260,41 +333,60 @@ export function buildOverlaidProvider(deps: OverlayDeps): Provider {
                   },
             update: publication.update
               ? () => {
-                  // Applica prima l'update upstream (popola il suo oggetto),
-                  // poi ricostruisci originali + twin da quelli freschi.
                   publication.update?.();
-                  rebuildTwins(upstream.getModels());
                 }
               : undefined,
           }),
       });
-    };
+    }) as Provider["refreshModels"];
   }
 
   // Forward filtro credenziali: si applica agli originali, i twin seguono
   // il destino dell'originale corrispondente.
-  if (upstream.filterModels) {
-    const upstreamFilter = upstream.filterModels.bind(upstream);
-    overlay.filterModels = (
+  if (base.filterModels) {
+    const upstreamFilter = base.filterModels;
+    provider.filterModels = ((
       models: readonly Model<Api>[],
       credential: Credential | undefined,
     ): readonly Model<Api>[] => {
       const originals = models.filter((m) => !isTwinId(m.id));
       const kept = new Set(
-        upstreamFilter(originals as ModelT<Api>[], credential).map((m) => m.id),
+        upstreamFilter.call(provider, originals as ModelT<Api>[], credential).map((m) => m.id),
       );
       return models.filter((m) =>
         isTwinId(m.id) ? kept.has(untwinId(m.id)) : kept.has(m.id),
       );
-    };
+    }) as Provider["filterModels"];
   }
 
-  if (upstream.fetchDeferred) {
-    overlay.fetchDeferred = upstream.fetchDeferred.bind(upstream);
-  }
-  if (upstream.cancelDeferred) {
-    overlay.cancelDeferred = upstream.cancelDeferred.bind(upstream);
+  if (previous) {
+    // Re-patch: i wrapper si ricreano, gli originali veri restano.
+    // Aggiorna il riferimento al wrapper corrente o l'adozione
+    // scambierebbe il nuovo wrapper per una fn altrui.
+    previous.wrapGetModels = wrapGetModels;
+    patchedOriginals.set(provider, previous);
+  } else {
+    patchedOriginals.set(provider, { orig: base, wrapGetModels });
   }
+  return twinEntries().map((t) => t.id);
+}
 
-  return overlay;
+/**
+ * Ripristina i metodi originali. Ritorna false se l'oggetto non era patchato
+ * (es. già sostituito dal proprietario: niente da ripristinare).
+ */
+export function unpatchProvider(provider: Provider): boolean {
+  const rec = patchedOriginals.get(provider);
+  const originals = rec?.orig;
+  if (!originals) return false;
+  provider.getModels = originals.getModels;
+  if (originals.stream) provider.stream = originals.stream;
+  else delete (provider as { stream?: unknown }).stream;
+  provider.streamSimple = originals.streamSimple;
+  if (originals.refreshModels) provider.refreshModels = originals.refreshModels;
+  else delete (provider as { refreshModels?: unknown }).refreshModels;
+  if (originals.filterModels) provider.filterModels = originals.filterModels;
+  else delete (provider as { filterModels?: unknown }).filterModels;
+  patchedOriginals.delete(provider);
+  return true;
 }

package/src/commands.ts

@@ -19,6 +19,7 @@ import { reviewWithCoverage } from "./reviewer.ts";
 import type { Metrics } from "./metrics.ts";
 import type { OutputVerdict } from "./output-judge.ts";
 import type { GateVerdictReport } from "./automatic/guardian.ts";
+import type { VerificationMode } from "./verification.ts";
 
 export interface GateStatusView {
   active: boolean;
@@ -79,6 +80,27 @@ export interface JevCommandDeps {
     hasStaleTests: boolean;
   };
   setGrounding: (mode: "off" | "warn" | "repair" | "hold") => JevConfig;
+  verificationStatus?: (cwd: string) => {
+    enabled: boolean;
+    mode: VerificationMode;
+    manifestPath: string;
+    manifestLoaded: boolean;
+    manifestError?: string;
+    changedFiles: string[];
+    checks: Array<{ id: string; state: "passed" | "failed" | "pending" }>;
+  };
+  setVerification?: (mode: "off" | VerificationMode) => JevConfig;
+  reloadVerificationManifest?: (cwd: string) => {
+    ok: boolean;
+    error?: string;
+    path?: string;
+  };
+  runVerification?: (args: {
+    cwd: string;
+    selection: string | undefined;
+    signal?: AbortSignal;
+    trusted: boolean;
+  }) => Promise<{ ok: boolean; message: string; results: unknown[] }>;
 }
 
 export const JEV_SUBCOMMANDS = [
@@ -96,6 +118,8 @@ export const JEV_SUBCOMMANDS = [
   "output",
   "last",
   "grounding",
+  "verification",
+  "verify",
   "backend",
   "save-key",
   "help",
@@ -121,6 +145,10 @@ export const JEV_HELP_TEXT = [
   "  /jev last                Ultimo verdetto del gate (twin): esito e controlli",
   "  /jev grounding off|warn|repair|hold",
   "                           Grounding affermazioni sessione (solo automatic, opt-in)",
+  "  /jev verification off|warn|repair|hold|reload",
+  "                           Footer deterministico + repair dai check progetto (opt-in; reload acquisisce manifest)",
+  "  /jev verify [recommended|all|id]",
+  "                           Esegue solo check dichiarati in .pi/jev-verification.json",
   "  /jev backend             Mostra backend attivo e chiavi rilevate",
   "  /jev backend auto|openrouter|typesafe",
   "                           Cambia backend (salvato in jev-config.json)",
@@ -140,7 +168,7 @@ export const JEV_HELP_TEXT = [
 export function registerJevCommand(pi: ExtensionAPI, deps: JevCommandDeps) {
   pi.registerCommand("jev", {
     description:
-      "Jev guard: verifica con TypeSafe Jev. Sottocomandi: status, mode, models, upstream, off, check, stats, help.",
+      "Jev guard: gate, grounding e verifica progetto. Sottocomandi: status, mode, upstream, check, verification, verify, stats, help.",
     getArgumentCompletions: (argumentPrefix) => {
       const prefix = argumentPrefix.trim().toLowerCase();
       return JEV_SUBCOMMANDS.filter((s) => s.startsWith(prefix)).map(
@@ -188,6 +216,7 @@ export function registerJevCommand(pi: ExtensionAPI, deps: JevCommandDeps) {
         const info = deps.reviewerInfo();
         const gate = deps.gateStatus();
         const twinView = deps.twinStatus();
+        const verification = deps.verificationStatus?.(ctx.cwd);
         const authProvider = twinView.primary?.provider ?? cfg.automatic.upstreamProvider;
         let guardedAuth = "—";
         if (gate.active) {
@@ -250,6 +279,11 @@ export function registerJevCommand(pi: ExtensionAPI, deps: JevCommandDeps) {
             `Exfil check: ${cfg.exfilCheck.enabled ? "attivo in automatic (confirm in TUI, fail-open)" : "disattivo (config)"}`,
             `Output judge: ${cfg.outputJudge.enabled ? `attivo in automatic (tool: ${cfg.outputJudge.tools.join(",") || "—"}, fail-open)` : "disattivo (config)"}`,
             `Grounding: ${cfg.grounding.enabled ? `attivo in automatic (mode=${cfg.grounding.mode}, evidenza=${deps.groundingStatus().entries}${deps.groundingStatus().hasStaleTests ? ", test stale" : ""})` : "disattivo (opt-in: /jev grounding warn)"}`,
+            verification
+              ? `Verifica progetto: ${verification.enabled
+                ? `attiva (mode=${verification.mode}, manifest=${verification.manifestLoaded ? "OK" : verification.manifestError ?? "assente"}, modifiche=${verification.changedFiles.length}, check=${verification.checks.map((check) => `${check.id}:${check.state}`).join(",") || "—"})`
+                : `disattiva (opt-in: /jev verification warn; manifest=${verification.manifestPath})`}`
+              : "Verifica progetto: non disponibile in questa estensione",
             cfg.mode === "automatic"
               ? "ATTENZIONE: in automatic testo/codice vengono inviati al verificatore. Crea il twin con /jev upstream e seleziona il modello __jev per enforcement."
               : "on-demand: nessuna verifica automatica.",
@@ -465,6 +499,9 @@ export function registerJevCommand(pi: ExtensionAPI, deps: JevCommandDeps) {
             last.report.grounding
               ? `grounding: ${last.report.grounding.action} (${last.report.grounding.reasons.join(", ") || "n/a"})`
               : "grounding: non intervenuto",
+            last.report.verification
+              ? `verifica progetto: ${last.report.verification.action} (file=${last.report.verification.changedFiles.join(",") || "—"}; check=${last.report.verification.checks.map((check) => `${check.id}:${check.state}`).join(",") || "—"})`
+              : "verifica progetto: non intervenuta",
             v.errorCode ? `errore: ${v.errorCode}` : `backend: ${v.backend ?? "?"} · modello: ${v.model ?? "?"}`,
             v.truncated ? `troncato: ${JSON.stringify(v.truncated)}` : "copertura intera",
             `tempo verifica: ${Math.round(v.elapsedMs)}ms`,
@@ -521,6 +558,74 @@ export function registerJevCommand(pi: ExtensionAPI, deps: JevCommandDeps) {
         return;
       }
 
+      if (sub === "verification") {
+        if (!deps.verificationStatus || !deps.setVerification) {
+          ctx.ui.notify("Verifica progetto non disponibile in questa versione dell'estensione.", "warning");
+          return;
+        }
+        const value = parts[1];
+        if (value === undefined) {
+          const st = deps.verificationStatus(ctx.cwd);
+          ctx.ui.notify(
+            st.enabled
+              ? [
+                  `Verifica progetto attiva in automatic (mode=${st.mode}).`,
+                  `Manifest: ${st.manifestPath} — ${st.manifestLoaded ? "OK" : st.manifestError ?? "non disponibile"}.`,
+                  `Modifiche osservate: ${st.changedFiles.join(", ") || "nessuna"}.`,
+                  `Check: ${st.checks.map((check) => `${check.id}:${check.state}`).join(", ") || "nessuno pertinente"}.`,
+                  "Esegui quelli mancanti con /jev verify recommended. Dopo una modifica manuale del manifest: /jev verification reload.",
+                ].join("\n")
+              : `Verifica progetto disattiva (opt-in). Manifest previsto: ${st.manifestPath}. Attiva con /jev verification warn|repair|hold.`,
+            "info",
+          );
+          return;
+        }
+        if (value === "reload") {
+          if (!deps.reloadVerificationManifest) {
+            ctx.ui.notify("Reload manifest non disponibile in questa versione dell'estensione.", "warning");
+            return;
+          }
+          const reloaded = deps.reloadVerificationManifest(ctx.cwd);
+          ctx.ui.notify(
+            reloaded.ok
+              ? `Manifest verifica acquisito: ${reloaded.path}. I comandi verranno eseguiti solo da questa snapshot.`
+              : `Manifest verifica non acquisito: ${reloaded.error}`,
+            reloaded.ok ? "info" : "warning",
+          );
+          return;
+        }
+        if (value !== "off" && value !== "warn" && value !== "repair" && value !== "hold") {
+          ctx.ui.notify("Uso: /jev verification off|warn|repair|hold|reload", "warning");
+          return;
+        }
+        deps.setVerification(value);
+        ctx.ui.notify(
+          value === "off"
+            ? "Verifica progetto disattivata."
+            : `Verifica progetto attiva (mode=${value}). Crea ${deps.verificationStatus(ctx.cwd).manifestPath} con i soli comandi approvati, poi usa /jev verify recommended.`,
+          "info",
+        );
+        return;
+      }
+
+      if (sub === "verify") {
+        if (!deps.runVerification) {
+          ctx.ui.notify("Verifica progetto non disponibile in questa versione dell'estensione.", "warning");
+          return;
+        }
+        const trusted = typeof (ctx as { isProjectTrusted?: unknown }).isProjectTrusted === "function"
+          ? ctx.isProjectTrusted()
+          : false;
+        const result = await deps.runVerification({
+          cwd: ctx.cwd,
+          selection: parts[1],
+          signal: ctx.signal ?? undefined,
+          trusted,
+        });
+        ctx.ui.notify(result.message, result.ok ? "info" : "warning");
+        return;
+      }
+
       if (sub === "reload") {
         const cfg = deps.reload();
         ctx.ui.notify(`Config ricaricata. mode=${cfg.mode} backend=${cfg.jev.backend}`, "info");

package/src/config.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import type { JevBackend } from "./reviewer.ts";
+import type { VerificationSettings } from "./verification.ts";
 
 export type JevMode = "on-demand" | "automatic";
 export type JevBackendSetting = JevBackend | "auto";
@@ -97,6 +98,7 @@ export interface JevConfig {
     /** Una modifica riuscita invalida i test precedenti (stale). */
     invalidateTestsOnEdit: boolean;
   };
+  verification: VerificationSettings;
   exfilCheck: {
     /** Check semantico sui comandi con tool di rete (solo automatic). */
     enabled: boolean;
@@ -194,6 +196,17 @@ export const DEFAULT_CONFIG: JevConfig = {
     cacheSeconds: 120,
     invalidateTestsOnEdit: true,
   },
+  verification: {
+    // Opt-in: il manifest può eseguire solo comandi esplicitamente approvati
+    // dal progetto; non abilitarlo silenziosamente in installazioni esistenti.
+    enabled: false,
+    mode: "warn",
+    manifestPath: ".pi/jev-verification.json",
+    maxRepairs: 1,
+    commandTimeoutMs: 120000,
+    outputChars: 6000,
+    maxCommands: 3,
+  },
   exfilCheck: {
     enabled: true,
     tools: ["bash", "powershell"],