pi-openai-toolkit 0.14.8 → 0.14.9

package/README.md

@@ -199,7 +199,7 @@ Allow a model and reviewer in `autoMode`:
 }
 ```
 
-Use `/auto on` in the session. The default `side-effect` gate reviews `bash`, `write`, `edit`, and configured extra tools. Set `gate` to `"all"` when every tool call needs review. A reviewer timeout does not approve a call.
+Use `/auto on` in the session, or start Pi with `--auto`. The TUI shows an activation notice and temporarily changes the working indicator to `Auto mode: reviewing <tool>` while a gated call is being reviewed; the footer keeps the active gate visible. On Pi versions that expose the compatible tool renderer, each tool block in Auto Mode also gets a bottom line: reviewed calls show states such as `allowed by reviewer · low risk · authorization medium` or `denied · <reason>`, while calls outside the configured gate show `not reviewed · outside the configured gate`. If that renderer seam is unavailable, the extension warns once and keeps the footer-only status. The default `side-effect` gate reviews `bash`, `write`, `edit`, and configured extra tools. Set `gate` to `"all"` when every tool call needs review. A reviewer timeout does not approve a call.
 
 ## Common configuration
 

package/README.zh.md

@@ -199,7 +199,7 @@ standalone 路由属于实验性的 CPA/Codex 网关协议，不是稳定的公
 }
 ```
 
-在会话中使用 `/auto on`。默认的 `side-effect` 审查范围覆盖 `bash`、`write`、`edit` 和额外配置的工具。如果需要审查所有工具调用，将 `gate` 设置为 `"all"`。审查超时不会自动放行调用。
+在会话中使用 `/auto on`，也可以用 `--auto` 启动 Pi。TUI 会显示自动模式已开启的提示；每次审查受控工具时，工作指示器会临时显示 `Auto mode: reviewing <tool>`，底部状态栏会保留当前审查范围。在支持兼容 tool renderer 的 Pi 版本中，自动模式下每个工具块底部都会显示一行状态：已审查的调用会显示 `allowed by reviewer · low risk · authorization medium` 或 `denied · <reason>`，不在当前审查范围内的调用会显示 `not reviewed · outside the configured gate`。如果当前 Pi 没有这个 renderer seam，扩展会告警一次并继续使用底部状态栏提示。默认的 `side-effect` 审查范围覆盖 `bash`、`write`、`edit` 和额外配置的工具。如果需要审查所有工具调用，将 `gate` 设置为 `"all"`。审查超时不会自动放行调用。
 
 ## 常用配置
 

package/docs/internals.md

@@ -9,6 +9,7 @@ Developer-facing reference for [pi-openai-toolkit](../README.md). The README kee
 - [Remote Context protocol](#remote-context-protocol)
 - [Rollover lifecycle](#rollover-lifecycle)
 - [Remote Compaction v2 wire contract](#remote-compaction-v2-wire-contract)
+- [Auto Mode TUI review renderer](#auto-mode-tui-review-renderer)
 - [Artifacts and debugging](#artifacts-and-debugging)
 - [Provenance](#provenance)
 
@@ -85,6 +86,23 @@ New checkpoints record `inputProvenance: "pi-context-hook-v1"` or `"legacy-raw-c
 
 ---
 
+### Auto Mode TUI review renderer
+
+Auto Mode owns the review decision, but Pi owns the built-in tool-block component. Pi 0.85.1 exports `ToolExecutionComponent` without a public decorator interface, so `src/auto-mode/tool-review-tui.ts` installs a narrow, idempotent compatibility patch on its `render()` method. The patch only reads the component's existing tool-call ID and appends one bounded, single-line status after the normal block output; it never changes tool execution, event ordering, or provider payloads.
+
+The extension updates an ephemeral per-call state through the same `tool_call` lifecycle that performs the review:
+
+- `skipped` when the tool is outside the configured Auto Mode gate;
+- `reviewing` while the reviewer model is running;
+- `awaiting-user` when an unavailable review reaches interactive confirmation;
+- `allowed`, `denied`, or `blocked` after the final decision.
+
+The state is intentionally not persisted to the session. It is bounded to recent calls and cleared at `session_start`, so reloading a session does not invent historical approval claims. The renderer uses Pi's current theme when available, truncates untrusted rationale text, and preserves the original render output when no state exists.
+
+This is a version-coupled adapter, not a stable Pi extension contract. It is feature-detected at registration time and marked with a global symbol so extension reloads do not wrap the class repeatedly. If the exported component shape changes or becomes non-writable, the adapter becomes a no-op, emits one warning in TUI mode, and the existing footer/working-message review indicators remain the fallback.
+
+---
+
 ### Artifacts and debugging
 
 With `debug: true`, the toolkit writes lifecycle and compaction artifacts under `artifactRoot` (default `~/.pi/agent/artifacts/pi-openai-toolkit/compaction`):

package/extensions/auto-mode.ts

@@ -1 +1 @@
-export { default } from "../src/auto-mode/extension.ts";
+export { default } from "../src/auto-mode/extension.ts";

package/extensions/codex-astra.ts

@@ -1 +1 @@
-export { default } from "../src/codex-astra/extension.ts";
+export { default } from "../src/codex-astra/extension.ts";

package/extensions/compaction.ts

@@ -1 +1 @@
-export { default } from "../src/extension-runtime.ts";
+export { default } from "../src/extension-runtime.ts";

package/extensions/image-generation.ts

@@ -1 +1 @@
-export { default } from "../src/image-generation/extension.ts";
+export { default } from "../src/image-generation/extension.ts";

package/extensions/web-search.ts

@@ -1 +1 @@
-export { default } from "../src/web-search/extension.ts";
+export { default } from "../src/web-search/extension.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.14.8",
+  "version": "0.14.9",
   "private": false,
   "type": "module",
   "engines": {
@@ -74,6 +74,7 @@
     "src/image-generation/service.ts",
     "src/image-generation/types.ts",
     "src/auto-mode/extension.ts",
+    "src/auto-mode/tool-review-tui.ts",
     "src/auto-mode/policy.ts",
     "src/auto-mode/prompt.ts",
     "src/auto-mode/transcript.ts",

package/src/auto-mode/classifier.ts

@@ -1,165 +1,165 @@
-import type { Api, Model } from "@earendil-works/pi-ai";
-import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { parseModelSpec } from "../runtime";
-import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
-import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
-
-/** One completed classification of the trajectory, tagged to a tool-call position. */
-export type ScoreRecord = {
-	risk: ClassifierRisk;
-	/** Tool-call counter value when the sample was taken. */
-	scoredAtCall: number;
-	/** Fingerprint of the user turns the score was based on. */
-	authorizationVersion: string;
-	sampledAt: number;
-};
-
-/**
- * Mutable per-session tracker for the non-blocking pre-scorer.
- *
- * The counters reproduce Codex's staleness rule: the agent keeps running while a
- * classification is in flight, so a score is only trustworthy if it is recent
- * enough and nothing the user said has changed underneath it.
- */
-export type ScoreTracker = {
-	latestCallIndex: number;
-	latestScoredIndex: number;
-	latestFailedIndex: number;
-	score?: ScoreRecord;
-};
-
-export function createScoreTracker(): ScoreTracker {
-	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
-}
-
-/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
-export function resetScoreTracker(tracker: ScoreTracker): void {
-	tracker.latestCallIndex = 0;
-	tracker.latestScoredIndex = 0;
-	tracker.latestFailedIndex = 0;
-	tracker.score = undefined;
-}
-
-/**
- * Fingerprint of the user-authored conversation. Any new or edited user turn makes
- * an existing score stale, because the score's authorization premise changed.
- */
-export function authorizationVersion(userText: string): string {
-	const bounded = boundReviewText(userText, 8_000);
-	let hash = 2166136261;
-	for (let index = 0; index < bounded.length; index += 1) {
-		hash ^= bounded.charCodeAt(index);
-		hash = Math.imul(hash, 16777619);
-	}
-	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
-}
-
-export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
-	tracker.score = score;
-	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
-}
-
-export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
-	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
-}
-
-export type FastDecisionInput = {
-	tracker: ScoreTracker;
-	/** Tool-call counter value for the call being gated. */
-	currentCallIndex: number;
-	authorizationVersion: string;
-	maxLag: number;
-	/** Retries after a denial and widened gates must not take the fast path. */
-	requiresSynchronousReview?: boolean;
-};
-
-/**
- * Decide whether a cached classification can satisfy this gated call without
- * running the blocking reviewer. Anything other than `low_risk` defers to the
- * synchronous review; the classifier never denies an action on its own.
- */
-export function fastApprovalEligible(input: FastDecisionInput): {
-	eligible: boolean;
-	reason: FastDecisionReason;
-} {
-	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
-
-	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
-	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
-
-	const score = input.tracker.score;
-	if (!score) return defer("missing_score");
-
-	const lag = input.currentCallIndex - score.scoredAtCall;
-	if (lag > input.maxLag) return defer("stale_score");
-	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
-	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
-	return defer("elevated_risk");
-}
-
-export type ClassificationResult =
-	| { kind: ClassifierRisk; model: string }
-	| { kind: "failed"; reason: string };
-
-/**
- * Run one non-blocking classification. Output is a single token; anything else is a
- * failed sample rather than a verdict, so a confused classifier costs a review and
- * never an approval or a denial.
- */
-export async function classifyTrajectory(params: {
-	registry: Pick<ModelRegistry, "find" | "complete">;
-	modelSpec: string;
-	prompt: string;
-	timeoutMs: number;
-	signal?: AbortSignal;
-}): Promise<ClassificationResult> {
-	const parsed = parseModelSpec(params.modelSpec);
-	if (!parsed) {
-		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
-	}
-	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
-	if (!model) {
-		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
-	}
-	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
-
-	const controller = new AbortController();
-	const abortFromCaller = () => controller.abort();
-	if (params.signal?.aborted) controller.abort();
-	else params.signal?.addEventListener("abort", abortFromCaller);
-	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
-
-	try {
-		const response = await params.registry.complete(
-			model,
-			{
-				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
-				messages: [
-					{
-						role: "user",
-						content: [{ type: "text", text: params.prompt }],
-						timestamp: Date.now(),
-					},
-				],
-			},
-			{ signal: controller.signal, cacheRetention: "none" },
-		);
-		if (response.stopReason === "error" || response.stopReason === "aborted") {
-			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
-		}
-		const text = response.content
-			.filter((block): block is { type: "text"; text: string } => block.type === "text")
-			.map((block) => block.text)
-			.join("")
-			.trim()
-			.toLowerCase();
-		if (/^high\b/.test(text)) return { kind: "high", model: label };
-		if (/^low\b/.test(text)) return { kind: "low", model: label };
-		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
-	} catch (error) {
-		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
-	} finally {
-		clearTimeout(timer);
-		params.signal?.removeEventListener("abort", abortFromCaller);
-	}
-}
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { parseModelSpec } from "../runtime";
+import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
+import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
+
+/** One completed classification of the trajectory, tagged to a tool-call position. */
+export type ScoreRecord = {
+	risk: ClassifierRisk;
+	/** Tool-call counter value when the sample was taken. */
+	scoredAtCall: number;
+	/** Fingerprint of the user turns the score was based on. */
+	authorizationVersion: string;
+	sampledAt: number;
+};
+
+/**
+ * Mutable per-session tracker for the non-blocking pre-scorer.
+ *
+ * The counters reproduce Codex's staleness rule: the agent keeps running while a
+ * classification is in flight, so a score is only trustworthy if it is recent
+ * enough and nothing the user said has changed underneath it.
+ */
+export type ScoreTracker = {
+	latestCallIndex: number;
+	latestScoredIndex: number;
+	latestFailedIndex: number;
+	score?: ScoreRecord;
+};
+
+export function createScoreTracker(): ScoreTracker {
+	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
+}
+
+/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
+export function resetScoreTracker(tracker: ScoreTracker): void {
+	tracker.latestCallIndex = 0;
+	tracker.latestScoredIndex = 0;
+	tracker.latestFailedIndex = 0;
+	tracker.score = undefined;
+}
+
+/**
+ * Fingerprint of the user-authored conversation. Any new or edited user turn makes
+ * an existing score stale, because the score's authorization premise changed.
+ */
+export function authorizationVersion(userText: string): string {
+	const bounded = boundReviewText(userText, 8_000);
+	let hash = 2166136261;
+	for (let index = 0; index < bounded.length; index += 1) {
+		hash ^= bounded.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
+}
+
+export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
+	tracker.score = score;
+	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
+}
+
+export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
+	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
+}
+
+export type FastDecisionInput = {
+	tracker: ScoreTracker;
+	/** Tool-call counter value for the call being gated. */
+	currentCallIndex: number;
+	authorizationVersion: string;
+	maxLag: number;
+	/** Retries after a denial and widened gates must not take the fast path. */
+	requiresSynchronousReview?: boolean;
+};
+
+/**
+ * Decide whether a cached classification can satisfy this gated call without
+ * running the blocking reviewer. Anything other than `low_risk` defers to the
+ * synchronous review; the classifier never denies an action on its own.
+ */
+export function fastApprovalEligible(input: FastDecisionInput): {
+	eligible: boolean;
+	reason: FastDecisionReason;
+} {
+	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
+
+	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
+	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
+
+	const score = input.tracker.score;
+	if (!score) return defer("missing_score");
+
+	const lag = input.currentCallIndex - score.scoredAtCall;
+	if (lag > input.maxLag) return defer("stale_score");
+	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
+	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
+	return defer("elevated_risk");
+}
+
+export type ClassificationResult =
+	| { kind: ClassifierRisk; model: string }
+	| { kind: "failed"; reason: string };
+
+/**
+ * Run one non-blocking classification. Output is a single token; anything else is a
+ * failed sample rather than a verdict, so a confused classifier costs a review and
+ * never an approval or a denial.
+ */
+export async function classifyTrajectory(params: {
+	registry: Pick<ModelRegistry, "find" | "complete">;
+	modelSpec: string;
+	prompt: string;
+	timeoutMs: number;
+	signal?: AbortSignal;
+}): Promise<ClassificationResult> {
+	const parsed = parseModelSpec(params.modelSpec);
+	if (!parsed) {
+		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
+	}
+	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
+	if (!model) {
+		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
+	}
+	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
+
+	const controller = new AbortController();
+	const abortFromCaller = () => controller.abort();
+	if (params.signal?.aborted) controller.abort();
+	else params.signal?.addEventListener("abort", abortFromCaller);
+	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
+
+	try {
+		const response = await params.registry.complete(
+			model,
+			{
+				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+				messages: [
+					{
+						role: "user",
+						content: [{ type: "text", text: params.prompt }],
+						timestamp: Date.now(),
+					},
+				],
+			},
+			{ signal: controller.signal, cacheRetention: "none" },
+		);
+		if (response.stopReason === "error" || response.stopReason === "aborted") {
+			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
+		}
+		const text = response.content
+			.filter((block): block is { type: "text"; text: string } => block.type === "text")
+			.map((block) => block.text)
+			.join("")
+			.trim()
+			.toLowerCase();
+		if (/^high\b/.test(text)) return { kind: "high", model: label };
+		if (/^low\b/.test(text)) return { kind: "low", model: label };
+		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
+	} catch (error) {
+		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+	} finally {
+		clearTimeout(timer);
+		params.signal?.removeEventListener("abort", abortFromCaller);
+	}
+}

package/src/auto-mode/extension.ts

@@ -43,6 +43,11 @@ import {
 	MAX_REVIEW_REASON_CHARS,
 	type ReviewOutcome,
 } from "./types";
+import {
+	installToolReviewRenderer,
+	type ToolReviewDisplayState,
+	type ToolReviewRendererBridge,
+} from "./tool-review-tui";
 
 const registeredApis = new WeakSet<object>();
 
@@ -133,10 +138,13 @@ export function registerAutoModeExtension(
 	pi: ExtensionAPI,
 	loadConfig: typeof loadToolkitConfig = loadToolkitConfig,
 	requestReview: typeof requestToolReview = requestToolReview,
+	createToolReviewRenderer: () => ToolReviewRendererBridge = installToolReviewRenderer,
 ): void {
 	if (registeredApis.has(pi)) return;
 	registeredApis.add(pi);
 
+	const toolReviewRenderer = createToolReviewRenderer();
+	let toolReviewRendererWarningShown = false;
 	const runtime: AutoModeRuntimeState = createRuntimeState(DEFAULT_AUTO_MODE_CONFIG);
 	const breaker: RejectionBreakerState = createRejectionBreaker();
 	const tracker: ScoreTracker = createScoreTracker();
@@ -144,14 +152,34 @@ export function registerAutoModeExtension(
 	let callIndex = 0;
 	let scoringInFlight = false;
 
-	function updateStatus(ctx: ExtensionContext): void {
+	function updateStatus(ctx: ExtensionContext, reviewingTool?: string): void {
 		if (!ctx.hasUI) return;
+		if (ctx.mode === "tui") {
+			toolReviewRenderer.setTheme(ctx.ui.theme);
+			if (reviewingTool) ctx.ui.setWorkingMessage(`Auto mode: reviewing ${reviewingTool}`);
+		}
+		const rendererSuffix = toolReviewRenderer.supported ? "" : " (footer only)";
 		ctx.ui.setStatus(
 			AUTO_MODE_STATUS_KEY,
-			runtime.engaged ? `auto-review: ${describeGate(runtime)}` : undefined,
+			runtime.engaged
+				? reviewingTool
+					? `auto-review: reviewing ${reviewingTool}${rendererSuffix}`
+					: `auto-review: ${describeGate(runtime)}${rendererSuffix}`
+				: undefined,
 		);
 	}
 
+	function setReviewDisplay(ctx: ExtensionContext, toolCallId: string, state: ToolReviewDisplayState): void {
+		if (ctx.mode === "tui") toolReviewRenderer.setTheme(ctx.ui.theme);
+		toolReviewRenderer.setState(toolCallId, state);
+	}
+
+	function clearReviewActivity(ctx: ExtensionContext): void {
+		if (!ctx.hasUI) return;
+		if (ctx.mode === "tui") ctx.ui.setWorkingMessage(undefined);
+		updateStatus(ctx);
+	}
+
 	function recordDecision(data: Omit<AutoModeDecisionRecord, "timestamp">): void {
 		pi.appendEntry(AUTO_MODE_ENTRY_TYPE, { timestamp: Date.now(), ...data } satisfies AutoModeDecisionRecord);
 	}
@@ -390,14 +418,30 @@ export function registerAutoModeExtension(
 		},
 	});
 
-	pi.on("session_start", (_event, ctx) => {
+	pi.on("session_start", (event, ctx) => {
 		const { config } = loadConfig();
+		toolReviewRenderer.clear();
+		if (
+			!toolReviewRenderer.supported &&
+			!toolReviewRendererWarningShown &&
+			ctx.hasUI &&
+			ctx.mode === "tui"
+		) {
+			ctx.ui.notify(
+				"Per-tool auto-review display is unavailable in this Pi version; using the footer status instead.",
+				"warning",
+			);
+			toolReviewRendererWarningShown = true;
+		}
 		setGateOverride(runtime, config.autoMode, undefined);
 		applyConfiguredGate(runtime, config.autoMode);
 		resetScoreTracker(tracker);
 		resetRejectionBreaker(breaker);
 		callIndex = 0;
-		if (pi.getFlag(AUTO_MODE_FLAG)) engage(ctx, config.autoMode);
+		const startedFromFlag = pi.getFlag(AUTO_MODE_FLAG) === true && engage(ctx, config.autoMode);
+		if (startedFromFlag && event.reason === "startup" && ctx.mode === "tui") {
+			ctx.ui.notify(`Auto mode on. Reviewing: ${describeGate(runtime)}`, "info");
+		}
 		updateStatus(ctx);
 	});
 
@@ -436,7 +480,15 @@ export function registerAutoModeExtension(
 			disengage(ctx);
 			return undefined;
 		}
-		if (!shouldReviewTool(event.toolName, runtime)) return undefined;
+		if (!shouldReviewTool(event.toolName, runtime)) {
+			setReviewDisplay(ctx, event.toolCallId, {
+				phase: "skipped",
+				toolName: event.toolName,
+				detail: "outside the configured gate",
+			});
+			updateStatus(ctx);
+			return undefined;
+		}
 
 		const pending = {
 			toolName: event.toolName,
@@ -456,6 +508,13 @@ export function registerAutoModeExtension(
 				maxLag: auto.classifier.maxLag,
 			});
 			if (fast.eligible) {
+				setReviewDisplay(ctx, pending.toolCallId, {
+					phase: "allowed",
+					toolName: pending.toolName,
+					source: "classifier",
+					detail: "low-risk trajectory pre-score",
+				});
+				updateStatus(ctx);
 				recordDecision({
 					toolName: pending.toolName,
 					toolCallId: pending.toolCallId,
@@ -472,26 +531,48 @@ export function registerAutoModeExtension(
 		const entries = ctx.sessionManager.buildContextEntries();
 		const transcript = auto.transcript ? transcriptFromEntries(entries).text : undefined;
 
-		const outcome = await requestReview({
-			registry: reviewerRegistry(ctx),
-			reviewerModelSpec: pending.reviewerModelSpec,
-			toolName: event.toolName,
-			toolInput: event.input,
-			transcript,
-			cwd: ctx.cwd,
-			timeoutMs: auto.timeoutMs,
-			signal: ctx.signal,
-			evidenceTools: auto.evidenceTools ? evidenceToolsFor(ctx.cwd) : undefined,
-			maxEvidenceRounds: auto.maxEvidenceRounds,
-		});
+		setReviewDisplay(ctx, pending.toolCallId, { phase: "reviewing", toolName: pending.toolName });
+		updateStatus(ctx, event.toolName);
+		let outcome: ReviewOutcome;
+		try {
+			outcome = await requestReview({
+				registry: reviewerRegistry(ctx),
+				reviewerModelSpec: pending.reviewerModelSpec,
+				toolName: event.toolName,
+				toolInput: event.input,
+				transcript,
+				cwd: ctx.cwd,
+				timeoutMs: auto.timeoutMs,
+				signal: ctx.signal,
+				evidenceTools: auto.evidenceTools ? evidenceToolsFor(ctx.cwd) : undefined,
+				maxEvidenceRounds: auto.maxEvidenceRounds,
+			});
+		} finally {
+			clearReviewActivity(ctx);
+		}
 
 		const decision = evaluateOutcome(outcome, pending, ctx, auto.circuitBreaker);
 		if (decision.kind === "ask-human") {
+			setReviewDisplay(ctx, pending.toolCallId, { phase: "awaiting-user", toolName: pending.toolName });
+			updateStatus(ctx);
 			const confirmed = await ctx.ui.confirm(
 				"Auto-mode review unavailable",
 				`${decision.reason}\n\nAllow ${event.toolName} to run?`,
 			);
 			if (confirmed) recordNonDenial(breaker);
+			setReviewDisplay(
+				ctx,
+				pending.toolCallId,
+				confirmed
+					? {
+							phase: "allowed",
+							toolName: pending.toolName,
+						source: "human",
+							detail: `review unavailable · ${outcome.kind === "unavailable" ? outcome.cause : "manual confirmation"}`,
+					  }
+					: { phase: "blocked", toolName: pending.toolName, detail: "user declined" },
+			);
+			updateStatus(ctx);
 			recordDecision({
 				toolName: event.toolName,
 				toolCallId: event.toolCallId,
@@ -505,10 +586,38 @@ export function registerAutoModeExtension(
 				: { block: true, reason: "Blocked by user after auto-mode review could not complete." };
 		}
 
+		if (decision.kind === "block") {
+			setReviewDisplay(
+				ctx,
+				pending.toolCallId,
+				outcome.kind === "deny"
+					? {
+							phase: "denied",
+							toolName: pending.toolName,
+							detail: `${outcome.verdict.riskLevel} risk · ${outcome.verdict.rationale}`,
+					  }
+					: {
+							phase: "blocked",
+							toolName: pending.toolName,
+							detail:
+								outcome.kind === "unavailable" ? `${outcome.cause} · ${outcome.reason}` : decision.reason,
+					  },
+			);
+			updateStatus(ctx);
+			return { block: true, reason: decision.reason, ...(decision.terminate ? { terminate: true } : {}) };
+		}
+
+		setReviewDisplay(ctx, pending.toolCallId, {
+			phase: "allowed",
+			toolName: pending.toolName,
+			source: "reviewer",
+			detail:
+				outcome.kind === "allow"
+					? `${outcome.verdict.riskLevel} risk · authorization ${outcome.verdict.userAuthorization}`
+					: "review completed",
+		});
 		updateStatus(ctx);
-		return decision.kind === "block"
-			? { block: true, reason: decision.reason, ...(decision.terminate ? { terminate: true } : {}) }
-			: undefined;
+		return undefined;
 	});
 
 	pi.on("tool_result", (event, ctx) => {