pi-openai-toolkit 0.8.0 → 0.10.0

package/README.md

@@ -1,7 +1,7 @@
 # pi-openai-toolkit
 
 <p align="center">
-  <strong>OpenAI-focused toolkit for <a href="https://github.com/earendil-works/pi">Pi</a>: Remote Compaction v2, Hosted Web Search & Native Image Generation</strong>
+  <strong>OpenAI-focused toolkit for <a href="https://github.com/earendil-works/pi">Pi</a>: Remote Compaction v2, Hosted Web Search, Native Image Generation &amp; Model-Reviewed Auto Mode</strong>
 </p>
 
 <p align="center">
@@ -10,11 +10,12 @@
 
 ---
 
-`pi-openai-toolkit` is an all-in-one OpenAI enhancement package for **Pi (>= 0.84.x)**. It bundles three extensions designed for OpenAI Responses endpoints:
+`pi-openai-toolkit` is an all-in-one OpenAI enhancement package for **Pi (>= 0.84.x)**. It bundles four extensions designed for OpenAI Responses endpoints:
 
 1. **Remote Responses Compaction v2** (`extensions/compaction.ts`): Server-side opaque context compaction using the `remote_compaction_v2` SSE streaming protocol. Preserves context fidelity without lossy text re-summarization.
 2. **Model-Scoped Web Search** (`extensions/web-search.ts`): Toolkit-owned hosted Web Search for an exact `provider/model-id` allowlist configured with `webSearch.models`, across the supported `openai-responses` and `openai-codex-responses` APIs.
 3. **Native Image Generation** (`extensions/image-generation.ts`): A sequential local tool backed by the hosted Responses `image_generation` tool. It supports text-to-image and explicit local-reference edits while keeping binary image data out of session history.
+4. **Model-Reviewed Auto Mode** (`extensions/auto-mode.ts`): Pi does not prompt before running tools. Auto mode adds a gate on state-changing tool calls and lets a reviewer model you configure approve or deny each one, so the agent keeps working without interrupting you.
 
 ## Installation
 
@@ -61,6 +62,9 @@ pi --no-extensions -e /absolute/path/to/pi-openai-toolkit/extensions/web-search.
 
 # Image generation only
 pi --no-extensions -e /absolute/path/to/pi-openai-toolkit/extensions/image-generation.ts
+
+# Auto mode only
+pi --no-extensions -e /absolute/path/to/pi-openai-toolkit/extensions/auto-mode.ts
 ```
 
 > ⚠️ **Conflict Warning**: Do not run `pi-remote-compact`, `@lll9p/pi-better-compaction`, or standalone `pi-openai-web-search` alongside `pi-openai-toolkit`. Duplicate hooks cause race conditions and duplicated system prompts.
@@ -89,8 +93,11 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
     "enabled": true,
     "allowCompactionContinuityBreak": false,
     "remoteCompactModel": "uwoacrimson/gpt-5.6-luna",
-    "model": null,
-    "thinkingLevel": "off",
+    "nativeFallback": {
+      "enabled": true,
+      "model": null,
+      "thinkingLevel": "off"
+    },
     "autoCompaction": {
       "enabled": true,
       "continuation": "inline",
@@ -114,10 +121,33 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
     ]
   },
   "imageGeneration": {
+    "enabled": false
+  },
+  "autoMode": {
     "enabled": true,
     "models": [
       "uwoacrimson/gpt-5.6-luna"
-    ]
+    ],
+    "reviewerModel": "uwoacrimson/gpt-5.6-sol",
+    "gate": "side-effect",
+    "extraTools": [
+      "openai_generate_image"
+    ],
+    "timeoutMs": 30000,
+    "transcript": true,
+    "evidenceTools": true,
+    "maxEvidenceRounds": 3,
+    "classifier": {
+      "enabled": false,
+      "model": "uwoacrimson/gpt-5.6-luna",
+      "timeoutMs": 15000,
+      "maxLag": 2
+    },
+    "circuitBreaker": {
+      "consecutiveDenials": 3,
+      "recentDenials": 10,
+      "windowSize": 50
+    }
   }
 }
 ```
@@ -129,8 +159,9 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
 - `enabled` (*boolean*, default: `true`): Enable or disable Remote Compaction.
 - `allowCompactionContinuityBreak` (*boolean*, default: `false`): When `true`, allows restarting a fresh native opaque compaction chain from Pi's current session text if the latest compaction was made by another strategy (e.g. text summary).
 - `remoteCompactModel` (*string | null*, default: `null`): Model formatted as `provider/model-id` used only for the synthetic `remote_compaction_v2` request. Pi's active session model is not switched and resumes normal requests after compaction. The override must resolve to the same effective base URL as the active model; provider, Responses API identifier, and model may differ. `null` preserves the current same-model path.
-- `model` (*string | null*, default: `null`): Separate native text-summary fallback model formatted as `provider/model-id` (e.g. `"openai/gpt-4o-mini"`) used if remote v2 is unavailable or fails. If `null`, Pi uses its default current-model compaction path.
-- `thinkingLevel` (*string*, default: `"off"`): Reasoning / thinking level passed to Pi native compaction fallback (`"off"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, `"xhigh"`, `"max"`).
+- `nativeFallback.enabled` (*boolean*, default: `true`): Master switch for toolkit-driven native compaction with an explicit summary model. It never touches the remote chain: `remote_compaction_v2` is still attempted and still wins when it succeeds. When `false`, only the post-failure native step is skipped, so every fallback falls straight through to Pi's own default compaction with the active model.
+- `nativeFallback.model` (*string | null*, default: `null`): Summary model formatted as `provider/model-id` (e.g. `"openai/gpt-4o-mini"`) used **only** when the active model cannot use remote v2 at all (non-Responses API, or an API excluded by `responsesApis`). It is never consulted once a remote request was attempted, and `null` means the active model runs Pi's default compaction path.
+- `nativeFallback.thinkingLevel` (*string*, default: `"off"`): Reasoning / thinking level passed to Pi's native `compact()` whenever this extension supplies the model (`"off"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, `"xhigh"`, `"max"`).
 - `autoCompaction.enabled` (*boolean*, default: `true`): Check for compaction after a completed tool-result batch crosses Pi's context threshold.
 - `autoCompaction.continuation` (*`"inline" | "followUp" | "off"`*, default: `"inline"`): `inline` compacts inside the current official Pi 0.84.3 tool loop and refreshes the next provider context; `followUp` uses Pi's public hidden follow-up message path; `off` disables toolkit-triggered automatic compaction.
 - `autoCompaction.unsupportedFallback` (*`"followUp" | "off"`*, default: `"followUp"`): Behavior when the guarded official-host inline adapter is unavailable. It does not change normal remote/native compaction fallback ordering.
@@ -149,10 +180,30 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
 
 #### `imageGeneration`
 
-- `enabled` (*boolean*, default: `true`): Enable or disable the `openai_generate_image` local tool.
-- `models` (*string[]*, default: `[]`): Exact `provider/model-id` allowlist. The tool is active only for listed models using `openai-responses` or `openai-codex-responses`. The allowlist is independent from Web Search and compaction.
+- `enabled` (*boolean*, default: `false`): The single opt-in switch for the `openai_generate_image` local tool. It defaults to off because every successful provider request may incur a charge.
+
+There is no model allowlist: the hosted `image_generation` tool is a capability of the Responses API, not of one vendor's model. Setting `enabled: true` exposes the tool to every active model whose API is `openai-responses` or `openai-codex-responses`, and hides it everywhere else. Web Search and compaction keep their own independent model allowlists.
+
+The request uses the current model's resolved Responses endpoint, authentication, and headers, while the hosted image tool itself is fixed to `gpt-image-2`; Pi does not switch the active conversation model. A gateway that does not support the hosted image tool still registers the tool and returns a bounded failure at call time; nothing is retried automatically.
 
-Image generation remains opt-in through the empty-by-default `models` allowlist because each successful provider request may incur a charge. The request uses the current model's resolved Responses endpoint, authentication, and headers, while the hosted image tool itself is fixed to `gpt-image-2`; Pi does not switch the active conversation model.
+#### `autoMode`
+
+- `enabled` (*boolean*, default: `true`): Master switch. With `true` the mode can still never engage until you allowlist a model and set a reviewer.
+- `models` (*string[]*, default: `[]`): Exact `provider/model-id` allowlist of **active session models** permitted to run in auto mode. An empty list disables auto mode everywhere.
+- `reviewerModel` (*string | null*, default: `null`): The approving model, formatted as `provider/model-id`. It is resolved through Pi's model registry and must exist there; it is used only for one-off review requests and never becomes the active conversation model. Auto mode cannot engage while this is unset.
+- `gate` (*`"side-effect" | "all"`*, default: `"side-effect"`): `side-effect` reviews `bash`, `write`, and `edit`; `all` reviews every tool call, including read-only tools.
+- `extraTools` (*string[]*, default: `[]`): Additional tool names reviewed on top of the `side-effect` default set, for example `openai_generate_image` or an MCP tool name.
+- `timeoutMs` (*integer*, default: `30000`, range `1000`-`120000`): Reviewer deadline across all of its rounds. Expiry never becomes approval.
+- `transcript` (*boolean*, default: `true`): Send the reviewer a bounded view of the conversation. Without it the reviewer can only judge the action's intrinsic risk and must treat user authorization as `unknown`.
+- `evidenceTools` (*boolean*, default: `true`): Let the reviewer spend read-only tool calls (`read`, `grep`, `find`, `ls`) establishing facts before it decides. These are Pi's own read-only tools executed by this extension; the reviewer is never given `bash`, `write`, `edit`, or network access.
+- `maxEvidenceRounds` (*integer*, default: `3`, range `0`-`8`): How many investigation rounds the reviewer may take before it must answer. `0` disables tools and keeps a single completion.
+- `classifier.enabled` (*boolean*, default: `false`): Opt in to a non-blocking trajectory pre-scorer that can satisfy an ordinary gated call from a cached low-risk classification instead of waiting for a full review. It is off by default because it adds one model call per gated tool result.
+- `classifier.model` (*string | null*): Classifier model as `provider/model-id`; falls back to `reviewerModel`. A classifier only ever defers to the blocking reviewer; it cannot approve on its own beyond a cached low-risk fast path, and it never denies.
+- `classifier.timeoutMs` (*integer*, default: `15000`) and `classifier.maxLag` (*integer*, default: `2`, range `0`-`20`): A score older than `maxLag` tool calls, or older than the last user turn, is stale and forces the blocking review.
+- `circuitBreaker.consecutiveDenials` (*integer*, default: `3`, `0` disables): Reviewer denials in a row that end the turn instead of letting the agent keep negotiating.
+- `circuitBreaker.recentDenials` (*integer*, default: `10`, `0` disables) and `circuitBreaker.windowSize` (*integer*, default: `50`, range `1`-`200`): Denials inside the last N reviewed calls that end the turn. This catches a scattered denial rate that never forms a consecutive run.
+
+Auto mode is opt-in through the empty-by-default `models` allowlist because it authorizes a model to approve writes and shell commands on your behalf. Enable it for a session with `pi --auto` or `/auto on`, and use `/auto all` to review every tool at once. See [Core Mechanics](#core-mechanics) section 5 for the exact decision and fallback rules.
 
 ---
 
@@ -183,8 +234,8 @@ Content-Type: application/json
 - **Fail-Closed Replay Guard**: Replay anchors on the Pi-authored compaction summary item by content and replaces it with the opaque compacted window; the post-compaction context is preserved verbatim, so transient messages injected by other extensions no longer block replay. If the summary anchor cannot be found, the toolkit aborts the provider request, shows an error notification, and always writes a content-free `*-replay-failure.json` artifact even when `logProviderPayloads` is disabled. The sentinel-only payload is never sent to the model.
 - **Graceful Multi-Tier Fallback**:
   1. Compatible Responses endpoints &rarr; Remote v2 Opaque Compaction.
-  2. Gateway failure or non-Responses model &rarr; Configured `compaction.model` fallback.
-  3. Otherwise &rarr; Pi default native text compaction.
+  2. Remote request attempted but failed on a model that *can* compact remotely &rarr; Pi's native `compact()` with `remoteCompactModel`, or the active model when no override is configured;
+  3. Model that cannot use remote v2 at all &rarr; Pi's native `compact()` with `compaction.nativeFallback.model`, or the active model when unset;
 
 ### 2. Tool-Loop Auto-Compaction and Continuation
 
@@ -207,7 +258,7 @@ For allowlisted models using `openai-responses` or `openai-codex-responses`, the
 
 ### 4. Native Image Generation and Editing
 
-For an allowlisted Responses model, Pi exposes the sequential `openai_generate_image` tool:
+When `imageGeneration.enabled` is `true` and the active model speaks a Responses API, Pi exposes the sequential `openai_generate_image` tool:
 
 - **Isolated request**: Sends one non-streaming, `store: false` Responses request containing only the image prompt and explicitly approved references. It does not forward recent conversation history and does not automatically retry after dispatch, avoiding accidental duplicate charges.
 - **Generation and editing**: Supports text-to-image or editing with 1-5 explicitly supplied local PNG, JPEG, or WebP reference paths. Reference upload always requires interactive confirmation; headless sessions reject reference uploads.
@@ -218,6 +269,26 @@ For an allowlisted Responses model, Pi exposes the sequential `openai_generate_i
 - **Headless behavior**: Text-to-image with the default artifact path remains available without a UI. Reference uploads and external output paths that require approval are rejected in headless sessions.
 - **Billing and verification boundary**: The configured gateway/provider remains the billing authority; the tool does not synthesize Pi usage or cost metadata. Deterministic tests and smoke checks never dispatch image generation, and no live paid probe runs without separate explicit approval.
 
+### 5. Model-Reviewed Auto Mode
+
+Pi does not prompt before running `bash`, `write`, or `edit`; the only built-in trust prompt concerns project-local settings. This extension adds the approval gate and lets a reviewer model operate it, mirroring Codex's `approval_policy` plus `approvals_reviewer` pairing.
+
+- **Engagement is non-blocking**: `pi --auto`, `/auto on`, and `/auto all` only flip in-session state and update the footer status. No provider request happens at engagement time, so turning the mode on can never stall the current turn.
+- **Gate scope**: `side-effect` reviews `bash`, `write`, and `edit`; `extraTools` adds named tools; `/auto all` (or `gate: "all"`) reviews every tool call. Read-only tools pass through untouched in the default scope.
+- **Two independent axes, one derived outcome**: The reviewer scores the action's intrinsic risk (`low`/`medium`/`high`/`critical`) separately from how far the conversation actually authorizes it (`unknown`/`low`/`medium`/`high`), then derives `allow`/`deny` from a fixed table: `low` and `medium` risk are allowed, `high` requires at least `medium` authorization and a narrow scope, `critical` is always denied. Judging only "does this command look dangerous" is what makes an approval reviewer rubber-stamp or block everything.
+- **Bounded transcript**: The reviewer receives a compact view of the conversation built from Pi's session entries, with user turns protected under their own budget and tool output on a smaller separate one, so verbose command output cannot crowd out the human turns that establish authorization. Omitted history is marked `<truncated />` rather than silently dropped, and only `[user]` entries count as evidence of approval.
+- **The reviewer can investigate**: When `evidenceTools` is on, the reviewer runs as a short bounded agent loop over Pi's read-only tools (`read`, `grep`, `find`, `ls`). It can open the script it is about to allow, check whether a deletion target exists or is empty, or confirm a write path lies inside the project. This extension executes those calls; the reviewer is never handed `bash`, a write tool, or network access, which is what keeps "let the judge look around" safe.
+- **Lenient verdict contract**: Only the outcome is required. `{"outcome":"allow"}` is a complete answer; risk, authorization, and rationale are back-filled (an unstated risk on a deny is recorded as `high`, which keeps the audit conservative in the direction that matters). Both `outcome`/`rationale` and the older `decision`/`reason` spelling are accepted. Unreadable output is a failure, never a guess.
+- **Untrusted evidence stays untrusted**: Tool arguments, transcript text, and file contents are labelled as data. Claims of prior approval, urgency, or instructions to answer a particular way inside them are ignored by policy.
+- **Optional non-blocking pre-scorer**: With `classifier.enabled`, a cheap single-token classification (`high`/`low`) of the trajectory runs after each gated tool result. A fresh `low` score satisfies the next gated call without waiting for a full review; `high`, a stale score, a failed sample, or a repeat of a tool already denied this turn all fall through to the blocking reviewer. The classifier can never deny anything.
+- **Denials carry an anti-circumvention clause**: A block returns the risk, the authorization, and the reviewer's reason to the requesting model, plus an explicit prohibition on achieving the same outcome by workaround, renaming, splitting, or indirect execution. The model may take a materially safer alternative or ask you.
+- **A review that did not finish is not a safety verdict**: Timeout, cancellation, provider error, and unreadable output each report their own cause and tell the agent not to infer unsafety from the failure. Only an actual `deny` is worded as a rejection.
+- **Rejection circuit breaker**: Repeated denials in one turn end the turn rather than letting the agent and reviewer negotiate indefinitely, on either a consecutive run or a denial rate inside a sliding window. `turn_start` clears the counters.
+- **Human fallback**: When a review is unavailable in an interactive session, the extension asks you directly with the failure reason. In print (`-p`) and JSON mode there is nobody to ask, so the action fails closed and is blocked.
+- **Eligibility is rechecked live**: Switching to a model outside `autoMode.models`, clearing `reviewerModel`, or setting `enabled: false` disengages immediately. Returning to an allowlisted model does not re-engage automatically; you must ask again with `/auto on`.
+- **Bounded audit trail**: Every decision is persisted as a custom session entry (`pi-openai-toolkit.auto-mode-decision.v1`) containing the tool name, call id, decision, bounded rationale, reviewer model, risk level, user authorization, investigation rounds used, and decision source (`reviewer`, `classifier`, `human`, `policy`, or `circuit-breaker`). Custom entries never enter LLM context, and tool arguments are not recorded.
+- **Cost boundary**: Each gated call costs at least one reviewer completion, and enabling `evidenceTools` lets that review expand into up to `maxEvidenceRounds` extra completions. The pre-scorer adds one small completion per gated tool result when enabled. Reviewer completions run with prompt caching disabled, and the reviewer can execute nothing beyond the read-only tools listed above.
+
 ---
 
 ## Development & Testing

package/README_zh.md

@@ -1,7 +1,7 @@
 # pi-openai-toolkit
 
 <p align="center">
-  <strong>专为 <a href="https://github.com/earendil-works/pi">Pi</a> 打造的 OpenAI 增强工具包：远端无损压缩 v2、原生托管联网搜索与图像生成</strong>
+  <strong>专为 <a href="https://github.com/earendil-works/pi">Pi</a> 打造的 OpenAI 增强工具包：远端无损压缩 v2、原生托管联网搜索、图像生成与模型审批 Auto 模式</strong>
 </p>
 
 <p align="center">
@@ -10,11 +10,12 @@
 
 ---
 
-`pi-openai-toolkit` 是专为 **Pi (>= 0.84.x)** 打造的 OpenAI 增强工具包，集成了三项针对 OpenAI Responses 协议的扩展：
+`pi-openai-toolkit` 是专为 **Pi (>= 0.84.x)** 打造的 OpenAI 增强工具包，集成了四项针对 OpenAI Responses 协议的扩展：
 
 1. **远端无损压缩 (Remote Compaction v2)** (`extensions/compaction.ts`): 基于 `remote_compaction_v2` SSE 流式协议实现的服务端密文无损会话压缩，彻底告别会话变长后丢失细节的文本二次摘要。
 2. **按模型启用的联网搜索** (`extensions/web-search.ts`): 通过 `webSearch.models` 精确匹配 `provider/model-id`，由 Toolkit 为符合条件的 `openai-responses` 与 `openai-codex-responses` 会话提供并拥有原生联网搜索。
 3. **原生图像生成** (`extensions/image-generation.ts`): 注册由 Responses 托管 `image_generation` 工具驱动的本地顺序工具，支持文生图和显式本地参考图编辑，同时避免把图像二进制写入会话历史。
+4. **模型审批 Auto 模式** (`extensions/auto-mode.ts`): Pi 默认不会为工具调用弹出审批确认。Auto 模式为改变状态的工具调用加上一道审批门，由你指定的审批模型判定放行或拦截，让 Agent 不必停下来等你确认也能继续推进。
 
 ## 安装使用
 
@@ -61,6 +62,9 @@ pi --no-extensions -e /本地绝对路径/pi-openai-toolkit/extensions/web-searc
 
 # 仅加载原生图像生成
 pi --no-extensions -e /本地绝对路径/pi-openai-toolkit/extensions/image-generation.ts
+
+# 仅加载 Auto 模式
+pi --no-extensions -e /本地绝对路径/pi-openai-toolkit/extensions/auto-mode.ts
 ```
 
 > ⚠️ **冲突提示**：请勿同时启用 `pi-remote-compact`、`@lll9p/pi-better-compaction` 或独立的 `pi-openai-web-search`。多重钩子会产生竞态或注入重复的 System Prompt。
@@ -89,8 +93,11 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
     "enabled": true,
     "allowCompactionContinuityBreak": false,
     "remoteCompactModel": "uwoacrimson/gpt-5.6-luna",
-    "model": null,
-    "thinkingLevel": "off",
+    "nativeFallback": {
+      "enabled": true,
+      "model": null,
+      "thinkingLevel": "off"
+    },
     "autoCompaction": {
       "enabled": true,
       "continuation": "inline",
@@ -114,10 +121,33 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
     ]
   },
   "imageGeneration": {
+    "enabled": false
+  },
+  "autoMode": {
     "enabled": true,
     "models": [
       "uwoacrimson/gpt-5.6-luna"
-    ]
+    ],
+    "reviewerModel": "uwoacrimson/gpt-5.6-sol",
+    "gate": "side-effect",
+    "extraTools": [
+      "openai_generate_image"
+    ],
+    "timeoutMs": 30000,
+    "transcript": true,
+    "evidenceTools": true,
+    "maxEvidenceRounds": 3,
+    "classifier": {
+      "enabled": false,
+      "model": "uwoacrimson/gpt-5.6-luna",
+      "timeoutMs": 15000,
+      "maxLag": 2
+    },
+    "circuitBreaker": {
+      "consecutiveDenials": 3,
+      "recentDenials": 10,
+      "windowSize": 50
+    }
   }
 }
 ```
@@ -129,8 +159,9 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
 - `enabled` (*boolean*, 默认 `true`): 是否启用远端无损压缩。
 - `allowCompactionContinuityBreak` (*boolean*, 默认 `false`): 若最近一次历史压缩由其他方式（如文本摘要）生成，设为 `true` 允许直接从当前有效文本上下文重建密文压缩链。
 - `remoteCompactModel` (*string | null*, 默认 `null`): 仅用于 synthetic `remote_compaction_v2` 请求的模型，格式为 `"provider/model-id"`。Pi 不会切换当前会话模型，压缩完成后仍由原模型继续正常请求。覆盖模型必须与当前模型使用相同的实际生效 Base URL；Provider、Responses API 标识符和模型本身可以不同。为 `null` 时保持当前模型执行远端压缩的原有行为。
-- `model` (*string | null*, 默认 `null`): 独立的原生文本摘要降级模型，格式为 `"provider/model-id"`（例如 `"openai/gpt-4o-mini"`）。当 Remote v2 不可用或失败时使用；为 `null` 时进入 Pi 默认的当前模型压缩路径。
-- `thinkingLevel` (*string*, 默认 `"off"`): 降级模型调用 Pi 原生压缩时的思考级别（`"off"`, `"minimal"`, `"low"`, `"medium"`, `"high"`, `"xhigh"`, `"max"`）。
+- `nativeFallback.enabled` (*boolean*, 默认 `true`): Toolkit 用显式摘要模型跑原生压缩的总开关。它不影响远端链路：`remote_compaction_v2` 照常被尝试，成功时照常生效。设为 `false` 只跳过失败后的那一步原生压缩，因此所有降级都直接交给 Pi 默认的当前模型压缩。
+- `nativeFallback.model` (*string | null*, 默认 `null`): 摘要模型，格式为 `"provider/model-id"`（例如 `"openai/gpt-4o-mini"`），**仅**用于根本无法走远端 v2 的当前模型（非 Responses API，或 API 被 `responsesApis` 排除）。远端请求已经发出过的情境不会读这个字段；为 `null` 时由当前活动模型走 Pi 默认压缩路径。
+- `nativeFallback.thinkingLevel` (*string*, 默认 `"off"`): 由本扩展指定模型时，传给 Pi 原生 `compact()` 的思考级别。
 - `autoCompaction.enabled` (*boolean*, 默认 `true`): 完整工具调用/结果批次结束并越过 Pi 上下文阈值后，检查是否需要压缩。
 - `autoCompaction.continuation` (*`"inline" | "followUp" | "off"`*, 默认 `"inline"`): `inline` 在官方 Pi 0.84.3 当前工具循环内完成压缩并刷新下一次 Provider 上下文；`followUp` 使用 Pi 公共的隐藏后续消息；`off` 关闭 Toolkit 触发的自动压缩。
 - `autoCompaction.unsupportedFallback` (*`"followUp" | "off"`*, 默认 `"followUp"`): 官方 Host 私有 inline 适配器不可用时的处理方式，不改变原有远端/原生压缩降级顺序。
@@ -149,10 +180,30 @@ C:\Users\<user>\.pi\agent\extensions\pi-openai-toolkit\config.json
 
 #### `imageGeneration`（图像生成配置）
 
-- `enabled` (*boolean*, 默认 `true`): 是否启用本地工具 `openai_generate_image`。
-- `models` (*string[]*, 默认 `[]`): 精确的 `provider/model-id` 白名单。只有列表中的模型使用 `openai-responses` 或 `openai-codex-responses` 时才会激活工具；它与联网搜索、压缩配置相互独立。
+- `enabled` (*boolean*, 默认 `false`): 本地工具 `openai_generate_image` 的唯一开关。默认关闭是因为每一次成功的 Provider 请求都可能产生费用。
+
+这里没有模型白名单：托管 `image_generation` 是 Responses API 的能力，不属于某个厂商的特定模型。`enabled: true` 后，所有 API 为 `openai-responses` 或 `openai-codex-responses` 的当前模型都会拿到这个工具，其他 API 则完全看不到。联网搜索和压缩仍保留各自的模型白名单。
+
+请求复用当前模型解析后的 Responses 端点、认证和请求头，托管图像工具固定使用 `gpt-image-2`；Pi 不会切换当前会话模型。不支持托管图像工具的网关仍会注册该工具，并在调用时返回有界错误；发送后不会自动重试。
 
-图像生成仍通过默认空白的 `models` 白名单显式启用，因为成功的 Provider 请求可能产生费用。请求复用当前模型解析后的 Responses 端点、认证和请求头，托管图像工具固定使用 `gpt-image-2`；Pi 不会切换当前会话模型。
+#### `autoMode`（Auto 模式配置）
+
+- `enabled` (*boolean*, 默认 `true`): 总开关。即使为 `true`，在未配置模型白名单和审批模型之前，Auto 模式仍然无法启用。
+- `models` (*string[]*, 默认 `[]`): 允许以 Auto 模式运行的**当前会话模型**精确 `provider/model-id` 白名单。空列表表示任何模型都无法使用 Auto 模式。
+- `reviewerModel` (*string | null*, 默认 `null`): 执行审批的模型，格式为 `"provider/model-id"`。它通过 Pi 的模型注册表解析且必须存在，仅用于一次性审批请求，不会成为当前会话模型。未设置时 Auto 模式无法启用。
+- `gate` (*`"side-effect" | "all"`*, 默认 `"side-effect"`): `side-effect` 只审批 `bash`、`write`、`edit`；`all` 审批包括只读工具在内的全部工具调用。
+- `extraTools` (*string[]*, 默认 `[]`): 在 `side-effect` 默认集之上额外审批的工具名，例如 `openai_generate_image` 或某个 MCP 工具名。
+- `timeoutMs` (*整数*, 默认 `30000`，范围 `1000`–`120000`): 审批模型所有轮次共用的总超时。超时永远不会被当作放行。
+- `transcript` (*boolean*, 默认 `true`): 给审批模型一份有界的会话上下文。关掉后它只能判断动作本身的风险，用户授权程度只能记为 `unknown`。
+- `evidenceTools` (*boolean*, 默认 `true`): 允许审批模型在结论之前调用只读工具（`read`、`grep`、`find`、`ls`）自己取证据。这些工具由本扩展执行；审批模型永远拿不到 `bash`、写入类工具或网络访问。
+- `maxEvidenceRounds` (*整数*, 默认 `3`，范围 `0`–`8`): 最多允许几轮取证，超过就必须给结论。设为 `0` 完全关闭工具，回到单次补全。
+- `classifier.enabled` (*boolean*, 默认 `false`): 是否启用非阻塞的轨迹预评分。开启后一个新鲜的 `low` 分数可以直接满足下一次受控调用，不必等完整审批。默认关闭是因为每个受控工具结果都会多一次模型调用。
+- `classifier.model` (*string | null*): 预评分模型，格式 `provider/model-id`，未设置时沿用 `reviewerModel`。预评分只能把调用退回阻塞审批；除了缓存的 `low` 快速通道之外它无权放行，也永不拒绝。
+- `classifier.timeoutMs` (*整数*, 默认 `15000`) 与 `classifier.maxLag` (*整数*, 默认 `2`，范围 `0`–`20`): 经过超过 `maxLag` 个工具调用、或用户又说了新话之后，分数作废并强制走阻塞审批。
+- `circuitBreaker.consecutiveDenials` (*整数*, 默认 `3`，`0` 关闭): 单轮内连续拒绝多少次就直接结束这一轮，而不是让主模型无限拉锯。
+- `circuitBreaker.recentDenials` (*整数*, 默认 `10`，`0` 关闭) 与 `circuitBreaker.windowSize` (*整数*, 默认 `50`，范围 `1`–`200`): 最近 N 次受审调用里拒绝多少次就结束这一轮。它拓的是没有连续出现但密度很高的拒绝。
+
+Auto 模式需要显式启用（`models` 默认为空），因为它相当于允许一个模型代你批准文件写入和命令执行。会话内可用 `pi --auto` 或 `/auto on` 开启，`/auto all` 一次审批全部工具。具体判定与降级规则见「核心工作原理解析」第 5 节。
 
 ---
 
@@ -183,8 +234,8 @@ Content-Type: application/json
 - **重放失败保护（Fail-Closed）**：重放以 Pi 生成的 compaction summary 哨兵为内容锚点，将其替换为密文压缩窗口；压缩后的其余上下文一律原样保留，因此其他扩展注入的临时消息不再阻断重放。若找不到哨兵锚点，插件会中止 provider 请求、弹出错误通知，并且即使 `logProviderPayloads` 关闭也会写入一份不含内容的安全失败记录 `*-replay-failure.json`。只含哨兵占位符的请求体永远不会发送给模型。
 - **三级优雅降级**：
   1. 支持的 Responses 端点 &rarr; 触发 Remote v2 密文无损压缩；
-  2. 网关不支持或报错 &rarr; 降级调用用户指定的 `compaction.model`；
-  3. 未配置降级模型 &rarr; 回退至 Pi 默认的当前模型摘要压缩。
+  2. 本可以远端压缩但网关报错或失败 &rarr; 用 `remoteCompactModel` 跑 Pi 原生 `compact()`，未配置覆盖模型则由当前活动模型执行；
+  3. 根本无法走远端的模型 &rarr; 用 `compaction.nativeFallback.model` 跑 Pi 原生 `compact()`，未配置则由当前活动模型执行；
 
 ### 2. 工具循环内自动压缩与续跑
 
@@ -207,7 +258,7 @@ Content-Type: application/json
 
 ### 4. 原生图像生成与编辑
 
-当当前 Responses 模型在白名单中时，Pi 会启用顺序工具 `openai_generate_image`：
+当 `imageGeneration.enabled` 为 `true` 且当前模型走 Responses API 时，Pi 会启用顺序工具 `openai_generate_image`：
 
 - **隔离请求**：仅发送一次非流式、`store: false` 的 Responses 请求，请求体只包含图像提示词和用户显式批准的参考图，不会附带最近会话历史；发送后不自动重试，避免重复计费。
 - **生成与编辑**：支持文生图，或使用 1–5 个显式指定的本地 PNG、JPEG、WebP 文件编辑。上传参考图前必须经过交互确认；Headless 会话拒绝上传参考图。
@@ -218,6 +269,26 @@ Content-Type: application/json
 - **Headless 行为**：不带参考图并使用默认 Artifact 路径的文生图可在无 UI 环境运行；需要确认的参考图上传和外部输出路径会在 Headless 会话中被拒绝。
 - **计费与验证边界**：实际计费以配置的 Gateway/Provider 为准，工具不会自行构造 Pi usage/cost 元数据。确定性测试和冒烟检查不会发起生图请求；未经单独明确批准，也不会执行真实付费探针。
 
+### 5. 模型审批的 Auto 模式
+
+Pi 本身在运行 `bash`、`write`、`edit` 前不会询问确认，内置的唯一 trust 提示只针对项目本地配置。本扩展补上这道审批门，并让审批模型来操作它，对应 Codex 的 `approval_policy` 加 `approvals_reviewer` 组合。
+
+- **开启动作不阻塞任务流**：`pi --auto`、`/auto on`、`/auto all` 只切换会话内状态并更新底部状态栏，开启时不会发起任何 Provider 请求。
+- **审批范围**：`side-effect` 审批 `bash`、`write`、`edit`；`extraTools` 追加工具名；`/auto all`（或 `gate: "all"`）审批全部工具调用。默认范围下只读工具直接放行。
+- **两个独立轴，一个推导结论**：审批模型分别给出动作本身的风险（`low`/`medium`/`high`/`critical`）和会话对它的授权程度（`unknown`/`low`/`medium`/`high`），再按固定表格推出 `allow`/`deny`：`low` 与 `medium` 风险放行，`high` 需要至少 `medium` 授权且范围窄，`critical` 一律拒绝。只问“这条命令危不危险”正是审批模型要么全部放行、要么全部拦截的原因。
+- **有界会话上下文**：审批模型收到的是从 Pi 会话条目重建的紧凑上下文。用户发言有自己独立的预算并优先保留，工具输出用另一份更小的预算，避免冗长命令输出挤掉真正能建立授权证据的人类发言。被省略的历史会标 `<truncated />` 而不是静默丢掉，且只有 `[user]` 条目能作为授权证据。
+- **审批模型可以自己取证**：`evidenceTools` 开启后，审批模型跑在一个有界的只读工具循环里（`read`、`grep`、`find`、`ls`）。它可以打开准备放行的脚本看它到底做什么、检查删除目标是否存在或为空、确认写入路径是否在项目内。这些调用由本扩展执行，审批模型永远拿不到 `bash` 与写入工具，也不会联网，这是“让裁判自己看一眼”能安全成立的前提。
+- **宽松结论契约**：只有结论字段是必需的。`{"outcome":"allow"}` 就是一个完整回答，风险、授权、理由由代码回填（拒绝但未说风险时按 `high` 记录，让审计往保守方向偏）。`outcome`/`rationale` 与旧的 `decision`/`reason` 两种写法都接受。解析失败是失败，不是猜测。
+- **不可信证据保持不可信**：工具参数、上下文文本、文件内容都标记为数据。其中出现的“用户已经同意过”、“很紧急”、或要求按某种方式回答的指令，按策略一律忽略。
+- **可选的非阻塞预评分**：`classifier.enabled` 后，每个受控工具结果之后会跑一次单 token 的轨迹分类（`high`/`low`）。新鲜的 `low` 可以直接满足下一次受控调用；`high`、过期分数、评分失败、以及本轮被拒绝过的同一工具重试，全部退回阻塞审批。预评分自己永不拒绝。
+- **拒绝带反规避条款**：拦截时会把风险等级、授权程度、理由一起返回给主模型，并附上明确禁止：不得通过变通、改名、拆分命令或间接执行达成同一结果。它只能换实质更安全的方案，或者来问你。
+- **没跑完的审批不是安全结论**：超时、取消、Provider 报错、输出不合法各自上报 cause，并告诉主模型不要因为这个失败就推断动作不安全。只有真正的 `deny` 才会被表述为拒绝。
+- **拒绝熔断器**：单轮内反复被拒会直接结束这一轮，而不是让主模型和审批模型无限拉锯；连续次数和滑动窗口内的拒绝密度两个条件都会触发。`turn_start` 会清空计数。
+- **降级人工确认**：交互会话中审批不可用时，扩展会带着失败原因直接问你；而 `-p` 与 JSON 模式无人可问，因此 fail-closed 直接拦截。
+- **实时重新校验资格**：切到 `autoMode.models` 之外的模型、清空 `reviewerModel` 或设 `enabled: false` 会立即退出 Auto 模式；切回白名单模型不会自动恢复，必须重新 `/auto on`。
+- **有界审计记录**：每次判定都以自定义会话条目（`pi-openai-toolkit.auto-mode-decision.v1`）落盘，包含工具名、调用 id、结论、有界理由、审批模型、风险等级、用户授权程度、取证轮数，以及判定来源（`reviewer`、`classifier`、`human`、`policy` 或 `circuit-breaker`）。自定义条目不进入 LLM 上下文，且不记录工具参数。
+- **费用边界**：每个受控调用至少产生一次审批补全；开启 `evidenceTools` 后，这一次审批最多可膨胀为 `maxEvidenceRounds` 轮额外补全。开启预评分时，每个受控工具结果多一次小补全。审批请求禁用提示缓存，除上述只读工具外不能执行任何操作。
+
 ---
 
 ## 测试与验证

package/extensions/auto-mode.ts

@@ -0,0 +1 @@
+export { default } from "../src/auto-mode/extension.ts";

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "pi-openai-toolkit",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": false,
   "type": "module",
-  "description": "OpenAI-focused Pi toolkit providing remote Responses compaction, native Web Search, and native image generation.",
+  "description": "OpenAI-focused Pi toolkit providing remote Responses compaction, native Web Search, native image generation, and model-reviewed auto mode.",
   "author": "awoaCrim and contributors",
   "license": "MIT",
   "repository": {
@@ -25,6 +25,7 @@
     "compaction",
     "web-search",
     "image-generation",
+    "auto-mode",
     "codex",
     "responses"
   ],
@@ -32,13 +33,15 @@
     "extensions": [
       "./extensions/compaction.ts",
       "./extensions/web-search.ts",
-      "./extensions/image-generation.ts"
+      "./extensions/image-generation.ts",
+      "./extensions/auto-mode.ts"
     ]
   },
   "files": [
     "extensions/compaction.ts",
     "extensions/web-search.ts",
     "extensions/image-generation.ts",
+    "extensions/auto-mode.ts",
     "src/compact-client.ts",
     "src/config.ts",
     "src/debug.ts",
@@ -55,6 +58,13 @@
     "src/image-generation/render.ts",
     "src/image-generation/service.ts",
     "src/image-generation/types.ts",
+    "src/auto-mode/extension.ts",
+    "src/auto-mode/policy.ts",
+    "src/auto-mode/prompt.ts",
+    "src/auto-mode/transcript.ts",
+    "src/auto-mode/reviewer.ts",
+    "src/auto-mode/classifier.ts",
+    "src/auto-mode/types.ts",
     "src/model-scope.ts",
     "src/native-fallback.ts",
     "src/payload-rewrite.ts",

package/src/auto-mode/classifier.ts

@@ -0,0 +1,165 @@
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { parseModelSpec } from "../runtime";
+import { CLASSIFIER_SYSTEM_PROMPT } from "./prompt";
+import { boundReviewText, type ClassifierRisk, type FastDecisionReason } from "./types";
+
+/** One completed classification of the trajectory, tagged to a tool-call position. */
+export type ScoreRecord = {
+	risk: ClassifierRisk;
+	/** Tool-call counter value when the sample was taken. */
+	scoredAtCall: number;
+	/** Fingerprint of the user turns the score was based on. */
+	authorizationVersion: string;
+	sampledAt: number;
+};
+
+/**
+ * Mutable per-session tracker for the non-blocking pre-scorer.
+ *
+ * The counters reproduce Codex's staleness rule: the agent keeps running while a
+ * classification is in flight, so a score is only trustworthy if it is recent
+ * enough and nothing the user said has changed underneath it.
+ */
+export type ScoreTracker = {
+	latestCallIndex: number;
+	latestScoredIndex: number;
+	latestFailedIndex: number;
+	score?: ScoreRecord;
+};
+
+export function createScoreTracker(): ScoreTracker {
+	return { latestCallIndex: 0, latestScoredIndex: 0, latestFailedIndex: 0 };
+}
+
+/** Reset everything: a new turn or a disengaged mode invalidates prior scoring. */
+export function resetScoreTracker(tracker: ScoreTracker): void {
+	tracker.latestCallIndex = 0;
+	tracker.latestScoredIndex = 0;
+	tracker.latestFailedIndex = 0;
+	tracker.score = undefined;
+}
+
+/**
+ * Fingerprint of the user-authored conversation. Any new or edited user turn makes
+ * an existing score stale, because the score's authorization premise changed.
+ */
+export function authorizationVersion(userText: string): string {
+	const bounded = boundReviewText(userText, 8_000);
+	let hash = 2166136261;
+	for (let index = 0; index < bounded.length; index += 1) {
+		hash ^= bounded.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return `${bounded.length}:${(hash >>> 0).toString(36)}`;
+}
+
+export function recordScoredCall(tracker: ScoreTracker, score: ScoreRecord): void {
+	tracker.score = score;
+	tracker.latestScoredIndex = Math.max(tracker.latestScoredIndex, score.scoredAtCall);
+}
+
+export function recordFailedCall(tracker: ScoreTracker, scoredAtCall: number): void {
+	tracker.latestFailedIndex = Math.max(tracker.latestFailedIndex, scoredAtCall);
+}
+
+export type FastDecisionInput = {
+	tracker: ScoreTracker;
+	/** Tool-call counter value for the call being gated. */
+	currentCallIndex: number;
+	authorizationVersion: string;
+	maxLag: number;
+	/** Retries after a denial and widened gates must not take the fast path. */
+	requiresSynchronousReview?: boolean;
+};
+
+/**
+ * Decide whether a cached classification can satisfy this gated call without
+ * running the blocking reviewer. Anything other than `low_risk` defers to the
+ * synchronous review; the classifier never denies an action on its own.
+ */
+export function fastApprovalEligible(input: FastDecisionInput): {
+	eligible: boolean;
+	reason: FastDecisionReason;
+} {
+	const defer = (reason: FastDecisionReason) => ({ eligible: false, reason });
+
+	if (input.requiresSynchronousReview) return defer("requires_synchronous_review");
+	if (input.tracker.latestFailedIndex > input.tracker.latestScoredIndex) return defer("scoring_failure");
+
+	const score = input.tracker.score;
+	if (!score) return defer("missing_score");
+
+	const lag = input.currentCallIndex - score.scoredAtCall;
+	if (lag > input.maxLag) return defer("stale_score");
+	if (score.authorizationVersion !== input.authorizationVersion) return defer("authorization_changed");
+	if (score.risk === "low") return { eligible: true, reason: "low_risk" };
+	return defer("elevated_risk");
+}
+
+export type ClassificationResult =
+	| { kind: ClassifierRisk; model: string }
+	| { kind: "failed"; reason: string };
+
+/**
+ * Run one non-blocking classification. Output is a single token; anything else is a
+ * failed sample rather than a verdict, so a confused classifier costs a review and
+ * never an approval or a denial.
+ */
+export async function classifyTrajectory(params: {
+	registry: Pick<ModelRegistry, "find" | "complete">;
+	modelSpec: string;
+	prompt: string;
+	timeoutMs: number;
+	signal?: AbortSignal;
+}): Promise<ClassificationResult> {
+	const parsed = parseModelSpec(params.modelSpec);
+	if (!parsed) {
+		return { kind: "failed", reason: `autoMode.classifier.model "${params.modelSpec}" is not provider/model-id.` };
+	}
+	const model = params.registry.find(parsed.provider, parsed.modelId) as Model<Api> | undefined;
+	if (!model) {
+		return { kind: "failed", reason: `Classifier model ${params.modelSpec} is not available.` };
+	}
+	const label = boundReviewText(`${model.provider}/${model.id}`, 256);
+
+	const controller = new AbortController();
+	const abortFromCaller = () => controller.abort();
+	if (params.signal?.aborted) controller.abort();
+	else params.signal?.addEventListener("abort", abortFromCaller);
+	const timer = setTimeout(() => controller.abort(), params.timeoutMs);
+
+	try {
+		const response = await params.registry.complete(
+			model,
+			{
+				systemPrompt: CLASSIFIER_SYSTEM_PROMPT,
+				messages: [
+					{
+						role: "user",
+						content: [{ type: "text", text: params.prompt }],
+						timestamp: Date.now(),
+					},
+				],
+			},
+			{ signal: controller.signal, cacheRetention: "none" },
+		);
+		if (response.stopReason === "error" || response.stopReason === "aborted") {
+			return { kind: "failed", reason: response.errorMessage ?? `Classifier stopped: ${response.stopReason}` };
+		}
+		const text = response.content
+			.filter((block): block is { type: "text"; text: string } => block.type === "text")
+			.map((block) => block.text)
+			.join("")
+			.trim()
+			.toLowerCase();
+		if (/^high\b/.test(text)) return { kind: "high", model: label };
+		if (/^low\b/.test(text)) return { kind: "low", model: label };
+		return { kind: "failed", reason: `Classifier returned unreadable output: ${boundReviewText(text, 80)}` };
+	} catch (error) {
+		return { kind: "failed", reason: error instanceof Error ? error.message : String(error) };
+	} finally {
+		clearTimeout(timer);
+		params.signal?.removeEventListener("abort", abortFromCaller);
+	}
+}