pi-verdict 0.1.0 → 0.2.1

package/README.md

@@ -3,11 +3,12 @@
 **[English](README.md)** | [简体中文](README.zh-CN.md)
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/pi-verdict)](https://www.npmjs.com/package/pi-verdict)
 [![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://pi.dev)
 
 > Pi runs YOLO by default: every tool call executes without asking.
 > **verdict gives each call a three-state adjudication — `allow / ask / deny`.**
-> Deterministic rules first; gray areas go to a model classifier that sees the conversation context; every failure mode fails closed.
+> A built-in deny floor plus your own allow/deny rules first; everything else goes to a model classifier that sees the conversation context; every failure mode fails closed.
 
 **verdict is an adjudication, not a switch.** Most classifiers in this space output a binary allow/block. Three states matter: `ask` routes genuinely ambiguous actions to a human (and degrades to `deny` in non-interactive sessions), so "not sure" never silently becomes "go ahead".
 
@@ -20,7 +21,11 @@
 | [@zhushanwen/pi-permission](https://www.npmjs.com/package/@zhushanwen/pi-permission) | ✅ (outcome) | ❌ single-turn, no context | closed (→ ask) | 4 |
 | [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages) | ✅ deterministic only | — (no built-in classifier) | closed | 3 |
 
-Full landscape: [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md). The single-file, zero-dependency shape is deliberate — the whole extension is one readable [~590-line file](extensions/auto-mode.ts).
+Full landscape: [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) · convergence analysis with the closest architectural relative: [`research/pi-automode-convergence.md`](research/pi-automode-convergence.md).
+
+Honest framing: pi-automode and pi-verdict have **converged on the same architecture** (deny floor → user rules → classifier, fail-closed — see the convergence analysis). What remains distinct here: a classifier that can say `ask` (runtime human-in-the-loop, not just rule-declared), a built-in floor you can turn off (`builtinDenyFloor` — user sovereignty), a zero-dependency single file (~700 lines, deliberate), and the measurement habit — every design decision in this repo is backed by shipped research.
+
+The single-file, zero-dependency shape is deliberate — the whole extension is one readable [~700-line file](extensions/auto-mode.ts).
 
 ## Pipeline
 
@@ -28,9 +33,10 @@ Full landscape: [`research/pi-permission-landscape.md`](research/pi-permission-l
 tool_call
   │
   ├─ 1. Rule layer (deterministic, zero latency)
-  │     ├─ bash: danger regexes (full-string) → deny; whitelist (per-segment argv) → allow
-  │     ├─ write/edit: path sensitivity S0–S5 (secrets/system/.git meta → deny; in-CWD → allow)
-  │     └─ read/grep/find/ls: secret paths → deny, else allow
+  │     ├─ built-in deny floor: bash danger regexes (full-string) +
+  │     │   path sensitivity S0–S5 (secrets/system/.git meta → deny)
+  │     ├─ your rules: user deny beats user allow (regex, see below)
+  │     └─ no built-in allowlist — every "always allow" claim is yours to make
   │
   ├─ 2. Gray zone → model classifier (defaults to session model — "self-reflection")
   │     ├─ input: CC-style <transcript> (last 5 user messages + last 10 tool calls,
@@ -76,6 +82,26 @@ cp extensions/auto-mode.ts ~/.pi/agent/extensions/
 | `PI_AUTO_MODE_MODEL` | — | env form of the model flag |
 | `PI_AUTO_MODE_DEBUG=1` | off | env form of debug (flag wins) |
 
+### User rules (`config/pi-verdict.json`)
+
+```json
+{
+  "allow": ["^ls\\b", "^git (status|log|diff)\\b"],
+  "deny":  ["rm ", "docker ", "^/etc/"],
+  "builtinDenyFloor": true,
+  "classifierModel": null
+}
+```
+
+- `allow`/`deny` are JS regex arrays; **`deny` wins over `allow`**, both beat the classifier
+- matched against the **full command string** for bash, the **absolute path** for file tools (read/write/edit/grep/find/ls); other tools (MCP etc.) always go to the classifier
+- `builtinDenyFloor: false` turns the built-in danger/path floor off entirely (risk accepted by you; the classifier and your rules remain)
+- `classifierModel: "provider/model-id"` persistently sets the classifier model (e.g. a fast flash-class model); precedence is flag > env > config > session model (self-reflection); an invalid value falls back to the session model with a one-time warning
+- the spec accepts pi's native `--model` thinking suffix: `"zai/glm-4-flash:low"` sets classifier thinking to effort low (default without suffix: thinking explicitly off — the [measured](research/thinking-param-blackhole.md) default)
+- first run generates a template at `~/.pi/agent/config/pi-verdict.json` (honors `PI_CODING_AGENT_DIR`); changes apply to new sessions
+
+Why no built-in allowlist? A third-party security audit ([`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md)) showed that allowlist soundness requires shell AST analysis — every built-in "always allow" would be a security claim maintained by the author. The built-in layer only makes **deny** claims (the sound direction); allow claims are yours.
+
 Requires pi ≥ 0.84. Works in interactive and non-interactive (`-p`/json/rpc) sessions; in non-interactive modes `ask` degrades to `deny`.
 
 ## Evidence-driven, not vibes-driven
@@ -86,14 +112,15 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 - [`research/thinking-param-blackhole.md`](research/thinking-param-blackhole.md) — three-layer forensic root-cause of thinking models burning the classifier budget; why the fix is `thinkingEnabled: false`
 - [`research/rule-engine-sim`](research/rule-engine-sim/README.md) — measured a tree-sitter rule-engine port against 746 real bash calls (**absorbs 0 gray calls**) and rejected it
 - [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) — the competitive landscape this README's positioning is checked against
+- [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md) — third-party audit of the rule layer (8/8 reproduced → fixed architecturally in 0.2.0)
+- [`research/pi-automode-convergence.md`](research/pi-automode-convergence.md) — where this project genuinely converges with pi-automode, and what remains distinct
 - [`research/claude-code-classifier-prompts.md`](research/claude-code-classifier-prompts.md) — structural reconstruction of Claude Code's classifier design (via self-hosted Langfuse observations) that this extension's transcript contract descends from
 
 ## Status & limitations
 
 Prototype quality — usable, not hardened:
 
-- bash segmentation is naive (no quoting/AST awareness); the AST-port alternative was [measured and rejected](research/rule-engine-sim/README.md), revisit if real traffic shows sensitive-path redirects slipping through
-- no user-defined rules yet; rule seeds live at the top of `extensions/auto-mode.ts`
+- no built-in allowlist by design (see the [security audit](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
 - AGENTS.md is not passed to the classifier as downweighted intent evidence (Claude Code does this)
 - parallel gray-zone calls are adjudicated serially
 - self-reflection means the session model adjudicates — point `--auto-mode-model` at a lighter model if verdict latency/cost matters (open question tracked in the issue tracker)
@@ -108,7 +135,7 @@ The name: the three-state **verdict** is the core concept. The UX keeps `/automo
 ```bash
 bun install
 bun run typecheck
-bun test          # 21 offline stub tests: rules, classifier retry, shadow cache, command semantics
+bun test          # 36 offline stub tests: deny floor, user rules, audit regression, classifier retry, shadow cache, commands
 ```
 
 Issue tracker and decision records live in the GitHub issues ("map" issue #1 indexes them).

package/README.zh-CN.md

@@ -3,11 +3,12 @@
 [English](README.md) | **[简体中文](README.zh-CN.md)**
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/pi-verdict)](https://www.npmjs.com/package/pi-verdict)
 [![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://pi.dev)
 
 > Pi 默认以 YOLO 模式运行:所有工具调用不经确认直接执行。
 > **verdict 给每次调用一个三态裁决 —— `allow / ask / deny`。**
-> 确定性规则先行;灰区交给携带会话上下文的模型分类器;任何失败路径一律 fail-closed。
+> 内置 deny floor 与你的 allow/deny 规则先行;其余交给携带会话上下文的模型分类器;任何失败路径一律 fail-closed。
 
 **verdict 是裁决,不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在:`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`),「不确定」永远不会静默变成「放行」。
 
@@ -20,7 +21,11 @@
 | [@zhushanwen/pi-permission](https://www.npmjs.com/package/@zhushanwen/pi-permission) | ✅(outcome) | ❌ 单轮无上下文 | closed(→ ask) | 4 |
 | [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages) | ✅ 纯确定性 | —(无内置分类器) | closed | 3 |
 
-完整全景:[`research/pi-permission-landscape.md`](research/pi-permission-landscape.md)。零依赖单文件形态是有意为之——整个扩展就是一个可通读的 [~590 行文件](extensions/auto-mode.ts)。
+完整全景:[`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) · 与最近架构亲缘的收敛分析:[`research/pi-automode-convergence.md`](research/pi-automode-convergence.md)。
+
+诚实地说:pi-automode 与 pi-verdict 在**架构上已收敛**(deny floor → 用户规则 → 分类器,fail-closed——见收敛分析)。这里仍然不同的是:分类器能说 `ask`(运行时人工介入,而非仅由规则预声明)、内置 floor 可以关(`builtinDenyFloor`——用户主权)、零依赖单文件(~700 行,刻意为之)、以及测量的习惯——本仓库每个设计决策都有随库研究背书。
+
+零依赖单文件形态是有意为之——整个扩展就是一个可通读的 [~700 行文件](extensions/auto-mode.ts)。
 
 ## 管线
 
@@ -28,9 +33,9 @@
 tool_call
   │
   ├─ 1. 规则层(确定性,零延迟)
-  │     ├─ bash:危险正则(完整命令串)→ deny;白名单(逐段 argv 检查)→ allow
-  │     ├─ write/edit:路径敏感度 S0–S5(密钥/系统/.git 元数据 → deny;CWD 内 → allow)
-  │     └─ read/grep/find/ls:密钥路径 → deny,其余 → allow
+  │     ├─ 内置 deny floor:bash 危险正则(完整命令串)+ 路径敏感度 S0–S5
+  │     ├─ 用户规则:deny 优先于 allow(正则,见下)
+  │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
   │
   ├─ 2. 灰区 → 模型分类器(默认继承会话模型 —— "自省")
   │     ├─ 输入:CC 风格 <transcript>(最近 5 条用户消息 + 最近 10 次工具调用,
@@ -76,6 +81,26 @@ cp extensions/auto-mode.ts ~/.pi/agent/extensions/
 | `PI_AUTO_MODE_MODEL` | — | 模型配置的环境变量形式 |
 | `PI_AUTO_MODE_DEBUG=1` | 关 | 调试的环境变量形式(flag 优先) |
 
+### 用户规则(`config/pi-verdict.json`)
+
+```json
+{
+  "allow": ["^ls\\b", "^git (status|log|diff)\\b"],
+  "deny":  ["rm ", "docker ", "^/etc/"],
+  "builtinDenyFloor": true,
+  "classifierModel": null
+}
+```
+
+- `allow`/`deny` 为 JS 正则数组;**`deny` 优先于 `allow`**,两者都优先于分类器
+- 匹配目标:bash = **完整命令串**;文件类工具(read/write/edit/grep/find/ls)= **绝对路径**;其余工具(MCP 等)恒走分类器
+- `builtinDenyFloor: false` 可整体关闭内置危险/路径拦截(风险自担;分类器与你的规则仍在)
+- `classifierModel: "provider/model-id"` 持久指定分类器模型(如轻量 flash 类);优先级 flag > env > config > 自省;无效值回退会话模型并一次性警告
+- spec 支持 pi 原生 `--model` 思考级别后缀:`"zai/glm-4-flash:low"` 将分类器思考设为 effort low(无后缀缺省 = 显式关思考,[实测](research/thinking-param-blackhole.md)背书的默认)
+- 首次运行自动生成模板 `~/.pi/agent/config/pi-verdict.json`(尊重 `PI_CODING_AGENT_DIR`);修改后新会话生效
+
+为什么没有内置白名单?第三方安全审计(见 [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md))证明白名单的健全性需要 shell AST 分析——每条内置「永远放行」都是作者维护的安全声明。因此内置层只做 **deny** 声明(方向健全),allow 声明归你。
+
 需要 pi ≥ 0.84。交互与非交互(`-p`/json/rpc)会话均支持;非交互模式下 `ask` 降级为 `deny`。
 
 ## 证据驱动,不靠直觉
@@ -86,14 +111,15 @@ cp extensions/auto-mode.ts ~/.pi/agent/extensions/
 - [`research/thinking-param-blackhole.md`](research/thinking-param-blackhole.md) —— 思考模型烧尽分类器预算的三层取证,以及为什么修复是 `thinkingEnabled: false`
 - [`research/rule-engine-sim`](research/rule-engine-sim/README.md) —— 用 746 条真实 bash 调用实测 tree-sitter 规则引擎移植(**灰区吸收 0 条**)并否决
 - [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) —— 本 README 定位所对照的竞品全景
+- [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md) —— 规则层第三方安全审计(8/8 复现 → 0.2.0 架构性修复)
+- [`research/pi-automode-convergence.md`](research/pi-automode-convergence.md) —— 与 pi-automode 何处真正收敛、何处仍然不同
 - [`research/claude-code-classifier-prompts.md`](research/claude-code-classifier-prompts.md) —— Claude Code 分类器设计的结构化还原(基于自托管 Langfuse 观测),本扩展 transcript 契约的血统来源
 
 ## 状态与限制
 
 原型质量 —— 可用,未硬化:
 
-- bash 分段是朴素切分(无引号/AST 感知);AST 移植方案已[实测否决](research/rule-engine-sim/README.md),真实流量出现敏感路径重定向绕过时重议
-- 暂无用户自定义规则;规则种子集在 `extensions/auto-mode.ts` 顶部
+- 设计上无内置白名单(见[安全审计](research/rule-layer-security-audit.md)与[用户规则](#用户规则configpi-verdictjson));allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
 - 自省意味着会话模型亲自裁决 —— 若延迟/成本敏感,用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)
@@ -108,7 +134,7 @@ cp extensions/auto-mode.ts ~/.pi/agent/extensions/
 ```bash
 bun install
 bun run typecheck
-bun test          # 21 个离线桩测试:规则层 / 分类器重试 / 影子缓存 / 命令语义
+bun test          # 36 个离线桩测试:deny floor / 用户规则 / 审计回归 / 分类器重试 / 影子缓存 / 命令
 ```
 
 Issue tracker 与决策记录在 GitHub issues(「地图」issue #1 为索引)。

package/extensions/auto-mode.ts

@@ -5,7 +5,11 @@
  * 语义对齐 Claude Code Auto Mode,但方向相反:Pi 默认放行 → 本扩展自动拦截。
  *
  * 管线(tool_call 钩子):
- *   1. 规则层:bash 白名单/危险正则 + 文件路径敏感度分级 → 硬 allow / 硬 deny
+ *   1. 规则层(内置 deny floor + 用户规则):
+ *      - 内置 floor:bash 危险正则 + 路径敏感度分级(S0-S5)→ 硬 deny
+ *        (默认开;配置 builtinDenyFloor:false 可整体关闭,风险自担)
+ *      - 用户规则:config/pi-verdict.json 的 allow/deny 正则(黑名单优先于白名单)
+ *      - 无内置白名单(安全声明由用户配置承担,#12/审计响应)
  *   2. 灰区:模型分类器(默认"自省":继承当前会话 provider/model)
  *      - 输入:CC 风格 <transcript> 精简转录(用户消息流 + 工具调用流,
  *        不含 assistant 叙述与工具结果),待审查动作固定为最后一行
@@ -19,13 +23,17 @@
  *
  * 配置:
  *   --auto-mode / --no-auto-mode   CLI flag,总开关(默认开)
- *   --auto-mode-model provider/id  分类器模型(默认继承会话当前模型)
+ *   --auto-mode-model provider/id[:thinking]  分类器模型 + 可选思考级别后缀
+ *                                  (pi 原生 --model 语法;缺省 off = 显式关思考)
  *   PI_AUTO_MODE_MODEL             同上的环境变量形式
  *   --auto-mode-debug             所有裁决(含放行)都弹通知;影子缓存标注同步开启
  *   PI_AUTO_MODE_DEBUG=1           同上的环境变量形式(兼容保留)
+ *   <agentDir>/config/pi-verdict.json   用户规则:{ allow: [regex], deny: [regex],
+ *                                     builtinDenyFloor, classifierModel }
+ *                                     匹配:bash=完整命令串 / 文件工具=绝对路径;新会话生效
  *
  * 已知原型简化(见 README「已知限制」):
- *   - bash 分段是朴素切分(不处理引号内的 | 等),无 AST
+ *   - 无内置 bash 白名单;危险识别依赖正则 floor(无 AST 解析)——未知形态交分类器
  *   - 裁决缓存暂缓引入(#5 决议):现为影子缓存 observe-only 遥测,积累数据后决断;
  *     无熔断器(重议信号 = deny 风暴成本失控 / 非交互长期运行)
  *   - 未把 AGENTS.md 作为降权意图证据传入分类器
@@ -34,6 +42,7 @@
  *           research/pi-model-call-and-ref-implementations.md
  */
 
+import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
@@ -42,32 +51,6 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 // 规则层:bash
 // ============================================================================
 
-/** 无条件白名单:只读/无副作用命令(源自 pi-permission BUILTIN_UNCONDITIONAL_SAFE + pi-auto-approve Tier 1) */
-const BASH_SAFE_UNCONDITIONAL = new Set([
-	"arch", "basename", "cat", "cd", "cksum", "cmp", "column", "comm", "cut", "diff", "dirname",
-	"du", "df", "echo", "expand", "expr", "false", "file", "fold", "grep", "groups", "head", "id",
-	"jq", "ls", "md5sum", "nl", "paste", "printenv", "ps", "pwd", "readlink", "realpath", "rev",
-	"seq", "sha256sum", "shasum", "stat", "tail", "tr", "true", "tsort", "uniq", "uname", "uptime",
-	"wc", "whereis", "who", "whoami", "which", "tree", "less", "more", "rg", "ag", "ack", "locate",
-	"type", "hostname", "env", "date",
-]);
-
-/** 条件白名单:argv 级检查(源自研究报告 §4.2) */
-const GIT_READONLY_SUBCOMMANDS = new Set([
-	"status", "log", "diff", "show", "branch", "tag", "remote", "rev-parse", "rev-list",
-	"describe", "whatchanged", "shortlog", "blame", "grep", "ls-remote",
-]);
-const GIT_FORBIDDEN_FLAGS = new Set([
-	"-c", "-C", "-p", "--config-env", "--exec-path", "--git-dir", "--namespace",
-	"--paginate", "--super-prefix", "--work-tree", "--output", "--ext-diff", "--textconv", "--exec",
-]);
-const FIND_FORBIDDEN = new Set(["-exec", "-execdir", "-ok", "-okdir", "-delete", "-fls", "-fprint", "-fprint0", "-fprintf"]);
-const RG_FORBIDDEN = new Set(["--pre", "--hostname-bin", "--search-zip", "-z"]);
-const OUTPUT_FLAG_COMMANDS = new Set(["base64", "sort", "iconv", "shuf"]);
-const PKG_READONLY = new Set(["list", "info", "view", "outdated", "audit", "why"]);
-const PIP_READONLY = new Set(["list", "show", "freeze", "search"]);
-const DOCKER_READONLY = new Set(["ps", "images", "inspect", "logs", "stats", "info", "version", "history", "top", "diff"]);
-
 /** 危险模式:对完整命令串匹配(覆盖管道/复合命令),命中即 deny(源自研究报告 §4.3) */
 const BASH_DANGER_RULES: Array<{ id: string; pattern: RegExp; reason: string }> = [
 	{ id: "rm-recursive", pattern: /\brm\b[^;|&]*(\s-(?:[a-zA-Z]*r[a-zA-Z]*f?|[a-zA-Z]*f[a-zA-Z]*r)\b|--recursive)/i, reason: "递归删除 (rm -r)" },
@@ -86,91 +69,96 @@ const BASH_DANGER_RULES: Array<{ id: string; pattern: RegExp; reason: string }>
 	{ id: "fork-bomb", pattern: /:\(\)\s*\{/, reason: "fork 炸弹" },
 ];
 
-/**
- * 朴素 bash 分段:按 && || ; | 切开,不处理引号包裹的运算符(原型简化)。
- * 危险规则已在完整命令串上跑过,这里的切分只服务于白名单判定。
- */
-function splitShellChain(command: string): string[] {
-	return command
-		.split(/&&|\|\||[;|]/)
-		.map((s) => s.trim())
-		.filter((s) => s.length > 0);
-}
-
-/** 提取段内 argv:跳过前导 VAR=value 赋值,命令名去路径前缀 */
-function segmentArgv(segment: string): string[] {
-	const tokens = segment.split(/\s+/).filter(Boolean);
-	while (tokens.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0])) tokens.shift();
-	if (tokens.length > 0) tokens[0] = path.basename(tokens[0]);
-	return tokens;
+type RuleVerdict = "allow" | "deny" | "gray";
+interface RuleResult {
+	verdict: RuleVerdict;
+	reason?: string;
 }
 
-function isConditionalSafe(argv: string[]): boolean {
-	const [cmd, ...rest] = argv;
-	switch (cmd) {
-		case "git": {
-			const sub = rest.find((t) => !t.startsWith("-"));
-			if (!sub || !GIT_READONLY_SUBCOMMANDS.has(sub)) return false;
-			if (rest.some((t) => GIT_FORBIDDEN_FLAGS.has(t))) return false;
-			if (sub === "branch") {
-				return rest.every((t) => t === "branch" || !t.startsWith("-") || /^(-l|--list|-a|-r|-v|--show-current|--format=)/.test(t));
-			}
-			return true;
+function classifyBash(command: string, floorOn: boolean): RuleResult {
+	// 内置 deny floor:危险正则对完整命令串匹配;可经 builtinDenyFloor 整体关闭
+	if (floorOn) {
+		for (const rule of BASH_DANGER_RULES) {
+			if (rule.pattern.test(command)) return { verdict: "deny", reason: `规则 ${rule.id}: ${rule.reason}` };
 		}
-		case "find":
-			return !rest.some((t) => FIND_FORBIDDEN.has(t));
-		case "rg":
-			return !rest.some((t) => RG_FORBIDDEN.has(t));
-		case "base64":
-		case "sort":
-		case "iconv":
-		case "shuf":
-			return !rest.some((t) => t === "-o" || t === "--output" || (/^-[a-zA-Z]*o/.test(t) && !t.startsWith("--")));
-		case "sed":
-			// 仅放行 sed -n {N|M,N}p [file]
-			return rest[0] === "-n" && rest.length <= 3 && (rest.length === 1 || /^\d*(,\d+)?p$/.test(rest[1] ?? ""));
-		case "date":
-			return !rest.some((t) => t === "-s" || t === "--set" || (/^-[a-zA-Z]*s/.test(t) && !t.startsWith("--")));
-		case "npm":
-		case "yarn":
-		case "pnpm":
-			return rest.length > 0 && PKG_READONLY.has(rest[0]);
-		case "pip":
-		case "pip3":
-			return rest.length > 0 && PIP_READONLY.has(rest[0]);
-		case "docker":
-		case "podman":
-			return rest.length > 0 && DOCKER_READONLY.has(rest[0]);
-		default:
-			return false;
 	}
+	if (!command.trim()) return { verdict: "allow", reason: "空命令" };
+	// 无内置白名单(#12):一切非危险命令交用户规则与分类器
+	return { verdict: "gray", reason: "无内置白名单" };
 }
 
-type RuleVerdict = "allow" | "deny" | "gray";
-interface RuleResult {
-	verdict: RuleVerdict;
-	reason?: string;
+// ============================================================================
+// 用户规则:白名单/黑名单(可配置;#12 审计响应)
+//
+// 配置:<agentDir>/config/pi-verdict.json(尊重 PI_CODING_AGENT_DIR 覆盖):
+//   { "allow": ["^ls\\b", "^git (status|log|diff)\\b"], "deny": ["rm ", "^/etc/"] }
+// 匹配目标:bash/powershell = 完整命令串;read/write/edit/grep/find/ls = 解析后绝对路径;
+// 其余工具(MCP/自定义)不参与用户规则,恒走分类器。
+// 优先级:内置 deny floor → 用户 deny → 用户 allow → gray;floor 默认开,可经 builtinDenyFloor:false 关闭。
+// 非法正则跳过并通知(配置错误不导致扩展失效);新会话生效。
+// ============================================================================
+
+interface UserRules {
+	allow: RegExp[];
+	deny: RegExp[];
+	/** 内置 deny floor 开关(危险正则 + 路径敏感度 deny),默认 true;关闭后依赖用户规则与分类器 */
+	builtinDenyFloor: boolean;
+	/** 分类器模型 spec(provider/id);null = 未配置(自省继承会话模型) */
+	classifierModel: string | null;
 }
 
-function classifyBash(command: string): RuleResult {
-	// 危险规则:对完整命令串匹配(单 argv 看不到管道另一侧)
-	for (const rule of BASH_DANGER_RULES) {
-		if (rule.pattern.test(command)) return { verdict: "deny", reason: `规则 ${rule.id}: ${rule.reason}` };
-	}
-	// 白名单:逐段检查,全部命中才放行
-	const segments = splitShellChain(command);
-	if (segments.length === 0) return { verdict: "allow", reason: "空命令" };
-	for (const segment of segments) {
-		const argv = segmentArgv(segment);
-		if (argv.length === 0) continue;
-		const [cmd, ...rest] = argv;
-		if (BASH_SAFE_UNCONDITIONAL.has(cmd)) continue;
-		// <cmd> --help / --version 一律放行
-		if (rest.length === 1 && /^(--help|-h|--version|-v)$/.test(rest[0])) continue;
-		if (OUTPUT_FLAG_COMMANDS.has(cmd) || isConditionalSafe(argv)) continue;
-		return { verdict: "gray", reason: `命令不在白名单: ${cmd}` };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], builtinDenyFloor: true, classifierModel: null };
+
+function userConfigPath(): string {
+	const agentDir = process.env.PI_CODING_AGENT_DIR ?? path.join(os.homedir(), ".pi", "agent");
+	return path.join(agentDir, "config", "pi-verdict.json");
+}
+
+const USER_CONFIG_TEMPLATE = `${JSON.stringify({
+	_hint: "pi-verdict 用户规则。allow/deny 为 JS 正则数组;deny 优先于 allow;匹配目标:bash=完整命令串,文件工具=绝对路径。builtinDenyFloor=false 可关闭内置危险规则/路径敏感度拦截(风险自担)。classifierModel 可持久指定分类器模型(provider/id,如 zai/glm-4-flash;可带 pi 原生思考后缀如 zai/glm-4-flash:low;留空=自省继承会话模型)。修改后新会话生效。",
+	allow: ["^ls\\b"],
+	deny: [],
+	builtinDenyFloor: true,
+	classifierModel: null,
+}, null, 2)}\n`;
+
+/**
+ * 加载用户规则。首启生成带注释模板(allow 内示例默认仅 ^ls\b 可用,其余为说明占位);
+ * 配置缺失/损坏/字段非法一律回退空规则(安全默认,不失效),非法正则收集回报。
+ */
+function loadUserRules(): { rules: UserRules; skipped: string[] } {
+	try {
+		const p = userConfigPath();
+		if (!fs.existsSync(p)) {
+			try {
+				fs.mkdirSync(path.dirname(p), { recursive: true });
+				fs.writeFileSync(p, USER_CONFIG_TEMPLATE);
+			} catch { /* 只读环境静默跳过 */ }
+			return { rules: EMPTY_RULES, skipped: [] };
+		}
+		const raw = JSON.parse(fs.readFileSync(p, "utf8")) as { allow?: unknown; deny?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown };
+		const skipped: string[] = [];
+		const compile = (list: unknown): RegExp[] =>
+			(Array.isArray(list) ? list : []).filter((x): x is string => typeof x === "string").flatMap((src) => {
+				try {
+					return [new RegExp(src)];
+				} catch {
+					skipped.push(src);
+					return [];
+				}
+			});
+		return {
+			rules: {
+				allow: compile(raw.allow),
+				deny: compile(raw.deny),
+				builtinDenyFloor: raw.builtinDenyFloor !== false,
+				classifierModel: typeof raw.classifierModel === "string" && raw.classifierModel.trim() ? raw.classifierModel.trim() : null,
+			},
+			skipped,
+		};
+	} catch {
+		return { rules: EMPTY_RULES, skipped: [] };
 	}
-	return { verdict: "allow" };
 }
 
 // ============================================================================
@@ -184,49 +172,98 @@ function expandHome(p: string): string {
 const S0_SECRET = [
 	/\.ssh(\/|$)/, /\.aws(\/|$)/, /\.gnupg(\/|$)/, /(^|\/)\.env(\.|$)/, /credentials?(\.|\/|$)/i,
 	/(^|\/)id_rsa/, /\.pem$/, /_history$/, /\.config\/gh(\/|$)/, /\.pi\/agent\/auth\.json$/,
+	// V8(安全审计):常见明文凭证文件补全
+	/(^|\/)\.netrc$/, /(^|\/)\.npmrc$/, /(^|\/)\.pypirc$/, /(^|\/)\.envrc$/, /(^|\/)\.vault-token$/,
+	/\.kube(\/|$)/, /\.docker\/config\.json$/, /\.gem\/credentials$/,
 ];
 const S1_SYSTEM = [/^\/etc(\/|$)/, /^\/usr(\/|$)/, /^\/var(\/|$)/, /^\/System(\/|$)/, /(^|\/)authorized_keys$/];
 const S2_USER_RC = [/\.(bashrc|zshrc|profile|bash_profile|gitconfig)$/, /crontab/, /Library\/LaunchAgents(\/|$)/, /\.config\/systemd(\/|$)/];
 const S3_GIT_META = [/(^|\/)\.git\/(hooks|config|modules)(\/|$)/, /(^|\/)\.gitmodules$/];
 
 /** read 类工具:S0 读取即高危(deny),其余读取放行。isWrite: write/edit 走完整分级 */
-function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: boolean): RuleResult {
+function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: boolean, floorOn: boolean): RuleResult {
 	const abs = path.resolve(cwd, expandHome(rawPath));
 	const hit = (rules: RegExp[]) => rules.some((r) => r.test(abs));
+	// floor 关闭时:内置 deny 一律降级 gray(永不升格 allow);非 deny 分支(allow/gray)保持
+	const D = floorOn
+		? (reason: string): RuleResult => ({ verdict: "deny", reason })
+		: (reason: string): RuleResult => ({ verdict: "gray", reason });
 
-	if (hit(S0_SECRET)) return { verdict: "deny", reason: `S0 密钥/凭证路径: ${rawPath}` };
+	if (hit(S0_SECRET)) return D(`S0 密钥/凭证路径: ${rawPath}`);
 	if (!isWrite) {
 		if (hit(S1_SYSTEM)) return { verdict: "gray", reason: `读取系统配置路径: ${rawPath}` };
 		return { verdict: "allow" };
 	}
-	if (hit(S1_SYSTEM)) return { verdict: "deny", reason: `写入系统目录: ${rawPath}` };
-	if (hit(S3_GIT_META)) return { verdict: "deny", reason: `写入 .git 元数据(可执行代码入口): ${rawPath}` };
+	if (hit(S1_SYSTEM)) return D(`写入系统目录: ${rawPath}`);
+	if (hit(S3_GIT_META)) return D(`写入 .git 元数据(可执行代码入口): ${rawPath}` );
 	if (hit(S2_USER_RC)) return { verdict: "gray", reason: `写入用户配置/持久化入口: ${rawPath}` };
 	if (abs === cwd || abs.startsWith(cwd + path.sep)) return { verdict: "allow" };
 	return { verdict: "gray", reason: `写入项目目录(CWD)外: ${rawPath}` };
 }
 
-/** 工具调用 → 规则层裁决。未覆盖的工具(含 MCP/自定义)→ gray,交分类器 */
-function classifyByRules(toolName: string, input: Record<string, unknown>, cwd: string): RuleResult {
+/** 用户规则匹配目标:bash/powershell=完整命令串;路径类工具=解析后绝对路径;其余工具不参与 */
+function userRuleTarget(toolName: string, input: Record<string, unknown>, cwd: string): string | null {
 	switch (toolName) {
 		case "bash":
 		case "powershell":
-			return classifyBash(String(input.command ?? ""));
+			return String(input.command ?? "");
+		case "read":
 		case "write":
 		case "edit":
-			return classifyPath(toolName, String(input.path ?? ""), cwd, true);
+		case "grep":
+		case "find":
+		case "ls": {
+			const p = typeof input.path === "string" && input.path ? input.path : null;
+			return p ? path.resolve(cwd, expandHome(p)) : null;
+		}
+		default:
+			return null;
+	}
+}
+
+/**
+ * 工具调用 → 规则层裁决。裁决序(#12):
+ *   1. 内置 base(bash 危险正则 floor / 路径敏感度分级)——deny 即终局(floor 可经 builtinDenyFloor 关闭)
+ *   2. 用户黑名单 → deny(优先于白名单)
+ *   3. 用户白名单 → allow
+ *   4. base(路径类工具的默认 allow/gray;其余 gray)→ 交分类器
+ */
+function classifyByRules(toolName: string, input: Record<string, unknown>, cwd: string, user: UserRules): RuleResult {
+	let base: RuleResult;
+	switch (toolName) {
+		case "bash":
+		case "powershell":
+			base = classifyBash(String(input.command ?? ""), user.builtinDenyFloor);
+			break;
+		case "write":
+		case "edit":
+			base = classifyPath(toolName, String(input.path ?? ""), cwd, true, user.builtinDenyFloor);
+			break;
 		case "read":
-			return classifyPath(toolName, String(input.path ?? ""), cwd, false);
+			base = classifyPath(toolName, String(input.path ?? ""), cwd, false, user.builtinDenyFloor);
+			break;
 		case "grep":
 		case "find":
 		case "ls": {
 			const p = typeof input.path === "string" ? input.path : undefined;
-			if (p) return classifyPath(toolName, p, cwd, false);
-			return { verdict: "allow" };
+			base = p ? classifyPath(toolName, p, cwd, false, user.builtinDenyFloor) : { verdict: "allow" };
+			break;
 		}
 		default:
-			return { verdict: "gray", reason: `未内置规则覆盖的工具: ${toolName}` };
+			base = { verdict: "gray", reason: `未内置规则覆盖的工具: ${toolName}` };
 	}
+	if (base.verdict === "deny") return base; // 内置 floor:deny 优先于一切用户规则
+
+	const target = userRuleTarget(toolName, input, cwd);
+	if (target !== null) {
+		for (const re of user.deny) {
+			if (re.test(target)) return { verdict: "deny", reason: `用户黑名单: ${re.source}` };
+		}
+		for (const re of user.allow) {
+			if (re.test(target)) return { verdict: "allow", reason: "用户白名单" };
+		}
+	}
+	return base;
 }
 
 // ============================================================================
@@ -311,7 +348,7 @@ interface ClassifierOutcome {
 	source: "model" | "fail-closed";
 }
 
-const CLASSIFIER_TIMEOUT_MS = 15_000;
+const CLASSIFIER_TIMEOUT_MS = 25_000; // 本网关 CC 分类器分布 p90=19.8s(15s 会误杀 ~15%),research/cache-sim 数据
 const CLASSIFIER_MAX_TOKENS = 512;
 const CLASSIFIER_RETRY_MAX_TOKENS = 1024; // 防御重试档:覆盖无视 reasoning:off 或轻思考仍超预算的模型
 
@@ -321,6 +358,7 @@ async function callClassifierOnce(
 	model: NonNullable<ExtensionContext["model"]>,
 	userMessage: string,
 	maxTokens: number,
+	thinking: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max" = "off",
 ): Promise<{ ok: true; text: string; stopReason: string } | { ok: false; error: string }> {
 	const signals = [AbortSignal.timeout(CLASSIFIER_TIMEOUT_MS)];
 	if (ctx.signal) signals.push(ctx.signal);
@@ -335,14 +373,14 @@ async function callClassifierOnce(
 				signal: AbortSignal.any(signals),
 				maxTokens,
 				temperature: 0,
-				// 关思考必须用 API 原生字段 thinkingEnabled:false,而非 reasoning:"off"。
-				// 扩展侧 ModelRegistry 只暴露 API 层 complete(),其选项类型没有 reasoning 字段
-				// (它是 SimpleStreamOptions 的字段;宽类型 Model<Api> 的索引签名让 TS 静默放行,
-				// 运行时被丢弃)——minimal/off 从未生效,GLM 按默认 max 档思考烧尽预算/超时。
-				// anthropic-messages 栈上 thinkingEnabled:false → thinking:{"type":"disabled"}
-				// → GLM 降为 effort low 轻思考;其他 API 为无害多余
-				// 属性,交由防御重试兜底。根因与研究:research/thinking-param-blackhole.md
-				thinkingEnabled: false,
+				// 思考参数必须用 API 原生字段(thinkingEnabled/effort),而非 reasoning
+				// (API 层 complete() 无此字段,宽类型索引签名静默放行后运行时丢弃——见
+				// research/thinking-param-blackhole.md)。
+				// 缺省 off = 显式关思考(实证送达 thinking:{"type":"disabled"},GLM 降为
+				// effort low 轻思考);后缀级别经 adaptive effort 送达(minimal→low 映射)。
+				...(thinking === "off"
+					? { thinkingEnabled: false }
+					: { thinkingEnabled: true, effort: thinking === "minimal" ? ("low" as const) : thinking }),
 				cacheRetention: "short",
 				sessionId: ctx.sessionManager.getSessionId(),
 			},
@@ -367,6 +405,7 @@ async function classifyWithModel(
 	ctx: ExtensionContext,
 	model: NonNullable<ExtensionContext["model"]>,
 	actionLine: string,
+	thinking: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max" = "off",
 ): Promise<ClassifierOutcome> {
 	const transcript = buildTranscript(ctx, actionLine);
 	const userMessage = `<transcript>\n${transcript}\n</transcript>\nJudge the LAST action in the transcript above. Your entire response MUST begin with <verdict>.`;
@@ -374,7 +413,7 @@ async function classifyWithModel(
 	const failures: string[] = [];
 	for (const [n, maxTokens] of attempts) {
 		if (ctx.signal?.aborted) break; // 用户已取消,不再重试
-		const r = await callClassifierOnce(ctx, model, userMessage, maxTokens);
+		const r = await callClassifierOnce(ctx, model, userMessage, maxTokens, thinking);
 		if (r.ok) {
 			const diag = `stopReason=${r.stopReason}, model=${model.id}, 原始输出=${JSON.stringify(r.text.slice(0, 200))}`;
 			if (r.stopReason !== "error" && r.stopReason !== "aborted") {
@@ -516,21 +555,27 @@ function shadowTag(probe: ShadowProbe): string {
 
 export default function autoMode(pi: ExtensionAPI) {
 	pi.registerFlag("auto-mode", { description: "Enable Auto Mode (rules + model classifier gating for tool calls)", type: "boolean", default: true });
-	pi.registerFlag("auto-mode-model", { description: "Classifier model as provider/id (default: inherit session model)", type: "string" });
+	pi.registerFlag("auto-mode-model", { description: "Classifier model as provider/id[:thinking] (pi --model syntax; default: inherit session model)", type: "string" });
 	pi.registerFlag("auto-mode-debug", { description: "Notify every verdict incl. allows, with shadow-cache annotation", type: "boolean", default: false });
 
 	let enabled = pi.getFlag("auto-mode") !== false;
 	const debug = pi.getFlag("auto-mode-debug") === true || process.env.PI_AUTO_MODE_DEBUG === "1";
 	const shadow = new ShadowCache();
+	let userRules: UserRules = loadUserRules().rules;
 
 	function refreshStatus(ctx: ExtensionContext) {
 		// 双态恒显:on 高亮 / off 暗色(原来 off 直接隐藏,状态不可见)
 		ctx.ui.setStatus("auto-mode", ctx.ui.theme.fg(enabled ? "accent" : "dim", enabled ? "auto mode on" : "auto mode off"));
 	}
 
-	// session_start 会重置 shadow(会话内存态,#5 定案)
+	// session_start:重置影子缓存(会话内存态,#5 定案)+ 重载用户规则(配置改动新会话生效)
 	pi.on("session_start", async (_event, ctx) => {
 		shadow.reset();
+		const loaded = loadUserRules();
+		userRules = loaded.rules;
+		if (loaded.skipped.length > 0) {
+			ctx.ui.notify(`pi-verdict:配置中 ${loaded.skipped.length} 条非法正则已跳过(${userConfigPath()})`, "warning");
+		}
 		refreshStatus(ctx);
 	});
 
@@ -560,14 +605,44 @@ export default function autoMode(pi: ExtensionAPI) {
 		},
 	});
 
+	let warnedClassifierModel = false;
+	/** 思考级别集(pi 原生 EXTENDED_THINKING_LEVELS;后缀语法对齐 pi --model provider/id:thinking) */
+	const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+
+	/** 解析 "provider/id:thinking" → { specPart, level }。无效后缀 → 忽略并警告一次 */
+	function parseModelSpec(raw: string, ctx: ExtensionContext): { specPart: string; level: string | null } {
+		const slash = raw.lastIndexOf("/");
+		const colon = raw.lastIndexOf(":");
+		if (colon > slash + 1 && THINKING_LEVELS.has(raw.slice(colon + 1))) {
+			return { specPart: raw.slice(0, colon), level: raw.slice(colon + 1) };
+		}
+		if (colon > slash + 1 && !warnedClassifierModel) {
+			warnedClassifierModel = true;
+			ctx.ui.notify(`pi-verdict:思考级别后缀 "${raw.slice(colon + 1)}" 无效(合法:${[...THINKING_LEVELS].join("/")}),已忽略`, "warning");
+		}
+		return { specPart: raw, level: null };
+	}
+
+	/** 分类器思考级别:spec 后缀指定;缺省 off(显式关思考,blackhole 研究背书) */
+	let classifierThinking: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max" = "off";
+
 	function resolveClassifierModel(ctx: ExtensionContext): NonNullable<ExtensionContext["model"]> | null {
-		const spec = (pi.getFlag("auto-mode-model") as string | undefined) ?? process.env.PI_AUTO_MODE_MODEL;
-		if (spec) {
-			const slash = spec.indexOf("/");
+		// 优先级:CLI flag > 环境变量 > 配置文件(classifierModel) > 自省(会话模型)
+		const raw =
+			(pi.getFlag("auto-mode-model") as string | undefined) ?? process.env.PI_AUTO_MODE_MODEL ?? userRules.classifierModel;
+		classifierThinking = "off";
+		if (raw) {
+			const { specPart, level } = parseModelSpec(raw, ctx);
+			if (level) classifierThinking = level as typeof classifierThinking;
+			const slash = specPart.indexOf("/");
 			if (slash > 0) {
-				const model = ctx.modelRegistry.find(spec.slice(0, slash), spec.slice(slash + 1));
+				const model = ctx.modelRegistry.find(specPart.slice(0, slash), specPart.slice(slash + 1));
 				if (model && ctx.modelRegistry.hasConfiguredAuth(model)) return model;
 			}
+			if (!warnedClassifierModel) {
+				warnedClassifierModel = true; // 每会话仅警告一次,避免逐调用刷屏
+				ctx.ui.notify(`pi-verdict:分类器模型 "${raw}" 不可用(未找到或未配置凭证),回退会话模型(自省)`, "warning");
+			}
 		}
 		return ctx.model ?? null; // 自省:继承当前会话模型
 	}
@@ -583,7 +658,7 @@ export default function autoMode(pi: ExtensionAPI) {
 		const action = describeAction(event.toolName, input);
 
 		// 第 1 层:规则
-		const rule = classifyByRules(event.toolName, input, ctx.cwd);
+		const rule = classifyByRules(event.toolName, input, ctx.cwd, userRules);
 		if (rule.verdict === "allow") {
 			if (debug) ctx.ui.notify(`🛡️ allow(规则): ${action}`, "info");
 			return undefined;
@@ -605,7 +680,7 @@ export default function autoMode(pi: ExtensionAPI) {
 		const ctxKey = shadowContextKey(ctx);
 		const probe = shadow.probe(cmdKey, ctxKey);
 
-		const outcome = await classifyWithModel(ctx, model, action);
+		const outcome = await classifyWithModel(ctx, model, action, classifierThinking);
 
 		// 影子回记:真实模型 allow/deny 入缓存;ask 与 fail-closed 不入(#5 定案);
 		// 命中且本次为可缓存裁决时,对比反事实一致性

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "pi-verdict",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Pi coding agent extension: automatic tool-call permission verdicts — rule layer + model classifier with three-state adjudication (allow/ask/deny), fail-closed, evidence-driven",
+  "author": "Jesset (https://github.com/jesset)",
   "type": "module",
   "main": "extensions/auto-mode.ts",
   "files": [
@@ -44,4 +45,4 @@
     "@types/node": "^26.3.0",
     "typescript": "^7.0.2"
   }
-}
+}