npm - pi-verdict - Versions diffs - 0.12.0 → 0.12.1 - Mend

pi-verdict 0.12.0 → 0.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/README.md +14 -9
package/README.zh-CN.md +70 -67
package/extensions/jev-adapter.ts +16 -0
package/extensions/pi-verdict.ts +77 -21
package/package.json +2 -2

package/README.md CHANGED Viewed

@@ -6,9 +6,9 @@
 [![npm](https://img.shields.io/npm/v/pi-verdict)](https://www.npmjs.com/package/pi-verdict)
 [![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://pi.dev)
-**pi-verdict is a minimal permission gate for [pi](https://pi.dev) in the style of Claude Code's auto mode: every tool call gets checked before it runs — allow, deny, or ask you first.**
+**pi-verdict is a minimal permission gate for [pi](https://pi.dev), inspired by Claude Code's auto mode: every tool call gets checked before it runs — allow, deny, or ask you first.**
-- Minimal — just 2k lines of code
+- Minimal — a ~2k-line single-file core (plus a small bundled jev adapter)
 - Built-in danger rules and your own allow/deny rules settle the clear cases first, at zero latency
 - Everything else goes to a model classifier that sees the conversation context
 - Any uncertainty or failure fails closed; nothing ever runs silently
@@ -39,10 +39,10 @@ Full statement in [docs/security-principles.md](docs/security-principles.md).
 ## Screenshots
-![Demo: protected-path ask declined](docs/demo.gif)
+![Demo: protected-path ask declined](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/demo.gif)
-![Automode Status](docs/images/status.png)
-![Ask Permission](docs/images/asked.png)
+![Automode Status](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/images/status.png)
+![Ask Permission](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/images/asked.png)
 ## Quick start
@@ -58,6 +58,8 @@ pi --extension ./extensions/pi-verdict.ts
 ```
+Requires pi ≥ 0.84. Works in interactive and non-interactive (`-p`/json/rpc) sessions; in non-interactive modes `ask` degrades to `deny`.
 ### Hosts
 pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi](https://github.com/can1357/oh-my-pi) (omp) — it self-anchors to whichever agent tree it is installed in, and follows the extension copy's own location on dual-install machines. On omp 18 the classifier's completion call falls back to the pi-ai compat API (still fail-closed). Details: [docs/configuration.md](docs/configuration.md#host-notes-pi-and-oh-my-pi).
@@ -94,6 +96,7 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
     "~/.profile",
     "~/.gnupg",
     "~/.mc",
+    "~/.kube",
     "~/.zshrc",
     "~/.bashrc"
   ],
@@ -122,7 +125,7 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
 - `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev (OpenRouter by default, or TypeSafe's official API directly with `PI_VERDICT_JEV_TRANSPORT=typesafe`); experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
 - `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
 - `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; with both switches on the notification appears once
-- `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a jev verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`enforce`, the default = the second layer adjudicates, except a demoted **deny or ask** can never be auto-relaxed to an allow — a fail-closed layer emitted no verdict, so its rescue stands; `shadow` = records its opinion only and you are asked — `/automode` hints the activation switch), otherwise asked of you directly. At/above the floor the first layer is autonomous. A natural pairing: jev first + a haiku/flash-class fallback
+- `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a jev verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`enforce`, the default = the second layer adjudicates; a demoted **deny or ask** can never be auto-relaxed to an allow; a fail-closed layer emitted no verdict, so its rescue stands; `shadow` = records its opinion only and you are asked — `/automode` hints the activation switch), otherwise asked of you directly. At/above the floor the first layer is autonomous. The floor applies to decisions models only — with an LLM classifier it is inert, and a one-time warning says so. A natural pairing: jev first + a haiku/flash-class fallback
 No built-in allowlist — every "always allow" claim is yours ([why](docs/configuration.md#why-no-built-in-allowlist)). Full reference: [docs/configuration.md](docs/configuration.md).
@@ -148,9 +151,7 @@ jev's calibrated confidence is exactly what the confidence floor keys on — pai
 The gate's own files — the config and the installed extension copy — are **user-editable only**: writes from inside the gate hard-deny (reads pass); your editor never passes through the gate, the sudoers/visudo precedent.
 - **Not disableable by any config** — `builtinDenyFloor: false` and user `allow` rules cannot touch this layer
-- **Tamper detection** as the backstop: watched files are snapshotted at `session_start` and re-verified before every verdict — a changed extension copy is auto-restored and the session goes fail-closed; a changed config gets one explicit keep/restore confirm ([ADR-0001](docs/adr/0001-self-protection-layer.md) for the differential-disposal rationale)
-Requires pi ≥ 0.84. Works in interactive and non-interactive (`-p`/json/rpc) sessions; in non-interactive modes `ask` degrades to `deny`.
+- **Tamper detection** as the backstop: watched files are snapshotted at `session_start` and re-verified before every verdict — a changed extension copy is auto-restored and the session goes fail-closed; a changed config gets one explicit keep/restore confirm when a UI is available (headless auto-restores, same as the extension copy; [ADR-0001](docs/adr/0001-self-protection-layer.md) for the differential-disposal rationale)
 ---
@@ -169,6 +170,10 @@ Honest framing: pi-automode and pi-verdict have **converged on the same architec
 ## Pipeline
+![pi-verdict security gate — tool-call adjudication pipeline](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.en.svg)
+*Diagram source & regeneration: [docs/diagrams/](docs/diagrams/README.md). Pipeline as of v0.12 — the ASCII version below is the text-faithful equivalent.*
 ```
 tool_call
   │

package/README.zh-CN.md CHANGED Viewed

@@ -6,44 +6,43 @@
 [![npm](https://img.shields.io/npm/v/pi-verdict)](https://www.npmjs.com/package/pi-verdict)
 [![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://pi.dev)
-**pi-verdict 是 [pi](https://pi.dev) 的 Claude Code 风格的 Auto mode 式的极简权限门禁:每次工具调用执行前先过检查——放行、拦截,或先问你。**
+**pi-verdict 是 [pi](https://pi.dev) 的极简权限门禁，灵感来自 Claude Code 的 auto mode：每次工具调用执行前先过检查——放行、拦截，或先问你。**
-- 只有2k行左右的极简代码
+- 极简——核心单文件约 2k 行(另含一个小型 jev 适配器)
 - 内置危险规则与你的 allow/deny 规则以零延迟先行裁决明确情形
 - 其余交给携带会话上下文的模型分类器
-- 任何不确定或失败一律 fail-closed, 绝不静默放行
-- 自我保护: 防止被窥探和篡改
+- 任何不确定或失败一律 fail-closed，绝不静默放行
+- 自保护：门禁守护自身，防窥探与篡改
 ## 问题
 pi 没有内置的逐次权限确认——每次工具调用都以 pi 进程自身的权限直接执行([pi 安全文档](https://pi.dev/docs/latest/security))。
-pi-verdict 补上这道缺失的门禁, 由模型基于上下文和你的意图判定是否可以运行.
+pi-verdict 补上这道缺失的门禁，由模型基于上下文和你的意图判定是否可以运行。
 ## 为什么是三态
-**verdict 是裁决,不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在:`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`),「不确定」永远不会静默变成「放行」——目标是安全的自动化而非最大的自动化:审批疲劳与静默危险执行都是危险。
+**verdict 是裁决，不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在：`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`)，「不确定」永远不会静默变成「放行」——目标是安全的自动化而非最大的自动化：审批疲劳与静默危险执行都是败因。
 ## 设计原则
-- **Fail closed**——不确定产生摩擦,绝不产生许可。
+- **Fail closed**——不确定产生摩擦，绝不产生许可。
 - **确定性 floor 先于 AI**——硬 deny 永不被分类器或用户 allow 规则覆盖。
-- **语义优先于语法**——分类器判定的是动作**做什么可能会产生什么安全影响**,而不是命令有多长。
-- **是判断,不是证明**——分类器的 `allow` 是有依据的判断;floor 的存在正因为它仅此而已。
-- **最小化可信输入**——transcript 不含工具结果(#22),分类器零路径明文(ADR-0002)。
-- **规范化身份**——词法 + realpath 双形匹配;「看起来在项目内」的路径不因此被信任(#20/#21)。
+- **语义优先于语法**——分类器判定的是动作**做什么可能会产生什么安全影响**，而不是命令有多长。
+- **是判断，不是证明**——分类器的 `allow` 是有依据的判断；floor 的存在正因 allow 仅是判断。
+- **最小化可信输入**——transcript 不含工具结果(#22)，分类器零路径明文(ADR-0002)。
+- **规范化身份**——词法 + realpath 双形匹配；「看起来在项目内」的路径不因此被信任(#20/#21)。
 - **门禁守护自身**——任何配置都关不掉的自保护层(ADR-0001)。
-- **是权限门禁,不是沙箱**——请在上面叠加 OS 级隔离;本门禁不替代它。
-完整表述见 [docs/security-principles.md](docs/security-principles.md):
+- **是权限门禁，不是沙箱**——请在上面叠加 OS 级隔离；本门禁不替代它。
+完整表述见 [docs/security-principles.md](docs/security-principles.md)。
 ## 截图
-![演示:受保护路径 ask 被拒绝](docs/demo.gif)
+![演示：受保护路径 ask 被拒绝](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/demo.gif)
-![Automode Status](docs/images/status.png)
-![Ask Permission](docs/images/asked.png)
+![Automode Status](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/images/status.png)
+![Ask Permission](https://raw.githubusercontent.com/jesset/pi-verdict/main/docs/images/asked.png)
 ## 快速开始
@@ -59,32 +58,34 @@ pi --extension ./extensions/pi-verdict.ts
 ```
+需要 pi ≥ 0.84。交互与非交互(`-p`/json/rpc)会话均支持；非交互模式下 `ask` 降级为 `deny`。
 ### 宿主
-pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi](https://github.com/can1357/oh-my-pi)(omp)——扩展按自身安装位置自锚定到所在宿主的目录树,双宿主并存的机器上跟随扩展副本自身的位置。omp 18 下分类器的模型调用经 pi-ai compat API 降级(仍然 fail-closed)。细节见 [docs/configuration.md](docs/configuration.md#host-notes-pi-and-oh-my-pi)。
+pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi](https://github.com/can1357/oh-my-pi)(omp)——扩展按自身安装位置自锚定到所在宿主的目录树，双宿主并存的机器上跟随扩展副本自身的位置。omp 18 下分类器的模型调用回退到 pi-ai compat API(仍然 fail-closed)。细节见 [docs/configuration.md](docs/configuration.md#host-notes-pi-and-oh-my-pi)。
 | | pi | omp |
 |---|---|---|
 | 安装 | `pi install npm:pi-verdict` | `omp plugin install npm:pi-verdict` |
-| 扩展副本 | `~/.pi/agent/extensions/` | `~/.omp/plugins/node_modules/pi-verdict/`(omp 18.1+;≤18.0 在 `agent/` 下) |
+| 扩展副本 | `~/.pi/agent/extensions/` | `~/.omp/plugins/node_modules/pi-verdict/`(omp 18.1+；≤18.0 在 `agent/` 下) |
 | 用户规则 | `~/.pi/agent/config/pi-verdict.json` | `~/.omp/agent/config/pi-verdict.json` |
 | 凭据文件(S0 硬 deny) | `~/.pi/agent/auth.json` | `~/.omp/agent/auth.json` |
-- `/automode` —— 显示当前状态:开/关
+- `/automode` —— 显示当前状态：开/关
 - `/automode on`
 - `/automode off`
-- `ctrl+shift+a` —— 静默切换主开关(footer 始终显示为唯一反馈;键位可经 `toggleShortcut` 重绑或禁用)
+- `ctrl+shift+a` —— 静默切换主开关(footer 始终显示为唯一反馈；键位可经 `toggleShortcut` 重绑或禁用)
 - footer 恒显 `auto mode on`(绿色)/ `auto mode off`(黄色)
 | 配置 | 默认 | 说明 |
 |---|---|---|
-| `--auto-mode` / `--no-auto-mode` | 开 | 总开关 |
+| `--auto-mode` / `--no-auto-mode` | 开 | 主开关 |
 | `--auto-mode-model provider/id` | 会话模型 | 分类器模型(默认"自省") |
 | `--auto-mode-debug` | 关 | 全量裁决通知 |
 | `PI_AUTO_MODE_MODEL` | — | 模型配置的环境变量形式 |
 | `PI_AUTO_MODE_DEBUG=1` | 关 | 调试的环境变量形式(flag 优先) |
-### 用户自定义规则(`~/.pi/agent/config/pi-verdict.json`)
+### 用户自定义规则(`pi-verdict.json`)
 ```json
 {
@@ -116,43 +117,41 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 }
 ```
-- `allow`/`deny` 为 JS 正则数组;**`deny` 优先于 `allow`**,两者都优先于分类器
-- `denyPaths` 是你声明**受保护**的普通路径列表:触碰触发**终局 ask** 由你裁决(非交互降级 deny);分类器只被告知路径**存在**,路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较:省略 `path`(pi 默认:当前目录)或传入位于声明路径之上的父目录,同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件)
-- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具):**直接放行、零模型调用**;列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效:它们仍受 deny floor 与你的 allow/deny 规则约束,自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察) 注意:被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器)
-- `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担;下方自保护层永远开启)
-- `classifierModel` 指定分类器模型,如 `"zai/glm-5.3-flash:low"`(支持思考后缀;缺省 = 会话模型且显式关思考)
-- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 TypeSafe jev 完成(默认 OpenRouter,或 `PI_VERDICT_JEV_TRANSPORT=typesafe` 直连官方 API);实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
-- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件,保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth,确认结束后落盘),protected-path ask 也入审计(#62);规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机;[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注);agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
-- `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解);默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知;两开关同开时通知只出现一次
-- `classifierMinConfidence`(可选,[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**:低于它的 jev 裁决被降级——配置了 `classifierFallbackModel` 则级联(`enforce`,默认 = 第二层全权裁决,但降级的 **deny 与 ask** 永不被自动放宽为 allow——fail-closed 未产生任何裁决,其获救裁决照常生效;`shadow` = 只记录意见、由你裁决——`/automode` 会提示激活开关),否则直接问你。不低于地板时第一层自主。天然搭配:jev 打头 + haiku/flash 级兜底
+- `allow`/`deny` 为 JS 正则数组；**`deny` 优先于 `allow`**，两者都优先于分类器
+- `denyPaths` 是你声明**受保护**的普通路径列表：触碰触发**终局 ask** 由你裁决(非交互降级 deny)；分类器只被告知路径**存在**，路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较：省略 `path`(pi 默认：当前目录)或传入位于声明路径之上的父目录，同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件)
+- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具)：**直接放行、零模型调用**；列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效：它们仍受 deny floor 与你的 allow/deny 规则约束，自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察)。注意：被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器)
+- `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担；下方自保护层永远开启)
+- `classifierModel` 指定分类器模型，如 `"zai/glm-5.3-flash:low"`(支持思考后缀；缺省 = 会话模型且显式关思考)
+- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 TypeSafe jev 完成(默认 OpenRouter，或 `PI_VERDICT_JEV_TRANSPORT=typesafe` 直连官方 API)；实验性质，详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件，保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth，确认结束后落盘)，protected-path ask 也入审计(#62)；规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机；[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注)；agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
+- `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解)；默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知；两开关同开时通知只出现一次
+- `classifierMinConfidence`(可选，[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**：低于它的 jev 裁决被降级——配置了 `classifierFallbackModel` 则级联(`enforce`，默认 = 第二层全权裁决；例外：降级的 **deny 与 ask** 永不被自动放宽为 allow；fail-closed 未产生裁决，其获救裁决照常生效；`shadow` = 只记录意见、由你裁决——`/automode` 会提示激活开关)，否则直接问你。不低于地板时第一层自主。地板仅作用于 decisions 模型——LLM 分类器下不生效，会有一次中性警告提示。天然搭配：jev 在前 + haiku/flash 级回退
-没有内置白名单——每一条「永远放行」声明都归你([为什么](docs/configuration.md#why-no-built-in-allowlist))。完整参考:[docs/configuration.md](docs/configuration.md)。
+没有内置白名单——每一条「永远放行」声明都归你([为什么](docs/configuration.md#why-no-built-in-allowlist))。完整参考：[docs/configuration.md](docs/configuration.md)。
 ### Jev 决策后端(实验性——[ADR-0003](docs/adr/0003-jev-decisions-adapter.md))
-1. 安装含适配器的版本( v0.8 及以上):  `pi install npm:pi-verdict`
-2. 选一条 transport(两条走同一 decisions wire 契约):
-  - **OpenRouter(默认)**: pi 内执行 `/login openrouter`,或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
-  - **TypeSafe 直连(官方 v1 API)**: 在 console.typesafe.ai 自助发 key,然后 `export TYPESAFE_API_KEY=apikey_...` 并 `export PI_VERDICT_JEV_TRANSPORT=typesafe`
-3. 把分类器指到 jev（新会话生效）
+1. 安装含适配器的版本(v0.8 及以上)：`pi install npm:pi-verdict`
+2. 选一条 transport(两条走同一 decisions wire 契约)：
+  - **OpenRouter(默认)**：pi 内执行 `/login openrouter`，或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
+  - **TypeSafe 直连(官方 v1 API)**：在 console.typesafe.ai 自助发 key，然后 `export TYPESAFE_API_KEY=apikey_...` 并 `export PI_VERDICT_JEV_TRANSPORT=typesafe`
+3. 将分类器指向 jev(新会话生效)
   - 持久：在 pi 之外编辑 `~/.pi/agent/config/pi-verdict.json` 并设置 `{ "classifierModel": "typesafe/jev-latest" }`
-  - 或者临时试一把：`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
+  - 或者临时试用一次：`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
-**限制**:
-- **Transport**: OpenRouter decisions(默认)或 TypeSafe 直连——TypeSafe 侧单次成本显示 $0(其 API 不返回 cost)
-- **宿主**:仅支持pi。omp 上该设置会警告并回退会话模型。也绝不能选作会话主模型(不生成文本,选中即警告)
-- **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖当前 transport 的端点(OpenRouter 侧为 alpha 接口)
+**限制**：
+- **Transport**：OpenRouter decisions(默认)或 TypeSafe 直连——TypeSafe 侧单次成本显示 $0(其 API 不返回 cost)
+- **宿主**：仅支持 pi。omp 上该设置会警告并回退会话模型。也绝不能选作会话主模型(不生成文本，选中即警告)
+- **逃生口**：`PI_VERDICT_JEV_URL` 可覆盖当前 transport 的端点(OpenRouter 侧为 alpha 接口)
-jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence", "classifierFallbackModel"`),让低置信调用交给更深的模型而非直接生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
+jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence", "classifierFallbackModel"`)，让低置信调用交由更深的模型复裁，而非就地生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
-门禁自身的文件——配置与扩展安装副本——**仅用户可改**:门禁之内的写入一律硬 deny(读放行);你的编辑器修改不经门禁,最近的同构先例是 sudoers 必须经 visudo。
+门禁自身的文件——配置与扩展安装副本——**仅用户可改**：门禁之内的写入一律硬 deny(读放行)；你的编辑器修改不经门禁，同类先例是 sudoers 必须经 visudo。
 - **不可经任何配置关闭**——`builtinDenyFloor: false` 与用户 `allow` 规则都动不了这一层
-- **变更检测**作纵深兜底:受保护文件在 `session_start` 快照、每次裁决前复核——扩展副本被改 → 自动还原 + 本会话 fail-closed;配置被改 → 一次明确的双选确认(差分处置的完整语义见 [ADR-0001](docs/adr/0001-self-protection-layer.md))
-需要 pi ≥ 0.84。交互与非交互(`-p`/json/rpc)会话均支持;非交互模式下 `ask` 降级为 `deny`。
+- **变更检测**作纵深兜底：受保护文件在 `session_start` 快照、每次裁决前复核——扩展副本被改 → 自动还原 + 本会话 fail-closed；配置被改 → 有 UI 时一次明确的双选确认(无 UI 时与扩展副本同样自动还原；差分处置的完整语义见 [ADR-0001](docs/adr/0001-self-protection-layer.md))
 ---
@@ -160,16 +159,20 @@ jev 的校准 confidence 正是置信地板的判定依据——搭配第二层
 | | 三态裁决 | 分类器携带上下文 | fail 方向 | 运行时依赖 |
 |---|---|---|---|---|
-| **pi-verdict** | ✅ allow / ask / deny | ✅ 近期用户意图 + 工具调用 | **closed**(异常/超时/违约 → deny;非交互 ask → deny) | **0** |
-| [@czottmann/pi-automode](https://github.com/czottmann/pi-automode) | 规则三态,分类器二态 | ✅ 预算化 transcript | closed | 1 |
+| **pi-verdict** | ✅ allow / ask / deny | ✅ 近期用户意图 + 工具调用 | **closed**(异常/超时/违约 → deny；非交互 ask → deny) | **0** |
+| [@czottmann/pi-automode](https://github.com/czottmann/pi-automode) | 规则三态，分类器二态 | ✅ 预算内裁剪的 transcript | closed | 1 |
 | [@zhushanwen/pi-permission](https://www.npmjs.com/package/@zhushanwen/pi-permission) | ✅(outcome) | ❌ 单轮无上下文 | closed(→ ask) | 4 |
 | [@gotgenes/pi-permission-system](https://github.com/gotgenes/pi-packages) | ✅ 纯确定性 | —(无内置分类器) | closed | 3 |
-完整全景:[`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) · 与最近架构亲缘的收敛分析:[`research/pi-automode-convergence.md`](research/pi-automode-convergence.md)。
+完整全景：[`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) · 与最近架构亲缘的收敛分析：[`research/pi-automode-convergence.md`](research/pi-automode-convergence.md)。
+诚实地说：pi-automode 与 pi-verdict 在**架构上已收敛**(deny floor → 用户规则 → 分类器，fail-closed——见收敛分析)。这里仍然不同的是：分类器能说 `ask`(运行时人工介入，而非仅由规则预声明)、内置 floor 可以关(`builtinDenyFloor`——用户主权)、任何配置都关不掉的自保护层([ADR-0001](docs/adr/0001-self-protection-layer.md)——门禁完整性)、零依赖的[可通读单文件](extensions/pi-verdict.ts)(仍刻意单文件)、以及测量的习惯——本仓库每个设计决策都有随库研究背书。
+## 判定管线
-诚实地说:pi-automode 与 pi-verdict 在**架构上已收敛**(deny floor → 用户规则 → 分类器,fail-closed——见收敛分析)。这里仍然不同的是:分类器能说 `ask`(运行时人工介入,而非仅由规则预声明)、内置 floor 可以关(`builtinDenyFloor`——用户主权)、任何配置都关不掉的自保护层([ADR-0001](docs/adr/0001-self-protection-layer.md)——门禁完整性)、零依赖的[可通读单文件](extensions/pi-verdict.ts)(仍刻意单文件)、以及测量的习惯——本仓库每个设计决策都有随库研究背书。
+![pi-verdict 安全门禁——工具调用判定管线](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.zh.svg)
-## 管线
+*图源与再生成：[docs/diagrams/](docs/diagrams/README.md)。管线基准：v0.12——下方 ASCII 为文本等价版。*
 ```
 tool_call
@@ -199,36 +202,36 @@ tool_call
 ```
-**fail-closed**:分类器异常 / 超时(25s)/ 输出违反契约 → 拦截,绝不静默放行。
+**fail-closed**：分类器异常 / 超时(25s)/ 输出违反契约 → 拦截，绝不静默放行。
-## 证据驱动,不靠直觉
+## 证据驱动，不靠直觉
-这里的设计决策用测量收敛,实验记录随仓库发布:
+这里的设计决策以测量定案，实验记录随仓库发布：
-- [`research/cache-sim`](research/cache-sim/README.md) —— 回放 1.2k+ 条真实分类器裁决,实测裁决缓存命中率(**3.2%** → 缓存暂缓,改建影子模式遥测)
-- [`research/thinking-param-blackhole.md`](research/thinking-param-blackhole.md) —— 思考模型烧尽分类器预算的三层取证,以及为什么修复是 `thinkingEnabled: false`
+- [`research/cache-sim`](research/cache-sim/README.md) —— 回放 1.2k+ 条真实分类器裁决，实测裁决缓存命中率(**3.2%** → 缓存暂缓；其后建成的运行时影子遥测实测 **3.3%**，后来一并移除，#73)
+- [`research/thinking-param-blackhole.md`](research/thinking-param-blackhole.md) —— 思考模型烧尽分类器预算的三层取证，以及为什么修复是 `thinkingEnabled: false`
 - [`research/rule-engine-sim`](research/rule-engine-sim/README.md) —— 用 746 条真实 bash 调用实测 tree-sitter 规则引擎移植(**灰区吸收 0 条**)并否决
 - [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) —— 本 README 定位所对照的竞品全景
 - [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md) —— 规则层绕过测试(8/8 复现 → 0.2.0 架构性修复)
 - [`research/pi-automode-convergence.md`](research/pi-automode-convergence.md) —— 与 pi-automode 何处真正收敛、何处仍然不同
-- [`research/claude-code-classifier-prompts.md`](research/claude-code-classifier-prompts.md) —— Claude Code 分类器设计的结构化还原(基于自托管 Langfuse 观测),本扩展 transcript 契约的血统来源
+- [`research/claude-code-classifier-prompts.md`](research/claude-code-classifier-prompts.md) —— Claude Code 分类器设计的结构化还原(基于自托管 Langfuse 观测)，本扩展 transcript 契约的承袭来源
 ## 状态与限制
-- 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户规则](#用户规则configpi-verdictjson));allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
-- 路径敏感度 floor 只作用于文件类工具:bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
+- 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
+- 路径敏感度 floor 只作用于文件类工具：bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
 - Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
-- 自省意味着会话模型亲自裁决 —— 若延迟/成本敏感,用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)
-- `denyPaths` 的 bash 提取是 token 级([ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md)):命令替换、base64 内嵌路径、外部脚本内容不产生命中信号——这些调用回落到分类器的存在性话术警戒。MCP 与自定义工具完全绕过提取器(其灰区裁决仍带话术)。路径归一化亦为基础档(ADR-0002):经符号链接目录写入尚不存在的目标不重建真实形、不产生命中——该间接路径同样由话术警戒覆盖(祖先重建档只适用于自保护层与路径敏感度 floor,不适用 denyPaths)。诚实表述,与自保护子串正则同例:确定性层可被混淆——这正是命中交由**你**裁决而非静默决定的原因
-- `denyPaths` 的 bash token 不含空格:**声明路径本身含空格时**,bash 拼写无法被提取器识别——`cat "/path with space/x"` 被拆成两个 token 永不命中(文件类工具仍命中,其路径不经 token 化)。glob 覆盖基名末段(`denyPaths: ["/proj/personal"]` 时 `cat /proj/pers*`)同样漏过——基名自身从未字面出现。经 shell 发起的递归搜索在两种拼写下都漏过——不带路径参数(默认搜 cwd,如裸 `rg foo`)或带父目录参数(`rg foo <声明路径的父目录>`):无参命令根本不产生 token,带参时 bash token 只做单向比较;同一形状经 `grep`/`find`/`ls` 工具发起则由双向子树比较覆盖。三个洞与上述替换/base64 一样回落到分类器的存在性话术
-- 自保护 bash 匹配是子串正则——可被混淆绕过;变更检测兜底覆盖会话内绕过,跨会话基线(启动时哈希比对与变更确认,含升级 UX)按 ADR-0001 为二期
+- 自省意味着会话模型自身裁决 —— 若延迟/成本敏感，用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)
+- `denyPaths` 的 bash 提取是 token 级([ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md))：命令替换、base64 内嵌路径、外部脚本内容不产生命中信号——这些调用回落到分类器的存在性话术警戒。MCP 与自定义工具完全绕过提取器(其灰区裁决仍带话术)。路径归一化亦为基础档(ADR-0002)：经符号链接目录写入尚不存在的目标不重建真实形、不产生命中——该间接路径同样由话术警戒覆盖(祖先重建档只适用于自保护层与路径敏感度 floor，不适用 denyPaths)。诚实表述，与自保护子串正则同例：确定性层可被混淆——这正是命中交由**你**裁决而非静默决定的原因
+- `denyPaths` 的 bash token 不含空格：**声明路径本身含空格时**，bash 拼写无法被提取器识别——`cat "/path with space/x"` 被拆成两个 token 永不命中(文件类工具仍命中，其路径不经 token 化)。glob 覆盖基名末段(`denyPaths: ["/proj/personal"]` 时 `cat /proj/pers*`)同样漏过——基名自身从未字面出现。经 shell 发起的递归搜索在两种拼写下都漏过——不带路径参数(默认搜 cwd，如裸 `rg foo`)或带父目录参数(`rg foo <声明路径的父目录>`)：无参命令根本不产生 token，带参时 bash token 只做单向比较；同一形状经 `grep`/`find`/`ls` 工具发起则由双向子树比较覆盖。三个洞与上述替换/base64 一样回落到分类器的存在性话术
+- 自保护 bash 匹配是子串正则——可被混淆绕过；变更检测兜底覆盖会话内绕过，跨会话基线(启动时哈希比对与变更确认，含升级 UX)按 ADR-0001 为二期
 - dev checkout(从仓库而非 `<agentDir>/extensions/` 运行扩展)不受自保护——下一个正常会话加载的安装副本只在其自身会话的门禁内受保护
-**verdict 不是沙箱。** 它在 pi 进程内裁决工具调用;不能遏制恶意代码、不能防护被攻陷的进程、不守护手工 `!` shell 逃逸。需要隔离请用操作系统级沙箱。
+**verdict 不是沙箱。** 它在 pi 进程内裁决工具调用；不能遏制恶意代码、不能防护被攻陷的进程、不守护手工 `!` shell 逃逸。需要隔离请用操作系统级沙箱。
-命名:三态**裁决(verdict)**是核心概念。UX 保留 `/automode` —— 模式概念上溯 Claude Code 的 auto mode,本项目亦借鉴了其 transcript 设计。
+命名：三态**裁决(verdict)**是核心概念。UX 保留 `/automode` —— 模式概念上溯 Claude Code 的 auto mode，本项目亦借鉴了其 transcript 设计。
 ## 开发

package/extensions/jev-adapter.ts CHANGED Viewed

@@ -195,6 +195,22 @@ export function parseJevConfidence(reason: string): number | null {
 	return m ? Number(m[1]) : null;
 }
+/** #81: protocol identity — `api === API_ID` names the decisions protocol, the
+ *  capability axis the extension actually gates on (numeric confidence is a
+ *  decisions-contract property, not a vendor trait). Structural type so callers
+ *  can pass any model-shaped object. */
+export function isDecisionsModel(model: { api?: string }): boolean {
+	return model.api === API_ID;
+}
+/** #81: exact match for the one decisions spec pi-verdict registers
+ *  ("typesafe/jev-latest"). The registry only ever holds that one slug, so prefix
+ *  tolerance would only ever catch typos — and would mislead with the jev-specific
+ *  wording keyed on this predicate. */
+export function isJevSpec(spec: string): boolean {
+	return spec === `${PROVIDER_ID}/${MODEL_ID}`;
+}
 function mapUsage(u: unknown): AssistantMessage["usage"] {
 	const usage = (u ?? {}) as { input_tokens?: unknown; output_tokens?: unknown; cost?: unknown };
 	const input = Number(usage.input_tokens) || 0;

package/extensions/pi-verdict.ts CHANGED Viewed

@@ -86,7 +86,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { parseJevConfidence } from "./jev-adapter";
+import { isDecisionsModel, isJevSpec, parseJevConfidence } from "./jev-adapter";
 // ============================================================================
 // 规则层:bash
@@ -1097,8 +1097,8 @@ interface ClassifierOutcome {
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
 	source: "model" | "fail-closed";
-	/** #54 audit material: the transcript actually sent and the last attempt's raw output (attached on both model and fail-closed outcomes) */
-	auditRaw?: { transcript: string; rawResponse: string; modelId: string; thinking: ThinkingLevel };
+	/** #54 audit material: the transcript actually sent and the last attempt's raw output (attached on both model and fail-closed outcomes); thinking is null for decisions models (#81) */
+	auditRaw?: { transcript: string; rawResponse: string; modelId: string; thinking: ThinkingLevel | null };
 }
 const CLASSIFIER_TIMEOUT_MS = 25_000; // 本网关 CC 分类器分布 p90=19.8s(15s 会误杀 ~15%),research/cache-sim 数据
@@ -1273,6 +1273,9 @@ async function classifyWithModel(
 	const transcript = buildTranscript(host, actionLine);
 	const userMessage = `<transcript>\n${transcript}\n</transcript>\nJudge the LAST action in the transcript above. Your entire response MUST begin with <verdict>.`;
 	const systemPrompt = denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
+	// #81: decisions models parse-then-drop the thinking suffix — the audit records
+	// null, never the configured-but-inert level (LLM classifiers keep theirs)
+	const auditThinking = isDecisionsModel(model) ? null : thinking;
 	const attempts: Array<[number, number]> = [[1, CLASSIFIER_MAX_TOKENS], [2, CLASSIFIER_RETRY_MAX_TOKENS]];
 	const failures: string[] = [];
 	let rawResponse = ""; // #54: raw output of the last attempt ("" for exception attempts — diagnostics already live in failures)
@@ -1284,7 +1287,7 @@ async function classifyWithModel(
 			const diag = `stopReason=${r.stopReason}, model=${model.id}, errorMessage=${JSON.stringify(r.errorMessage ?? null)}, raw output=${JSON.stringify(r.text.slice(0, 200))}`;
 			if (r.stopReason !== "error" && r.stopReason !== "aborted") {
 				const parsed = parseVerdict(r.text);
-				if (parsed) return { ...parsed, source: "model", auditRaw: { transcript, rawResponse, modelId: model.id, thinking } };
+				if (parsed) return { ...parsed, source: "model", auditRaw: { transcript, rawResponse, modelId: model.id, thinking: auditThinking } };
 				failures.push(`attempt ${n} (${maxTokens}t) contract violation: ${diag}`);
 			} else {
 				failures.push(`attempt ${n} (${maxTokens}t) aborted/errored: ${diag}`);
@@ -1293,7 +1296,7 @@ async function classifyWithModel(
 			failures.push(`attempt ${n} (${maxTokens}t) exception: ${r.error}`);
 		}
 	}
-	return { verdict: "deny", reason: `classifier failure (fail-closed): ${failures.join("; ")}`, source: "fail-closed", auditRaw: { transcript, rawResponse, modelId: model.id, thinking } };
+	return { verdict: "deny", reason: `classifier failure (fail-closed): ${failures.join("; ")}`, source: "fail-closed", auditRaw: { transcript, rawResponse, modelId: model.id, thinking: auditThinking } };
 }
 // ============================================================================
@@ -1539,9 +1542,12 @@ export interface AdjudicateEnv {
 /** #67: the confidence floor. Below it the first layer abstains and the call cascades —
  *  to the fallback if configured, else to the human (headless degrades to deny). Numeric
- *  confidence exists only on jev-formatted reasons; LLM first layers never demote. */
-function confidenceDemotion(outcome: ClassifierOutcome, rules: UserRules): { confidence: number } | null {
-	if (rules.classifierMinConfidence === null || outcome.source === "fail-closed") return null;
+ *  confidence is a decisions-protocol contract property (#81): demotion requires the
+ *  protocol identity (isDecisionsModel) AND a parseable segment — an LLM whose free-text
+ *  reason happens to match the jev format no longer demotes. LLM first layers gate on
+ *  ask/fail-closed only. */
+function confidenceDemotion(outcome: ClassifierOutcome, rules: UserRules, model: NonNullable<ExtensionContext["model"]>): { confidence: number } | null {
+	if (rules.classifierMinConfidence === null || outcome.source === "fail-closed" || !isDecisionsModel(model)) return null;
 	const conf = parseJevConfidence(outcome.reason);
 	if (conf !== null && conf < rules.classifierMinConfidence) return { confidence: conf };
 	return null;
@@ -1694,7 +1700,7 @@ export async function adjudicate(
 	// #67 cascade: a confidence-floor demotion, or a classifier fail-closed outcome
 	// (the first layer produced no verdict)
-	const demotion = confidenceDemotion(outcome, state.userRules);
+	const demotion = confidenceDemotion(outcome, state.userRules, resolved.model);
 	const cascade = demotion || outcome.source === "fail-closed"
 		? await runConfidenceCascade(state, env, demotion ? { verdict: outcome.verdict, reason: outcome.reason } : null, demotion ? { kind: "demotion", confidence: demotion.confidence } : { kind: "fail-closed" }, state.userRules.denyPaths.length > 0, actionLine)
 		: {};
@@ -1891,6 +1897,9 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	});
 	let warnedClassifierModel = false;
+	let warnedFloorInert = false;
+	/** #81: per-layer one-shot for the jev thinking-suffix warning */
+	const jevSuffixWarned = { classifier: false, fallback: false };
 	/** 思考级别集(pi 原生 EXTENDED_THINKING_LEVELS;后缀语法对齐 pi --model provider/id:thinking) */
 	const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
@@ -1907,6 +1916,42 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		return { specPart: raw, level: null };
 	}
+	/** #81: jev-specialized unavailable wording — the two real causes, instead of the
+	 *  generic "not found or no configured auth", which points nowhere for jev. */
+	const JEV_UNAVAILABLE_HINT =
+		"jev needs a pi host with registerProvider (omp is not supported) and a key: OPENROUTER_API_KEY / OpenRouter login (default transport), or TYPESAFE_API_KEY (PI_VERDICT_JEV_TRANSPORT=typesafe)";
+	/** #81: shared spec→model resolution for both classifier layers — registry
+	 *  lookup + auth check, plus the jev thinking-suffix warning fired only on the
+	 *  resolved path: decisions models parse-then-drop the suffix, so "ignored" is
+	 *  factually true exactly here. On the session-model fallback (unresolvable
+	 *  spec) the suffix stays effective for the LLM and must not be called ignored.
+	 *  Returns null when the spec does not resolve; the layer's fallback semantics
+	 *  stay with the caller. */
+	function findSpecModel(ctx: ExtensionContext, specPart: string, level: string | null, layer: "classifier" | "fallback"): NonNullable<ExtensionContext["model"]> | null {
+		const slash = specPart.indexOf("/");
+		if (slash <= 0) return null;
+		const model = ctx.modelRegistry.find(specPart.slice(0, slash), specPart.slice(slash + 1));
+		if (!model || !ctx.modelRegistry.hasConfiguredAuth(model)) return null;
+		if (level !== null && isJevSpec(specPart) && !jevSuffixWarned[layer]) {
+			jevSuffixWarned[layer] = true;
+			ctx.ui.notify(`pi-verdict: thinking suffix "${level}" has no effect on a decisions model (${specPart} has no reasoning to configure) — ignored`, "warning");
+		}
+		return model;
+	}
+	/** #81: floor-inert — the confidence floor binds to decisions models, so a
+	 *  non-decisions classifier silently ignores it. Surfaces once per session at the
+	 *  first resolution (explicit model and self-reflection fallback alike; a purely
+	 *  rule-adjudicated session never sees it — lazy via getModel). Neutral wording:
+	 *  the fact, never a judgment on the config (users may pre-set the floor for a
+	 *  future jev switch). */
+	function warnFloorInert(ctx: ExtensionContext, model: NonNullable<ExtensionContext["model"]>): void {
+		if (warnedFloorInert || state.userRules.classifierMinConfidence === null || isDecisionsModel(model)) return;
+		warnedFloorInert = true;
+		ctx.ui.notify("pi-verdict: classifierMinConfidence has no effect on a non-decisions classifier (the floor applies to decisions models like typesafe/jev-latest)", "warning");
+	}
 	/** 解析分类器模型与思考级别:CLI flag > 环境变量 > 配置文件(classifierModel) >
 	 *  自省(会话模型)。不可用回退会话模型并警告一次;null = 连会话模型都没有 →
 	 *  fail-closed。经 AdjudicateEnv.getModel 惰性调用(仅灰区),回退警告不会出现在
@@ -1922,18 +1967,27 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				ctx.ui.notify(msg, "warning");
 			});
 			thinking = (level ?? "off") as ThinkingLevel;
-			const slash = specPart.indexOf("/");
-			if (slash > 0) {
-				const model = ctx.modelRegistry.find(specPart.slice(0, slash), specPart.slice(slash + 1));
-				if (model && ctx.modelRegistry.hasConfiguredAuth(model)) return { model, thinking };
+			const model = findSpecModel(ctx, specPart, level, "classifier");
+			if (model) {
+				warnFloorInert(ctx, model);
+				return { model, thinking };
 			}
 			if (!warnedClassifierModel) {
 				warnedClassifierModel = true; // 每会话仅警告一次,避免逐调用刷屏
-				ctx.ui.notify(`pi-verdict: classifier model "${raw}" unavailable (not found or no configured auth), falling back to session model (self-reflection)`, "warning");
+				ctx.ui.notify(
+					isJevSpec(specPart)
+						? `pi-verdict: classifier model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT}; falling back to session model (self-reflection)`
+						: `pi-verdict: classifier model "${raw}" unavailable (not found or no configured auth), falling back to session model (self-reflection)`,
+					"warning",
+				);
 			}
 		}
 		// 自省:继承当前会话模型;显式指定的思考级别在回退时仍生效(原语义)
-		return ctx.model ? { model: ctx.model, thinking } : null;
+		if (ctx.model) {
+			warnFloorInert(ctx, ctx.model);
+			return { model: ctx.model, thinking };
+		}
+		return null;
 	}
 	let warnedFallbackSuffix = false;
@@ -1952,14 +2006,16 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			ctx.ui.notify(msg, "warning");
 		});
 		const thinking = (level ?? "off") as ThinkingLevel;
-		const slash = specPart.indexOf("/");
-		if (slash > 0) {
-			const model = ctx.modelRegistry.find(specPart.slice(0, slash), specPart.slice(slash + 1));
-			if (model && ctx.modelRegistry.hasConfiguredAuth(model)) return { model, thinking };
-		}
+		const model = findSpecModel(ctx, specPart, level, "fallback");
+		if (model) return { model, thinking };
 		if (!warnedFallbackModel) {
 			warnedFallbackModel = true; // one warning per session
-			ctx.ui.notify(`pi-verdict: fallback model "${raw}" unavailable (not found or no configured auth) — classifierFallbackModel inactive this session`, "warning");
+			ctx.ui.notify(
+				isJevSpec(specPart)
+					? `pi-verdict: fallback model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT} — classifierFallbackModel inactive this session`
+					: `pi-verdict: fallback model "${raw}" unavailable (not found or no configured auth) — classifierFallbackModel inactive this session`,
+				"warning",
+			);
 		}
 		return null;
 	}

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
 	"name": "pi-verdict",
-	"version": "0.12.0",
-	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
+	"version": "0.12.1",
+	"description": "A minimal permission gate for Pi, inspired by Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",
 	"main": "extensions/pi-verdict.ts",