pi-verdict 0.13.0 → 0.13.1

package/README.md

@@ -119,7 +119,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
 
 - `allow`/`deny` are JS regex arrays; **`deny` wins over `allow`**, both beat the classifier
 - `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files)
-- `ignoreTools` names uncovered tools (`todo`, `web_search`, MCP/custom tools) that skip adjudication — **allow with zero model calls**; entries naming covered tools (`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`) are inert: those stay governed by the deny floor and your allow/deny rules, and the self-protection layer always runs first. A fresh install pre-fills a **starter list** (`todo`, `ask_user_question`, `memory_write`, `memory_search` — observed harmless across the 1265-verdict production audit). Caveat: an exempted tool loses the classifier's `denyPaths` existence-hint vigilance (uncovered tools never hit the path extractor anyway)
+- `ignoreTools` names uncovered tools (`todo`, `web_search`, MCP/custom tools) that skip adjudication — **allow with zero model calls**; entries naming covered tools (`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`) are inert: those stay governed by the deny floor and your allow/deny rules, and the self-protection layer always runs first. A fresh install pre-fills a **starter list** (`todo`, `ask_user_question`, `memory_write`, `memory_search` — observed harmless across the 1265-verdict production audit). Caveat: an exempted tool loses the classifier's `denyPaths` existence-hint vigilance (uncovered tools never hit the path extractor anyway); MCP tool names are normalized before matching — see [codemode & MCP](#pi-099-codemode--mcp-indirect-calls-are-still-gated)
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
 - `classifierModel: "typesafe/jev-latest"` opts into the **native jev classifier** — one structured `classify()` call per gray-zone verdict via pi's built-in classifier catalog (TypeSafe direct, or Jev on OpenRouter/OpenCode/Cloudflare/Vercel); see [ADR-0005](docs/adr/0005-native-classifier-migration.md)
@@ -141,13 +141,23 @@ No built-in allowlist — every "always allow" claim is yours ([why](docs/config
    - or try it once: `PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **Notes**:
-- Verdicts are structured `classify()` answers (choice + probabilities + confidence); the reason line keeps the historical `jev:` shape, other classifier APIs render `classifier:`
+- Verdicts are structured `classify()` answers (choice + probabilities + confidence); the reason line keeps the historical `jev:` probability breakdown (tag-free — the `<verdict>` prefix survives only in the audit record's rawResponse), other classifier APIs render `classifier:`
 - Classifier specs resolve through pi's classifier catalog first (`findOfType`), chat registry second; on same-id dual listings (llama.cpp) the native entry wins; thinking suffixes on a classifier spec warn once and drop (recorded `thinking: null`)
 - Custom endpoints: override the provider's `baseUrl` in models.json (the 0.12 `PI_VERDICT_JEV_URL` escape hatch is gone, as is `PI_VERDICT_JEV_TRANSPORT` — transport choice is now the spec itself)
 - Carried-over limit: the denyPaths existence hint still does not reach classifier-typed models ([ADR-0005](docs/adr/0005-native-classifier-migration.md)); on the TypeSafe direct transport per-call cost shows $0 (its API does not report it)
 
 jev's calibrated confidence is exactly what the confidence floor keys on — pair it with a second layer (`"classifierMinConfidence", "classifierFallbackModel"`) so its low-confidence calls go to a deeper model instead of standing ([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)).
 
+### pi 0.99 codemode & MCP: indirect calls are still gated
+
+pi 0.99 can run model-written JavaScript in a QuickJS sandbox (`codemode`) that calls pi's tools, and MCP servers register tools as `mcp__<server>__<tool>`. Neither surface bypasses this gate:
+
+- **Nested calls are gated exactly like direct ones** — pi routes every tool call a codemode script makes through the same `tool_call` pipeline (tagged `parentToolCallId`, ids `<parent>/<n>`); a blocked call returns as an error to the script, which the model sees
+- **MCP tools land in the gray zone** — the rule layer covers the built-in command/file tools only; each `mcp__*` call is classified, fail-closed included
+- **`ignoreTools` and MCP names**: tool names are normalized — every character outside `[A-Za-z0-9_]` becomes `_` (`mcp__dev-radius__x` → `mcp__dev_radius__x`); exemption entries must use the normalized form
+- **Cost amplification**: one script may issue up to 256 nested calls; gray-zone calls classify one by one, so a slow LLM classifier multiplies per-call latency
+- **Exposure boundary**: adding an MCP server auto-enables codemode, and `pi --no-extensions -e builtin:mcp` runs MCP tools with no extensions loaded — i.e. without this gate. The gate is itself an extension, so it cannot be active in a session that loads none; the boundary is inherent to pi's extension model, stated here rather than papered over
+
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 
 The gate's own files — the config and the installed extension copy — are **user-editable only**: writes from inside the gate hard-deny (reads pass); your editor never passes through the gate, the sudoers/visudo precedent.
@@ -195,7 +205,9 @@ tool_call
   ├─ 2. Gray zone → model classifier (defaults to session model — "self-reflection")
   │     ├─ input: CC-style <transcript> — recent user intent + tool calls,
   │     │        action under review always last
-  │     └─ output contract: <verdict>allow|ask|deny</verdict> prefix-anchored
+  │     └─ output: native classify() answers (choice + probabilities + confidence;
+  │              tag-free reason, full contract line in the audit rawResponse) or,
+  │              on the chat path, <verdict>…</verdict> prefix-anchored free text
   │
   └─ 3. Three-state adjudication
         ├─ allow → pass
@@ -223,6 +235,7 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 - no built-in allowlist by design (see the [bypass writeup](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
 - the path sensitivity floor applies to file tools only: bash command strings are matched by the danger regexes alone, so e.g. `cat ~/.ssh/id_rsa` goes to the classifier rather than the deterministic S0 deny (the file-tool spelling `read ~/.ssh/id_rsa` does deny)
 - on Windows the built-in floor covers bash-shaped patterns only — PowerShell-native dangerous commands (`Remove-Item -Recurse -Force`, `Invoke-Expression`, `Set-ExecutionPolicy`, …) rely on the classifier (fail-closed)
+- on macOS the per-user temp tree (`$TMPDIR`, the `/var/folders/…/T` confstr dir) is exempt from the system-directory floor: reads allow at zero cost, writes adjudicate as ordinary outside-project writes (classifier). The exemption anchors to the runtime-resolved confstr family — a hand-set `TMPDIR` lifts nothing — and `/var/tmp` (POSIX shared temp) stays denied; symlink spellings whose real form escapes the temp tree still hit S1
 - AGENTS.md is not passed to the classifier as downweighted intent evidence (Claude Code does this)
 - parallel gray-zone calls are adjudicated serially
 - self-reflection means the session model adjudicates — point `--auto-mode-model` at a lighter model if verdict latency/cost matters (open question tracked in the issue tracker)

package/README.zh-CN.md

@@ -119,7 +119,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
 
 - `allow`/`deny` 为 JS 正则数组；**`deny` 优先于 `allow`**，两者都优先于分类器
 - `denyPaths` 是你声明**受保护**的普通路径列表：触碰触发**终局 ask** 由你裁决(非交互降级 deny)；分类器只被告知路径**存在**，路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较：省略 `path`(pi 默认：当前目录)或传入位于声明路径之上的父目录，同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件)
-- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具)：**直接放行、零模型调用**；列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效：它们仍受 deny floor 与你的 allow/deny 规则约束，自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察)。注意：被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器)
+- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具)：**直接放行、零模型调用**；列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效：它们仍受 deny floor 与你的 allow/deny 规则约束，自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察)。注意：被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器);MCP 工具名匹配前会归一化——见 [codemode 与 MCP](#pi-099-codemode-与-mcp间接调用同样受门禁)
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担；下方自保护层永远开启)
 - `classifierModel` 指定分类器模型，如 `"zai/glm-5.3-flash:low"`(支持思考后缀；缺省 = 会话模型且显式关思考)
 - `classifierModel: "typesafe/jev-latest"` 启用**原生 jev 分类器**——每次灰区裁决经 pi 内置分类器目录发一次结构化 `classify()` 调用(TypeSafe 直连,或 OpenRouter/OpenCode/Cloudflare/Vercel 上的 Jev);详见 [ADR-0005](docs/adr/0005-native-classifier-migration.md)
@@ -141,13 +141,23 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
   - 或者临时试用一次:`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **说明**:
-- 裁决为结构化 `classify()` 应答(choice + probabilities + confidence);reason 行保留历史 `jev:` 形态,其余分类器 API 渲染 `classifier:`
+- 裁决为结构化 `classify()` 应答(choice + probabilities + confidence);reason 行保留历史 `jev:` 概率分解(无标签——`<verdict>` 前缀只存活于审计记录的 rawResponse),其余分类器 API 渲染 `classifier:`
 - 分类器 spec 先经 pi 分类器目录解析(`findOfType`)、chat 注册表兜底;同 id 双型并存(llama.cpp)时原生条目优先;分类器 spec 上的思考后缀警告一次后丢弃(审计 `thinking` 记为 `null`)
 - 自定义端点:在 models.json 覆盖 provider 的 `baseUrl`(0.12 的 `PI_VERDICT_JEV_URL` 逃生口与 `PI_VERDICT_JEV_TRANSPORT` 均已移除——transport 选择即 spec 本身)
 - 沿袭限制:denyPaths 存在性话术仍不达分类器形态模型([ADR-0005](docs/adr/0005-native-classifier-migration.md));TypeSafe 直连的单次成本显示 $0(其 API 不返回 cost)
 
 jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence", "classifierFallbackModel"`)，让低置信调用交由更深的模型复裁，而非就地生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
 
+### pi 0.99 codemode 与 MCP:间接调用同样受门禁
+
+pi 0.99 可以在 QuickJS 沙箱(`codemode`)里运行模型写的 JavaScript 去调用 pi 的工具,MCP 服务器则以 `mcp__<server>__<tool>` 注册工具。这两个新增面都不会绕过本门禁:
+
+- **嵌套调用与直接调用同样过门**——pi 把 codemode 脚本发起的每一次工具调用都路由到同一条 `tool_call` 管线(带 `parentToolCallId`,id 形如 `<父id>/<n>`);被拦截的调用以错误形式回传脚本,模型可见
+- **MCP 工具落入灰区**——规则层只覆盖内置命令/文件工具;每次 `mcp__*` 调用都走分类器,含 fail-closed
+- **`ignoreTools` 与 MCP 工具名**:工具名会归一化——`[A-Za-z0-9_]` 之外的字符统一变 `_`(`mcp__dev-radius__x` → `mcp__dev_radius__x`);豁免条目必须写归一化后的形态
+- **成本放大**:单个脚本最多可发 256 次嵌套调用,灰区调用逐个分类,慢的 LLM 分类器会把单次延迟成倍放大
+- **暴露边界**:添加 MCP 服务器会自动开启 codemode,而 `pi --no-extensions -e builtin:mcp` 可在不加载任何扩展(即无本门禁)的情况下启用 MCP 工具。门禁自身即扩展,在完全不加载扩展的会话中无法生效;此边界为 pi 扩展模型的固有属性,此处显式陈述而非掩饰
+
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 
 门禁自身的文件——配置与扩展安装副本——**仅用户可改**：门禁之内的写入一律硬 deny(读放行)；你的编辑器修改不经门禁，同类先例是 sudoers 必须经 visudo。
@@ -223,6 +233,7 @@ tool_call
 - 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
 - 路径敏感度 floor 只作用于文件类工具：bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
 - Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
+- macOS 下 per-user 临时目录(`$TMPDIR`,`/var/folders/…/T` confstr 目录)豁免于系统目录 floor:读零成本放行,写按普通项目外写交分类器裁决。豁免锚定运行时解析的 confstr 族——手工设置 `TMPDIR` 不会解除任何保护;`/var/tmp`(POSIX 共享临时目录)维持拦截;真实形态逃逸临时树的符号链接拼写仍命中 S1
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
 - 自省意味着会话模型自身裁决 —— 若延迟/成本敏感，用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)

package/extensions/pi-verdict.ts

@@ -461,7 +461,62 @@ const S0_SECRET = [
 ];
 // /private prefixes: macOS firmlinks — /etc, /var are really /private/etc,
 // /private/var, and realpath'd toolchain output uses the real spelling (#21)
-const S1_SYSTEM = [/^\/etc(\/|$)/i, /^\/private\/(etc|var)(\/|$)/i, /^\/usr(\/|$)/i, /^\/var(\/|$)/i, /^\/System(\/|$)/i, /(^|\/)authorized_keys$/i];
+// Split into two families (#83): the directory-prefix family (what the per-user
+// temp exemption may lift on macOS) and the basename family (authorized_keys —
+// staging it in a temp dir must stay denied; defense in depth for the
+// stage-then-copy chain).
+const S1_SYSTEM_DIRS = [/^\/etc(\/|$)/i, /^\/private\/(etc|var)(\/|$)/i, /^\/usr(\/|$)/i, /^\/var(\/|$)/i, /^\/System(\/|$)/i];
+const S1_SYSTEM_FILES = [/(^|\/)authorized_keys$/i];
+const S1_SYSTEM = [...S1_SYSTEM_DIRS, ...S1_SYSTEM_FILES];
+
+/** #83: the per-user temp exemption bases — macOS confstr family only, at the
+ *  confstr DEPTH (two segments below the family root: /var/folders/<xx>/<yy>/…),
+ *  so the family root itself or a stray one-level child can never widen the
+ *  exemption. The guard is deliberate: os.tmpdir() reads the process env, so
+ *  trusting it verbatim would let a hand-set TMPDIR (e.g. TMPDIR=/etc, or the
+ *  family root) lift the floor over S1 trees — narrowing the never-config-exemptible
+ *  floor must go through code review, not an env accident. Another user's confstr
+ *  subtree technically passes the depth check but is macOS-permission-guarded
+ *  (same-user threat only). /var/tmp (POSIX shared temp) intentionally stays S1.
+ *  Returns [] (inert) on every other platform — their tmpdirs never match S1. */
+export function computeTmpdirBases(
+	platform: NodeJS.Platform,
+	tmp: string,
+	realpath: (p: string) => string | null,
+): string[] {
+	if (platform !== "darwin" || !tmp) return [];
+	const lexical = path.resolve(tmp);
+	const real = realpath(lexical);
+	const bases = real === null ? [lexical] : [lexical, real];
+	const confstrFamily = /^(?:\/private)?\/var\/folders\/[^/]+\/[^/]+(?:\/|$)/;
+	return bases.every((b) => confstrFamily.test(b)) ? bases : [];
+}
+
+/** The session-constant exemption bases (os.tmpdir() is stable for a process
+ *  lifetime); test-overridable via the exported seam below. */
+function defaultTmpdirBases(): string[] {
+	return computeTmpdirBases(process.platform, os.tmpdir(), (p) => {
+		try {
+			return fs.realpathSync(p);
+		} catch {
+			return null;
+		}
+	});
+}
+
+let tmpdirExemptBases = defaultTmpdirBases();
+
+/** Test seam for tmpdirExemptBases — exported for tests only (the internal-seam
+ *  surface, the standing #35 pattern); null restores the production bases. */
+export function setTmpdirBasesForTests(bases: string[] | null): void {
+	tmpdirExemptBases = bases ?? defaultTmpdirBases();
+}
+
+/** #83: is EVERY canonical form of the target under the per-user temp tree?
+ *  Intersection semantics (#20 discipline): a lexical temp spelling whose real
+ *  form escapes (symlink to /etc) is NOT exempt — the S1 grading still applies. */
+const tmpdirExempt = (forms: string[]): boolean =>
+	tmpdirExemptBases.length > 0 && forms.every((f) => tmpdirExemptBases.some((b) => f === b || f.startsWith(b + path.sep)));
 const S2_USER_RC = [/\.(bashrc|zshrc|profile|bash_profile|gitconfig)$/i, /crontab/i, /Library\/LaunchAgents(\/|$)/i, /\.config\/systemd(\/|$)/i];
 const S3_GIT_META = [/(^|\/)\.git\/(hooks|config|modules)(\/|$)/i, /(^|\/)\.gitmodules$/i];
 
@@ -479,11 +534,17 @@ function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: b
 		: (reason: string): RuleResult => ({ verdict: "gray", reason });
 
 	if (hit(S0_SECRET)) return D(`S0 secrets/credential path: ${rawPath}`);
+	// #83: under the per-user temp tree the DIRECTORY-prefix family of S1 lifts (a
+	// macOS confstr temp dir is per-user scratch, not a system directory); the
+	// basename family (authorized_keys) still applies, and the fall-through keeps the
+	// deny-only floor philosophy — reads regain the ordinary read allow, writes grade
+	// as ordinary outside-project writes (gray, classifier-adjudicated).
+	const s1Rules = tmpdirExempt(forms) ? S1_SYSTEM_FILES : S1_SYSTEM;
 	if (!isWrite) {
-		if (hit(S1_SYSTEM)) return { verdict: "gray", reason: `read system config path: ${rawPath}` };
+		if (hit(s1Rules)) return { verdict: "gray", reason: `read system config path: ${rawPath}` };
 		return { verdict: "allow" };
 	}
-	if (hit(S1_SYSTEM)) return D(`write to system directory: ${rawPath}`);
+	if (hit(s1Rules)) return D(`write to system directory: ${rawPath}`);
 	if (hit(S3_GIT_META)) return D(`write to .git metadata (executable code entry point): ${rawPath}` );
 	if (hit(S2_USER_RC)) return { verdict: "gray", reason: `write to user config/persistence entry point: ${rawPath}` };
 	// In-cwd write allowance (#20): every canonical form must sit inside the cwd
@@ -556,10 +617,126 @@ function userRuleTarget(toolName: string, input: Record<string, unknown>, cwd: s
 // only ever sees a fixed existence hint — zero path plaintext.
 // ============================================================================
 
-/** Path-like tokens in a shell command string: ~/…, $HOME/…, absolute /…, ./… / ../…, and word/word relative forms. URL path segments can match the absolute branch — harmless: resolution against denyPaths prefixes is what decides, false positives ask (safe direction) */
-const BASH_PATH_TOKENS =
+/** Path-like tokens in a shell command string: ~/…, $HOME/…, absolute /…, ./… / ../…, and word/word relative forms. URL path segments can match the absolute branch — harmless: resolution against denyPaths prefixes is what decides, false positives ask (safe direction).
+ *
+ * Exported as the SEMANTIC ORACLE for #32's linear tokenizer (bashPathTokens) — the
+ * production path never runs this regex: its four alternatives backtrack
+ * quadratically on long failure searches (a 200k separator-free run takes ~28s,
+ * issue #32), and unlike the danger regexes (#25's 8192 cap) it cannot be capped —
+ * truncation would let a protected-path spelling beyond the cap silently escape
+ * the deterministic ask (ADR-0002's never-silently-passed contract). */
+export const BASH_PATH_TOKENS =
 	/(?:~|\$HOME)(?:\/[\w.@*-]+)*|\/(?:[\w.@*-]+\/)*[\w.@*-]*|\.{1,2}(?:\/[\w.@*-]+)+|[\w.-]+(?:\/[\w.-]+)+/g;
 
+/** ASCII class membership for the tokenizer (JS \w is ASCII-only; non-ASCII code
+ *  points simply fall outside the classes, matching the regex). */
+const TOKEN_W2 = new Uint8Array(128); // [\w.@*-]
+const TOKEN_W4 = new Uint8Array(128); // [\w.-]
+for (let c = 0; c < 128; c++) {
+	const ch = String.fromCharCode(c);
+	if (/[a-zA-Z0-9_]/.test(ch) || ".@*-".includes(ch)) TOKEN_W2[c] = 1;
+	if (/[a-zA-Z0-9_]/.test(ch) || ".-".includes(ch)) TOKEN_W4[c] = 1;
+}
+
+const isW2 = (s: string, i: number): boolean => i < s.length && s.charCodeAt(i) < 128 && TOKEN_W2[s.charCodeAt(i)] === 1;
+const isW4 = (s: string, i: number): boolean => i < s.length && s.charCodeAt(i) < 128 && TOKEN_W4[s.charCodeAt(i)] === 1;
+
+/** #32: linear tokenizer for BASH_PATH_TOKENS — one deterministic pass, provably
+ *  O(n): each alternative parses greedily with at most a bounded (≤ 2) retry, and
+ *  the scan position only advances. The regex oracle's matchAll semantics are
+ *  reproduced exactly (alternation priority included; equivalence pinned by a
+ *  fuzz test against the oracle). Derivation per alternative:
+ *  - alt1 `(~|$HOME)(\/W2+)*`: the star never fails — prefix + maximal (/ + W2-run)
+ *    repetitions; a bare ~ / $HOME is a legal zero-iteration match.
+ *  - alt2 `\/(W2+\/)*W2*`: pairs stop at the first word-run not followed by a slash;
+ *    the trailing star always succeeds, so the greedy parse is THE match (a lone
+ *    "/" is a legal zero-pair, empty-tail match).
+ *  - alt3 `\.{1,2}(\/W2+)+`: dots are tried greedily (2 then 1 — the regex's DFS
+ *    order); the plus needs one '/'-then-W2 continuation, else the alternative fails.
+ *  - alt4 `W4+(\/W4+)+`: the leading run is maximal [p, e); a continuation is viable
+ *    ONLY at a '/' (a literal) immediately followed by a W4 char, and once viable
+ *    the greedy inner always completes — so the DFS-first match takes the LARGEST
+ *    viable '/' at or before e and extends greedily. This is exactly where the
+ *    regex paid O(n) per start position on failure; the scan computes it in O(1)
+ *    amortized. */
+export function bashPathTokens(command: string): string[] {
+	const s = command;
+	const n = s.length;
+	// Right-to-left precompute of maximal-run ends — the single pass that makes every
+	// position O(1): runEndX[i] = first index >= i not in class X (i when s[i] itself
+	// is out of class; n at the end of string).
+	const runEnd2 = new Int32Array(n + 1);
+	const runEnd4 = new Int32Array(n + 1);
+	runEnd2[n] = n;
+	runEnd4[n] = n;
+	for (let i = n - 1; i >= 0; i--) {
+		runEnd2[i] = isW2(s, i) ? runEnd2[i + 1] : i;
+		runEnd4[i] = isW4(s, i) ? runEnd4[i + 1] : i;
+	}
+	const out: string[] = [];
+	let p = 0;
+	while (p < n) {
+		const c = s[p];
+		let m = 0; // match end (exclusive); 0 = no match at p
+		if (c === "~" || s.startsWith("$HOME", p)) {
+			// alt1: deterministic greedy (/ + W2-run) repetitions
+			let q = c === "~" ? p + 1 : p + 5;
+			for (;;) {
+				if (s[q] === "/" && isW2(s, q + 1)) q = runEnd2[q + 1];
+				else break;
+			}
+			m = q;
+		} else if (c === "/") {
+			// alt2: (W2-run + /) pairs while possible, then the trailing W2-run
+			let q = p + 1;
+			for (;;) {
+				if (!isW2(s, q)) break; // empty tail — the match is the consumed prefix
+				const r = runEnd2[q];
+				if (s[r] !== "/") {
+					q = r; // tail run consumes through r
+					break;
+				}
+				q = r + 1; // pair complete — another may follow
+			}
+			m = q;
+		} else if (c === ".") {
+			// alt3: dots greedy 2 then 1; inner = maximal (/ + W2-run) repetitions, >= 1 required
+			const innerEnd = (q: number): number | null => {
+				if (s[q] !== "/" || !isW2(s, q + 1)) return null;
+				let r = q;
+				for (;;) {
+					if (s[r] === "/" && isW2(s, r + 1)) r = runEnd2[r + 1];
+					else break;
+				}
+				return r;
+			};
+			if (s[p + 1] === ".") m = innerEnd(p + 2) ?? 0;
+			if (m === 0) m = innerEnd(p + 1) ?? 0;
+		}
+		if (m === 0 && isW4(s, p)) {
+			// alt4: the maximal leading run is [p, e). '/' is not in W4, so the run
+			// itself contains no slash and the ONLY viable continuation split is at e
+			// — the O(1) step that replaces the regex's O(n)-per-position backtrack.
+			const e = runEnd4[p];
+			if (s[e] === "/" && isW4(s, e + 1)) {
+				let q = e;
+				for (;;) {
+					if (s[q] === "/" && isW4(s, q + 1)) q = runEnd4[q + 1];
+					else break;
+				}
+				m = q;
+			}
+		}
+		if (m > p) {
+			out.push(s.slice(p, m));
+			p = m; // matchAll semantics: continue after the match
+		} else {
+			p++;
+		}
+	}
+	return out;
+}
+
 /** Normalized forms of one path for denyPaths comparison: base tier only (ADR-0002) —
  *  no ancestor rebuild; a nonexistent target under a symlinked dir falls to the
  *  classifier + existence hint instead (pinned by a regression test). */
@@ -578,7 +755,7 @@ const anchorDenyPaths = (paths: string[], cwd: string): string[] => paths.flatMa
  *  IS the cwd subtree (#48). */
 function denyPathCandidates(toolName: string, input: Record<string, unknown>, cwd: string): string[] {
 	const kind = toolKind(toolName);
-	if (kind === "command") return [...String(input.command ?? "").matchAll(BASH_PATH_TOKENS)].map((m) => m[0]);
+	if (kind === "command") return bashPathTokens(String(input.command ?? "")); // #32: linear — the regex stays as the test oracle
 	if (kind === "file") {
 		const p = typeof input.path === "string" && input.path ? input.path : null;
 		if (!p) return isScopeTool(toolName) ? [cwd] : [];
@@ -1040,12 +1217,19 @@ export interface NativeClassifierSpec {
 	provider?: string;
 }
 
-/** The resolved classifier layer (ADR-0005): native = classify() protocol path
- *  (floor-capable by construction), chat = LLM prompt path (thinking applies). */
-export type ResolvedModel =
+/** The resolved classifier spec (ADR-0005): native = classify() protocol path
+ *  (floor-capable by construction), chat = LLM prompt path — what spec resolution
+ *  returns, before the thinking level is attached. */
+export type ResolvedSpec =
 	| { kind: "native"; model: NativeClassifierSpec }
 	| { kind: "chat"; model: NonNullable<ExtensionContext["model"]> };
 
+/** A fully resolved classifier layer: the spec plus its thinking level. Native
+ *  layers do not consume the level (classifier models carry no reasoning — a
+ *  suffix warns once and the audit records null), but the parsed value stays on
+ *  the layer; chat layers pass it through to the completion call. */
+export type ResolvedLayer = ResolvedSpec & { thinking: ThinkingLevel };
+
 export interface ClassifierAnswerShape {
 	type: string;
 	choice?: string;
@@ -1117,12 +1301,15 @@ export function confidencePercent(conf: number): number {
 	return Math.floor(conf * 100 + 1e-9);
 }
 
-/** Validates the verdict answer and synthesizes the contract line
- *  (`<verdict>…</verdict>` + one-line reason) from a native classify() answer. Any
- *  malformed shape throws — the caller's fail-closed path owns the fallout. Reason is
- *  user-facing (block reasons, ask dialogs): plain percentages, no internal notation.
- *  Confidence is hard-required (#63 carried over): the decisions contract guarantees it
- *  on choice answers, so absence is contract drift and drift fails closed. */
+/** Validates the verdict answer and synthesizes the human-readable reason line
+ *  (probability breakdown, plain percentages, no internal notation). Any malformed
+ *  shape throws — the caller's fail-closed path owns the fallout. Confidence is
+ *  hard-required (#63 carried over): the decisions contract guarantees it on choice
+ *  answers, so absence is contract drift and drift fails closed. The historical
+ *  `<verdict>…</verdict>` prefix is NOT part of the reason anymore (see the ADR-0005
+ *  amendment): it existed to satisfy the LLM path's parseVerdict contract, which the
+ *  native path never needed — the full contract line lives on in the audit record's
+ *  rawResponse only. */
 export function composeVerdictLine(answer: ClassifierAnswerShape, api: string): string {
 	const choice = String(answer.choice ?? "").trim().toLowerCase();
 	if (!VERDICTS.includes(choice as VerdictChoice)) {
@@ -1138,7 +1325,7 @@ export function composeVerdictLine(answer: ClassifierAnswerShape, api: string):
 		.map((v) => `${v} ${pct(probs[v])}`)
 		.join(", ");
 	const prefix = SYSTEM_ONE_APIS.has(api) ? "jev" : "classifier";
-	return `<verdict>${choice}</verdict> ${prefix}: ${choice} ${pct(probs[choice])} (confidence ${confidencePercent(conf)}%; ${rest})`;
+	return `${prefix}: ${choice} ${pct(probs[choice])} (confidence ${confidencePercent(conf)}%; ${rest})`;
 }
 
 const MAX_USER_MESSAGES = 5;
@@ -1419,12 +1606,16 @@ export async function classifyNative(
 	if (answer.type !== "choice") return fail(`malformed verdict answer (type=${JSON.stringify(answer.type)})`);
 	try {
 		const line = composeVerdictLine(answer, model.api);
+		const verdict = String(answer.choice).trim().toLowerCase() as ClassifierOutcome["verdict"];
 		return {
-			verdict: String(answer.choice).trim().toLowerCase() as ClassifierOutcome["verdict"],
+			verdict,
 			reason: line,
 			source: "model",
 			confidence: confidencePercent(answer.confidence as number),
-			auditRaw: { transcript, rawResponse: line, modelId: model.id, thinking: null },
+			// The audit keeps the full contract line (tag included) in rawResponse — "what
+			// the protocol said" — mirroring the LLM path's rawResponse (the model's full
+			// output, tag included). The reason field is human-facing and tag-free.
+			auditRaw: { transcript, rawResponse: `<verdict>${verdict}</verdict> ${line}`, modelId: model.id, thinking: null },
 		};
 	} catch (error) {
 		return fail(`${error instanceof Error ? error.message : String(error)}`);
@@ -1432,27 +1623,23 @@ export async function classifyNative(
 }
 
 async function classifyWithModel(
-	host: PipelineHost,
-	signal: AbortSignal | undefined,
-	complete: CompletionFn,
-	classify: ClassifyFn | undefined,
-	model: ResolvedModel,
-	actionLine: string,
-	thinking: ThinkingLevel = "off",
-	denyPathsActive = false,
-	timeoutMs: number = CLASSIFIER_TIMEOUT_MS,
+	env: Pick<AdjudicateEnv, "host" | "signal" | "complete" | "classify">,
+	resolved: ResolvedLayer,
+	call: { actionLine: string; denyPathsActive: boolean; timeoutMs?: number },
 ): Promise<ClassifierOutcome> {
-	if (model.kind === "native") return classifyNative(classify, model.model, host, actionLine, signal, timeoutMs);
-	const chat = model.model;
-	const transcript = buildTranscript(host, actionLine);
+	const timeoutMs = call.timeoutMs ?? CLASSIFIER_TIMEOUT_MS;
+	if (resolved.kind === "native") return classifyNative(env.classify, resolved.model, env.host, call.actionLine, env.signal, timeoutMs);
+	const chat = resolved.model;
+	const thinking = resolved.thinking;
+	const transcript = buildTranscript(env.host, call.actionLine);
 	const userMessage = `<transcript>\n${transcript}\n</transcript>\nJudge the LAST action in the transcript above. Your entire response MUST begin with <verdict>.`;
-	const systemPrompt = denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
+	const systemPrompt = call.denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
 	const attempts: Array<[number, number]> = [[1, CLASSIFIER_MAX_TOKENS], [2, CLASSIFIER_RETRY_MAX_TOKENS]];
 	const failures: string[] = [];
 	let rawResponse = ""; // #54: raw output of the last attempt ("" for exception attempts — diagnostics already live in failures)
 	for (const [n, maxTokens] of attempts) {
-		if (signal?.aborted) break; // 用户已取消,不再重试
-		const r = await callClassifierOnce(host, signal, complete, chat, userMessage, maxTokens, thinking, systemPrompt, timeoutMs);
+		if (env.signal?.aborted) break; // 用户已取消,不再重试
+		const r = await callClassifierOnce(env.host, env.signal, env.complete, chat, userMessage, maxTokens, thinking, systemPrompt, timeoutMs);
 		if (r.ok) {
 			rawResponse = r.text;
 			const diag = `stopReason=${r.stopReason}, model=${chat.id}, errorMessage=${JSON.stringify(r.errorMessage ?? null)}, raw output=${JSON.stringify(r.text.slice(0, 200))}`;
@@ -1704,14 +1891,14 @@ export interface Verdict {
 export interface AdjudicateEnv {
 	cwd: string;
 	hasUI: boolean;
-	getModel: () => { model: ResolvedModel; thinking: ThinkingLevel } | null;
+	getModel: () => ResolvedLayer | null;
 	complete: CompletionFn;
 	/** Native classify() seam (ADR-0005); absent on hosts without the capability —
 	 *  the native path fail-closes, never silently falls back to the chat path. */
 	classify?: ClassifyFn;
 	host: PipelineHost;
 	signal?: AbortSignal;
-	getFallbackModel?: () => { model: ResolvedModel; thinking: ThinkingLevel } | null;
+	getFallbackModel?: () => ResolvedLayer | null;
 }
 
 /** #67 (0.13, ADR-0005): the floor gates on protocol-native confidence — set only
@@ -1777,10 +1964,10 @@ async function runConfidenceCascade(
 	};
 	const resolved = getFb();
 	if (!resolved) return failed(rules.classifierFallbackModel, "fallback model unresolvable (not found or no configured auth)");
-	const outcome = await classifyWithModel(env.host, env.signal, env.complete, env.classify, resolved.model, actionLine, resolved.thinking, denyPathsActive, FALLBACK_TIMEOUT_MS);
-	if (outcome.source !== "model") return failed(resolved.model.model.id, outcome.reason);
+	const outcome = await classifyWithModel(env, resolved, { actionLine, denyPathsActive, timeoutMs: FALLBACK_TIMEOUT_MS });
+	if (outcome.source !== "model") return failed(resolved.model.id, outcome.reason);
 	state.fallback.note(first?.verdict ?? null, outcome.verdict);
-	const fb: FallbackAudit = { ...base, model: resolved.model.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs: Date.now() - start, error: null };
+	const fb: FallbackAudit = { ...base, model: resolved.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs: Date.now() - start, error: null };
 	if (mode === "shadow") return { ...demotedMark, fb, ...shadowApplied };
 	// The carve-outs on second-layer authority (#71): it may not auto-relax a negative
 	// first-layer verdict — a demoted deny OR ask that the fallback would allow goes to
@@ -1868,7 +2055,7 @@ export async function adjudicate(
 		return { verdict: "deny", reason, source: "fail-closed", degraded: false };
 	}
 
-	const outcome = await classifyWithModel(env.host, env.signal, env.complete, env.classify, resolved.model, actionLine, resolved.thinking, state.userRules.denyPaths.length > 0);
+	const outcome = await classifyWithModel(env, resolved, { actionLine, denyPathsActive: state.userRules.denyPaths.length > 0 });
 
 	// #67 cascade: a confidence-floor demotion, or a classifier fail-closed outcome
 	// (the first layer produced no verdict)
@@ -2104,6 +2291,16 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		return id.includes("jev");
 	}
 
+	/** Shared "spec unavailable" wording: jev specs get the specialized causes,
+	 *  anything else the generic miss; `tail` carries the layer's fallback
+	 *  semantics with its leading separator. (Extracted from two previously
+	 *  lockstep-synchronized ternaries — see CHANGELOG [Unreleased].) */
+	function unavailableNotice(subject: string, raw: string, specPart: string, tail: string): string {
+		return isJevSpec(specPart)
+			? `pi-verdict: ${subject} "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT}${tail}`
+			: `pi-verdict: ${subject} "${raw}" unavailable (not found or no configured auth)${tail}`;
+	}
+
 	/** ADR-0005: shared spec→model resolution for both classifier layers. Native
 	 *  classifier entries are looked up first (findOfType) and WIN on same-id dual
 	 *  listings (llama.cpp chat+classifier share ids) — the native path is the point
@@ -2113,7 +2310,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  chat path the suffix stays effective and must not be called ignored). Returns
 	 *  null when the spec does not resolve; the layer's fallback semantics stay with
 	 *  the caller. */
-	function findSpecModel(ctx: ExtensionContext, specPart: string, level: string | null, layer: "classifier" | "fallback"): ResolvedModel | null {
+	function findSpecModel(ctx: ExtensionContext, specPart: string, level: string | null, layer: "classifier" | "fallback"): ResolvedSpec | null {
 		const slash = specPart.indexOf("/");
 		if (slash <= 0) return null;
 		const provider = specPart.slice(0, slash);
@@ -2141,7 +2338,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  model and self-reflection fallback alike; a purely rule-adjudicated session never
 	 *  sees it — lazy via getModel). Neutral wording: the fact, never a judgment on the
 	 *  config (users may pre-set the floor for a future classifier switch). */
-	function warnFloorInert(ctx: ExtensionContext, model: ResolvedModel): void {
+	function warnFloorInert(ctx: ExtensionContext, model: ResolvedSpec): void {
 		if (warnedFloorInert || state.userRules.classifierMinConfidence === null || model.kind === "native") return;
 		warnedFloorInert = true;
 		ctx.ui.notify("pi-verdict: classifierMinConfidence has no effect on a chat-model classifier (the floor applies to native classifier models like typesafe/jev-latest, whose confidence is protocol-native)", "warning");
@@ -2151,7 +2348,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  自省(会话模型,恒为 chat 路径——0.99 分类器不进 /model)。不可用回退会话模型
 	 *  并警告一次;null = 连会话模型都没有 → fail-closed。经 AdjudicateEnv.getModel
 	 *  惰性调用(仅灰区),回退警告不会出现在规则已裁决的调用上。 */
-	function resolveClassifier(ctx: ExtensionContext): { model: ResolvedModel; thinking: ThinkingLevel } | null {
+	function resolveClassifier(ctx: ExtensionContext): ResolvedLayer | null {
 		const raw =
 			(pi.getFlag("auto-mode-model") as string | undefined) ?? process.env.PI_AUTO_MODE_MODEL ?? state.userRules.classifierModel;
 		let thinking: ThinkingLevel = "off";
@@ -2162,17 +2359,15 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				ctx.ui.notify(msg, "warning");
 			});
 			thinking = (level ?? "off") as ThinkingLevel;
-			const model = findSpecModel(ctx, specPart, level, "classifier");
-			if (model) {
-				warnFloorInert(ctx, model);
-				return { model, thinking };
+			const spec = findSpecModel(ctx, specPart, level, "classifier");
+			if (spec) {
+				warnFloorInert(ctx, spec);
+				return { ...spec, thinking };
 			}
 			if (!warnedClassifierModel) {
 				warnedClassifierModel = true; // 每会话仅警告一次,避免逐调用刷屏
 				ctx.ui.notify(
-					isJevSpec(specPart)
-						? `pi-verdict: classifier model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT}; falling back to session model (self-reflection)`
-						: `pi-verdict: classifier model "${raw}" unavailable (not found or no configured auth), falling back to session model (self-reflection)`,
+					unavailableNotice("classifier model", raw, specPart, "; falling back to session model (self-reflection)"),
 					"warning",
 				);
 			}
@@ -2180,9 +2375,9 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		// 自省:继承当前会话模型(chat 路径——0.99 分类器不进 /model,会话模型恒为
 		// chat/virtual);显式指定的思考级别在回退时仍生效(原语义)
 		if (ctx.model) {
-			const self: ResolvedModel = { kind: "chat", model: ctx.model };
+			const self: ResolvedSpec = { kind: "chat", model: ctx.model };
 			warnFloorInert(ctx, self);
-			return { model: self, thinking };
+			return { ...self, thinking };
 		}
 		return null;
 	}
@@ -2194,7 +2389,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  judgment twice instead of adding a second opinion. Unresolvable → one-time warning
 	 *  + null (shadow: inert; enforce: triggered calls fail-closed, see runFallbackCascade).
 	 *  Resolved lazily via AdjudicateEnv.getFallbackModel, only after the gate fires. */
-	function resolveFallbackClassifier(ctx: ExtensionContext): { model: ResolvedModel; thinking: ThinkingLevel } | null {
+	function resolveFallbackClassifier(ctx: ExtensionContext): ResolvedLayer | null {
 		const raw = state.userRules.classifierFallbackModel;
 		if (!raw) return null;
 		const { specPart, level } = parseModelSpec(raw, (msg) => {
@@ -2203,14 +2398,12 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			ctx.ui.notify(msg, "warning");
 		});
 		const thinking = (level ?? "off") as ThinkingLevel;
-		const model = findSpecModel(ctx, specPart, level, "fallback");
-		if (model) return { model, thinking };
+		const spec = findSpecModel(ctx, specPart, level, "fallback");
+		if (spec) return { ...spec, thinking };
 		if (!warnedFallbackModel) {
 			warnedFallbackModel = true; // one warning per session
 			ctx.ui.notify(
-				isJevSpec(specPart)
-					? `pi-verdict: fallback model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT} — classifierFallbackModel inactive this session`
-					: `pi-verdict: fallback model "${raw}" unavailable (not found or no configured auth) — classifierFallbackModel inactive this session`,
+				unavailableNotice("fallback model", raw, specPart, " — classifierFallbackModel inactive this session"),
 				"warning",
 			);
 		}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.13.0",
+	"version": "0.13.1",
 	"description": "A minimal permission gate for Pi, inspired by Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",