pi-verdict 0.13.1 → 0.15.0

package/README.md

@@ -110,6 +110,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
+  "auditRedactSecrets": true,
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
@@ -123,7 +124,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
 - `classifierModel: "typesafe/jev-latest"` opts into the **native jev classifier** — one structured `classify()` call per gray-zone verdict via pi's built-in classifier catalog (TypeSafe direct, or Jev on OpenRouter/OpenCode/Cloudflare/Vercel); see [ADR-0005](docs/adr/0005-native-classifier-migration.md)
-- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
+- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); secret-shaped text is redacted on append (`<redacted:type#fingerprint>`, deterministic so cross-record tracing survives — `auditRedactSecrets: false` opts out; [ADR-0007](docs/adr/0007-audit-secret-redaction.md)); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
 - `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; with both switches on the notification appears once
 - `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a native-classifier verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`enforce`, the default = the second layer adjudicates; a demoted **deny or ask** can never be auto-relaxed to an allow; a fail-closed layer emitted no verdict, so its rescue stands; `shadow` = records its opinion only and you are asked — `/automode` hints the activation switch), otherwise asked of you directly. At/above the floor the first layer is autonomous. The floor applies to native classifier models only (protocol-native confidence) — with a chat/LLM classifier it is inert, and a one-time warning says so. A natural pairing: jev first + a haiku/flash-class fallback
 
@@ -157,6 +158,7 @@ pi 0.99 can run model-written JavaScript in a QuickJS sandbox (`codemode`) that
 - **`ignoreTools` and MCP names**: tool names are normalized — every character outside `[A-Za-z0-9_]` becomes `_` (`mcp__dev-radius__x` → `mcp__dev_radius__x`); exemption entries must use the normalized form
 - **Cost amplification**: one script may issue up to 256 nested calls; gray-zone calls classify one by one, so a slow LLM classifier multiplies per-call latency
 - **Exposure boundary**: adding an MCP server auto-enables codemode, and `pi --no-extensions -e builtin:mcp` runs MCP tools with no extensions loaded — i.e. without this gate. The gate is itself an extension, so it cannot be active in a session that loads none; the boundary is inherent to pi's extension model, stated here rather than papered over
+- **Batch latency is configurable** ([ADR-0006](docs/adr/0006-codemode-nested-calls-policy.md)): every nested call adjudicates individually and gray-zone adjudication is serial (~350ms/call measured), so large script batches pay real latency. `"codemodeNestedCalls": "rules-only"` opts nested calls into the deterministic layers only (rules, floor, self-protection, denyPaths + ask) — the gray zone passes; the trade-off is that rule-passing actions the classifier would have caught (e.g. a nested `bash head ~/.ssh/config` without a denyPaths declaration) pass too. Audit records carry `toolCallId`/`parentToolCallId` either way
 
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -184,7 +186,7 @@ Honest framing: pi-automode and pi-verdict have **converged on the same architec
 
 ![pi-verdict security gate — tool-call adjudication pipeline](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.en.svg)
 
-*Diagram source & regeneration: [docs/diagrams/](docs/diagrams/README.md). Pipeline as of v0.12 — the ASCII version below is the text-faithful equivalent.*
+*Diagram source & regeneration: [docs/diagrams/](docs/diagrams/README.md). Pipeline as of v0.14 — the ASCII version below is the text-faithful equivalent.*
 
 ```
 tool_call
@@ -200,14 +202,21 @@ tool_call
   │     ├─ denyPaths (ADR-0002): protected paths → terminal ask,
   │     │   before user allow; classifier sees an existence hint only
   │     ├─ ignoreTools: your declared uncovered tools → allow, zero model calls
-  │     └─ no built-in allowlist — every "always allow" claim is yours to make
+  │     ├─ headless subagent-artifacts writes (ADR-0008): a no-UI session's
+  │     │   write/edit under <agentDir>/sessions/**/subagent-artifacts/ →
+  │     │   deterministic allow (interactive sessions keep the ask); your
+  │     │   deny rules and denyPaths still outrank it
+  │     └─ no built-in allowlist on your surfaces — every "always allow"
+  │       claim is yours to make (the one built-in allow is pi's own
+  │       subagent-artifacts subtree, headless-only, ADR-0008)
   │
-  ├─ 2. Gray zone → model classifier (defaults to session model — "self-reflection")
-  │     ├─ input: CC-style <transcript> — recent user intent + tool calls,
-  │     │        action under review always last
-  │     └─ output: native classify() answers (choice + probabilities + confidence;
-  │              tag-free reason, full contract line in the audit rawResponse) or,
-  │              on the chat path, <verdict>…</verdict> prefix-anchored free text
+  ├─ 2. Gray zone → nested-call policy, then model classifier
+  │     ├─ nested call (codemode) + codemodeNestedCalls=rules-only → pass;
+  │     │   deterministic layers above already ran (ADR-0006)
+  │     ├─ gate (default, or a direct call) → classifier: native classify()
+  │     │   (choice + probabilities + confidence; tag-free reason, full contract
+  │     │   line in the audit rawResponse) or, on the chat path (session-model
+  │     │   self-reflection), <verdict>…</verdict> prefix-anchored free text
   │
   └─ 3. Three-state adjudication
         ├─ allow → pass
@@ -232,7 +241,7 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 
 ## Status & limitations
 
-- no built-in allowlist by design (see the [bypass writeup](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
+- no built-in allowlist on user surfaces by design (see the [bypass writeup](research/rule-layer-security-audit.md); the one built-in allow is pi's own subagent-artifacts subtree, headless-only, [ADR-0008](docs/adr/0008-agentdir-sessions-write-exemption.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
 - the path sensitivity floor applies to file tools only: bash command strings are matched by the danger regexes alone, so e.g. `cat ~/.ssh/id_rsa` goes to the classifier rather than the deterministic S0 deny (the file-tool spelling `read ~/.ssh/id_rsa` does deny)
 - on Windows the built-in floor covers bash-shaped patterns only — PowerShell-native dangerous commands (`Remove-Item -Recurse -Force`, `Invoke-Expression`, `Set-ExecutionPolicy`, …) rely on the classifier (fail-closed)
 - on macOS the per-user temp tree (`$TMPDIR`, the `/var/folders/…/T` confstr dir) is exempt from the system-directory floor: reads allow at zero cost, writes adjudicate as ordinary outside-project writes (classifier). The exemption anchors to the runtime-resolved confstr family — a hand-set `TMPDIR` lifts nothing — and `/var/tmp` (POSIX shared temp) stays denied; symlink spellings whose real form escapes the temp tree still hit S1

package/README.zh-CN.md

@@ -110,6 +110,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
+  "auditRedactSecrets": true,
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
@@ -123,7 +124,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担；下方自保护层永远开启)
 - `classifierModel` 指定分类器模型，如 `"zai/glm-5.3-flash:low"`(支持思考后缀；缺省 = 会话模型且显式关思考)
 - `classifierModel: "typesafe/jev-latest"` 启用**原生 jev 分类器**——每次灰区裁决经 pi 内置分类器目录发一次结构化 `classify()` 调用(TypeSafe 直连,或 OpenRouter/OpenCode/Cloudflare/Vercel 上的 Jev);详见 [ADR-0005](docs/adr/0005-native-classifier-migration.md)
-- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件，保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth，确认结束后落盘)，protected-path ask 也入审计(#62)；规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机；[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注)；agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
+- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件，保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth，确认结束后落盘)，protected-path ask 也入审计(#62)；规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机；[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注)；凭证明文在落盘前脱敏(`<redacted:类型#指纹>`，指纹具确定性、跨记录可追踪——`auditRedactSecrets: false` 可显式关闭；[ADR-0007](docs/adr/0007-audit-secret-redaction.md))；agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
 - `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解)；默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知；两开关同开时通知只出现一次
 - `classifierMinConfidence`(可选，[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**：低于它的原生分类器裁决被降级——配置了 `classifierFallbackModel` 则级联(`enforce`，默认 = 第二层全权裁决；例外：降级的 **deny 与 ask** 永不被自动放宽为 allow；fail-closed 未产生裁决，其获救裁决照常生效；`shadow` = 只记录意见、由你裁决——`/automode` 会提示激活开关)，否则直接问你。不低于地板时第一层自主。地板仅作用于原生分类器模型(协议原生置信度)——chat/LLM 分类器下不生效，会有一次中性警告提示。天然搭配：jev 在前 + haiku/flash 级回退
 
@@ -157,6 +158,7 @@ pi 0.99 可以在 QuickJS 沙箱(`codemode`)里运行模型写的 JavaScript 去
 - **`ignoreTools` 与 MCP 工具名**:工具名会归一化——`[A-Za-z0-9_]` 之外的字符统一变 `_`(`mcp__dev-radius__x` → `mcp__dev_radius__x`);豁免条目必须写归一化后的形态
 - **成本放大**:单个脚本最多可发 256 次嵌套调用,灰区调用逐个分类,慢的 LLM 分类器会把单次延迟成倍放大
 - **暴露边界**:添加 MCP 服务器会自动开启 codemode,而 `pi --no-extensions -e builtin:mcp` 可在不加载任何扩展(即无本门禁)的情况下启用 MCP 工具。门禁自身即扩展,在完全不加载扩展的会话中无法生效;此边界为 pi 扩展模型的固有属性,此处显式陈述而非掩饰
+- **批量延迟可配置**([ADR-0006](docs/adr/0006-codemode-nested-calls-policy.md)):每个嵌套调用独立裁决且灰区裁决为串行(实测 ~350ms/次),大脚本批次的判定开销可观。`"codemodeNestedCalls": "rules-only"` 让嵌套调用只走确定性层(规则、floor、自保护、denyPaths + ask)——灰区直接放行;代价是规则层放行、但分类器会拦的动作(如未声明 denyPaths 时的嵌套 `bash head ~/.ssh/config`)同样放行。两种模式下审计记录均携带 `toolCallId`/`parentToolCallId` 归因
 
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -184,7 +186,7 @@ pi 0.99 可以在 QuickJS 沙箱(`codemode`)里运行模型写的 JavaScript 去
 
 ![pi-verdict 安全门禁——工具调用判定管线](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.zh.svg)
 
-*图源与再生成：[docs/diagrams/](docs/diagrams/README.md)。管线基准：v0.12——下方 ASCII 为文本等价版。*
+*图源与再生成：[docs/diagrams/](docs/diagrams/README.md)。管线基准：v0.14——下方 ASCII 为文本等价版。*
 
 ```
 tool_call
@@ -200,12 +202,21 @@ tool_call
   │     ├─ denyPaths(ADR-0002):受保护路径 → 终局 ask,先于用户 allow;
   │     │   分类器只见存在性话术
   │     ├─ ignoreTools:用户声明的未覆盖工具 → 直接放行,零模型调用
-  │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
+  │     ├─ headless subagent-artifacts 写入(ADR-0008):无 UI 会话对
+  │     │   <agentDir>/sessions/**/subagent-artifacts/ 的 write/edit →
+  │     │   确定性放行(交互会话仍可 ask);用户 deny 规则与 denyPaths
+  │     │   声明仍然优先
+  │     └─ 你的操作面上无内置白名单 —— 「永远放行」的声明由你自己做
+  │       (唯一的内置放行是 pi 自身的 subagent-artifacts 子树,仅限
+  │       headless,ADR-0008)
   │
-  ├─ 2. 灰区 → 模型分类器(默认继承会话模型 —— "自省")
-  │     ├─ 输入:CC 风格 <transcript> —— 近期用户意图 + 工具调用,
-  │     │        待审动作固定在末尾
-  │     └─ 输出契约:<verdict>allow|ask|deny</verdict> 前缀锚定
+  ├─ 2. 灰区 → 嵌套策略,再进模型分类器
+  │     ├─ 嵌套调用(codemode)+ codemodeNestedCalls=rules-only → 放行;
+  │     │   上方确定性层已全部跑完(ADR-0006)
+  │     ├─ gate(默认,或直发调用)→ 分类器:原生 classify()
+  │     │   (choice + probabilities + confidence;reason 无标签,完整契约行
+  │     │   存审计 rawResponse)或 chat 路径(会话模型自省)的
+  │     │   <verdict>…</verdict> 前缀锚定自由文本
   │
   └─ 3. 三态裁决
         ├─ allow → 放行
@@ -230,7 +241,7 @@ tool_call
 
 ## 状态与限制
 
-- 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
+- 设计上在你的操作面无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson)；唯一内置放行是 pi 自身的 subagent-artifacts 子树、仅限 headless,[ADR-0008](docs/adr/0008-agentdir-sessions-write-exemption.md))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
 - 路径敏感度 floor 只作用于文件类工具：bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
 - Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
 - macOS 下 per-user 临时目录(`$TMPDIR`,`/var/folders/…/T` confstr 目录)豁免于系统目录 floor:读零成本放行,写按普通项目外写交分类器裁决。豁免锚定运行时解析的 confstr 族——手工设置 `TMPDIR` 不会解除任何保护;`/var/tmp`(POSIX 共享临时目录)维持拦截;真实形态逃逸临时树的符号链接拼写仍命中 S1

package/extensions/pi-verdict.ts

@@ -81,6 +81,7 @@
  *               research/pi-model-call-and-ref-implementations.md
  */
 
+import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -276,9 +277,20 @@ interface UserRules {
 	/** #67: does the second layer adjudicate cascaded calls ("enforce", default since
 	 *  0.12.0) or only record its opinion while the human decides ("shadow")? */
 	classifierFallbackMode: "shadow" | "enforce";
+	/** #90/ADR-0006: nested-call policy. "gate" (default) = nested calls adjudicate
+	 *  identically to direct calls; "rules-only" = nested calls keep every
+	 *  deterministic layer (self-protection, floor, user rules, denyPaths + its ask)
+	 *  and skip only the classifier + cascade — the gray zone passes, because serial
+	 *  adjudication of codemode batches amplifies per-call latency (live-fire:
+	 *  ~350ms/call). Opt-in: rule-passing actions the classifier would have caught
+	 *  pass under rules-only (coverage is denyPaths-declaration-dependent). */
+	codemodeNestedCalls: "gate" | "rules-only";
+	/** ADR-0007: redact secret-shaped text from audit records before append.
+	 *  Default true; false is the explicit keep-raw escape hatch. */
+	auditRedactSecrets: boolean;
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce" };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce", codemodeNestedCalls: "gate", auditRedactSecrets: true };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -347,6 +359,7 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 	classifierModel: null,
 	toggleShortcut: DEFAULT_TOGGLE_SHORTCUT,
 	audit: false,
+	auditRedactSecrets: true,
 	notifyAllows: false,
 	classifierMinConfidence: null,
 	classifierFallbackModel: null,
@@ -371,7 +384,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown; codemodeNestedCalls?: unknown; auditRedactSecrets?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -416,6 +429,11 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 		if (minConfRaw !== undefined && minConfRaw !== null && !minConfOk) skipped.push(`classifierMinConfidence: ${JSON.stringify(minConfRaw)}`);
 		const fbModeRaw = raw.classifierFallbackMode;
 		if (fbModeRaw !== undefined && fbModeRaw !== "shadow" && fbModeRaw !== "enforce") skipped.push(`classifierFallbackMode: ${JSON.stringify(fbModeRaw)}`);
+		// #90: nested-call policy — invalid values skip into the one-shot warning channel
+		const nestedRaw = raw.codemodeNestedCalls;
+		if (nestedRaw !== undefined && nestedRaw !== "gate" && nestedRaw !== "rules-only") skipped.push(`codemodeNestedCalls: ${JSON.stringify(nestedRaw)}`);
+		// ADR-0007: audit redaction — non-boolean values skip into the one-shot warning channel, redaction stays on
+		if (raw.auditRedactSecrets !== undefined && typeof raw.auditRedactSecrets !== "boolean") skipped.push(`auditRedactSecrets: ${JSON.stringify(raw.auditRedactSecrets)}`);
 		return {
 			rules: {
 				allow: compile(raw.allow),
@@ -430,6 +448,8 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				classifierFallbackModel: typeof raw.classifierFallbackModel === "string" && raw.classifierFallbackModel.trim() ? raw.classifierFallbackModel.trim() : null,
 				classifierMinConfidence: minConfOk ? minConfRaw : null,
 				classifierFallbackMode: fbModeRaw === undefined ? "enforce" : fbModeRaw === "enforce" ? "enforce" : "shadow", // invalid values land on the conservative shadow (standing invalid-config precedent); the key-less default is enforce
+				codemodeNestedCalls: nestedRaw === "rules-only" ? "rules-only" : "gate", // invalid values keep the safe default (gate)
+				auditRedactSecrets: raw.auditRedactSecrets !== false, // default on; only an explicit false disables (ADR-0007)
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -808,6 +828,8 @@ interface ProtectedSet {
 	prefixes: string[];
 	/** 读拒绝前缀(#54):verdicts 审计目录——记录含不可信原始输出,禁回流 agent context */
 	readPrefixes: string[];
+	/** Subagent-artifacts write-exemption tree (ADR-0008): <agentDir>/sessions — headless write/edit to its subagent-artifacts subtree passes deterministically */
+	runtimeWritePrefixes: string[];
 	/** bash/powershell 命令串危险特征(子串匹配,可绕——变更检测兜底) */
 	bashPatterns: RegExp[];
 	/** 变更检测基线(词法路径 + 类别;session_start 时快照全文) */
@@ -965,7 +987,15 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 	}
 	bashPatterns.push(new RegExp(`(?:${[...vAlts].join("|")})`));
 
-	return { exact: [...exact], prefixes: [...prefixes], readPrefixes: verdictsForms, bashPatterns, watchBases };
+	// ADR-0008: <agentDir>/sessions is pi's own runtime output tree (subagent
+	// artifacts live there); write/edit grade as deterministic allow. The prefix
+	// uses the ancestor-rebuild tier (rebuiltForms), matching the target-side
+	// forms: sessions/ may not exist yet on a fresh install, and an allow-grade
+	// exemption must not hinge on directory existence (baseForms alone would
+	// miss the firmlink real form and silently void the exemption).
+	const runtimeWritePrefixes = rebuiltForms(path.join(agentDir, "sessions"));
+
+	return { exact: [...exact], prefixes: [...prefixes], readPrefixes: verdictsForms, runtimeWritePrefixes, bashPatterns, watchBases };
 }
 
 /** Does the resolved write path hit the protected set (realpath guards against
@@ -996,6 +1026,20 @@ export function isProtectedReadPath(rawPath: string | undefined, cwd: string, pr
 	return false;
 }
 
+/** ADR-0008: subagent-artifacts write exemption — EVERY canonical form must sit
+ *  under <agentDir>/sessions AND carry a subagent-artifacts directory segment
+ *  (intersection semantics, same discipline as the in-cwd allowance): a lexical
+ *  hit whose real form escapes (symlink alias) earns no exemption and falls back
+ *  to the classifier. Gated to headless sessions at the call site — an
+ *  interactive session keeps its ask capability. */
+const SUBAGENT_ARTIFACTS_SEG = /(^|\/)subagent-artifacts(\/|$)/;
+export function isSubagentArtifactWrite(rawPath: string, cwd: string, prot: ProtectedSet): boolean {
+	if (prot.runtimeWritePrefixes.length === 0 || !rawPath) return false;
+	const forms = rebuiltForms(path.resolve(cwd, expandHome(rawPath)));
+	const inTree = (f: string) => prot.runtimeWritePrefixes.some((p) => f === p || f.startsWith(p + path.sep));
+	return forms.every((f) => inTree(f) && SUBAGENT_ARTIFACTS_SEG.test(f));
+}
+
 /** 自保护层裁决(第 0 层,先于一切):触碰门禁自身文件 → 不可豁免的 deny;其余 null 交后续层 */
 function selfProtectCheck(toolName: string, input: Record<string, unknown>, cwd: string, prot: ProtectedSet): RuleResult | null {
 	switch (toolName) {
@@ -1741,14 +1785,23 @@ export interface AuditRecord {
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
 	/** #62: protected-path asks are recorded too — their user answers grade the
-	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. */
-	source: "model" | "fail-closed" | "protected-path";
+	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. "rule" exists for
+	 *  one audited rule-layer outcome: the rules-only nested passthrough (#90). */
+	source: "model" | "fail-closed" | "protected-path" | "rule";
 	degraded: boolean;
 	/** #62 ground truth: the user's answer to an interactive ask confirm. Present only
 	 *  on records whose confirm actually ran; headless/degraded asks omit it. */
 	userAnswer?: "allowed" | "declined";
 	/** #62: ISO timestamp of the confirm resolution; `ts` stays adjudication time. */
 	answeredAt?: string;
+	/** #90: the call's id — `<parent id>/<n>` for nested calls (codemode scripts).
+ *  Direct-call records carry it too; pre-0.14 corpora simply lack the field. */
+	toolCallId?: string;
+	/** #90: set iff another tool (a codemode script) issued this call — the audit
+	 *  attribution that makes nested calls distinguishable from direct ones. */
+	parentToolCallId?: string;
+	/** #90: the nested-call policy in effect for a rules-only passthrough record. */
+	policy?: "rules-only";
 	/** #62: protected-path records only — the matched path. */
 	detail?: string;
 	/** #67: the confidence floor fired — the first-layer verdict was demoted. */
@@ -1757,20 +1810,110 @@ export interface AuditRecord {
 	fallback?: FallbackAudit;
 }
 
+// ============================================================================
+// Audit secret redaction (ADR-0007)
+// ============================================================================
+
+/** sha256 fingerprint (first 8 hex), unsalted: deterministic — the same secret
+ *  keeps one fingerprint across records, preserving clustering and diffability.
+ *  The threat model anchors on high-entropy API keys, for which the rainbow
+ *  tables that salting guards against are infeasible (ADR-0007). */
+function redactionFingerprint(secret: string): string {
+	return crypto.createHash("sha256").update(secret).digest("hex").slice(0, 8);
+}
+
+/** Context-guided value redaction — shapeless secrets identified by neighboring
+ *  structure (assignment/header/URL position). Every value character class
+ *  excludes `<` (every replacement starts with `<`, so layering is idempotent);
+ *  `#` is excluded only where a bare fragment could look like a value (bearer,
+ *  query). The URL value class also excludes `/` (RFC 3986 userinfo forbids it —
+ *  and it keeps `host:8080/path@…` port shapes out of the password slot). */
+const REDACT_CONTEXT_RULES: ReadonlyArray<{ re: RegExp; build: (...m: string[]) => string }> = [
+	{ re: /(https?:\/\/[^/\s:@]+:)([^@/\s<]{8,})(?=@)/g, build: (...m) => `${m[1]}<redacted:url#${redactionFingerprint(m[2])}>` },
+	{ re: /(-u\s+"?)([^:\s"<]+):([^"\s<]{8,})(")/g, build: (...m) => `${m[1]}${m[2]}:<redacted:basic#${redactionFingerprint(m[3])}>${m[4]}` },
+	{ re: /(-u\s+)([^:\s"<]+):([^"\s<]{8,})/g, build: (...m) => `${m[1]}${m[2]}:<redacted:basic#${redactionFingerprint(m[3])}>` },
+	// query runs before env: a `?token=…` param belongs to the query tag; the env
+	// bare-name branch (TOKEN/APIKEY/SECRET) then only sees non-query positions
+	{ re: /([?&](?:token|apikey|api_key|access_token|client_secret|signature|sig)=)([^&\s"'#<>]{8,})/gi, build: (...m) => `${m[1]}<redacted:query#${redactionFingerprint(m[2])}>` },
+	{ re: /\b([A-Za-z_][A-Za-z0-9_]*(?:_KEY|_TOKEN|_SECRET|_PASSWORD|_CREDENTIALS?)|APIKEY|TOKEN|SECRET)(=)("[^"<]{8,}"|[^\s"<&;]{8,})/gi, build: (...m) => `${m[1]}${m[2]}<redacted:env#${redactionFingerprint(m[3].replace(/^"|"$/g, ""))}>` },
+	{ re: /(\bbearer\s+)([A-Za-z0-9._~+/=-]{8,})/gi, build: (...m) => `${m[1]}<redacted:bearer#${redactionFingerprint(m[2])}>` },
+];
+
+/** Exact provider token shapes (near-zero false positives). Order matters both
+ *  here (specific prefix before general: sk-ant before sk) and against the
+ *  context layer: shapes run SECOND, so a provider-shaped *username* (e.g.
+ *  `-u "sk-…:shapelesspass"`) still has its raw form visible when the context
+ *  rules match — running shapes first would rewrite the username into a marker
+ *  and the `<` exclusion would defeat the `-u` rule, dropping the shapeless
+ *  password raw. All patterns are character classes + bounded/greedy
+ *  quantifiers — no nested quantifiers, no backtrack blowup. */
+const REDACT_TOKEN_SHAPES: ReadonlyArray<{ type: string; re: RegExp }> = [
+	{ type: "jwt", re: /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
+	{ type: "github_pat", re: /github_pat_[A-Za-z0-9_]{22,}/g },
+	{ type: "gh", re: /gh[posur]_[A-Za-z0-9]{30,}/g },
+	{ type: "sk-ant", re: /sk-ant-[A-Za-z0-9_-]{20,}/g },
+	{ type: "sk", re: /sk-[A-Za-z0-9][A-Za-z0-9_-]{15,}/g },
+	{ type: "pk", re: /pk-[A-Za-z0-9][A-Za-z0-9_-]{15,}/g },
+	{ type: "aws", re: /AKIA[0-9A-Z]{16}/g },
+	{ type: "slack", re: /xox[abprs]-[A-Za-z0-9-]{10,}/g },
+	{ type: "google", re: /AIza[0-9A-Za-z_-]{30,}/g },
+];
+
+function redactString(s: string): string {
+	let out = s;
+	for (const { re, build } of REDACT_CONTEXT_RULES) {
+		out = out.replace(re, build);
+	}
+	for (const { type, re } of REDACT_TOKEN_SHAPES) {
+		out = out.replace(re, (m) => `<redacted:${type}#${redactionFingerprint(m)}>`);
+	}
+	return out;
+}
+
+/** Audit redaction: recursively processes every string value of the record
+ *  (input/actionLine/transcript/reason/fallback…), returning a fresh tree and
+ *  never mutating the caller's object (pendingAudit is spread later for the
+ *  userAnswer finalize). Exotic objects (Date, …) pass through untouched —
+ *  JSON.stringify keeps authority over their serialization. Applies to the
+ *  persisted copy only — the adjudication pipeline and the classifier input
+ *  keep the raw text: the fact that a command carries a secret is itself an
+ *  adjudication signal (ADR-0007). */
+export function redactSecrets<T>(value: T): T {
+	if (typeof value === "string") return redactString(value) as T;
+	if (Array.isArray(value)) return value.map((v) => redactSecrets(v)) as T;
+	if (value !== null && typeof value === "object") {
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) return value;
+		const out: Record<string, unknown> = {};
+		for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = redactSecrets(v);
+		return out as T;
+	}
+	return value;
+}
+
 /** Audit sink (#54): append-only and fail-soft (the first write failure surfaces
  *  once via drainWarning; verdicts are never affected). The dir is created
  *  lazily — audit on with no gray-zone call all session leaves zero filesystem trace. */
 export class AuditLog {
 	private warning: string | null = null;
 	private warned = false;
-	constructor(readonly dir: string) {}
+	constructor(readonly dir: string, readonly redact = true) {}
 
 	append(record: AuditRecord): void {
 		// sessionId comes from the host with no shape guarantee: narrow to a safe filename charset
 		const file = path.join(this.dir, `${record.sessionId.replace(/[^a-zA-Z0-9_-]/g, "_")}.jsonl`);
 		try {
 			fs.mkdirSync(this.dir, { recursive: true });
-			fs.appendFileSync(file, JSON.stringify(record) + "\n");
+			// ADR-0007: redact the persisted copy only (new tree — the caller's
+			// pendingAudit object is spread later for the userAnswer finalize);
+			// a redaction failure fails open: record integrity over hygiene
+			let persisted: AuditRecord = record;
+			if (this.redact) {
+				try {
+					persisted = redactSecrets(record);
+				} catch { /* fail-open */ }
+			}
+			fs.appendFileSync(file, JSON.stringify(persisted) + "\n");
 		} catch (err) {
 			if (!this.warned) {
 				this.warned = true;
@@ -1838,7 +1981,7 @@ export class SessionState {
 
 	/** #54: the audit flag follows the rules (applies to new sessions); the dir is anchored to the install path */
 	private makeAudit(rules: UserRules): AuditLog | null {
-		return rules.audit && this.agentDir ? new AuditLog(path.join(this.agentDir, "verdicts")) : null;
+		return rules.audit && this.agentDir ? new AuditLog(path.join(this.agentDir, "verdicts"), rules.auditRedactSecrets) : null;
 	}
 
 	/** 会话重置:重载用户规则(配置改动新会话生效)+ 按会话 cwd 重锚 denyPaths
@@ -1991,12 +2134,20 @@ async function runConfidenceCascade(
  */
 export async function adjudicate(
 	state: SessionState,
-	call: { toolName: string; input: Record<string, unknown> },
+	call: { toolName: string; input: Record<string, unknown>; toolCallId?: string; parentToolCallId?: string },
 	env: AdjudicateEnv,
 ): Promise<Verdict> {
 	const rule = classifyByRules(call.toolName, call.input, env.cwd, state.userRules, state.prot, state.anchoredDenyPathBases(env.cwd));
 	if (rule.verdict === "allow") return { verdict: "allow", reason: rule.reason ?? "", source: "rule", degraded: false };
 	if (rule.verdict === "deny") return { verdict: "deny", reason: rule.reason ?? "", source: "rule", degraded: false };
+	// ADR-0008: subagent artifacts — a headless (no-UI) session writing pi's own
+	// runtime artifact tree passes deterministically; user deny and denyPaths have
+	// already ruled above (declarations beat the built-in exemption), and only the
+	// gray grade is lifted. An interactive session keeps its ask capability, so the
+	// exemption stays headless-only. Read and bash are deliberately NOT exempt.
+	if (rule.verdict === "gray" && !env.hasUI && (call.toolName === "write" || call.toolName === "edit") && isSubagentArtifactWrite(String(call.input.path ?? ""), env.cwd, state.prot)) {
+		return { verdict: "allow", reason: "subagent artifacts (headless) — deterministic write exemption (ADR-0008)", source: "rule", degraded: false };
+	}
 
 	// #62: the audit surface widens to protected-path asks (their user answers grade the
 	// denyPaths rules); rule allow/deny stay unaudited (no corpus value, #54). Record
@@ -2016,6 +2167,10 @@ export async function adjudicate(
 		thinking: raw?.thinking ?? null,
 		transcript: raw?.transcript ?? null,
 		rawResponse: raw?.rawResponse ?? null,
+		// #90 audit attribution: ids ride on every record; nested records additionally
+		// carry the parent linkage, making them distinguishable from direct calls
+		...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}),
+		...(call.parentToolCallId !== undefined ? { parentToolCallId: call.parentToolCallId } : {}),
 		...v,
 	});
 
@@ -2030,6 +2185,17 @@ export async function adjudicate(
 		return { verdict: "deny", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: true };
 	}
 
+	// ADR-0006 (#90): the layered-exemption policy. Nested calls under rules-only have
+	// already passed every deterministic layer above (self-protection, floor, user
+	// rules, denyPaths + its ask) — only the intelligence layer is skipped: the gray
+	// zone passes. Audited when audit is on (source rule + policy marker): the user
+	// needs corpus data on what the opt-in actually let through.
+	if (call.parentToolCallId !== undefined && state.userRules.codemodeNestedCalls === "rules-only") {
+		const reason = "codemodeNestedCalls rules-only: gray-zone passthrough (nested call — deterministic layers only)";
+		state.audit?.append({ ...buildRecord({ verdict: "allow", reason, source: "rule", degraded: false }, null), policy: "rules-only" });
+		return { verdict: "allow", reason, source: "rule", degraded: false };
+	}
+
 	// 灰区 → 分类器;无可用模型 → fail-closed
 
 	const resolved = env.getModel();
@@ -2219,6 +2385,8 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	const toggleHint = () => (registeredToggleKey ? ` · toggle: ${registeredToggleKey}` : "");
 	/** Status line denyPaths count (ADR-0002): shown only when configured */
 	const denyPathsHint = () => (state.userRules.denyPaths.length > 0 ? `\ndenyPaths: ${state.userRules.denyPaths.length} active` : "");
+	/** #90: nested-call policy hint — shown only when the exemption is active */
+	const nestedPolicyHint = () => (state.userRules.codemodeNestedCalls === "rules-only" ? "\nnested calls: rules-only (deterministic layers only — the gray zone passes)" : "");
 	/** Status line audit hint (#54): shown only while the sink is active */
 	const auditHint = () => (state.audit ? `\naudit: on → ${state.audit.dir}` : "");
 	/** Status line cascade hint (#63/#67): shown while the floor or the fallback is configured */
@@ -2236,7 +2404,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			const arg = args.trim().toLowerCase();
 			// 裸调用:只读状态展示,无副作用
 			if (arg === "") {
-				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${denyPathsHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
+				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${denyPathsHint()}${nestedPolicyHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
 			return;
 			}
 			// 幂等设定:与现值相同不翻转,仅确认
@@ -2451,7 +2619,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		}
 
 		// 判定管线(零 UI)→ 呈现(source 模板)
-		const verdict = await adjudicate(state, { toolName: event.toolName, input }, {
+		const verdict = await adjudicate(state, { toolName: event.toolName, input, toolCallId: event.toolCallId, parentToolCallId: event.parentToolCallId }, {
 			cwd: ctx.cwd,
 			hasUI: !!ctx.hasUI,
 			getModel: () => resolveClassifier(ctx),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.13.1",
+	"version": "0.15.0",
 	"description": "A minimal permission gate for Pi, inspired by Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",
@@ -55,7 +55,7 @@
 		}
 	},
 	"devDependencies": {
-		"@earendil-works/pi-coding-agent": "0.99.2",
+		"@earendil-works/pi-coding-agent": "1.0.0",
 		"@types/node": "^26.3.0",
 		"typescript": "^7.0.2"
 	}