pi-verdict 0.5.0 → 0.5.2

package/README.md

@@ -12,6 +12,7 @@
 - Built-in danger rules and your own allow/deny rules settle the clear cases first, at zero latency
 - Everything else goes to a model classifier that sees the conversation context
 - Any uncertainty or failure fails closed; nothing ever runs silently
+- Self-protection: the gate guards itself against snooping and tampering
 
 ## The problem
 
@@ -23,10 +24,15 @@ pi-verdict adds the missing gate: a model decides whether each call should run,
 
 **verdict is an adjudication, not a switch.** Most classifiers in this space output a binary allow/block. Three states matter: `ask` routes genuinely ambiguous actions to a human (and degrades to `deny` in non-interactive sessions), so "not sure" never silently becomes "go ahead".
 
+## Screenshots
+
+![Automode Status](docs/images/status.png)
+![Ask Permission](docs/images/asked.png)
+
 ## Quick start
 
 ```bash
-# install from npm (listed in the package catalog: https://pi.dev/packages/pi-verdict)
+# install from npm:
 pi install npm:pi-verdict
 
 # or directly from git — try it once
@@ -62,15 +68,15 @@ pi --extension ./extensions/auto-mode.ts
 ```
 
 - `allow`/`deny` are JS regex arrays; **`deny` wins over `allow`**, both beat the classifier
-- matched against the **full command string** for bash, the **absolute path** for file tools (read/write/edit/grep/find/ls); other tools (MCP etc.) always go to the classifier
-- `denyPaths` are plain paths (not regexes) you declare **protected** ([ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md)): any tool call touching them — file tools via their path, bash via path tokens extracted from the command string — triggers a **terminal ask** you adjudicate (non-interactive sessions degrade to deny). The tool owns normalization: `~`, `$HOME/`, relative, `..` and symlink spellings all resolve, compared per path segment. Priority: after your `deny` rules, **before your `allow` rules** (not even your own allowlist may touch these), and not affected by `builtinDenyFloor: false` — it is your declaration, not a built-in claim. The classifier only ever learns that protected paths *exist* (a fixed system-prompt hint to judge copy-then-read/archiving/indirection strictly); the paths themselves never leave your machine, and a hit never reaches the classifier at all — the matched path shows **only** in the local confirm dialog; block reasons and notifications carry none (they return into the agent context). Entries are normalized once at session start, anchored to the session cwd — mid-session symlink creation or cwd drift does not change what the declaration covers. When S0 secrets paths deny outright while your `denyPaths` merely ask, that asymmetry is deliberate: the exception to a *user-declared* path belongs to the user; S0 is an author-vetted set (see the ADR)
+- `denyPaths` are plain paths (not regexes) you declare **protected**: any tool call touching them — file tools via their path, bash via path tokens extracted from the command string — triggers a **terminal ask** you adjudicate (non-interactive sessions degrade to deny). Not affected by `builtinDenyFloor: false`.
+  The classifier only ever learns that protected paths *exist*; the paths themselves never leave your machine, and a matched path shows **only** in the local confirm dialog.
 - `builtinDenyFloor: false` turns the built-in danger/path floor off entirely (risk accepted by you; the classifier and your rules remain — the self-protection layer below always stays on)
 - `classifierModel: "provider/model-id"` sets the classifier model (e.g. a fast flash-class model); precedence is flag > env > config > session model (self-reflection); an invalid value falls back to the session model with a one-time warning
-- the spec accepts pi's native `--model` thinking suffix: `"zai/glm-5.3-flash:low"` sets classifier thinking to effort low (default without suffix: thinking explicitly off — the [measured](research/thinking-param-blackhole.md) default)
-- `toggleShortcut` rebinds the master-switch toggle key (any pi key combo, e.g. `ctrl+shift+x`; `null` or empty disables the shortcut; an invalid combo warns once at session start and skips registration). The toggle is semantically identical to `/automode on|off` — works mid-run, no confirmation, never persisted (persistence stays with the `--no-auto-mode` flag; the extension never writes its own protected config)
-- first run generates a template at `~/.pi/agent/config/pi-verdict.json` (honors `PI_CODING_AGENT_DIR`); changes apply to new sessions
+- the spec accepts pi's native `--model` thinking suffix: `"zai/glm-5.3-flash:low"` sets classifier thinking to effort low (default without suffix: thinking explicitly off)
+- `toggleShortcut` rebinds the master-switch toggle key (`null` or empty disables it, not persisted)
+- first run generates a template at `~/.pi/agent/config/pi-verdict.json` (honors `PI_CODING_AGENT_DIR`)
 
-**Why no built-in allowlist?** Bypass testing of the rule layer ([writeup](research/rule-layer-security-audit.md)) showed that allowlist soundness requires shell AST analysis — every built-in "always allow" would be a security claim maintained by the author. The built-in layer only makes **deny** claims (the sound direction); allow claims are yours.
+**Why no built-in allowlist?** Bypass testing of the rule layer ([writeup](research/rule-layer-security-audit.md)) showed that allowlist robustness is very limited. The built-in layer only makes **deny** claims (the sound direction); allow claims are yours.
 
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -115,11 +121,13 @@ tool_call
   │         config changed + interactive → one keep/restore confirm
   │
   ├─ 1. Rule layer (deterministic, zero latency)
-  │     ├─ built-in deny floor: bash danger regexes (full-string) +
-  │     │   path sensitivity S0–S5 (secrets/system/.git meta → deny)
+  │     ├─ built-in deny floor: bash danger regexes (full-string, capped at 8192 chars) +
+  │     │   path sensitivity S0–S5 (secrets/system/.git meta → deny;
+  │     │   dual-form matching — lexical + realpath, symlink aliases resolve)
   │     ├─ your rules: user deny beats user allow (regex, see below)
   │     ├─ denyPaths (ADR-0002): user-declared protected paths, tool-owned
-  │     │   normalization (~, $HOME, relative, .., symlink) → terminal ask,
+  │     │   normalization (~, $HOME, relative, .., symlink, case on
+  │     │   macOS/Windows) → terminal ask,
   │     │   before user allow; classifier sees an existence hint only
   │     └─ no built-in allowlist — every "always allow" claim is yours to make
   │
@@ -142,7 +150,7 @@ tool_call
         replays a double-key LRU(128) to measure would-be hit rate
 ```
 
-**fail-closed**: classifier exception / timeout (15s) / contract violation → deny. Never silently allow.
+**fail-closed**: classifier exception / timeout (25s) / contract violation → deny. Never silently allow.
 
 ## Evidence-driven, not vibes-driven
 
@@ -158,9 +166,9 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 
 ## Status & limitations
 
-Prototype quality — usable, not hardened:
-
 - no built-in allowlist by design (see the [bypass writeup](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
+- the path sensitivity floor applies to file tools only: bash command strings are matched by the danger regexes alone, so e.g. `cat ~/.ssh/id_rsa` goes to the classifier rather than the deterministic S0 deny (the file-tool spelling `read ~/.ssh/id_rsa` does deny)
+- on Windows the built-in floor covers bash-shaped patterns only — PowerShell-native dangerous commands (`Remove-Item -Recurse -Force`, `Invoke-Expression`, `Set-ExecutionPolicy`, …) rely on the classifier (fail-closed)
 - AGENTS.md is not passed to the classifier as downweighted intent evidence (Claude Code does this)
 - parallel gray-zone calls are adjudicated serially
 - self-reflection means the session model adjudicates — point `--auto-mode-model` at a lighter model if verdict latency/cost matters (open question tracked in the issue tracker)
@@ -179,7 +187,7 @@ The name: the three-state **verdict** is the core concept. The UX keeps `/automo
 ```bash
 bun install
 bun run typecheck
-bun test          # 91 offline stub tests: self-protection, tamper detection, deny floor, user rules, denyPaths, bypass regression, classifier retry, shadow cache, commands, toggle shortcut
+bun test          # offline stub tests: self-protection, tamper detection, deny floor, user rules, denyPaths, bypass regression, classifier retry, shadow cache, commands, toggle shortcut
 ```
 
 Issue tracker and decision records live in the GitHub issues ("map" issue #1 indexes them).

package/README.zh-CN.md

@@ -6,12 +6,13 @@
 [![npm](https://img.shields.io/npm/v/pi-verdict)](https://www.npmjs.com/package/pi-verdict)
 [![pi extension](https://img.shields.io/badge/pi-extension-blueviolet)](https://pi.dev)
 
-**pi-verdict 是 [pi](https://pi.dev) 的 Claude Code 的 Auto mode 式的极简权限门禁:每次工具调用执行前先过检查——放行、拦截,或先问你。**
+**pi-verdict 是 [pi](https://pi.dev) 的 Claude Code 风格的 Auto mode 式的极简权限门禁:每次工具调用执行前先过检查——放行、拦截,或先问你。**
 
 - 只有几百行的极简代码
 - 内置危险规则与你的 allow/deny 规则以零延迟先行裁决明确情形
 - 其余交给携带会话上下文的模型分类器
 - 任何不确定或失败一律 fail-closed, 绝不静默放行
+- 自我保护: 防止被窥探和篡改
 
 ## 问题
 
@@ -23,10 +24,15 @@ pi-verdict 补上这道缺失的门禁, 由模型基于上下文和你的意图
 
 **verdict 是裁决,不是开关。** 本品类的分类器大多只输出二值 allow/block。三态有意义的地方在:`ask` 把真正含糊的动作转交人类确认(非交互会话中降级为 `deny`),「不确定」永远不会静默变成「放行」。
 
+## 截图
+
+![Automode Status](docs/images/status.png)
+![Ask Permission](docs/images/asked.png)
+
 ## 快速开始
 
 ```bash
-# 从 npm 安装(已收录 pi 官方包目录: https://pi.dev/packages/pi-verdict)
+# 从 npm 安装:
 pi install npm:pi-verdict
 
 # 或直接从源码 —— 试用一次
@@ -62,15 +68,15 @@ pi --extension ./extensions/auto-mode.ts
 ```
 
 - `allow`/`deny` 为 JS 正则数组;**`deny` 优先于 `allow`**,两者都优先于分类器
-- 匹配目标:bash = **完整命令串**;文件类工具(read/write/edit/grep/find/ls)= **绝对路径**;其余工具(MCP 等)恒走分类器
-- `denyPaths` 是你声明**受保护**的普通路径列表(非正则,[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md)):任何触碰它们的工具调用——文件类工具取其路径、bash 从命令串提取路径 token——触发**终局 ask**,由你裁决(非交互会话降级 deny)。归一化由工具负责:`~`、`$HOME/`、相对、`..`、symlink 拼写全部消解,按路径段前缀比对。优先级:在你的 `deny` 规则之后、**`allow` 规则之前**(连你自己的白名单也不得触碰),且不受 `builtinDenyFloor: false` 影响——这是你的声明而非内置声明。分类器只被告知受保护路径**存在**(固定 system prompt 话术,对先拷贝再读取/打包/间接引用从紧裁决);路径明文永不出本机,命中调用根本到不了分类器——命中的路径**只**出现在本地确认弹窗;阻断理由与通知不含明文(它们回流进 agent 上下文)。条目在会话启动时一次性归一化,锚定会话 cwd——会话中途新建 symlink 或 cwd 漂移不改变声明覆盖范围。S0 机密路径直接 deny 而你的 `denyPaths` 仅 ask 的不对称是刻意的:用户声明的例外归用户,S0 是作者审定集(见 ADR)
+- `denyPaths` 是你声明**受保护**的普通路径列表(非正则):任何触碰它们的工具调用——文件类工具取其路径、bash 从命令串提取路径 token——触发**终局 ask**,由你裁决(非交互会话降级 deny)。不受 `builtinDenyFloor: false` 影响
+  分类器只被告知受保护路径**存在**,路径明文永不出本机, 命中的路径**只**出现在本地确认弹窗。
 - `builtinDenyFloor: false` 可整体关闭内置危险/路径拦截(风险自担;分类器与你的规则仍在——下方自保护层永远开启)
 - `classifierModel: "provider/model-id"` 指定分类器模型(如轻量 flash 类);优先级 flag > env > config > 自省;无效值回退会话模型并一次性警告
-- spec 支持 pi 原生 `--model` 思考级别后缀:`"zai/glm-5.3-flash:low"` 将分类器思考设为 effort low(无后缀缺省 = 显式关思考,[实测](research/thinking-param-blackhole.md)背书的默认)
-- `toggleShortcut` 重绑主开关快捷键(任意 pi 键组合,如 `ctrl+shift+x`;`null` 或空串禁用;非法组合在会话启动时一次性警告并跳过注册)。快捷键与 `/automode on|off` **语义等价**——运行中生效、无确认弹窗、不持久化(持久需求由 `--no-auto-mode` flag 承担;扩展运行时从不写自己的受保护配置)
-- 首次运行自动生成模板 `~/.pi/agent/config/pi-verdict.json`(尊重 `PI_CODING_AGENT_DIR`);修改后新会话生效
+- spec 支持 pi 原生 `--model` 思考级别后缀:`"zai/glm-5.3-flash:low"` 将分类器思考设为 effort low(无后缀缺省 = 显式关思考)
+- `toggleShortcut` 重绑主开关快捷键(`null` 或空串禁用, 非持久化)
+- 首次运行自动生成模板 `~/.pi/agent/config/pi-verdict.json`(尊重 `PI_CODING_AGENT_DIR`)
 
-**为什么没有内置白名单?**对规则层的绕过测试(见 [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md))证明白名单的健全性需要 shell AST 分析——每条内置「永远放行」都是作者维护的安全声明。因此内置层只做 **deny** 声明(方向健全),allow 声明归你。
+**为什么没有内置白名单?**对规则层的绕过测试(见 [`research/rule-layer-security-audit.md`](research/rule-layer-security-audit.md))证明白名单的健壮性非常有限。因此内置层只做 **deny** 声明(方向健全),allow 声明归你。
 
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -115,10 +121,11 @@ tool_call
   │         仅配置被改且有 UI → 一次保留/还原确认
   │
   ├─ 1. 规则层(确定性,零延迟)
-  │     ├─ 内置 deny floor:bash 危险正则(完整命令串)+ 路径敏感度 S0–S5
+  │     ├─ 内置 deny floor:bash 危险正则(完整命令串,截断上限 8192 字符)+ 路径敏感度 S0–S5
+  │     │   (双形匹配 —— 词法 + realpath,符号链接别名会被解析)
   │     ├─ 用户规则:deny 优先于 allow(正则,见下)
   │     ├─ denyPaths(ADR-0002):用户声明的受保护路径,工具负责归一化
-  │     │   (~、$HOME、相对、..、symlink)→ 终局 ask,先于用户 allow;
+  │     │   (~、$HOME、相对、..、symlink、macOS/Windows 大小写)→ 终局 ask,先于用户 allow;
   │     │   分类器只见存在性话术
   │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
   │
@@ -140,7 +147,7 @@ tool_call
         回放双键 LRU(128)测量 would-be 命中率
 ```
 
-**fail-closed**:分类器异常 / 超时(15s)/ 输出违反契约 → 拦截,绝不静默放行。
+**fail-closed**:分类器异常 / 超时(25s)/ 输出违反契约 → 拦截,绝不静默放行。
 
 ## 证据驱动,不靠直觉
 
@@ -156,9 +163,9 @@ tool_call
 
 ## 状态与限制
 
-原型质量 —— 可用,未硬化:
-
 - 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户规则](#用户规则configpi-verdictjson));allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
+- 路径敏感度 floor 只作用于文件类工具:bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
+- Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
 - 自省意味着会话模型亲自裁决 —— 若延迟/成本敏感,用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)
@@ -177,7 +184,7 @@ tool_call
 ```bash
 bun install
 bun run typecheck
-bun test          # 91 个离线桩测试:自保护 / 变更检测 / deny floor / 用户规则 / denyPaths / 绕过回归 / 分类器重试 / 影子缓存 / 命令 / toggle 快捷键
+bun test          # 离线桩测试:自保护 / 变更检测 / deny floor / 用户规则 / denyPaths / 绕过回归 / 分类器重试 / 影子缓存 / 命令 / toggle 快捷键
 ```
 
 Issue tracker 与决策记录在 GitHub issues(「地图」issue #1 为索引)。

package/extensions/auto-mode.ts

@@ -118,11 +118,17 @@ interface RuleResult {
 	detail?: string;
 }
 
+/** Cap the danger-regex matching input (#25): the prefix-consuming character
+ *  classes plus nested alternations can backtrack quadratically on very long
+ *  separator-free strings. Beyond the cap, rule matching is lost and the call
+ *  falls to the classifier (fail-closed direction). */
+export const BASH_MAX_MATCH_LEN = 8192;
+
 function classifyBash(command: string, floorOn: boolean): RuleResult {
-	// 内置 deny floor:危险正则对完整命令串匹配;可经 builtinDenyFloor 整体关闭
 	if (floorOn) {
+		const capped = command.length > BASH_MAX_MATCH_LEN ? command.slice(0, BASH_MAX_MATCH_LEN) : command;
 		for (const rule of BASH_DANGER_RULES) {
-			if (rule.pattern.test(command)) return { verdict: "deny", reason: `rule ${rule.id}: ${rule.reason}` };
+			if (rule.pattern.test(capped)) return { verdict: "deny", reason: `rule ${rule.id}: ${rule.reason}` };
 		}
 	}
 	if (!command.trim()) return { verdict: "allow", reason: "empty command" };
@@ -207,7 +213,7 @@ function userConfigPath(): string {
 }
 
 const USER_CONFIG_TEMPLATE = `${JSON.stringify({
-	_hint: "pi-verdict user rules. allow/deny are JS regex arrays; deny wins over allow. Match target: bash = full command string, file tools = absolute path. denyPaths is a list of protected path prefixes (plain paths, not regexes; the tool owns normalization — ~, $HOME, relative, .. and symlink forms all resolve — and any access attempt, including from bash command strings, asks for your confirmation, degrading to deny in non-interactive sessions; priority: after your deny rules, before your allow rules; never sent to the classifier). builtinDenyFloor=false disables the built-in danger/path floor (at your own risk; the self-protection layer always stays on and cannot be turned off by any config). classifierModel persistently sets the classifier model (provider/id, e.g. zai/glm-5.3-flash; accepts a pi-native thinking suffix, e.g. zai/glm-5.3-flash:low; empty = self-reflection, inherit session model). toggleShortcut sets the master-switch toggle key (pi key combo, e.g. ctrl+shift+a; null or empty disables the shortcut). This file is part of the permission gate itself: pi-verdict denies any agent-side modification of it — edit it manually outside pi. Changes apply to new sessions.",
+	_hint: "pi-verdict user rules. allow/deny are JS regex arrays; deny wins over allow. Match target: bash = full command string, file tools = absolute path. denyPaths is a list of protected path prefixes (plain paths, not regexes; the tool owns normalization — ~, $HOME, relative, .. and symlink forms all resolve, case folds on macOS/Windows — and any access attempt, including from bash command strings, asks for your confirmation, degrading to deny in non-interactive sessions; priority: after your deny rules, before your allow rules; never sent to the classifier). builtinDenyFloor=false disables the built-in danger/path floor (at your own risk; the self-protection layer always stays on and cannot be turned off by any config). classifierModel persistently sets the classifier model (provider/id, e.g. zai/glm-5.3-flash; accepts a pi-native thinking suffix, e.g. zai/glm-5.3-flash:low; empty = self-reflection, inherit session model). toggleShortcut sets the master-switch toggle key (pi key combo, e.g. ctrl+shift+a; null or empty disables the shortcut). This file is part of the permission gate itself: pi-verdict denies any agent-side modification of it — edit it manually outside pi. Changes apply to new sessions.",
 	allow: ["^ls\\b"],
 	deny: [],
 	denyPaths: [],
@@ -231,7 +237,15 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		const raw = JSON.parse(fs.readFileSync(p, "utf8")) as { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown };
+		try {
+			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
+		} catch (err) {
+			// Invalid config never silently disables the gate (#25): a parse failure
+			// loads empty user rules (the floor and self-protection layer stay on)
+			// and reports through the session_start skip channel, same as invalid regexes
+			return { rules: EMPTY_RULES, skipped: [`config parse failed: ${err instanceof Error ? err.message : String(err)} — user rules not loaded (${p})`], shortcutWarning: null };
+		}
 		const skipped: string[] = [];
 		const compile = (list: unknown): RegExp[] =>
 			(Array.isArray(list) ? list : []).filter((x): x is string => typeof x === "string").flatMap((src) => {
@@ -277,21 +291,57 @@ function expandHome(p: string): string {
 	return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
 }
 
+// All S-rules match case-insensitively (#21): on case-insensitive filesystems
+// (default macOS APFS, Windows) case variants name the same file — realpath
+// normalization covers existing targets, /i covers the lexical forms of
+// nonexistent ones; on linux the uppercase spelling usually does not exist and
+// the occasional false positive fails toward deny (safe direction).
 const S0_SECRET = [
-	/\.ssh(\/|$)/, /\.aws(\/|$)/, /\.gnupg(\/|$)/, /(^|\/)\.env(\.|$)/, /credentials?(\.|\/|$)/i,
-	/(^|\/)id_rsa/, /\.pem$/, /_history$/, /\.config\/gh(\/|$)/, /\.pi\/agent\/auth\.json$/,
+	/\.ssh(\/|$)/i, /\.aws(\/|$)/i, /\.gnupg(\/|$)/i, /(^|\/)\.env(\.|$)/i, /credentials?(\.|\/|$)/i,
+	/(^|\/)id_rsa/i, /\.pem$/i, /_history$/i, /\.config\/gh(\/|$)/i, /\.pi\/agent\/auth\.json$/i,
 	// V8(安全审计):常见明文凭证文件补全
-	/(^|\/)\.netrc$/, /(^|\/)\.npmrc$/, /(^|\/)\.pypirc$/, /(^|\/)\.envrc$/, /(^|\/)\.vault-token$/,
-	/\.kube(\/|$)/, /\.docker\/config\.json$/, /\.gem\/credentials$/,
+	/(^|\/)\.netrc$/i, /(^|\/)\.npmrc$/i, /(^|\/)\.pypirc$/i, /(^|\/)\.envrc$/i, /(^|\/)\.vault-token$/i,
+	/\.kube(\/|$)/i, /\.docker\/config\.json$/i, /\.gem\/credentials$/i,
 ];
-const S1_SYSTEM = [/^\/etc(\/|$)/, /^\/usr(\/|$)/, /^\/var(\/|$)/, /^\/System(\/|$)/, /(^|\/)authorized_keys$/];
-const S2_USER_RC = [/\.(bashrc|zshrc|profile|bash_profile|gitconfig)$/, /crontab/, /Library\/LaunchAgents(\/|$)/, /\.config\/systemd(\/|$)/];
-const S3_GIT_META = [/(^|\/)\.git\/(hooks|config|modules)(\/|$)/, /(^|\/)\.gitmodules$/];
+// /private prefixes: macOS firmlinks — /etc, /var are really /private/etc,
+// /private/var, and realpath'd toolchain output uses the real spelling (#21)
+const S1_SYSTEM = [/^\/etc(\/|$)/i, /^\/private\/(etc|var)(\/|$)/i, /^\/usr(\/|$)/i, /^\/var(\/|$)/i, /^\/System(\/|$)/i, /(^|\/)authorized_keys$/i];
+const S2_USER_RC = [/\.(bashrc|zshrc|profile|bash_profile|gitconfig)$/i, /crontab/i, /Library\/LaunchAgents(\/|$)/i, /\.config\/systemd(\/|$)/i];
+const S3_GIT_META = [/(^|\/)\.git\/(hooks|config|modules)(\/|$)/i, /(^|\/)\.gitmodules$/i];
+
+/**
+ * All canonical forms of a path for rule matching: the lexical absolute plus,
+ * whenever an existing ancestor can be resolved, the form rebuilt from that
+ * ancestor's realpath. Read and write targets may both not exist yet — walking
+ * up to the nearest existing ancestor means a symlink alias exposes its real
+ * form even when the final segments do not exist (#20).
+ */
+function targetForms(abs: string): string[] {
+	const out = new Set<string>([abs]);
+	let dir = abs;
+	const tail: string[] = [];
+	for (;;) {
+		try {
+			const real = fs.realpathSync(dir);
+			out.add(path.join(real, ...tail));
+			return [...out];
+		} catch {
+			const parent = path.dirname(dir);
+			if (parent === dir) return [...out];
+			tail.unshift(path.basename(dir));
+			dir = parent;
+		}
+	}
+}
 
 /** read 类工具:S0 读取即高危(deny),其余读取放行。isWrite: write/edit 走完整分级 */
 function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: boolean, floorOn: boolean): RuleResult {
 	const abs = path.resolve(cwd, expandHome(rawPath));
-	const hit = (rules: RegExp[]) => rules.some((r) => r.test(abs));
+	// Dual-form matching (#20): rules test every canonical form of the target —
+	// a project-local symlink aliasing ~/.ssh or a .git/hooks dir must not pass
+	// the floor on its lexical spelling alone.
+	const forms = targetForms(abs);
+	const hit = (rules: RegExp[]) => forms.some((f) => rules.some((r) => r.test(f)));
 	// floor 关闭时:内置 deny 一律降级 gray(永不升格 allow);非 deny 分支(allow/gray)保持
 	const D = floorOn
 		? (reason: string): RuleResult => ({ verdict: "deny", reason })
@@ -305,7 +355,12 @@ function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: b
 	if (hit(S1_SYSTEM)) return D(`write to system directory: ${rawPath}`);
 	if (hit(S3_GIT_META)) return D(`write to .git metadata (executable code entry point): ${rawPath}` );
 	if (hit(S2_USER_RC)) return { verdict: "gray", reason: `write to user config/persistence entry point: ${rawPath}` };
-	if (abs === cwd || abs.startsWith(cwd + path.sep)) return { verdict: "allow" };
+	// In-cwd write allowance (#20): every canonical form must sit inside the cwd
+	// (in either its lexical or real form) — a lexical prefix hit whose real
+	// form escapes the project (symlink alias) grades as an outside-cwd write.
+	const cwdBases = new Set([cwd, tryRealpath(cwd)]);
+	const inCwd = (f: string) => [...cwdBases].some((b) => f === b || f.startsWith(b + path.sep));
+	if (forms.every(inCwd)) return { verdict: "allow" };
 	return { verdict: "gray", reason: `write outside project directory (CWD): ${rawPath}` };
 }
 
@@ -362,6 +417,14 @@ function userRuleTarget(toolName: string, input: Record<string, unknown>, cwd: s
 const BASH_PATH_TOKENS =
 	/(?:~|\$HOME)(?:\/[\w.@*-]+)*|\/(?:[\w.@*-]+\/)*[\w.@*-]*|\.{1,2}(?:\/[\w.@*-]+)+|[\w.-]+(?:\/[\w.-]+)+/g;
 
+/** Case-insensitive filesystems (default macOS APFS, Windows) compare path strings
+ *  case-folded; realpath already normalizes case whenever it resolves, this covers
+ *  the lexical-only forms of nonexistent targets (#21). Linux stays case-sensitive. */
+const CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32";
+const fold = (s: string): string => (CASE_INSENSITIVE_FS ? s.toLowerCase() : s);
+const pathEquals = (a: string, b: string): boolean => fold(a) === fold(b);
+const pathStartsWith = (child: string, base: string): boolean => fold(child).startsWith(fold(base) + path.sep);
+
 /** Normalized forms of one path (lexical + realpath when it exists) for denyPaths comparison */
 function denyPathForms(raw: string, cwd: string): string[] {
 	if (!raw) return [];
@@ -393,7 +456,7 @@ function hitDenyPaths(toolName: string, input: Record<string, unknown>, cwd: str
 	for (const candidate of denyPathCandidates(toolName, input)) {
 		for (const c of denyPathForms(candidate, cwd)) {
 			for (const b of bases) {
-				if (c === b || c.startsWith(b + path.sep)) return b;
+				if (pathEquals(c, b) || pathStartsWith(c, b)) return b;
 			}
 		}
 	}
@@ -467,9 +530,48 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 	// 安装副本目标:单文件形态 → 文件本体(exact);npm 目录形态 → 包根目录(prefix)。
 	// extRoot 与 ownFile 各取词法/realpath 双形交叉判定,集合同样双形收录——
 	// 避免符号链接目录(如 macOS /var → /private/var)导致传入词法路径与集合错位。
+	/** List every file under a package root (npm dir install form) for the tamper
+	 *  baseline (#26): write protection covers the whole package dir, so the watch
+	 *  scope must not lag behind it — a planted manifest entry must not survive to
+	 *  the next session undetected. node_modules/.git are skipped; depth and file
+	 *  count are bounded so a planted oversized tree cannot blow up the next
+	 *  session's baseline build (defense in depth, requires a prior bypass). */
+	const listPackageFiles = (root: string): string[] => {
+		const out: string[] = [];
+		const walk = (dir: string, depth: number): void => {
+			if (depth > 16 || out.length >= 500) return;
+			let names: string[];
+			try {
+				names = fs.readdirSync(dir);
+			} catch {
+				return;
+			}
+			for (const name of names) {
+				if (name === "node_modules" || name === ".git") continue;
+				const full = path.join(dir, name);
+				// stat (not lstat) follows symlinks: a package file replaced by a
+				// symlink to outside content must not silently drop out of the
+				// baseline — the watched path stays the lexical entry; a symlink
+				// cycle (ELOOP) throws and is skipped (#26 review)
+				let st: fs.Stats;
+				try {
+					st = fs.statSync(full);
+				} catch {
+					continue;
+				}
+				if (st.isDirectory()) walk(full, depth + 1);
+				else if (st.isFile() && out.length < 500) out.push(full);
+			}
+		};
+		walk(root, 0);
+		return out;
+	};
+
 	const extTargets = new Set<string>();
 	if (ownFile) {
 		watchBases.push({ file: ownFile, kind: "extension" });
+		const seenWatch = new Set<string>([ownFile]);
+		let pkgRoot: string | null = null;
 		const extRoots = new Set([path.join(agentDir, "extensions"), tryRealpath(path.join(agentDir, "extensions"))]);
 		const ownForms = new Set([ownFile, tryRealpath(ownFile)]);
 		for (const extRoot of extRoots) {
@@ -482,6 +584,16 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 					(singleFile ? exact : prefixes).add(f);
 					extTargets.add(f);
 				}
+				if (!singleFile && pkgRoot === null) pkgRoot = target;
+			}
+		}
+		// one walk of the package root (lexical form; takeSnapshots' pathForms
+		// expansion picks up real forms per file) — no duplicate entries
+		if (pkgRoot !== null) {
+			for (const f of listPackageFiles(pkgRoot)) {
+				if (seenWatch.has(f)) continue;
+				seenWatch.add(f);
+				watchBases.push({ file: f, kind: "extension" });
 			}
 		}
 	}
@@ -511,10 +623,12 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 	return { exact: [...exact], prefixes: [...prefixes], bashPatterns, watchBases };
 }
 
-/** 解析后的写入路径是否命中受保护集合(经 realpath 防 symlink 旁路) */
+/** Does the resolved write path hit the protected set (realpath guards against
+ *  symlink bypass; nonexistent targets rebuild their real form from the
+ *  nearest existing ancestor, #20) */
 export function isProtectedWritePath(rawPath: string, cwd: string, prot: ProtectedSet): boolean {
 	if (!rawPath) return false;
-	for (const c of pathForms(path.resolve(cwd, expandHome(rawPath)))) {
+	for (const c of targetForms(path.resolve(cwd, expandHome(rawPath)))) {
 		if (prot.exact.includes(c)) return true;
 		for (const p of prot.prefixes) {
 			if (c === p || c.startsWith(p + path.sep)) return true;
@@ -659,13 +773,23 @@ function sanitize(text: string): string {
 	if (cleaned.length <= MAX_ENTRY_CHARS) return cleaned;
 	const head = Math.floor(MAX_ENTRY_CHARS * 0.6);
 	const tail = MAX_ENTRY_CHARS - head;
-	return `${cleaned.slice(0, head)}\n…[truncated]…\n${cleaned.slice(-tail)}`;
+	return `${cleaned.slice(0, head)}…[truncated]…${cleaned.slice(-tail)}`;
+}
+
+/** Transcript line body: sanitized (zero-width stripped, length-capped) with
+ *  line breaks escaped in place — the transcript is line-structured ("User: …" /
+ *  "tool: …"), and an embedded line break in a path, command, or message could
+ *  otherwise forge a structural line (#22). Covers \n, \r\n, lone \r and the
+ *  Unicode separators U+2028/U+2029/U+0085, which models may render as breaks.
+ *  Content is preserved, only the line structure is defended. */
+function transcriptSafe(text: string): string {
+	return sanitize(text).replace(/[\r\n\u2028\u2029\u0085]/g, "\\n");
 }
 
 function toolCallLine(name: string, args: Record<string, unknown>): string {
-	if (typeof args.command === "string") return `${name}: ${sanitize(args.command)}`;
-	if (typeof args.path === "string") return `${name}: ${args.path}`;
-	return `${name}: ${sanitize(JSON.stringify(args))}`;
+	if (typeof args.command === "string") return `${name}: ${transcriptSafe(args.command)}`;
+	if (typeof args.path === "string") return `${name}: ${transcriptSafe(args.path)}`;
+	return `${name}: ${transcriptSafe(JSON.stringify(args))}`;
 }
 
 /**
@@ -681,7 +805,7 @@ function collectTranscriptParts(ctx: ExtensionContext): { userLines: string[]; t
 		const msg = entry.message;
 		if (msg.role === "user") {
 			const text = typeof msg.content === "string" ? msg.content : msg.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
-			if (text.trim()) userLines.push(`User: ${sanitize(text)}`);
+			if (text.trim()) userLines.push(`User: ${transcriptSafe(text)}`);
 		} else if (msg.role === "assistant") {
 			for (const block of msg.content) {
 				if (block.type === "toolCall") toolLines.push(toolCallLine(block.name, block.arguments as Record<string, unknown>));

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.5.0",
+	"version": "0.5.2",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",