feat(permission): integrate auto-review and hard guards

config/pi-permission-hard-guards.jsonc

@@ -0,0 +1,17 @@
+{
+  // Bundle default. The installed user-level copy is seeded once and may then
+  // be edited by the user; project configuration cannot override it.
+  "version": 1,
+  "permission": {
+    "bash": {
+      "rm -rf /": "deny",
+      "rm -rf /*": "deny",
+      "rm -rf ~": "deny",
+      "rm -rf ~/*": "deny",
+      "sudo rm -rf /": "deny",
+      "sudo rm -rf /*": "deny",
+      "mkfs*": "deny",
+      "dd * of=/dev/*": "deny"
+    }
+  }
+}

config/pi-permission-policy.jsonc

@@ -1,23 +1,50 @@
 {
-  "$schema": "https://raw.githubusercontent.com/gotgenes/pi-packages/main/packages/pi-permission-system/schemas/permissions.schema.json",
   "debugLog": false,
   "permissionReviewLog": true,
   "yoloMode": false,
   "doublePressToConfirm": true,
-  "authorizerChain": [
-    "auto-review"
-  ],
+
+  // AutoReview is the default authority for deterministic review decisions.
+  "authorizerChain": ["auto-review"],
+  "autoReview": {
+    "enabled": true,
+    "provider": "openai-codex",
+    "model": "codex-auto-review",
+    "reasoning": "low",
+    "timeoutMs": 90000,
+    "includeBaselinePolicy": true
+  },
+  "analysis": {
+    "enabled": true,
+    "threshold": 500,
+    "retainAnalyzedBatches": 2,
+    "timeoutMs": 90000
+  },
+
   "shellTools": {
     "ssh_bash": {
       "commandArgument": "command",
       "decisionFloor": "ask"
     }
   },
+
   "permission": {
-    "*": "allow",
+    // Unknown tools are reviewed instead of silently allowed.
+    "*": "ask",
+    "read": "allow",
+    "write": "allow",
+    "edit": "allow",
     "grep": "allow",
     "find": "allow",
     "multi_grep": "allow",
+    "codegraph_explore": "allow",
+    "lsp_diagnostics": "allow",
+    "ctx_execute": "allow",
+    "ctx_execute_file": "allow",
+    "ctx_batch_execute": "allow",
+    "tool_search": "allow",
+    "ask_user_question": "allow",
+
     "ssh_connect": "ask",
     "ssh_cd": "ask",
     "ssh_read": "ask",
@@ -25,33 +52,13 @@
     "ssh_edit": "ask",
     "ssh_find": "ask",
     "ssh_grep": "ask",
+
     "external_directory": {
       "*": "ask"
     },
     "path": {
       "*": "allow",
-      ".git/*": "ask",
-      "*.env": "deny",
-      "*.env.*": "deny",
-      "*.env.example": "allow",
-      "~/.ssh": "deny",
-      "~/.ssh/*": "deny",
-      "~/.gnupg": "deny",
-      "~/.gnupg/*": "deny",
-      "~/.aws": "deny",
-      "~/.aws/*": "deny",
-      "~/.kube": "deny",
-      "~/.kube/*": "deny",
-      "~/.docker/config.json": "deny",
-      "~/.config/gh/hosts.yml": "deny",
-      "~/.netrc": "deny",
-      "~/.npmrc": "deny",
-      "~/.pypirc": "deny",
-      "~/Library/Keychains": "deny",
-      "~/Library/Keychains/*": "deny",
-      "~/.pi/agent/auth.json": "deny",
-      "~/.pi/agent/models.json": "deny",
-      "~/.pi/agent/models-store.json": "deny"
+      ".git/*": "ask"
     },
     "bash": {
       "*": "allow",