feat(permission): integrate auto-review and hard guards

pi-permission-system/src/extension-config.ts

@@ -1,6 +1,12 @@
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+  normalizeAutoReviewAnalysisConfig,
+  normalizeAutoReviewConfig,
+  type AutoReviewAnalysisConfig,
+  type AutoReviewConfig,
+} from "./auto-review/config.js";
 import type {
   ShellToolsConfig,
   UnifiedPermissionConfig,
@@ -32,6 +38,10 @@ export interface PermissionSystemExtensionConfig {
   shellTools?: ShellToolsConfig;
   /** Ordered names of registered live-authority chain links to consult before the terminal authorizer. */
   authorizerChain?: string[];
+  /** Built-in model reviewer configuration. */
+  autoReview?: AutoReviewConfig;
+  /** Count-based background policy analysis configuration. */
+  analysis?: AutoReviewAnalysisConfig;
 }
 
 export const DEFAULT_EXTENSION_CONFIG: PermissionSystemExtensionConfig = {
@@ -72,6 +82,12 @@ export function normalizePermissionSystemConfig(
     yoloMode: raw.yoloMode === true,
     doublePressToConfirm: raw.doublePressToConfirm !== false,
   };
+  if (raw.autoReview !== undefined) {
+    result.autoReview = normalizeAutoReviewConfig(raw.autoReview);
+  }
+  if (raw.analysis !== undefined) {
+    result.analysis = normalizeAutoReviewAnalysisConfig(raw.analysis);
+  }
   if (raw.piInfrastructureReadPaths !== undefined) {
     result.piInfrastructureReadPaths = raw.piInfrastructureReadPaths;
   }