feat(pi-permission-system): AutoReview 改为跟随主模型的对话式工具调用审查

AutoReview：

- 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型
  （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查
  模型，只设其一视为配置错误并转人工。
- 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制
  toolChoice，正文文本（即使是合法 JSON）一律忽略。
- approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。
  超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样
  转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。
- 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向
  扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会
  转人工。
- 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换
  为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。
- 同一条用户消息内完全相同的请求只缓存 approve 结论。
- 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。

删除：

- 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。
- 整个 annotator 机制（model-explanation、注册表、registerAnnotator、
  provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置
  被拒绝。

测试：

- 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真
  或只测实现细节的旧测试。
- 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

pi-permission-system/test/auto-review-runtime.test.ts

@@ -1,12 +1,42 @@
 import { describe, expect, it, vi } from "vitest";
 
-import type { ExtensionContext, ModelRegistry, SessionManager } from "@earendil-works/pi-coding-agent";
-import { DEFAULT_AUTO_REVIEW_CONFIG, type AutoReviewConfig } from "#src/auto-review/config";
+import type { Api, Model } from "@earendil-works/pi-ai";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import {
+  DEFAULT_AUTO_REVIEW_CONFIG,
+  type AutoReviewConfig,
+} from "#src/auto-review/config";
 import { installBuiltinAutoReview } from "#src/auto-review/runtime";
 import type { ConfigReader } from "#src/config-store";
 import type { PermissionsService } from "#src/service";
 
-function harness(autoReview: AutoReviewConfig, hasUI = true) {
+function makeModel(id: string, provider = "cfg"): Model<Api> {
+  return { id, provider } as unknown as Model<Api>;
+}
+
+/**
+ * A registry exposing `streamSimple`, as a real Pi 1.3.0 runtime does — the
+ * reviewer completes through `streamSimple(...).result()`.
+ *
+ * The pinned development types predate this surface, so the registry is built
+ * as a plain object — the same structural approach the reviewer takes.
+ */
+function chatRegistry(provider: string, modelId: string) {
+  return {
+    find: (p: string, m: string) =>
+      p === provider && m === modelId ? makeModel(m, p) : undefined,
+    streamSimple: vi.fn(),
+  };
+}
+
+interface HarnessOptions {
+  readonly autoReview: AutoReviewConfig;
+  readonly hasUI?: boolean;
+  readonly registry?: object;
+}
+
+function harness(options: HarnessOptions) {
+  const { autoReview, hasUI = true } = options;
   const notify = vi.fn();
   const registerAuthorizer = vi.fn(() => () => {});
   const controller = installBuiltinAutoReview({
@@ -25,8 +55,10 @@ function harness(autoReview: AutoReviewConfig, hasUI = true) {
   const ctx = {
     hasUI,
     ui: { notify },
-    modelRegistry: {} as ModelRegistry,
-    sessionManager: { getBranch: () => [] } as unknown as Pick<SessionManager, "getBranch">,
+    modelRegistry: options.registry ?? {},
+    sessionManager: { getBranch: () => [], getSessionId: () => "s" },
+    model: makeModel("session-model"),
+    signal: undefined,
   } as unknown as ExtensionContext;
 
   controller.handleSessionStart(ctx);
@@ -35,33 +67,77 @@ function harness(autoReview: AutoReviewConfig, hasUI = true) {
 
 describe("built-in AutoReview lifecycle", () => {
   it("registers the auto-review authorizer", () => {
-    const { registerAuthorizer } = harness({ ...DEFAULT_AUTO_REVIEW_CONFIG });
+    const { registerAuthorizer } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG },
+    });
 
-    expect(registerAuthorizer).toHaveBeenCalledWith("auto-review", expect.any(Function));
+    expect(registerAuthorizer).toHaveBeenCalledWith(
+      "auto-review",
+      expect.any(Function),
+    );
   });
 
-  it("warns once at session start when provider and model are unset", () => {
-    const { notify } = harness({ ...DEFAULT_AUTO_REVIEW_CONFIG });
+  it("warns when exactly one of provider/model is set", () => {
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg" },
+    });
 
     expect(notify).toHaveBeenCalledTimes(1);
     expect(notify.mock.calls[0]?.[1]).toBe("warning");
-    expect(notify.mock.calls[0]?.[0]).toMatch(/provider.*model/iu);
+    expect(notify.mock.calls[0]?.[0]).toMatch(/only one of/iu);
   });
 
-  it("stays silent when both provider and model are configured", () => {
-    const { notify } = harness({ ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "vendor", model: "m" });
+  it("warns when the named model cannot be resolved", () => {
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg", model: "missing" },
+      registry: chatRegistry("cfg", "present"),
+    });
+
+    expect(notify).toHaveBeenCalledTimes(1);
+    expect(notify.mock.calls[0]?.[0]).toMatch(/cfg\/missing.*not available/iu);
+  });
+
+  it("warns when the runtime exposes no completion capability", () => {
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg", model: "m" },
+      registry: {},
+    });
+
+    expect(notify).toHaveBeenCalledTimes(1);
+    expect(notify.mock.calls[0]?.[0]).toMatch(/does not support an independent model call/iu);
+  });
+
+  it("stays silent when the named model resolves", () => {
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg", model: "m" },
+      registry: chatRegistry("cfg", "m"),
+    });
+
+    expect(notify).not.toHaveBeenCalled();
+  });
+
+  it("stays silent in follow-the-session-model mode", () => {
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG },
+      registry: {},
+    });
 
     expect(notify).not.toHaveBeenCalled();
   });
 
   it("stays silent when AutoReview is disabled", () => {
-    const { notify } = harness({ ...DEFAULT_AUTO_REVIEW_CONFIG, enabled: false });
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, enabled: false, provider: "cfg" },
+    });
 
     expect(notify).not.toHaveBeenCalled();
   });
 
   it("does not notify without a UI", () => {
-    const { notify } = harness({ ...DEFAULT_AUTO_REVIEW_CONFIG }, false);
+    const { notify } = harness({
+      autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg" },
+      hasUI: false,
+    });
 
     expect(notify).not.toHaveBeenCalled();
   });
@@ -77,7 +153,7 @@ describe("built-in AutoReview lifecycle", () => {
           yoloMode: false,
           doublePressToConfirm: true,
           authorizerChain: [],
-          autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG },
+          autoReview: { ...DEFAULT_AUTO_REVIEW_CONFIG, provider: "cfg" },
         }),
       } as ConfigReader,
     });