feat: 移除 Codex Fast mode 与 AutoReview 后台分析，模型改为配置驱动

移除 pi-extension-codex-fast-mode： - 删除整个扩展目录；同步清理根 package.json 的 files / pi.extensions / dependencies 条目、package-lock.json、tests/extension-load.test.ts 断言与文档章节。 - pi-minimal-footer 的 Fast on 渲染是该扩展的唯一消费者。扩展移除后 accent 分支不再有生产者，collectFooterStatusItems 简化为直接返回非空状态字符串，去掉 FooterStatusItem 与 accent 标志，避免留下死代码。移除 500 次裁决后的后台分析体系： - 删除 analysis-agent.ts（192 行）与 ledger.ts（296 行），以及对应的 auto-review-runtime / auto-review-ledger 测试。 - runtime.ts 由 177 行收敛到 85 行：安装选项缩为 { service, config }；删除 handleAgentSettled 与 agent_settled 注册；保留 session_start / turn_start （denial circuit breaker 属安全语义）/ session_shutdown。 - 删除 analysis 配置键：config、extension-config、config-schema、生成的 permissions.schema.json 与种子配置。 - 删除 reviewer 的 onDecision 回调（唯一消费者是 ledger）。 - 删除迁移机制 scripts/migrate-permission-policy.mjs、其测试与 update.sh 中 46 行 migrate_permission_policy 接线。种子部署保持“目标缺失才写入”，已存在的 policy.jsonc 永不被覆盖。 AutoReview 模型改为纯配置驱动： - 删除 DEFAULT_PROVIDER / DEFAULT_MODEL 常量与 findCodexTemplate 合成逻辑； model.ts 由 65 行收敛到 48 行。 - provider / model 任一缺失时返回新增失败类别 model-unconfigured 并 defer 到人工审批；provider 未注册或模型未发布同样 defer。 - reasoning 不再有默认常量，完全由配置决定。 - session_start 在 auto-review 已列入 authorizerChain 且 provider/model 未配齐时 ui.notify 提示一次，避免不使用 AutoReview 的用户被打扰。 - 种子 autoReview 只保留 enabled，provider/model/reasoning 由用户按本机实际可用的模型填写。破坏性变更：analysis 键已从 strictObject schema 删除，任何仍带该键的 policy.jsonc 会使整份配置被拒（fail-closed 到全 ask）。这是刻意的变更，已由 config-loader 测试固定，防止将来无声放宽。测试： - 新增 auto-review-model.test.ts（7 例），覆盖此前完全缺失的模型解析：真实命中、未配置、provider 未知、模型未发布，以及不再合成替代模型。 - 重写 auto-review-runtime.test.ts（6 例）：authorizer 注册、未配置时提示一次、已配置 / disabled / 无 UI / 不在 chain 时静默。 - config-loader.test.ts 新增 2 例：带 analysis 的旧配置被拒且 fail-closed、 autoReview 逐字段合并。 - composition-root.test.ts 的 EXPECTED_HANDLERS 移除 agent_settled。文档：AGENTS.md、README.md、pi-permission-system 的 README / CHANGELOG / configuration.md / architecture.md / auto-review UPSTREAM.md。验证：pi-permission-system 的 typecheck、2577 个测试与 build 全部通过；根 50 个测试通过；schema 重新生成无漂移；新种子通过 schema 校验；5 个脚本 sh -n 通过；git diff --check 无空白问题。未安装 shellcheck；未执行真实 pi install / update（属外部写操作）。
2026-10-26 10:45:22 +00:00 · 2026-10-14 08:15:13 -07:00
parent 73f3117a7e
commit cdd91b3f8b
45 changed files with 325 additions and 2357 deletions
@@ -496,7 +496,9 @@ Nothing constrains an `Authorizer` to be deterministic. `LocalUserAuthorizer` is

 This package now owns the default model reviewer as the named `auto-review` authorizer. It is still downstream of deterministic policy: only an ordinary `ask` enters the authorizer chain, and a hard-guard `deny` never reaches it. The reviewer returns `allow`, `deny`, or `defer`; only `defer` falls through to the terminal human authority. Its transcript boundary admits direct user messages and recognized non-cancelled structured answers, never assistant/tool/compaction content.

-The composition root registers the authorizer on the same `LocalPermissionsService` instance it publishes. `installBuiltinAutoReview()` returns lifecycle methods instead of registering a second set of Pi session handlers. The root's single `session_start` and `session_shutdown` handlers coordinate service publication and reviewer state; `turn_start` resets the denial circuit breaker, and `agent_settled` is the safe boundary for optional count-based analysis.
+The composition root registers the authorizer on the same `LocalPermissionsService` instance it publishes. `installBuiltinAutoReview()` returns lifecycle methods instead of registering a second set of Pi session handlers. The root's single `session_start` and `session_shutdown` handlers coordinate service publication and reviewer state, and `turn_start` resets the denial circuit breaker.
+
+The review model is configuration-only. `resolveReviewModel()` reads `autoReview.provider` / `autoReview.model` and looks the pair up in the live registry; it neither defaults the pair nor synthesizes a stand-in. An unconfigured, unknown-provider, or unpublished-model pair resolves to a failure category, which the reviewer records and turns into `defer`, so the ask reaches the human prompt instead of being decided by an unintended model.

 A separate `HardGuardPolicyLoader` supplies a global-only manager to `PermissionResolver`. Resolution is deliberately asymmetric:

@@ -511,8 +513,6 @@ ordinaryManager.check(intent, session rules)

 Thus hard-file `allow` means “not blocked by hard guards,” not “approved overall.” Ordinary policy, per-agent restrictions, session grants, yolo mode, and model authority cannot loosen a hard deny.

-Completed AutoReview verdicts flow to an owner-only count ledger. The reviewer callback strips rationale/transcript/raw payload and persists bounded fingerprints. Reaching the configured checkpoint marks analysis pending. At `agent_settled`, a tool-free, extension-free, in-memory AgentSession receives only aggregated records. Its strict JSON proposal is validated against the evidence, persisted, and injected into the same session as a follow-up. The checkpoint advances only after a valid proposal is stored; shutdown leaves pending work durable. No analysis path mutates either policy file.
-
 The public authorizer registry remains available for other named authorities. Configuration order determines chain order, unregistered names are skipped fail-safe, and registration alone grants no authority.

 Authorizers are named capabilities registered on `permissions:ready`; the integrated `auto-review` authorizer uses the same chain contract as third-party links. Once configured, a link's `allow` or `deny` is final for any ordinary-policy `ask`, including `path`; `defer` advances to the next link or terminal.
@@ -588,7 +588,7 @@ src/
 ├── authority/
 │   ├── authorizer-selection.ts  Configured authorizer resolution
 │   └── authorizer-chain.ts      Named authorizer ordering and terminal fallback
-├── auto-review/                 Integrated reviewer and count-based analysis
+├── auto-review/                 Integrated reviewer
 ├── service.ts                   Cross-extension permission service
 └── types.ts                     Shared domain types
 ```
@@ -12,5 +12,5 @@

 - AutoReview 是 `pi-permission-system` 的内置 authorizer，而不是单独加载的 Pi 扩展。
 - 配置从统一的 `policy.jsonc` 读取。
- 完成的自动裁决进入基于计数的 ledger 和一个隔离的、无工具的后台分析 Agent。
- 分析建议回传到当前活跃的 Pi Session，且在用户明确确认前绝不修改策略。
+- 评审模型完全由配置指定：不保留 provider/model 默认常量，也不合成替代模型；未配置或无法解析时 `defer` 到人工审批。
+- 已移除上游的裁决计数 ledger、后台分析 Agent 与建议回传流程；扩展不再汇总历史裁决，也不自动修改策略。
@@ -64,17 +64,39 @@ There is no separate `external_directory` decision. A path outside the current w
 ```

 > **Note:** Trailing commas are not supported. If parsing fails, ordinary policy fails safely to `ask`.
-## Built-in AutoReview and Count-Based Analysis
+## Built-in AutoReview

 `autoReview.enabled` controls the built-in authorizer named `auto-review`. It only receives requests that ordinary policy resolved to `ask`; it cannot bypass a hard deny. Add `"auto-review"` to `authorizerChain` to make it the primary case-by-case authority. An `allow` or `deny` verdict is final for that request. `defer` continues to the next authorizer and ultimately the human permission dialog.

 The reviewer uses only trusted direct-user transcript evidence and recognized structured answers. Assistant, tool, compaction, and cancelled-answer content cannot authorize an operation. Model lookup, authentication, timeout, malformed output, or internal errors all return `defer`.

-`analysis.threshold` counts completed automatic verdicts, not Pi turns and not deferrals. Each `allow` or `deny` appends one sanitized record under the global extension state directory. Records contain bounded surface/pattern fingerprints and risk/authorization classifications; they omit rationale, raw payload, transcript, and credentials.
+The review model comes entirely from configuration. There is no default provider/model pair and no synthesized stand-in, so automatic review stays inactive until both `autoReview.provider` and `autoReview.model` name a model your Pi registry actually publishes:

-When the count since the last accepted checkpoint reaches the threshold (500 by default), the ledger marks analysis pending. At the next `agent_settled` boundary the extension starts an isolated AgentSession with no tools, extensions, skills, prompt templates, themes, or project context. Its JSON proposal is schema-validated and filtered so authorization-dependent, denied, or high-risk evidence cannot become an unconditional allow candidate.
+```jsonc
+{
+  "authorizerChain": ["auto-review"],
+  "autoReview": {
+    "enabled": true,
+    "provider": "deepseek",
+    "model": "deepseek-flash",
+    "reasoning": "off"
+  }
+}
+```

-A successful proposal advances the checkpoint, is retained according to `retainAnalyzedBatches`, and is delivered with `deliverAs: "followUp"` and `triggerTurn: true` to this conversation. The proposal is advisory only. Neither `policy.jsonc` nor `hard-guards.jsonc` is modified until the user explicitly chooses and confirms rules. Shutdown aborts the running worker but leaves the pending checkpoint durable for the next session.
+| Key                    | Default | Description                                                                                                                              |
+| ---------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
+| `autoReview.enabled`   | `true`  | Registers the `auto-review` authorizer. It decides nothing until named in `authorizerChain`.                                             |
+| `autoReview.provider`  | —       | Pi provider id of the review model. No default; when absent the reviewer defers every ask.                                               |
+| `autoReview.model`     | —       | Model id within that provider. No default; when absent the reviewer defers every ask.                                                    |
+| `autoReview.reasoning` | —       | Thinking level for a reasoning-capable review model. No default; omit to send no reasoning option.                                       |
+| `autoReview.timeoutMs` | `90000` | Total retry budget for one review call.                                                                                                  |
+| `autoReview.includeBaselinePolicy` | `true` | Include the built-in Codex Guardian–style policy text.                                                                      |
+| `autoReview.additionalPolicy` | —  | Operator policy appended to the baseline. Required when `includeBaselinePolicy` is `false`.                                              |
+
+When either `provider` or `model` is missing and `auto-review` is named in `authorizerChain`, the extension notifies once at `session_start` that automatic review cannot run and every ask will reach the human prompt. An unknown provider or an unpublished model id also defers, with the reason recorded in the permission review log.
+
+Each `allow` / `deny` is written to the permission review log; the extension keeps no aggregate history, runs no background analysis agent, and never edits either policy file.

 ## Runtime Knobs