feat: vendor permission auto-review source

config/pi-auto-permissions.json

@@ -1,27 +0,0 @@
-{
-  "enabled": true,
-  "reviewEvidence": {
-    "projectInstructions": true
-  },
-  "ui": {
-    "enabled": true,
-    "resultDisplayMs": 2500,
-    "placement": "widget"
-  },
-  "rules": [
-    {
-      "pattern": "\\bgit\\s+(?!(?:status|diff|log|show|rev-parse|ls-files|grep)\\b)(?!branch(?:\\s+--show-current[^\\r\\n;&|]*)?\\s*(?:$|[;&|]))(?!remote\\s+(?:-v|get-url)\\b)",
-      "flags": "i",
-      "level": "guarded",
-      "group": "git",
-      "label": "Git mutation or network operation"
-    },
-    {
-      "pattern": "(?:^|[\\n;&|])\\s*(?:(?:npm|pnpm|bun)\\s+(?:install|add|uninstall|update)\\b|pip3?\\s+install\\b|brew\\s+(?:install|uninstall)\\b)",
-      "flags": "i",
-      "level": "guarded",
-      "group": "packages",
-      "label": "Package installation or removal"
-    }
-  ]
-}

config/pi-permission-system.json

@@ -4,6 +4,9 @@
   "permissionReviewLog": true,
   "yoloMode": false,
   "doublePressToConfirm": true,
+  "authorizerChain": [
+    "auto-review"
+  ],
   "permission": {
     "*": "allow",
     "grep": "allow",
@@ -43,6 +46,7 @@
       "grep*": "deny",
       "find*": "deny",
       "fd*": "deny",
+      "git *": "ask",
       "git status*": "allow",
       "git diff*": "allow",
       "git log*": "allow",
@@ -54,6 +58,22 @@
       "git branch --show-current*": "allow",
       "git remote -v": "allow",
       "git remote get-url*": "allow",
+      "npm install *": "ask",
+      "npm add *": "ask",
+      "npm uninstall *": "ask",
+      "npm update *": "ask",
+      "pnpm install *": "ask",
+      "pnpm add *": "ask",
+      "pnpm uninstall *": "ask",
+      "pnpm update *": "ask",
+      "bun install *": "ask",
+      "bun add *": "ask",
+      "bun uninstall *": "ask",
+      "bun update *": "ask",
+      "pip install *": "ask",
+      "pip3 install *": "ask",
+      "brew install *": "ask",
+      "brew uninstall *": "ask",
       "rm *": "ask",
       "/bin/rm *": "ask",
       "rmdir *": "ask",