mirror of
https://bitbucket.org/siakitem/my-pi.git
synced 2026-10-26 10:45:22 +00:00
云服务部-叶林立andDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
7e6a8faae1
AutoReview： - 审查器回到 Codex Guardian 风格的对话式审查，默认跟随会话当前主模型 （每次审查实时读取 ctx.model）；provider/model 必须同时设置才固定审查 模型，只设其一视为配置错误并转人工。 - 结论只通过 approve / reject 两个工具给出，参数仅 reason；不强制 toolChoice，正文文本（即使是合法 JSON）一律忽略。 - approve 自动放行；reject 转人工并在弹窗显示理由（标注模型生成）。 超时、Provider 错误、截断、未调用工具、多次调用、参数无效等异常同样 转人工，并附固定的系统说明；用户按 Esc 中止时直接拒绝。 - 模型调用改为 modelRegistry.streamSimple(...).result()：Pi 1.3.0 面向 扩展的 ModelRegistry 没有 completeSimple，原写法在真实环境中每次都会 转人工。 - 对话记录保留可信度标注；工具结果在有更短的 pi-compaction 摘要时替换 为摘要；token 估算改为非 ASCII 字符按 1 token 计；预算可配置。 - 同一条用户消息内完全相同的请求只缓存 approve 结论。 - 默认 reasoning low、总超时 30 秒、最多 2 次尝试、maxOutputTokens 4000。 删除： - 未发布过的 TypeSafe Jev 分类器实现、DenialCircuitBreaker。 - 整个 annotator 机制（model-explanation、注册表、registerAnnotator、 provider-timeout）；annotators 配置键保留为已弃用并忽略，避免旧配置 被拒绝。 测试： - 新增 reviewer / transcript / 弹窗说明 / 默认配置测试；清理重复、恒真 或只测实现细节的旧测试。 - 使用 deepseek-v4.1-flash 实测 5 个场景各 5 次，25 次结论全部符合预期。 Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
333 lines
17 KiB
JSON
333 lines
17 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/gotgenes/pi-packages/main/packages/pi-permission-system/schemas/permissions.schema.json",
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"description": "JSON Schema URI for editor autocomplete and validation.",
|
|
"type": "string"
|
|
},
|
|
"debugLog": {
|
|
"description": "Write verbose permission-system diagnostics to the extension logs directory.",
|
|
"markdownDescription": "Write verbose permission-system diagnostics to `logs/pi-permission-system-debug.jsonl` under the extension config directory.",
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"permissionReviewLog": {
|
|
"description": "Write permission request and decision audit events to the extension logs directory.",
|
|
"markdownDescription": "Write permission request and decision audit events to `logs/pi-permission-system-permission-review.jsonl` under the extension config directory.",
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"yoloMode": {
|
|
"description": "Auto-approve ask-state permission checks, including subagent approval forwarding.",
|
|
"markdownDescription": "Auto-approve `ask`-state permission checks, including subagent approval forwarding.\n\n⚠️ **Use with caution** — this disables all interactive confirmation prompts.",
|
|
"default": false,
|
|
"type": "boolean"
|
|
},
|
|
"doublePressToConfirm": {
|
|
"description": "Require a confirming second press of a decision hotkey in the inline permission dialog. Applies to TUI sessions only.",
|
|
"markdownDescription": "Require a confirming second press of a decision hotkey (`y`/`s`/`n`/`r`) in the inline permission dialog before it commits — the first press arms the action and shows a `Press y again to approve.` hint.\n\nApplies to interactive **TUI** sessions only; the non-TUI (RPC/frontend) prompt keeps its single-select flow. Set to `false` to commit decisions on the first hotkey press.",
|
|
"default": true,
|
|
"type": "boolean"
|
|
},
|
|
"forwardingTimeoutMs": {
|
|
"description": "How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds. Omit to use the default (600000, ten minutes).",
|
|
"markdownDescription": "How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds.\n\nOmit to use the default (`600000`, ten minutes). A child whose in-process parent is not draining its inbox at all gives up in a couple of seconds regardless of this value, so lower it only to bound how long you are willing to leave an *unanswered* prompt pending.",
|
|
"default": 600000,
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"promptMaxRows": {
|
|
"description": "Maximum rows a permission prompt renders before eliding its evidence. Omit to use the default (24).",
|
|
"markdownDescription": "Maximum rows a permission prompt renders before eliding its evidence.\n\nOmit to use the default (24). The request's own facts — the requesting agent, the tool, the matched rule, the decision-relevant value — are never elided by this budget; what gives way is the supporting evidence, and `Ctrl+O` expands the prompt to the complete request.",
|
|
"default": 24,
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"promptFieldMaxWidth": {
|
|
"description": "Maximum characters of any one field shown in a permission prompt. Omit to use the default (400).",
|
|
"markdownDescription": "Maximum characters of any one field shown in a permission prompt.\n\nOmit to use the default (400). This is what bounds a single pathological field — a long here-string command, say — that would otherwise fill the prompt through wrapping. A shortened field is marked with an ellipsis, and `Ctrl+O` shows it in full.",
|
|
"default": 400,
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"reviewLogFieldMaxWidth": {
|
|
"description": "Maximum characters of any one value written to the permission review log. Omit to use the default (1000).",
|
|
"markdownDescription": "Maximum characters of any one value written to the permission review log.\n\nOmit to use the default (1000). Every string the review log writes is narrowed to this width and marked with an ellipsis, so the log's growth is a decision you make rather than a side effect of how long a command happened to be. Raise it to keep longer values — a bash command exceeding the width is stored shortened.\n\nThis is a length bound, not redaction: it never inspects a value to decide what to hide. Key-name masking is unchanged and applies independently.",
|
|
"default": 1000,
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"toolInputPreviewMaxLength": {
|
|
"deprecated": true,
|
|
"description": "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one preview. Still accepted so an existing config is not rejected; remove it.",
|
|
"markdownDescription": "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one preview inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"toolTextSummaryMaxLength": {
|
|
"deprecated": true,
|
|
"description": "Deprecated and ignored. Superseded by promptMaxRows and promptFieldMaxWidth, which bound the whole prompt rather than one summary. Still accepted so an existing config is not rejected; remove it.",
|
|
"markdownDescription": "**Deprecated and ignored.** Superseded by `promptMaxRows` and `promptFieldMaxWidth`, which bound the whole permission prompt rather than one summary inside it.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"authorizerChain": {
|
|
"description": "Ordered names of registered live-authority chain links to consult before the terminal authorizer. Config order (not registration order) fixes the chain order; an unregistered name is skipped fail-safe (more prompting, never less); a link decides nothing until it is named here.",
|
|
"markdownDescription": "Ordered names of registered **live-authority chain links** (for example AutoReview) to consult before the terminal human authorizer. A named link may approve or deny any ordinary-policy `ask`, including `path`; `defer` advances to the next link or the human terminal. Defaults to an empty list.",
|
|
"default": [],
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"permission": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "A surface name or the universal fallback key '*'."
|
|
},
|
|
"additionalProperties": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/permissionState"
|
|
},
|
|
{
|
|
"$ref": "#/$defs/permissionMap"
|
|
}
|
|
]
|
|
},
|
|
"description": "Flat permission policy. Each key is a surface name; values are a PermissionState string (catch-all) or a pattern→action map.",
|
|
"markdownDescription": "Flat permission policy.\n\nEach top-level key is a surface name:\n- `\"*\"` — universal fallback\n- Tool names (`read`, `write`, `bash`, `mcp`, `skill`, `path`, etc.)\n\nA string value is shorthand for `{ \"*\": action }`. An object maps wildcard patterns to actions, and the most specific matching pattern wins.\n\nFor built-in file tools, patterns match `input.path`. The cross-cutting `path` surface checks path-bearing tools and bash path tokens.\n\n**Merge order (lowest → highest precedence):** global → per-agent frontmatter → project-agent frontmatter.",
|
|
"examples": [
|
|
{
|
|
"*": "ask",
|
|
"path": {
|
|
"*": "allow",
|
|
"*.env": "deny",
|
|
"*.env.*": "deny",
|
|
"*.env.example": "allow"
|
|
},
|
|
"read": "allow",
|
|
"write": "deny",
|
|
"edit": "deny",
|
|
"bash": {
|
|
"*": "ask",
|
|
"git *": "ask",
|
|
"git status": "allow",
|
|
"git diff": "allow"
|
|
},
|
|
"mcp": {
|
|
"*": "ask",
|
|
"mcp_status": "allow",
|
|
"exa:*": "allow"
|
|
},
|
|
"skill": {
|
|
"*": "ask",
|
|
"librarian": "allow"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"autoReview": {
|
|
"description": "Built-in model-assisted reviewer used for static-policy review decisions.",
|
|
"type": "object",
|
|
"properties": {
|
|
"enabled": {
|
|
"type": "boolean"
|
|
},
|
|
"provider": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"model": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"reasoning": {
|
|
"type": "string",
|
|
"enum": [
|
|
"off",
|
|
"minimal",
|
|
"low",
|
|
"medium",
|
|
"high",
|
|
"xhigh",
|
|
"max"
|
|
]
|
|
},
|
|
"timeoutMs": {
|
|
"type": "integer",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 300000
|
|
},
|
|
"maxAttempts": {
|
|
"type": "integer",
|
|
"minimum": 1,
|
|
"maximum": 5
|
|
},
|
|
"maxOutputTokens": {
|
|
"type": "integer",
|
|
"minimum": 256,
|
|
"maximum": 32000
|
|
},
|
|
"transcript": {
|
|
"type": "object",
|
|
"properties": {
|
|
"messageTokens": {
|
|
"type": "integer",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"toolTokens": {
|
|
"type": "integer",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 9007199254740991
|
|
},
|
|
"maxUntrustedEntries": {
|
|
"type": "integer",
|
|
"exclusiveMinimum": 0,
|
|
"maximum": 9007199254740991
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"annotators": {
|
|
"deprecated": true,
|
|
"description": "Deprecated and ignored. The annotator mechanism was removed; still accepted so an existing config is not rejected. Remove it.",
|
|
"markdownDescription": "**Deprecated and ignored.** The annotator mechanism was removed together with the `model-explanation` annotator.\n\nStill accepted so an existing config is not rejected fail-closed, but the value no longer takes effect. Remove it.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"shellTools": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "A non-bash tool name that carries shell semantics."
|
|
},
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": {
|
|
"commandArgument": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "The name of the tool's input argument holding the shell command string (e.g. 'cmd')."
|
|
},
|
|
"workdirArgument": {
|
|
"description": "Optional name of the tool's input argument holding the working directory (e.g. 'workdir').",
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"decisionFloor": {
|
|
"description": "Require every invocation of this shell alias to be reviewed at least as an ask; deny remains deny.",
|
|
"markdownDescription": "Sets the minimum review decision for this alias. `allow` results from Bash policy are raised to `ask`, while existing `ask` and `deny` results are preserved. Only `\"ask\"` is accepted so a project override cannot weaken a global floor.",
|
|
"type": "string",
|
|
"const": "ask"
|
|
}
|
|
},
|
|
"required": [
|
|
"commandArgument"
|
|
],
|
|
"additionalProperties": false,
|
|
"description": "Maps one shell-aliased tool to the input arguments holding its command and optional working directory, plus an optional ask decision floor."
|
|
},
|
|
"description": "Maps non-bash tool names that carry shell semantics to the input arguments holding their command and working directory.",
|
|
"markdownDescription": "Records which non-`bash` tools carry shell semantics, mapping each tool name to the input argument holding its command (and optionally its working directory).\n\nUse this when an extension replaces the native `bash` tool under a different name — e.g. `@howaboua/pi-codex-conversion` registers `exec_command` with a `cmd` argument and an optional `workdir`. Recording the alias lets the permission system gate that tool through the same bash enforcement stack as native `bash` (command decomposition, wrapper flooring, path/external-directory token gates, and `bash:` rules).\n\nSet `decisionFloor` to `\"ask\"` when the wrapper crosses an additional trust boundary, such as SSH or container execution. Bash `allow` results are raised to `ask`; existing `ask` and `deny` results remain unchanged.\n\nExample:\n\n```json\n\"shellTools\": {\n \"exec_command\": { \"commandArgument\": \"cmd\", \"workdirArgument\": \"workdir\" },\n \"ssh_bash\": { \"commandArgument\": \"command\", \"decisionFloor\": \"ask\" }\n}\n```\n\n**Merge order:** merge each tool mapping by field across global → project. Project values can replace argument names, while a global `decisionFloor: \"ask\"` survives when the project entry omits it.",
|
|
"examples": [
|
|
{
|
|
"exec_command": {
|
|
"commandArgument": "cmd",
|
|
"workdirArgument": "workdir"
|
|
},
|
|
"ssh_bash": {
|
|
"commandArgument": "command",
|
|
"decisionFloor": "ask"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"additionalProperties": false,
|
|
"title": "PI Permission System Configuration",
|
|
"description": "Ordinary JSONC policy combining runtime knobs, AutoReview settings, and flat permission rules for pi-permission-system.",
|
|
"markdownDescription": "Global ordinary JSONC policy for [pi-permission-system](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-system).\n\nPlace at `~/.pi/agent/extensions/pi-permission-system/policy.jsonc`. Project-level policy files are not loaded. Global-only hard guards use the separate `hard-guards.jsonc` schema.",
|
|
"$defs": {
|
|
"permissionState": {
|
|
"anyOf": [
|
|
{
|
|
"type": "string",
|
|
"const": "allow",
|
|
"description": "Permit the action silently with no user interaction."
|
|
},
|
|
{
|
|
"type": "string",
|
|
"const": "deny",
|
|
"description": "Block the action with an error message. The agent is told not to retry."
|
|
},
|
|
{
|
|
"type": "string",
|
|
"const": "ask",
|
|
"description": "Prompt the user for confirmation via the interactive UI before proceeding."
|
|
}
|
|
],
|
|
"description": "A permission decision: allow (permit silently), deny (block with error), or ask (prompt the user for confirmation)."
|
|
},
|
|
"permissionMap": {
|
|
"type": "object",
|
|
"propertyNames": {
|
|
"type": "string",
|
|
"minLength": 1,
|
|
"description": "A non-empty pattern string. Use * for wildcard matching. Prefix with ~/ or $HOME/ for home-relative paths."
|
|
},
|
|
"additionalProperties": {
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/permissionState"
|
|
},
|
|
{
|
|
"$ref": "#/$defs/denyWithReason"
|
|
}
|
|
]
|
|
},
|
|
"description": "A map of wildcard patterns to permission states. The most specific matching pattern wins.",
|
|
"markdownDescription": "A map of wildcard patterns to permission states.\n\nUse `*` for wildcard matching. When several patterns match, the most specific pattern wins: exact patterns first, then more literal characters, fewer wildcards, and longer patterns. Declaration order is only the final tie-breaker, where the later rule wins.\n\nPattern keys support home directory expansion: `~/path` and `$HOME/path` expand at match time. The stored pattern is shown in logs and approval dialogs as written."
|
|
},
|
|
"denyWithReason": {
|
|
"type": "object",
|
|
"properties": {
|
|
"action": {
|
|
"type": "string",
|
|
"const": "deny",
|
|
"description": "The permission decision — must be \"deny\"."
|
|
},
|
|
"reason": {
|
|
"description": "Optional reason shown to the agent when this action is denied.",
|
|
"type": "string",
|
|
"maxLength": 500
|
|
}
|
|
},
|
|
"required": [
|
|
"action"
|
|
],
|
|
"additionalProperties": false,
|
|
"description": "Deny with an optional custom reason shown to the agent when the action is blocked."
|
|
}
|
|
}
|
|
}
|