v0.5.0: config + security defaults (final epic — gaps #9 + #10)

[rz1989s]

v0.5.0 — Config + Security Defaults (FINAL epic)

Closes PRD gaps #9 (security posture) + #10 (workflow-fit defaults). Completes the 5-epic roadmap (4/5 → 5/5). All 10 PRD gaps closed.

SPEC-5 + PLAN-5 (resolved 7 implementation unknowns against pi's verified extension API).

What ships

Gap #9 — Security posture:

• Audit log (lib/audit.ts): every delegation (success, cache hit, fallback, failure) appended to ~/.pi/agent/vision-audit.log as one JSONL line (ts/provider/model/image_path/source_hash/cached/fallback/ok/error_code/latency_ms/local_only). Privacy stance: never logs image bytes or the full prompt — source_hash is a one-way fingerprint; data:URL/base64 image_path truncated. Default ON (opt-out security posture). One entry per delegation via the delegate.ts chokepoint (batch = N entries). /vision audit <clear|show|path|on|off>.
• Local-only mode (config.localOnly): image bytes never leave the machine. Structural guarantee — the network-call code path is never entered on a cache miss (gate at delegate.ts:317, before callWithRetryAndFallback:335). Cache hits still work (cache is local). Paste auto mode short-circuits to hint (no autoDelegateTimeoutMs burned). Every event audited with local_only: true (greppable proof). /vision local-only [on|off].
• Explicit provider routing: already satisfied by v0.2.x; the audit log makes it auditable.

Gap #10 — Workflow-fit defaults:

• Auto-detect (lib/defaults.ts): at session_start, when provider+model are both unset (fresh config), detects from models.json — prefers Ollama provider's vision models (AGENTS.md "Ollama Cloud primary") + first non-Ollama vision model as fallback (frontier escalation). Persists once (user sees + can override; /vision clear re-triggers). Verified the registry is populated before session_start fires (agent-session.js:1737, getAvailable() synchronous).
• Config migration from pi-paster: documented, not built (pi-paster has no configurable vision model; markerStyle is a superset).

Config (4 new fields → 22 total)

auditLog (default true), auditLogPath (default undefined), localOnly (default false), autoDetectVisionModel (default true). Forward-compat: a v0.4.0 config loads with the 4 new fields defaulted.

Key design: unified network path (PLAN-5 §1.6)

Refactored delegateToVisionModel's two cache branches into a single network path — behavior-preserving (T47 + T55 assert v0.4.0 semantics intact) + gives one insertion point for the local-only gate + the audit entry.

Tests

• 350 tests pass (286 v0.4.0 baseline + 64 new). Typecheck clean. TDD, one commit per feature (8 commits).
• Critical gates: T54 (audit basic), T57/T58 (local-only cache hit/miss — zero network calls), T59 (paste local-only short-circuit), T61/T62 (auto-detect Ollama primary + frontier fallback), T70 (regression gate).
• Audit boundary verified: pre-flight errors are NOT audited (they fire before image load + before any routing decision).
• Audit concurrency verified (T68): 10 parallel appends → 10 distinct lines, no corruption.

Constraints

• Clean-room (no copied lines from pi-vision-tool / pi-paster).
• No AI attribution.
• lib/audit.ts + lib/defaults.ts stateless pure (no globalThis needed).

EVAL

Real-pi EVAL (Ghostty + tmux) deferred to RECTOR after merge + /reload (fresh session after /vision clear → auto-detect; /vision local-only on → new image errors, cached returns; /vision audit show → JSONL tail).