SecurityValidator silently a no-op since v4.x — restore patterns.example.yaml shipping AND make yaml resolvable from ~/.pai/hooks/

[virtualian]

Finding

While fixing #156 (yaml import warning), discovered that SecurityValidator has been silently fail-open since the v3.0 → v4.x refactor.

Root causes

Two independent regressions, both must be fixed for the validator to function:

1. yaml package not resolvable from ~/.pai/hooks/. PR SecurityValidator hook fires PreToolUse:Read error: missing 'yaml' package in ~/.pai/ #156 silences the import-time crash via lazy dynamic import + try/catch fail-open, but parseYaml permanently resolves to null because Bun resolves dynamic imports relative to the script file. From ~/.pai/hooks/, await import('yaml') rejects regardless of cwd. The hook always returns the empty fail-open config.

2. patterns.example.yaml no longer ships. The file exists only in older releases (Releases/v2.3/, v2.4/, v2.5/, v3.0/). It was dropped from Releases/v4.0.3+/. Even if yaml were resolvable, loadPatterns() would still fall through to the no-patterns fail-open branch.

Net effect

For every PreToolUse:Bash, PreToolUse:Read, PreToolUse:Edit, PreToolUse:Write call:

• The hook executes
• loadPatterns() returns the permissive empty config
• validateBashCommand() and validatePath() always return { action: 'allow' }
• No commands are blocked, no paths are protected, no security events are logged

All blocked-pattern, zero-access-path, and confirm-pattern protections are inactive.

Required changes

• (a) Make yaml resolvable from ~/.pai/hooks/ — likely add ~/.pai/package.json declaring yaml as a dep + bun install step in the PAI installer, OR bundle yaml into the hook via bun build.
• (b) Restore patterns.example.yaml under Releases/v4.0.3+/.claude/PAISECURITYSYSTEM/ (or wherever codePath('PAI', 'PAISECURITYSYSTEM', 'patterns.example.yaml') resolves to in the v4 layout) and have the installer copy it to the live runtime.
• (c) Add a verification ISC: pattern matching actually triggers on a known-blocked test input (e.g. rm -rf / returns exit 2, ~/.ssh Read returns exit 2).

Severity

Medium-to-high. Users on PAI v4.0.3+ may believe SecurityValidator is protecting them when it isn't. No live exploit known, but the documented blocked/zeroAccess/noDelete protections silently do nothing.

References

• SecurityValidator hook fires PreToolUse:Read error: missing 'yaml' package in ~/.pai/ #156 (the visible-warning fix that surfaced this)
• Last shipping copy of patterns.example.yaml: Releases/v3.0/.claude/skills/PAI/PAISECURITYSYSTEM/patterns.example.yaml