@mortz.prk/opencode-auto-mode 0.1.3 → 1.0.1

package/README.md

@@ -1,162 +1,206 @@
 # OpenCode Auto Mode
 
-## What this solves
+Reviews OpenCode permission prompts automatically. OpenCode decides what needs
+approval; the plugin reviews only `ask` actions.
 
-OpenCode's permission prompts can interrupt routine work. This plugin reviews actions automatically and returns **allow**, **deny**, or **ask**, leaving uncertain decisions to you. Combine built-in checks, your own CEL rules, decision providers, and an LLM reviewer to choose how approvals work.
+## Install and configure
 
-This is an independently maintained project for OpenCode v2 (`@opencode/plugin` 2.0). **Review applies to all agents by default**, including Build and Plan. An Auto agent is optional; adding one does not limit review unless you also configure `options.agents`.
+Add this to `~/.config/opencode/opencode.jsonc`. It asks for permission on every
+action and reviews those requests using built-in checks. No model or API key is
+needed:
 
-## Install from npm
-
-The public npm package is `@mortz.prk/opencode-auto-mode`.
+```jsonc
+{
+  "$schema": "https://opencode.ai/config.json",
+  "permissions": [
+    { "action": "*", "resource": "*", "effect": "ask" }
+  ],
+  "plugins": [
+    {
+      "package": "@mortz.prk/opencode-auto-mode",
+      "options": {
+        "classifiers": [
+          { "type": "static" }
+        ]
+      }
+    }
+  ]
+}
+```
 
-Add the plugin to your global `~/.config/opencode/opencode.jsonc` using an example below. OpenCode installs the package from npm; no login, registry configuration, or separate project dependency is needed. Restart the service after changing plugins:
+Restart OpenCode after saving:
 
 ```sh
 opencode service restart
 ```
 
-## Configuration examples
+There is no default review pipeline, and empty options are invalid. Add at least
+one review entry. Built-in checks deny dangerous shell commands, allow common
+read-only commands, and send other parsed commands to the configured reviewers.
+Dynamic syntax such as command substitution, nested shells, and stateful builtins
+still requires manual approval.
 
-### Built-in checks followed by an LLM
+The snippets below change parts of that configuration; keep your `classifiers`
+list when adding other options.
 
-This reviews **all agents** because `agents` is omitted. Built-in checks allow supported read-only commands such as `pwd` and block known dangerous shell operations. Other supported actions go to the LLM using OpenCode's default model; uncertain decisions require manual approval.
+## Add a typed decision model
 
-```json
+```jsonc
 {
-  "plugins": [
-    {
-      "package": "@mortz.prk/opencode-auto-mode",
-      "options": {
-        "review": "all"
-      }
-    }
-  ]
+  "options": {
+    "classifiers": [
+      { "type": "static" },
+      { "type": "decision", "model": "typesafe-ai/jev-latest" }
+    ]
+  }
 }
 ```
 
-Set `options.model` to `{ "id": "your-model", "providerID": "your-provider" }` to select the reviewer model. `review: "all"` reviews eligible actions even when OpenCode would allow them; `review: "prompts"` reviews only actions already requiring approval. OpenCode's explicit denies remain authoritative.
+| Provider | Setup |
+| --- | --- |
+| `typesafe-ai` | Set `TYPESAFE_API_KEY`. |
+| `openai` | Set `OPENAI_API_KEY`. |
+| `laya` | Run a loopback `/v1/systemone` service. `LAYA_API_KEY` is optional. |
+
+Decision entries accept `minConfidence` (default `0.9`), `timeoutMs`, and
+`apiKeyEnv`. `laya` also accepts `endpoint`.
 
-### Static checks and your own rules, without a model
+## Add an LLM
 
-This also reviews **all agents**. `pwd` passes the static checks, `git status --short` matches the exact CEL allow rule, `curl` matches the deny rule, and edits or writes require your approval. Unmatched actions require manual approval because there is no model stage.
+Add an `llm` entry after the built-in checks:
 
-```json
+```jsonc
 {
-  "plugins": [
-    {
-      "package": "@mortz.prk/opencode-auto-mode",
-      "options": {
-        "review": "all",
-        "classifier": {
-          "stages": [
-            { "type": "static" },
-            {
-              "type": "rules",
-              "rules": [
-                {
-                  "expression": "action == 'shell' && command == 'git' && args == ['status', '--short']",
-                  "decision": "allow"
-                },
-                {
-                  "expression": "action == 'shell' && command == 'curl'",
-                  "decision": "deny"
-                },
-                {
-                  "expression": "action in ['edit', 'write']",
-                  "decision": "ask"
-                }
-              ]
-            }
-          ]
-        }
-      }
-    }
-  ]
+  "options": {
+    "classifiers": [
+      { "type": "static" },
+      { "type": "llm" }
+    ]
+  }
 }
 ```
 
-Rules use [Buf's CEL evaluator](https://github.com/bufbuild/cel-es). Available variables are `action`, `resource`, `command`, `args`, `agent`, `projectDir`, and `isDelegation`. For shell resources, `command` is the literal executable and `args` contains its decoded arguments. Every resource must be covered by allow rules within a rules stage. Matching deny rules take precedence across stages, followed by ask rules, before any allow decision. Collection macros are disabled; invalid expressions or evaluation limits require manual approval.
+When an `llm` entry has no `model`, the **session model** is used. To choose a
+different model:
 
-Shell review uses OpenCode's subcommand parsing and a literal-command guard. A permitted `pwd` does not authorize the rest of `pwd ; sudo rm -rf`; the dangerous operation is denied. Unsupported syntax, such as redirects or substitutions, and Windows shells require manual approval.
+```jsonc
+{ "type": "llm", "model": "anthropic/claude-sonnet-4-5" }
+```
 
-### Decision providers with an LLM fallback
+## Combine reviewers
 
-This reviews **all agents** too. Static checks run first, followed by Jev, OpenAI Decisions, local Laya, and an LLM. Remove or reorder provider stages to suit your setup; you do not need all of them.
+Entries run in order. Add as many as you need:
 
-```json
+```jsonc
 {
-  "plugins": [
-    {
-      "package": "@mortz.prk/opencode-auto-mode",
-      "options": {
-        "review": "all",
-        "classifier": {
-          "stages": [
-            { "type": "static" },
-            { "type": "jev", "minConfidence": 0.9 },
-            { "type": "openai-decision", "minConfidence": 0.9 },
-            { "type": "laya", "endpoint": "http://127.0.0.1:8000/v1/systemone" },
-            { "type": "llm" }
-          ]
-        }
-      }
-    }
-  ]
+  "options": {
+    "classifiers": [
+      { "type": "static" },
+      { "type": "decision", "model": "typesafe-ai/jev-latest" },
+      { "type": "llm" }
+    ]
+  }
 }
 ```
 
-| Stage | Setup |
-| --- | --- |
-| `jev` | Set `TYPESAFE_API_KEY`; default model is `jev-latest`. |
-| `openai-decision` | Set `OPENAI_API_KEY`; default model is `gpt-6-luna`. |
-| `laya` | Run a compatible local `/v1/systemone` service; optionally set `LAYA_API_KEY`. Only loopback endpoints are accepted. |
-| `llm` | Uses OpenCode's default model, or the configured reviewer model. |
-
-A valid provider allow/deny result below `minConfidence` continues to the next stage. An explicit ask, provider error, timeout, or invalid response requires manual approval and stops the pipeline. Export API keys in the environment of the OpenCode service. Provider stages also accept `model`, `apiKeyEnv`, and `timeoutMs`.
+An entry can allow, deny, or ask, which stops the pipeline. If it abstains or
+fails, the next entry runs. If nothing decides, the action remains `ask`.
 
-## Tips: an optional Auto agent
+## Use it for specific agents
 
-Add an Auto agent if you want a separate agent for automatic review, then restrict the plugin with `options.agents: ["auto"]`. **Only this example limits review to Auto**; Build, Plan, and other agents retain their normal OpenCode permission behavior.
+OpenCode allows everything by default. To review only the `build` agent, set its
+permissions and leave global permissions unchanged:
 
-```json
+```jsonc
 {
   "agents": {
-    "auto": {
-      "mode": "primary",
-      "description": "Build with automatic permission review"
+    "build": {
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "ask" }
+      ]
     }
-  },
-  "plugins": [
-    {
-      "package": "@mortz.prk/opencode-auto-mode",
-      "options": {
-        "review": "all",
-        "agents": ["auto"]
+  }
+}
+```
+
+## TUI indicator
+
+A passive indicator shows when the plugin is reviewing the current session.
+It is enabled by default. Set `tui: false` in plugin options to hide it.
+Invalid options show `auto-mode: invalid config` in the same place and an error
+toast at startup. OpenCode's own permission dialog handles manual approvals.
+
+## Review options
+
+Each LLM or typed decision reviewer can have its own policy:
+
+```jsonc
+{
+  "options": {
+    "classifiers": [
+      {
+        "type": "llm",
+        "policy": {
+          "trusted": ["the repository and its CI configuration"],
+          "blocks": ["publish packages", "change production infrastructure"],
+          "exceptions": ["run the repository's test and lint scripts"]
+        }
       }
-    }
-  ]
+    ]
+  }
 }
 ```
 
-Select Auto alongside Build and Plan. To review all agents while keeping Auto available, omit `options.agents`.
+`trusted` describes the trusted boundary, `blocks` describes actions to deny, and
+`exceptions` describes narrow acceptable cases. Omitted lists use the built-in
+policy; an empty list clears that list. Policies are independent between
+reviewers and do not apply to static checks or replace OpenCode permissions.
 
-Keep ordinary OpenCode permission rules requiring approval for sensitive actions so prompts remain available when the plugin is disabled. `trusted`, `blocks`, and `exceptions` replace the corresponding model-review policy lists. Configure these globally. The TUI integration shows review status and provides manual allow/deny commands.
+## Auditing
 
-## Publishing releases
+Enable the audit log in plugin options:
 
-Open **Actions → Release npm package → Run workflow**, select `main`, choose `patch`, `minor`, or `major` (default: `patch`), and run it. This manual workflow runs tests, lint, and typecheck, increments `package.json`, checks the package, commits and tags the version, publishes to npm, and creates an immutable GitHub release with generated notes.
+```jsonc
+{
+  "options": {
+    "auditLog": true
+  }
+}
+```
 
-The same release can be started with one command:
+Decisions are appended as JSON lines to
+`$XDG_STATE_HOME/opencode-auto-mode/decisions.jsonl`. Replay recorded tool calls
+without executing anything:
 
 ```sh
-gh workflow run publish.yml --repo mortezaPRK/opencode-auto-mode --ref main -f bump=patch
+bun scripts/replay.ts [--days 14] [--session ID] [--agent build|any] [--json]
+```
+
+To send decisions through OpenCode's OTLP telemetry, configure OTLP for OpenCode
+with its standard environment variables, then enable the plugin flag. This sends
+correlated decision logs and review traces, including model reviewer attempts:
+
+```jsonc
+{
+  "options": {
+    "otlp": true
+  }
+}
 ```
 
-Publishing uses the existing [npm trusted publisher](https://docs.npmjs.com/trusted-publishers/) for GitHub owner `mortezaPRK`, repository `opencode-auto-mode`, and workflow filename `publish.yml`. No npm token or additional personal access token is needed in repository secrets.
+## Development
 
-GitHub release immutability is enabled in the repository settings. Releases and tags do not trigger publication; only running this workflow does.
+```sh
+bun install
+bun test
+bun run lint
+bun run typecheck
+bun run test:integration
+```
 
 ## Credit
 
-Created originally by [Andrew Mellen (mellena1)](https://github.com/mellena1) in [mellena1/opencode-auto-mode](https://github.com/mellena1/opencode-auto-mode), also credited as the author in [package.json](package.json). This independent project retains the original [MIT license](LICENSE).
+Created originally by [Andrew Mellen (mellena1)](https://github.com/mellena1) in
+[mellena1/opencode-auto-mode](https://github.com/mellena1/opencode-auto-mode),
+also credited as the author in [package.json](package.json). This independent
+project retains the original [MIT license](LICENSE).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mortz.prk/opencode-auto-mode",
-  "version": "0.1.3",
+  "version": "1.0.1",
   "description": "Configurable automatic permission review for OpenCode v2.",
   "author": {
     "name": "Andrew Mellen",
@@ -36,9 +36,10 @@
     "test:integration": "bun run integration/opencode.ts"
   },
   "dependencies": {
-    "@bufbuild/cel": "0.6.1",
-    "@bufbuild/protobuf": "2.16.0",
+    "@opencode/ai": "2.0.30",
     "@opencode/plugin": "^2.0.14",
+    "@opencode/schema": "^2.0.30",
+    "effect": "4.0.1",
     "shell-quote": "1.12.0"
   },
   "peerDependencies": {
@@ -49,9 +50,9 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@opencode/theme": "^2.0.14",
-    "@opentui/core": "0.5.17",
-    "@opentui/keymap": "^0.5.10",
-    "@opentui/solid": "0.5.17",
+    "@opentui/core": "0.6.6",
+    "@opentui/keymap": "^0.6.6",
+    "@opentui/solid": "0.6.6",
     "@types/node": "^26.6.4",
     "@types/shell-quote": "1.7.5",
     "@typescript/native": "npm:typescript@^7.0.2",

package/src/audit.ts

@@ -0,0 +1,61 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+export interface AuditRecord {
+  ts: string;
+  reviewID: string;
+  sessionID: string;
+  agent?: string;
+  action: string;
+  resources: string[];
+  hostEffect: string;
+  decision: string;
+  stage: string;
+  reason: string;
+  durationMs: number;
+  error?: boolean;
+  errorDetail?: string;
+  traceID?: string;
+  spanID?: string;
+}
+
+export interface AuditLog { write(record: AuditRecord): void }
+
+const MAX_BYTES = 10 * 1024 * 1024;
+const MAX_RESOURCES = 16;
+const MAX_RESOURCE_CHARS = 512;
+const MAX_REASON_CHARS = 512;
+
+export function defaultAuditPath(): string {
+  const base = process.env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
+  return path.join(base, "opencode-auto-mode", "decisions.jsonl");
+}
+
+function clip(value: string, max: number): string {
+  return value.length > max ? `${value.slice(0, max - 1)}…` : value;
+}
+
+export function createAuditLog(setting: boolean | string | undefined): AuditLog | undefined {
+  if (setting === undefined || setting === false) return undefined;
+  const file = typeof setting === "string" ? setting : defaultAuditPath();
+  return {
+    write(record) {
+      let fd: number | undefined;
+      try {
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        try { if (fs.statSync(file).size > MAX_BYTES) fs.renameSync(file, `${file}.1`); } catch { /* no file yet */ }
+        fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | fs.constants.O_NOFOLLOW, 0o600);
+        const safe: AuditRecord = {
+          ...record,
+          resources: record.resources.slice(0, MAX_RESOURCES).map((resource) => clip(resource, MAX_RESOURCE_CHARS)),
+          reason: clip(record.reason, MAX_REASON_CHARS),
+          ...(record.errorDetail === undefined ? {} : { errorDetail: clip(record.errorDetail, MAX_REASON_CHARS) }),
+        };
+        fs.writeSync(fd, `${JSON.stringify(safe)}\n`);
+      } catch {
+        // Auditing is best effort and must not interrupt permission review.
+      } finally { if (fd !== undefined) fs.closeSync(fd); }
+    },
+  };
+}

package/src/classifier.ts

@@ -1,53 +1,42 @@
 import { classify } from "./tiers.js";
 import type { ClassifierStage } from "./config.js";
-import type { PermissionRequest, ReviewResult } from "./reviewer.js";
-import { evaluateRules, type RuleMatch } from "./rules.js";
+import type { PermissionRequest, ReviewResult, StageResult } from "./reviewer.js";
 import { guardShell } from "./shell.js";
 
-function ruleDecision(matches: RuleMatch[]): ReviewResult | undefined {
-  for (const decision of ["deny", "ask"] as const) {
-    if (matches.some((match) => match.rule.decision === decision && match.any))
-      return { decision, reason: `user rule: ${decision}` };
-  }
-  if (matches[0]?.coverage.length && matches[0].coverage.every((_, index) =>
-      matches.some((match) => match.rule.decision === "allow" && match.coverage[index])))
-    return { decision: "allow", reason: "all resources match CEL allow rules" };
-  return undefined;
-}
-
 export async function compositeDecision(
   stages: ClassifierStage[],
   request: PermissionRequest,
-  review: (stage: Exclude<ClassifierStage, { type: "static" } | { type: "rules" }>) => Promise<ReviewResult | undefined>,
+  review: (stage: Exclude<ClassifierStage, { type: "static" }>) => Promise<StageResult>,
 ): Promise<ReviewResult> {
   const shellResult = request.action === "shell" ? guardShell(request.resources) : undefined;
-  if (shellResult?.decision === "deny") return shellResult;
+  if (shellResult?.decision === "deny") return { ...shellResult, stage: "shell-guard" };
   for (const stage of stages) {
     if (stage.type !== "static") continue;
     const result = classify(request.action, request.resources);
-    if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason };
+    if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason, stage: "static" };
   }
-  let matches: RuleMatch[];
-  try { matches = await evaluateRules(stages.flatMap((stage) => stage.type === "rules" ? stage.rules : []), request); }
-  catch { return { decision: "ask", reason: "CEL rule evaluation failed; please decide yourself" }; }
-  for (const decision of ["deny", "ask"] as const) {
-    const result = ruleDecision(matches.filter((match) => match.rule.decision === decision));
-    if (result) return result;
+  if (shellResult) {
+    // Parsed read-only results feed the static stage, but never bypass a model-only pipeline.
+    const hasStatic = stages.some((stage) => stage.type === "static");
+    if (shellResult.decision !== "allow" || hasStatic)
+      return { ...shellResult, stage: shellResult.decision === "allow" ? "static" : "shell-guard" };
   }
-  if (shellResult) return shellResult;
+  let abstained: string | undefined;
   for (const stage of stages) {
     if (stage.type === "static") {
       const result = classify(request.action, request.resources, {
         projectDir: request.projectDir, allowInProjectEdits: stage.allowInProjectEdits,
       });
-      if (result.tier === "auto-allow") return { decision: "allow", reason: result.reason };
-    } else if (stage.type === "rules") {
-      const result = ruleDecision(matches.filter((match) => stage.rules.includes(match.rule)));
-      if (result) return result;
+      if (result.tier === "auto-allow") return { decision: "allow", reason: result.reason, stage: "static" };
     } else {
       const result = await review(stage);
-      if (result) return result;
+      if (result.decision === "abstain") { abstained = result.reason; continue; }
+      return { decision: result.decision, reason: result.reason, stage: result.stage ?? stage.type };
     }
   }
-  return { decision: "ask", reason: "No classifier made a decision" };
+  return {
+    decision: "ask",
+    reason: abstained ? `No classifier made a decision (${abstained})` : "No classifier made a decision",
+    stage: "none",
+  };
 }