@mortz.prk/opencode-auto-mode 0.1.3 → 1.0.1

package/src/transcript.ts

@@ -1,13 +1,19 @@
 const MAX_USERS = 10;
 const MAX_TOOLS = 20;
+const MAX_USER_CHARS = 8_000;
 const MAX_ENTRY_CHARS = 500;
-const MAX_TRANSCRIPT_CHARS = 6000;
+const MAX_TRANSCRIPT_BYTES = 12_000;
 
 interface ToolEntry {
   name: string;
   input: unknown;
 }
 
+interface Entry {
+  role: "user" | "tool";
+  text: string;
+}
+
 function truncate(value: string, max: number): string {
   return value.length > max ? `${value.slice(0, max - 1)}…` : value;
 }
@@ -42,30 +48,161 @@ function assistantTools(message: unknown): ToolEntry[] {
   return tools;
 }
 
-function formatTool(tool: ToolEntry): string {
+function formatTool(tool: ToolEntry): { text: string; truncated: boolean } {
   let detail = "";
+  let truncated = false;
   try {
     const state = asRecord(tool.input);
     const input = state?.["input"] ?? tool.input;
     const raw = typeof input === "string" ? input : JSON.stringify(input);
-    if (raw) detail = truncate(raw, MAX_ENTRY_CHARS);
+    if (raw) {
+      truncated = raw.length > MAX_ENTRY_CHARS;
+      detail = truncate(raw, MAX_ENTRY_CHARS);
+    }
   } catch {
     detail = "";
   }
-  return detail ? `${tool.name} ${detail}` : tool.name;
+  return { text: detail ? `${tool.name} ${detail}` : tool.name, truncated };
 }
 
-export function extractTranscript(messages: unknown[]): string {
-  const entries: { role: "user" | "tool"; text: string }[] = [];
-  for (const message of messages) {
-    const text = userText(message);
-    if (text !== undefined) entries.push({ role: "user", text: truncate(text, MAX_ENTRY_CHARS) });
-    for (const tool of assistantTools(message)) entries.push({ role: "tool", text: formatTool(tool) });
+function escapedSize(value: string): number {
+  return Buffer.byteLength(JSON.stringify(value));
+}
+
+function prefixByEscapedBytes(characters: string[], maxBytes: number): string {
+  let low = 0;
+  let high = characters.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (escapedSize(characters.slice(0, middle).join("")) <= maxBytes) low = middle;
+    else high = middle - 1;
+  }
+  return characters.slice(0, low).join("");
+}
+
+function suffixByEscapedBytes(characters: string[], maxBytes: number): string {
+  let low = 0;
+  let high = characters.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (escapedSize(characters.slice(characters.length - middle).join("")) <= maxBytes) low = middle;
+    else high = middle - 1;
   }
-  if (!entries.some((entry) => entry.role === "user")) return "(no prior user messages in this session)";
+  return characters.slice(characters.length - low).join("");
+}
+
+/** Clips the head and tail so escaping cannot hide a trailing constraint. */
+function clipEscaped(value: string, maxBytes: number): string {
+  if (escapedSize(value) <= maxBytes) return value;
+  const characters = Array.from(value);
+  const marker = "…";
+  const budget = Math.max(0, maxBytes - escapedSize(marker));
+  const headBudget = Math.floor(budget * 0.6);
+  return `${prefixByEscapedBytes(characters, headBudget)}${marker}${suffixByEscapedBytes(characters, budget - headBudget)}`;
+}
+
+function clipChars(value: string, max: number): string {
+  if (value.length <= max) return value;
+  const characters = Array.from(value);
+  const head = Math.floor(max * 0.6);
+  return `${characters.slice(0, head).join("")}…${characters.slice(characters.length - (max - head)).join("")}`;
+}
+
+interface TranscriptData {
+  transcript: string;
+  userEvidence: boolean;
+  missingUserText: boolean;
+  notes: string[];
+}
+
+function renderTranscript(entries: Entry[], toolTruncated: boolean, userClipped: boolean): { transcript: string; notes: string[] } {
+  if (!entries.some((entry) => entry.role === "user")) return { transcript: "(no prior user messages in this session)", notes: [] };
   let users = 0;
   let tools = 0;
   const recent = entries.slice().reverse().filter((entry) => entry.role === "user" ? ++users <= MAX_USERS : ++tools <= MAX_TOOLS).reverse();
-  const incomplete = recent.length < entries.length ? "\n… incomplete session context" : "";
-  return truncate(`User messages and prior tool calls (chronological):\n${JSON.stringify(recent)}${incomplete}`, MAX_TRANSCRIPT_CHARS);
+  const notes: string[] = [];
+  if (recent.length < entries.length) notes.push("older messages omitted");
+  if (toolTruncated) notes.push("some tool details truncated");
+  if (userClipped) notes.push("latest user message truncated");
+  const render = () => `User messages and prior tool calls (chronological):\n${JSON.stringify(recent)}` +
+    (notes.length ? `\n… partial session history (${notes.join("; ")})` : "");
+
+  while (Buffer.byteLength(render()) > MAX_TRANSCRIPT_BYTES && recent.length > 1) {
+    // Keep at least the latest user message.
+    const onlyOneUser = recent.filter((entry) => entry.role === "user").length <= 1;
+    const index = onlyOneUser && recent[0].role === "user" ? recent.findIndex((entry) => entry.role === "tool") : 0;
+    if (index < 0) break;
+    recent.splice(index, 1);
+    if (!notes.includes("older messages omitted")) notes.push("older messages omitted");
+  }
+
+  const latestUser = [...recent].reverse().find((entry) => entry.role === "user");
+  for (let attempt = 0; latestUser !== undefined && Buffer.byteLength(render()) > MAX_TRANSCRIPT_BYTES && attempt < 10; attempt++) {
+    if (!notes.includes("latest user message truncated")) notes.push("latest user message truncated");
+    const excess = Buffer.byteLength(render()) - MAX_TRANSCRIPT_BYTES;
+    latestUser.text = clipEscaped(latestUser.text, Math.max(128, escapedSize(latestUser.text) - excess - 64));
+  }
+  return { transcript: render(), notes };
+}
+
+function buildTranscript(messages: unknown[]): TranscriptData {
+  const entries: Entry[] = [];
+  let userEvidence = false;
+  let missingUserText = false;
+  let userClipped = false;
+  let toolTruncated = false;
+  for (const message of messages) {
+    const record = asRecord(message);
+    if (record?.type === "user") {
+      const text = userText(message);
+      if (text === undefined) {
+        missingUserText = true;
+        continue;
+      }
+      userEvidence = true;
+      const clipped = clipChars(text, MAX_USER_CHARS);
+      if (clipped !== text) userClipped = true;
+      entries.push({ role: "user", text: clipped });
+    }
+    for (const tool of assistantTools(message)) {
+      const formatted = formatTool(tool);
+      if (formatted.truncated) toolTruncated = true;
+      entries.push({ role: "tool", text: formatted.text });
+    }
+  }
+  const rendered = renderTranscript(entries, toolTruncated, userClipped);
+  return { transcript: rendered.transcript, userEvidence, missingUserText, notes: rendered.notes };
+}
+
+export interface ReviewContext { transcript: string; complete: boolean; reason?: string; notes?: string[] }
+
+export function extractReviewContext(messages: unknown[]): ReviewContext {
+  const attachment = messages.some((message) => {
+    const record = asRecord(message);
+    if (record?.type !== "user") return false;
+    // These attachments carry evidence that the text-only reviewer cannot see.
+    return ["files", "skills", "agents"].some((key) =>
+      Array.isArray(record[key]) && record[key].length > 0);
+  });
+  const data = buildTranscript(messages);
+  if (attachment)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "User authorization includes attachments that cannot be reviewed automatically",
+    };
+  if (data.missingUserText)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "A user message has no text that can be reviewed",
+    };
+  if (!data.userEvidence)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "No user authorization message is available",
+    };
+  return { transcript: data.transcript, complete: true, notes: data.notes };
+}
+
+export function extractTranscript(messages: unknown[]): string {
+  return buildTranscript(messages).transcript;
 }

package/src/tui-state.ts

@@ -0,0 +1,7 @@
+import type { DecisionRecord } from "./state.js";
+
+export function isReviewing(records: Record<string, DecisionRecord>, sessionID: string | undefined, now = Date.now()): boolean {
+  if (!sessionID) return false;
+  return Object.values(records).some((record) => record.sessionID === sessionID &&
+    record.decision === "reviewing" && now - record.at >= 0 && now - record.at < 90_000);
+}

package/src/tui.tsx

@@ -1,320 +1,48 @@
 /** @jsxImportSource @opentui/solid */
-import { createMemo, createSignal, Show, type JSX } from "solid-js";
+import { createSignal, Show } from "solid-js";
 import { Plugin } from "@opencode/plugin/tui";
-import type { Context } from "@opencode/plugin/tui/context";
-import type { ResolvedTheme } from "@opencode/theme/tui";
-import { readDecisions } from "./state.js";
+import { readConfigError, readDecisions } from "./state.js";
+import { isReviewing } from "./tui-state.js";
 
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-const MAX_RESOURCE = 48;
-const POLL_MS = 1_000;
-const STALE_MS = 90_000;
-
-type Pending = {
-  requestID: string;
-  sessionID: string;
-  action: string;
-  resource: string;
-  at: number;
-  escalated: boolean;
-};
-
-function str(value: unknown, fallback: string): string {
-  return typeof value === "string" && value.trim() ? value.trim() : fallback;
-}
-
-function truncate(value: string, max: number): string {
-  return value.length > max ? value.slice(0, max - 1) + "…" : value;
-}
-
-// `ctx.data.session.list()` is unreliable across betas: on 0.0.0-beta-17823
-// the host's session store memo never invalidates, so iterating sessions to
-// find pending permissions sees an empty list forever. Instead the badge is
-// fed by permission events plus the server plugin's decision file: tier-3
-// reviews run inside the evaluate hook BEFORE a permission request exists,
-// so "reviewing" records (synthetic IDs) create spinner entries, and the
-// permission.asked event that follows an escalation adopts the matching
-// entry so its spinner time carries over.
-function Badge(props: {
-  pending: () => Pending | undefined;
-  answer: (reply: "once" | "reject") => Promise<void>;
-  allowKey: string;
-  denyKey: string;
-  keymap: Pick<Context["keymap"], "layer">;
-  theme: () => ResolvedTheme;
-}): JSX.Element {
-  const theme = props.theme();
-
-  props.keymap.layer(() => ({
-    mode: "base",
-    commands: [
-      {
-        id: "auto-mode.allow",
-        title: "Allow pending permission",
-        group: "Auto-mode",
-        palette: true,
-        bind: props.allowKey,
-        // Only real, escalated requests can be answered — during review no
-        // server-side permission request exists yet.
-        enabled: () => props.pending()?.escalated === true,
-        run: () => {
-          void props.answer("once");
-        },
-      },
-      {
-        id: "auto-mode.deny",
-        title: "Deny pending permission",
-        group: "Auto-mode",
-        palette: true,
-        bind: props.denyKey,
-        enabled: () => props.pending()?.escalated === true,
-        run: () => {
-          void props.answer("reject");
-        },
-      },
-    ],
-  }));
-
-  const thinking = createMemo(() => {
-    const p = props.pending();
-    return p !== undefined && !p.escalated;
-  });
-  const label = createMemo(() => (thinking() ? "reviewing" : "needs your approval"));
-
-  // The glyph comes from opentui's intrinsic <spinner>, not our own timer:
-  // npm installs can split solid-js into two instances (the plugin's exact
-  // pin vs @opentui/solid's peer pin), which freezes timer-driven signal
-  // renders. The spinner element animates on its own renderable, so the
-  // badge works regardless of how dependencies resolve.
-  return (
-    <box flexDirection="row" gap={1}>
-      <spinner frames={SPINNER_FRAMES} interval={120} color={theme.text.feedback.warning.base} />
-      <text fg={theme.text.feedback.warning.base}>auto-mode {label()}</text>
-    </box>
-  );
-}
 
 export default Plugin.define({
   id: "opencode-auto-mode",
   setup: async (ctx) => {
-    const options = ctx.options as Record<string, unknown>;
-    const keybinds = (options.keybinds ?? {}) as Record<string, unknown>;
-    const allowKey = str(keybinds.allow, "ctrl+alt+a");
-    const denyKey = str(keybinds.deny, "ctrl+alt+d");
-
-    // Own pending list, fed by events. Keeping it locally (instead of reading
-    // the host's session store) makes the badge independent of host store
-    // behavior across betas.
-    const [pending, setPending] = createSignal<Pending[]>([]);
-    const firstSeen = new Map<string, number>();
-
-    const addPending = (data: {
-      id: string;
-      sessionID: string;
-      action: string;
-      resources: readonly string[];
-    }) => {
-      if (pending().some((p) => p.requestID === data.id)) return;
-      // An asked event means the server plugin's review already finished with
-      // ASK. Adopt a matching in-review entry so its spinner duration carries
-      // over instead of restarting the badge from scratch.
-      const inReview = pending().find(
-        (p) => !p.escalated && p.sessionID === data.sessionID && p.action === data.action,
-      );
-      if (inReview) {
-        firstSeen.delete(inReview.requestID);
-        setPending((prev) =>
-          prev.map((p) =>
-            p === inReview ? { ...p, requestID: data.id, escalated: true } : p,
-          ),
-        );
-        firstSeen.set(data.id, inReview.at);
-        return;
-      }
-      const at = firstSeen.get(data.id) ?? Date.now();
-      firstSeen.set(data.id, at);
-      setPending((prev) => [
-        ...prev,
-        {
-          requestID: data.id,
-          sessionID: data.sessionID,
-          action: data.action,
-          resource: truncate(data.resources.join(" ") || data.action, MAX_RESOURCE),
-          at,
-          escalated: true,
-        },
-      ]);
-    };
-
-    const removePending = (requestID: string) => {
-      firstSeen.delete(requestID);
-      setPending((prev) => prev.filter((p) => p.requestID !== requestID));
-    };
-
-    // Primary channel: the host data bus. Some host versions forward only a
-    // subset of event types, so the raw server stream below is the fallback;
-    // handlers dedupe by request ID.
-    const unsubs = [
-      ctx.data.on("permission.asked", (event) => addPending(event.data)),
-      ctx.data.on("permission.replied", (event) => removePending(event.data.requestID)),
-    ];
-
-    // Fallback channel: the raw server event stream, with reconnection.
-    const abort = new AbortController();
-    const runStream = async () => {
-      while (!abort.signal.aborted) {
-        try {
-          for await (const event of ctx.client.event.subscribe({ signal: abort.signal })) {
-            if (event.type === "permission.asked") addPending(event.data);
-            else if (event.type === "permission.replied") removePending(event.data.requestID);
-          }
-        } catch {
-          // fall through to reconnect
-        }
-        if (abort.signal.aborted) return;
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-      }
-    };
-    void runStream();
-
-    // Reconcile with the server plugin's decision file:
-    // - "reviewing" records create spinner entries (they precede any event,
-    //   since the evaluate hook runs before the request is published)
-    // - "ask" escalates the entry, "allow"/"deny" resolves it
-    // - entries that outlived every record and the review window are pruned
-    const poll = setInterval(() => {
-      snapshotView();
-      const decisions = readDecisions();
-      const now = Date.now();
-      let next = pending();
-      let dirty = false;
-
-      for (const [reviewID, rec] of Object.entries(decisions)) {
-        if (rec.decision !== "reviewing") continue;
-        if (next.some((p) => p.requestID === reviewID)) continue;
-        if (now - rec.at >= STALE_MS) continue;
-        firstSeen.set(reviewID, rec.at);
-        next = [
-          ...next,
-          {
-            requestID: reviewID,
-            sessionID: rec.sessionID,
-            action: rec.action ?? "",
-            resource: truncate(
-              (rec.resources ?? []).join(" ") || rec.action || "",
-              MAX_RESOURCE,
-            ),
-            at: rec.at,
-            escalated: false,
-          },
-        ];
-        dirty = true;
-      }
-
-      const reconciled: Pending[] = [];
-      for (const p of next) {
-        const record = decisions[p.requestID];
-        if (record?.decision === "allow" || record?.decision === "deny") {
-          firstSeen.delete(p.requestID);
-          dirty = true;
-          continue;
-        }
-        if (record?.decision === "ask" && !p.escalated) {
-          reconciled.push({ ...p, escalated: true });
-          dirty = true;
-          continue;
-        }
-        if (!record && now - p.at >= STALE_MS) {
-          firstSeen.delete(p.requestID);
-          dirty = true;
-          continue;
-        }
-        reconciled.push(p);
-      }
-      if (dirty) setPending(reconciled);
-    }, POLL_MS);
-
-    // View scoping: decision records live in a machine-global file (and on
-    // shared servers permission events are global too), so without filtering
-    // every open TUI would badge other TUIs' reviews. Router + tabs state is
-    // client-local — a foreign session is never the current route nor an open
-    // tab here — which discriminates both separate-server and shared-server
-    // setups. Snapshotted on the existing poll tick (1s granularity is fine
-    // for a status badge) instead of relying on host reactivity.
-    const [visibleIDs, setVisibleIDs] = createSignal<ReadonlySet<string>>(new Set());
-    const snapshotView = () => {
-      const ids = new Set<string>();
-      try {
-        if (ctx.ui.tabs.enabled()) {
-          for (const tab of ctx.ui.tabs.list()) ids.add(tab.sessionID);
-        }
-      } catch {
-        // tabs unavailable — route only
-      }
-      try {
-        const route = ctx.ui.router.current();
-        if (route.type === "session") ids.add(route.sessionID);
-      } catch {
-        // router unavailable — tabs only
-      }
-      const key = [...ids].sort().join(",");
-      const prev = [...visibleIDs()].sort().join(",");
-      if (key !== prev) setVisibleIDs(ids);
-    };
-    snapshotView();
-
-    const mostRecent = createMemo(() => {
-      const visible = visibleIDs();
-      const requests = pending().filter((p) => visible.has(p.sessionID));
-      return requests.length > 0 ? requests[requests.length - 1] : undefined;
-    });
-
-    const answer = async (reply: "once" | "reject") => {
-      const pendingRequest = mostRecent();
-      if (!pendingRequest) return;
-      try {
-        await ctx.client.permission.reply({
-          sessionID: pendingRequest.sessionID,
-          requestID: pendingRequest.requestID,
-          decision: reply,
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
+    if (ctx.options.tui === false) return;
+    const [reviewing, setReviewing] = createSignal(false);
+    const [configError, setConfigError] = createSignal(false);
+    let announced = false;
+    const update = () => {
+      const route = ctx.ui.router.current();
+      setReviewing(isReviewing(readDecisions(), route.type === "session" ? route.sessionID : undefined));
+      const error = readConfigError(ctx.location?.directory);
+      setConfigError(error !== undefined);
+      if (error === undefined) announced = false;
+      else if (!announced) {
+        announced = true;
         ctx.ui.toast.show({
-          variant: "error",
-          title: "Auto-mode",
-          message: `Failed to reply: ${message}`,
-          duration: 4000,
+          variant: "error", title: "auto-mode", duration: 10_000,
+          message: "Invalid configuration; automatic approval is disabled.",
         });
       }
     };
-
-    // Top-right overlay, above the permission dialog (which covers the bottom
-    // bar). Only visible while this TUI has a session with a pending review:
-    // spinner while reviewing, ⚠ when it needs the user.
-    const disposeBadge = ctx.ui.slot({
+    update();
+    const poll = setInterval(update, 250);
+    const dispose = ctx.ui.slot({
       append: "app",
       render: () => (
-        <Show when={mostRecent() !== undefined}>
-          <box position="absolute" top={0} right={0} zIndex={10_000}>
-            <Badge
-              pending={mostRecent}
-              answer={answer}
-              allowKey={allowKey}
-              denyKey={denyKey}
-              keymap={ctx.keymap}
-              theme={() => ctx.theme}
-            />
-          </box>
-        </Show>
+        <box position="absolute" top={0} right={0} zIndex={10_000} flexDirection="row" gap={1}>
+          <Show when={configError()}>
+            <text fg={ctx.theme.text.feedback.error.base}>auto-mode: invalid config</text>
+          </Show>
+          <Show when={reviewing()}>
+            <spinner frames={SPINNER_FRAMES} interval={120} color={ctx.theme.text.feedback.warning.base} />
+            <text fg={ctx.theme.text.feedback.warning.base}>auto-mode reviewing</text>
+          </Show>
+        </box>
       ),
     });
-
-    return () => {
-      for (const unsub of unsubs) unsub();
-      abort.abort();
-      clearInterval(poll);
-      disposeBadge();
-    };
+    return () => { clearInterval(poll); dispose(); };
   },
 });

package/src/providers.ts

@@ -1,103 +0,0 @@
-import { object, localEndpoint, type ClassifierStage } from "./config.js";
-import { buildReviewPrompt, type PermissionRequest, type ReviewResult, type Decision } from "./reviewer.js";
-import type { ReviewPolicy } from "./policy.js";
-
-export type ProviderStage = Extract<ClassifierStage, { type: "jev" | "openai-decision" | "laya" }>;
-const choices = {
-  allow: "The whole action is safe and authorized by the user for this exact scope.",
-  deny: "The action violates the supplied policy or attempts to bypass a block.",
-  ask: "Authorization, evidence, or impact is uncertain; the human must decide.",
-};
-const MAX_BYTES = 65_536;
-
-function probability(value: unknown): value is number {
-  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
-}
-
-function answer(value: unknown, stage: ProviderStage): ReviewResult | undefined {
-  if (!object(value) || value.type !== "choice" || typeof value.choice !== "string" || !Object.hasOwn(choices, value.choice) ||
-      !probability(value.confidence) || !object(value.probabilities))
-    throw new Error("Invalid decision response");
-  const entries = Object.entries(value.probabilities);
-  if (entries.length !== 3 || entries.some(([key, value]) => !Object.hasOwn(choices, key) || !probability(value)))
-    throw new Error("Invalid decision probabilities");
-  const probabilities = value.probabilities as Record<Decision, number>;
-  if (Math.abs(Object.values(probabilities).reduce((a, b) => a + b, 0) - 1) > 0.01 ||
-      probabilities[value.choice as Decision] < Math.max(...Object.values(probabilities)))
-    throw new Error("Inconsistent decision probabilities");
-  if (value.choice === "ask") return { decision: "ask", reason: `${stage.type} requested human review` };
-  if (value.confidence < (stage.minConfidence ?? 0.9) || probabilities[value.choice as Decision] < (stage.minConfidence ?? 0.9))
-    return undefined;
-  return { decision: value.choice as Decision, reason: `${stage.type} decision (confidence ${value.confidence})` };
-}
-
-async function readJSON(response: Response): Promise<unknown> {
-  if (!response.ok || !response.body) throw new Error("Decision provider failed");
-  const reader = response.body.getReader();
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      size += value.length;
-      if (size > MAX_BYTES) throw new Error("Decision response too large");
-      chunks.push(value);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } finally {
-    await reader.cancel().catch(() => {});
-    reader.releaseLock();
-  }
-}
-
-export async function providerDecision(
-  stage: ProviderStage,
-  request: PermissionRequest,
-  policy: ReviewPolicy,
-  fetcher: typeof fetch = fetch,
-): Promise<ReviewResult | undefined> {
-  try {
-    const openai = stage.type === "openai-decision";
-    const endpoint = stage.type === "laya" ? localEndpoint(stage.endpoint ?? "http://127.0.0.1:8000/v1/systemone") :
-      openai ? "https://api.openai.com/v1/decisions" : "https://api.typesafe.ai/v1/systemone";
-    const key = process.env[stage.apiKeyEnv ?? (openai ? "OPENAI_API_KEY" : stage.type === "jev" ? "TYPESAFE_API_KEY" : "LAYA_API_KEY")];
-    if (stage.type !== "laya" && !key) throw new Error("Missing decision provider credentials");
-    const instructions = buildReviewPrompt(request, policy);
-    const body = openai ? {
-      model: stage.model ?? "gpt-6-luna",
-      input: JSON.stringify(request),
-      questions: [{ name: "permission", type: "choice", instructions,
-        choices: Object.entries(choices).map(([value, description]) => ({ value, description })) }],
-    } : {
-      ...(stage.type === "jev" ? { model: stage.model ?? "jev-latest" } : stage.model ? { model: stage.model } : {}),
-      state: request,
-      questions: { permission: { type: "choice", instructions, criteria: choices } },
-    };
-    const payload = JSON.stringify(body);
-    if (Buffer.byteLength(payload) > MAX_BYTES) throw new Error("Decision request too large");
-    const response = await fetcher(endpoint, {
-      method: "POST", redirect: "error", signal: AbortSignal.timeout(stage.timeoutMs ?? 10_000),
-      headers: { "Content-Type": "application/json", ...(key ? { Authorization: `Bearer ${key}` } : {}) },
-      body: payload,
-    });
-    const parsed = await readJSON(response);
-    if (!object(parsed)) throw new Error("Invalid decision response");
-    if (!openai) return answer(object(parsed.answers) ? parsed.answers.permission : undefined, stage);
-    if (!Array.isArray(parsed.answers) || parsed.answers.length !== 1 || !object(parsed.answers[0]) ||
-        parsed.answers[0].name !== "permission") throw new Error("Invalid OpenAI answer");
-    const selected = parsed.answers[0];
-    if (selected.type === "refusal") return { decision: "ask", reason: "OpenAI declined the decision" };
-    if (!Array.isArray(selected.probabilities) || selected.probabilities.length !== 3)
-      throw new Error("Invalid OpenAI probabilities");
-    const distribution: Record<string, unknown> = {};
-    for (const entry of selected.probabilities) {
-      if (!object(entry) || typeof entry.value !== "string" || !Object.hasOwn(choices, entry.value) ||
-          Object.hasOwn(distribution, entry.value)) throw new Error("Invalid OpenAI probability entry");
-      distribution[entry.value] = entry.probability;
-    }
-    return answer({ ...selected, probabilities: distribution }, stage);
-  } catch {
-    return { decision: "ask", reason: `${stage.type} unavailable or returned an invalid decision` };
-  }
-}