@mortz.prk/opencode-auto-mode 1.0.0 → 1.0.1

package/README.md

@@ -36,7 +36,9 @@ opencode service restart
 
 There is no default review pipeline, and empty options are invalid. Add at least
 one review entry. Built-in checks deny dangerous shell commands, allow common
-read-only commands, and leave everything else as `ask`.
+read-only commands, and send other parsed commands to the configured reviewers.
+Dynamic syntax such as command substitution, nested shells, and stateful builtins
+still requires manual approval.
 
 The snippets below change parts of that configuration; keep your `classifiers`
 list when adding other options.
@@ -125,7 +127,8 @@ permissions and leave global permissions unchanged:
 
 A passive indicator shows when the plugin is reviewing the current session.
 It is enabled by default. Set `tui: false` in plugin options to hide it.
-OpenCode's own permission dialog handles manual approvals.
+Invalid options show `auto-mode: invalid config` in the same place and an error
+toast at startup. OpenCode's own permission dialog handles manual approvals.
 
 ## Review options
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mortz.prk/opencode-auto-mode",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Configurable automatic permission review for OpenCode v2.",
   "author": {
     "name": "Andrew Mellen",

package/src/classifier.ts

@@ -15,7 +15,12 @@ export async function compositeDecision(
     const result = classify(request.action, request.resources);
     if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason, stage: "static" };
   }
-  if (shellResult) return { ...shellResult, stage: "shell-guard" };
+  if (shellResult) {
+    // Parsed read-only results feed the static stage, but never bypass a model-only pipeline.
+    const hasStatic = stages.some((stage) => stage.type === "static");
+    if (shellResult.decision !== "allow" || hasStatic)
+      return { ...shellResult, stage: shellResult.decision === "allow" ? "static" : "shell-guard" };
+  }
   let abstained: string | undefined;
   for (const stage of stages) {
     if (stage.type === "static") {

package/src/index.ts

@@ -1,6 +1,6 @@
 import { Plugin } from "@opencode/plugin";
 import { createLogger } from "./logger.js";
-import { recordDecision } from "./state.js";
+import { clearConfigError, recordConfigError, recordDecision } from "./state.js";
 import { defaultPolicy } from "./policy.js";
 import { extractReviewContext } from "./transcript.js";
 import { scanResultContent, withInjectionWarning } from "./probe.js";
@@ -18,9 +18,16 @@ export default Plugin.define({
   id: "opencode-auto-mode",
   setup: async (ctx) => {
     const log = createLogger("events.log");
+    const directory = ctx.location?.directory;
     let options: ReturnType<typeof parseOptions> | undefined;
-    try { options = parseOptions(ctx.options); }
-    catch { log.log("Invalid configuration; automatic approval disabled"); }
+    try {
+      options = parseOptions(ctx.options);
+      if (directory !== undefined) clearConfigError(directory);
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      log.log(`Invalid configuration; automatic approval disabled: ${detail}`);
+      if (directory !== undefined) recordConfigError(directory, detail);
+    }
     const sinks = [createAuditLog(options?.auditLog), createOtlpExporter(options?.otlp)].filter((sink) => sink !== undefined);
     const traces = createTraceExporter(options?.otlp);
     const counts = new Map<string, number>();
@@ -48,16 +55,18 @@ export default Plugin.define({
         };
         let contextLoaded = false;
         let contextComplete = false;
+        let contextReason = "User authorization context is unavailable";
         result = await compositeDecision(options.classifiers, request, async (stage) => {
           if (!contextLoaded) {
             const messages = await withTimeout(ctx.session.context({ sessionID: event.sessionID }), 3_000);
             const context = extractReviewContext(messages);
             request.transcript = context.transcript;
             contextComplete = context.complete;
+            contextReason = context.reason ?? contextReason;
             contextLoaded = true;
           }
           if (!contextComplete)
-            return { decision: "ask", reason: "User authorization context is unavailable" };
+            return { decision: "ask", reason: contextReason };
           const policy = defaultPolicy(stage.policy);
           const attemptStartedAt = Date.now();
           let outcome: StageResult;

package/src/shell.ts

@@ -3,14 +3,29 @@ import { basename } from "node:path";
 import { classify } from "./tiers.js";
 import type { ReviewResult } from "./reviewer.js";
 
-const WRAPPERS = new Set(["env", "command", "builtin", "exec", "eval", "source", ".", "cd", "pushd", "popd",
-  "sh", "bash", "dash", "zsh", "ksh", "fish", "pwsh", "powershell", "cmd", "!", "time", "coproc",
-  "if", "then", "else", "elif", "fi", "for", "while", "until", "case", "esac", "select", "do", "done", "function",
-  "export", "unset", "set", "shopt", "alias", "unalias", "trap", "umask", "exit", "return", "shift", "readonly", "local", "declare", "typeset"]);
+const MAX_COMMAND_CHARS = 4096;
+const MAX_COMMAND_BYTES = 65_536;
 const BALANCED_QUOTES = /^(?:[^'"\\]|\\[^\r\n]|'[^']*'|"(?:[^"\\]|\\[^\r\n])*")*$/;
+const CONTROL_OPERATORS = new Set([";", "&&", "||", "|", "|&", "&"]);
+const REDIRECT_OPERATORS = new Set([">", ">>", ">&", "<&", "<", "<<", "<<-", "<<<", "<>", ">|", "&>", "&>>"]);
+const WRITE_OPERATORS = new Set([">", ">>", ">|", "&>", "&>>", "<>"]);
+const SHELLS = new Set(["sh", "bash", "dash", "zsh", "ksh", "fish", "pwsh", "powershell", "cmd"]);
+const SCRIPT_HOSTS = new Set(["python", "python3", "node", "perl", "ruby", "php", "awk", "gawk", "lua"]);
+const STATEFUL = new Set(["alias", "unalias", "export", "unset", "set", "shopt", "trap", "umask",
+  "readonly", "declare", "typeset", "local", "function"]);
+const DYNAMIC = new Set(["eval", "source", ".", "exec", "xargs"]);
+const DYNAMIC_SYNTAX = /\$\(|`|\$\(\s*\(|[<>]\(/;
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const WRAPPERS = new Set(["env", "command", "builtin", "exec", "time", "!", "nohup", "setsid", "nice",
+  "ionice", "stdbuf", "timeout"]);
+const VALUE_OPTIONS = new Set(["-u", "--unset", "-C", "--chdir", "-S", "--split-string", "-a", "--argv0",
+  "-n", "--adjustment", "-s", "--signal", "-k", "--kill-after"]);
+const READ_ONLY = new Set(["pwd", "whoami", "hostname", "uname", "id", "groups", "ls", "cat", "head", "tail",
+  "wc", "date", "echo", "printf", "true", ":", "rg", "grep", "sort", "uniq", "cut", "tr", "jq", "stat", "file",
+  "du", "df", "tree", "bat", "which", "type", "sleep", "test", "basename", "dirname", "realpath", "diff"]);
 
 export function shellWords(command: string): string[] | undefined {
-  if (!command || command.length > 4096 || /[$`~\r\n\0{}[\]]/.test(command) ||
+  if (!command || command.length > MAX_COMMAND_CHARS || /[$`~\r\n\0{}[\]]/.test(command) ||
       /[^\S \t]/.test(command) || !BALANCED_QUOTES.test(command)) return undefined;
   try {
     const words = parse(command);
@@ -18,17 +33,300 @@ export function shellWords(command: string): string[] | undefined {
   } catch { return undefined; }
 }
 
+interface Segment { words: string[]; write: boolean }
+type Verdict = { decision: "deny"; reason: string } | { decision: "allow" | "review" | "ask" };
+
+function blockedCommand(command: string): string | undefined {
+  const normalized = shellWords(command);
+  const result = classify("shell", [command, ...(normalized ? [normalized.join(" ")] : [])]);
+  return result.tier === "auto-deny" ? result.reason : undefined;
+}
+
+/** True when the command contains a heredoc marker outside quotes. Heredoc bodies are data. */
+function hasHeredoc(command: string): boolean {
+  let quote: "'" | '"' | undefined;
+  for (let index = 0; index < command.length; index++) {
+    const character = command[index];
+    if (quote === "'") { if (character === "'") quote = undefined; continue; }
+    if (quote === '"') {
+      if (character === "\\") { index++; continue; }
+      if (character === '"') quote = undefined;
+      continue;
+    }
+    if (character === "'" || character === '"') { quote = character; continue; }
+    if (character === "\\") { index++; continue; }
+    if (character === "<" && command[index + 1] === "<" && command[index + 2] !== "<") return true;
+  }
+  return false;
+}
+
+interface HeredocMarker { delimiter: string; quoted: boolean; stripTabs: boolean }
+
+/** Reads heredoc markers on one line, ignoring markers inside quoted strings and comments. */
+function heredocMarkers(line: string): HeredocMarker[] {
+  const markers: HeredocMarker[] = [];
+  let quote: "'" | '"' | undefined;
+  for (let index = 0; index < line.length; index++) {
+    const character = line[index];
+    if (quote === "'") { if (character === "'") quote = undefined; continue; }
+    if (quote === '"') {
+      if (character === "\\") { index++; continue; }
+      if (character === '"') quote = undefined;
+      continue;
+    }
+    if (character === "'" || character === '"') { quote = character; continue; }
+    if (character === "\\") { index++; continue; }
+    if (character === "#" && (index === 0 || /\s/.test(line[index - 1] ?? ""))) break;
+    if (character !== "<" || line[index + 1] !== "<" || line[index + 2] === "<") continue;
+    let cursor = index + 2;
+    const stripTabs = line[cursor] === "-";
+    if (stripTabs) cursor++;
+    while (line[cursor] === " " || line[cursor] === "\t") cursor++;
+    let delimiter = "";
+    let quoted = false;
+    if (line[cursor] === "'" || line[cursor] === '"') {
+      const closing = line[cursor];
+      quoted = true;
+      cursor++;
+      while (cursor < line.length && line[cursor] !== closing) delimiter += line[cursor++];
+    } else {
+      while (cursor < line.length && /[A-Za-z0-9_]/.test(line[cursor])) delimiter += line[cursor++];
+    }
+    if (delimiter) markers.push({ delimiter, quoted, stripTabs });
+    index = cursor - 1;
+  }
+  return markers;
+}
+
+/** Resolves leading assignments and wrapper options to the effective executable. */
+function resolveExecutable(words: string[]): { name: string; index: number } | undefined {
+  let index = 0;
+  while (index < words.length && ASSIGNMENT.test(words[index])) index++;
+  while (index < words.length) {
+    const name = basename(words[index]);
+    if (!WRAPPERS.has(name)) break;
+    index++;
+    if (name === "timeout") {
+      while (index < words.length && words[index].startsWith("-") && words[index] !== "-") {
+        const option = words[index].split("=", 1)[0];
+        index += VALUE_OPTIONS.has(option) && !words[index].includes("=") ? 2 : 1;
+      }
+      if (index < words.length) index++;
+      continue;
+    }
+    while (index < words.length) {
+      const word = words[index];
+      if (word === "--") { index++; break; }
+      if (word.startsWith("-") && word !== "-") {
+        const option = word.split("=", 1)[0];
+        index += VALUE_OPTIONS.has(option) && !word.includes("=") ? 2 : 1;
+        continue;
+      }
+      if (ASSIGNMENT.test(word)) { index++; continue; }
+      break;
+    }
+  }
+  return index < words.length ? { name: basename(words[index]), index } : undefined;
+}
+
+/** True when the effective executable is a shell, a dynamic builtin, or a stateful builtin. */
+function dynamicExecution(words: string[]): boolean {
+  const executable = resolveExecutable(words);
+  if (executable === undefined) return true;
+  if (SHELLS.has(executable.name) || DYNAMIC.has(executable.name) || STATEFUL.has(executable.name)) return true;
+  return executable.name === "find" && words.slice(executable.index + 1)
+    .some((word) => /^-(?:exec|execdir|ok|okdir|delete)$/.test(word));
+}
+
+function isReadOnlyGit(args: string[]): boolean {
+  if (args.some((arg) =>
+    /^(?:-c|--git-dir|--work-tree|--exec-path|--config-env)(?:=|$)/.test(arg) ||
+    arg === "--ext-diff" || arg === "--exec" || arg.startsWith("--output"))) return false;
+  const subcommand = args[0];
+  if (subcommand === undefined) return false;
+  if (["status", "diff", "log", "show", "rev-parse"].includes(subcommand)) return true;
+  if (subcommand !== "branch") return false;
+  if (args.length === 1) return true;
+  return args.slice(1).every((arg) =>
+    ["--show-current", "--list", "-a", "-r", "-v", "-vv", "--merged", "--no-merged", "--contains", "--points-at", "--format"]
+      .some((safe) => arg === safe || arg.startsWith(`${safe}=`)));
+}
+
+function isReadOnlySed(args: string[]): boolean {
+  if (args.some((arg) => arg === "-i" || arg.startsWith("--in-place") || arg === "-e" ||
+      arg === "--expression" || arg === "-f" || arg === "--file")) return false;
+  return args[0] === "-n" && args[1] !== undefined && /^\d+(?:,\d+)?p$/.test(args[1]);
+}
+
+function isReadOnlyGh(args: string[]): boolean {
+  const [group, subcommand] = args;
+  if (group === "label" && subcommand === "list") return true;
+  if (group === "api") {
+    return !args.some((arg) => arg === "-X" || arg === "--method" || arg.startsWith("-X") ||
+      arg.startsWith("--method=") || ["-f", "--field", "-F", "--raw-field", "--input"].includes(arg));
+  }
+  return new Set(["pr view", "pr list", "pr diff", "pr checks", "issue view", "issue list", "run view",
+    "run list", "repo view", "auth status", "status", "search"]).has(`${group} ${subcommand}`);
+}
+
+function isReadOnly(words: string[]): boolean {
+  const command = basename(words[0]);
+  const args = words.slice(1);
+  if (READ_ONLY.has(command)) {
+    return command !== "date" || !args.some((arg) => arg === "-s" || arg === "--set" || arg.startsWith("--set="));
+  }
+  if (command === "git") return isReadOnlyGit(args);
+  if (command === "find") return !args.some((arg) => /^-(?:fprint|fprint0|fprintf|fls)$/.test(arg));
+  if (command === "sed") return isReadOnlySed(args);
+  if (command === "gh") return isReadOnlyGh(args);
+  if (command === "docker") return args[0] === "logs";
+  if (command === "bun")
+    return args[0] === "test" || (args[0] === "run" && (args[1] === "lint" || args[1] === "typecheck"));
+  return false;
+}
+
+function analyzeSegment(segment: Segment): Verdict {
+  if (!segment.words.length) return segment.write ? { decision: "review" } : { decision: "allow" };
+  const command = segment.words[0];
+  if (!command || command.includes("$")) return { decision: "ask" };
+  const blocked = blockedCommand(segment.words.join(" "));
+  if (blocked !== undefined) return { decision: "deny", reason: blocked };
+  if (dynamicExecution(segment.words)) return { decision: "ask" };
+  if (!segment.write && isReadOnly(segment.words)) return { decision: "allow" };
+  return { decision: "review" };
+}
+
+function analyzeLine(command: string): Verdict {
+  if (!command.trim()) return { decision: "allow" };
+  if (!BALANCED_QUOTES.test(command)) return { decision: "ask" };
+  const blocked = blockedCommand(command);
+  if (blocked !== undefined) return { decision: "deny", reason: blocked };
+
+  let tokens;
+  try { tokens = parse(command); }
+  catch { return { decision: "ask" }; }
+  const blockedTokens = blockedCommand(tokens.filter((token): token is string => typeof token === "string").join(" "));
+  if (blockedTokens !== undefined) return { decision: "deny", reason: blockedTokens };
+  if (DYNAMIC_SYNTAX.test(command)) return { decision: "ask" };
+
+  const segments: Segment[] = [{ words: [], write: false }];
+  let current = segments[0];
+  let redirect: { write: boolean } | undefined;
+  for (const token of tokens) {
+    if (typeof token === "string") {
+      if (redirect) {
+        const target = token;
+        if (redirect.write && target !== "/dev/null" && !/^\d+$/.test(target) && !target.startsWith("&"))
+          current.write = true;
+        redirect = undefined;
+      } else current.words.push(token);
+      continue;
+    }
+    if ("comment" in token) continue;
+    if (token.op === "glob") { current.words.push(token.pattern); continue; }
+    if (CONTROL_OPERATORS.has(token.op)) {
+      current = { words: [], write: false };
+      segments.push(current);
+      continue;
+    }
+    if (REDIRECT_OPERATORS.has(token.op)) {
+      if (current.words.length && /^\d+$/.test(current.words[current.words.length - 1])) current.words.pop();
+      redirect = { write: WRITE_OPERATORS.has(token.op) };
+      continue;
+    }
+    return { decision: "ask" };
+  }
+  if (redirect) return { decision: "ask" };
+
+  let ask = false;
+  let review = false;
+  for (const segment of segments) {
+    const verdict = analyzeSegment(segment);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
+  }
+  if (ask) return { decision: "ask" };
+  return { decision: review ? "review" : "allow" };
+}
+
+function analyzeHeredoc(command: string): Verdict {
+  const lines = command.split("\n");
+  const firstLine = lines[0] ?? "";
+  const markers = heredocMarkers(firstLine);
+  if (!markers.length) return { decision: "ask" };
+  let index = 1;
+  const bodies: { lines: string[]; quoted: boolean }[] = [];
+  for (const marker of markers) {
+    const body: string[] = [];
+    let closed = false;
+    while (index < lines.length) {
+      const candidate = marker.stripTabs ? lines[index].replace(/^\t+/, "") : lines[index];
+      index++;
+      if (candidate === marker.delimiter) { closed = true; break; }
+      body.push(candidate);
+    }
+    if (!closed) return { decision: "ask" };
+    bodies.push({ lines: body, quoted: marker.quoted });
+  }
+
+  let ask = false;
+  let review = false;
+  for (const line of [firstLine, ...lines.slice(index)]) {
+    if (!line.trim()) continue;
+    const verdict = analyzeLine(line);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
+  }
+  for (const body of bodies) {
+    // Unquoted heredoc bodies undergo command and parameter expansion.
+    if (!body.quoted && DYNAMIC_SYNTAX.test(body.lines.join("\n"))) return { decision: "ask" };
+  }
+  try {
+    const words = parse(firstLine).filter((token): token is string => typeof token === "string");
+    const executable = resolveExecutable(words);
+    if (executable === undefined || SHELLS.has(executable.name) || SCRIPT_HOSTS.has(executable.name) ||
+        DYNAMIC.has(executable.name) || STATEFUL.has(executable.name)) return { decision: "ask" };
+  } catch { return { decision: "ask" }; }
+  if (ask) return { decision: "ask" };
+  return { decision: review ? "review" : "allow" };
+}
+
+function analyze(command: string): Verdict {
+  if (hasHeredoc(command)) return analyzeHeredoc(command);
+  const blocked = blockedCommand(command);
+  if (blocked !== undefined) return { decision: "deny", reason: blocked };
+  if (command.includes("\n")) {
+    let ask = false;
+    let review = false;
+    for (const line of command.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const verdict = analyzeLine(trimmed);
+      if (verdict.decision === "deny") return verdict;
+      if (verdict.decision === "ask") ask = true;
+      else if (verdict.decision === "review") review = true;
+    }
+    if (ask) return { decision: "ask" };
+    return { decision: review ? "review" : "allow" };
+  }
+  return analyzeLine(command);
+}
+
 export function guardShell(resources: readonly string[]): ReviewResult | undefined {
   if (process.platform === "win32") return { decision: "ask", reason: "Shell dialect requires manual approval" };
-  if (!resources.length || resources.length > 256 || resources.some((resource) => resource.length > 4096) ||
-      resources.reduce((sum, resource) => sum + Buffer.byteLength(resource), 0) > 65_536)
+  if (!resources.length || resources.length > 256 || resources.some((resource) => resource.length > MAX_COMMAND_CHARS) ||
+      resources.reduce((sum, resource) => sum + Buffer.byteLength(resource), 0) > MAX_COMMAND_BYTES)
     return { decision: "ask", reason: "Shell command exceeds parsing limits" };
-  let uncertain = false;
+  let ask = false;
+  let review = false;
   for (const resource of resources) {
-    const words = shellWords(resource);
-    const result = classify("shell", [resource, ...(words ? [words.join(" ")] : [])]);
-    if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason };
-    if (!words || words[0].includes("=") || WRAPPERS.has(basename(words[0]))) uncertain = true;
+    const verdict = analyze(resource);
+    if (verdict.decision === "deny") return { decision: "deny", reason: verdict.reason };
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
   }
-  return uncertain ? { decision: "ask", reason: "Shell syntax requires manual approval" } : undefined;
+  if (ask) return { decision: "ask", reason: "Shell syntax requires manual approval" };
+  return review ? undefined : { decision: "allow", reason: "read-only command" };
 }

package/src/state.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash } from "node:crypto";
 import { privateFile, STORAGE_DIR } from "./storage.js";
 
 export type DecisionKind = "reviewing" | "allow" | "deny" | "ask";
@@ -17,6 +18,80 @@ export interface DecisionRecord {
 export const STATE_FILE = path.join(STORAGE_DIR, "state.json");
 
 const MAX_AGE_MS = 10 * 60 * 1000;
+const MAX_CONFIG_MESSAGE = 1024;
+
+export interface ConfigErrorRecord {
+  directory: string;
+  message: string;
+}
+
+interface StoredConfigError extends ConfigErrorRecord {
+  at: number;
+}
+
+function canonicalDirectory(directory: string): string {
+  try { return fs.realpathSync.native(directory); }
+  catch { return path.resolve(directory); }
+}
+
+function configErrorFile(directory: string): string {
+  return `config-error-${createHash("sha256").update(directory).digest("hex")}.json`;
+}
+
+function readConfigErrorFile(directory: string): StoredConfigError | undefined {
+  let fd: number | undefined;
+  try {
+    fd = privateFile(configErrorFile(directory), false);
+    if (fs.fstatSync(fd).size > 4096) return undefined;
+    const parsed: unknown = JSON.parse(fs.readFileSync(fd, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
+    const record = parsed as Partial<StoredConfigError>;
+    if (record.directory !== directory || typeof record.message !== "string" ||
+        record.message.length > MAX_CONFIG_MESSAGE || typeof record.at !== "number" || !Number.isFinite(record.at))
+      return undefined;
+    return { directory: record.directory, message: record.message, at: record.at };
+  } catch {
+    return undefined;
+  } finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+
+function writeConfigError(record: StoredConfigError): void {
+  let fd: number | undefined;
+  const temporary = `config-error-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp`;
+  const target = configErrorFile(record.directory);
+  try {
+    fd = privateFile(temporary, true);
+    fs.writeSync(fd, JSON.stringify(record), 0);
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(path.join(STORAGE_DIR, temporary), path.join(STORAGE_DIR, target));
+  } catch {
+    // Badge state is best effort and must not interrupt permission review.
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    try { fs.rmSync(path.join(STORAGE_DIR, temporary), { force: true }); }
+    catch { /* best effort */ }
+  }
+}
+
+/** Records that the plugin options for a location are unusable, so the TUI can show it. */
+export function recordConfigError(directory: string, message: string): void {
+  const canonical = canonicalDirectory(directory);
+  writeConfigError({ directory: canonical, message: message.slice(0, MAX_CONFIG_MESSAGE), at: Date.now() });
+}
+
+export function readConfigError(directory: string | undefined): ConfigErrorRecord | undefined {
+  if (directory === undefined) return undefined;
+  const canonical = canonicalDirectory(directory);
+  const record = readConfigErrorFile(canonical);
+  return record === undefined ? undefined : { directory: record.directory, message: record.message };
+}
+
+export function clearConfigError(directory: string): void {
+  try {
+    fs.rmSync(path.join(STORAGE_DIR, configErrorFile(canonicalDirectory(directory))), { force: true });
+  } catch { /* best effort */ }
+}
 
 export function readDecisions(): Record<string, DecisionRecord> {
   let fd: number | undefined;

package/src/tiers.ts

@@ -5,7 +5,9 @@ export type Tier = "auto-allow" | "auto-deny" | "review" | "unknown";
 export interface Classification { tier: Tier; reason: string }
 export interface ClassifyOptions { projectDir?: string; allowInProjectEdits?: boolean }
 
-const READ_ONLY_COMMANDS = new Set(["pwd", "whoami", "hostname", "uname", "id", "groups", "ls", "ls -a", "ls -l", "ls -la", "ls -al", "ls -A"]);
+const READ_ONLY_COMMANDS = new Set(["pwd", "whoami", "hostname", "uname", "id", "groups", "ls", "ls -a", "ls -l", "ls -la", "ls -al", "ls -A",
+  "git status", "git status --short", "git diff", "git log", "git show", "git branch --show-current",
+  "date", "date +%s", "cat", "head", "tail", "rg", "grep", "wc", "bun test", "bun run lint", "bun run typecheck"]);
 const BLOCKED_SHELL = [
   /\brm\s+-rf?\s+\/(\s|$|\*)/,
   /\bsudo\b/,

package/src/transcript.ts

@@ -1,13 +1,19 @@
 const MAX_USERS = 10;
 const MAX_TOOLS = 20;
+const MAX_USER_CHARS = 8_000;
 const MAX_ENTRY_CHARS = 500;
-const MAX_TRANSCRIPT_CHARS = 6000;
+const MAX_TRANSCRIPT_BYTES = 12_000;
 
 interface ToolEntry {
   name: string;
   input: unknown;
 }
 
+interface Entry {
+  role: "user" | "tool";
+  text: string;
+}
+
 function truncate(value: string, max: number): string {
   return value.length > max ? `${value.slice(0, max - 1)}…` : value;
 }
@@ -42,47 +48,161 @@ function assistantTools(message: unknown): ToolEntry[] {
   return tools;
 }
 
-function formatTool(tool: ToolEntry): string {
+function formatTool(tool: ToolEntry): { text: string; truncated: boolean } {
   let detail = "";
+  let truncated = false;
   try {
     const state = asRecord(tool.input);
     const input = state?.["input"] ?? tool.input;
     const raw = typeof input === "string" ? input : JSON.stringify(input);
-    if (raw) detail = truncate(raw, MAX_ENTRY_CHARS);
+    if (raw) {
+      truncated = raw.length > MAX_ENTRY_CHARS;
+      detail = truncate(raw, MAX_ENTRY_CHARS);
+    }
   } catch {
     detail = "";
   }
-  return detail ? `${tool.name} ${detail}` : tool.name;
+  return { text: detail ? `${tool.name} ${detail}` : tool.name, truncated };
+}
+
+function escapedSize(value: string): number {
+  return Buffer.byteLength(JSON.stringify(value));
+}
+
+function prefixByEscapedBytes(characters: string[], maxBytes: number): string {
+  let low = 0;
+  let high = characters.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (escapedSize(characters.slice(0, middle).join("")) <= maxBytes) low = middle;
+    else high = middle - 1;
+  }
+  return characters.slice(0, low).join("");
+}
+
+function suffixByEscapedBytes(characters: string[], maxBytes: number): string {
+  let low = 0;
+  let high = characters.length;
+  while (low < high) {
+    const middle = Math.ceil((low + high) / 2);
+    if (escapedSize(characters.slice(characters.length - middle).join("")) <= maxBytes) low = middle;
+    else high = middle - 1;
+  }
+  return characters.slice(characters.length - low).join("");
 }
 
-export interface ReviewContext { transcript: string; complete: boolean }
+/** Clips the head and tail so escaping cannot hide a trailing constraint. */
+function clipEscaped(value: string, maxBytes: number): string {
+  if (escapedSize(value) <= maxBytes) return value;
+  const characters = Array.from(value);
+  const marker = "…";
+  const budget = Math.max(0, maxBytes - escapedSize(marker));
+  const headBudget = Math.floor(budget * 0.6);
+  return `${prefixByEscapedBytes(characters, headBudget)}${marker}${suffixByEscapedBytes(characters, budget - headBudget)}`;
+}
+
+function clipChars(value: string, max: number): string {
+  if (value.length <= max) return value;
+  const characters = Array.from(value);
+  const head = Math.floor(max * 0.6);
+  return `${characters.slice(0, head).join("")}…${characters.slice(characters.length - (max - head)).join("")}`;
+}
+
+interface TranscriptData {
+  transcript: string;
+  userEvidence: boolean;
+  missingUserText: boolean;
+  notes: string[];
+}
+
+function renderTranscript(entries: Entry[], toolTruncated: boolean, userClipped: boolean): { transcript: string; notes: string[] } {
+  if (!entries.some((entry) => entry.role === "user")) return { transcript: "(no prior user messages in this session)", notes: [] };
+  let users = 0;
+  let tools = 0;
+  const recent = entries.slice().reverse().filter((entry) => entry.role === "user" ? ++users <= MAX_USERS : ++tools <= MAX_TOOLS).reverse();
+  const notes: string[] = [];
+  if (recent.length < entries.length) notes.push("older messages omitted");
+  if (toolTruncated) notes.push("some tool details truncated");
+  if (userClipped) notes.push("latest user message truncated");
+  const render = () => `User messages and prior tool calls (chronological):\n${JSON.stringify(recent)}` +
+    (notes.length ? `\n… partial session history (${notes.join("; ")})` : "");
+
+  while (Buffer.byteLength(render()) > MAX_TRANSCRIPT_BYTES && recent.length > 1) {
+    // Keep at least the latest user message.
+    const onlyOneUser = recent.filter((entry) => entry.role === "user").length <= 1;
+    const index = onlyOneUser && recent[0].role === "user" ? recent.findIndex((entry) => entry.role === "tool") : 0;
+    if (index < 0) break;
+    recent.splice(index, 1);
+    if (!notes.includes("older messages omitted")) notes.push("older messages omitted");
+  }
+
+  const latestUser = [...recent].reverse().find((entry) => entry.role === "user");
+  for (let attempt = 0; latestUser !== undefined && Buffer.byteLength(render()) > MAX_TRANSCRIPT_BYTES && attempt < 10; attempt++) {
+    if (!notes.includes("latest user message truncated")) notes.push("latest user message truncated");
+    const excess = Buffer.byteLength(render()) - MAX_TRANSCRIPT_BYTES;
+    latestUser.text = clipEscaped(latestUser.text, Math.max(128, escapedSize(latestUser.text) - excess - 64));
+  }
+  return { transcript: render(), notes };
+}
+
+function buildTranscript(messages: unknown[]): TranscriptData {
+  const entries: Entry[] = [];
+  let userEvidence = false;
+  let missingUserText = false;
+  let userClipped = false;
+  let toolTruncated = false;
+  for (const message of messages) {
+    const record = asRecord(message);
+    if (record?.type === "user") {
+      const text = userText(message);
+      if (text === undefined) {
+        missingUserText = true;
+        continue;
+      }
+      userEvidence = true;
+      const clipped = clipChars(text, MAX_USER_CHARS);
+      if (clipped !== text) userClipped = true;
+      entries.push({ role: "user", text: clipped });
+    }
+    for (const tool of assistantTools(message)) {
+      const formatted = formatTool(tool);
+      if (formatted.truncated) toolTruncated = true;
+      entries.push({ role: "tool", text: formatted.text });
+    }
+  }
+  const rendered = renderTranscript(entries, toolTruncated, userClipped);
+  return { transcript: rendered.transcript, userEvidence, missingUserText, notes: rendered.notes };
+}
+
+export interface ReviewContext { transcript: string; complete: boolean; reason?: string; notes?: string[] }
 
 export function extractReviewContext(messages: unknown[]): ReviewContext {
-  const supported = messages.every((message) => {
+  const attachment = messages.some((message) => {
     const record = asRecord(message);
-    if (record?.type !== "user") return true;
+    if (record?.type !== "user") return false;
     // These attachments carry evidence that the text-only reviewer cannot see.
-    return userText(message) !== undefined && ["files", "skills", "agents"].every((key) =>
-      record[key] === undefined || (Array.isArray(record[key]) && record[key].length === 0));
+    return ["files", "skills", "agents"].some((key) =>
+      Array.isArray(record[key]) && record[key].length > 0);
   });
-  const transcript = extractTranscript(messages);
-  return {
-    transcript,
-    complete: supported && transcript.startsWith("User messages") && !transcript.includes("…"),
-  };
+  const data = buildTranscript(messages);
+  if (attachment)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "User authorization includes attachments that cannot be reviewed automatically",
+    };
+  if (data.missingUserText)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "A user message has no text that can be reviewed",
+    };
+  if (!data.userEvidence)
+    return {
+      transcript: data.transcript, complete: false, notes: data.notes,
+      reason: "No user authorization message is available",
+    };
+  return { transcript: data.transcript, complete: true, notes: data.notes };
 }
 
 export function extractTranscript(messages: unknown[]): string {
-  const entries: { role: "user" | "tool"; text: string }[] = [];
-  for (const message of messages) {
-    const text = userText(message);
-    if (text !== undefined) entries.push({ role: "user", text: truncate(text, MAX_ENTRY_CHARS) });
-    for (const tool of assistantTools(message)) entries.push({ role: "tool", text: formatTool(tool) });
-  }
-  if (!entries.some((entry) => entry.role === "user")) return "(no prior user messages in this session)";
-  let users = 0;
-  let tools = 0;
-  const recent = entries.slice().reverse().filter((entry) => entry.role === "user" ? ++users <= MAX_USERS : ++tools <= MAX_TOOLS).reverse();
-  const incomplete = recent.length < entries.length ? "\n… incomplete session context" : "";
-  return truncate(`User messages and prior tool calls (chronological):\n${JSON.stringify(recent)}${incomplete}`, MAX_TRANSCRIPT_CHARS);
+  return buildTranscript(messages).transcript;
 }

package/src/tui.tsx

@@ -1,7 +1,7 @@
 /** @jsxImportSource @opentui/solid */
 import { createSignal, Show } from "solid-js";
 import { Plugin } from "@opencode/plugin/tui";
-import { readDecisions } from "./state.js";
+import { readConfigError, readDecisions } from "./state.js";
 import { isReviewing } from "./tui-state.js";
 
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
@@ -11,21 +11,36 @@ export default Plugin.define({
   setup: async (ctx) => {
     if (ctx.options.tui === false) return;
     const [reviewing, setReviewing] = createSignal(false);
+    const [configError, setConfigError] = createSignal(false);
+    let announced = false;
     const update = () => {
       const route = ctx.ui.router.current();
       setReviewing(isReviewing(readDecisions(), route.type === "session" ? route.sessionID : undefined));
+      const error = readConfigError(ctx.location?.directory);
+      setConfigError(error !== undefined);
+      if (error === undefined) announced = false;
+      else if (!announced) {
+        announced = true;
+        ctx.ui.toast.show({
+          variant: "error", title: "auto-mode", duration: 10_000,
+          message: "Invalid configuration; automatic approval is disabled.",
+        });
+      }
     };
     update();
     const poll = setInterval(update, 250);
     const dispose = ctx.ui.slot({
       append: "app",
       render: () => (
-        <Show when={reviewing()}>
-          <box position="absolute" top={0} right={0} zIndex={10_000} flexDirection="row" gap={1}>
+        <box position="absolute" top={0} right={0} zIndex={10_000} flexDirection="row" gap={1}>
+          <Show when={configError()}>
+            <text fg={ctx.theme.text.feedback.error.base}>auto-mode: invalid config</text>
+          </Show>
+          <Show when={reviewing()}>
             <spinner frames={SPINNER_FRAMES} interval={120} color={ctx.theme.text.feedback.warning.base} />
             <text fg={ctx.theme.text.feedback.warning.base}>auto-mode reviewing</text>
-          </box>
-        </Show>
+          </Show>
+        </box>
       ),
     });
     return () => { clearInterval(poll); dispose(); };