@mortz.prk/opencode-auto-mode 1.0.0 → 1.0.2

package/src/shell.ts

@@ -1,34 +1,395 @@
-import { parse } from "shell-quote";
-import { basename } from "node:path";
-import { classify } from "./tiers.js";
 import type { ReviewResult } from "./reviewer.js";
+import {
+  BALANCED_QUOTES, CONTROL_OPERATORS, DYNAMIC, REDIRECT_OPERATORS, SCRIPT_HOSTS, SHELLS, STATEFUL,
+  denyCleanPrefix, denyInvocation, hasAmbiguousDescriptorClose, hasAssembledUndecodedSyntax, hasHeredoc,
+  hasUndecodedSyntax, heredocMarkers, isReadOnlyInvocation, logicalLines, normalizeContinuations, parseShell,
+  rawHeredocScript, resolveExecutable, stripDescriptorPrefixes,
+} from "./shell-policy.js";
 
-const WRAPPERS = new Set(["env", "command", "builtin", "exec", "eval", "source", ".", "cd", "pushd", "popd",
-  "sh", "bash", "dash", "zsh", "ksh", "fish", "pwsh", "powershell", "cmd", "!", "time", "coproc",
-  "if", "then", "else", "elif", "fi", "for", "while", "until", "case", "esac", "select", "do", "done", "function",
-  "export", "unset", "set", "shopt", "alias", "unalias", "trap", "umask", "exit", "return", "shift", "readonly", "local", "declare", "typeset"]);
-const BALANCED_QUOTES = /^(?:[^'"\\]|\\[^\r\n]|'[^']*'|"(?:[^"\\]|\\[^\r\n])*")*$/;
+const MAX_COMMAND_CHARS = 4096;
+const MAX_COMMAND_BYTES = 65_536;
+const WRITE_OPERATORS = new Set([">", ">>", ">|", "&>", "&>>", "<>"]);
+const DYNAMIC_SYNTAX = /\$\(|`|\$\(\s*\(|[<>]\(|\$\[/;
+const FORK_BOMB = /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/;
 
 export function shellWords(command: string): string[] | undefined {
-  if (!command || command.length > 4096 || /[$`~\r\n\0{}[\]]/.test(command) ||
+  if (!command || command.length > MAX_COMMAND_CHARS || /[$`~\r\n\0{}[\]]/.test(command) ||
       /[^\S \t]/.test(command) || !BALANCED_QUOTES.test(command)) return undefined;
   try {
-    const words = parse(command);
+    const words = parseShell(command);
     return words.length && words.every((word) => typeof word === "string") ? words as string[] : undefined;
   } catch { return undefined; }
 }
 
+interface Segment { words: string[]; globs: boolean[]; write: boolean }
+type Verdict = { decision: "deny"; reason: string } | { decision: "allow" | "review" | "ask" };
+
+/** True when the effective executable is a shell, a dynamic builtin, or a stateful builtin. */
+function dynamicExecution(words: string[]): boolean {
+  const executable = resolveExecutable(words);
+  if (executable === undefined) return true;
+  if (SHELLS.has(executable.name) || DYNAMIC.has(executable.name) || STATEFUL.has(executable.name)) return true;
+  return executable.name === "find" && words.slice(executable.index + 1)
+    .some((word) => /^-(?:exec|execdir|ok|okdir|delete)$/.test(word));
+}
+
+function analyzeSegment(segment: Segment): Verdict {
+  if (!segment.words.length) return segment.write ? { decision: "review" } : { decision: "allow" };
+  const command = segment.words[0];
+  if (!command || command.includes("$")) return { decision: "ask" };
+  // A deny that is already identifiable wins over every uncertainty below, so
+  // `sudo id *.txt` stays a mandatory deny instead of becoming a review.
+  const blocked = denyInvocation(segment.words);
+  if (blocked !== undefined) return { decision: "deny", reason: blocked };
+  if (dynamicExecution(segment.words)) return { decision: "ask" };
+  // `isReadOnlyInvocation` refuses any argument an unquoted expansion could turn
+  // into several words, so the literal flag policies only judge what will run.
+  if (!segment.write && isReadOnlyInvocation(segment.words, segment.globs)) return { decision: "allow" };
+  return { decision: "review" };
+}
+
+/** Token shapes this module consumes; `parse` returns a wider union. */
+type Token = string | { comment: string } | { op: string; pattern?: string };
+
+interface ParsedLine { segments: Segment[]; complete: boolean }
+
+/** Characters that end an unquoted shell word. JS `\s` is wider than a shell, so the set is explicit. */
+const WORD_DELIMITER = /[ \t\n;|&()<>]/;
+
+/**
+ * One entry per shell word, true when the word contains an expansion that can
+ * turn it into several arguments.
+ *
+ * `shell-quote` only marks `*` and `?` as globs, but bracket (`[ab]`) and brace
+ * (`{a,b}`) expansion, and parameter expansion, change the argument count too.
+ * This scan is quote- and escape-aware, so quoted or escaped bracket, brace, and
+ * glob markers are not flagged here. `shell-quote` still reports an escaped
+ * `*`/`?` as a glob token, which stays conservatively reviewed.
+ *
+ * A parameter inside double quotes counts as uncertain for the same reason: it
+ * stays one word only after expansion, and the value decides both the text and —
+ * for `"$@"` — the count. `sort "${X:--oout}" file` writes a file when `X` is
+ * unset, `find . "${X:--delete}"` deletes, and `uniq "$@"` can become two
+ * operands, while `shell-quote` sees only an empty string. Single quotes and an
+ * escaped `\$` are literal and stay safe. Matching the flags by position keeps
+ * the raw text out of the parsed logic.
+ */
+function wordExpansions(command: string): boolean[] {
+  const expansions: boolean[] = [];
+  let present = false;
+  let expansion = false;
+  let wordStart = true;
+  let quote: "'" | '"' | "$'" | undefined;
+  const flush = () => {
+    if (!present) return;
+    expansions.push(expansion);
+    present = false;
+    expansion = false;
+  };
+  for (let index = 0; index < command.length; index++) {
+    const character = command[index];
+    if (quote === "'") {
+      if (character === "'") quote = undefined;
+      continue;
+    }
+    if (quote === "$'") {
+      if (character === "\\") index++;
+      else if (character === "'") quote = undefined;
+      continue;
+    }
+    if (quote === '"') {
+      if (character === "\\") index++;
+      else if (character === '"') quote = undefined;
+      else if (character === "$") expansion = true;
+      continue;
+    }
+    if (character === "\\") {
+      present = true;
+      if (index + 1 < command.length && command[++index] !== "\n") wordStart = false;
+      continue;
+    }
+    if (character === "'" || character === '"' || (character === "$" && command[index + 1] === "'")) {
+      present = true;
+      wordStart = false;
+      if (character === "'" || character === '"') quote = character;
+      else { quote = "$'"; index++; }
+      continue;
+    }
+    if (character === "#" && wordStart) {
+      const end = command.indexOf("\n", index);
+      flush();
+      if (end === -1) break;
+      index = end;
+      wordStart = true;
+      continue;
+    }
+    if (WORD_DELIMITER.test(character)) {
+      flush();
+      wordStart = true;
+      continue;
+    }
+    if (character === "*" || character === "?" || character === "[" || character === "{" ||
+        character === "$") expansion = true;
+    present = true;
+    wordStart = false;
+  }
+  flush();
+  return expansions;
+}
+
+/** Splits parsed tokens into simple commands, tracking whether the whole line parsed. */
+function lineSegments(tokens: readonly Token[], expansions: readonly boolean[] = []): ParsedLine {
+  const segments: Segment[] = [{ words: [], globs: [], write: false }];
+  let current = segments[0];
+  let redirect: { write: boolean } | undefined;
+  let wordIndex = 0;
+  const nextExpansion = () => expansions[wordIndex++] ?? false;
+  for (const token of tokens) {
+    if (typeof token === "string") {
+      if (redirect) {
+        const target = token;
+        nextExpansion();
+        if (redirect.write && target !== "/dev/null" && !/^\d+$/.test(target) && !target.startsWith("&"))
+          current.write = true;
+        redirect = undefined;
+      } else {
+        current.words.push(token);
+        current.globs.push(nextExpansion());
+      }
+      continue;
+    }
+    if ("comment" in token) continue;
+    if (token.op === "glob" && token.pattern !== undefined) {
+      if (redirect) {
+        // A glob is still a redirection target, so it never becomes a command word.
+        nextExpansion();
+        if (redirect.write) current.write = true;
+        redirect = undefined;
+      } else {
+        nextExpansion();
+        current.words.push(token.pattern);
+        current.globs.push(true);
+      }
+      continue;
+    }
+    if (CONTROL_OPERATORS.has(token.op)) {
+      // A control operator before the redirection target is invalid syntax.
+      if (redirect) return { segments, complete: false };
+      current = { words: [], globs: [], write: false };
+      segments.push(current);
+      continue;
+    }
+    if (REDIRECT_OPERATORS.has(token.op)) {
+      // Descriptor prefixes (`2>` in `2>/dev/null`) are stripped from the source
+      // before parsing, so a numeric word here is an operand and must survive.
+      redirect = { write: WRITE_OPERATORS.has(token.op) };
+      continue;
+    }
+    return { segments, complete: false };
+  }
+  return { segments, complete: redirect === undefined };
+}
+
+function analyzeLine(command: string): Verdict {
+  if (!command.trim()) return { decision: "allow" };
+  if (!BALANCED_QUOTES.test(command)) return { decision: "ask" };
+  if (FORK_BOMB.test(command)) return { decision: "deny", reason: "dangerous shell operation" };
+
+  let tokens;
+  try { tokens = parseShell(command); }
+  catch { return { decision: "ask" }; }
+
+  const { segments, complete } = lineSegments(tokens, wordExpansions(stripDescriptorPrefixes(command)));
+  // Deny rules that are already visible must win even when later arguments are
+  // dynamic (`sudo id $(...)`) and even when the line only parses partially.
+  for (const segment of segments) {
+    const blocked = denyInvocation(segment.words);
+    if (blocked !== undefined) return { decision: "deny", reason: blocked };
+  }
+  // Bash closes the descriptor and runs the rest of the word as a command
+  // (`2>&-sudo id` runs sudo), while shell-quote reads `-sudo` as the redirect
+  // target. Neither reading may approve the invocation.
+  if (hasAmbiguousDescriptorClose(command)) return { decision: "ask" };
+  if (!complete || DYNAMIC_SYNTAX.test(command)) return { decision: "ask" };
+
+  let ask = false;
+  let review = false;
+  for (const segment of segments) {
+    const verdict = analyzeSegment(segment);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
+  }
+  if (ask) return { decision: "ask" };
+  return { decision: review ? "review" : "allow" };
+}
+
+/** Analyzes every logical line, keeping deny precedence over ask and review. */
+function analyzeLines(command: string): Verdict {
+  let ask = false;
+  let review = false;
+  const { lines, certain } = logicalLines(command);
+  // An undecodable header or a body that can move its terminator leaves the
+  // script/data split unknown, so nothing past that line may be auto-approved.
+  if (certain < lines.length) ask = true;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const verdict = analyzeLine(trimmed);
+    if (verdict.decision === "deny") return verdict;
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
+  }
+  if (ask) return { decision: "ask" };
+  return { decision: review ? "review" : "allow" };
+}
+
+function analyzeHeredoc(command: string): Verdict {
+  const lines = command.split("\n");
+  const firstLine = lines[0] ?? "";
+  const markers = heredocMarkers(firstLine);
+  if (!markers.length) return { decision: "ask" };
+  let index = 1;
+  const bodies: { lines: string[]; quoted: boolean }[] = [];
+  for (const marker of markers) {
+    const body: string[] = [];
+    let closed = false;
+    while (index < lines.length) {
+      const candidate = marker.stripTabs ? lines[index].replace(/^\t+/, "") : lines[index];
+      index++;
+      if (candidate === marker.delimiter) { closed = true; break; }
+      body.push(candidate);
+    }
+    if (!closed) return { decision: "ask" };
+    bodies.push({ lines: body, quoted: marker.quoted });
+  }
+
+  // The header line is script, and so is the text after the bodies — but only if
+  // the bodies really end where the raw text says. The header is analyzed on its
+  // own because its markers have already been consumed above: handing them back
+  // to the heredoc scanner would swallow the tail as a second body.
+  const header = analyzeLine(firstLine);
+  if (header.decision === "deny") return header;
+  // An unquoted body is matched against its terminator after the shell removes
+  // continuations, so a body line ending in a backslash moves the boundary —
+  // including the last one, whose `\`-newline joins the terminator line into the
+  // body. That has to fail closed before the tail is judged, or a tail that is
+  // really body data would deny. A quoted body keeps its backslashes literally.
+  for (const body of bodies) {
+    if (body.quoted) continue;
+    if (body.lines.some((line) => line.endsWith("\\"))) return { decision: "ask" };
+  }
+  // The tail is analyzed as its own script so a further heredoc there is routed
+  // the same way, and a blocked command spanning a quoted newline is still seen
+  // whole.
+  const tail = lines.slice(index).join("\n");
+  const rest: Verdict = tail ? analyze(tail) : { decision: "allow" };
+  if (rest.decision === "deny") return rest;
+  let ask = header.decision === "ask" || rest.decision === "ask";
+  const review = header.decision === "review" || rest.decision === "review";
+  // Unquoted heredoc bodies undergo command and parameter expansion. That can run
+  // a substitution, so it fails closed, but it cannot move the terminator: the
+  // tail denied above stays a deny.
+  for (const body of bodies) {
+    if (body.quoted) continue;
+    if (DYNAMIC_SYNTAX.test(body.lines.join("\n"))) return { decision: "ask" };
+  }
+  try {
+    const words = parseShell(firstLine).filter((token): token is string => typeof token === "string");
+    const executable = resolveExecutable(words);
+    if (executable === undefined || SHELLS.has(executable.name) || SCRIPT_HOSTS.has(executable.name) ||
+        DYNAMIC.has(executable.name) || STATEFUL.has(executable.name)) ask = true;
+  } catch { return { decision: "ask" }; }
+  if (ask) return { decision: "ask" };
+  return { decision: review ? "review" : "allow" };
+}
+
+function analyze(command: string): Verdict {
+  // A shell separates words only on space, tab, and newline. JS `\s` (and the
+  // parser behind it) also matches CR, FF, VT, NBSP, and Unicode spaces, which
+  // can move a heredoc boundary or turn a midword hash into a comment, so any of
+  // them fails closed before normalization, the deny pass, or parsing.
+  //
+  // `$[` is the legacy arithmetic expansion: the `<<` inside it is a shift, not
+  // a heredoc, so heredoc routing would treat the rest of the script as a body
+  // and swallow a trailing command. Extended quoting has the same problem from
+  // the other side: `$'...'` lets a backslash escape its own quote, so a quote
+  // scan can end the string early and read `<<EOF` as a heredoc, and `$"..."`
+  // is a locale quote this parser does not decode. Reject all three on the raw
+  // source before normalization or heredoc routing, conservatively including
+  // quoted and heredoc data.
+  if (hasUndecodedSyntax(command)) return { decision: "ask" };
+  // Fail closed on any raw heredoc header that normalization cannot be trusted
+  // on: the raw source is the only place its marker and delimiter are still
+  // intact. Every header is validated, not just the first, because a continued
+  // header after a stable body is the same problem. Each raw line before the
+  // ambiguity is certainly script — the header line itself runs before the shell
+  // reads its body — so a deny visible there is mandatory; everything after may
+  // be data and only reaches manual approval.
+  const raw = rawHeredocScript(command);
+  if (raw.ambiguous) {
+    for (const line of raw.lines) {
+      // A line whose own normalization assembles unsupported quoting cannot be
+      // parsed safely; its deny is left to manual approval instead of guessed.
+      if (hasAssembledUndecodedSyntax(line)) continue;
+      // The raw line may still carry a `\`-newline that the shell removes before
+      // it forms this header; removing it here only reaches the deny pass, and
+      // the header line itself is always script.
+      const verdict = analyzeLine(normalizeContinuations(line).trim());
+      if (verdict.decision === "deny") return verdict;
+    }
+    return { decision: "ask" };
+  }
+  // Normalization removes `\`-newlines, so the shell can parse an unsupported
+  // form the raw check above could not see: `sort $`+newline+`'\x2doout'` is
+  // `sort -oout` to Bash once the pair is gone. The marker itself is never parsed.
+  // A deny in the clean prefix before it is still mandatory, so check that first;
+  // only then repeat the gate and fail closed before heredoc routing.
+  const normalized = normalizeContinuations(command);
+  if (hasUndecodedSyntax(normalized)) {
+    const blocked = denyCleanPrefix(normalized);
+    if (blocked !== undefined) return { decision: "deny", reason: blocked };
+    return { decision: "ask" };
+  }
+  // `logicalLines` must split on the newlines the shell actually treats as
+  // separators, and heredoc bodies stay untouched.
+  if (hasHeredoc(normalized)) return analyzeHeredoc(normalized);
+  if (normalized.includes("\n")) return analyzeLines(normalized);
+  return analyzeLine(normalized);
+}
+
 export function guardShell(resources: readonly string[]): ReviewResult | undefined {
   if (process.platform === "win32") return { decision: "ask", reason: "Shell dialect requires manual approval" };
-  if (!resources.length || resources.length > 256 || resources.some((resource) => resource.length > 4096) ||
-      resources.reduce((sum, resource) => sum + Buffer.byteLength(resource), 0) > 65_536)
+  if (!resources.length || resources.length > 256 || resources.some((resource) => resource.length > MAX_COMMAND_CHARS) ||
+      resources.reduce((sum, resource) => sum + Buffer.byteLength(resource), 0) > MAX_COMMAND_BYTES)
     return { decision: "ask", reason: "Shell command exceeds parsing limits" };
-  let uncertain = false;
+  let ask = false;
+  let review = false;
   for (const resource of resources) {
-    const words = shellWords(resource);
-    const result = classify("shell", [resource, ...(words ? [words.join(" ")] : [])]);
-    if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason };
-    if (!words || words[0].includes("=") || WRAPPERS.has(basename(words[0]))) uncertain = true;
+    const verdict = analyze(resource);
+    if (verdict.decision === "deny") return { decision: "deny", reason: verdict.reason };
+    if (verdict.decision === "ask") ask = true;
+    else if (verdict.decision === "review") review = true;
   }
-  return uncertain ? { decision: "ask", reason: "Shell syntax requires manual approval" } : undefined;
+  if (ask) return { decision: "ask", reason: "Shell syntax requires manual approval" };
+  return review ? undefined : { decision: "allow", reason: "read-only command" };
 }
+
+export interface ShellClassification {
+  tier: "auto-allow" | "auto-deny" | "review";
+  reason: string;
+}
+
+/**
+ * Static tier classification for shell actions. The shell guard is the single
+ * source of truth so the classifier can never allow or deny something the guard
+ * would not.
+ */
+export function classifyShell(resources: readonly string[]): ShellClassification {
+  const verdict = guardShell(resources);
+  if (verdict?.decision === "deny") return { tier: "auto-deny", reason: verdict.reason };
+  if (verdict?.decision === "allow") return { tier: "auto-allow", reason: verdict.reason };
+  if (verdict?.decision === "ask") return { tier: "review", reason: "shell syntax requires manual approval" };
+  return { tier: "review", reason: "evaluate the entire command as one action" };
+}
+

package/src/state.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { createHash } from "node:crypto";
 import { privateFile, STORAGE_DIR } from "./storage.js";
 
 export type DecisionKind = "reviewing" | "allow" | "deny" | "ask";
@@ -17,6 +18,80 @@ export interface DecisionRecord {
 export const STATE_FILE = path.join(STORAGE_DIR, "state.json");
 
 const MAX_AGE_MS = 10 * 60 * 1000;
+const MAX_CONFIG_MESSAGE = 1024;
+
+export interface ConfigErrorRecord {
+  directory: string;
+  message: string;
+}
+
+interface StoredConfigError extends ConfigErrorRecord {
+  at: number;
+}
+
+function canonicalDirectory(directory: string): string {
+  try { return fs.realpathSync.native(directory); }
+  catch { return path.resolve(directory); }
+}
+
+function configErrorFile(directory: string): string {
+  return `config-error-${createHash("sha256").update(directory).digest("hex")}.json`;
+}
+
+function readConfigErrorFile(directory: string): StoredConfigError | undefined {
+  let fd: number | undefined;
+  try {
+    fd = privateFile(configErrorFile(directory), false);
+    if (fs.fstatSync(fd).size > 4096) return undefined;
+    const parsed: unknown = JSON.parse(fs.readFileSync(fd, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
+    const record = parsed as Partial<StoredConfigError>;
+    if (record.directory !== directory || typeof record.message !== "string" ||
+        record.message.length > MAX_CONFIG_MESSAGE || typeof record.at !== "number" || !Number.isFinite(record.at))
+      return undefined;
+    return { directory: record.directory, message: record.message, at: record.at };
+  } catch {
+    return undefined;
+  } finally { if (fd !== undefined) fs.closeSync(fd); }
+}
+
+function writeConfigError(record: StoredConfigError): void {
+  let fd: number | undefined;
+  const temporary = `config-error-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp`;
+  const target = configErrorFile(record.directory);
+  try {
+    fd = privateFile(temporary, true);
+    fs.writeSync(fd, JSON.stringify(record), 0);
+    fs.closeSync(fd);
+    fd = undefined;
+    fs.renameSync(path.join(STORAGE_DIR, temporary), path.join(STORAGE_DIR, target));
+  } catch {
+    // Badge state is best effort and must not interrupt permission review.
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    try { fs.rmSync(path.join(STORAGE_DIR, temporary), { force: true }); }
+    catch { /* best effort */ }
+  }
+}
+
+/** Records that the plugin options for a location are unusable, so the TUI can show it. */
+export function recordConfigError(directory: string, message: string): void {
+  const canonical = canonicalDirectory(directory);
+  writeConfigError({ directory: canonical, message: message.slice(0, MAX_CONFIG_MESSAGE), at: Date.now() });
+}
+
+export function readConfigError(directory: string | undefined): ConfigErrorRecord | undefined {
+  if (directory === undefined) return undefined;
+  const canonical = canonicalDirectory(directory);
+  const record = readConfigErrorFile(canonical);
+  return record === undefined ? undefined : { directory: record.directory, message: record.message };
+}
+
+export function clearConfigError(directory: string): void {
+  try {
+    fs.rmSync(path.join(STORAGE_DIR, configErrorFile(canonicalDirectory(directory))), { force: true });
+  } catch { /* best effort */ }
+}
 
 export function readDecisions(): Record<string, DecisionRecord> {
   let fd: number | undefined;

package/src/status.ts

@@ -0,0 +1,72 @@
+import type { AutoModeDecision, AutoModeStatus } from "./rpc.js";
+
+const MAX_RECENT = 100;
+// Match the audit record bounds so live status and durable history describe
+// the same action, not an unbounded copy of the permission event.
+const MAX_ACTION_CHARS = 128;
+const MAX_STAGE_CHARS = 64;
+const MAX_REASON_CHARS = 200;
+const MAX_REVIEWING = 256;
+
+function clip(value: string, max = MAX_REASON_CHARS): string {
+  // Count code points, not UTF-16 units, so clipping cannot cut a surrogate
+  // pair in half.
+  const characters = Array.from(value);
+  return characters.length > max ? `${characters.slice(0, max - 1).join("")}…` : value;
+}
+
+export interface StatusTracker {
+  start(sessionID: string, reviewID: string, at: number): void;
+  finish(decision: Omit<AutoModeDecision, "reason"> & { reason: string }): AutoModeDecision;
+  snapshot(input: { enabled: boolean; configError?: string; classifiers: string[]; reviewTimeoutMs: number; sessionID?: string }): AutoModeStatus;
+  recent(limit: number, sessionID?: string): AutoModeDecision[];
+}
+
+/**
+ * Small in-memory view of AutoMode for clients. It holds no prompts and is
+ * bounded in both entries and text so a long session cannot grow it without
+ * limit; durable history stays in the audit log.
+ */
+export function createStatusTracker(): StatusTracker {
+  // Keyed by review rather than session: a session can ask about several
+  // actions at once, and finishing one must not hide the others.
+  const reviewing = new Map<string, { sessionID: string; startedAt: number }>();
+  let recent: AutoModeDecision[] = [];
+
+  return {
+    start(sessionID, reviewID, at) {
+      if (reviewing.size >= MAX_REVIEWING && !reviewing.has(reviewID)) {
+        const oldest = reviewing.keys().next().value;
+        if (oldest !== undefined) reviewing.delete(oldest);
+      }
+      reviewing.set(reviewID, { sessionID, startedAt: at });
+    },
+    finish(decision) {
+      reviewing.delete(decision.reviewID);
+      const entry: AutoModeDecision = {
+        ...decision,
+        action: clip(decision.action, MAX_ACTION_CHARS),
+        stage: clip(decision.stage, MAX_STAGE_CHARS),
+        reason: clip(decision.reason),
+      };
+      recent = [...recent, entry].slice(-MAX_RECENT);
+      return entry;
+    },
+    snapshot(input) {
+      return {
+        enabled: input.enabled,
+        ...(input.configError === undefined ? {} : { configError: clip(input.configError) }),
+        classifiers: input.classifiers,
+        reviewTimeoutMs: input.reviewTimeoutMs,
+        reviewing: [...reviewing.entries()]
+          .filter(([, entry]) => input.sessionID === undefined || entry.sessionID === input.sessionID)
+          .map(([reviewID, entry]) => ({ sessionID: entry.sessionID, reviewID, startedAt: entry.startedAt })),
+        recent: input.sessionID === undefined ? recent.slice(-20) : recent.filter((entry) => entry.sessionID === input.sessionID).slice(-20),
+      };
+    },
+    recent(limit, sessionID) {
+      const matches = sessionID === undefined ? recent : recent.filter((entry) => entry.sessionID === sessionID);
+      return matches.slice(-limit);
+    },
+  };
+}

package/src/tiers.ts

@@ -1,20 +1,11 @@
 import * as path from "node:path";
 import { lstatSync, realpathSync } from "node:fs";
+import { classifyShell } from "./shell.js";
 
 export type Tier = "auto-allow" | "auto-deny" | "review" | "unknown";
 export interface Classification { tier: Tier; reason: string }
 export interface ClassifyOptions { projectDir?: string; allowInProjectEdits?: boolean }
 
-const READ_ONLY_COMMANDS = new Set(["pwd", "whoami", "hostname", "uname", "id", "groups", "ls", "ls -a", "ls -l", "ls -la", "ls -al", "ls -A"]);
-const BLOCKED_SHELL = [
-  /\brm\s+-rf?\s+\/(\s|$|\*)/,
-  /\bsudo\b/,
-  /\bmkfs\./,
-  /\bdd\s+if=.*\s+of=\/(dev|sd|nvme|hd)/,
-  /\b(shutdown|reboot|halt|poweroff)\b/,
-  /:\(\)\s*\{\s*:\s*\|\s*:&\s*\};:/,
-  /\bchmod\s+777\b/,
-];
 const SENSITIVE_PATH = /(?:^|[/\\])(?:\.[^/\\]+|opencode\.jsonc?|id_(?:rsa|dsa|ecdsa|ed25519)|[^/\\]+\.(?:pem|key|p12|pfx)|[^/\\]*(?:credentials|token|secret|password|private.key)[^/\\]*)(?:[/\\]|$)/i;
 
 export function isInProject(target: string, projectDir: string): boolean {
@@ -44,16 +35,7 @@ function safeTarget(target: string, projectDir: string): boolean {
 }
 
 export function classify(action: string, resources: readonly string[], options?: ClassifyOptions): Classification {
-  if (action === "shell") {
-    for (const command of resources) {
-      for (const pattern of BLOCKED_SHELL) {
-        if (pattern.test(command)) return { tier: "auto-deny", reason: "dangerous shell operation" };
-      }
-    }
-    if (resources.length > 0 && resources.every((command) => READ_ONLY_COMMANDS.has(command)))
-      return { tier: "auto-allow", reason: "read-only command" };
-    return { tier: "review", reason: "evaluate the entire command as one action" };
-  }
+  if (action === "shell") return classifyShell(resources);
   if (action === "read" || ((action === "edit" || action === "write") && options?.allowInProjectEdits)) {
     if (options?.projectDir && resources.length > 0 && resources.every((target) =>
         target.length > 0 && safeTarget(target, options.projectDir!)))

package/src/timeout.ts

@@ -0,0 +1,30 @@
+import { ReviewFailure } from "./errors.js";
+
+/**
+ * Bounds a provider promise and rejects it as soon as `signal` aborts.
+ *
+ * A provider may ignore the signal, so this wrapper settles on its own and
+ * clears both its timer and abort listener on every path. Adding a listener to
+ * an already-aborted signal never replays the abort, so check `aborted` after
+ * subscribing or a cancelled fallback stage would wait for the full timeout.
+ */
+export function withTimeout<T>(promise: Promise<T>, ms: number, signal?: AbortSignal): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let settled = false;
+    const finish = (action: () => void) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      action();
+    };
+    const onAbort = () => finish(() => reject(new ReviewFailure("cancelled", "Review cancelled")));
+    const timer = setTimeout(() => finish(() => reject(new ReviewFailure("timeout", "Review timed out"))), ms);
+    // Observe the provider promise before any early return: a promise that is
+    // already rejected must not become an unhandled rejection just because the
+    // signal was aborted before this wrapper was created.
+    promise.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+  });
+}