@mortz.prk/opencode-auto-mode 1.0.1 → 1.0.2

package/src/tiers.ts

@@ -1,22 +1,11 @@
 import * as path from "node:path";
 import { lstatSync, realpathSync } from "node:fs";
+import { classifyShell } from "./shell.js";
 
 export type Tier = "auto-allow" | "auto-deny" | "review" | "unknown";
 export interface Classification { tier: Tier; reason: string }
 export interface ClassifyOptions { projectDir?: string; allowInProjectEdits?: boolean }
 
-const READ_ONLY_COMMANDS = new Set(["pwd", "whoami", "hostname", "uname", "id", "groups", "ls", "ls -a", "ls -l", "ls -la", "ls -al", "ls -A",
-  "git status", "git status --short", "git diff", "git log", "git show", "git branch --show-current",
-  "date", "date +%s", "cat", "head", "tail", "rg", "grep", "wc", "bun test", "bun run lint", "bun run typecheck"]);
-const BLOCKED_SHELL = [
-  /\brm\s+-rf?\s+\/(\s|$|\*)/,
-  /\bsudo\b/,
-  /\bmkfs\./,
-  /\bdd\s+if=.*\s+of=\/(dev|sd|nvme|hd)/,
-  /\b(shutdown|reboot|halt|poweroff)\b/,
-  /:\(\)\s*\{\s*:\s*\|\s*:&\s*\};:/,
-  /\bchmod\s+777\b/,
-];
 const SENSITIVE_PATH = /(?:^|[/\\])(?:\.[^/\\]+|opencode\.jsonc?|id_(?:rsa|dsa|ecdsa|ed25519)|[^/\\]+\.(?:pem|key|p12|pfx)|[^/\\]*(?:credentials|token|secret|password|private.key)[^/\\]*)(?:[/\\]|$)/i;
 
 export function isInProject(target: string, projectDir: string): boolean {
@@ -46,16 +35,7 @@ function safeTarget(target: string, projectDir: string): boolean {
 }
 
 export function classify(action: string, resources: readonly string[], options?: ClassifyOptions): Classification {
-  if (action === "shell") {
-    for (const command of resources) {
-      for (const pattern of BLOCKED_SHELL) {
-        if (pattern.test(command)) return { tier: "auto-deny", reason: "dangerous shell operation" };
-      }
-    }
-    if (resources.length > 0 && resources.every((command) => READ_ONLY_COMMANDS.has(command)))
-      return { tier: "auto-allow", reason: "read-only command" };
-    return { tier: "review", reason: "evaluate the entire command as one action" };
-  }
+  if (action === "shell") return classifyShell(resources);
   if (action === "read" || ((action === "edit" || action === "write") && options?.allowInProjectEdits)) {
     if (options?.projectDir && resources.length > 0 && resources.every((target) =>
         target.length > 0 && safeTarget(target, options.projectDir!)))

package/src/timeout.ts

@@ -0,0 +1,30 @@
+import { ReviewFailure } from "./errors.js";
+
+/**
+ * Bounds a provider promise and rejects it as soon as `signal` aborts.
+ *
+ * A provider may ignore the signal, so this wrapper settles on its own and
+ * clears both its timer and abort listener on every path. Adding a listener to
+ * an already-aborted signal never replays the abort, so check `aborted` after
+ * subscribing or a cancelled fallback stage would wait for the full timeout.
+ */
+export function withTimeout<T>(promise: Promise<T>, ms: number, signal?: AbortSignal): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let settled = false;
+    const finish = (action: () => void) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", onAbort);
+      action();
+    };
+    const onAbort = () => finish(() => reject(new ReviewFailure("cancelled", "Review cancelled")));
+    const timer = setTimeout(() => finish(() => reject(new ReviewFailure("timeout", "Review timed out"))), ms);
+    // Observe the provider promise before any early return: a promise that is
+    // already rejected must not become an unhandled rejection just because the
+    // signal was aborted before this wrapper was created.
+    promise.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+  });
+}

package/src/traces.ts

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
 import type { AuditRecord } from "./audit.js";
+import { sanitizeRecord } from "./audit.js";
 import type { OtlpOptions } from "./otlp.js";
 import type { StageResult } from "./reviewer.js";
 
@@ -55,20 +56,25 @@ export function createTraceExporter(setting: boolean | OtlpOptions | undefined,
       return {
         traceID, spanID, attempts,
         finish(record) {
-          const shared = [attribute("review.id", record.reviewID), attribute("session.id", record.sessionID)];
+          // Both log sinks sanitize before serialising; traces are a third sink
+          // and must not export unbounded record fields.
+          const safe = sanitizeRecord(record);
+          const shared = [attribute("review.id", safe.reviewID), attribute("session.id", safe.sessionID)];
           const spans = [{
             traceId: traceID, spanId: spanID, name: "auto_mode.review", kind: 1,
-            startTimeUnixNano: nano(startedAt), endTimeUnixNano: nano(startedAt + record.durationMs),
-            attributes: [...shared, attribute("action", record.action), attribute("agent", record.agent ?? ""),
-              attribute("decision", record.decision), attribute("stage", record.stage)],
-            status: { code: record.error ? 2 : 1 },
+            startTimeUnixNano: nano(startedAt), endTimeUnixNano: nano(startedAt + safe.durationMs),
+            attributes: [...shared, attribute("action", safe.action), attribute("agent", safe.agent ?? ""),
+              attribute("decision", safe.decision), attribute("stage", safe.stage),
+              ...(safe.errorKind === undefined ? [] : [attribute("error.kind", safe.errorKind)])],
+            status: { code: safe.error ? 2 : 1 },
           }, ...attempts.map((attempt) => ({
             traceId: traceID, spanId: randomBytes(8).toString("hex"), parentSpanId: spanID,
             name: "auto_mode.classifier", kind: 1,
             startTimeUnixNano: nano(attempt.startedAt), endTimeUnixNano: nano(attempt.startedAt + attempt.durationMs),
             attributes: [...shared, attribute("classifier.index", attempt.index), attribute("classifier.type", attempt.type),
-              attribute("model", attempt.model ?? ""), attribute("decision", attempt.result.decision)],
-            status: { code: 1 },
+              attribute("model", attempt.model ?? ""), attribute("decision", attempt.result.decision),
+              ...(attempt.result.errorKind === undefined ? [] : [attribute("error.kind", attempt.result.errorKind)])],
+            status: { code: attempt.result.errorKind === undefined ? 1 : 2 },
           }))];
           const body = JSON.stringify({ resourceSpans: [{
             resource: { attributes: [attribute("service.name", "opencode-auto-mode")] },

package/src/transcript.ts

@@ -1,7 +1,7 @@
 const MAX_USERS = 10;
 const MAX_TOOLS = 20;
 const MAX_USER_CHARS = 8_000;
-const MAX_ENTRY_CHARS = 500;
+const MAX_ENTRY_BYTES = 500;
 const MAX_TRANSCRIPT_BYTES = 12_000;
 
 interface ToolEntry {
@@ -14,10 +14,6 @@ interface Entry {
   text: string;
 }
 
-function truncate(value: string, max: number): string {
-  return value.length > max ? `${value.slice(0, max - 1)}…` : value;
-}
-
 function asRecord(value: unknown): Record<string, unknown> | undefined {
   if (typeof value === "object" && value !== null && !Array.isArray(value)) {
     return value as Record<string, unknown>;
@@ -56,8 +52,11 @@ function formatTool(tool: ToolEntry): { text: string; truncated: boolean } {
     const input = state?.["input"] ?? tool.input;
     const raw = typeof input === "string" ? input : JSON.stringify(input);
     if (raw) {
-      truncated = raw.length > MAX_ENTRY_CHARS;
-      detail = truncate(raw, MAX_ENTRY_CHARS);
+      // Keep the tail as well as the head: written payloads and patches often
+      // carry their constraints at the end. Clip once, on escaped bytes, so a
+      // later UTF-16 length check cannot cut the preserved tail back off.
+      detail = clipEscaped(raw, MAX_ENTRY_BYTES);
+      truncated = detail !== raw;
     }
   } catch {
     detail = "";
@@ -101,9 +100,12 @@ function clipEscaped(value: string, maxBytes: number): string {
   return `${prefixByEscapedBytes(characters, headBudget)}${marker}${suffixByEscapedBytes(characters, budget - headBudget)}`;
 }
 
-function clipChars(value: string, max: number): string {
-  if (value.length <= max) return value;
+/** Clips text to `max` code points, keeping both ends for review evidence. */
+export function clipChars(value: string, max: number): string {
   const characters = Array.from(value);
+  // Compare code points, not UTF-16 units, so astral characters cannot make
+  // this return a longer string than it received.
+  if (characters.length <= max) return value;
   const head = Math.floor(max * 0.6);
   return `${characters.slice(0, head).join("")}…${characters.slice(characters.length - (max - head)).join("")}`;
 }
@@ -111,7 +113,6 @@ function clipChars(value: string, max: number): string {
 interface TranscriptData {
   transcript: string;
   userEvidence: boolean;
-  missingUserText: boolean;
   notes: string[];
 }
 
@@ -148,17 +149,15 @@ function renderTranscript(entries: Entry[], toolTruncated: boolean, userClipped:
 function buildTranscript(messages: unknown[]): TranscriptData {
   const entries: Entry[] = [];
   let userEvidence = false;
-  let missingUserText = false;
   let userClipped = false;
   let toolTruncated = false;
   for (const message of messages) {
     const record = asRecord(message);
     if (record?.type === "user") {
       const text = userText(message);
-      if (text === undefined) {
-        missingUserText = true;
-        continue;
-      }
+      // An empty turn (attachments only, synthetic input) says nothing about
+      // authorization; it must not invalidate the rest of the session.
+      if (text === undefined) continue;
       userEvidence = true;
       const clipped = clipChars(text, MAX_USER_CHARS);
       if (clipped !== text) userClipped = true;
@@ -171,7 +170,7 @@ function buildTranscript(messages: unknown[]): TranscriptData {
     }
   }
   const rendered = renderTranscript(entries, toolTruncated, userClipped);
-  return { transcript: rendered.transcript, userEvidence, missingUserText, notes: rendered.notes };
+  return { transcript: rendered.transcript, userEvidence, notes: rendered.notes };
 }
 
 export interface ReviewContext { transcript: string; complete: boolean; reason?: string; notes?: string[] }
@@ -179,6 +178,8 @@ export interface ReviewContext { transcript: string; complete: boolean; reason?:
 export function extractReviewContext(messages: unknown[]): ReviewContext {
   const attachment = messages.some((message) => {
     const record = asRecord(message);
+    // Skill messages carry model-facing instructions the text-only reviewer cannot see.
+    if (record?.type === "skill") return true;
     if (record?.type !== "user") return false;
     // These attachments carry evidence that the text-only reviewer cannot see.
     return ["files", "skills", "agents"].some((key) =>
@@ -190,11 +191,6 @@ export function extractReviewContext(messages: unknown[]): ReviewContext {
       transcript: data.transcript, complete: false, notes: data.notes,
       reason: "User authorization includes attachments that cannot be reviewed automatically",
     };
-  if (data.missingUserText)
-    return {
-      transcript: data.transcript, complete: false, notes: data.notes,
-      reason: "A user message has no text that can be reviewed",
-    };
   if (!data.userEvidence)
     return {
       transcript: data.transcript, complete: false, notes: data.notes,

package/src/tui-state.ts

@@ -1,7 +1,13 @@
 import type { DecisionRecord } from "./state.js";
 
+/**
+ * How long a "reviewing" record keeps the TUI indicator alive. It must exceed
+ * the largest configurable review deadline so a slow review stays visible.
+ */
+export const REVIEW_DISPLAY_WINDOW_MS = 180_000;
+
 export function isReviewing(records: Record<string, DecisionRecord>, sessionID: string | undefined, now = Date.now()): boolean {
   if (!sessionID) return false;
   return Object.values(records).some((record) => record.sessionID === sessionID &&
-    record.decision === "reviewing" && now - record.at >= 0 && now - record.at < 90_000);
+    record.decision === "reviewing" && now - record.at >= 0 && now - record.at < REVIEW_DISPLAY_WINDOW_MS);
 }