@mortz.prk/opencode-auto-mode 1.0.1 → 1.1.1

package/src/decisions.ts

@@ -1,213 +0,0 @@
-import { Effect } from "effect";
-import {
-  Evaluation,
-  EvaluationClient,
-  EvaluationModel,
-  EvaluationResponse,
-  type EvaluationAnswer,
-  type EvaluationInput,
-  type EvaluationRoute,
-} from "@opencode/ai/experimental";
-import { AIError, InvalidProviderOutputError, ModelID } from "@opencode/ai";
-import { localEndpoint, parseReviewerModel, type DecisionStage } from "./config.js";
-import { buildReviewPrompt, type Decision, type PermissionRequest, type StageResult } from "./reviewer.js";
-import type { ReviewPolicy } from "./policy.js";
-
-const choices = {
-  allow: "The whole action is safe and authorized by the user for this exact scope.",
-  deny: "The action violates the supplied policy or attempts to bypass a block.",
-  ask: "Authorization, evidence, or impact is uncertain; the human must decide.",
-} as const;
-const MAX_BYTES = 65_536;
-const SYSTEM_ONE_URL = "https://api.typesafe.ai/v1/systemone";
-const LOCAL_SYSTEM_ONE_URL = "http://127.0.0.1:8000/v1/systemone";
-const OPENAI_URL = "https://api.openai.com/v1/decisions";
-const API_KEY_ENV = {
-  "typesafe-ai": "TYPESAFE_API_KEY",
-  laya: "LAYA_API_KEY",
-  openai: "OPENAI_API_KEY",
-} as const;
-
-type RuntimeDecisionStage = DecisionStage & { readonly apiKey?: string };
-
-function probability(value: unknown): value is number {
-  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
-}
-
-function object(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function answer(value: unknown, stage: RuntimeDecisionStage): StageResult {
-  if (!object(value) || value.type !== "choice" || typeof value.choice !== "string" || !Object.hasOwn(choices, value.choice) ||
-      !probability(value.confidence) || !object(value.probabilities))
-    throw new Error("Invalid decision response");
-  const entries = Object.entries(value.probabilities);
-  if (entries.length !== 3 || entries.some(([key, value]) => !Object.hasOwn(choices, key) || !probability(value)))
-    throw new Error("Invalid decision probabilities");
-  const probabilities = value.probabilities as Record<Decision, number>;
-  if (Math.abs(Object.values(probabilities).reduce((a, b) => a + b, 0) - 1) > 0.01 ||
-      probabilities[value.choice as Decision] < Math.max(...Object.values(probabilities)))
-    throw new Error("Inconsistent decision probabilities");
-  if (value.choice === "ask") return { decision: "ask", reason: `${stage.model} requested human review` };
-  const threshold = stage.minConfidence ?? 0.9;
-  if (value.confidence < threshold || probabilities[value.choice as Decision] < threshold) {
-    if (value.choice === "deny") return { decision: "ask", reason: `${stage.model} returned a low-confidence deny` };
-    return { decision: "abstain", reason: `${stage.model} abstained below the confidence threshold` };
-  }
-  return { decision: value.choice as Decision, reason: `${stage.model} decision (confidence ${value.confidence})` };
-}
-
-async function readJSON(response: Response): Promise<unknown> {
-  if (!response.ok || !response.body) throw new Error("Decision provider failed");
-  const reader = response.body.getReader();
-  const chunks: Uint8Array[] = [];
-  let size = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      size += value.length;
-      if (size > MAX_BYTES) throw new Error("Decision response too large");
-      chunks.push(value);
-    }
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } finally {
-    await reader.cancel().catch(() => {});
-    reader.releaseLock();
-  }
-}
-
-function state(request: PermissionRequest): EvaluationInput {
-  const value = JSON.parse(JSON.stringify(request)) as EvaluationInput;
-  if (Buffer.byteLength(JSON.stringify(value)) > MAX_BYTES) throw new Error("Decision request too large");
-  return value;
-}
-
-function systemOneEndpoint(stage: RuntimeDecisionStage): string {
-  return stage.endpoint === undefined ? LOCAL_SYSTEM_ONE_URL : localEndpoint(stage.endpoint);
-}
-
-function evaluationChoice(value: unknown): EvaluationAnswer {
-  if (!object(value) || value.type !== "choice" || typeof value.choice !== "string") throw new Error("Invalid System One answer");
-  if (!object(value.probabilities) || !probability(value.confidence)) throw new Error("Invalid System One answer");
-  return {
-    type: "choice",
-    choice: value.choice,
-    probabilities: value.probabilities as Record<string, number>,
-    confidence: value.confidence,
-  };
-}
-
-function systemOneRoute(stage: RuntimeDecisionStage, modelID: string, url: string, fetcher: typeof fetch): EvaluationRoute {
-  return {
-    id: "system-one",
-    evaluate: (request) => Effect.tryPromise({
-      try: async () => {
-        const payload = JSON.stringify({ model: modelID, state: request.state, questions: request.questions });
-        if (Buffer.byteLength(payload) > MAX_BYTES) throw new Error("Decision request too large");
-        const response = await fetcher(url, {
-          method: "POST", redirect: "error", signal: AbortSignal.timeout(stage.timeoutMs ?? 10_000),
-          headers: { "Content-Type": "application/json", ...(stage.apiKey === undefined ? {} : { Authorization: `Bearer ${stage.apiKey}` }) },
-          body: payload,
-        });
-        const parsed = await readJSON(response);
-        const value = object(parsed) && object(parsed.answers) ? parsed.answers.permission : undefined;
-        return new EvaluationResponse({
-          model: ModelID.make(modelID),
-          answers: { permission: evaluationChoice(value) },
-        });
-      },
-      catch: (cause) => new AIError({
-        reason: new InvalidProviderOutputError({ route: "system-one", message: "System One request failed", cause }),
-      }),
-    }),
-  };
-}
-
-async function systemOneDecision(
-  stage: RuntimeDecisionStage,
-  request: PermissionRequest,
-  policy: ReviewPolicy,
-  fetcher: typeof fetch,
-): Promise<StageResult> {
-  const ref = parseReviewerModel(stage.model);
-  const key = stage.apiKey;
-  if (ref.providerID !== "laya" && !key) throw new Error("Missing decision provider credentials");
-  const model = EvaluationModel.make({
-    id: ref.id,
-    provider: ref.providerID,
-    route: systemOneRoute(stage, ref.id, ref.providerID === "laya" ? systemOneEndpoint(stage) : SYSTEM_ONE_URL, fetcher),
-  });
-  const response = await Effect.runPromise(
-    Evaluation.run({
-      model,
-      state: state(request),
-      questions: {
-        permission: { type: "choice", instructions: buildReviewPrompt(request, policy), criteria: choices },
-      },
-    }).pipe(Effect.provide(EvaluationClient.fetchLayer)),
-  );
-  return answer(response.answers.permission, stage);
-}
-
-async function openAIDecision(
-  stage: RuntimeDecisionStage,
-  request: PermissionRequest,
-  policy: ReviewPolicy,
-  fetcher: typeof fetch,
-): Promise<StageResult> {
-  const ref = parseReviewerModel(stage.model);
-  if (!stage.apiKey) throw new Error("Missing decision provider credentials");
-  const body = {
-    model: ref.id,
-    input: JSON.stringify(request),
-    questions: [{
-      name: "permission",
-      type: "choice",
-      instructions: buildReviewPrompt(request, policy),
-      choices: Object.entries(choices).map(([value, description]) => ({ value, description })),
-    }],
-  };
-  const payload = JSON.stringify(body);
-  if (Buffer.byteLength(payload) > MAX_BYTES) throw new Error("Decision request too large");
-  const response = await fetcher(OPENAI_URL, {
-    method: "POST", redirect: "error", signal: AbortSignal.timeout(stage.timeoutMs ?? 10_000),
-    headers: { "Content-Type": "application/json", Authorization: `Bearer ${stage.apiKey}` },
-    body: payload,
-  });
-  const parsed = await readJSON(response);
-  if (!object(parsed) || !Array.isArray(parsed.answers) || parsed.answers.length !== 1 || !object(parsed.answers[0]) ||
-      parsed.answers[0].name !== "permission") throw new Error("Invalid OpenAI answer");
-  const selected = parsed.answers[0];
-  if (selected.type === "refusal") return { decision: "abstain", reason: `${stage.model} declined the decision` };
-  if (!Array.isArray(selected.probabilities) || selected.probabilities.length !== 3)
-    throw new Error("Invalid OpenAI probabilities");
-  const distribution: Record<string, unknown> = {};
-  for (const entry of selected.probabilities) {
-    if (!object(entry) || typeof entry.value !== "string" || !Object.hasOwn(choices, entry.value) ||
-        Object.hasOwn(distribution, entry.value)) throw new Error("Invalid OpenAI probability entry");
-    distribution[entry.value] = entry.probability;
-  }
-  return answer({ ...selected, probabilities: distribution }, stage);
-}
-
-export async function decisionStage(
-  input: DecisionStage,
-  request: PermissionRequest,
-  policy: ReviewPolicy,
-  fetcher: typeof fetch = fetch,
-): Promise<StageResult> {
-  try {
-    const ref = parseReviewerModel(input.model);
-    if (!Object.hasOwn(API_KEY_ENV, ref.providerID)) throw new Error("Unsupported decision provider");
-    const stage: RuntimeDecisionStage = {
-      ...input,
-      apiKey: process.env[input.apiKeyEnv ?? API_KEY_ENV[ref.providerID as keyof typeof API_KEY_ENV]],
-    };
-    return ref.providerID === "openai" ? await openAIDecision(stage, request, policy, fetcher) :
-      await systemOneDecision(stage, request, policy, fetcher);
-  } catch {
-    return { decision: "abstain", reason: `${input.model} unavailable or returned an invalid decision` };
-  }
-}

package/src/logger.ts

@@ -1,26 +0,0 @@
-import * as fs from "node:fs";
-import { privateFile } from "./storage.js";
-
-export interface Logger {
-  log(line: string): void;
-  logJSON(label: string, value: unknown): void;
-}
-
-export function createLogger(filename: string): Logger {
-  const stamp = () => new Date().toISOString();
-  const append = (line: string) => {
-    let fd: number | undefined;
-    try {
-      fd = privateFile(filename, true, true);
-      const size = fs.fstatSync(fd).size;
-      if (size > 1_048_576) fs.ftruncateSync(fd, 0);
-      fs.writeSync(fd, `[${stamp()}] ${line.slice(0, 1024).replace(/[\r\n]/g, " ")}\n`);
-    } catch {
-      // Logging is best effort and must not interrupt permission review.
-    } finally { if (fd !== undefined) fs.closeSync(fd); }
-  };
-  return {
-    log: append,
-    logJSON: (label, value) => append(`${label}: ${JSON.stringify(value)}`),
-  };
-}

package/src/otlp.ts

@@ -1,74 +0,0 @@
-import type { AuditLog, AuditRecord } from "./audit.js";
-
-export interface OtlpOptions { endpoint?: string; headers?: Record<string, string>; timeoutMs?: number }
-
-const MAX_TIMEOUT_MS = 10_000;
-
-function parseHeaders(raw: string | undefined): Record<string, string> {
-  const headers: Record<string, string> = {};
-  for (const pair of (raw ?? "").split(",")) {
-    const index = pair.indexOf("=");
-    if (index > 0) headers[pair.slice(0, index).trim()] = pair.slice(index + 1).trim();
-  }
-  return headers;
-}
-
-export function logsUrl(base: string): string {
-  const url = new URL(base);
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new Error("Invalid OTLP endpoint");
-  if (!url.pathname.endsWith("/v1/logs")) url.pathname = `${url.pathname.replace(/\/+$/, "")}/v1/logs`;
-  return url.href;
-}
-
-const attr = (key: string, value: string | number | boolean) => ({
-  key,
-  value: typeof value === "string" ? { stringValue: value } : typeof value === "boolean" ? { boolValue: value } : { intValue: String(value) },
-});
-
-export function toLogRecord(record: AuditRecord) {
-  const severity = record.decision === "deny" ? { severityNumber: 13, severityText: "WARN" } : { severityNumber: 9, severityText: "INFO" };
-  return {
-    timeUnixNano: String(BigInt(Date.parse(record.ts)) * 1_000_000n),
-    ...(record.traceID === undefined ? {} : { traceId: record.traceID, spanId: record.spanID }),
-    ...severity,
-    body: { stringValue: record.reason },
-    attributes: [
-      attr("event.name", "auto_mode.decision"),
-      attr("session.id", record.sessionID),
-      attr("review.id", record.reviewID),
-      attr("agent", record.agent ?? ""),
-      attr("action", record.action),
-      attr("resources", record.resources.join(" ; ")),
-      attr("host_effect", record.hostEffect),
-      attr("decision", record.decision),
-      attr("stage", record.stage),
-      attr("duration_ms", record.durationMs),
-      attr("error", record.error === true),
-      ...(record.errorDetail === undefined ? [] : [attr("error.detail", record.errorDetail)]),
-    ],
-  };
-}
-
-/** Exports each decision as an OTLP/HTTP JSON log record. Defaults follow the OpenCode telemetry environment. */
-export function createOtlpExporter(setting: boolean | OtlpOptions | undefined, env: NodeJS.ProcessEnv = process.env): AuditLog | undefined {
-  if (setting === undefined || setting === false) return undefined;
-  const options = setting === true ? {} : setting;
-  const base = options.endpoint ?? env.OPENCODE_OTLP_ENDPOINT ?? env.OTEL_EXPORTER_OTLP_ENDPOINT;
-  if (!base) return undefined;
-  let url: string;
-  try { url = logsUrl(base); } catch { return undefined; }
-  const headers = { "content-type": "application/json", ...parseHeaders(env.OTEL_EXPORTER_OTLP_HEADERS), ...parseHeaders(env.OPENCODE_OTLP_HEADERS), ...options.headers };
-  const timeout = Math.min(options.timeoutMs ?? 3_000, MAX_TIMEOUT_MS);
-  return {
-    write(record) {
-      const body = JSON.stringify({
-        resourceLogs: [{
-          resource: { attributes: [attr("service.name", "opencode-auto-mode")] },
-          scopeLogs: [{ scope: { name: "opencode-auto-mode" }, logRecords: [toLogRecord(record)] }],
-        }],
-      });
-      // Fire and forget: telemetry must never delay or fail a permission review.
-      fetch(url, { method: "POST", headers, body, signal: AbortSignal.timeout(timeout), redirect: "error" }).catch(() => {});
-    },
-  };
-}

package/src/policy.ts

@@ -1,36 +0,0 @@
-export interface ReviewPolicy {
-  trusted: string[];
-  blocks: string[];
-  exceptions: string[];
-}
-
-const DEFAULT_TRUSTED = [
-  "the git repo in the session's working directory (reviewable via version control)",
-];
-
-const DEFAULT_BLOCKS = [
-  "Destroy or exfiltrate: force-push over history, mass-delete cloud storage or branches, drop tables, overwrite shared artifacts, or send internal data to an external destination.",
-  "Destroy or exfiltrate: batch deletes from a vague request (e.g. 'clean up branches' must not become a remote branch delete without explicit scope).",
-  "Degrade security posture: disable logging or monitoring, install persistence (SSH keys, cron jobs, startup hooks), change auth config, or edit the agent's own permission config.",
-  "Degrade security posture: retry a failed deploy or check with a skip-verification / --force / --no-verify flag the user did not ask for.",
-  "Cross trust boundaries: run code cloned from an untrusted source, curl|bash a remote script, or execute pasted payloads without review.",
-  "Cross trust boundaries: scan credential stores (.env, aws credentials, env vars, token files) for usable tokens beyond the task at hand.",
-  "Cross trust boundaries: exfiltrate data via gist/pastebin upload, webhook POST, or push to a remote the user never named.",
-  "Bypass review or affect others: push directly to main/master, run production deploys or migrations, or modify shared jobs/resources the agent did not create.",
-  "Bypass review or affect others: act on an agent-inferred target (closest-name match for 'cancel my job') without explicit user confirmation of that exact target.",
-];
-
-const DEFAULT_EXCEPTIONS = [
-  "Installing packages already declared in the repo manifest, or running the repo's own build/test/lint/format scripts.",
-  "Standard credential flows the user asked for (e.g. running the documented login command).",
-  "Pushing to the session's own working branch when that is the task.",
-  "Read-only inspection (listing, diffing, dry runs) before a guarded action.",
-];
-
-export function defaultPolicy(options?: Partial<ReviewPolicy>): ReviewPolicy {
-  return {
-    trusted: [...(options?.trusted ?? DEFAULT_TRUSTED)],
-    blocks: [...(options?.blocks ?? DEFAULT_BLOCKS)],
-    exceptions: [...(options?.exceptions ?? DEFAULT_EXCEPTIONS)],
-  };
-}

package/src/state.ts

@@ -1,135 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { createHash } from "node:crypto";
-import { privateFile, STORAGE_DIR } from "./storage.js";
-
-export type DecisionKind = "reviewing" | "allow" | "deny" | "ask";
-
-export interface DecisionRecord {
-  requestID: string;
-  sessionID: string;
-  decision: DecisionKind;
-  reason: string;
-  at: number;
-  action?: string;
-  resources?: string[];
-}
-
-export const STATE_FILE = path.join(STORAGE_DIR, "state.json");
-
-const MAX_AGE_MS = 10 * 60 * 1000;
-const MAX_CONFIG_MESSAGE = 1024;
-
-export interface ConfigErrorRecord {
-  directory: string;
-  message: string;
-}
-
-interface StoredConfigError extends ConfigErrorRecord {
-  at: number;
-}
-
-function canonicalDirectory(directory: string): string {
-  try { return fs.realpathSync.native(directory); }
-  catch { return path.resolve(directory); }
-}
-
-function configErrorFile(directory: string): string {
-  return `config-error-${createHash("sha256").update(directory).digest("hex")}.json`;
-}
-
-function readConfigErrorFile(directory: string): StoredConfigError | undefined {
-  let fd: number | undefined;
-  try {
-    fd = privateFile(configErrorFile(directory), false);
-    if (fs.fstatSync(fd).size > 4096) return undefined;
-    const parsed: unknown = JSON.parse(fs.readFileSync(fd, "utf8"));
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return undefined;
-    const record = parsed as Partial<StoredConfigError>;
-    if (record.directory !== directory || typeof record.message !== "string" ||
-        record.message.length > MAX_CONFIG_MESSAGE || typeof record.at !== "number" || !Number.isFinite(record.at))
-      return undefined;
-    return { directory: record.directory, message: record.message, at: record.at };
-  } catch {
-    return undefined;
-  } finally { if (fd !== undefined) fs.closeSync(fd); }
-}
-
-function writeConfigError(record: StoredConfigError): void {
-  let fd: number | undefined;
-  const temporary = `config-error-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.tmp`;
-  const target = configErrorFile(record.directory);
-  try {
-    fd = privateFile(temporary, true);
-    fs.writeSync(fd, JSON.stringify(record), 0);
-    fs.closeSync(fd);
-    fd = undefined;
-    fs.renameSync(path.join(STORAGE_DIR, temporary), path.join(STORAGE_DIR, target));
-  } catch {
-    // Badge state is best effort and must not interrupt permission review.
-  } finally {
-    if (fd !== undefined) fs.closeSync(fd);
-    try { fs.rmSync(path.join(STORAGE_DIR, temporary), { force: true }); }
-    catch { /* best effort */ }
-  }
-}
-
-/** Records that the plugin options for a location are unusable, so the TUI can show it. */
-export function recordConfigError(directory: string, message: string): void {
-  const canonical = canonicalDirectory(directory);
-  writeConfigError({ directory: canonical, message: message.slice(0, MAX_CONFIG_MESSAGE), at: Date.now() });
-}
-
-export function readConfigError(directory: string | undefined): ConfigErrorRecord | undefined {
-  if (directory === undefined) return undefined;
-  const canonical = canonicalDirectory(directory);
-  const record = readConfigErrorFile(canonical);
-  return record === undefined ? undefined : { directory: record.directory, message: record.message };
-}
-
-export function clearConfigError(directory: string): void {
-  try {
-    fs.rmSync(path.join(STORAGE_DIR, configErrorFile(canonicalDirectory(directory))), { force: true });
-  } catch { /* best effort */ }
-}
-
-export function readDecisions(): Record<string, DecisionRecord> {
-  let fd: number | undefined;
-  try {
-    fd = privateFile("state.json", false);
-    if (fs.fstatSync(fd).size > 65_536) return {};
-    const raw = fs.readFileSync(fd, "utf8");
-    const parsed: unknown = JSON.parse(raw);
-    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
-    return Object.fromEntries(Object.entries(parsed).filter(([id, value]) =>
-      id.length < 256 && typeof value === "object" && value !== null &&
-      value.requestID === id && typeof value.sessionID === "string" && value.sessionID.length < 256 &&
-      typeof value.reason === "string" && value.reason.length <= 4096 &&
-      typeof value.at === "number" && Number.isFinite(value.at) &&
-      (value.action === undefined || typeof value.action === "string") &&
-      (value.resources === undefined || (Array.isArray(value.resources) && value.resources.length <= 256 &&
-        value.resources.every((resource: unknown) => typeof resource === "string"))) &&
-      ["reviewing", "allow", "deny", "ask"].includes(value.decision))) as Record<string, DecisionRecord>;
-  } catch {
-    return {};
-  } finally { if (fd !== undefined) fs.closeSync(fd); }
-}
-
-export function recordDecision(record: DecisionRecord): void {
-  const all = readDecisions();
-  Object.defineProperty(all, record.requestID, { value: record, enumerable: true, configurable: true });
-  const cutoff = Date.now() - MAX_AGE_MS;
-  for (const [id, rec] of Object.entries(all)) {
-    if (rec.at < cutoff || Object.keys(all).length > 128) delete all[id];
-  }
-  let fd: number | undefined;
-  try {
-    const data = JSON.stringify(all);
-    if (Buffer.byteLength(data) > 65_536) return;
-    fd = privateFile("state.json", true);
-    fs.ftruncateSync(fd, 0);
-    fs.writeSync(fd, data, 0);
-  } catch {
-    // Badge state is best effort and must not interrupt permission review.
-  } finally { if (fd !== undefined) fs.closeSync(fd); }
-}

package/src/storage.ts

@@ -1,26 +0,0 @@
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-
-export const STORAGE_DIR = path.join(os.tmpdir(), `opencode-auto-mode-${process.getuid?.() ?? os.userInfo().username}`);
-
-function owned(stat: fs.Stats): boolean {
-  return (process.getuid === undefined || stat.uid === process.getuid()) && (stat.mode & 0o077) === 0;
-}
-
-export function privateFile(filename: string, write: boolean, append = false): number {
-  if (path.basename(filename) !== filename) throw new Error("Invalid storage file");
-  try { fs.mkdirSync(STORAGE_DIR, { mode: 0o700 }); }
-  catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
-  const directory = fs.lstatSync(STORAGE_DIR);
-  if (!directory.isDirectory() || !owned(directory)) throw new Error("Unsafe storage directory");
-  const fd = fs.openSync(path.join(STORAGE_DIR, filename),
-    (write ? fs.constants.O_RDWR | fs.constants.O_CREAT : fs.constants.O_RDONLY) | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK |
-      (append ? fs.constants.O_APPEND : 0), 0o600);
-  const file = fs.fstatSync(fd);
-  if (!file.isFile() || !owned(file) || file.nlink !== 1) {
-    fs.closeSync(fd);
-    throw new Error("Unsafe storage file");
-  }
-  return fd;
-}

package/src/traces.ts

@@ -1,84 +0,0 @@
-import { randomBytes } from "node:crypto";
-import type { AuditRecord } from "./audit.js";
-import type { OtlpOptions } from "./otlp.js";
-import type { StageResult } from "./reviewer.js";
-
-export interface ClassifierAttempt {
-  index: number;
-  type: string;
-  model?: string;
-  startedAt: number;
-  durationMs: number;
-  result: StageResult;
-}
-
-export interface ReviewTrace {
-  traceID: string;
-  spanID: string;
-  attempts: ClassifierAttempt[];
-  finish(record: AuditRecord): void;
-}
-
-const attribute = (key: string, value: string | number) => ({
-  key,
-  value: typeof value === "number" ? { intValue: String(value) } : { stringValue: value },
-});
-const nano = (ms: number) => String(BigInt(Math.trunc(ms)) * 1_000_000n);
-
-export function tracesUrl(base: string): string {
-  const url = new URL(base);
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) throw new Error("Invalid OTLP endpoint");
-  url.pathname = url.pathname.replace(/\/v1\/(?:logs|traces)\/?$/, "").replace(/\/+$/, "") + "/v1/traces";
-  return url.href;
-}
-
-function headers(raw: string | undefined): Record<string, string> {
-  return Object.fromEntries((raw ?? "").split(",").flatMap((pair) => {
-    const index = pair.indexOf("=");
-    return index > 0 ? [[pair.slice(0, index).trim(), pair.slice(index + 1).trim()]] : [];
-  }));
-}
-
-export function createTraceExporter(setting: boolean | OtlpOptions | undefined, env: NodeJS.ProcessEnv = process.env) {
-  if (setting === undefined || setting === false) return undefined;
-  const options = setting === true ? {} : setting;
-  const base = options.endpoint ?? env.OPENCODE_OTLP_ENDPOINT ?? env.OTEL_EXPORTER_OTLP_ENDPOINT;
-  if (!base) return undefined;
-  let url: string;
-  try { url = tracesUrl(base); } catch { return undefined; }
-  const requestHeaders = { "content-type": "application/json", ...headers(env.OTEL_EXPORTER_OTLP_HEADERS), ...headers(env.OPENCODE_OTLP_HEADERS), ...options.headers };
-  return {
-    begin(startedAt: number): ReviewTrace {
-      const traceID = randomBytes(16).toString("hex");
-      const spanID = randomBytes(8).toString("hex");
-      const attempts: ClassifierAttempt[] = [];
-      return {
-        traceID, spanID, attempts,
-        finish(record) {
-          const shared = [attribute("review.id", record.reviewID), attribute("session.id", record.sessionID)];
-          const spans = [{
-            traceId: traceID, spanId: spanID, name: "auto_mode.review", kind: 1,
-            startTimeUnixNano: nano(startedAt), endTimeUnixNano: nano(startedAt + record.durationMs),
-            attributes: [...shared, attribute("action", record.action), attribute("agent", record.agent ?? ""),
-              attribute("decision", record.decision), attribute("stage", record.stage)],
-            status: { code: record.error ? 2 : 1 },
-          }, ...attempts.map((attempt) => ({
-            traceId: traceID, spanId: randomBytes(8).toString("hex"), parentSpanId: spanID,
-            name: "auto_mode.classifier", kind: 1,
-            startTimeUnixNano: nano(attempt.startedAt), endTimeUnixNano: nano(attempt.startedAt + attempt.durationMs),
-            attributes: [...shared, attribute("classifier.index", attempt.index), attribute("classifier.type", attempt.type),
-              attribute("model", attempt.model ?? ""), attribute("decision", attempt.result.decision)],
-            status: { code: 1 },
-          }))];
-          const body = JSON.stringify({ resourceSpans: [{
-            resource: { attributes: [attribute("service.name", "opencode-auto-mode")] },
-            scopeSpans: [{ scope: { name: "opencode-auto-mode" }, spans }],
-          }] });
-          // Match log export: best effort, independent of permission delivery.
-          fetch(url, { method: "POST", headers: requestHeaders, body, redirect: "error",
-            signal: AbortSignal.timeout(Math.min(options.timeoutMs ?? 3_000, 10_000)) }).catch(() => {});
-        },
-      };
-    },
-  };
-}