@mortz.prk/opencode-auto-mode 1.0.2 → 1.1.2

package/README.md

@@ -1,336 +1,221 @@
 # OpenCode Auto Mode
 
-Reviews OpenCode permission prompts automatically. OpenCode decides what needs
-approval; the plugin reviews only `ask` actions.
+Automatic review of OpenCode permission requests. While a session's auto mode is
+on, the plugin reviews native **allow** and **ask** effects, including saved
+**Always** approvals. A native **deny** is always final.
 
-## Install and configure
+Auto Mode reduces prompts. It is not a security sandbox, and it cannot make an
+invalid configuration fail closed.
 
-Add this to `~/.config/opencode/opencode.jsonc`. It asks for permission on every
-action and reviews those requests using built-in checks. No model or API key is
-needed:
+## Requirements
 
-```jsonc
-{
-  "$schema": "https://opencode.ai/config.json",
-  "permissions": [
-    { "action": "*", "resource": "*", "effect": "ask" }
-  ],
-  "plugins": [
-    {
-      "package": "@mortz.prk/opencode-auto-mode",
-      "options": {
-        "classifiers": [
-          { "type": "static" }
-        ]
-      }
-    }
-  ]
-}
-```
-
-OpenCode watches configuration files and reloads plugins after a save, so no
-restart is needed. If a change does not take effect, run `/reload` in the TUI to
-force a full reload.
-
-There is no default review pipeline, and empty options are invalid. Add at least
-one review entry. Built-in checks deny dangerous shell commands, allow common
-read-only commands, and send other parsed commands to the configured reviewers.
-Dynamic syntax such as command substitution, nested shells, and stateful builtins
-still requires manual approval.
-
-The snippets below change parts of that configuration; keep your `classifiers`
-list when adding other options.
-
-### How a shell command is classified
+- OpenCode V2. The checked-in plugin SDK and schema targets OpenCode `2.2.0`.
+- Model references only if you use `decision` or `llm` classifier stages. Models
+  and provider credentials belong in your personal OpenCode provider config.
+  This repository supplies no model, endpoint, credential, or allowlist.
+- **Data egress:** a configured `decision` or `llm` stage sends the action and
+  resources (including full Code Mode source), agent, project/worktree, git
+  state, and up to 12 KB of user messages to that model's provider, even with
+  audit off. Choose a provider you trust.
 
-Commands are parsed before they are judged, so text that merely mentions a
-dangerous word — a commit message, a search pattern, a heredoc body — is not
-treated as a dangerous operation. Denials apply to the parsed executable and its
-arguments, and nested shells are inspected recursively.
+## Install
 
-Read-only allowlisting checks the executable **and** its flags. Options that
-write files or run programs (`rg --pre`, `sort -o`, `tree -o`, `file -C`,
-`bat --pager`, `hostname NAME`, `uniq IN OUT`) are handed to the reviewers
-instead of being auto-approved.
+Register the plugin **once** in your user-owned global config:
 
-A shell result is final when it is `deny` or `ask`: `ask` means manual approval,
-even if a model reviewer is configured. Read-only auto-approval is narrower than
-the pipeline: for shell actions, the static stage auto-approves only commands the
-guard recognizes as read-only. Every other parsed command that is not denied —
-including a write such as `pwd > marker` — goes to the configured reviewers, and a
-model reviewer may allow it. With no reviewer configured, it stays `ask`.
-
-## Add a typed decision model
+`~/.config/opencode/opencode.jsonc` (or
+`$XDG_CONFIG_HOME/opencode/opencode.jsonc`). The global config must be outside
+the repository, resolve with no symlink in its path, be user-owned and not
+group/other-writable, be a single hardlink, and use an absolute
+`XDG_CONFIG_HOME` when set.
 
 ```jsonc
 {
-  "options": {
-    "classifiers": [
-      { "type": "static" },
-      { "type": "decision", "model": "typesafe-ai/jev-latest" }
-    ]
-  }
-}
-```
-
-| Provider | Setup |
-| --- | --- |
-| `typesafe-ai` | Set `TYPESAFE_API_KEY`. |
-| `openai` | Set `OPENAI_API_KEY`. |
-| `laya` | Run a loopback `/v1/systemone` service. `LAYA_API_KEY` is optional. |
-
-Decision entries accept `minConfidence` (default `0.9`), `timeoutMs`, and
-`apiKeyEnv`. `laya` also accepts `endpoint`.
-
-## Add an LLM
-
-Add an `llm` entry after the built-in checks:
-
-```jsonc
-{
-  "options": {
-    "classifiers": [
-      { "type": "static" },
-      { "type": "llm" }
-    ]
-  }
-}
-```
-
-When an `llm` entry has no `model`, the **session model** is used. To choose a
-different model:
-
-```jsonc
-{ "type": "llm", "model": "anthropic/claude-sonnet-4-5" }
-```
-
-## Combine reviewers
-
-Entries run in order. Add as many as you need:
-
-```jsonc
-{
-  "options": {
-    "classifiers": [
-      { "type": "static" },
-      { "type": "decision", "model": "typesafe-ai/jev-latest" },
-      { "type": "llm" }
-    ]
-  }
-}
-```
-
-An entry can allow, deny, or ask, which stops the pipeline. An entry that abstains
-hands the action to the next entry. If nothing decides, the action remains `ask`.
-
-## Time limit and failures
-
-A review never blocks a permission prompt indefinitely. One deadline covers every
-entry in the pipeline, including both model calls of an `llm` entry:
-
-```jsonc
-{ "options": { "reviewTimeoutMs": 60000 } }
-```
-
-`reviewTimeoutMs` accepts 1000–120000 and defaults to 60000. When the deadline
-passes, provider and context requests are aborted and the action is asked with
-`Auto-mode review deadline exceeded`. Interrupting a session also abandons its
-review, so a stopped turn cannot later receive an automatic approval.
-
-Failures are reported with a bounded cause — `deadline`, `timeout`, `cancelled`,
-`provider`, `invalid-output`, or `context` — in the audit log and in OTLP
-(`error.kind`), while the user-facing message stays generic.
-
-A typed decision reviewer that is unavailable or returns a malformed response
-abstains, so the next entry runs. An `llm` entry behaves differently: a timeout
-or provider error abstains, but an unparseable final answer is an `ask` (manual
-approval) with `invalid-output`, and the pipeline stops there.
-
-## Use it for specific agents
-
-OpenCode allows everything by default. To review only the `build` agent, set its
-permissions and leave global permissions unchanged:
-
-```jsonc
-{
-  "agents": {
-    "build": {
-      "permissions": [
-        { "action": "*", "resource": "*", "effect": "ask" }
+  "$schema": "https://opencode.ai/config.json",
+  "plugins": [{
+    "package": "@mortz.prk/opencode-auto-mode",
+    "options": {
+      "classifiers": [
+        { "type": "static" },
+        { "type": "llm", "model": "<provider>/<reviewer-model>" }
       ]
     }
-  }
+  }]
 }
 ```
 
-## TUI indicator
+The `static` stage handles low-risk reads and eligible in-project edits without a
+model. Remove the `llm` stage if you want a static-only setup; anything static
+cannot resolve then asks you.
 
-A passive indicator shows when the plugin is reviewing the current session.
-It is enabled by default. Set `tui: false` in plugin options to hide it.
-Invalid options show `auto-mode: invalid config` in the same place and raise an
-error toast when the configuration is loaded. OpenCode's own permission dialog
-handles manual approvals.
+For native typed decisions, add a `decision` stage between `static` and `llm`:
 
-The indicator window is longer than the maximum review deadline, so a slow
-review stays visible until it resolves.
+```jsonc
+{ "type": "decision", "model": "<provider>/<decision-model>", "minConfidence": 0.9 }
+```
 
-## Desktop app (preview)
+Only add this stage if your OpenCode provider supports native decisions. The
+plugin has no HTTP decision adapter or custom endpoint option.
 
-OpenCode 2.2.0+ can load the plugin's GUI entry in the desktop app. It adds a
-composer pill and an **Auto-mode** side panel showing whether the current session
-is being reviewed and how recent actions were decided, plus a command-palette
-entry to open the panel.
+Keep the plugin registration in global config only. Do not add the full plugin to
+project config, `cli.json`, or `.opencode/plugins/` as well: the plugin reads its
+safety options from exactly one global registration. The server registration
+loads the TUI part automatically. Desktop loads the experimental GUI part from
+global config and needs the built `dist/gui-experimental.cjs` bundle; in a local
+checkout, run `bun run build:gui` first.
 
-The GUI only reads state. Every permission decision still comes from the server
-part, so disabling the GUI never disables automatic review.
+## Verify
 
-The GUI is loaded from the desktop app's own background server and reads that
-server's auto-mode state. If you connect the app to another server, that server's
-reviews do not appear in the panel.
+Restart nothing for a config-only change. OpenCode watches config files and
+reloads plugins after a save; `/reload` forces a full reload if needed.
 
-The desktop app reads plugins only from the **global** `opencode.json(c)`. If
-your TUI configuration lives in `cli.json`, add the package to the global file as
-well:
+Run:
 
-```jsonc
-{
-  "plugins": [{ "package": "@mortz.prk/opencode-auto-mode", "options": { "classifiers": [{ "type": "static" }] } }]
-}
+```text
+/auto-mode status
 ```
 
-Turn the GUI off without removing the plugin in **Settings → Extensions →
-Plugins**. The GUI plugin API is experimental and may change between OpenCode
-releases; the server and TUI parts do not depend on it.
+A working install reports `Auto mode: on`, today's allow/ask/deny counts, active
+reviews, and breaker state. With invalid configuration, the command reports
+`Auto mode: invalid` and `Review disabled: <error>`; the desktop pill reads
+`Invalid config — review disabled`. A storage or status failure is not a config
+error: the command appends its error and the pill reads `Review unavailable` or
+`status unavailable`. Fix the strict option shapes below rather than expecting a
+migration hint.
 
-## Review options
+## Use
 
-Each LLM or typed decision reviewer can have its own policy:
+- `/auto-mode` toggles the current session.
+- `/auto-mode on` enables review and resets the breaker.
+- `/auto-mode off` restores the native host effect.
+- `/auto-mode status` reports mode, counts, active reviews, and breaker state.
 
-```jsonc
-{
-  "options": {
-    "classifiers": [
-      {
-        "type": "llm",
-        "policy": {
-          "trusted": ["the repository and its CI configuration"],
-          "blocks": ["publish packages", "change production infrastructure"],
-          "exceptions": ["run the repository's test and lint scripts"]
-        }
-      }
-    ]
-  }
-}
-```
+Configure native permissions for ordinary safe work and leave residual risky
+operations as `ask`. Keep hard denials in user-owned global `policies`
+(`tool.use`); the plugin does not install or rewrite native rules.
 
-`trusted` describes the trusted boundary, `blocks` describes actions to deny, and
-`exceptions` describes narrow acceptable cases. Omitted lists use the built-in
-policy; an empty list clears that list. Policies are independent between
-reviewers and do not apply to static checks or replace OpenCode permissions.
+## Options
 
-## All plugin options
+Unknown keys are rejected. `classifiers` is required and must contain 1–64
+ordered stages, with at most one `static` stage.
 
-| Option | Default | Meaning |
+| Option | Default | Contract |
 | --- | --- | --- |
-| `classifiers` | — | Ordered review entries; at least one is required. |
-| `reviewTimeoutMs` | `60000` | Deadline for one complete review (1000–120000). |
-| `auditLog` | off | `true` writes the default JSONL file; a string sets the path. |
-| `otlp` | off | `true` uses OpenCode's OTLP environment; an object sets `endpoint`, `headers`, and `timeoutMs`. |
-| `tui` | on | Set `false` to hide the TUI indicator. |
-
-Static entries accept `allowInProjectEdits`. Decision entries accept
-`minConfidence`, `timeoutMs`, `apiKeyEnv`, and `endpoint` (loopback `laya` only;
-defaults to `http://127.0.0.1:8000/v1/systemone`). OpenCode reloads the plugin
-when you save, so option changes apply without a restart; run `/reload` in the
-TUI if a change does not take effect. Invalid options disable automatic approval
-and are reported in the TUI and over the status RPC.
-
-## Data that leaves the machine
-
-Reviewers see the proposed action, its resources, the session directory, the
-requesting agent, the pending permission `metadata` and `source`, and a bounded
-transcript of recent user messages and tool inputs (12 KB, with the head and tail
-of each tool input). Nothing else about the session is sent.
-
-* A model reviewer receives that material through OpenCode's own session model or
-  the `model` you configure.
-* A typed decision reviewer receives it at the configured provider endpoint.
-* Audit records and OTLP log records keep the action, agent, up to 16 resources,
-  a short reason, and, on failure, a short error detail. Both pass the record
-  through one sanitizer, which bounds these fields — 128 characters for the
-  action and agent, 64 for the stage, 512 for each resource, reason, and error
-  detail — but does **not** redact text.
-* OTLP exports logs and traces as separate streams (`/v1/logs` and `/v1/traces`).
-  Trace root attributes use the same sanitizer, so their action, agent, and stage
-  are bounded like the log fields. Each reviewer attempt adds a child span with
-  its model and outcome; the `model` attribute is not clipped. Traces do not
-  include resources, reasons, or error-detail text.
-* Text in every stream is unredacted, including the action and agent. Traces
-  carry the action and agent; logs carry those plus resources, reasons, and
-  error details. These fields may be sensitive, and resources or reasons can
-  contain inline file contents or shell commands, including credentials such as
-  an `Authorization` header. Audit JSONL keeps the same unredacted fields as OTLP
-  logs. Enable `auditLog` or `otlp` only if you are comfortable storing or
-  exporting that material.
-* Records do not include the reviewer prompt, the session transcript, or API keys
-  configured for providers.
-
-## Platform limits
-
-* Windows always asks for shell actions; the guard only parses POSIX syntax.
-* Reviews happen inside the OpenCode server, so a headless or remote TUI behaves
-  the same as a local one. The desktop GUI needs OpenCode 2.2.0+.
-
-## Auditing
-
-Enable the audit log in plugin options:
-
-```jsonc
-{
-  "options": {
-    "auditLog": true
-  }
-}
-```
-
-Decisions are appended as JSON lines to
-`$XDG_STATE_HOME/opencode-auto-mode/decisions.jsonl`. Replay recorded tool calls
-without executing anything (run from a checkout; it reads the OpenCode database
-read-only and needs `--config` if your global config is not at a default path):
+| `classifiers` | required | Ordered `static`, `decision`, and `llm` stages. No default list and no unconfigured mode. |
+| `reviewTimeoutMs` | `15000` | Whole-review deadline; integer 1–120000. |
+| `breaker` | `3 / 10 / 50` | `{consecutiveDenies, windowDenies, windowSize}`. All three keys are required when supplied. |
+| `tui` | `true` | Show or hide the TUI indicator. UI-only; review still runs server-side. |
+| `audit` | `{enabled:false,maxBytes:10485760}` | Object only. Local audit is off by default. |
 
-```sh
-bun scripts/replay.ts [--days 14] [--session ID] [--agent build|any] [--json]
-```
-
-To send decisions through OpenCode's OTLP telemetry, configure OTLP for OpenCode
-with its standard environment variables, then enable the plugin flag. This sends
-correlated decision logs and review traces, including model reviewer attempts:
+Stage shapes:
 
-```jsonc
-{
-  "options": {
-    "otlp": true
-  }
-}
-```
-
-## Development
-
-```sh
-bun install
-bun test
-bun run lint
-bun run typecheck
-bun run build:gui
-bun run test:integration
+| Stage | Shape |
+| --- | --- |
+| `static` | `{ "type": "static", "allowInProjectEdits"?: boolean }` |
+| `decision` | `{ "type": "decision", "model": "<provider>/<model>", "timeoutMs"?: number, "minConfidence"?: number }` |
+| `llm` | `{ "type": "llm", "model": "<provider>/<model>", "timeoutMs"?: number }` |
+
+## How review works
+
+1. Native permissions, policies, and saved approvals produce `allow`, `ask`, or
+   `deny`. A native **deny is final** and is never reviewed or weakened.
+2. With mode on, native allows and asks are reviewed. Saved **Always** entries
+   are re-reviewed but never deleted or rewritten.
+3. Built-in guards run first: protected paths and credentials, risky shell
+   structure, recursive external deletion, history changes, and ambiguous syntax.
+   These guards are not user-extensible. Git metadata (`.git`), Git global
+   options, and complex POSIX shell syntax are left to the configured decision/LLM
+   stages, not automatically denied or forced to a user prompt. Credential
+   protections and visible blocked operations still take precedence. Unsupported
+   Windows shell dialects still require manual approval. Loading a skill is
+   low-risk: it loads instructions, not executable code; later tool calls are
+   checked separately.
+4. Configured classifiers run in array order. A static stage may resolve low-risk
+   work; a decision stage uses OpenCode's native decision API; an LLM stage uses
+   its explicit reviewer. The first decisive allow or deny stops the chain.
+5. Exhaustion, unusable context, interruption, failure, or timeout resolves to
+   **ask**. A deny ends with `Continue with a safer alternative.`
+
+Mode off restores the original host effect. A paused breaker turns a reviewed
+native allow into `ask`; an existing native ask keeps its prompt.
+
+Assuming classifiers: [static, decision, llm] (array order is authoritative).
+
+```mermaid
+flowchart TD
+    A[permission evaluate<br/>allow / ask / deny] --> B{native deny?}
+    B -- yes --> B1[final, untouched<br/>audit only]
+    B -- no --> C{config valid &<br/>session on?}
+    C -- invalid --> C1[passthrough<br/>review disabled]
+    C -- off --> C2[restore native<br/>effect + message]
+    C -- paused --> C3[allow → ask<br/>ask → passthrough]
+
+    C -- on --> D[context fetch<br/>size ≤ 64 KiB]
+    D --> E[Code Mode hash identity<br/>execute:sha256]
+    E --> S
+
+    subgraph S [scoreRequest — every hand-written safety check lives here]
+      S1[shell: guardShell + visibleShellDeny<br/>parse / operand roles / recursive delete]
+      S2[tiers: protected paths, credential names,<br/>symlink traversal, project scope]
+      S3[read/edit/write: URL, scope, safeTarget]
+      S4[webfetch/websearch/execute/unknown → HIGH]
+      S5[git history → evaluateVcsGate]
+      S1 --> S2 --> S3 --> S4 --> S5
+    end
+
+    S -- deny --> X1[DENY]
+    S -- ask --> X2[ASK]
+    S -- low / medium / high --> R
+
+    subgraph R [runClassifiers]
+      R0{score deny/ask?} -- yes --> X1
+      R0 -- no --> R1[static: low → ALLOW<br/>else abstain]
+      R1 -- abstain --> R2[decision: native generate.decisions<br/>confidence ≥ 0.9]
+      R2 -- ask / low confidence --> R3[llm: native generate.text]
+      R2 -- allow / deny --> T[terminal]
+      R3 -- allow / deny --> T
+      R3 -- ask / unresolved --> X2
+    end
+
+    X1 --> F[modes.finish<br/>counts + breaker]
+    X2 --> F
+    T --> F
+    F --> G[apply effect to host]
 ```
 
-`build:gui` writes `dist/gui-experimental.cjs`, the file the `./gui-experimental`
-export points at. It runs automatically before publishing.
+## Safety limits
+
+- **Native Auto/YOLO is client-local.** If enabled, OpenCode may auto-approve an
+  `ask` without a dialog, including a plugin ask. Plugin checks still run and
+  plugin denies still block, but the plugin cannot read, change, or synchronize
+  that switch. Disable client Auto/YOLO if you need prompts.
+- **Invalid configuration acts disabled.** The plugin performs no review and
+  native behavior applies. That is passthrough, not fail-closed.
+- Coverage is limited to the permission `evaluate` hook and the Code Mode
+  `execute.before` bridge. Native path grants are not an OS sandbox.
+- Code Mode stays HIGH: JavaScript can hide egress behind aliases and computed
+  URLs. Its permission identity is the SHA-256 of the exact UTF-8 source. Old
+  raw-code approvals generally do not match.
+- Other project plugins can affect residual effects; only run code you trust.
+
+## Audit
+
+Audit is the only plugin-generated telemetry and is **off by default**. It is
+local and unsafe: raw records are unredacted and can contain secrets, file
+contents, prompts, and model outputs. If enabled, the fixed path is
+`$XDG_STATE_HOME/opencode-auto-mode/decisions.jsonl` (or
+`~/.local/state/opencode-auto-mode/decisions.jsonl` when `XDG_STATE_HOME` is not
+absolute). Rotated archives are retained; delete them manually. See
+[README.llm.md](README.llm.md#audit-and-replay) before enabling it.
+
+## More documentation
+
+- [README.llm.md](README.llm.md) — installation instructions for an AI agent,
+  full options, migration from 1.0.x, audit, and troubleshooting.
+- [CONTRIBUTING.md](CONTRIBUTING.md) — repository map, local development,
+  tests, and release checks. It ships with the package.
 
 ## Credit
 
 Created originally by [Andrew Mellen (mellena1)](https://github.com/mellena1) in
-[mellena1/opencode-auto-mode](https://github.com/mellena1/opencode-auto-mode),
-also credited as the author in [package.json](package.json). This independent
-project retains the original [MIT license](LICENSE).
+[mellena1/opencode-auto-mode](https://github.com/mellena1/opencode-auto-mode).
+This independent project retains the original [MIT license](LICENSE).

package/dist/gui-experimental.cjs

@@ -1 +1 @@
-"use strict";Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:"Module"}});const t=require("solid-js/web"),c=require("solid-js"),u=require("@opencode/plugin/gui"),C=require("@opencode/plugin/rpc"),q={type:"object",properties:{enabled:{type:"boolean"},configError:{type:"string"},classifiers:{type:"array",items:{type:"string"}},reviewTimeoutMs:{type:"number"},reviewing:{type:"array",items:{type:"object",properties:{sessionID:{type:"string"},reviewID:{type:"string"},startedAt:{type:"number"}},required:["sessionID","reviewID","startedAt"],additionalProperties:!1}},recent:{type:"array",items:{type:"object",properties:{reviewID:{type:"string"},sessionID:{type:"string"},action:{type:"string"},decision:{type:"string"},stage:{type:"string"},reason:{type:"string"},durationMs:{type:"number"},at:{type:"number"},errorKind:{type:"string"}},required:["reviewID","sessionID","action","decision","stage","reason","durationMs","at"],additionalProperties:!1}}},required:["enabled","classifiers","reviewTimeoutMs","reviewing","recent"],additionalProperties:!1},$={type:"object",properties:{reviewID:{type:"string"},sessionID:{type:"string"},action:{type:"string"},decision:{type:"string"},stage:{type:"string"},reason:{type:"string"},durationMs:{type:"number"},at:{type:"number"},errorKind:{type:"string"}},required:["reviewID","sessionID","action","decision","stage","reason","durationMs","at"],additionalProperties:!1},j=C.Rpc.define({id:"opencode-auto-mode",methods:{status:{input:{type:"object",properties:{sessionID:{type:"string"}},additionalProperties:!1},output:q},decisions:{input:{type:"object",properties:{sessionID:{type:"string"},limit:{type:"number"}},additionalProperties:!1},output:{type:"array",items:$}}},events:{decision:{schema:$}}});function K(e){return e===void 0?void 0:{key:e.key,sessionID:e.id,ownServer:e.server.builtin}}function T(){let e,i=0,l=0,s=0;return{select(o){return o===e?!1:(e=o,l=i,s=0,!0)},begin(o){if(o===e)return++i},accept(o){return o<=l||o<=s?!1:(s=o,!0)}}}function k(e,i){const l=T();return async s=>{if(l.select(s?.key)&&i(void 0),s===void 0||!s.ownServer)return;const o=l.begin(s.key);if(o!==void 0)try{const v=await e(s.sessionID);l.accept(o)&&i(v)}catch{}}}function y(e){return e?.recent.at(-1)}function A(e){return e===void 0||e.reviewing.length===0&&e.recent.length===0?"empty":"entries"}function L(e){if(e===void 0)return;if(e.reviewing.length>0)return"auto-mode reviewing…";const i=y(e);if(i!==void 0)return i.errorKind!==void 0?`auto-mode ${i.decision}: ${i.errorKind}`:`auto-mode ${i.decision}`}function O(e,i,l){if(e===void 0||e.reviewing.length>0)return!1;const s=y(e);return s!==void 0&&i-s.at>l}var E=t.template('<div style="padding:8px 12px;font-size:12px;display:flex;flex-direction:column;gap:6px">'),_=t.template("<div>"),N=t.template("<div> "),F=t.template("<div style=display:flex;flex-direction:column;gap:2px><span style=font-weight:600> · </span><span></span><span style=opacity:0.6> · <!>ms · ");const R=3e3,x=3e4,D={allow:"success",ask:"warning",deny:"danger"},z=u.Plugin.define({i18n:{en:{"command.open":"Open auto-mode decisions","panel.title":"Auto-mode","panel.empty":"No decisions in this session yet.","panel.disabled":"Auto-mode has no valid configuration; automatic review is disabled. Host permissions still apply.","panel.reviewing":"Reviewing…","pill.title":"Auto-mode decisions"}},setup(e){const[i,l]=c.createSignal(void 0),s=k(r=>e.client.rpc(j).status({sessionID:r}),l),o=()=>K(e.sessions.current()),[v,I]=c.createSignal(Date.now()),m=()=>{I(Date.now()),s(o())};u.createKeyed(()=>o()?.key,m,{otherwise:m});const S=setInterval(m,R);c.onCleanup(()=>clearInterval(S));const M={id:"decisions",get title(){return e.t("panel.title")},closable:"compact",fallback:!0};e.add(u.Panel,{id:"decisions",region:"side",mobile:{get title(){return e.t("panel.title")},order:60,kind:"menu",icon:"shield"},list:r=>r.open.includes("decisions")?[M]:[],render:()=>(()=>{var r=E();return t.insert(r,(()=>{var p=t.memo(()=>i()?.enabled===!1);return()=>p()?(()=>{var n=_();return t.insert(n,()=>e.t("panel.disabled")),n})():null})(),null),t.insert(r,(()=>{var p=t.memo(()=>A(i())==="empty");return()=>p()?(()=>{var n=_();return t.insert(n,()=>e.t("panel.empty")),n})():[t.createComponent(c.For,{get each(){return[...i()?.reviewing??[]]},children:n=>(()=>{var a=N(),d=a.firstChild;return t.insert(a,()=>e.t("panel.reviewing"),d),t.insert(a,()=>n.reviewID,null),a})()}),t.createComponent(c.For,{get each(){return[...i()?.recent??[]].reverse()},children:n=>(()=>{var a=F(),d=a.firstChild,f=d.firstChild,w=d.nextSibling,g=w.nextSibling,b=g.firstChild,h=b.nextSibling;return h.nextSibling,t.insert(d,()=>n.decision,f),t.insert(d,(()=>{var P=t.memo(()=>n.errorKind===void 0);return()=>P()?"":` (${n.errorKind})`})(),f),t.insert(d,()=>n.action,null),t.insert(w,()=>n.reason),t.insert(g,()=>n.stage,b),t.insert(g,()=>Math.round(n.durationMs),h),t.insert(g,()=>new Date(n.at).toLocaleTimeString(),null),a})()})]})(),null),r})()}),e.add(u.Command,()=>({id:"open",title:e.t("command.open"),group:"tools",run:()=>{const r=e.sessions.current();r&&e.layout.toggle(`${e.id}:decisions`,r)}})),e.add(u.ComposerPill,{id:"status",order:20,show:()=>{const r=i(),p=L(r);if(p===void 0||O(r,v(),x))return;const n=(r?.reviewing.length??0)>0;return{label:p,tone:n?"warning":D[y(r)?.decision??"allow"],title:e.t("pill.title"),rows:(r?.recent??[]).slice(-5).reverse().map(a=>({id:a.reviewID,label:`${a.decision} · ${a.action}`,tone:D[a.decision],detail:a.reason}))}}})}});exports.default=z;
+Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});let e=require("solid-js"),t=require("@opencode/plugin/gui"),n=require("@opencode/plugin/rpc");var r={type:`object`,properties:{enabled:{type:`boolean`},mode:{type:`string`,enum:[`on`,`off`,`paused`,`invalid`]},configError:{type:`string`,maxLength:200},errorKind:{type:`string`,enum:[`config`,`storage`,`status`]},reviewTimeoutMs:{type:`number`},reviewing:{type:`array`,maxItems:256,items:{type:`object`,properties:{sessionID:{type:`string`},reviewID:{type:`string`},startedAt:{type:`number`}},required:[`sessionID`,`reviewID`,`startedAt`],additionalProperties:!1}},counts:{type:`object`,properties:{allow:{type:`integer`,minimum:0},ask:{type:`integer`,minimum:0},deny:{type:`integer`,minimum:0}},required:[`allow`,`ask`,`deny`],additionalProperties:!1},breaker:{type:`boolean`}},required:[`enabled`,`mode`,`reviewTimeoutMs`,`reviewing`,`counts`],additionalProperties:!1},i=n.Rpc.define({id:`opencode-auto-mode`,methods:{status:{input:{type:`object`,properties:{sessionID:{type:`string`,minLength:1,maxLength:256}},additionalProperties:!1},output:r},setMode:{input:{type:`object`,properties:{sessionID:{type:`string`,minLength:1,maxLength:256},mode:{type:`string`,enum:[`on`,`off`,`resume`]}},required:[`sessionID`,`mode`],additionalProperties:!1},output:r}},events:{decision:{schema:{type:`object`,properties:{reviewID:{type:`string`},sessionID:{type:`string`},action:{type:`string`,maxLength:128},decision:{type:`string`,maxLength:64},stage:{type:`string`,maxLength:64},reason:{type:`string`,maxLength:200},durationMs:{type:`number`},at:{type:`number`},errorKind:{type:`string`,maxLength:64}},required:[`reviewID`,`sessionID`,`action`,`decision`,`stage`,`reason`,`durationMs`,`at`],additionalProperties:!1}}}});function a(e,t){return JSON.stringify([e,t.directory,t.workspaceID])}function o(e){if(!(e?.location===void 0||!e.id||e.id.length>256||!e.location.directory))return{key:a(e.key,e.location),sessionID:e.id,ownServer:e.server.builtin,location:{...e.location}}}var s={enabled:!1,mode:`invalid`,configError:`status unavailable`,errorKind:`status`,reviewTimeoutMs:0,reviewing:[],counts:{allow:0,ask:0,deny:0}},c=5e3;function l(e,t,n){let r=new AbortController,i=new Promise((e,n)=>{r.signal.addEventListener(`abort`,()=>n(Error(t)),{once:!0})}),a=setTimeout(()=>r.abort(),e),o=Promise.resolve().then(()=>{if(r.signal.aborted)throw Error(t);return n(r.signal)});return{abort:()=>r.abort(),done:Promise.race([o,i]).finally(()=>clearTimeout(a))}}function u(e,t,n=c){let r,i,a=0,o=!1,u=()=>{i?.request.abort(),i=void 0};return Object.assign(c=>{if(o||(r!==c?.key&&(r=c?.key,a++,u(),t(void 0)),c===void 0||!c.ownServer))return Promise.resolve();if(i!==void 0)return i.done;let d=a,f=l(n,`status request aborted`,t=>e(c,t)),p=f.done.then(e=>{!o&&d===a&&t(e??{...s},c)},()=>{!o&&d===a&&t({...s},c)}).finally(()=>{i?.request===f&&(i=void 0)});return i={request:f,done:p},p},{invalidate(){a++,u()},dispose(){o=!0,a++,u()}})}function d(e,t,n,r=()=>{},i=c){let a=new Map,o=!1,s=Number.isFinite(i)&&i>0?i:c;return{pending:e=>a.has(e.key),run(i,c){if(o||i===void 0||!i.ownServer||c===void 0)return Promise.resolve();let u=a.get(i.key);if(u)return u.done;let d=l(s,`mode change aborted`,t=>e(i,c,t)),f=d.done.then(e=>{!o&&e!==void 0&&t(i,e)},()=>{o||n()}).finally(()=>{a.get(i.key)?.request===d&&a.delete(i.key),o||r()});return a.set(i.key,{request:d,done:f}),r(),f},dispose(){o=!0;for(let e of a.values())e.request.abort();a.clear()}}}function f(e){switch(e?.mode){case`on`:return e.enabled?`off`:`on`;case`off`:return`on`;case`paused`:return`resume`;default:return}}function p(e){if(e!==void 0)switch(e.mode){case`invalid`:return e.errorKind===`status`||e.errorKind===void 0&&e.configError===`status unavailable`?`status unavailable`:e.errorKind===`config`?`Invalid config — review disabled`:`Review unavailable`;case`paused`:return`paused (breaker)`;case`off`:return`off`;case`on`:return e.enabled?`auto`:`off`}}function m(e){if(e?.mode===`invalid`&&e.configError!==void 0&&e.configError!==`status unavailable`)return`${p(e)}: ${e.configError}`}function h(e){if(e!==void 0)return e.mode===`invalid`?`danger`:e.mode===`paused`?`warning`:e.mode===`on`&&e.enabled?`success`:void 0}function g(e,t,n=Date.now){let r=new Set,i=0,a=0;return o=>{let s=e();if(s===void 0||!s.ownServer||o.location.directory!==s.location.directory||o.location.workspaceID!==s.location.workspaceID||o.data===null||typeof o.data!=`object`)return;let c=o.data;if(c.sessionID!==s.sessionID||typeof c.reviewID!=`string`||c.reviewID.length>256)return;let l=c.stage===`breaker`?`breaker`:c.decision===`deny`?`deny`:void 0;if(l===void 0)return;let u=JSON.stringify([s.key,c.reviewID,l]);if(r.has(u))return;r.add(u),r.size>128&&r.delete(r.values().next().value);let d=n();d-i>=5e3&&(i=d,a=0),!(l===`deny`&&a>=4)&&(a++,t({kind:l,message:l===`breaker`?`Auto mode paused (breaker)`:`Auto mode denied`}))}}function _(e){let t,n,r,i=!1,a=()=>{n?.abort(),r?.(),n=void 0,r=void 0};return{update(o,s){if(i||o===t)return;a(),t=o;let c=new AbortController;n=c;try{r=s(t=>{c.signal.aborted||e(t)},c.signal)}catch{a(),t=void 0}},dispose(){i=!0,a(),t=void 0}}}var v=1e3,y=t.Plugin.define({setup(n){let[r,a]=(0,e.createSignal)(void 0),[s,c]=(0,e.createSignal)(0),l=()=>o(n.sessions.current()),y=u((e,t)=>n.client.rpc(i).status({sessionID:e.sessionID},{location:e.location,signal:t}),(e,t)=>{e===void 0?a(void 0):t!==void 0&&l()?.key===t.key&&a({key:t.key,value:e})}),b=d((e,t,r)=>(y.invalidate(),n.client.rpc(i).setMode({sessionID:e.sessionID,mode:t},{location:e.location,signal:r})),(e,t)=>{l()?.key===e.key&&a({key:e.key,value:t})},()=>n.toast.show({title:`Auto-mode`,description:`Could not change auto mode. Try again.`,variant:`error`,duration:5e3}),()=>c(e=>e+1)),x=_(g(l,e=>{n.toast.show({title:`Auto-mode`,description:e.message,variant:e.kind===`deny`?`error`:`default`,duration:5e3})})),S=()=>{let e=n.client;x.update(e,(t,n)=>e.rpc(i).events.on(`decision`,t,{signal:n}));let t=l();t!==void 0&&b.pending(t)||y(t)};(0,t.createKeyed)(()=>l()?.key,S,{otherwise:S});let C=setInterval(S,v);(0,e.onCleanup)(()=>{clearInterval(C),b.dispose(),y.dispose(),x.dispose()}),n.add(t.ComposerPill,{id:`status`,order:20,show:e=>{s();let t=o(e.session),n=r(),i=t?.ownServer&&n?.key===t.key?n.value:void 0,a=f(i),c=t!==void 0&&b.pending(t),l=c?`changing auto mode…`:p(i)??`status unavailable`,u=m(i);return{label:l,tone:h(i),title:c?`Auto-mode: change pending`:u===void 0?a===void 0?`Auto-mode unavailable`:`Auto-mode: ${a}`:`Auto-mode: ${u}`,run:!c&&a!==void 0&&t?.ownServer?()=>{b.run(t,a)}:void 0}}})}});exports.default=y;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mortz.prk/opencode-auto-mode",
-  "version": "1.0.2",
+  "version": "1.1.2",
   "description": "Configurable automatic permission review for OpenCode v2.",
   "author": {
     "name": "Andrew Mellen",
@@ -18,7 +18,10 @@
   "license": "MIT",
   "files": [
     "src",
-    "dist"
+    "dist",
+    "README.md",
+    "README.llm.md",
+    "CONTRIBUTING.md"
   ],
   "exports": {
     ".": {
@@ -36,7 +39,8 @@
     "./gui-experimental": "./dist/gui-experimental.cjs"
   },
   "scripts": {
-    "lint": "eslint . --max-warnings=0",
+    "lint": "eslint . --max-warnings=0 && node scripts/complexity-lint.js",
+    "lint:complexity": "node scripts/complexity-lint.js",
     "typecheck": "tsc --noEmit",
     "test": "bun test",
     "test:integration": "bun run integration/opencode.ts",
@@ -44,10 +48,8 @@
     "prepublishOnly": "bun run build:gui"
   },
   "dependencies": {
-    "@opencode/ai": "2.0.30",
     "@opencode/plugin": "2.2.0",
     "@opencode/schema": "2.2.0",
-    "effect": "4.0.1",
     "shell-quote": "1.12.0"
   },
   "peerDependencies": {
@@ -59,16 +61,15 @@
     "@eslint/js": "^10.0.1",
     "@opencode/theme": "2.2.0",
     "@opentui/core": "0.7.0",
-    "@opentui/keymap": "^0.6.6",
     "@opentui/solid": "0.7.0",
     "@types/node": "^26.6.4",
     "@types/shell-quote": "1.7.5",
     "@typescript/native": "npm:typescript@^7.0.2",
     "eslint": "^10.12.0",
-    "solid-js": "1.9.12",
+    "solid-js": "1.9.17",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.71.1",
-    "vite": "^7.0.0",
+    "vite": "^8.3.5",
     "vite-plugin-solid": "^2.11.0"
   }
 }