@mortz.prk/opencode-auto-mode 1.0.2 → 1.1.2

package/src/audit.ts

@@ -1,8 +1,11 @@
-import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import type { ReviewErrorKind } from "./errors.js";
+import { createJsonlLog, type DebugLogSetting } from "./debug-events.js";
+import { parseShellCommands } from "./shell.js";
+import { DYNAMIC, SCRIPT_HOSTS, SHELLS, STATEFUL, normalizeContinuations, resolveExecutable } from "./shell-policy.js";
 
+/** Unsafe, opt-in debugging data. Every original field is retained, including secrets. */
 export interface AuditRecord {
   ts: string;
   reviewID: string;
@@ -10,69 +13,147 @@ export interface AuditRecord {
   agent?: string;
   action: string;
   resources: string[];
-  hostEffect: string;
+  /** Actual host effect before arbitration; older raw records may omit it. */
+  hostEffect?: string;
   decision: string;
+  proposedDecision?: "allow" | "ask" | "deny";
+  /** True when the evaluated host effect was a native/saved allow rather than an ask. */
+  reviewedNativeAllow?: boolean;
+  /** How the applied effect was chosen: enforced, off, paused or cancelled. */
+  disposition?: string;
+  /** Message left on the host permission after arbitration, including off restores. */
+  appliedMessage?: string;
   stage: string;
   reason: string;
   durationMs: number;
-  error?: boolean;
+  score?: number | string;
+  breaker?: boolean;
   errorKind?: ReviewErrorKind;
-  errorDetail?: string;
-  traceID?: string;
-  spanID?: string;
+  [key: string]: unknown;
 }
 
 export interface AuditLog { write(record: AuditRecord): void }
 
-const MAX_BYTES = 10 * 1024 * 1024;
-const MAX_RESOURCES = 16;
-const MAX_RESOURCE_CHARS = 512;
-const MAX_REASON_CHARS = 512;
-const MAX_ACTION_CHARS = 128;
-const MAX_AGENT_CHARS = 128;
-const MAX_STAGE_CHARS = 64;
-const ERROR_KINDS: readonly ReviewErrorKind[] = ["deadline", "timeout", "cancelled", "provider", "invalid-output", "context"];
-
+/** XDG state must be an absolute path; relative or empty values fall back to home. */
 export function defaultAuditPath(): string {
-  const base = process.env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
+  const configured = process.env.XDG_STATE_HOME;
+  const base = configured !== undefined && configured !== "" && path.isAbsolute(configured)
+    ? configured
+    : path.join(os.homedir(), ".local", "state");
   return path.join(base, "opencode-auto-mode", "decisions.jsonl");
 }
 
-function clip(value: string, max: number): string {
-  return value.length > max ? `${value.slice(0, max - 1)}…` : value;
+const REDACTED = "[REDACTED]";
+const HTTP_BODY_OPTION = /^--(?:(?:expand-)?(?:data(?:-[a-z]+)?|json|form(?:-string)?)|post-data|post-file|body-data|body-file|upload-file|execute|config)(?:=|$)/;
+const POSSIBLE_HTTP_BODY = /--(?:(?:expand-)?(?:data|json|form)|post-|body-|upload-file|execute|config)|-[^- \t\n]*[dFTKe]/;
+const WGET_BODY_OPTIONS = ["--body-data", "--body-file", "--config", "--execute", "--post-data", "--post-file", "--upload-file"];
+
+function isWgetBodyOption(word: string): boolean {
+  const option = word.split("=", 1)[0]!;
+  if (!option.startsWith("--") || option.length <= 2) return false;
+  return WGET_BODY_OPTIONS.filter((name) => name.startsWith(option)).length === 1;
+}
+
+function uncertainHttpBodyEvidence(value: string): boolean {
+  const literal = normalizeContinuations(value).replace(/['"\\]/g, "");
+  const abbreviatedWgetOption = /\bwget\b/.test(literal) &&
+    (literal.match(/--[A-Za-z0-9-]+/g) ?? []).some(isWgetBodyOption);
+  return /(?:curl|wget)/.test(literal) && (POSSIBLE_HTTP_BODY.test(literal) || abbreviatedWgetOption);
+}
+
+function isHttpBodyOption(word: string, client: string): boolean {
+  return HTTP_BODY_OPTION.test(word) || (client === "wget" && isWgetBodyOption(word));
+}
+
+function wgetShortOptionBehavior(word: string): "body" | "value" | "other" {
+  // -e/--execute supplies wgetrc settings, including post_data; stop at value options.
+  for (let letter = 1; letter < word.length; letter++) {
+    if (word[letter] === "e") return "body";
+    if ("oaOUtTwQDAlIRX".includes(word[letter]!))
+      return letter === word.length - 1 ? "value" : "other";
+  }
+  return "other";
+}
+
+function curlShortOptionBehavior(word: string): "body" | "value" | "other" {
+  for (let letter = 1; letter < word.length; letter++) {
+    if ("dFT".includes(word[letter]!)) return "body";
+    if (word[letter] === "K") return "body"; // curl config is not bounded evidence.
+    if ("HAeuxowQCrmXbcztEyU".includes(word[letter]!))
+      return letter === word.length - 1 ? "value" : "other";
+  }
+  return "other";
+}
+
+function hasHttpBodyOptionEvidence(words: readonly string[], client: string, start: number): boolean {
+  const args = words.slice(start);
+  for (let index = 0; index < args.length; index++) {
+    const word = args[index]!;
+    if (word === "--") break;
+    if (isHttpBodyOption(word, client)) return true;
+    if (/^--(?:header|user-agent|referer|user|proxy|output|url|request|cookie|cookie-jar|config|directory-prefix)$/.test(word)) {
+      if (word === "--config") return true;
+      index++;
+      continue;
+    }
+    if (!/^-[^-]/.test(word)) continue;
+    const behavior = client === "wget" ? wgetShortOptionBehavior(word) : curlShortOptionBehavior(word);
+    if (behavior === "body") return true;
+    if (behavior === "value") index++;
+  }
+  return false;
+}
+
+interface JsonVisitState { nodes: number; changed: boolean }
+
+function visitJson(entry: unknown, level: number, depth: number, state: JsonVisitState): unknown {
+  if (++state.nodes > 4096 || level > 32) { state.changed = true; return REDACTED; }
+  if (typeof entry === "string") {
+    const redacted = redactHttpBodies(entry, depth + 1);
+    if (redacted !== entry) state.changed = true;
+    return redacted;
+  }
+  if (Array.isArray(entry)) return entry.map((item) => visitJson(item, level + 1, depth, state));
+  if (entry !== null && typeof entry === "object")
+    return Object.fromEntries(Object.entries(entry).map(([key, item]) => [key, visitJson(item, level + 1, depth, state)]));
+  return entry;
+}
+
+/** Actual literal invocations, not strings merely mentioning an HTTP client. */
+function segmentHasHttpBodyEvidence(words: readonly string[], globs: readonly boolean[], value: string): boolean {
+  if (!words.length) return false;
+  const executable = resolveExecutable(words);
+  if (!executable || SHELLS.has(executable.name) || SCRIPT_HOSTS.has(executable.name) ||
+      DYNAMIC.has(executable.name) || STATEFUL.has(executable.name) || globs.some(Boolean))
+    return uncertainHttpBodyEvidence(value);
+  return ["curl", "wget"].includes(executable.name) &&
+    hasHttpBodyOptionEvidence(words, executable.name, executable.index + 1);
+}
+
+function hasHttpBodyEvidence(value: string): boolean {
+  const parsed = parseShellCommands(value);
+  // Unknown syntax may hide an invocation (substitution, interpreter, heredoc).
+  // With a client and body marker present, omit rather than leak into a model.
+  if (!parsed?.complete) return uncertainHttpBodyEvidence(value);
+  return parsed.segments.some((segment) => segmentHasHttpBodyEvidence(segment.words, segment.globs, value));
 }
 
-/**
- * Bounds every exported record. Local audit and OTLP must describe the same
- * payload, so both call this before serialising anything.
- */
-export function sanitizeRecord(record: AuditRecord): AuditRecord {
-  return {
-    ...record,
-    action: clip(record.action, MAX_ACTION_CHARS),
-    resources: record.resources.slice(0, MAX_RESOURCES).map((resource) => clip(resource, MAX_RESOURCE_CHARS)),
-    reason: clip(record.reason, MAX_REASON_CHARS),
-    stage: clip(record.stage, MAX_STAGE_CHARS),
-    ...(record.agent === undefined ? {} : { agent: clip(record.agent, MAX_AGENT_CHARS) }),
-    ...(record.errorKind === undefined ? {} : { errorKind: ERROR_KINDS.includes(record.errorKind) ? record.errorKind : "provider" }),
-    ...(record.errorDetail === undefined ? {} : { errorDetail: clip(record.errorDetail, MAX_REASON_CHARS) }),
-  };
+/** Evidence privacy helper, independent of the unredacted debugging audit sink. */
+export function redactHttpBodies(value: string, depth = 0): string {
+  if (/^\s*(?:\[|\{|")/.test(value)) {
+    let parsed: unknown;
+    try { parsed = JSON.parse(value); } catch { /* Not a serialized JSON value. */ }
+    if (parsed !== undefined) {
+      if (depth >= 8) return REDACTED;
+      const state: JsonVisitState = { nodes: 0, changed: false };
+      const visited = visitJson(parsed, 0, depth, state);
+      return state.changed ? JSON.stringify(visited) : value;
+    }
+  }
+  return hasHttpBodyEvidence(value) ? "[REDACTED HTTP BODY AND COMMAND EVIDENCE]" : value;
 }
 
-export function createAuditLog(setting: boolean | string | undefined): AuditLog | undefined {
-  if (setting === undefined || setting === false) return undefined;
-  const file = typeof setting === "string" ? setting : defaultAuditPath();
-  return {
-    write(record) {
-      let fd: number | undefined;
-      try {
-        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-        try { if (fs.statSync(file).size > MAX_BYTES) fs.renameSync(file, `${file}.1`); } catch { /* no file yet */ }
-        fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_APPEND | fs.constants.O_NOFOLLOW, 0o600);
-        fs.writeSync(fd, `${JSON.stringify(sanitizeRecord(record))}\n`);
-      } catch {
-        // Auditing is best effort and must not interrupt permission review.
-      } finally { if (fd !== undefined) fs.closeSync(fd); }
-    },
-  };
+/** OFF unless explicitly enabled. Records are neither redacted nor truncated. */
+export function createAuditLog(setting: DebugLogSetting): AuditLog | undefined {
+  return createJsonlLog(setting);
 }

package/src/classifier.ts

@@ -1,53 +1,50 @@
-import { classify } from "./tiers.js";
-import type { ClassifierStage } from "./config.js";
+import type { ClassifierOptions } from "./config.js";
+import { errorKindOf } from "./errors.js";
 import type { PermissionRequest, ReviewResult, StageResult } from "./reviewer.js";
-import { guardShell } from "./shell.js";
-import type { ReviewErrorKind } from "./errors.js";
+import type { RequestScore } from "./score.js";
 
-export async function compositeDecision(
-  stages: ClassifierStage[],
-  request: PermissionRequest,
-  review: (stage: Exclude<ClassifierStage, { type: "static" }>) => Promise<StageResult>,
-): Promise<ReviewResult> {
-  const shellResult = request.action === "shell" ? guardShell(request.resources) : undefined;
-  if (shellResult?.decision === "deny") return { ...shellResult, stage: "shell-guard" };
-  for (const stage of stages) {
-    if (stage.type !== "static") continue;
-    const result = classify(request.action, request.resources);
-    if (result.tier === "auto-deny") return { decision: "deny", reason: result.reason, stage: "static" };
-  }
-  if (shellResult) {
-    // Parsed read-only results feed the static stage, but never bypass a model-only pipeline.
-    const hasStatic = stages.some((stage) => stage.type === "static");
-    if (shellResult.decision !== "allow" || hasStatic)
-      return { ...shellResult, stage: shellResult.decision === "allow" ? "static" : "shell-guard" };
-  }
-  let abstained: string | undefined;
-  let abstainedKind: ReviewErrorKind | undefined;
-  for (const stage of stages) {
-    if (stage.type === "static") {
-      const result = classify(request.action, request.resources, {
-        projectDir: request.projectDir, allowInProjectEdits: stage.allowInProjectEdits,
-      });
-      if (result.tier === "auto-allow") return { decision: "allow", reason: result.reason, stage: "static" };
-    } else {
-      const result = await review(stage);
-      if (result.decision === "abstain") {
-        abstained = result.reason;
-        abstainedKind ??= result.errorKind;
-        continue;
+export interface ClassifierCallbacks {
+  /** Whole-pipeline cancellation/deadline, distinct from each stage's timeout. */
+  signal?: AbortSignal;
+  decision(stage: Extract<ClassifierOptions, { type: "decision" }>, request: PermissionRequest): Promise<StageResult>;
+  llm(stage: Extract<ClassifierOptions, { type: "llm" }>, request: PermissionRequest): Promise<StageResult>;
+  onResult?(stage: ClassifierOptions, result: StageResult, index: number): void;
+}
+
+/** Configured order is authoritative. The caller applies mandatory deny/ask guards first. */
+export async function runClassifiers(stages: readonly ClassifierOptions[], request: PermissionRequest, score: RequestScore, callbacks: ClassifierCallbacks): Promise<ReviewResult> {
+  const interrupted = (stage = "classifiers"): ReviewResult => ({
+    decision: "ask", reason: "Classifier pipeline interrupted; human review required", stage,
+    errorKind: callbacks.signal?.reason instanceof DOMException && callbacks.signal.reason.name === "TimeoutError" ? "deadline" : "cancelled",
+  });
+  if (callbacks.signal?.aborted) return interrupted();
+  // Defensive guard: no configured stage may override mandatory scoring effects.
+  if (score.deny || score.ask)
+    return { decision: score.deny ? "deny" : "ask", reason: score.reason, stage: "guard" };
+  let last: StageResult | undefined;
+  for (const [index, stage] of stages.entries()) {
+    if (callbacks.signal?.aborted) return interrupted(stage.type);
+    let result: StageResult;
+    try {
+      if (stage.type === "static") {
+        const editsDisabled = stage.allowInProjectEdits === false && ["edit", "write"].includes(request.action);
+        result = score.band === "low" && !editsDisabled
+          ? { decision: "allow", reason: score.reason, stage: "static" }
+          : { decision: "abstain", reason: "Static classifier requires further review", stage: "static" };
+      } else {
+        // Decisions and LLMs see any unresolved band; never silently reorder or insert stages.
+        result = stage.type === "decision" ? await callbacks.decision(stage, request) : await callbacks.llm(stage, request);
       }
-      const terminal: ReviewResult = {
-        decision: result.decision, reason: result.reason, stage: result.stage ?? stage.type,
-        ...(result.errorKind === undefined ? {} : { errorKind: result.errorKind }),
-      };
-      return terminal;
+    } catch (error) {
+      result = { decision: "abstain", reason: "Classifier unavailable", stage: stage.type, errorKind: errorKindOf(error) };
     }
+    if (callbacks.signal?.aborted) result = interrupted(stage.type);
+    try { callbacks.onResult?.(stage, result, index); } catch { /* Observability must not alter a verdict. */ }
+    // Observers can synchronously trigger cancellation too; never return a stale allow.
+    if (callbacks.signal?.aborted) return interrupted(stage.type);
+    if (result.errorKind === "cancelled" || result.errorKind === "deadline") return { ...result, decision: "ask" };
+    if (result.decision === "allow" || result.decision === "deny") return result as ReviewResult;
+    last = result;
   }
-  return {
-    decision: "ask",
-    reason: abstained ? `No classifier made a decision (${abstained})` : "No classifier made a decision",
-    stage: "none",
-    ...(abstainedKind === undefined ? {} : { errorKind: abstainedKind }),
-  };
+  return { ...last, decision: "ask", reason: last?.reason ?? "No classifier resolved the request", stage: last?.stage ?? "classifiers" };
 }

package/src/code-mode.ts

@@ -0,0 +1,55 @@
+import { createHash } from "node:crypto";
+
+const MAX_CODE_BYTES = 65_536;
+const IDENTITY_PREFIX = "execute:sha256:";
+const METADATA_KEY = "opencodeAutoModeCode";
+
+/** Hash the exact UTF-8 program, without normalizing whitespace or punctuation.
+ * Native save entries are wildcard patterns: raw JavaScript is never a safe save entry.
+ * This identity format intentionally contains neither '*' nor '?'. */
+export function codeModeIdentity(code: string): string {
+  return `${IDENTITY_PREFIX}${createHash("sha256").update(code, "utf8").digest("hex")}`;
+}
+
+function validCode(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0 && Buffer.byteLength(value) <= MAX_CODE_BYTES;
+}
+
+/** Build only the Code Mode-specific fields of permission.assert. The caller owns
+ * session, agent and source, and must not mutate the executable input afterwards.
+ * No native rules or saved approvals are read, migrated, removed, or overwritten.
+ * Legacy raw-code rules generally do not match these identities; broad native
+ * execute policies (including '*') still do. Raw-code-specific configured policies
+ * require a separate native evaluation by the caller; this helper cannot preserve
+ * their semantics by passing raw code as a second resource (that breaks Always).
+ */
+export function codeModePermission(input: unknown) {
+  const code = typeof input === "string" ? input : input && typeof input === "object" && !Array.isArray(input)
+    ? (input as { code?: unknown }).code : undefined;
+  if (!validCode(code)) throw new Error("Code Mode input is missing, unsupported or too large for permission review");
+  const identity = codeModeIdentity(code);
+  return {
+    action: "execute" as const,
+    resources: [identity],
+    save: [identity],
+    metadata: { [METADATA_KEY]: { version: 1, identity, code } },
+  };
+}
+
+/** Recover reviewer evidence only when metadata is bound to the sole hash resource.
+ * Native deny remains final. Native allows are reviewed whenever auto mode is on;
+ * there is no reviewNativeAllows option and no legacy bypass. Returned resources
+ * are reviewer-local, not host edits.
+ * Undefined means an ordinary non-identity execute request; malformed identity
+ * requests throw rather than allowing review of an opaque digest or mismatched code.
+ */
+export function codeModeReviewResources(event: { action: string; resources: readonly string[]; metadata?: Record<string, unknown> }): string[] | undefined {
+  if (event.action !== "execute" || !event.resources.some(resource => resource.startsWith(IDENTITY_PREFIX))) return undefined;
+  const evidence = event.metadata?.[METADATA_KEY];
+  if (!evidence || typeof evidence !== "object" || Array.isArray(evidence))
+    throw new Error("Code Mode program evidence is unavailable");
+  const { version, identity, code } = evidence as { version?: unknown; identity?: unknown; code?: unknown };
+  if (version !== 1 || !validCode(code) || event.resources.length !== 1 || identity !== event.resources[0] || identity !== codeModeIdentity(code))
+    throw new Error("Code Mode program evidence does not match its permission identity");
+  return [code];
+}

package/src/config.ts

@@ -1,137 +1,134 @@
 import { Model } from "@opencode/schema/model";
-import type { ReviewPolicy } from "./policy.js";
-import { logsUrl, type OtlpOptions } from "./otlp.js";
 
-export type ReviewerModel = string;
 export type ReviewerModelRef = { id: string; providerID: string; variant?: string };
-export type DecisionProvider = {
-  apiKeyEnv?: string;
-  minConfidence?: number;
-  timeoutMs?: number;
-};
-
-export type DecisionStage = {
-  type: "decision";
-  model: string;
-  endpoint?: string;
-  policy?: Partial<ReviewPolicy>;
-} & DecisionProvider;
-
-export type ClassifierStage =
+export type ClassifierOptions =
   | { type: "static"; allowInProjectEdits?: boolean }
-  | DecisionStage
-  | { type: "llm"; model?: ReviewerModel; policy?: Partial<ReviewPolicy> };
-
+  | { type: "decision"; model: string; timeoutMs?: number; minConfidence?: number }
+  | { type: "llm"; model: string; timeoutMs?: number };
+export interface BreakerOptions { consecutiveDenies: number; windowDenies: number; windowSize: number }
+export interface AuditOptions { enabled: boolean; maxBytes: number }
 export interface AutoModeOptions {
-  classifiers: ClassifierStage[];
-  tui?: boolean;
-  auditLog?: boolean | string;
-  otlp?: boolean | OtlpOptions;
-  reviewTimeoutMs?: number;
+  classifiers: ClassifierOptions[];
+  /** Resolved scoring compatibility field, derived from static stages; not a public option. */
+  allowInProjectEdits: boolean;
+  tui: boolean;
+  reviewTimeoutMs: number;
+  breaker: BreakerOptions;
+  audit: AuditOptions;
 }
 
-/** Longest a single review may block the permission prompt, across every stage. */
-export const DEFAULT_REVIEW_TIMEOUT_MS = 60_000;
+export const DEFAULT_REVIEW_TIMEOUT_MS = 15_000;
 export const MAX_REVIEW_TIMEOUT_MS = 120_000;
+/** Audited JSONL rotation limit; the debug event sink uses the same 10 MiB cap. */
+export const DEFAULT_AUDIT_MAX_BYTES = 10_485_760;
+const DEFAULT_BREAKER: BreakerOptions = { consecutiveDenies: 3, windowDenies: 10, windowSize: 50 };
 
 export function object(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-
 function text(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0 && value.length <= 4096;
 }
-
-function only(value: Record<string, unknown>, keys: string[]): boolean {
-  return Object.keys(value).every((key) => keys.includes(key));
+function only(value: Record<string, unknown>, keys: readonly string[]): void {
+  const unknown = Object.keys(value).find((key) => !keys.includes(key));
+  if (unknown) throw new Error(`Unknown auto-mode option '${unknown}'`);
+}
+function invalid(name: string): never { throw new Error(`Invalid auto-mode ${name}`); }
+function integer(value: unknown, max: number): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= max;
 }
-
 export function parseReviewerModel(value: string): ReviewerModelRef {
   const ref = Model.Ref.parse(value);
-  return {
-    id: ref.id,
-    providerID: ref.providerID,
-    ...(ref.variant === undefined ? {} : { variant: ref.variant }),
-  };
+  return { id: ref.id, providerID: ref.providerID, ...(ref.variant === undefined ? {} : { variant: ref.variant }) };
 }
-
-function model(value: unknown): value is ReviewerModel {
-  if (typeof value !== "string" || !text(value)) return false;
+function model(value: unknown): value is string {
+  if (!text(value)) return false;
   try { parseReviewerModel(value); return true; } catch { return false; }
 }
 
-function policy(value: unknown): value is Partial<ReviewPolicy> {
-  return object(value) && only(value, ["trusted", "blocks", "exceptions"]) &&
-    Object.values(value).every((list) => Array.isArray(list) && list.length <= 256 && list.every(text));
-}
-
-export function localEndpoint(value: string): string {
-  const url = new URL(value);
-  if (!['http:', 'https:'].includes(url.protocol) ||
-      !['127.0.0.1', '[::1]'].includes(url.hostname) || url.username || url.password || url.search || url.hash ||
-      url.pathname !== '/v1/systemone') throw new Error("Local System One requires a loopback /v1/systemone endpoint");
-  return url.href;
-}
-
-function otlp(value: unknown): value is OtlpOptions {
-  if (!object(value) || !only(value, ["endpoint", "headers", "timeoutMs"])) return false;
-  if (value.endpoint !== undefined) {
-    if (!text(value.endpoint)) return false;
-    try { logsUrl(value.endpoint); } catch { return false; }
+/** One configured pipeline stage. Unknown keys are rejected per stage type. */
+function parseClassifier(stage: unknown): ClassifierOptions {
+  if (!object(stage)) invalid("classifier");
+  if (stage.type === "static") {
+    only(stage, ["type", "allowInProjectEdits"]);
+    if (stage.allowInProjectEdits !== undefined && typeof stage.allowInProjectEdits !== "boolean")
+      invalid("static allowInProjectEdits");
+    return { type: "static", ...(stage.allowInProjectEdits === undefined ? {} : { allowInProjectEdits: stage.allowInProjectEdits }) };
   }
-  if (value.headers !== undefined && (!object(value.headers) || Object.keys(value.headers).length > 32 ||
-      !Object.entries(value.headers).every(([key, header]) => /^[A-Za-z0-9-]{1,128}$/.test(key) && text(header)))) return false;
-  return value.timeoutMs === undefined || (typeof value.timeoutMs === "number" && Number.isInteger(value.timeoutMs) &&
-    value.timeoutMs >= 1 && value.timeoutMs <= 10_000);
+  if (stage.type !== "decision" && stage.type !== "llm") invalid("classifier type");
+  only(stage, stage.type === "decision" ? ["type", "model", "timeoutMs", "minConfidence"] : ["type", "model", "timeoutMs"]);
+  if (!model(stage.model)) invalid("classifier model");
+  if (stage.timeoutMs !== undefined && !integer(stage.timeoutMs, MAX_REVIEW_TIMEOUT_MS)) invalid("classifier timeoutMs");
+  if (stage.type === "decision" && stage.minConfidence !== undefined &&
+      (typeof stage.minConfidence !== "number" || !Number.isFinite(stage.minConfidence) ||
+        stage.minConfidence < 0 || stage.minConfidence > 1))
+    invalid("decision minConfidence");
+  return { type: stage.type, model: stage.model,
+    ...(stage.timeoutMs === undefined ? {} : { timeoutMs: stage.timeoutMs as number }),
+    ...(stage.type === "decision" && stage.minConfidence !== undefined ? { minConfidence: stage.minConfidence as number } : {}) };
 }
 
-export const DECISION_PROVIDERS = ["typesafe-ai", "laya", "openai"] as const;
+/** Required, non-empty, and at most one static stage. Exactly one static stage may
+ * exist: a second is redundant at best and makes the effective project-edit policy
+ * ambiguous. */
+function parseClassifiers(value: unknown): ClassifierOptions[] {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 64) invalid("classifiers");
+  const classifiers = value.map(parseClassifier);
+  if (classifiers.filter((stage) => stage.type === "static").length > 1) invalid("classifiers");
+  return classifiers;
+}
 
-function decision(value: Record<string, unknown>): value is DecisionStage {
-  if (!only(value, ["type", "model", "apiKeyEnv", "minConfidence", "timeoutMs", "endpoint", "policy"])) return false;
-  if (value.policy !== undefined && !policy(value.policy)) return false;
-  if (!model(value.model)) return false;
-  const ref = parseReviewerModel(value.model);
-  if (ref.variant !== undefined || !(DECISION_PROVIDERS as readonly string[]).includes(ref.providerID)) return false;
-  if (value.apiKeyEnv !== undefined &&
-      (typeof value.apiKeyEnv !== "string" || !/^[A-Z_][A-Z0-9_]{0,127}$/.test(value.apiKeyEnv))) return false;
-  if (value.minConfidence !== undefined &&
-      (typeof value.minConfidence !== "number" || !Number.isFinite(value.minConfidence) ||
-       value.minConfidence < 0 || value.minConfidence > 1)) return false;
-  if (value.timeoutMs !== undefined &&
-      (typeof value.timeoutMs !== "number" || !Number.isInteger(value.timeoutMs) ||
-       value.timeoutMs < 1 || value.timeoutMs > 30_000)) return false;
-  if (value.endpoint !== undefined) {
-    if (ref.providerID !== "laya" || !text(value.endpoint)) return false;
-    try { localEndpoint(value.endpoint); } catch { return false; }
-  }
-  return true;
+function parseBreaker(value: unknown): BreakerOptions {
+  if (!object(value)) invalid("breaker");
+  only(value, ["consecutiveDenies", "windowDenies", "windowSize"]);
+  if (!integer(value.consecutiveDenies, 10_000) || !integer(value.windowDenies, 10_000) ||
+      !integer(value.windowSize, 10_000) || value.windowDenies > value.windowSize)
+    invalid("breaker thresholds");
+  return {
+    consecutiveDenies: value.consecutiveDenies,
+    windowDenies: value.windowDenies,
+    windowSize: value.windowSize,
+  };
 }
 
-function stage(value: unknown): value is ClassifierStage {
-  if (!object(value)) return false;
-  if (value.type === "static") return only(value, ["type", "allowInProjectEdits"]) &&
-    (value.allowInProjectEdits === undefined || typeof value.allowInProjectEdits === "boolean");
-  if (value.type === "llm") return only(value, ["type", "model", "policy"]) &&
-    (value.model === undefined || model(value.model)) &&
-    (value.policy === undefined || policy(value.policy));
-  return value.type === "decision" && decision(value);
+/** Audit settings are an object only; a bare path or boolean was a removed shape. */
+function parseAudit(value: unknown): AuditOptions {
+  if (!object(value)) invalid("audit");
+  only(value, ["enabled", "maxBytes"]);
+  if (value.enabled !== undefined && typeof value.enabled !== "boolean") invalid("audit enabled");
+  if (value.maxBytes !== undefined && (typeof value.maxBytes !== "number" || !Number.isSafeInteger(value.maxBytes) ||
+      value.maxBytes < 0)) invalid("audit maxBytes");
+  return {
+    enabled: value.enabled === undefined ? false : value.enabled,
+    maxBytes: value.maxBytes === undefined ? DEFAULT_AUDIT_MAX_BYTES : value.maxBytes,
+  };
 }
 
+/** Strict validation only; callers must obtain provenance via loadGlobalOptions,
+ * never from the SDK's project-merged ctx.options. */
 export function parseOptions(value: unknown): AutoModeOptions {
-  if (!object(value)) throw new Error("Invalid auto-mode options");
-  if (!only(value, ["classifiers", "tui", "auditLog", "otlp", "reviewTimeoutMs"]))
-    throw new Error("Unknown auto-mode option");
-  if (value.tui !== undefined && typeof value.tui !== "boolean") throw new Error("Invalid TUI setting");
-  if (value.reviewTimeoutMs !== undefined &&
-      (typeof value.reviewTimeoutMs !== "number" || !Number.isInteger(value.reviewTimeoutMs) ||
-       value.reviewTimeoutMs < 1_000 || value.reviewTimeoutMs > MAX_REVIEW_TIMEOUT_MS))
-    throw new Error("Invalid review timeout");
-  if (value.auditLog !== undefined && typeof value.auditLog !== "boolean" && !text(value.auditLog))
-    throw new Error("Invalid audit log");
-  if (value.otlp !== undefined && typeof value.otlp !== "boolean" && !otlp(value.otlp)) throw new Error("Invalid OTLP options");
-  if (!Array.isArray(value.classifiers) || value.classifiers.length === 0 ||
-      value.classifiers.length > 16 || !value.classifiers.every(stage))
-    throw new Error("A valid nonempty classifiers array is required");
-  return value as unknown as AutoModeOptions;
+  if (!object(value)) invalid("options");
+  only(value, ["classifiers", "reviewTimeoutMs", "breaker", "tui", "audit"]);
+  const classifiers = parseClassifiers(value.classifiers);
+  const result: AutoModeOptions = {
+    classifiers,
+    // In-project edit auto-allow remains the default (owner-approved); a static
+    // stage opts out by setting allowInProjectEdits: false.
+    allowInProjectEdits: classifiers.some((stage) => stage.type === "static" && stage.allowInProjectEdits !== false),
+    tui: true,
+    reviewTimeoutMs: DEFAULT_REVIEW_TIMEOUT_MS,
+    breaker: { ...DEFAULT_BREAKER },
+    audit: { enabled: false, maxBytes: DEFAULT_AUDIT_MAX_BYTES },
+  };
+  if (value.reviewTimeoutMs !== undefined) {
+    if (!integer(value.reviewTimeoutMs, MAX_REVIEW_TIMEOUT_MS)) invalid("reviewTimeoutMs");
+    result.reviewTimeoutMs = value.reviewTimeoutMs;
+  }
+  if (value.tui !== undefined) {
+    if (typeof value.tui !== "boolean") invalid("tui");
+    result.tui = value.tui;
+  }
+  if (value.breaker !== undefined) result.breaker = parseBreaker(value.breaker);
+  if (value.audit !== undefined) result.audit = parseAudit(value.audit);
+  return result;
 }