auto-mode 0.1.0 → 0.2.0

package/dist/classify-locally-BHl0xiqa.js

@@ -1,786 +0,0 @@
-import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, parse, relative } from "node:path";
-import { promisify } from "node:util";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-//#region src/config/config.ts
-const run = promisify(execFile);
-/**
-* Muse Spark is the default because it reasons, it was correct on every case we
-* measured, and a contributor-tier call costs about a fortieth of the
-* alternatives. Its token budget is not a preference: below roughly 2000 it
-* returns nothing at all.
-*/
-const DEFAULT_CONFIG = {
-	provider: {
-		baseURL: "https://api.meta.ai",
-		model: "muse-spark-1.3-contributor",
-		apiKeyEnv: "META_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	transcriptEntries: 40,
-	onFailure: "defer"
-};
-/** Provider presets, so a config need only name one. */
-const PRESETS = {
-	spark: DEFAULT_CONFIG.provider,
-	claude: {
-		baseURL: "https://api.anthropic.com",
-		model: "claude-haiku-4-5-20251001",
-		apiKeyEnv: "ANTHROPIC_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	glm: {
-		baseURL: "https://api.z.ai/api/anthropic",
-		model: "glm-5.3-flash",
-		apiKeyEnv: "ZAI_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 6e4
-	}
-};
-function configPath() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
-	return join(base, "auto-mode", "config.json");
-}
-/**
-* Reads the config, falling back to the shipped defaults. A missing file is
-* normal. A malformed one is not, and it throws rather than silently running a
-* policy the user did not write.
-*/
-async function loadConfig(path = configPath()) {
-	let text;
-	try {
-		text = await readFile(path, "utf8");
-	} catch {
-		return DEFAULT_CONFIG;
-	}
-	let parsed;
-	try {
-		parsed = JSON.parse(text);
-	} catch (error) {
-		throw new Error(`${path} is not valid JSON: ${error.message}`);
-	}
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`${path} must hold a JSON object`);
-	return merge(parsed, path);
-}
-function merge(raw, path) {
-	const presetName = typeof raw["preset"] === "string" ? raw["preset"] : void 0;
-	if (presetName !== void 0 && PRESETS[presetName] === void 0) throw new Error(`${path} names an unknown preset '${presetName}'; known presets are ${Object.keys(PRESETS).join(", ")}`);
-	const base = presetName === void 0 ? DEFAULT_CONFIG.provider : PRESETS[presetName];
-	const override = isObject(raw["provider"]) ? raw["provider"] : {};
-	const provider = {
-		baseURL: str(override["baseURL"]) ?? base.baseURL,
-		model: str(override["model"]) ?? base.model,
-		reasoning: typeof override["reasoning"] === "boolean" ? override["reasoning"] : base.reasoning,
-		maxTokens: num(override["maxTokens"]) ?? base.maxTokens,
-		timeoutMs: num(override["timeoutMs"]) ?? base.timeoutMs,
-		...pick("apiKeyEnv", str(override["apiKeyEnv"]) ?? base.apiKeyEnv),
-		...pick("apiKeyCommand", str(override["apiKeyCommand"]) ?? base.apiKeyCommand)
-	};
-	const onFailure = raw["onFailure"] === "deny" ? "deny" : "defer";
-	return {
-		provider,
-		transcriptEntries: num(raw["transcriptEntries"]) ?? DEFAULT_CONFIG.transcriptEntries,
-		onFailure,
-		...pick("classifierPath", str(raw["classifierPath"])),
-		...pick("rulesPath", str(raw["rulesPath"]))
-	};
-}
-/** Reads the key from the environment, then from the helper command. */
-async function resolveApiKey(provider) {
-	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
-	if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
-	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return null;
-	try {
-		const { stdout } = await run("/bin/sh", ["-c", provider.apiKeyCommand], { timeout: 5e3 });
-		const key = stdout.trim();
-		return key === "" ? null : key;
-	} catch {
-		return null;
-	}
-}
-function isObject(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function str(value) {
-	return typeof value === "string" && value !== "" ? value : void 0;
-}
-function num(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function pick(key, value) {
-	return value === void 0 ? {} : { [key]: value };
-}
-//#endregion
-//#region src/harness/detect-harness.ts
-/**
-* Names the harness that sent a hook payload.
-*
-* The three shapes overlap, so order matters. Muse carries `model_provider`,
-* which neither of the others sends, so it is tested first — Muse also sends
-* `turn_id`, and testing that first would call every Muse payload Codex. Claude
-* is the only one that sends `prompt_id`. Codex is then what is left that
-* carries `turn_id`.
-*
-* Environment variables cannot help here: Muse runs hook commands with a
-* scrubbed environment, so a Muse hook sees none of them.
-*/
-function detectHarness(payload) {
-	if ("model_provider" in payload) return "muse";
-	if ("prompt_id" in payload) return "claude";
-	if ("turn_id" in payload) return "codex";
-	return null;
-}
-//#endregion
-//#region src/harness/parse-payload.ts
-const EVENTS = /* @__PURE__ */ new Set(["PreToolUse", "PermissionRequest"]);
-function readString(payload, key) {
-	const value = payload[key];
-	return typeof value === "string" && value !== "" ? value : void 0;
-}
-/**
-* Normalises one harness payload, or returns null when auto-mode has nothing to
-* say about it — an unknown harness, an event that is not a tool gate, or a
-* body that is not an object. A null is not a refusal: the caller stays out of
-* the way and the harness decides for itself.
-*/
-function parsePayload(body) {
-	if (body === null || typeof body !== "object" || Array.isArray(body)) return null;
-	const payload = body;
-	const harness = detectHarness(payload);
-	if (harness === null) return null;
-	const event = readString(payload, "hook_event_name");
-	if (event === void 0 || !EVENTS.has(event)) return null;
-	const toolName = readString(payload, "tool_name");
-	if (toolName === void 0) return null;
-	const toolInput = payload["tool_input"];
-	const transcriptPath = readString(payload, "transcript_path");
-	return {
-		harness,
-		event,
-		sessionId: readString(payload, "session_id") ?? "",
-		cwd: readString(payload, "cwd") ?? process.cwd(),
-		toolName,
-		toolInput: toolInput !== null && typeof toolInput === "object" && !Array.isArray(toolInput) ? toolInput : {},
-		...transcriptPath === void 0 ? {} : { transcriptPath },
-		raw: payload
-	};
-}
-//#endregion
-//#region src/harness/render-verdict.ts
-/**
-* Turns a verdict into the JSON the harness reads on stdout.
-*
-* All three harnesses take the same shape, because Codex and Muse both model
-* their hook contract on Claude's. `allow` and `ask` differ: `allow` runs the
-* tool with no prompt, while `ask` falls through to whatever the harness would
-* have done on its own, which is usually to ask the operator.
-*/
-function renderVerdict(event, verdict) {
-	if (verdict.kind === "ask") return JSON.stringify({ hookSpecificOutput: {
-		hookEventName: event,
-		permissionDecision: "ask"
-	} });
-	if (verdict.kind === "allow") return JSON.stringify({ hookSpecificOutput: {
-		hookEventName: event,
-		permissionDecision: "allow"
-	} });
-	return JSON.stringify({ hookSpecificOutput: {
-		hookEventName: event,
-		permissionDecision: "deny",
-		permissionDecisionReason: `[${verdict.rule}] ${verdict.reason}`
-	} });
-}
-//#endregion
-//#region src/install/hook-config.ts
-/**
-* Prints the hook entry a harness needs, for the user to paste into their own
-* settings. auto-mode never writes those files itself: they are the user's
-* configuration, and an agent that can edit its own restraints has none.
-*
-* All three take a different entry shape, and each difference is load-bearing:
-*
-* - Claude matches tool names against a regular expression, so matching every
-*   tool is `.*`. Two near-misses both leave the hook installed but never
-*   firing: `*` is not a valid regular expression, and `""` matches only a tool
-*   whose name is the empty string.
-* - Muse takes `""` to mean every tool, so the same value means opposite things
-*   in the two harnesses.
-* - Codex registers a bare handler list with no matcher.
-* - Muse 1.3 rejects a handler carrying `timeout_ms`, reporting an unknown
-*   field and skipping the whole handler silently, so the hook never runs. A
-*   user-tier Muse entry takes `type` and `command` and nothing else.
-*
-* The timeout is 90 seconds, not the usual 30: a reasoning model takes 13-24
-* seconds on a hard case, and a harness timeout shorter than the model call
-* turns every hard case into a silent failure.
-*/
-function hookConfig(harness, command) {
-	return JSON.stringify({ hooks: { PreToolUse: [harness === "claude" ? {
-		matcher: ".*",
-		hooks: [{
-			type: "command",
-			command,
-			timeout: 90
-		}]
-	} : harness === "codex" ? { hooks: [{
-		type: "command",
-		command,
-		timeout: 90
-	}] } : {
-		matcher: "",
-		hooks: [{
-			type: "command",
-			command
-		}]
-	}] } }, null, 2);
-}
-const SETTINGS_PATHS = {
-	claude: "~/.claude/settings.json",
-	codex: "~/.codex/hooks.json",
-	muse: "~/.config/muse/settings.json"
-};
-/** What else each harness needs before the hook will run. Empty when nothing. */
-const SETUP_NOTES = {
-	claude: ["A tool your permission settings already deny is refused before the hook sees it, so", "auto-mode can only narrow what the harness would have allowed."],
-	codex: [
-		"Set `hooks = true` in ~/.codex/config.toml.",
-		"Codex will not run an untrusted hook. Trust it once when Codex prompts you; the",
-		"answer is recorded under [hooks.state] in config.toml. Until then the hook is",
-		"skipped silently."
-	],
-	muse: ["Muse runs hooks with a scrubbed environment, so an API key from a variable will", "not reach it. Set provider.apiKeyCommand in the auto-mode config instead."]
-};
-//#endregion
-//#region src/policy/load-policy.ts
-/** The line in the classifier file that the rule list replaces. */
-const RULES_MARKER = "<rules>";
-/**
-* Reads the two policy files and splices them into the one system prompt the
-* model receives. Nothing else is added, so `auto-mode print-prompt` shows
-* exactly what the classifier reads.
-*/
-async function loadPolicy(paths = {}) {
-	const shipped = findShippedPolicyDir();
-	const classifierPath = paths.classifierPath ?? join(shipped, "classifier.md");
-	const rulesPath = paths.rulesPath ?? join(shipped, "rules.md");
-	const [classifier, rules] = await Promise.all([readFile(classifierPath, "utf8"), readFile(rulesPath, "utf8")]);
-	if (!classifier.includes(RULES_MARKER)) throw new Error(`${classifierPath} has no ${RULES_MARKER} line, so the rules cannot be placed`);
-	return classifier.replace(RULES_MARKER, rules.trim());
-}
-/**
-* Finds the `policy/` directory this package ships. It walks up from this
-* module rather than counting directories, because the built bundle is flat
-* while the source is nested, and a fixed `..` count is right for only one of
-* them.
-*/
-function findShippedPolicyDir() {
-	let dir = dirname(fileURLToPath(import.meta.url));
-	for (;;) {
-		if (existsSync(join(dir, "policy", "classifier.md"))) return join(dir, "policy");
-		const parent = dirname(dir);
-		if (parent === dir || dir === parse(dir).root) throw new Error("auto-mode cannot find its shipped policy/ directory");
-		dir = parent;
-	}
-}
-//#endregion
-//#region src/transcript/read-transcript.ts
-const MAX_ENTRY_CHARS = 2e3;
-/**
-* Reads the tail of a harness transcript.
-*
-* Only the tail, and always the same tail for a given session length, so the
-* prompt prefix grows by appending rather than sliding. A sliding window would
-* change the cached prefix on every call and pay full price each time.
-*
-* Every harness writes JSONL but none writes the same schema, so this reads
-* defensively and drops what it cannot understand. A transcript it cannot parse
-* yields no entries, and the classifier then judges the action with no history —
-* which is weaker, not wrong.
-*/
-async function readTranscript(path, limit) {
-	if (path === void 0 || limit <= 0) return [];
-	let text;
-	try {
-		text = await readFile(path, "utf8");
-	} catch {
-		return [];
-	}
-	const entries = [];
-	for (const line of text.split("\n")) {
-		if (line.trim() === "") continue;
-		let parsed;
-		try {
-			parsed = JSON.parse(line);
-		} catch {
-			continue;
-		}
-		const entry = flatten(parsed);
-		if (entry !== null) entries.push(entry);
-	}
-	return entries.slice(-limit);
-}
-function flatten(value) {
-	if (value === null || typeof value !== "object") return null;
-	const row = value;
-	const message = row["message"];
-	const inner = message !== null && typeof message === "object" ? message : row;
-	const role = typeof inner["role"] === "string" ? inner["role"] : typeof row["type"] === "string" ? row["type"] : null;
-	if (role === null) return null;
-	const text = contentToText(inner["content"] ?? row["content"] ?? row["text"]);
-	return text === "" ? null : {
-		role,
-		text: text.slice(0, MAX_ENTRY_CHARS)
-	};
-}
-function contentToText(content) {
-	if (typeof content === "string") return content.trim();
-	if (!Array.isArray(content)) return "";
-	const parts = [];
-	for (const block of content) {
-		if (typeof block === "string") {
-			parts.push(block);
-			continue;
-		}
-		if (block === null || typeof block !== "object") continue;
-		const item = block;
-		if (typeof item["text"] === "string") {
-			parts.push(item["text"]);
-			continue;
-		}
-		if (item["type"] === "tool_use" && typeof item["name"] === "string") parts.push(`[tool ${item["name"]}] ${JSON.stringify(item["input"] ?? {})}`);
-	}
-	return parts.join("\n").trim();
-}
-//#endregion
-//#region src/model/anthropic-client.ts
-async function callModel(provider, apiKey, request) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => controller.abort(), provider.timeoutMs);
-	try {
-		const response = await fetch(`${provider.baseURL.replace(/\/$/, "")}/v1/messages`, {
-			method: "POST",
-			signal: controller.signal,
-			headers: {
-				"content-type": "application/json",
-				"x-api-key": apiKey,
-				"anthropic-version": "2023-06-01"
-			},
-			body: JSON.stringify({
-				model: provider.model,
-				max_tokens: provider.maxTokens,
-				system: [{
-					type: "text",
-					text: request.system,
-					cache_control: { type: "ephemeral" }
-				}],
-				messages: [{
-					role: "user",
-					content: request.user
-				}]
-			})
-		});
-		if (!response.ok) throw new Error(`${response.status} ${(await response.text()).slice(0, 300)}`);
-		return readResult(await response.json());
-	} finally {
-		clearTimeout(timer);
-	}
-}
-function readResult(body) {
-	const root = asObject(body);
-	const content = root["content"];
-	const parts = [];
-	if (Array.isArray(content)) for (const block of content) {
-		const item = asObject(block);
-		if (item["type"] === "text" && typeof item["text"] === "string") parts.push(item["text"]);
-	}
-	const usage = asObject(root["usage"]);
-	return {
-		text: parts.join("\n"),
-		cachedInputTokens: count(usage["cache_read_input_tokens"]),
-		cacheWriteTokens: count(usage["cache_creation_input_tokens"]),
-		newInputTokens: count(usage["input_tokens"]),
-		outputTokens: count(usage["output_tokens"])
-	};
-}
-function asObject(value) {
-	return value !== null && typeof value === "object" ? value : {};
-}
-function count(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : 0;
-}
-//#endregion
-//#region src/model/build-request.ts
-const MAX_INPUT_CHARS = 4e3;
-/**
-* Writes the user turn: the conversation so far, then the action to judge.
-*
-* The action goes last and is labelled, because the policy tells the classifier
-* to judge the most recent action and treat everything before it as context.
-* Anything earlier that looks like an instruction is data, and the policy says
-* so; this only has to make clear which part is which.
-*/
-function buildUserMessage(payload, transcript, reasoning) {
-	const history = transcript.length === 0 ? "(no transcript available from this harness)" : transcript.map((entry) => `${entry.role}: ${entry.text}`).join("\n\n");
-	const input = JSON.stringify(payload.toolInput, null, 2).slice(0, MAX_INPUT_CHARS);
-	const closing = reasoning ? "Work through the classification process, then end your reply with the output contract tags." : "Reply with the output contract tags and nothing else.";
-	return `<transcript>
-${history}
-</transcript>
-
-<action>
-tool: ${payload.toolName}
-cwd: ${payload.cwd}
-input:
-${input}
-</action>
-
-${closing}`;
-}
-//#endregion
-//#region src/model/parse-verdict.ts
-const BLOCK = /<block>\s*(yes|no)\s*<\/block>/i;
-const RULE = /<rule>([^<]*)<\/rule>/i;
-const REASON = /<reason>([^<]*)<\/reason>/i;
-/**
-* Reads the classifier's answer.
-*
-* Every ambiguity resolves to allow, on the policy's own reasoning: a block
-* nobody can name is a false positive, and a false positive costs more than the
-* action it stopped. A model that says `yes` but names no rule has not made a
-* case, so there is nothing to show the user and nothing to appeal.
-*/
-function parseModelVerdict(text) {
-	const block = BLOCK.exec(text);
-	if (block === null || block[1]?.toLowerCase() !== "yes") return { kind: "allow" };
-	const rule = RULE.exec(text)?.[1]?.trim();
-	if (rule === void 0 || rule === "") return { kind: "allow" };
-	const stripped = (REASON.exec(text)?.[1]?.trim())?.replace(/^\[[^\]]*\]\s*/, "") ?? "";
-	return {
-		kind: "deny",
-		rule,
-		reason: stripped === "" ? "the policy blocks this action." : stripped
-	};
-}
-//#endregion
-//#region src/model/classify-with-model.ts
-/**
-* Asks the model. A null verdict means auto-mode has no opinion, and the caller
-* writes nothing so the harness decides for itself.
-*/
-async function classifyWithModel(payload, config) {
-	const apiKey = await resolveApiKey(config.provider);
-	if (apiKey === null) return failure(config, "no API key: set the configured environment variable or key command");
-	let system;
-	try {
-		system = await loadPolicy({
-			...config.classifierPath === void 0 ? {} : { classifierPath: config.classifierPath },
-			...config.rulesPath === void 0 ? {} : { rulesPath: config.rulesPath }
-		});
-	} catch (error) {
-		return failure(config, `policy unreadable: ${error.message}`);
-	}
-	const user = buildUserMessage(payload, await readTranscript(payload.transcriptPath, config.transcriptEntries), config.provider.reasoning);
-	try {
-		const result = await callModel(config.provider, apiKey, {
-			system,
-			user
-		});
-		if (result.text.trim() === "") return failure(config, `${config.provider.model} returned no text; raise maxTokens`);
-		const verdict = parseModelVerdict(result.text);
-		const cache = `${result.cachedInputTokens} cached / ${result.cacheWriteTokens} written / ${result.newInputTokens} new / ${result.outputTokens} out`;
-		return {
-			verdict,
-			note: verdict.kind === "deny" ? `${config.provider.model} blocked it: [${verdict.rule}] ${verdict.reason} (${cache})` : `${config.provider.model} allowed it (${cache})`
-		};
-	} catch (error) {
-		const message = error.name === "AbortError" ? `timed out after ${config.provider.timeoutMs}ms` : error.message;
-		return failure(config, `${config.provider.model} failed: ${message}`);
-	}
-}
-function failure(config, note) {
-	if (config.onFailure === "deny") return {
-		verdict: {
-			kind: "deny",
-			rule: "Classifier Unavailable",
-			reason: `${note}; this policy is configured to fail closed.`
-		},
-		note
-	};
-	return {
-		verdict: null,
-		note: `${note}; deferring to the harness`
-	};
-}
-//#endregion
-//#region src/rules/local-allowlists.ts
-/**
-* Tools whose documented effect is to read. Names differ by harness, so this
-* set holds every spelling the three use.
-*/
-const READ_ONLY_TOOLS = /* @__PURE__ */ new Set([
-	"Read",
-	"Glob",
-	"Grep",
-	"LS",
-	"NotebookRead",
-	"WebFetch",
-	"WebSearch",
-	"TodoWrite",
-	"read",
-	"glob",
-	"grep",
-	"list_dir",
-	"read_file",
-	"file_search",
-	"view_image"
-]);
-/** Tools that carry a shell command and so need the command read instead. */
-const SHELL_TOOLS = /* @__PURE__ */ new Set([
-	"Bash",
-	"bash",
-	"shell",
-	"run_command",
-	"local_shell"
-]);
-/**
-* Commands that only print. A command outside this set is not assumed to
-* write — it is simply not decided here, and goes to the model.
-*/
-const READ_ONLY_COMMANDS = /* @__PURE__ */ new Set([
-	"awk",
-	"basename",
-	"cat",
-	"cksum",
-	"column",
-	"comm",
-	"cut",
-	"date",
-	"df",
-	"diff",
-	"dirname",
-	"du",
-	"echo",
-	"env",
-	"false",
-	"fd",
-	"file",
-	"find",
-	"grep",
-	"head",
-	"hostname",
-	"id",
-	"jq",
-	"less",
-	"ls",
-	"md5sum",
-	"nl",
-	"od",
-	"printenv",
-	"printf",
-	"ps",
-	"pwd",
-	"readlink",
-	"realpath",
-	"rg",
-	"sha1sum",
-	"sha256sum",
-	"sort",
-	"stat",
-	"tail",
-	"tr",
-	"true",
-	"type",
-	"uname",
-	"uniq",
-	"uptime",
-	"wc",
-	"which",
-	"whoami",
-	"xxd",
-	"yq"
-]);
-/** `git` subcommands that only report. */
-const READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set([
-	"blame",
-	"describe",
-	"diff",
-	"log",
-	"ls-files",
-	"ls-remote",
-	"ls-tree",
-	"rev-list",
-	"rev-parse",
-	"shortlog",
-	"show",
-	"show-ref",
-	"status",
-	"tag",
-	"whatchanged"
-]);
-/**
-* Directory names a build reproduces. Deleting one of these inside the working
-* tree is the Regenerable output exception, which is the single most common
-* thing a classifier gets wrong.
-*/
-const REGENERABLE_DIRS = /* @__PURE__ */ new Set([
-	".gradle",
-	".next",
-	".nuxt",
-	".parcel-cache",
-	".pytest_cache",
-	".turbo",
-	".venv",
-	"__pycache__",
-	"build",
-	"coverage",
-	"dist",
-	"node_modules",
-	"out",
-	"target",
-	"venv"
-]);
-//#endregion
-//#region src/rules/split-shell-command.ts
-/**
-* Splits a shell command on the operators that chain separate commands, so each
-* one can be judged on its own. Quoted text is left alone: `echo "a && b"` is
-* one command, not two.
-*
-* This is deliberately not a shell parser. It recognises enough to decide
-* whether every part of a command is plainly read-only; anything it cannot
-* account for is reported through `hasUnparsedConstruct`, and the caller then
-* declines to judge locally rather than guessing.
-*/
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const push = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
-	};
-	while (i < command.length) {
-		const ch = command[i];
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			push();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			push();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
-	}
-	push();
-	return {
-		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
-	};
-}
-//#endregion
-//#region src/rules/classify-locally.ts
-const ESCALATE = { kind: "escalate" };
-function classifyLocally(payload) {
-	if (READ_ONLY_TOOLS.has(payload.toolName)) return {
-		kind: "allow",
-		exception: "Read-only actions"
-	};
-	if (!SHELL_TOOLS.has(payload.toolName)) return ESCALATE;
-	const command = payload.toolInput["command"];
-	if (typeof command !== "string" || command === "") return ESCALATE;
-	const { segments, hasUnparsedConstruct } = splitShellCommand(command);
-	if (hasUnparsedConstruct || segments.length === 0) return ESCALATE;
-	let exception = "Read-only actions";
-	for (const segment of segments) {
-		const verdict = classifySegment(segment.text, payload.cwd);
-		if (verdict === null) return ESCALATE;
-		if (verdict !== "Read-only actions") exception = verdict;
-	}
-	return {
-		kind: "allow",
-		exception
-	};
-}
-/** Names the exception covering one command, or null to send it to the model. */
-function classifySegment(text, cwd) {
-	const words = tokenize(text);
-	const start = words.findIndex((word) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word));
-	if (start === -1) return "Read-only actions";
-	const head = words[start];
-	const rest = words.slice(start + 1);
-	const name = head.includes("/") ? head.split("/").pop() : head;
-	if (READ_ONLY_COMMANDS.has(name)) return "Read-only actions";
-	if (name === "git") {
-		const sub = rest.find((word) => !word.startsWith("-"));
-		return sub !== void 0 && READ_ONLY_GIT_SUBCOMMANDS.has(sub) ? "Read-only actions" : null;
-	}
-	if (name === "rm") return classifyRemove(rest, cwd);
-	return null;
-}
-/**
-* Allows a delete only when every path it names is a regenerable directory
-* inside the working tree. A single unrecognised path sends the whole command
-* to the model, because `rm` takes many and one of them may not be scratch.
-*/
-function classifyRemove(args, cwd) {
-	const paths = args.filter((arg) => !arg.startsWith("-"));
-	if (paths.length === 0) return null;
-	for (const path of paths) {
-		const stripped = stripQuotes(path);
-		if (stripped.includes("*") || stripped.includes("~") || stripped.includes("$")) return null;
-		const resolved = isAbsolute(stripped) ? normalize(stripped) : normalize(`${cwd}/${stripped}`);
-		const within = relative(cwd, resolved);
-		if (within === "" || within.startsWith("..") || isAbsolute(within)) return null;
-		const last = within.split(/[\\/]/).filter((s) => s !== "").at(-1);
-		if (last === void 0 || !REGENERABLE_DIRS.has(last)) return null;
-	}
-	return "Regenerable output";
-}
-function tokenize(text) {
-	return text.split(/\s+/).filter((word) => word !== "");
-}
-function stripQuotes(word) {
-	const first = word[0];
-	return (first === "'" || first === "\"") && word.at(-1) === first ? word.slice(1, -1) : word;
-}
-//#endregion
-export { loadPolicy as a, hookConfig as c, detectHarness as d, DEFAULT_CONFIG as f, resolveApiKey as g, loadConfig as h, readTranscript as i, renderVerdict as l, configPath as m, classifyWithModel as n, SETTINGS_PATHS as o, PRESETS as p, parseModelVerdict as r, SETUP_NOTES as s, classifyLocally as t, parsePayload as u };