auto-mode 0.14.0 → 0.16.0

package/README.md

@@ -58,10 +58,10 @@ assessment.
 
 ## Decisions and failures
 
-Jev evaluates each named rule with a typed choice. auto-mode returns a denial for a confident block,
-approval when every rule confidently allows the action, and a denial for uncertain decisions. Every
-denial names its rule, the harm, and what clears it, and the agent continues on another path. The
-confidence threshold is configurable and needs evaluation against your actions.
+Jev evaluates each named rule with a typed choice between allow and block. auto-mode allows the
+action unless some rule's block probability reaches the threshold, 0.2 by default. Every denial
+names the rule with the highest block probability, the harm, and what clears it, and the agent
+continues on another path. The threshold is configurable and needs evaluation against your actions.
 
 A missing key, failed API call, malformed response, or oversized request follows
 `decision.onFailure`. The default `defer` writes no verdict and keeps the prompt; `deny` fails

package/dist/{classify-edit-D8GC6b91.js → classify-edit-LpoeenGt.js}

@@ -17717,6 +17717,9 @@ function getRE2(pattern) {
 	compiledRE2.set(pattern, compiled);
 	return compiled;
 }
+//#endregion
+//#region src/bypass/classify-edit.ts
+const MAX_SCANNED_BYTES = 262144;
 function classifyEdit(action, scope) {
 	const fields = getEditFields(action.toolName);
 	if (fields === null) return {
@@ -17747,7 +17750,7 @@ function classifyEdit(action, scope) {
 		kind: "jev",
 		reason: text.reason
 	};
-	if (Buffer.byteLength(text, "utf8") > 262144) return {
+	if (Buffer.byteLength(text, "utf8") > MAX_SCANNED_BYTES) return {
 		kind: "jev",
 		reason: "content larger than the secret scan reads"
 	};

package/dist/cli.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
-import { D as string, E as strictObject, T as number, _ as splitCommandWords, a as resolveSessionScopePath, b as DEFAULT_SCOPE_SOURCES, c as findCheckout, f as loadRepositoryContext, g as splitShellCommand, h as toRepositorySlug, i as resolveStateDir, m as loadPolicy, n as parseActionRequest, o as loadSessionScope, p as loadCheckoutRemotes, r as classifyAction, s as EMPTY_SESSION_SCOPE, t as renderVerdict, x as loadConfig, y as DEFAULT_DENIAL_BUDGET } from "./render-verdict-QLyj-g7d.js";
+import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-u3_ftSEp.js";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, normalize } from "node:path";
-import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
@@ -120,10 +119,10 @@ function formatDenialsLeft(left) {
 }
 //#endregion
 //#region src/budget/resolve-denial-state-path.ts
-function resolveDenialStatePath(request) {
+function resolveDenialStatePath(request, stateDir) {
 	const agentID = request.decisionContext?.agentID ?? "";
 	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
-	return join(resolveStateDir(), "denials", `${key}.json`);
+	return join(stateDir, "denials", `${key}.json`);
 }
 //#endregion
 //#region src/budget/write-denial-state.ts
@@ -150,8 +149,8 @@ function buildJevOnlyConfig(config) {
 }
 //#endregion
 //#region src/diagnostics/write-action-diagnostic.ts
-async function writeActionDiagnostic(payload, entry) {
-	const path = process.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(), "actions.jsonl");
+async function writeActionDiagnostic(payload, entry, host, warnings) {
+	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(host), "actions.jsonl");
 	if (path === "") return;
 	const record = {
 		schemaVersion: 3,
@@ -173,29 +172,32 @@ async function writeActionDiagnostic(payload, entry) {
 		});
 		await appendFile(path, `${JSON.stringify(record)}\n`, { mode: 384 });
 	} catch {
-		process.stderr.write("auto-mode: diagnostics unavailable\n");
+		warnings.write("auto-mode: diagnostics unavailable\n");
 	}
 }
 function toHash(value) {
 	return createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
 //#endregion
-//#region src/request/parse-scope-record-request.ts
-const recordSchema = strictObject({
+//#region src/request/scope-record-request-schema.ts
+const scopeRecordRequestSchema = strictObject({
 	sessionID: string().min(1),
 	cwd: string().min(1),
 	startedAt: number().int().positive(),
 	command: string().min(1),
 	resultText: string()
 });
+//#endregion
+//#region src/request/parse-scope-record-request.ts
 function parseScopeRecordRequest(body) {
-	const parsed = recordSchema.safeParse(body);
+	const parsed = scopeRecordRequestSchema.safeParse(body);
 	return parsed.success ? parsed.data : null;
 }
 //#endregion
 //#region src/scope/read-pull-request.ts
 const LOOKUP_TIMEOUT_MS = 5e3;
-function readPullRequest(repository, number) {
+function readPullRequest(repository, number, options = {}) {
+	const [file, ...prefix] = options.command ?? ["gh"];
 	const args = [
 		"pr",
 		"view",
@@ -206,7 +208,8 @@ function readPullRequest(repository, number) {
 		"headRefName,createdAt"
 	];
 	return new Promise((resolve) => {
-		const child = spawn("gh", [
+		const child = spawn(file, [
+			...prefix,
 			...args,
 			"--jq",
 			"[.headRefName, .createdAt] | @tsv"
@@ -216,7 +219,7 @@ function readPullRequest(repository, number) {
 				"pipe",
 				"ignore"
 			],
-			timeout: LOOKUP_TIMEOUT_MS
+			timeout: options.timeoutMs ?? LOOKUP_TIMEOUT_MS
 		});
 		let output = "";
 		child.stdout.setEncoding("utf8");
@@ -365,13 +368,17 @@ async function readBranchCreatedAt(commonDir, branch) {
 }
 //#endregion
 //#region src/scope/write-session-scope.ts
-async function writeSessionScope(path, added) {
+const SYSTEM_CLOCK = {
+	now: Date.now,
+	wait: (ms) => setTimeout(ms)
+};
+async function writeSessionScope(path, added, clock = SYSTEM_CLOCK) {
 	await mkdir(dirname(path), {
 		recursive: true,
 		mode: 448
 	});
 	const lock = `${path}.lock`;
-	await claimLock(lock);
+	await claimLock(lock, clock);
 	try {
 		const merged = mergeSessionScope([await loadSessionScope(path), added]);
 		const staged = `${path}.${randomUUID()}.tmp`;
@@ -384,8 +391,8 @@ async function writeSessionScope(path, added) {
 const STALE_LOCK_MS = 1e4;
 const LOCK_WAIT_MS = 3e3;
 const LOCK_POLL_MS = 10;
-async function claimLock(lock) {
-	const deadline = Date.now() + LOCK_WAIT_MS;
+async function claimLock(lock, clock) {
+	const deadline = clock.now() + LOCK_WAIT_MS;
 	for (;;) {
 		try {
 			await (await open(lock, "wx", 384)).close();
@@ -394,9 +401,9 @@ async function claimLock(lock) {
 			if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
 		}
 		const held = await stat(lock).catch(() => null);
-		if (held !== null && Date.now() - held.mtimeMs > STALE_LOCK_MS) await rm(lock, { force: true });
-		else if (Date.now() > deadline) throw new Error("session scope lock unavailable");
-		else await setTimeout(LOCK_POLL_MS);
+		if (held !== null && clock.now() - held.mtimeMs > STALE_LOCK_MS) await rm(lock, { force: true });
+		else if (clock.now() > deadline) throw new Error("session scope lock unavailable");
+		else await clock.wait(LOCK_POLL_MS);
 	}
 }
 //#endregion
@@ -407,12 +414,12 @@ async function updateSessionScope(request, options) {
 	if (age < -6e4 || age > MAX_CALL_AGE_MS) return EMPTY_SESSION_SCOPE;
 	const events = collectScopeEvents(request.command, request.cwd, options.home);
 	const scope = mergeSessionScope(await Promise.all(events.map((event) => tryVerifyScopeEvent(event, request, options))));
-	if (scope.worktrees.length + scope.branches.length + scope.pullRequests.length > 0) await writeSessionScope(resolveSessionScopePath(options.stateDir, request.sessionID), scope);
+	if (scope.worktrees.length + scope.branches.length + scope.pullRequests.length > 0) await writeSessionScope(resolveSessionScopePath(options.stateDir, request.sessionID), scope, options.lockClock);
 	return scope;
 }
 async function tryVerifyScopeEvent(event, request, options) {
 	try {
-		return await verifyScopeEvent(event, request, options);
+		return await (options.verifyEvent === void 0 ? verifyScopeEvent(event, request, options) : options.verifyEvent(event, request));
 	} catch {
 		return EMPTY_SESSION_SCOPE;
 	}
@@ -422,9 +429,9 @@ const FILE_CLOCK_SLACK_MS = 50;
 async function verifyScopeEvent(event, request, options) {
 	if (event.kind === "worktree") {
 		const link = await stat(join(event.path, ".git"));
-		const checkout = await findCheckout(event.path);
+		const checkout = await findCheckout(event.path, options.env);
 		if (!link.isFile() || link.mtimeMs < request.startedAt - FILE_CLOCK_SLACK_MS || checkout?.worktree !== event.path) return EMPTY_SESSION_SCOPE;
-		const branch = (await loadRepositoryContext(event.path))?.branch ?? null;
+		const branch = (await loadRepositoryContext(event.path, options.env))?.branch ?? null;
 		if (branch === null) return {
 			...EMPTY_SESSION_SCOPE,
 			worktrees: [event.path]
@@ -439,7 +446,7 @@ async function verifyScopeEvent(event, request, options) {
 			}] : []
 		};
 	}
-	const checkout = await findCheckout(event.directory);
+	const checkout = await findCheckout(event.directory, options.env);
 	if (checkout === null) return EMPTY_SESSION_SCOPE;
 	if (event.kind === "branch") return await isBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
 		...EMPTY_SESSION_SCOPE,
@@ -470,7 +477,7 @@ async function isBranchCreatedSince(commonDir, branch, since) {
 	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
 }
 //#endregion
-//#region src/cli.ts
+//#region src/run-cli.ts
 const USAGE = `auto-mode — a permission classifier for the auto-mode Claude Code mod
 
 Usage:
@@ -486,44 +493,85 @@ Options:
   --jev-only            With run: require Jev and cap its API timeout at 5 seconds
   --evaluation-deadline <unix-ms>  With --jev-only: share the helper and API deadline
 `;
-function readStdin() {
-	return text(process.stdin);
+async function runCLI(argv, io) {
+	const args = parseArgs({
+		args: [...argv],
+		allowPositionals: true,
+		options: {
+			classifier: { type: "string" },
+			rules: { type: "string" },
+			explain: { type: "boolean" },
+			"local-only": { type: "boolean" },
+			"jev-only": { type: "boolean" },
+			"evaluation-deadline": { type: "string" },
+			help: {
+				type: "boolean",
+				short: "h"
+			}
+		}
+	});
+	const [command] = args.positionals;
+	if (args.values.help === true || command === void 0) {
+		io.stdout.write(USAGE);
+		return 0;
+	}
+	if (command === "run") try {
+		return await run(io, args.values.explain === true, args.values["local-only"] === true, args.values["jev-only"] === true, args.values["evaluation-deadline"]);
+	} catch {
+		io.stderr.write("auto-mode: configuration unreadable; no verdict\n");
+		return 0;
+	}
+	if (command === "record") return runRecord(io);
+	if (command === "print-prompt") {
+		const config = await loadConfig(void 0, io.host);
+		printWarnings(io.stderr, config.warnings);
+		const framework = config.provider.protocol === "system-one" ? "decision.md" : "classifier.md";
+		const prompt = await loadPolicy({
+			classifierPath: args.values.classifier ?? config.classifierPath,
+			rulesPath: args.values.rules ?? config.rulesPath
+		}, framework);
+		io.stdout.write(`${prompt}\n`);
+		return 0;
+	}
+	io.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
+	return 2;
 }
-async function run(explain, localOnly, jevOnly, deadline) {
-	const raw = await readStdin();
+async function run(io, explain, localOnly, jevOnly, deadline) {
+	const raw = await io.stdin();
 	let body;
 	try {
 		body = JSON.parse(raw);
 	} catch {
-		return printNote(explain, "stdin is not JSON, so no verdict");
+		return printNote(io.stderr, explain, "stdin is not JSON, so no verdict");
 	}
 	const request = parseActionRequest(body);
-	if (request === null) return printNote(explain, "not an action request this classifier judges, so no verdict");
+	if (request === null) return printNote(io.stderr, explain, "not an action request this classifier judges, so no verdict");
+	const host = io.host;
 	const invocationID = randomUUID();
 	await writeActionDiagnostic(request, {
 		invocationID,
 		status: "started"
-	});
+	}, host, io.stderr);
 	let loaded;
 	try {
-		loaded = await loadConfig();
+		loaded = await loadConfig(void 0, host);
 	} catch {
 		await writeActionDiagnostic(request, {
 			invocationID,
 			status: "failure",
 			verdict: "defer"
-		});
-		return printNote(true, "configuration unreadable; no verdict");
+		}, host, io.stderr);
+		return printNote(io.stderr, true, "configuration unreadable; no verdict");
 	}
-	printWarnings(loaded.warnings);
+	printWarnings(io.stderr, loaded.warnings);
 	const config = jevOnly ? buildJevOnlyConfig(loaded) : loaded;
 	if (config === null) {
 		await writeActionDiagnostic(request, {
 			invocationID,
 			status: "failure",
 			verdict: "defer"
-		});
-		return printNote(true, "Jev-only evaluation requires system-one; no verdict");
+		}, host, io.stderr);
+		return printNote(io.stderr, true, "Jev-only evaluation requires system-one; no verdict");
 	}
 	const deadlineAt = deadline === void 0 ? void 0 : Number(deadline);
 	if (deadlineAt !== void 0 && (!jevOnly || !Number.isSafeInteger(deadlineAt) || deadlineAt <= 0)) {
@@ -531,26 +579,24 @@ async function run(explain, localOnly, jevOnly, deadline) {
 			invocationID,
 			status: "failure",
 			verdict: "defer"
-		});
-		return printNote(true, "invalid Jev evaluation deadline; no verdict");
+		}, host, io.stderr);
+		return printNote(io.stderr, true, "invalid Jev evaluation deadline; no verdict");
 	}
 	const controller = new AbortController();
-	const stopEvaluation = () => {
+	const unsubscribe = jevOnly ? io.subscribeToStopSignals(() => {
 		controller.abort();
-	};
-	if (jevOnly) {
-		process.on("SIGTERM", stopEvaluation);
-		process.on("SIGINT", stopEvaluation);
-	}
+	}) : null;
 	try {
-		const statePath = resolveDenialStatePath(request);
+		const statePath = resolveDenialStatePath(request, resolveStateDir(host));
 		const retryKey = buildRetryKey(request);
 		const before = await loadDenialState(statePath);
 		const retry = findRetryDeny(before, retryKey);
 		const outcome = retry === null ? await classifyAction(request, config, {
 			localOnly,
 			deadlineAt,
-			signal: controller.signal
+			signal: controller.signal,
+			host,
+			stderr: io.stderr
 		}) : {
 			verdict: retry,
 			decidingStage: "retry",
@@ -559,8 +605,8 @@ async function run(explain, localOnly, jevOnly, deadline) {
 		};
 		const latest = retry === null ? await loadDenialState(statePath) : before;
 		const plan = planDenialBudget(latest, outcome.verdict, retryKey, config.denialBudget ?? DEFAULT_DENIAL_BUDGET);
-		if (plan.state !== latest) await tryWriteDenialState(statePath, plan.state);
-		if (plan.verdict !== null) writeVerdict(plan.verdict);
+		if (plan.state !== latest) await tryWriteDenialState(io.stderr, statePath, plan.state);
+		if (plan.verdict !== null) printVerdict(io.stdout, plan.verdict);
 		await writeActionDiagnostic(request, {
 			invocationID,
 			status: outcome.status,
@@ -572,16 +618,32 @@ async function run(explain, localOnly, jevOnly, deadline) {
 			},
 			escalation: plan.escalation,
 			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics }
-		});
+		}, host, io.stderr);
 		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
-		return printNote(explain || outcome.unavailable === true, note);
+		return printNote(io.stderr, explain || outcome.unavailable === true, note);
 	} finally {
-		process.off("SIGTERM", stopEvaluation);
-		process.off("SIGINT", stopEvaluation);
+		unsubscribe?.();
+	}
+}
+function printNote(stderr, explain, message) {
+	if (explain) stderr.write(`auto-mode: ${message}\n`);
+	return 0;
+}
+function printWarnings(stderr, warnings = []) {
+	for (const warning of warnings) stderr.write(`auto-mode: ${warning}\n`);
+}
+async function tryWriteDenialState(stderr, path, state) {
+	try {
+		await writeDenialState(path, state);
+	} catch {
+		stderr.write("auto-mode: denial counts unavailable\n");
 	}
 }
-async function runRecord() {
-	const raw = await readStdin();
+function printVerdict(stdout, verdict) {
+	stdout.write(renderVerdict(verdict));
+}
+async function runRecord(io) {
+	const raw = await io.stdin();
 	let body;
 	try {
 		body = JSON.parse(raw);
@@ -591,78 +653,34 @@ async function runRecord() {
 	const request = parseScopeRecordRequest(body);
 	if (request === null) return 0;
 	try {
-		const config = await loadConfig();
+		const config = await loadConfig(void 0, io.host);
 		if (Object.values(config.scopeSources ?? DEFAULT_SCOPE_SOURCES).some((source) => source.kind === "session")) await updateSessionScope(request, {
 			now: Date.now(),
-			stateDir: resolveStateDir(),
-			home: homedir(),
+			stateDir: resolveStateDir(io.host),
+			home: io.host.home,
+			env: io.host.env,
 			readPullRequest
 		});
 	} catch {
-		process.stderr.write("auto-mode: session scope unavailable\n");
+		io.stderr.write("auto-mode: session scope unavailable\n");
 	}
 	return 0;
 }
-async function tryWriteDenialState(path, state) {
-	try {
-		await writeDenialState(path, state);
-	} catch {
-		process.stderr.write("auto-mode: denial counts unavailable\n");
-	}
-}
-function writeVerdict(verdict) {
-	process.stdout.write(renderVerdict(verdict));
-}
-function printWarnings(warnings = []) {
-	for (const warning of warnings) process.stderr.write(`auto-mode: ${warning}\n`);
-}
-function printNote(explain, message) {
-	if (explain) process.stderr.write(`auto-mode: ${message}\n`);
-	return 0;
-}
-async function main(argv) {
-	const args = parseArgs({
-		args: [...argv],
-		allowPositionals: true,
-		options: {
-			classifier: { type: "string" },
-			rules: { type: "string" },
-			explain: { type: "boolean" },
-			"local-only": { type: "boolean" },
-			"jev-only": { type: "boolean" },
-			"evaluation-deadline": { type: "string" },
-			help: {
-				type: "boolean",
-				short: "h"
-			}
-		}
-	});
-	const [command] = args.positionals;
-	if (args.values.help === true || command === void 0) {
-		process.stdout.write(USAGE);
-		return 0;
-	}
-	if (command === "run") try {
-		return await run(args.values.explain === true, args.values["local-only"] === true, args.values["jev-only"] === true, args.values["evaluation-deadline"]);
-	} catch {
-		process.stderr.write("auto-mode: configuration unreadable; no verdict\n");
-		return 0;
-	}
-	if (command === "record") return runRecord();
-	if (command === "print-prompt") {
-		const config = await loadConfig();
-		printWarnings(config.warnings);
-		const framework = config.provider.protocol === "system-one" ? "decision.md" : "classifier.md";
-		const prompt = await loadPolicy({
-			classifierPath: args.values.classifier ?? config.classifierPath,
-			rulesPath: args.values.rules ?? config.rulesPath
-		}, framework);
-		process.stdout.write(`${prompt}\n`);
-		return 0;
+//#endregion
+//#region src/cli.ts
+process.exitCode = await runCLI(process.argv.slice(2), {
+	stdin: () => text(process.stdin),
+	stdout: process.stdout,
+	stderr: process.stderr,
+	host: readHostEnvironment(),
+	subscribeToStopSignals: (onStop) => {
+		process.on("SIGTERM", onStop);
+		process.on("SIGINT", onStop);
+		return () => {
+			process.off("SIGTERM", onStop);
+			process.off("SIGINT", onStop);
+		};
 	}
-	process.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
-	return 2;
-}
-process.exitCode = await main(process.argv.slice(2));
+});
 //#endregion
 export {};