auto-mode 0.17.0 → 0.18.0

package/README.md

@@ -96,7 +96,8 @@ if (request !== null) {
 
 `classifyAction` runs both tiers and returns the verdict, a note, and diagnostics. A request carries
 the session identity, the action, and the task context; `parseActionRequest` builds one from the
-mod's JSON.
+mod's JSON. Build every request with `parseActionRequest`: it drops a child agent's direct user
+message, and the classifiers trust the request they receive.
 
 ## Documentation
 

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-Bx9Lw7gO.js";
+import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-lM31QV2u.js";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -274,6 +274,22 @@ function parseScopeRecordRequest(body) {
 	return parsed.success ? parsed.data : null;
 }
 //#endregion
+//#region src/request/to-mod-request.ts
+function toModRequest(request) {
+	const context = request.decisionContext;
+	return {
+		sessionID: request.sessionID,
+		...request.toolUseID === void 0 ? {} : { toolUseID: request.toolUseID },
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: request.toolInput,
+		context: {
+			...context,
+			omittedTaskContext: [...context.omittedTaskContext]
+		}
+	};
+}
+//#endregion
 //#region src/scope/read-pull-request.ts
 const LOOKUP_TIMEOUT_MS = 5e3;
 function readPullRequest(repository, number, options = {}) {
@@ -335,6 +351,17 @@ function collectPullRequestAddresses(text) {
 }
 const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
 //#endregion
+//#region mods/auto-mode/contract/scope-commands.ts
+const SCOPE_COMMANDS = {
+	git: [
+		"worktree add",
+		"checkout",
+		"switch",
+		"branch"
+	],
+	gh: ["pr create"]
+};
+//#endregion
 //#region src/scope/collect-scope-events.ts
 function collectScopeEvents(command, cwd, home) {
 	const events = [];
@@ -344,7 +371,7 @@ function collectScopeEvents(command, cwd, home) {
 		const [name, ...args] = splitCommandWords(segment.text);
 		if (name === "cd") directory = hasPipe ? null : resolvePath(directory, args[0] ?? home, home);
 		else if (name === "git" && directory !== null) events.push(...collectGitEvents(args, directory, home));
-		else if (name === "gh" && directory !== null && args[0] === "pr" && args[1] === "create") events.push({
+		else if (name === "gh" && directory !== null && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null) events.push({
 			kind: "pull-request",
 			directory,
 			head: findOptionValue(args, ["--head", "-H"])
@@ -352,15 +379,6 @@ function collectScopeEvents(command, cwd, home) {
 	}
 	return events;
 }
-const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"-c",
-	"-C",
-	"--create",
-	"--force-create"
-]);
-const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
 function collectGitEvents(args, cwd, home) {
 	let directory = cwd;
 	let index = 0;
@@ -368,34 +386,33 @@ function collectGitEvents(args, cwd, home) {
 		if (args[index] === "-C") directory = resolvePath(directory, args[index + 1] ?? "", home);
 		index += args[index] === "-C" || args[index] === "-c" ? 2 : 1;
 	}
-	const subcommand = args[index];
-	const rest = args.slice(index + 1);
-	if (directory === null) return [];
-	if (subcommand === "worktree" && rest[0] === "add") {
-		const path = findWorktreePath(rest.slice(1));
-		const resolved = path === null ? null : resolvePath(directory, path, home);
-		return resolved === null ? [] : [{
-			kind: "worktree",
-			path: resolved
-		}];
-	}
-	if (subcommand === "checkout" || subcommand === "switch") {
-		const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
-		return name === null ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
-	}
-	if (subcommand === "branch" && !rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) {
-		const name = rest.find((word) => !word.startsWith("-"));
-		return name === void 0 || isUnresolved(name) ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
+	const found = findScopeCommand(SCOPE_COMMANDS.git, args.slice(index));
+	if (directory === null || found === null) return [];
+	return GIT_EVENT_COLLECTORS[found.command](found.rest, directory, home);
+}
+function findScopeCommand(commands, args) {
+	for (const command of commands) {
+		const words = command.split(" ");
+		if (words.every((word, index) => args[index] === word)) return {
+			command,
+			rest: args.slice(words.length)
+		};
 	}
-	return [];
+	return null;
+}
+const GIT_EVENT_COLLECTORS = {
+	"worktree add": collectWorktreeEvents,
+	checkout: collectSwitchEvents,
+	switch: collectSwitchEvents,
+	branch: collectBranchEvents
+};
+function collectWorktreeEvents(rest, directory, home) {
+	const path = findWorktreePath(rest);
+	const resolved = path === null ? null : resolvePath(directory, path, home);
+	return resolved === null ? [] : [{
+		kind: "worktree",
+		path: resolved
+	}];
 }
 const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"-b",
@@ -410,6 +427,32 @@ function findWorktreePath(args) {
 	}
 	return null;
 }
+const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-B",
+	"-c",
+	"-C",
+	"--create",
+	"--force-create"
+]);
+const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
+function collectSwitchEvents(rest, directory) {
+	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
+	return name === null ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
+function collectBranchEvents(rest, directory) {
+	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
+	const name = rest.find((word) => !word.startsWith("-"));
+	return name === void 0 || isUnresolved(name) ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
 function findOptionValue(args, options) {
 	const index = args.findIndex((word) => options.includes(word));
 	const value = index === -1 ? void 0 : args[index + 1];
@@ -704,7 +747,7 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 			const captured = await tryWriteRequestCapture(resolveCaptureDir(config.capture, host), {
 				schemaVersion: 1,
 				time: (/* @__PURE__ */ new Date()).toISOString(),
-				request: body,
+				request: toModRequest(request),
 				verdict: plan.verdict,
 				decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
 				escalation: plan.escalation

package/dist/index.d.ts

@@ -1,32 +1,48 @@
-//#region src/request/types.d.ts
+//#region mods/auto-mode/contract/message-origins.d.ts
+declare const MESSAGE_ORIGINS: readonly ['composer', 'bridge', 'sdk'];
+//#endregion
+//#region mods/auto-mode/contract/types.d.ts
+type MessageOrigin = (typeof MESSAGE_ORIGINS)[number];
 interface UserTask {
   readonly text: string;
-  readonly origin: 'composer' | 'bridge' | 'sdk';
+  readonly origin: MessageOrigin;
 }
 interface DirectUserMessage extends UserTask {
   readonly freshness?: 'stale' | undefined;
 }
-interface DecisionContext {
+interface DelegatedTask {
+  readonly text: string;
+  readonly origin: 'agent.spawn';
+}
+interface TaskOmission {
+  readonly field: 'originalUserTask' | 'delegatedTask';
+  readonly reason: 'unavailable' | 'budget';
+}
+interface ModContext {
   readonly agentID: string | null;
   readonly originalUserTask: UserTask | null;
-  readonly delegatedTask: {
-    readonly text: string;
-    readonly origin: 'agent.spawn';
-  } | null;
+  readonly delegatedTask: DelegatedTask | null;
   readonly lastDirectUserMessage: DirectUserMessage | null;
-  readonly omittedTaskContext: readonly {
-    readonly field: 'originalUserTask' | 'delegatedTask';
-    readonly reason: 'unavailable' | 'budget';
-  }[];
+  readonly omittedTaskContext: TaskOmission[];
 }
-interface ActionRequest {
+interface ModRequest {
   readonly sessionID: string;
   readonly toolUseID?: string | undefined;
   readonly cwd: string;
   readonly toolName: string;
   readonly toolInput: Readonly<Record<string, unknown>>;
-  readonly decisionContext?: DecisionContext | undefined;
+  readonly context: ModContext;
 }
+//#endregion
+//#region src/request/types.d.ts
+type DeepReadonly<T> = T extends readonly (infer Item)[] ? readonly DeepReadonly<Item>[] : T extends object ? { readonly [Key in keyof T]: DeepReadonly<T[Key]>; } : T;
+type DecisionContext = DeepReadonly<ModContext>;
+type ActionRequest = DeepReadonly<Omit<ModRequest, 'context'>> & {
+  readonly decisionContext?: DecisionContext | undefined;
+};
+type ParsedActionRequest = ActionRequest & {
+  readonly decisionContext: DecisionContext;
+};
 type Verdict = {
   readonly kind: 'allow';
 } | {
@@ -349,7 +365,7 @@ interface PolicyPaths {
 export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md' | 'judge.md'): Promise<string>;
 //#endregion
 //#region src/request/parse-action-request.d.ts
-export declare function parseActionRequest(body: unknown): ActionRequest | null;
+export declare function parseActionRequest(body: unknown): ParsedActionRequest | null;
 //#endregion
 //#region src/request/render-verdict.d.ts
 export declare function renderVerdict(verdict: Verdict): string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-Bx9Lw7gO.js";
+import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-lM31QV2u.js";
 //#region src/config/load-claude-rules.ts
 async function loadClaudeRules(path, host) {
 	return (await loadClaudeSettings(path, host)).rules;

package/dist/{render-verdict-Bx9Lw7gO.js → render-verdict-lM31QV2u.js}

@@ -6652,6 +6652,11 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region mods/auto-mode/contract/find-current-direct-user-message.ts
+function findCurrentDirectUserMessage(message) {
+	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
+}
+//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir(startDir = import.meta.dirname, stopDir = parse(startDir).root) {
 	let dir = startDir;
@@ -6674,13 +6679,6 @@ async function loadPolicy(paths = {}, framework = "classifier.md") {
 	return classifier.replace(RULES_MARKER, rules.trim());
 }
 //#endregion
-//#region src/request/find-current-direct-user-message.ts
-function findCurrentDirectUserMessage(context) {
-	if (context === void 0 || context.agentID !== null) return null;
-	const message = context.lastDirectUserMessage;
-	return message === null || message.freshness === "stale" ? null : message.text;
-}
-//#endregion
 //#region src/judge/build-judge-message.ts
 function buildJudgeMessage(input) {
 	const evidence = {
@@ -7289,7 +7287,7 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 		if (judge.protocol !== "claude-code" && apiKey === null) throw new Error("no API key for the judge");
 		failure = "policy";
 		const system = await loadPolicy({ rulesPath: options.rulesPath }, "judge.md");
-		const directMessage = findCurrentDirectUserMessage(payload.decisionContext);
+		const directMessage = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 		const user = buildJudgeMessage({
 			rule: evidence.rule,
 			basis: evidence.basis,
@@ -7393,7 +7391,6 @@ function buildBudgetOmittedContext(context, field) {
 function buildTaskContext(context) {
 	let result = {
 		...context,
-		lastDirectUserMessage: context.agentID === null ? context.lastDirectUserMessage : null,
 		omittedTaskContext: [...context.omittedTaskContext]
 	};
 	for (const field of ["originalUserTask", "delegatedTask"]) {
@@ -7431,8 +7428,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 		source: "configured",
 		text
 	};
-	const context = payload.decisionContext;
-	const isStale = context?.agentID === null && context.lastDirectUserMessage?.freshness === "stale";
+	const isStale = payload.decisionContext?.lastDirectUserMessage?.freshness === "stale";
 	const answerGuidance = isStale ? `${BASE_ANSWER_GUIDANCE} ${STALE_ANSWER_GUIDANCE}` : BASE_ANSWER_GUIDANCE;
 	const questions = Object.fromEntries(Object.entries(rules).map(([id, rule]) => {
 		const canClarifyFalsePositive = rule.source === "shipped" && rule.tier === "hard" && (rule.name === "Policy Tampering" || rule.name === "Audit Tampering");
@@ -7456,7 +7452,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 			configuredRules,
 			...repositoryContext === null ? {} : { repositoryContext },
 			...mcpServers.length === 0 ? {} : { mcpServers },
-			lastUserMessage: (context === void 0 || context.agentID === null) && !isStale ? lastUserMessage : null,
+			lastUserMessage: isStale ? null : lastUserMessage,
 			...payload.decisionContext === void 0 ? {} : { taskContext: buildTaskContext(payload.decisionContext) },
 			action: {
 				tool: payload.toolName,
@@ -7856,7 +7852,7 @@ async function classifyWithJev(payload, config, options) {
 		key = await resolveApiKey(config.provider, options);
 		if (key === null) throw new Error("no API key: set the configured environment variable or key command");
 		stage = "evidence";
-		const directUserText = findCurrentDirectUserMessage(payload.decisionContext);
+		const directUserText = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 		const settings = await (options.claudeSettings ?? loadClaudeSettings(config.claudeSettingsPath, options.host));
 		const [policy, repositoryContext, mcpServers] = await Promise.all([
 			loadPolicy({
@@ -7978,7 +7974,7 @@ async function classifyWithModel(payload, config, options = {}) {
 	} catch (error) {
 		return buildFailure(config, `policy unreadable: ${toMessage(error)}`);
 	}
-	const directMessage = findCurrentDirectUserMessage(payload.decisionContext);
+	const directMessage = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 	const transcript = directMessage === null ? [] : [{
 		role: "user",
 		text: directMessage
@@ -8619,10 +8615,11 @@ function parseActionRequest(body) {
 //#endregion
 //#region src/request/render-verdict.ts
 function renderVerdict(verdict) {
-	return M(verdict).with({ kind: "allow" }, () => JSON.stringify({ decision: "allow" })).with({ kind: "deny" }, (denied) => JSON.stringify({
+	const rendered = M(verdict).returnType().with({ kind: "allow" }, () => ({ decision: "allow" })).with({ kind: "deny" }, (denied) => ({
 		decision: "deny",
 		reason: `[${denied.rule}] ${denied.reason}`
 	})).exhaustive();
+	return JSON.stringify(rendered);
 }
 //#endregion
 export { resolveConfigPath as A, resolveStateDir as C, DEFAULT_SCOPE_SOURCES as D, DEFAULT_DENIAL_BUDGET as E, string as F, PRESETS as M, number as N, loadConfig as O, strictObject as P, tryClassifyEdit as S, DEFAULT_CONFIG as T, checkContainment as _, loadSessionScope as a, splitCommandWords as b, classifyLocally as c, sendDecision as d, loadRepositoryContext as f, loadPolicy as g, buildDecisionRequest as h, resolveSessionScopePath as i, readHostEnvironment as j, resolveApiKey as k, classifyWithModel as l, DecisionRequestError as m, parseActionRequest as n, EMPTY_SESSION_SCOPE as o, loadCheckoutRemotes as p, classifyAction as r, buildTaskScope as s, renderVerdict as t, parseModelVerdict as u, toRepositorySlug as v, findCheckout as w, loadClaudeSettings as x, splitShellCommand as y };

package/mods/auto-mode/contract/find-current-direct-user-message.test.ts

@@ -0,0 +1,26 @@
+import { expect, test } from 'bun:test';
+import { findCurrentDirectUserMessage } from './find-current-direct-user-message.ts';
+
+test('it returns the text of a current direct message', () => {
+  expect(findCurrentDirectUserMessage({ text: 'Push it to main', origin: 'composer' })).toBe(
+    'Push it to main',
+  );
+});
+
+test('it returns nothing for a direct message marked stale', () => {
+  expect(
+    findCurrentDirectUserMessage({
+      text: 'Push it to main',
+      origin: 'composer',
+      freshness: 'stale',
+    }),
+  ).toBeNull();
+});
+
+test('it returns nothing when no direct message was sent', () => {
+  expect(findCurrentDirectUserMessage(null)).toBeNull();
+});
+
+test('it returns nothing when the request carries no decision context', () => {
+  expect(findCurrentDirectUserMessage(undefined)).toBeNull();
+});

package/mods/auto-mode/contract/find-current-direct-user-message.ts

@@ -0,0 +1,9 @@
+import type { DirectUserMessage } from './types.ts';
+
+export function findCurrentDirectUserMessage(
+  message: Readonly<DirectUserMessage> | null | undefined,
+): string | null {
+  return message === null || message === undefined || message.freshness === 'stale'
+    ? null
+    : message.text;
+}

package/mods/auto-mode/contract/is-message-origin.test.ts

@@ -0,0 +1,10 @@
+import { expect, test } from 'bun:test';
+import { isMessageOrigin } from './is-message-origin.ts';
+
+test.each(['composer', 'bridge', 'sdk'])('it accepts %s as a direct message origin', (origin) => {
+  expect(isMessageOrigin(origin)).toBe(true);
+});
+
+test.each(['plugin', 'agent.spawn', ''])('it rejects %p as a direct message origin', (origin) => {
+  expect(isMessageOrigin(origin)).toBe(false);
+});

package/mods/auto-mode/contract/is-message-origin.ts

@@ -0,0 +1,6 @@
+import { MESSAGE_ORIGINS } from './message-origins.ts';
+import type { MessageOrigin } from './types.ts';
+
+export function isMessageOrigin(value: string): value is MessageOrigin {
+  return MESSAGE_ORIGINS.some((origin) => origin === value);
+}

package/mods/auto-mode/contract/message-origins.ts

@@ -0,0 +1,3 @@
+// Composer, Remote Control and the SDK are the prompt origins a person types
+// into; any other origin is a delivery from a tool, not direct user evidence.
+export const MESSAGE_ORIGINS = ['composer', 'bridge', 'sdk'] as const;

package/mods/auto-mode/contract/scope-commands.ts

@@ -0,0 +1,6 @@
+// The commands that can create a worktree, a branch, or a PR, keyed by program.
+// Each entry is the words that follow the program and its leading options.
+export const SCOPE_COMMANDS = {
+  git: ['worktree add', 'checkout', 'switch', 'branch'],
+  gh: ['pr create'],
+} as const;

package/mods/auto-mode/contract/types.ts

@@ -0,0 +1,51 @@
+import type { MESSAGE_ORIGINS } from './message-origins.ts';
+
+export type MessageOrigin = (typeof MESSAGE_ORIGINS)[number];
+
+export interface UserTask {
+  readonly text: string;
+  readonly origin: MessageOrigin;
+}
+
+export interface DirectUserMessage extends UserTask {
+  readonly freshness?: 'stale' | undefined;
+}
+
+export interface DelegatedTask {
+  readonly text: string;
+  readonly origin: 'agent.spawn';
+}
+
+export interface TaskOmission {
+  readonly field: 'originalUserTask' | 'delegatedTask';
+  readonly reason: 'unavailable' | 'budget';
+}
+
+export interface ModContext {
+  readonly agentID: string | null;
+  readonly originalUserTask: UserTask | null;
+  readonly delegatedTask: DelegatedTask | null;
+  readonly lastDirectUserMessage: DirectUserMessage | null;
+  readonly omittedTaskContext: TaskOmission[];
+}
+
+export interface ModRequest {
+  readonly sessionID: string;
+  readonly toolUseID?: string | undefined;
+  readonly cwd: string;
+  readonly toolName: string;
+  readonly toolInput: Readonly<Record<string, unknown>>;
+  readonly context: ModContext;
+}
+
+export interface ModScopeRecord {
+  readonly sessionID: string;
+  readonly cwd: string;
+  readonly startedAt: number;
+  readonly command: string;
+  readonly resultText: string;
+}
+
+export type ModVerdict =
+  | { readonly decision: 'allow' }
+  | { readonly decision: 'deny'; readonly reason: string };

package/mods/auto-mode/hooks/build-action-request.ts

@@ -0,0 +1,46 @@
+import type { ModRequest, TaskOmission } from '../contract/types.ts';
+import type { PromptContext } from './types.ts';
+
+interface ActionRequestInput {
+  readonly sessionID: string;
+  readonly toolUseID: string | undefined;
+  readonly cwd: string;
+  readonly toolName: string;
+  readonly toolInput: Readonly<Record<string, unknown>>;
+  readonly agentID: string | null;
+  readonly delegatedText: string | undefined;
+  readonly prompts: PromptContext;
+}
+
+export function buildActionRequest(input: Readonly<ActionRequestInput>): ModRequest {
+  const isChild = input.agentID !== null;
+
+  const delegatedTask =
+    input.delegatedText === undefined
+      ? null
+      : { text: input.delegatedText, origin: 'agent.spawn' as const };
+
+  const omittedTaskContext: TaskOmission[] = [
+    ...(input.prompts.originalUserTask === null
+      ? [{ field: 'originalUserTask' as const, reason: 'unavailable' as const }]
+      : []),
+    ...(isChild && delegatedTask === null
+      ? [{ field: 'delegatedTask' as const, reason: 'unavailable' as const }]
+      : []),
+  ];
+
+  return {
+    sessionID: input.sessionID,
+    ...(input.toolUseID === undefined ? {} : { toolUseID: input.toolUseID }),
+    cwd: input.cwd,
+    toolName: input.toolName,
+    toolInput: input.toolInput,
+    context: {
+      agentID: input.agentID,
+      originalUserTask: input.prompts.originalUserTask,
+      delegatedTask,
+      lastDirectUserMessage: input.prompts.lastDirectUserMessage,
+      omittedTaskContext,
+    },
+  };
+}

package/mods/auto-mode/hooks/build-prompt-context.ts

@@ -1,4 +1,6 @@
-import type { DirectUserMessage, PromptContext, UserTask } from './types.ts';
+import { isMessageOrigin } from '../contract/is-message-origin.ts';
+import type { DirectUserMessage, UserTask } from '../contract/types.ts';
+import type { PromptContext } from './types.ts';
 
 export function buildPromptContext(
   previous: PromptContext | null,
@@ -20,7 +22,7 @@ export function buildPromptContext(
 
   const origin = input.origin.kind;
 
-  if (origin !== 'composer' && origin !== 'bridge' && origin !== 'sdk') {
+  if (!isMessageOrigin(origin)) {
     return {
       originalUserTask: previous?.originalUserTask ?? null,
       lastDirectUserMessage: buildStaleMessage(previous?.lastDirectUserMessage ?? null),

package/mods/auto-mode/hooks/is-scope-command.ts

@@ -0,0 +1,18 @@
+import { SCOPE_COMMANDS } from '../contract/scope-commands.ts';
+
+// A cheap gate before the record subprocess: options may sit between the
+// program and its subcommand, and the CLI parses the words exactly.
+const SCOPE_COMMAND_PATTERN = new RegExp(
+  Object.entries(SCOPE_COMMANDS)
+    .map(([program, commands]) => {
+      const alternatives = commands.map((command) => command.split(' ').join(String.raw`\s+`));
+
+      return String.raw`\b${program}\s[^\n]*?\b(?:${alternatives.join('|')})\b`;
+    })
+    .join('|'),
+  'u',
+);
+
+export function isScopeCommand(command: string): boolean {
+  return SCOPE_COMMAND_PATTERN.test(command);
+}

package/mods/auto-mode/hooks/is-tool-input.ts

@@ -0,0 +1,3 @@
+export function isToolInput(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/mods/auto-mode/hooks/parse-decision.ts

@@ -1,11 +1,8 @@
-interface Decision {
-  readonly decision: 'allow' | 'deny';
-  readonly reason?: string;
-}
+import type { ModVerdict } from '../contract/types.ts';
 
 // The CLI ships with this mod, so any other shape is a mismatched or broken CLI,
 // and only an exact verdict may replace the prompt.
-export function parseDecision(stdout: string): Decision | null {
+export function parseDecision(stdout: string): ModVerdict | null {
   let body: unknown;
 
   try {

package/mods/auto-mode/hooks/register.ts

@@ -1,12 +1,11 @@
+import type { ModScopeRecord } from '../contract/types.ts';
+import { buildActionRequest } from './build-action-request.ts';
 import { buildPromptContext } from './build-prompt-context.ts';
+import { isScopeCommand } from './is-scope-command.ts';
+import { isToolInput } from './is-tool-input.ts';
 import { parseDecision } from './parse-decision.ts';
 import type { ModOn, ModOptions, PromptContext } from './types.ts';
 
-// Commands that can create a worktree, a branch, or a PR. Any other call skips
-// the record subprocess, so ordinary calls pay nothing for the session scope.
-const SCOPE_COMMAND =
-  /\bgit\s[^\n]*?\b(?:worktree\s+add|checkout|switch|branch)\b|\bgh\s+pr\s+create\b/u;
-
 // The record may look up a created PR's head branch with gh, which the CLI
 // bounds at 5 seconds.
 const RECORD_TIMEOUT_MS = 8000;
@@ -73,7 +72,7 @@ export function register(on: ModOn, options: ModOptions): void {
     activeCalls.set(e.tool_use_id, e.agentId ?? null);
 
     const command =
-      e.tool === 'Bash' && typeof e.command === 'string' && SCOPE_COMMAND.test(e.command)
+      e.tool === 'Bash' && typeof e.command === 'string' && isScopeCommand(e.command)
         ? e.command
         : null;
 
@@ -89,7 +88,14 @@ export function register(on: ModOn, options: ModOptions): void {
 
     if (command !== null && cwd !== null && sessionID !== null && result.deny === undefined) {
       const executable = typeof options.command === 'string' ? options.command : 'auto-mode';
-      const request = { sessionID, cwd, startedAt, command, resultText: result.text ?? '' };
+
+      const request: ModScopeRecord = {
+        sessionID,
+        cwd,
+        startedAt,
+        command,
+        resultText: result.text ?? '',
+      };
 
       try {
         await $.process.run([executable, 'record'], {
@@ -137,26 +143,17 @@ export function register(on: ModOn, options: ModOptions): void {
 
       const agentID = e.tool_use_id === undefined ? null : activeCalls.get(e.tool_use_id);
 
-      if (e.tool_use_id !== undefined && agentID === undefined) {
+      if (agentID === undefined) {
         $.ui.log(`${logPrefix} evaluation skipped; untracked tool call`, { to: 'debug' });
 
         return decided;
       }
 
-      const isChild = agentID !== null && agentID !== undefined;
-      const delegatedText = isChild ? delegatedTasks.get(agentID) : undefined;
+      if (!isToolInput(e.input)) {
+        $.ui.log(`${logPrefix} evaluation skipped; tool input is not an object`, { to: 'debug' });
 
-      const delegatedTask =
-        delegatedText === undefined ? null : { text: delegatedText, origin: 'agent.spawn' };
-
-      const omittedTaskContext = [
-        ...(prompts.originalUserTask === null
-          ? [{ field: 'originalUserTask', reason: 'unavailable' }]
-          : []),
-        ...(isChild && delegatedTask === null
-          ? [{ field: 'delegatedTask', reason: 'unavailable' }]
-          : []),
-      ];
+        return decided;
+      }
 
       const command = typeof options.command === 'string' ? options.command : 'auto-mode';
       const childTimeoutMs = EVALUATION_TIMEOUT_MS;
@@ -164,20 +161,16 @@ export function register(on: ModOn, options: ModOptions): void {
 
       $.ui.log(`${logPrefix} evaluator invoked`, { to: 'debug' });
 
-      const request = {
+      const request = buildActionRequest({
         sessionID,
-        ...(e.tool_use_id === undefined ? {} : { toolUseID: e.tool_use_id }),
+        toolUseID: e.tool_use_id,
         cwd,
         toolName: e.tool,
         toolInput: e.input,
-        context: {
-          agentID: agentID ?? null,
-          originalUserTask: prompts.originalUserTask,
-          delegatedTask,
-          lastDirectUserMessage: isChild ? null : prompts.lastDirectUserMessage,
-          omittedTaskContext,
-        },
-      };
+        agentID,
+        delegatedText: agentID === null ? undefined : delegatedTasks.get(agentID),
+        prompts,
+      });
 
       const result = await $.process.run(
         [command, 'run', '--jev-only', '--evaluation-deadline', String(deadlineAt)],

package/mods/auto-mode/hooks/types.ts

@@ -1,3 +1,5 @@
+import type { DirectUserMessage, UserTask } from '../contract/types.ts';
+
 export interface PermissionDecision {
   readonly decision: 'allow' | 'ask' | 'deny';
   readonly reason?: string;
@@ -45,15 +47,6 @@ export interface CallResult {
   readonly isError?: true;
 }
 
-export interface UserTask {
-  readonly text: string;
-  readonly origin: 'composer' | 'bridge' | 'sdk';
-}
-
-export interface DirectUserMessage extends UserTask {
-  readonly freshness?: 'stale';
-}
-
 export interface PromptContext {
   readonly originalUserTask: UserTask | null;
   readonly lastDirectUserMessage: DirectUserMessage | null;

package/mods/auto-mode/tsconfig.json

@@ -8,5 +8,6 @@
     "noEmit": true,
     "skipLibCheck": true
   },
-  "include": ["hooks/**/*.ts"]
+  "include": ["hooks/**/*.ts", "contract/**/*.ts"],
+  "exclude": ["contract/**/*.test.ts"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",