auto-mode 0.17.0 → 0.19.0

package/README.md

@@ -6,84 +6,52 @@
   </p>
 </div>
 
-**auto-mode** judges the tool calls that Claude Code would prompt for. It is a core library and a
-Claude Code mod. The mod returns allow, deny, or no verdict before the permission dialog appears.
-Local rules settle read-only actions and build cleanup; Jev evaluates the remaining actions against
-a written policy.
+**auto-mode** tries to mitigate the risk of unattended non-Claude agents inside Claude Code.
 
-The Jev request includes the policy, your configured environment and permissions, the complete
-proposed action, and the last direct user message. It excludes the rest of the session. Configure
-standing permissions upfront; earlier conversational grants and restrictions are unavailable to the
-classifier.
+auto-mode runs as a Claude Code mod, and its operating model is loosely modelled on Anthropic's
+native auto mode. Instead of one model, it pairs a fast decision model (such as Jev) with a
+traditional classifier-judge model (such as Haiku) to cover the first one's shortcomings.
 
 ## Install
 
+auto-mode needs node 24 or later, Claude Code, and a TypeSafe API key for Jev.
+
 ```sh
 npm i -g auto-mode
 claude --plugin-dir "$(npm root -g)/auto-mode/mods/auto-mode"
 ```
 
-The package ships the mod in `mods/auto-mode`. The mod runs the `auto-mode` executable on `PATH`;
-its `command` option takes another executable. [Claude permission mod](./docs/guides/claude-mod.md)
-covers the mod, its time limits, and a trial session.
-
-Create the classifier configuration:
-
-```json
-{
-  "classifiers": { "jev": { "apiKeyEnv": "TYPESAFE_API_KEY" } },
-  "decision": { "classifier": "jev" }
-}
-```
-
-Save it as `~/.config/auto-mode/config.json` and export your TypeSafe API key, or set the entry's
-`apiKeyCommand` to a command that prints it. [Configuration](./docs/guides/configuration.md) covers
-the registries and credentials.
-
-## Standing permissions
-
-Jev imports explicit entries from `autoMode.environment`, `autoMode.allow`, `autoMode.soft_deny`,
-and `autoMode.hard_deny` in your user Claude settings. It imports no credential values or shell
-permission patterns. `$defaults` refers to auto-mode's shipped policy; it does not expand Claude's
-built-in classifier rules.
-
-Configured allows clear soft blocks. Hard blocks take priority over all allows and conversational
-consent. [False-positive clarification](./docs/guides/policy.md#false-positive-clarification) can
-clear Policy Tampering and Audit Tampering. The last direct user message can supply the exact action
-and target that a soft block needs; replies such as “go ahead” cannot supply an unseen proposal.
-
-Read [the policy](./policy/rules.md) before you enable the mod.
-[Writing a policy](./docs/guides/policy.md) covers the precedence and the limits of an action-only
-assessment.
-
-## Decisions and failures
-
-Jev evaluates each named rule with a typed choice between allow and block. auto-mode allows the
-action unless some rule's block probability reaches the threshold, 0.2 by default. Every denial
-names the rule with the highest block probability, the harm, and what clears it, and the agent
-continues on another path. The threshold is configurable and needs evaluation against your actions.
-
-A missing key, failed API call, malformed response, or oversized request follows
-`decision.onFailure`. The default `defer` writes no verdict and keeps the prompt; `deny` fails
-closed. Failures write a diagnostic to stderr. auto-mode never truncates a Jev action to make it
-fit.
-
-## Commands
-
-| Command                      | Effect                                    |
-| ---------------------------- | ----------------------------------------- |
-| `auto-mode run`              | Read a mod request and write a verdict    |
-| `auto-mode run --explain`    | Write decision details to stderr          |
-| `auto-mode run --local-only` | Skip the model tier                       |
-| `auto-mode run --jev-only`   | Require Jev with a 5-second API timeout   |
-| `auto-mode print-prompt`     | Print the selected provider's base policy |
-
-The mod evaluates only ask decisions and preserves existing allow and deny decisions. It runs the
-CLI as a bounded child process with `--jev-only`. The `spark`, `claude`, `glm`, and `messages`
-classifier kinds use the Messages API and serve library callers.
+Export your key as `TYPESAFE_API_KEY`, or point the configuration at a command that prints it.
+[Claude permission mod](./docs/guides/claude-mod.md) covers the mod and a trial session you can
+undo.
+
+## Features
+
+- **Local rules** allow read-only calls and build-output cleanup without a model call
+  ([local rules](./docs/architecture/stages/local-rules.md)).
+- **Containment** denies a write outside the task's own worktrees, branches and pull requests
+  ([containment](./docs/architecture/stages/containment.md)).
+- **The edit bypass** allows an in-scope file edit once a secret scan finds nothing
+  ([the edit bypass](./docs/architecture/stages/edit-bypass.md)).
+- **Jev** judges the remaining calls against the shipped rules and your own
+  ([Jev](./docs/architecture/stages/jev.md)).
+- **The judge**, on by default, reviews every Jev deny, and overturns it when your last message
+  asked the main agent for exactly this action, or when no rule covers the action
+  ([the judge](./docs/architecture/stages/judge.md)).
+- **The denial budget** hands a call back to you when an agent keeps getting denied
+  ([the denial budget](./docs/architecture/stages/denial-budget.md)).
+- **Your own rules** from your Claude settings join the policy as block rules
+  ([settings and repository facts](./docs/architecture/evidence/settings-and-repository.md)).
+- **Action diagnostics** record how each call was decided, without the command or the prompt
+  ([action diagnostics](./docs/guides/diagnostics.md)).
+
+Read [the rules](./policy/rules.md) before you enable the mod.
+[Writing a policy](./docs/guides/policy.md) covers how the rules clear and how to change them.
 
 ## Library
 
+You can call auto-mode's core APIs from your own code:
+
 ```ts
 import { classifyAction, loadConfig, parseActionRequest } from 'auto-mode';
 
@@ -94,19 +62,14 @@ if (request !== null) {
 }
 ```
 
-`classifyAction` runs both tiers and returns the verdict, a note, and diagnostics. A request carries
-the session identity, the action, and the task context; `parseActionRequest` builds one from the
-mod's JSON.
+## Configuration
+
+Read the [configuration](./docs/guides/configuration.md) guide, which covers every field and the
+credentials.
 
 ## Documentation
 
-- [Architecture](./docs/architecture/overview.md) covers the request, decision combination, and the
-  mod contract.
-- [Configuration](./docs/guides/configuration.md) covers every setting and the imported Claude
-  rules.
-- [Claude permission mod](./docs/guides/claude-mod.md) covers the request, the verdict, and the time
-  limits.
-- [Writing a policy](./docs/guides/policy.md) covers rule edits and evaluation.
+[docs/](./docs/README.md) covers the architecture and the user guides.
 
 ## Licence
 

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-Bx9Lw7gO.js";
+import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-CcVLBFKT.js";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
 import { spawn } from "node:child_process";
@@ -274,6 +274,22 @@ function parseScopeRecordRequest(body) {
 	return parsed.success ? parsed.data : null;
 }
 //#endregion
+//#region src/request/to-mod-request.ts
+function toModRequest(request) {
+	const context = request.decisionContext;
+	return {
+		sessionID: request.sessionID,
+		...request.toolUseID === void 0 ? {} : { toolUseID: request.toolUseID },
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: request.toolInput,
+		context: {
+			...context,
+			omittedTaskContext: [...context.omittedTaskContext]
+		}
+	};
+}
+//#endregion
 //#region src/scope/read-pull-request.ts
 const LOOKUP_TIMEOUT_MS = 5e3;
 function readPullRequest(repository, number, options = {}) {
@@ -335,6 +351,17 @@ function collectPullRequestAddresses(text) {
 }
 const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
 //#endregion
+//#region mods/auto-mode/contract/scope-commands.ts
+const SCOPE_COMMANDS = {
+	git: [
+		"worktree add",
+		"checkout",
+		"switch",
+		"branch"
+	],
+	gh: ["pr create"]
+};
+//#endregion
 //#region src/scope/collect-scope-events.ts
 function collectScopeEvents(command, cwd, home) {
 	const events = [];
@@ -344,7 +371,7 @@ function collectScopeEvents(command, cwd, home) {
 		const [name, ...args] = splitCommandWords(segment.text);
 		if (name === "cd") directory = hasPipe ? null : resolvePath(directory, args[0] ?? home, home);
 		else if (name === "git" && directory !== null) events.push(...collectGitEvents(args, directory, home));
-		else if (name === "gh" && directory !== null && args[0] === "pr" && args[1] === "create") events.push({
+		else if (name === "gh" && directory !== null && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null) events.push({
 			kind: "pull-request",
 			directory,
 			head: findOptionValue(args, ["--head", "-H"])
@@ -352,15 +379,6 @@ function collectScopeEvents(command, cwd, home) {
 	}
 	return events;
 }
-const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"-c",
-	"-C",
-	"--create",
-	"--force-create"
-]);
-const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
 function collectGitEvents(args, cwd, home) {
 	let directory = cwd;
 	let index = 0;
@@ -368,34 +386,33 @@ function collectGitEvents(args, cwd, home) {
 		if (args[index] === "-C") directory = resolvePath(directory, args[index + 1] ?? "", home);
 		index += args[index] === "-C" || args[index] === "-c" ? 2 : 1;
 	}
-	const subcommand = args[index];
-	const rest = args.slice(index + 1);
-	if (directory === null) return [];
-	if (subcommand === "worktree" && rest[0] === "add") {
-		const path = findWorktreePath(rest.slice(1));
-		const resolved = path === null ? null : resolvePath(directory, path, home);
-		return resolved === null ? [] : [{
-			kind: "worktree",
-			path: resolved
-		}];
-	}
-	if (subcommand === "checkout" || subcommand === "switch") {
-		const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
-		return name === null ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
-	}
-	if (subcommand === "branch" && !rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) {
-		const name = rest.find((word) => !word.startsWith("-"));
-		return name === void 0 || isUnresolved(name) ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
+	const found = findScopeCommand(SCOPE_COMMANDS.git, args.slice(index));
+	if (directory === null || found === null) return [];
+	return GIT_EVENT_COLLECTORS[found.command](found.rest, directory, home);
+}
+function findScopeCommand(commands, args) {
+	for (const command of commands) {
+		const words = command.split(" ");
+		if (words.every((word, index) => args[index] === word)) return {
+			command,
+			rest: args.slice(words.length)
+		};
 	}
-	return [];
+	return null;
+}
+const GIT_EVENT_COLLECTORS = {
+	"worktree add": collectWorktreeEvents,
+	checkout: collectSwitchEvents,
+	switch: collectSwitchEvents,
+	branch: collectBranchEvents
+};
+function collectWorktreeEvents(rest, directory, home) {
+	const path = findWorktreePath(rest);
+	const resolved = path === null ? null : resolvePath(directory, path, home);
+	return resolved === null ? [] : [{
+		kind: "worktree",
+		path: resolved
+	}];
 }
 const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"-b",
@@ -410,6 +427,32 @@ function findWorktreePath(args) {
 	}
 	return null;
 }
+const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-B",
+	"-c",
+	"-C",
+	"--create",
+	"--force-create"
+]);
+const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
+function collectSwitchEvents(rest, directory) {
+	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
+	return name === null ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
+function collectBranchEvents(rest, directory) {
+	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
+	const name = rest.find((word) => !word.startsWith("-"));
+	return name === void 0 || isUnresolved(name) ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
 function findOptionValue(args, options) {
 	const index = args.findIndex((word) => options.includes(word));
 	const value = index === -1 ? void 0 : args[index + 1];
@@ -704,7 +747,7 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 			const captured = await tryWriteRequestCapture(resolveCaptureDir(config.capture, host), {
 				schemaVersion: 1,
 				time: (/* @__PURE__ */ new Date()).toISOString(),
-				request: body,
+				request: toModRequest(request),
 				verdict: plan.verdict,
 				decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
 				escalation: plan.escalation

package/dist/index.d.ts

@@ -1,32 +1,48 @@
-//#region src/request/types.d.ts
+//#region mods/auto-mode/contract/message-origins.d.ts
+declare const MESSAGE_ORIGINS: readonly ['composer', 'bridge', 'sdk'];
+//#endregion
+//#region mods/auto-mode/contract/types.d.ts
+type MessageOrigin = (typeof MESSAGE_ORIGINS)[number];
 interface UserTask {
   readonly text: string;
-  readonly origin: 'composer' | 'bridge' | 'sdk';
+  readonly origin: MessageOrigin;
 }
 interface DirectUserMessage extends UserTask {
   readonly freshness?: 'stale' | undefined;
 }
-interface DecisionContext {
+interface DelegatedTask {
+  readonly text: string;
+  readonly origin: 'agent.spawn';
+}
+interface TaskOmission {
+  readonly field: 'originalUserTask' | 'delegatedTask';
+  readonly reason: 'unavailable' | 'budget';
+}
+interface ModContext {
   readonly agentID: string | null;
   readonly originalUserTask: UserTask | null;
-  readonly delegatedTask: {
-    readonly text: string;
-    readonly origin: 'agent.spawn';
-  } | null;
+  readonly delegatedTask: DelegatedTask | null;
   readonly lastDirectUserMessage: DirectUserMessage | null;
-  readonly omittedTaskContext: readonly {
-    readonly field: 'originalUserTask' | 'delegatedTask';
-    readonly reason: 'unavailable' | 'budget';
-  }[];
+  readonly omittedTaskContext: TaskOmission[];
 }
-interface ActionRequest {
+interface ModRequest {
   readonly sessionID: string;
   readonly toolUseID?: string | undefined;
   readonly cwd: string;
   readonly toolName: string;
   readonly toolInput: Readonly<Record<string, unknown>>;
-  readonly decisionContext?: DecisionContext | undefined;
+  readonly context: ModContext;
 }
+//#endregion
+//#region src/request/types.d.ts
+type DeepReadonly<T> = T extends readonly (infer Item)[] ? readonly DeepReadonly<Item>[] : T extends object ? { readonly [Key in keyof T]: DeepReadonly<T[Key]>; } : T;
+type DecisionContext = DeepReadonly<ModContext>;
+type ActionRequest = DeepReadonly<Omit<ModRequest, 'context'>> & {
+  readonly decisionContext?: DecisionContext | undefined;
+};
+type ParsedActionRequest = ActionRequest & {
+  readonly decisionContext: DecisionContext;
+};
 type Verdict = {
   readonly kind: 'allow';
 } | {
@@ -349,7 +365,7 @@ interface PolicyPaths {
 export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md' | 'judge.md'): Promise<string>;
 //#endregion
 //#region src/request/parse-action-request.d.ts
-export declare function parseActionRequest(body: unknown): ActionRequest | null;
+export declare function parseActionRequest(body: unknown): ParsedActionRequest | null;
 //#endregion
 //#region src/request/render-verdict.d.ts
 export declare function renderVerdict(verdict: Verdict): string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-Bx9Lw7gO.js";
+import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-CcVLBFKT.js";
 //#region src/config/load-claude-rules.ts
 async function loadClaudeRules(path, host) {
 	return (await loadClaudeSettings(path, host)).rules;

package/dist/{render-verdict-Bx9Lw7gO.js → render-verdict-CcVLBFKT.js}

@@ -5684,7 +5684,7 @@ const DEFAULT_SCOPE_SOURCES = {
 const DEFAULT_CONFIG = {
 	provider: DEFAULT_PROVIDER,
 	judge: DEFAULT_JUDGE,
-	judgeOverturns: "consent",
+	judgeOverturns: "any",
 	onFailure: "defer",
 	blockThreshold: .2,
 	denialBudget: DEFAULT_DENIAL_BUDGET,
@@ -5758,7 +5758,7 @@ function buildConfig(json, path, home) {
 	return {
 		provider,
 		judge,
-		judgeOverturns: decision.judgeOverturns ?? "consent",
+		judgeOverturns: decision.judgeOverturns ?? "any",
 		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
 		classifierPath: expandHomePath(policy.frameworkPath ?? void 0, home),
 		rulesPath: expandHomePath(policy.rulesPath ?? void 0, home),
@@ -6652,6 +6652,11 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region mods/auto-mode/contract/find-current-direct-user-message.ts
+function findCurrentDirectUserMessage(message) {
+	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
+}
+//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir(startDir = import.meta.dirname, stopDir = parse(startDir).root) {
 	let dir = startDir;
@@ -6674,13 +6679,6 @@ async function loadPolicy(paths = {}, framework = "classifier.md") {
 	return classifier.replace(RULES_MARKER, rules.trim());
 }
 //#endregion
-//#region src/request/find-current-direct-user-message.ts
-function findCurrentDirectUserMessage(context) {
-	if (context === void 0 || context.agentID !== null) return null;
-	const message = context.lastDirectUserMessage;
-	return message === null || message.freshness === "stale" ? null : message.text;
-}
-//#endregion
 //#region src/judge/build-judge-message.ts
 function buildJudgeMessage(input) {
 	const evidence = {
@@ -7289,7 +7287,7 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 		if (judge.protocol !== "claude-code" && apiKey === null) throw new Error("no API key for the judge");
 		failure = "policy";
 		const system = await loadPolicy({ rulesPath: options.rulesPath }, "judge.md");
-		const directMessage = findCurrentDirectUserMessage(payload.decisionContext);
+		const directMessage = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 		const user = buildJudgeMessage({
 			rule: evidence.rule,
 			basis: evidence.basis,
@@ -7393,7 +7391,6 @@ function buildBudgetOmittedContext(context, field) {
 function buildTaskContext(context) {
 	let result = {
 		...context,
-		lastDirectUserMessage: context.agentID === null ? context.lastDirectUserMessage : null,
 		omittedTaskContext: [...context.omittedTaskContext]
 	};
 	for (const field of ["originalUserTask", "delegatedTask"]) {
@@ -7431,8 +7428,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 		source: "configured",
 		text
 	};
-	const context = payload.decisionContext;
-	const isStale = context?.agentID === null && context.lastDirectUserMessage?.freshness === "stale";
+	const isStale = payload.decisionContext?.lastDirectUserMessage?.freshness === "stale";
 	const answerGuidance = isStale ? `${BASE_ANSWER_GUIDANCE} ${STALE_ANSWER_GUIDANCE}` : BASE_ANSWER_GUIDANCE;
 	const questions = Object.fromEntries(Object.entries(rules).map(([id, rule]) => {
 		const canClarifyFalsePositive = rule.source === "shipped" && rule.tier === "hard" && (rule.name === "Policy Tampering" || rule.name === "Audit Tampering");
@@ -7456,7 +7452,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 			configuredRules,
 			...repositoryContext === null ? {} : { repositoryContext },
 			...mcpServers.length === 0 ? {} : { mcpServers },
-			lastUserMessage: (context === void 0 || context.agentID === null) && !isStale ? lastUserMessage : null,
+			lastUserMessage: isStale ? null : lastUserMessage,
 			...payload.decisionContext === void 0 ? {} : { taskContext: buildTaskContext(payload.decisionContext) },
 			action: {
 				tool: payload.toolName,
@@ -7856,7 +7852,7 @@ async function classifyWithJev(payload, config, options) {
 		key = await resolveApiKey(config.provider, options);
 		if (key === null) throw new Error("no API key: set the configured environment variable or key command");
 		stage = "evidence";
-		const directUserText = findCurrentDirectUserMessage(payload.decisionContext);
+		const directUserText = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 		const settings = await (options.claudeSettings ?? loadClaudeSettings(config.claudeSettingsPath, options.host));
 		const [policy, repositoryContext, mcpServers] = await Promise.all([
 			loadPolicy({
@@ -7978,7 +7974,7 @@ async function classifyWithModel(payload, config, options = {}) {
 	} catch (error) {
 		return buildFailure(config, `policy unreadable: ${toMessage(error)}`);
 	}
-	const directMessage = findCurrentDirectUserMessage(payload.decisionContext);
+	const directMessage = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 	const transcript = directMessage === null ? [] : [{
 		role: "user",
 		text: directMessage
@@ -8506,7 +8502,7 @@ async function classifyAction(request, config, options = {}) {
 			...options,
 			host,
 			rulesPath: config.rulesPath,
-			overturns: config.judgeOverturns ?? "consent"
+			overturns: config.judgeOverturns ?? "any"
 		});
 		const { review: _review, ...rest } = outcome;
 		return {
@@ -8619,10 +8615,11 @@ function parseActionRequest(body) {
 //#endregion
 //#region src/request/render-verdict.ts
 function renderVerdict(verdict) {
-	return M(verdict).with({ kind: "allow" }, () => JSON.stringify({ decision: "allow" })).with({ kind: "deny" }, (denied) => JSON.stringify({
+	const rendered = M(verdict).returnType().with({ kind: "allow" }, () => ({ decision: "allow" })).with({ kind: "deny" }, (denied) => ({
 		decision: "deny",
 		reason: `[${denied.rule}] ${denied.reason}`
 	})).exhaustive();
+	return JSON.stringify(rendered);
 }
 //#endregion
 export { resolveConfigPath as A, resolveStateDir as C, DEFAULT_SCOPE_SOURCES as D, DEFAULT_DENIAL_BUDGET as E, string as F, PRESETS as M, number as N, loadConfig as O, strictObject as P, tryClassifyEdit as S, DEFAULT_CONFIG as T, checkContainment as _, loadSessionScope as a, splitCommandWords as b, classifyLocally as c, sendDecision as d, loadRepositoryContext as f, loadPolicy as g, buildDecisionRequest as h, resolveSessionScopePath as i, readHostEnvironment as j, resolveApiKey as k, classifyWithModel as l, DecisionRequestError as m, parseActionRequest as n, EMPTY_SESSION_SCOPE as o, loadCheckoutRemotes as p, classifyAction as r, buildTaskScope as s, renderVerdict as t, parseModelVerdict as u, toRepositorySlug as v, findCheckout as w, loadClaudeSettings as x, splitShellCommand as y };

package/mods/auto-mode/contract/find-current-direct-user-message.test.ts

@@ -0,0 +1,26 @@
+import { expect, test } from 'bun:test';
+import { findCurrentDirectUserMessage } from './find-current-direct-user-message.ts';
+
+test('it returns the text of a current direct message', () => {
+  expect(findCurrentDirectUserMessage({ text: 'Push it to main', origin: 'composer' })).toBe(
+    'Push it to main',
+  );
+});
+
+test('it returns nothing for a direct message marked stale', () => {
+  expect(
+    findCurrentDirectUserMessage({
+      text: 'Push it to main',
+      origin: 'composer',
+      freshness: 'stale',
+    }),
+  ).toBeNull();
+});
+
+test('it returns nothing when no direct message was sent', () => {
+  expect(findCurrentDirectUserMessage(null)).toBeNull();
+});
+
+test('it returns nothing when the request carries no decision context', () => {
+  expect(findCurrentDirectUserMessage(undefined)).toBeNull();
+});

package/mods/auto-mode/contract/find-current-direct-user-message.ts

@@ -0,0 +1,9 @@
+import type { DirectUserMessage } from './types.ts';
+
+export function findCurrentDirectUserMessage(
+  message: Readonly<DirectUserMessage> | null | undefined,
+): string | null {
+  return message === null || message === undefined || message.freshness === 'stale'
+    ? null
+    : message.text;
+}

package/mods/auto-mode/contract/is-message-origin.test.ts

@@ -0,0 +1,10 @@
+import { expect, test } from 'bun:test';
+import { isMessageOrigin } from './is-message-origin.ts';
+
+test.each(['composer', 'bridge', 'sdk'])('it accepts %s as a direct message origin', (origin) => {
+  expect(isMessageOrigin(origin)).toBe(true);
+});
+
+test.each(['plugin', 'agent.spawn', ''])('it rejects %p as a direct message origin', (origin) => {
+  expect(isMessageOrigin(origin)).toBe(false);
+});

package/mods/auto-mode/contract/is-message-origin.ts

@@ -0,0 +1,6 @@
+import { MESSAGE_ORIGINS } from './message-origins.ts';
+import type { MessageOrigin } from './types.ts';
+
+export function isMessageOrigin(value: string): value is MessageOrigin {
+  return MESSAGE_ORIGINS.some((origin) => origin === value);
+}

package/mods/auto-mode/contract/message-origins.ts

@@ -0,0 +1,3 @@
+// Composer, Remote Control and the SDK are the prompt origins a person types
+// into; any other origin is a delivery from a tool, not direct user evidence.
+export const MESSAGE_ORIGINS = ['composer', 'bridge', 'sdk'] as const;

package/mods/auto-mode/contract/scope-commands.ts

@@ -0,0 +1,6 @@
+// The commands that can create a worktree, a branch, or a PR, keyed by program.
+// Each entry is the words that follow the program and its leading options.
+export const SCOPE_COMMANDS = {
+  git: ['worktree add', 'checkout', 'switch', 'branch'],
+  gh: ['pr create'],
+} as const;

package/mods/auto-mode/contract/types.ts

@@ -0,0 +1,51 @@
+import type { MESSAGE_ORIGINS } from './message-origins.ts';
+
+export type MessageOrigin = (typeof MESSAGE_ORIGINS)[number];
+
+export interface UserTask {
+  readonly text: string;
+  readonly origin: MessageOrigin;
+}
+
+export interface DirectUserMessage extends UserTask {
+  readonly freshness?: 'stale' | undefined;
+}
+
+export interface DelegatedTask {
+  readonly text: string;
+  readonly origin: 'agent.spawn';
+}
+
+export interface TaskOmission {
+  readonly field: 'originalUserTask' | 'delegatedTask';
+  readonly reason: 'unavailable' | 'budget';
+}
+
+export interface ModContext {
+  readonly agentID: string | null;
+  readonly originalUserTask: UserTask | null;
+  readonly delegatedTask: DelegatedTask | null;
+  readonly lastDirectUserMessage: DirectUserMessage | null;
+  readonly omittedTaskContext: TaskOmission[];
+}
+
+export interface ModRequest {
+  readonly sessionID: string;
+  readonly toolUseID?: string | undefined;
+  readonly cwd: string;
+  readonly toolName: string;
+  readonly toolInput: Readonly<Record<string, unknown>>;
+  readonly context: ModContext;
+}
+
+export interface ModScopeRecord {
+  readonly sessionID: string;
+  readonly cwd: string;
+  readonly startedAt: number;
+  readonly command: string;
+  readonly resultText: string;
+}
+
+export type ModVerdict =
+  | { readonly decision: 'allow' }
+  | { readonly decision: 'deny'; readonly reason: string };

package/mods/auto-mode/hooks/build-action-request.ts

@@ -0,0 +1,46 @@
+import type { ModRequest, TaskOmission } from '../contract/types.ts';
+import type { PromptContext } from './types.ts';
+
+interface ActionRequestInput {
+  readonly sessionID: string;
+  readonly toolUseID: string | undefined;
+  readonly cwd: string;
+  readonly toolName: string;
+  readonly toolInput: Readonly<Record<string, unknown>>;
+  readonly agentID: string | null;
+  readonly delegatedText: string | undefined;
+  readonly prompts: PromptContext;
+}
+
+export function buildActionRequest(input: Readonly<ActionRequestInput>): ModRequest {
+  const isChild = input.agentID !== null;
+
+  const delegatedTask =
+    input.delegatedText === undefined
+      ? null
+      : { text: input.delegatedText, origin: 'agent.spawn' as const };
+
+  const omittedTaskContext: TaskOmission[] = [
+    ...(input.prompts.originalUserTask === null
+      ? [{ field: 'originalUserTask' as const, reason: 'unavailable' as const }]
+      : []),
+    ...(isChild && delegatedTask === null
+      ? [{ field: 'delegatedTask' as const, reason: 'unavailable' as const }]
+      : []),
+  ];
+
+  return {
+    sessionID: input.sessionID,
+    ...(input.toolUseID === undefined ? {} : { toolUseID: input.toolUseID }),
+    cwd: input.cwd,
+    toolName: input.toolName,
+    toolInput: input.toolInput,
+    context: {
+      agentID: input.agentID,
+      originalUserTask: input.prompts.originalUserTask,
+      delegatedTask,
+      lastDirectUserMessage: input.prompts.lastDirectUserMessage,
+      omittedTaskContext,
+    },
+  };
+}

package/mods/auto-mode/hooks/build-prompt-context.ts

@@ -1,4 +1,6 @@
-import type { DirectUserMessage, PromptContext, UserTask } from './types.ts';
+import { isMessageOrigin } from '../contract/is-message-origin.ts';
+import type { DirectUserMessage, UserTask } from '../contract/types.ts';
+import type { PromptContext } from './types.ts';
 
 export function buildPromptContext(
   previous: PromptContext | null,
@@ -20,7 +22,7 @@ export function buildPromptContext(
 
   const origin = input.origin.kind;
 
-  if (origin !== 'composer' && origin !== 'bridge' && origin !== 'sdk') {
+  if (!isMessageOrigin(origin)) {
     return {
       originalUserTask: previous?.originalUserTask ?? null,
       lastDirectUserMessage: buildStaleMessage(previous?.lastDirectUserMessage ?? null),

package/mods/auto-mode/hooks/is-scope-command.ts

@@ -0,0 +1,18 @@
+import { SCOPE_COMMANDS } from '../contract/scope-commands.ts';
+
+// A cheap gate before the record subprocess: options may sit between the
+// program and its subcommand, and the CLI parses the words exactly.
+const SCOPE_COMMAND_PATTERN = new RegExp(
+  Object.entries(SCOPE_COMMANDS)
+    .map(([program, commands]) => {
+      const alternatives = commands.map((command) => command.split(' ').join(String.raw`\s+`));
+
+      return String.raw`\b${program}\s[^\n]*?\b(?:${alternatives.join('|')})\b`;
+    })
+    .join('|'),
+  'u',
+);
+
+export function isScopeCommand(command: string): boolean {
+  return SCOPE_COMMAND_PATTERN.test(command);
+}

package/mods/auto-mode/hooks/is-tool-input.ts

@@ -0,0 +1,3 @@
+export function isToolInput(value: unknown): value is Readonly<Record<string, unknown>> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/mods/auto-mode/hooks/parse-decision.ts

@@ -1,11 +1,8 @@
-interface Decision {
-  readonly decision: 'allow' | 'deny';
-  readonly reason?: string;
-}
+import type { ModVerdict } from '../contract/types.ts';
 
 // The CLI ships with this mod, so any other shape is a mismatched or broken CLI,
 // and only an exact verdict may replace the prompt.
-export function parseDecision(stdout: string): Decision | null {
+export function parseDecision(stdout: string): ModVerdict | null {
   let body: unknown;
 
   try {

package/mods/auto-mode/hooks/register.ts

@@ -1,12 +1,11 @@
+import type { ModScopeRecord } from '../contract/types.ts';
+import { buildActionRequest } from './build-action-request.ts';
 import { buildPromptContext } from './build-prompt-context.ts';
+import { isScopeCommand } from './is-scope-command.ts';
+import { isToolInput } from './is-tool-input.ts';
 import { parseDecision } from './parse-decision.ts';
 import type { ModOn, ModOptions, PromptContext } from './types.ts';
 
-// Commands that can create a worktree, a branch, or a PR. Any other call skips
-// the record subprocess, so ordinary calls pay nothing for the session scope.
-const SCOPE_COMMAND =
-  /\bgit\s[^\n]*?\b(?:worktree\s+add|checkout|switch|branch)\b|\bgh\s+pr\s+create\b/u;
-
 // The record may look up a created PR's head branch with gh, which the CLI
 // bounds at 5 seconds.
 const RECORD_TIMEOUT_MS = 8000;
@@ -73,7 +72,7 @@ export function register(on: ModOn, options: ModOptions): void {
     activeCalls.set(e.tool_use_id, e.agentId ?? null);
 
     const command =
-      e.tool === 'Bash' && typeof e.command === 'string' && SCOPE_COMMAND.test(e.command)
+      e.tool === 'Bash' && typeof e.command === 'string' && isScopeCommand(e.command)
         ? e.command
         : null;
 
@@ -89,7 +88,14 @@ export function register(on: ModOn, options: ModOptions): void {
 
     if (command !== null && cwd !== null && sessionID !== null && result.deny === undefined) {
       const executable = typeof options.command === 'string' ? options.command : 'auto-mode';
-      const request = { sessionID, cwd, startedAt, command, resultText: result.text ?? '' };
+
+      const request: ModScopeRecord = {
+        sessionID,
+        cwd,
+        startedAt,
+        command,
+        resultText: result.text ?? '',
+      };
 
       try {
         await $.process.run([executable, 'record'], {
@@ -137,26 +143,17 @@ export function register(on: ModOn, options: ModOptions): void {
 
       const agentID = e.tool_use_id === undefined ? null : activeCalls.get(e.tool_use_id);
 
-      if (e.tool_use_id !== undefined && agentID === undefined) {
+      if (agentID === undefined) {
         $.ui.log(`${logPrefix} evaluation skipped; untracked tool call`, { to: 'debug' });
 
         return decided;
       }
 
-      const isChild = agentID !== null && agentID !== undefined;
-      const delegatedText = isChild ? delegatedTasks.get(agentID) : undefined;
+      if (!isToolInput(e.input)) {
+        $.ui.log(`${logPrefix} evaluation skipped; tool input is not an object`, { to: 'debug' });
 
-      const delegatedTask =
-        delegatedText === undefined ? null : { text: delegatedText, origin: 'agent.spawn' };
-
-      const omittedTaskContext = [
-        ...(prompts.originalUserTask === null
-          ? [{ field: 'originalUserTask', reason: 'unavailable' }]
-          : []),
-        ...(isChild && delegatedTask === null
-          ? [{ field: 'delegatedTask', reason: 'unavailable' }]
-          : []),
-      ];
+        return decided;
+      }
 
       const command = typeof options.command === 'string' ? options.command : 'auto-mode';
       const childTimeoutMs = EVALUATION_TIMEOUT_MS;
@@ -164,20 +161,16 @@ export function register(on: ModOn, options: ModOptions): void {
 
       $.ui.log(`${logPrefix} evaluator invoked`, { to: 'debug' });
 
-      const request = {
+      const request = buildActionRequest({
         sessionID,
-        ...(e.tool_use_id === undefined ? {} : { toolUseID: e.tool_use_id }),
+        toolUseID: e.tool_use_id,
         cwd,
         toolName: e.tool,
         toolInput: e.input,
-        context: {
-          agentID: agentID ?? null,
-          originalUserTask: prompts.originalUserTask,
-          delegatedTask,
-          lastDirectUserMessage: isChild ? null : prompts.lastDirectUserMessage,
-          omittedTaskContext,
-        },
-      };
+        agentID,
+        delegatedText: agentID === null ? undefined : delegatedTasks.get(agentID),
+        prompts,
+      });
 
       const result = await $.process.run(
         [command, 'run', '--jev-only', '--evaluation-deadline', String(deadlineAt)],

package/mods/auto-mode/hooks/types.ts

@@ -1,3 +1,5 @@
+import type { DirectUserMessage, UserTask } from '../contract/types.ts';
+
 export interface PermissionDecision {
   readonly decision: 'allow' | 'ask' | 'deny';
   readonly reason?: string;
@@ -45,15 +47,6 @@ export interface CallResult {
   readonly isError?: true;
 }
 
-export interface UserTask {
-  readonly text: string;
-  readonly origin: 'composer' | 'bridge' | 'sdk';
-}
-
-export interface DirectUserMessage extends UserTask {
-  readonly freshness?: 'stale';
-}
-
 export interface PromptContext {
   readonly originalUserTask: UserTask | null;
   readonly lastDirectUserMessage: DirectUserMessage | null;

package/mods/auto-mode/tsconfig.json

@@ -8,5 +8,6 @@
     "noEmit": true,
     "skipLibCheck": true
   },
-  "include": ["hooks/**/*.ts"]
+  "include": ["hooks/**/*.ts", "contract/**/*.ts"],
+  "exclude": ["contract/**/*.test.ts"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.17.0",
+  "version": "0.19.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",
@@ -44,8 +44,7 @@
     "audit": "bun audit",
     "bench": "bun --no-env-file src/secrets/find-secret.bench.ts",
     "build": "tsdown",
-    "build:agents": "bash scripts/build-agents-md.sh agents/shared.md agents/project.md AGENTS.md",
-    "check": "bun run format:check && bun run lint && bun run check:imports && bun run typecheck && bun run deadcode && bun run test && bun run build && bun run check:artifact && bun run publint",
+    "check": "bun run format:check && bun run lint:full && bun run check:imports && bun run typecheck && bun run deadcode && bun run test && bun run build && bun run check:artifact && bun run publint",
     "deadcode": "knip",
     "eval": "bun --no-env-file --conditions=auto-mode-eval evals/eval.ts",
     "eval:answer-guidance": "bun --no-env-file --conditions=auto-mode-eval evals/runners/run-answer-guidance-evaluation.ts",
@@ -58,8 +57,9 @@
     "first-publish": "scripts/first-publish.sh",
     "format": "oxfmt . && format-codemod --quiet .",
     "format:check": "oxfmt --check . && format-codemod --check --quiet .",
-    "lint": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
-    "lint:fix": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error --fix",
+    "lint": "oxlint",
+    "lint:fix": "oxlint --fix",
+    "lint:full": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
     "prepare": "bash scripts/link-evals-package.sh && (command -v git > /dev/null 2>&1 && lefthook install --force || true)",
     "publint": "publint",
     "test": "bun run build && bun --no-env-file test --conditions=auto-mode-eval",
@@ -80,7 +80,7 @@
     "@types/node": "26.5.1",
     "@zgeoff/bun-test-extended": "0.1.0",
     "@zgeoff/format-codemod": "0.1.0",
-    "@zgeoff/oxlint-config": "0.1.0",
+    "@zgeoff/oxlint-config": "0.2.0",
     "knip": "6.35.1",
     "lefthook": "2.1.12",
     "mitata": "1.0.34",

package/policy/rules.md

@@ -156,17 +156,25 @@ registry, or a deploy command.
 **Must name:** publish, release, or deploy, plus the target.
 
 ### Outbound Communication
-A message that reaches people outside the checkout's own repositories and outside
-the channels the user named: an email, a chat message to a person or channel the
-user did not name, a post on a public service, or an issue, comment, pull request,
-or review on a repository that is not a remote of the checkout.
+A message that reaches people the user did not ask to reach: an email, a chat
+message to a person or channel the user did not name, a post on a public service,
+an issue, comment, pull request, or review on a repository that is not a remote of
+the checkout, or a comment or review on an issue or pull request the task does not
+own.
 
 **Must name:** that the message is sent, and to whom or where.
 
-An issue, comment, pull request, or review on a repository that is a remote of
-the checkout is not this rule, whichever issue or pull request it targets. Compare
-the repository's host, owner, and name with the remotes; a lookalike name is not a
-match.
+The task's own threads on a repository that is a remote of the checkout are not
+this rule: opening the pull request or issue the task calls for, and commenting on
+or reviewing a pull request in the task scope or an issue or pull request the user
+named. Compare the repository's host, owner, and name with the remotes; a
+lookalike name is not a match.
+
+A comment or review on any other issue or pull request is this rule, even on a
+remote of the checkout, because it reaches that thread's author and readers. A
+number alone, such as `gh pr comment 498`, does not show that the pull request is
+the task's own. Without a task scope fact that lists it or a user message that
+names it, treat it as a thread the task does not own.
 
 Once the user names a channel or an outside thread, further posts to that same
 place stand for the rest of the session. This is a standing permission the rule
@@ -280,11 +288,13 @@ or a scripted delete over every key.
 **Must name:** the table or the database, and the operation.
 
 ### Persistent Configuration
-Granting access into this environment from outside it, or redirecting where
-credentials or code go: adding a key to `~/.ssh/authorized_keys`, changing
-`~/.ssh/config`, writing package registry credentials or pointing a registry at a
-new host, and the global git settings `credential.helper`, `url.<base>.insteadOf`,
-and `core.sshCommand`.
+Granting access into this environment from outside it, redirecting where
+credentials or code go, or opening credentials to other users: adding a key to
+`~/.ssh/authorized_keys`, changing `~/.ssh/config`, writing package registry
+credentials or pointing a registry at a new host, the global git settings
+`credential.helper`, `url.<base>.insteadOf`, and `core.sshCommand`, and widening
+the permissions of a credential file or directory, such as `chmod -R a+rwx ~/.ssh`
+or making a private key or `~/.aws/credentials` readable by group or others.
 
 **Must name:** the file or the setting.
 
@@ -294,10 +304,12 @@ grant, not as a file edit.
 The environment is isolated, so a change that stays inside it is not this rule:
 `crontab`, a systemd unit, a launch agent, a shell startup file, `PATH`, other
 `git config --global` keys, a detached process, `sudo`, a sudoers entry, and
-`chmod` or `chown`. Using that access against auto-mode is Policy Tampering.
+`chmod` or `chown` on anything that is not a credential. Using that access against
+auto-mode is Policy Tampering.
 
 Authenticating a tool the user asked to use, such as `npm login` before a publish
-the user asked for, is not this rule. Neither is a change that narrows access.
+the user asked for, is not this rule. Neither is a change that narrows access,
+such as `chmod 600` on a private key.
 
 ### Credential Exploration
 Printing a credential's value into the transcript, or searching broadly for keys