auto-mode 0.18.0 → 0.19.1

package/mods/auto-mode/contract/types.ts

@@ -11,7 +11,7 @@ export interface DirectUserMessage extends UserTask {
   readonly freshness?: 'stale' | undefined;
 }
 
-export interface DelegatedTask {
+interface DelegatedTask {
   readonly text: string;
   readonly origin: 'agent.spawn';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.18.0",
+  "version": "0.19.1",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",
@@ -44,8 +44,7 @@
     "audit": "bun audit",
     "bench": "bun --no-env-file src/secrets/find-secret.bench.ts",
     "build": "tsdown",
-    "build:agents": "bash scripts/build-agents-md.sh agents/shared.md agents/project.md AGENTS.md",
-    "check": "bun run format:check && bun run lint && bun run check:imports && bun run typecheck && bun run deadcode && bun run test && bun run build && bun run check:artifact && bun run publint",
+    "check": "bun run format:check && bun run lint:full && bun run typecheck && bun run deadcode && bun run test && bun run build && bun run check:artifact && bun run publint",
     "deadcode": "knip",
     "eval": "bun --no-env-file --conditions=auto-mode-eval evals/eval.ts",
     "eval:answer-guidance": "bun --no-env-file --conditions=auto-mode-eval evals/runners/run-answer-guidance-evaluation.ts",
@@ -58,15 +57,18 @@
     "first-publish": "scripts/first-publish.sh",
     "format": "oxfmt . && format-codemod --quiet .",
     "format:check": "oxfmt --check . && format-codemod --check --quiet .",
-    "lint": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
-    "lint:fix": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error --fix",
+    "lint": "oxlint",
+    "lint:actionlint": "actionlint",
+    "lint:fix": "oxlint --fix",
+    "lint:full": "oxlint --type-aware --type-check --report-unused-disable-directives-severity error",
+    "lint:shellcheck": "shellcheck scripts/*.sh .claude/skills/docs-writing/scripts/*.sh",
+    "lint:shfmt": "shfmt -d scripts/*.sh",
     "prepare": "bash scripts/link-evals-package.sh && (command -v git > /dev/null 2>&1 && lefthook install --force || true)",
     "publint": "publint",
     "test": "bun run build && bun --no-env-file test --conditions=auto-mode-eval",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p evals/tsconfig.json --noEmit",
     "check:artifact": "bun --no-env-file scripts/check-artifact.ts",
-    "check:claude-mod": "bash scripts/check-claude-mod.sh",
-    "check:imports": "bun --no-env-file scripts/check-imports.ts",
+    "check:claude-mod": "bun --no-env-file scripts/check-claude-mod.ts",
     "files:branch": "bun scripts/collect-branch-files.ts",
     "lint:files": "oxlint --no-error-on-unmatched-pattern",
     "test:related": "bun scripts/run-related-tests.ts"
@@ -80,12 +82,11 @@
     "@types/node": "26.5.1",
     "@zgeoff/bun-test-extended": "0.1.0",
     "@zgeoff/format-codemod": "0.1.0",
-    "@zgeoff/oxlint-config": "0.1.0",
+    "@zgeoff/oxlint-config": "0.2.1",
     "knip": "6.35.1",
     "lefthook": "2.1.12",
     "mitata": "1.0.34",
     "msw": "2.15.0",
-    "oxc-parser": "0.137.0",
     "oxfmt": "0.67.0",
     "oxlint": "1.82.0",
     "oxlint-tsgolint": "7.0.2001",

package/policy/rules.md

@@ -156,17 +156,25 @@ registry, or a deploy command.
 **Must name:** publish, release, or deploy, plus the target.
 
 ### Outbound Communication
-A message that reaches people outside the checkout's own repositories and outside
-the channels the user named: an email, a chat message to a person or channel the
-user did not name, a post on a public service, or an issue, comment, pull request,
-or review on a repository that is not a remote of the checkout.
+A message that reaches people the user did not ask to reach: an email, a chat
+message to a person or channel the user did not name, a post on a public service,
+an issue, comment, pull request, or review on a repository that is not a remote of
+the checkout, or a comment or review on an issue or pull request the task does not
+own.
 
 **Must name:** that the message is sent, and to whom or where.
 
-An issue, comment, pull request, or review on a repository that is a remote of
-the checkout is not this rule, whichever issue or pull request it targets. Compare
-the repository's host, owner, and name with the remotes; a lookalike name is not a
-match.
+The task's own threads on a repository that is a remote of the checkout are not
+this rule: opening the pull request or issue the task calls for, and commenting on
+or reviewing a pull request in the task scope or an issue or pull request the user
+named. Compare the repository's host, owner, and name with the remotes; a
+lookalike name is not a match.
+
+A comment or review on any other issue or pull request is this rule, even on a
+remote of the checkout, because it reaches that thread's author and readers. A
+number alone, such as `gh pr comment 498`, does not show that the pull request is
+the task's own. Without a task scope fact that lists it or a user message that
+names it, treat it as a thread the task does not own.
 
 Once the user names a channel or an outside thread, further posts to that same
 place stand for the rest of the session. This is a standing permission the rule
@@ -280,11 +288,13 @@ or a scripted delete over every key.
 **Must name:** the table or the database, and the operation.
 
 ### Persistent Configuration
-Granting access into this environment from outside it, or redirecting where
-credentials or code go: adding a key to `~/.ssh/authorized_keys`, changing
-`~/.ssh/config`, writing package registry credentials or pointing a registry at a
-new host, and the global git settings `credential.helper`, `url.<base>.insteadOf`,
-and `core.sshCommand`.
+Granting access into this environment from outside it, redirecting where
+credentials or code go, or opening credentials to other users: adding a key to
+`~/.ssh/authorized_keys`, changing `~/.ssh/config`, writing package registry
+credentials or pointing a registry at a new host, the global git settings
+`credential.helper`, `url.<base>.insteadOf`, and `core.sshCommand`, and widening
+the permissions of a credential file or directory, such as `chmod -R a+rwx ~/.ssh`
+or making a private key or `~/.aws/credentials` readable by group or others.
 
 **Must name:** the file or the setting.
 
@@ -294,10 +304,12 @@ grant, not as a file edit.
 The environment is isolated, so a change that stays inside it is not this rule:
 `crontab`, a systemd unit, a launch agent, a shell startup file, `PATH`, other
 `git config --global` keys, a detached process, `sudo`, a sudoers entry, and
-`chmod` or `chown`. Using that access against auto-mode is Policy Tampering.
+`chmod` or `chown` on anything that is not a credential. Using that access against
+auto-mode is Policy Tampering.
 
 Authenticating a tool the user asked to use, such as `npm login` before a publish
-the user asked for, is not this rule. Neither is a change that narrows access.
+the user asked for, is not this rule. Neither is a change that narrows access,
+such as `chmod 600` on a private key.
 
 ### Credential Exploration
 Printing a credential's value into the transcript, or searching broadly for keys