auto-mode 0.19.0 → 0.19.2

package/dist/cli.js

@@ -1,156 +1,21 @@
 #!/usr/bin/env node
-import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-CcVLBFKT.js";
-import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
-import { spawn } from "node:child_process";
+import { C as readHostEnvironment, T as resolveXDGDir, a as classifyAction, b as loadConfig, i as recordScope, m as writeActionDiagnostic, n as parseScopeRecordRequest, p as loadPolicy, r as parseActionRequest, t as renderVerdict, v as findGitEntry } from "./render-verdict-DBcgB5CC.js";
+import { chmod, mkdir, open, realpath, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
-import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 import { parseArgs } from "node:util";
-import { setTimeout } from "node:timers/promises";
-//#region src/budget/build-retry-key.ts
-const DESCRIPTIVE_FIELDS = { Bash: [
-	"description",
-	"timeout",
-	"run_in_background"
-] };
-function buildRetryKey(request) {
-	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
-	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
-	const message = request.decisionContext?.lastDirectUserMessage ?? null;
-	const canonical = JSON.stringify(sortKeys({
-		cwd: request.cwd,
-		toolName: request.toolName,
-		toolInput: input,
-		lastDirectUserMessage: message?.text ?? null,
-		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
-	}));
-	return createHash("sha256").update(canonical).digest("hex");
-}
-function sortKeys(value) {
-	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
-	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
-	return value;
-}
-//#endregion
-//#region src/budget/find-retry-deny.ts
-function findRetryDeny(state, retryKey) {
-	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
-	return {
-		kind: "deny",
-		rule: state.lastDenied.rule,
-		reason: state.lastDenied.reason
-	};
-}
-//#endregion
-//#region src/budget/types.ts
-const EMPTY_DENIAL_STATE = {
-	consecutive: 0,
-	session: 0,
-	lastDenied: null
-};
-//#endregion
-//#region src/budget/load-denial-state.ts
-const count = number().int().nonnegative();
-const stateSchema = strictObject({
-	consecutive: count,
-	session: count,
-	lastDenied: strictObject({
-		retryKey: string().min(1),
-		rule: string(),
-		reason: string()
-	}).nullable()
-});
-async function loadDenialState(path) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch {
-		return EMPTY_DENIAL_STATE;
-	}
-	try {
-		const parsed = stateSchema.safeParse(JSON.parse(raw));
-		return parsed.success ? parsed.data : EMPTY_DENIAL_STATE;
-	} catch {
-		return EMPTY_DENIAL_STATE;
-	}
-}
-//#endregion
-//#region src/budget/plan-denial-budget.ts
-function planDenialBudget(state, verdict, retryKey, budget) {
-	if (verdict === null) return {
-		verdict: null,
-		state,
-		escalation: false
-	};
-	if (verdict.kind === "allow") return {
-		verdict,
-		state: {
-			...state,
-			consecutive: 0,
-			lastDenied: null
-		},
-		escalation: false
-	};
-	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
-		verdict: null,
-		state: EMPTY_DENIAL_STATE,
-		escalation: true
-	};
-	const next = {
-		consecutive: state.consecutive + 1,
-		session: state.session + 1,
-		lastDenied: {
-			retryKey,
-			rule: verdict.rule,
-			reason: verdict.reason
-		}
-	};
-	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
-	return {
-		verdict: {
-			...verdict,
-			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
-		},
-		state: next,
-		escalation: false
-	};
-}
-function formatDenialsLeft(left) {
-	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
-	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
-}
-//#endregion
-//#region src/budget/resolve-denial-state-path.ts
-function resolveDenialStatePath(request, stateDir) {
-	const agentID = request.decisionContext?.agentID ?? "";
-	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
-	return join(stateDir, "denials", `${key}.json`);
-}
-//#endregion
-//#region src/budget/write-denial-state.ts
-async function writeDenialState(path, state) {
-	const staged = `${path}.${randomUUID()}.tmp`;
-	await mkdir(dirname(path), {
-		recursive: true,
-		mode: 448
-	});
-	await writeFile(staged, `${JSON.stringify(state)}\n`, { mode: 384 });
-	await rename(staged, path);
-}
-//#endregion
 //#region src/capture/resolve-capture-dir.ts
 function resolveCaptureDir(capture, host) {
-	return capture.dir ?? join(resolveStateDir(host), "captures");
+	return capture.dir ?? join(resolveXDGDir(host, "state"), "captures");
 }
 //#endregion
 //#region src/capture/find-enclosing-work-tree.ts
 async function findEnclosingWorkTree(path) {
 	const real = await resolveExistingPrefix(resolve(path));
-	for (let directory = real;; directory = dirname(directory)) {
-		if (await hasGitEntry(directory)) return directory;
-		if (dirname(directory) === directory) return null;
-	}
+	const entry = await findGitEntry(real);
+	return entry === null ? null : entry.directory;
 }
 async function resolveExistingPrefix(path) {
 	const missing = [];
@@ -161,15 +26,6 @@ async function resolveExistingPrefix(path) {
 		missing.push(basename(current));
 	}
 }
-const ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
-async function hasGitEntry(directory) {
-	try {
-		await lstat(join(directory, ".git"));
-		return true;
-	} catch (error) {
-		return !(error instanceof Error && "code" in error && ABSENT_CODES.has(String(error.code)));
-	}
-}
 //#endregion
 //#region src/capture/try-write-request-capture.ts
 async function tryWriteRequestCapture(dir, record) {
@@ -227,53 +83,6 @@ function buildJevOnlyConfig(config) {
 	};
 }
 //#endregion
-//#region src/diagnostics/write-action-diagnostic.ts
-async function writeActionDiagnostic(payload, entry, host, warnings) {
-	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(host), "actions.jsonl");
-	if (path === "") return;
-	const record = {
-		schemaVersion: 4,
-		time: (/* @__PURE__ */ new Date()).toISOString(),
-		invocationID: entry.invocationID,
-		sessionHash: toHash(payload.sessionID),
-		actionHash: payload.toolUseID === void 0 ? null : toHash(payload.toolUseID),
-		status: entry.status,
-		verdict: entry.verdict ?? null,
-		decidingStage: entry.decidingStage ?? null,
-		denials: entry.denials ?? null,
-		escalation: entry.escalation ?? false,
-		diagnostics: entry.diagnostics ?? null,
-		judge: entry.judge ?? null
-	};
-	try {
-		await mkdir(dirname(path), {
-			recursive: true,
-			mode: 448
-		});
-		await appendFile(path, `${JSON.stringify(record)}\n`, { mode: 384 });
-	} catch {
-		warnings.write("auto-mode: diagnostics unavailable\n");
-	}
-}
-function toHash(value) {
-	return createHash("sha256").update(value).digest("hex").slice(0, 16);
-}
-//#endregion
-//#region src/request/scope-record-request-schema.ts
-const scopeRecordRequestSchema = strictObject({
-	sessionID: string().min(1),
-	cwd: string().min(1),
-	startedAt: number().int().positive(),
-	command: string().min(1),
-	resultText: string()
-});
-//#endregion
-//#region src/request/parse-scope-record-request.ts
-function parseScopeRecordRequest(body) {
-	const parsed = scopeRecordRequestSchema.safeParse(body);
-	return parsed.success ? parsed.data : null;
-}
-//#endregion
 //#region src/request/to-mod-request.ts
 function toModRequest(request) {
 	const context = request.decisionContext;
@@ -290,314 +99,18 @@ function toModRequest(request) {
 	};
 }
 //#endregion
-//#region src/scope/read-pull-request.ts
-const LOOKUP_TIMEOUT_MS = 5e3;
-function readPullRequest(repository, number, options = {}) {
-	const [file, ...prefix] = options.command ?? ["gh"];
-	const args = [
-		"pr",
-		"view",
-		String(number),
-		"--repo",
-		repository,
-		"--json",
-		"headRefName,createdAt"
-	];
-	return new Promise((resolve) => {
-		const child = spawn(file, [
-			...prefix,
-			...args,
-			"--jq",
-			"[.headRefName, .createdAt] | @tsv"
-		], {
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			],
-			timeout: options.timeoutMs ?? LOOKUP_TIMEOUT_MS
-		});
-		let output = "";
-		child.stdout.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			output += chunk;
-		});
-		child.on("error", () => {
-			resolve(null);
-		});
-		child.on("close", (code) => {
-			const [head = "", created = ""] = output.trim().split("	");
-			const createdAt = Date.parse(created);
-			resolve(code === 0 && head !== "" && !Number.isNaN(createdAt) ? {
-				head,
-				createdAt
-			} : null);
-		});
-	});
-}
-//#endregion
-//#region src/scope/collect-pull-request-addresses.ts
-function collectPullRequestAddresses(text) {
-	const addresses = /* @__PURE__ */ new Map();
-	for (const match of text.matchAll(PULL_REQUEST_URL)) {
-		const repository = toRepositorySlug(`https://${match.groups?.["repository"] ?? ""}`);
-		const number = Number(match.groups?.["number"]);
-		if (repository !== null) addresses.set(`${repository}#${String(number)}`, {
-			repository,
-			number
-		});
-	}
-	return [...addresses.values()];
-}
-const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
-//#endregion
-//#region mods/auto-mode/contract/scope-commands.ts
-const SCOPE_COMMANDS = {
-	git: [
-		"worktree add",
-		"checkout",
-		"switch",
-		"branch"
-	],
-	gh: ["pr create"]
-};
-//#endregion
-//#region src/scope/collect-scope-events.ts
-function collectScopeEvents(command, cwd, home) {
-	const events = [];
-	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
-	let directory = cwd;
-	for (const segment of splitShellCommand(command).segments) {
-		const [name, ...args] = splitCommandWords(segment.text);
-		if (name === "cd") directory = hasPipe ? null : resolvePath(directory, args[0] ?? home, home);
-		else if (name === "git" && directory !== null) events.push(...collectGitEvents(args, directory, home));
-		else if (name === "gh" && directory !== null && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null) events.push({
-			kind: "pull-request",
-			directory,
-			head: findOptionValue(args, ["--head", "-H"])
-		});
-	}
-	return events;
-}
-function collectGitEvents(args, cwd, home) {
-	let directory = cwd;
-	let index = 0;
-	while (index < args.length && args[index]?.startsWith("-") === true) {
-		if (args[index] === "-C") directory = resolvePath(directory, args[index + 1] ?? "", home);
-		index += args[index] === "-C" || args[index] === "-c" ? 2 : 1;
-	}
-	const found = findScopeCommand(SCOPE_COMMANDS.git, args.slice(index));
-	if (directory === null || found === null) return [];
-	return GIT_EVENT_COLLECTORS[found.command](found.rest, directory, home);
-}
-function findScopeCommand(commands, args) {
-	for (const command of commands) {
-		const words = command.split(" ");
-		if (words.every((word, index) => args[index] === word)) return {
-			command,
-			rest: args.slice(words.length)
-		};
-	}
-	return null;
-}
-const GIT_EVENT_COLLECTORS = {
-	"worktree add": collectWorktreeEvents,
-	checkout: collectSwitchEvents,
-	switch: collectSwitchEvents,
-	branch: collectBranchEvents
-};
-function collectWorktreeEvents(rest, directory, home) {
-	const path = findWorktreePath(rest);
-	const resolved = path === null ? null : resolvePath(directory, path, home);
-	return resolved === null ? [] : [{
-		kind: "worktree",
-		path: resolved
-	}];
-}
-const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"--reason"
-]);
-function findWorktreePath(args) {
-	for (let index = 0; index < args.length; index += 1) {
-		const word = args[index] ?? "";
-		if (WORKTREE_VALUE_OPTIONS.has(word)) index += 1;
-		else if (!word.startsWith("-")) return word;
-	}
-	return null;
-}
-const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"-c",
-	"-C",
-	"--create",
-	"--force-create"
-]);
-const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
-function collectSwitchEvents(rest, directory) {
-	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
-	return name === null ? [] : [{
-		kind: "branch",
-		name,
-		directory
-	}];
-}
-function collectBranchEvents(rest, directory) {
-	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
-	const name = rest.find((word) => !word.startsWith("-"));
-	return name === void 0 || isUnresolved(name) ? [] : [{
-		kind: "branch",
-		name,
-		directory
-	}];
-}
-function findOptionValue(args, options) {
-	const index = args.findIndex((word) => options.includes(word));
-	const value = index === -1 ? void 0 : args[index + 1];
-	return value === void 0 || isUnresolved(value) ? null : value;
-}
-function isUnresolved(word) {
-	return /[$`]/u.test(word);
-}
-function resolvePath(directory, path, home) {
-	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
-	if (isUnresolved(expanded) || expanded.startsWith("~") || expanded === "") return null;
-	if (!isAbsolute(expanded) && directory === null) return null;
-	const absolute = isAbsolute(expanded) || directory === null ? expanded : join(directory, expanded);
-	return normalize(absolute).replace(/(?<=.)\/$/u, "");
-}
-//#endregion
-//#region src/scope/merge-session-scope.ts
-function mergeSessionScope(all) {
-	const branches = /* @__PURE__ */ new Map();
-	const pullRequests = /* @__PURE__ */ new Map();
-	for (const branch of all.flatMap((scope) => scope.branches)) branches.set(`${branch.commonDir}\0${branch.name}`, branch);
-	for (const pull of all.flatMap((scope) => scope.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
-	return {
-		worktrees: [...new Set(all.flatMap((scope) => scope.worktrees))],
-		branches: [...branches.values()],
-		pullRequests: [...pullRequests.values()]
-	};
-}
-//#endregion
-//#region src/scope/read-branch-created-at.ts
-async function readBranchCreatedAt(commonDir, branch) {
-	if (!/^[\w./-]+$/u.test(branch) || branch.split("/").includes("..")) return null;
-	const [first = ""] = (await readFile(join(commonDir, "logs", "refs", "heads", branch), "utf8").catch(() => "")).split("\n");
-	const seconds = /^0+ [\da-f]+ .* (?<time>\d+) [+-]\d{4}\t/u.exec(first)?.groups?.["time"];
-	return seconds === void 0 ? null : Number(seconds) * 1e3;
-}
-//#endregion
-//#region src/scope/write-session-scope.ts
-const SYSTEM_CLOCK = {
-	now: Date.now,
-	wait: (ms) => setTimeout(ms)
-};
-async function writeSessionScope(path, added, clock = SYSTEM_CLOCK) {
-	await mkdir(dirname(path), {
-		recursive: true,
-		mode: 448
-	});
-	const lock = `${path}.lock`;
-	await claimLock(lock, clock);
-	try {
-		const merged = mergeSessionScope([await loadSessionScope(path), added]);
-		const staged = `${path}.${randomUUID()}.tmp`;
-		await writeFile(staged, `${JSON.stringify(merged)}\n`, { mode: 384 });
-		await rename(staged, path);
-	} finally {
-		await rm(lock, { force: true });
-	}
-}
-const STALE_LOCK_MS = 1e4;
-const LOCK_WAIT_MS = 3e3;
-const LOCK_POLL_MS = 10;
-async function claimLock(lock, clock) {
-	const deadline = clock.now() + LOCK_WAIT_MS;
-	for (;;) {
-		try {
-			await (await open(lock, "wx", 384)).close();
-			return;
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
-		}
-		const held = await stat(lock).catch(() => null);
-		if (held !== null && clock.now() - held.mtimeMs > STALE_LOCK_MS) await rm(lock, { force: true });
-		else if (clock.now() > deadline) throw new Error("session scope lock unavailable");
-		else await clock.wait(LOCK_POLL_MS);
-	}
-}
-//#endregion
-//#region src/scope/update-session-scope.ts
-const MAX_CALL_AGE_MS = 9e5;
-async function updateSessionScope(request, options) {
-	const age = options.now - request.startedAt;
-	if (age < -6e4 || age > MAX_CALL_AGE_MS) return EMPTY_SESSION_SCOPE;
-	const events = collectScopeEvents(request.command, request.cwd, options.home);
-	const scope = mergeSessionScope(await Promise.all(events.map((event) => tryVerifyScopeEvent(event, request, options))));
-	if (scope.worktrees.length + scope.branches.length + scope.pullRequests.length > 0) await writeSessionScope(resolveSessionScopePath(options.stateDir, request.sessionID), scope, options.lockClock);
-	return scope;
-}
-async function tryVerifyScopeEvent(event, request, options) {
-	try {
-		return await (options.verifyEvent === void 0 ? verifyScopeEvent(event, request, options) : options.verifyEvent(event, request));
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
-}
-const FORGE_CLOCK_SKEW_MS = 6e4;
-const FILE_CLOCK_SLACK_MS = 50;
-async function verifyScopeEvent(event, request, options) {
-	if (event.kind === "worktree") {
-		const link = await stat(join(event.path, ".git"));
-		const checkout = await findCheckout(event.path, options.env);
-		if (!link.isFile() || link.mtimeMs < request.startedAt - FILE_CLOCK_SLACK_MS || checkout?.worktree !== event.path) return EMPTY_SESSION_SCOPE;
-		const branch = (await loadRepositoryContext(event.path, options.env))?.branch ?? null;
-		if (branch === null) return {
-			...EMPTY_SESSION_SCOPE,
-			worktrees: [event.path]
-		};
-		const isNew = await isBranchCreatedSince(checkout.commonDir, branch, request.startedAt);
-		return {
-			...EMPTY_SESSION_SCOPE,
-			worktrees: [event.path],
-			branches: isNew ? [{
-				name: branch,
-				commonDir: checkout.commonDir
-			}] : []
-		};
-	}
-	const checkout = await findCheckout(event.directory, options.env);
-	if (checkout === null) return EMPTY_SESSION_SCOPE;
-	if (event.kind === "branch") return await isBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
-		...EMPTY_SESSION_SCOPE,
-		branches: [{
-			name: event.name,
-			commonDir: checkout.commonDir
-		}]
-	} : EMPTY_SESSION_SCOPE;
-	const remotes = await loadCheckoutRemotes(checkout.commonDir);
-	const repositories = new Set(remotes.map((remote) => toRepositorySlug(remote.url)));
-	const addresses = collectPullRequestAddresses(request.resultText).filter((address) => repositories.has(address.repository));
-	const pulls = await Promise.all(addresses.map(async (address) => {
-		const pull = await options.readPullRequest(address.repository, address.number);
-		return pull !== null && pull.createdAt >= request.startedAt - FORGE_CLOCK_SKEW_MS ? [{
-			...address,
-			head: pull.head
-		}] : [];
-	}));
-	return {
-		...EMPTY_SESSION_SCOPE,
-		pullRequests: pulls.flat()
-	};
-}
-async function isBranchCreatedSince(commonDir, branch, since) {
-	const createdAt = await readBranchCreatedAt(commonDir, branch);
-	if (createdAt === null || createdAt < Math.floor(since / 1e3) * 1e3) return false;
-	const ref = await stat(join(commonDir, "refs", "heads", branch)).catch(() => null);
-	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
+//#region src/write-action-failure.ts
+async function writeActionFailure(request, host, stderr) {
+	const invocationID = randomUUID();
+	await writeActionDiagnostic(request, {
+		invocationID,
+		status: "started"
+	}, host, stderr);
+	await writeActionDiagnostic(request, {
+		invocationID,
+		status: "failure",
+		verdict: "defer"
+	}, host, stderr);
 }
 //#endregion
 //#region src/run-cli.ts
@@ -617,22 +130,11 @@ Options:
   --evaluation-deadline <unix-ms>  With --jev-only: share the helper and API deadline
 `;
 async function runCLI(argv, io) {
-	const args = parseArgs({
-		args: [...argv],
-		allowPositionals: true,
-		options: {
-			classifier: { type: "string" },
-			rules: { type: "string" },
-			explain: { type: "boolean" },
-			"local-only": { type: "boolean" },
-			"jev-only": { type: "boolean" },
-			"evaluation-deadline": { type: "string" },
-			help: {
-				type: "boolean",
-				short: "h"
-			}
-		}
-	});
+	const args = tryParseCLIArgs(argv);
+	if (args instanceof Error) {
+		io.stderr.write(`auto-mode: ${args.message}\n\n${USAGE}`);
+		return 2;
+	}
 	const [command] = args.positionals;
 	if (args.values.help === true || command === void 0) {
 		io.stdout.write(USAGE);
@@ -659,6 +161,28 @@ async function runCLI(argv, io) {
 	io.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
 	return 2;
 }
+function tryParseCLIArgs(argv) {
+	try {
+		return parseArgs({
+			args: [...argv],
+			allowPositionals: true,
+			options: {
+				classifier: { type: "string" },
+				rules: { type: "string" },
+				explain: { type: "boolean" },
+				"local-only": { type: "boolean" },
+				"jev-only": { type: "boolean" },
+				"evaluation-deadline": { type: "string" },
+				help: {
+					type: "boolean",
+					short: "h"
+				}
+			}
+		});
+	} catch (error) {
+		return error instanceof Error ? error : new Error(String(error));
+	}
+}
 async function run(io, explain, localOnly, jevOnly, deadline) {
 	const raw = await io.stdin();
 	let body;
@@ -670,39 +194,22 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 	const request = parseActionRequest(body);
 	if (request === null) return printNote(io.stderr, explain, "not an action request this classifier judges, so no verdict");
 	const host = io.host;
-	const invocationID = randomUUID();
-	await writeActionDiagnostic(request, {
-		invocationID,
-		status: "started"
-	}, host, io.stderr);
 	let loaded;
 	try {
 		loaded = await loadConfig(void 0, host);
 	} catch {
-		await writeActionDiagnostic(request, {
-			invocationID,
-			status: "failure",
-			verdict: "defer"
-		}, host, io.stderr);
+		await writeActionFailure(request, host, io.stderr);
 		return printNote(io.stderr, true, "configuration unreadable; no verdict");
 	}
 	printWarnings(io.stderr, loaded.warnings);
 	const config = jevOnly ? buildJevOnlyConfig(loaded) : loaded;
 	if (config === null) {
-		await writeActionDiagnostic(request, {
-			invocationID,
-			status: "failure",
-			verdict: "defer"
-		}, host, io.stderr);
+		await writeActionFailure(request, host, io.stderr);
 		return printNote(io.stderr, true, "Jev-only evaluation requires system-one; no verdict");
 	}
 	const deadlineAt = deadline === void 0 ? void 0 : Number(deadline);
 	if (deadlineAt !== void 0 && (!jevOnly || !Number.isSafeInteger(deadlineAt) || deadlineAt <= 0)) {
-		await writeActionDiagnostic(request, {
-			invocationID,
-			status: "failure",
-			verdict: "defer"
-		}, host, io.stderr);
+		await writeActionFailure(request, host, io.stderr);
 		return printNote(io.stderr, true, "invalid Jev evaluation deadline; no verdict");
 	}
 	const controller = new AbortController();
@@ -710,52 +217,28 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 		controller.abort();
 	}) : null;
 	try {
-		const statePath = resolveDenialStatePath(request, resolveStateDir(host));
-		const retryKey = buildRetryKey(request);
-		const before = await loadDenialState(statePath);
-		const retry = findRetryDeny(before, retryKey);
-		const outcome = retry === null ? await classifyAction(request, config, {
+		const outcome = await classifyAction(request, config, {
 			localOnly,
 			deadlineAt,
 			signal: controller.signal,
 			host,
-			stderr: io.stderr
-		}) : {
-			verdict: retry,
-			decidingStage: "retry",
-			note: "retry of the action just denied; denied again",
-			status: "deny"
-		};
-		const latest = retry === null ? await loadDenialState(statePath) : before;
-		const plan = planDenialBudget(latest, outcome.verdict, retryKey, config.denialBudget ?? DEFAULT_DENIAL_BUDGET);
-		if (plan.state !== latest) await tryWriteDenialState(io.stderr, statePath, plan.state);
-		if (plan.verdict !== null) printVerdict(io.stdout, plan.verdict);
-		await writeActionDiagnostic(request, {
-			invocationID,
-			status: outcome.status,
-			verdict: plan.verdict?.kind ?? "defer",
-			decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
-			denials: {
-				consecutive: plan.state.consecutive,
-				session: plan.state.session
-			},
-			escalation: plan.escalation,
-			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics },
-			...outcome.judge === void 0 ? {} : { judge: outcome.judge }
-		}, host, io.stderr);
+			stderr: io.stderr,
+			budget: true,
+			actionLog: true
+		});
+		if (outcome.verdict !== null) printVerdict(io.stdout, outcome.verdict);
 		if (config.capture?.enabled === true) {
 			const captured = await tryWriteRequestCapture(resolveCaptureDir(config.capture, host), {
 				schemaVersion: 1,
 				time: (/* @__PURE__ */ new Date()).toISOString(),
 				request: toModRequest(request),
-				verdict: plan.verdict,
-				decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
-				escalation: plan.escalation
+				verdict: outcome.verdict,
+				decidingStage: outcome.decidingStage,
+				escalation: outcome.escalation ?? false
 			});
 			printCaptureNote(io.stderr, captured);
 		}
-		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
-		return printNote(io.stderr, explain || outcome.unavailable === true, note);
+		return printNote(io.stderr, explain || outcome.unavailable === true, outcome.note);
 	} finally {
 		unsubscribe?.();
 	}
@@ -767,13 +250,6 @@ function printNote(stderr, explain, message) {
 function printWarnings(stderr, warnings = []) {
 	for (const warning of warnings) stderr.write(`auto-mode: ${warning}\n`);
 }
-async function tryWriteDenialState(stderr, path, state) {
-	try {
-		await writeDenialState(path, state);
-	} catch {
-		stderr.write("auto-mode: denial counts unavailable\n");
-	}
-}
 function printVerdict(stdout, verdict) {
 	stdout.write(renderVerdict(verdict));
 }
@@ -793,13 +269,7 @@ async function runRecord(io) {
 	if (request === null) return 0;
 	try {
 		const config = await loadConfig(void 0, io.host);
-		if (Object.values(config.scopeSources ?? DEFAULT_SCOPE_SOURCES).some((source) => source.kind === "session")) await updateSessionScope(request, {
-			now: Date.now(),
-			stateDir: resolveStateDir(io.host),
-			home: io.host.home,
-			env: io.host.env,
-			readPullRequest
-		});
+		await recordScope(request, config, { host: io.host });
 	} catch {
 		io.stderr.write("auto-mode: session scope unavailable\n");
 	}