auto-mode 0.4.4 → 0.6.0

package/mods/auto-mode/hooks/build-prompt-context.claude-check.ts

@@ -14,7 +14,6 @@ test('it keeps the original human task separate from later instructions', () =>
   expect(later).toStrictEqual({
     originalUserTask: { text: 'Build the parser', origin: 'composer' },
     lastDirectUserMessage: { text: 'Do not push', origin: 'bridge' },
-    hasPrompt: true,
     canCaptureOriginal: true,
   });
 });

package/mods/auto-mode/hooks/build-prompt-context.ts

@@ -14,7 +14,6 @@ export function buildPromptContext(
     return {
       originalUserTask: null,
       lastDirectUserMessage: null,
-      hasPrompt: false,
       canCaptureOriginal: input.source === 'startup' || input.source === 'clear',
     };
   }
@@ -31,7 +30,6 @@ export function buildPromptContext(
       previous?.originalUserTask ??
       (previous?.canCaptureOriginal === true ? lastDirectUserMessage : null),
     lastDirectUserMessage,
-    hasPrompt: true,
     canCaptureOriginal: previous?.canCaptureOriginal ?? false,
   };
 }

package/mods/auto-mode/hooks/parse-decision.ts

@@ -3,6 +3,8 @@ interface Decision {
   readonly reason?: string;
 }
 
+// The CLI ships with this mod, so any other shape is a mismatched or broken CLI,
+// and only an exact verdict may replace the prompt.
 export function parseDecision(stdout: string): Decision | null {
   let body: unknown;
 
@@ -12,39 +14,25 @@ export function parseDecision(stdout: string): Decision | null {
     return null;
   }
 
-  if (typeof body !== 'object' || body === null || !('hookSpecificOutput' in body)) {
+  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
     return null;
   }
 
-  const output = body.hookSpecificOutput;
+  const keys = Object.keys(body).toSorted().join(',');
 
-  if (
-    typeof output !== 'object' ||
-    output === null ||
-    !('hookEventName' in output) ||
-    output.hookEventName !== 'PermissionRequest' ||
-    !('decision' in output)
-  ) {
-    return null;
-  }
-
-  const value = output.decision;
-
-  if (typeof value !== 'object' || value === null || !('behavior' in value)) {
-    return null;
-  }
-
-  if (value.behavior === 'allow') {
+  if (keys === 'decision' && 'decision' in body && body.decision === 'allow') {
     return { decision: 'allow' };
   }
 
   if (
-    value.behavior === 'deny' &&
-    'message' in value &&
-    typeof value.message === 'string' &&
-    value.message.trim() !== ''
+    keys === 'decision,reason' &&
+    'decision' in body &&
+    body.decision === 'deny' &&
+    'reason' in body &&
+    typeof body.reason === 'string' &&
+    body.reason.trim() !== ''
   ) {
-    return { decision: 'deny', reason: value.message };
+    return { decision: 'deny', reason: body.reason };
   }
 
   return null;

package/mods/auto-mode/hooks/register.claude-check.ts

@@ -1,5 +1,13 @@
 import { expect, test } from 'claude-code/testing';
 
+const NO_PROMPT_CONTEXT = {
+  agentID: null,
+  originalUserTask: null,
+  delegatedTask: null,
+  lastDirectUserMessage: null,
+  omittedTaskContext: [{ field: 'originalUserTask', reason: 'unavailable' }],
+};
+
 test('it preserves an existing denial and its rule', async ($, on) => {
   const decided = {
     decision: 'deny',
@@ -20,8 +28,7 @@ test('it preserves an existing denial and its rule', async ($, on) => {
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+        stdout: '{"decision":"allow"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -66,8 +73,7 @@ test('it preserves an existing allowance without a second evaluator', async ($,
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"deny","message":"[Data Exfiltration] Refuse the transfer."}}}',
+        stdout: '{"decision":"deny","reason":"[Data Exfiltration] Refuse the transfer."}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -118,8 +124,7 @@ test('it approves an ask after Jev allows the action', async ($, on) => {
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+        stdout: '{"decision":"allow"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -146,13 +151,11 @@ test('it approves an ask after Jev allows the action', async ($, on) => {
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -187,8 +190,7 @@ test('it refuses an ask after Jev denies the action', async ($, on) => {
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"deny","message":"[Data Exfiltration] Refuse the transfer."}}}',
+        stdout: '{"decision":"deny","reason":"[Data Exfiltration] Refuse the transfer."}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -219,13 +221,11 @@ test('it refuses an ask after Jev denies the action', async ($, on) => {
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -287,13 +287,11 @@ test('it retains manual approval when Jev returns no opinion', async ($, on) =>
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -355,13 +353,11 @@ test('it retains manual approval for malformed JSON without copying diagnostics'
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -370,7 +366,7 @@ test('it retains manual approval for malformed JSON without copying diagnostics'
   });
 });
 
-test('it retains manual approval for a verdict from another event', async ($, on) => {
+test('it retains manual approval for a hook-shaped verdict', async ($, on) => {
   const decided = {
     decision: 'ask',
     reason: 'Existing permission decision',
@@ -424,13 +420,11 @@ test('it retains manual approval for a verdict from another event', async ($, on
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -439,6 +433,47 @@ test('it retains manual approval for a verdict from another event', async ($, on
   });
 });
 
+test('it retains manual approval for a verdict with unknown or mistyped fields', async ($, on) => {
+  const outputs = [
+    '{"decision":"allow","reason":123}',
+    '{"decision":"allow","rule":"Read-only actions"}',
+    '{"decision":"deny","reason":"[Data Exfiltration] Refuse the transfer.","extra":true}',
+    '{"decision":"deny","reason":42}',
+    '["allow"]',
+  ];
+
+  let stdout = '';
+
+  on('classic.SessionStart', () => ({}));
+  on('session.cwd', () => ({ value: '/repo' }));
+  on('tool.check', () => ({ decision: 'ask' }));
+
+  on('process.run', () => ({
+    value: {
+      exitCode: 0,
+      stdout,
+      stderr: '',
+      isStdoutTruncated: false,
+      isStderrTruncated: false,
+    },
+  }));
+
+  // oxlint-disable-next-line new-cap -- The host event API retains its event spelling.
+  await $.classic.SessionStart({ source: 'startup', session_id: 'session-1', cwd: '/repo' });
+
+  const results: unknown[] = [];
+
+  for (const output of outputs) {
+    stdout = output;
+
+    const result = await $.tool.check({ tool: 'Bash', input: { command: 'rm fixture.txt' } });
+
+    results.push(result);
+  }
+
+  expect(results).toStrictEqual(outputs.map(() => ({ decision: 'ask' })));
+});
+
 test('it retains manual approval for a malformed denial', async ($, on) => {
   const decided = {
     decision: 'ask',
@@ -465,8 +500,7 @@ test('it retains manual approval for a malformed denial', async ($, on) => {
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"deny"}}}',
+        stdout: '{"decision":"deny"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -493,13 +527,11 @@ test('it retains manual approval for a malformed denial', async ($, on) => {
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -534,8 +566,7 @@ test('it retains manual approval for a truncated response', async ($, on) => {
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+        stdout: '{"decision":"allow"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: true,
         isStderrTruncated: false,
@@ -562,13 +593,11 @@ test('it retains manual approval for a truncated response', async ($, on) => {
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -603,8 +632,7 @@ test('it retains manual approval when the child exits nonzero', async ($, on) =>
     return {
       value: {
         exitCode: 1,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+        stdout: '{"decision":"allow"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -631,13 +659,11 @@ test('it retains manual approval when the child exits nonzero', async ($, on) =>
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -690,13 +716,11 @@ test('it retains manual approval when the child times out', async ($, on) => {
   expect(timeoutMs).toBeLessThanOrEqual(8000);
 
   expect(JSON.parse(stdin)).toStrictEqual({
-    hook_event_name: 'PermissionRequest',
-    prompt_id: 'mod-check',
-    session_id: 'session-1',
+    sessionID: 'session-1',
     cwd: '/repo',
-    transcript_path: '/repo/transcript.jsonl',
-    tool_name: 'Bash',
-    tool_input: { command: 'git push origin feature', timeout: 120_000 },
+    toolName: 'Bash',
+    toolInput: { command: 'git push origin feature', timeout: 120_000 },
+    context: NO_PROMPT_CONTEXT,
   });
 
   expect(invocation).toMatchObject({
@@ -724,8 +748,7 @@ test('it retains manual approval before the session context arrives', async ($,
     return {
       value: {
         exitCode: 0,
-        stdout:
-          '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+        stdout: '{"decision":"allow"}',
         stderr: 'synthetic-private-fragment',
         isStdoutTruncated: false,
         isStderrTruncated: false,
@@ -771,8 +794,7 @@ test(
       return {
         value: {
           exitCode: 0,
-          stdout:
-            '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}',
+          stdout: '{"decision":"allow"}',
           stderr: 'synthetic-private-fragment',
           isStdoutTruncated: false,
           isStderrTruncated: false,
@@ -799,13 +821,11 @@ test(
     expect(timeoutMs).toBeLessThanOrEqual(8000);
 
     expect(JSON.parse(stdin)).toStrictEqual({
-      hook_event_name: 'PermissionRequest',
-      prompt_id: 'mod-check',
-      session_id: 'session-1',
+      sessionID: 'session-1',
       cwd: '/repo',
-      transcript_path: '/repo/transcript.jsonl',
-      tool_name: 'Bash',
-      tool_input: { command: 'git push origin feature', timeout: 120_000 },
+      toolName: 'Bash',
+      toolInput: { command: 'git push origin feature', timeout: 120_000 },
+      context: NO_PROMPT_CONTEXT,
     });
 
     expect(invocation).toMatchObject({
@@ -856,11 +876,45 @@ test('it refreshes the context from the current user prompt after reload', async
   });
 
   expect(result).toStrictEqual({ decision: 'ask' });
+  expect(JSON.parse(stdin)).toMatchObject({ sessionID: 'new-session', cwd: '/new-repo' });
+  expect(stdin.includes('transcript')).toBe(false);
+});
+
+test('it carries the session identity and the direct user message', async ($, on) => {
+  let stdin = '';
+
+  on('classic.SessionStart', () => ({}));
+  on('prompt.submit', (_api, e) => ({ text: e.text }));
+  on('session.cwd', () => ({ value: '/repo' }));
+  on('tool.check', () => ({ decision: 'ask' }));
+
+  on('process.run', (_api, e) => {
+    stdin = e.init?.stdin ?? '';
+
+    return {
+      value: {
+        exitCode: 0,
+        stdout: '',
+        stderr: '',
+        isStdoutTruncated: false,
+        isStderrTruncated: false,
+      },
+    };
+  });
+
+  // oxlint-disable-next-line new-cap -- The host event API retains its event spelling.
+  await $.classic.SessionStart({ source: 'startup', session_id: 'session-1', cwd: '/repo' });
+  await $.prompt.submit({ text: 'Clean the build output.', origin: { kind: 'composer' } });
+  await $.tool.check({ tool: 'Bash', input: { command: 'rm -rf dist' } });
 
   expect(JSON.parse(stdin)).toMatchObject({
-    session_id: 'new-session',
-    cwd: '/new-repo',
-    transcript_path: '/new-repo/current.jsonl',
+    sessionID: 'session-1',
+    context: {
+      agentID: null,
+      originalUserTask: { text: 'Clean the build output.' },
+      lastDirectUserMessage: { text: 'Clean the build output.' },
+      omittedTaskContext: [],
+    },
   });
 });
 
@@ -892,7 +946,7 @@ test('it preserves the complete action without truncation', async ($, on) => {
   const result = await $.tool.check({ tool: 'Write', input: { file_path: '/repo/file', content } });
 
   expect(result).toStrictEqual({ decision: 'ask' });
-  expect(JSON.parse(stdin)).toMatchObject({ tool_input: { file_path: '/repo/file', content } });
+  expect(JSON.parse(stdin)).toMatchObject({ toolInput: { file_path: '/repo/file', content } });
 });
 
 test('it does not replace the main context with a subagent prompt', async ($, on) => {
@@ -940,12 +994,7 @@ test('it does not replace the main context with a subagent prompt', async ($, on
   });
 
   expect(result).toStrictEqual({ decision: 'ask' });
-
-  expect(JSON.parse(stdin)).toMatchObject({
-    cwd: '/main',
-    session_id: 'main-session',
-    transcript_path: '/main/user.jsonl',
-  });
+  expect(JSON.parse(stdin)).toMatchObject({ cwd: '/main', sessionID: 'main-session' });
 });
 
 test('it honors a configured fail-closed classifier verdict', async ($, on) => {
@@ -957,10 +1006,8 @@ test('it honors a configured fail-closed classifier verdict', async ($, on) => {
     value: {
       exitCode: 0,
       stdout: JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: 'PermissionRequest',
-          decision: { behavior: 'deny', message: '[Classifier Unavailable] Jev unavailable.' },
-        },
+        decision: 'deny',
+        reason: '[Classifier Unavailable] Jev unavailable.',
       }),
       stderr: '',
       isStdoutTruncated: false,

package/mods/auto-mode/hooks/register.ts

@@ -3,10 +3,7 @@ import { parseDecision } from './parse-decision.ts';
 import type { ModOn, ModOptions, PromptContext } from './types.ts';
 
 export function register(on: ModOn, options: ModOptions): void {
-  let context: {
-    readonly sessionID: string;
-    readonly transcriptPath: string;
-  } | null = null;
+  let sessionID: string | null = null;
 
   const activeCalls = new Map<string, string | null>();
   const delegatedTasks = new Map<string, string>();
@@ -15,9 +12,9 @@ export function register(on: ModOn, options: ModOptions): void {
 
   on('classic.SessionStart', (_api, e, next) => {
     if (e.agent_id === undefined) {
-      const isCompact = e.source === 'compact' && context?.sessionID === e.session_id;
+      const isCompact = e.source === 'compact' && sessionID === e.session_id;
 
-      context = { sessionID: e.session_id, transcriptPath: e.transcript_path };
+      sessionID = e.session_id;
 
       const previousPrompts = isCompact ? prompts : null;
 
@@ -33,7 +30,7 @@ export function register(on: ModOn, options: ModOptions): void {
 
   on('classic.UserPromptSubmit', (_api, e, next) => {
     if (e.agent_id === undefined) {
-      context = { sessionID: e.session_id, transcriptPath: e.transcript_path };
+      sessionID = e.session_id;
     }
 
     return next(e);
@@ -83,7 +80,7 @@ export function register(on: ModOn, options: ModOptions): void {
       return decided;
     }
 
-    if (next.signal.aborted || context === null) {
+    if (next.signal.aborted || sessionID === null) {
       const status = next.signal.aborted ? 'cancelled' : 'missing session context';
 
       $.ui.log(`${logPrefix} evaluation skipped; ${status}`, { to: 'debug' });
@@ -140,31 +137,24 @@ export function register(on: ModOn, options: ModOptions): void {
 
       $.ui.log(`${logPrefix} evaluator invoked`, { to: 'debug' });
 
+      const request = {
+        sessionID,
+        ...(e.tool_use_id === undefined ? {} : { toolUseID: e.tool_use_id }),
+        cwd,
+        toolName: e.tool,
+        toolInput: e.input,
+        context: {
+          agentID: agentID ?? null,
+          originalUserTask: prompts.originalUserTask,
+          delegatedTask,
+          lastDirectUserMessage: isChild ? null : prompts.lastDirectUserMessage,
+          omittedTaskContext,
+        },
+      };
+
       const result = await $.process.run(
         [command, 'run', '--jev-only', '--evaluation-deadline', String(deadlineAt)],
-        {
-          timeoutMs: childTimeoutMs,
-          stdin: JSON.stringify({
-            hook_event_name: 'PermissionRequest',
-            prompt_id: e.tool_use_id ?? 'mod-check',
-            session_id: context.sessionID,
-            cwd,
-            ...(isChild ? {} : { transcript_path: context.transcriptPath }),
-            ...(prompts.hasPrompt || isChild
-              ? {
-                  auto_mode_context: {
-                    agentID: agentID ?? null,
-                    originalUserTask: prompts.originalUserTask,
-                    delegatedTask,
-                    lastDirectUserMessage: isChild ? null : prompts.lastDirectUserMessage,
-                    omittedTaskContext,
-                  },
-                }
-              : {}),
-            tool_name: e.tool,
-            tool_input: e.input,
-          }),
-        },
+        { timeoutMs: childTimeoutMs, stdin: JSON.stringify(request) },
       );
 
       if (result.exitCode !== 0 || result.isStdoutTruncated || next.signal.aborted) {

package/mods/auto-mode/hooks/types.ts

@@ -45,7 +45,6 @@ export interface UserTask {
 export interface PromptContext {
   readonly originalUserTask: UserTask | null;
   readonly lastDirectUserMessage: UserTask | null;
-  readonly hasPrompt: boolean;
   readonly canCaptureOriginal: boolean;
 }
 
@@ -100,7 +99,7 @@ export interface ModAPI {
   readonly process: {
     readonly run: (argv: readonly string[], init?: ProcessInput['init']) => Promise<ProcessResult>;
   };
-  readonly prompt: { readonly submit: (input: Pick<PromptInput, 'text'>) => Promise<object> };
+  readonly prompt: { readonly submit: (input: PromptInput) => Promise<object> };
   readonly tool: { readonly check: (input: CheckInput) => Promise<PermissionDecision> };
   readonly classic: {
     readonly SessionStart: (

package/package.json

@@ -1,13 +1,11 @@
 {
   "name": "auto-mode",
-  "version": "0.4.4",
-  "description": "A permission classifier that runs as a hook, so agents that are not Claude can run unattended",
+  "version": "0.6.0",
+  "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",
     "claude-code",
-    "codex",
-    "hook",
-    "muse",
+    "mod",
     "permissions"
   ],
   "homepage": "https://github.com/zgeoff/auto-mode#readme",

package/policy/denial.md

@@ -0,0 +1 @@
+Do not retry this action, and do not reach the same result another way: not with a different command, tool, script, file, or agent. Continue the task on a safer path that does not need this action. If no safer path exists for this step, finish the rest of the task first, then tell the user what you need from them for this step.