auto-mode 0.6.0 → 0.8.0

package/README.md

@@ -31,14 +31,14 @@ Create the classifier configuration:
 
 ```json
 {
-  "preset": "jev",
-  "provider": { "apiKeyEnv": "TYPESAFE_API_KEY" }
+  "classifiers": { "jev": { "apiKeyEnv": "TYPESAFE_API_KEY" } },
+  "decision": { "classifier": "jev" }
 }
 ```
 
-Save it as `~/.config/auto-mode/config.json` and export your TypeSafe API key, or set
-`provider.apiKeyCommand` to a command that prints it.
-[Configuration](./docs/guides/configuration.md) covers credentials and provider overrides.
+Save it as `~/.config/auto-mode/config.json` and export your TypeSafe API key, or set the entry's
+`apiKeyCommand` to a command that prints it. [Configuration](./docs/guides/configuration.md) covers
+the registries, credentials, and migrating an older file.
 
 ## Standing permissions
 
@@ -63,9 +63,10 @@ approval when every rule confidently allows the action, and a denial for uncerta
 denial names its rule, the harm, and what clears it, and the agent continues on another path. The
 confidence threshold is configurable and needs evaluation against your actions.
 
-A missing key, failed API call, malformed response, or oversized request follows `onFailure`. The
-default `defer` writes no verdict and keeps the prompt; `deny` fails closed. Failures write a
-diagnostic to stderr. auto-mode never truncates a Jev action to make it fit.
+A missing key, failed API call, malformed response, or oversized request follows
+`decision.onFailure`. The default `defer` writes no verdict and keeps the prompt; `deny` fails
+closed. Failures write a diagnostic to stderr. auto-mode never truncates a Jev action to make it
+fit.
 
 ## Commands
 
@@ -76,10 +77,11 @@ diagnostic to stderr. auto-mode never truncates a Jev action to make it fit.
 | `auto-mode run --local-only` | Skip the model tier                       |
 | `auto-mode run --jev-only`   | Require Jev with a 5-second API timeout   |
 | `auto-mode print-prompt`     | Print the selected provider's base policy |
+| `auto-mode config migrate`   | Rewrite an older config file in place     |
 
 The mod evaluates only ask decisions and preserves existing allow and deny decisions. It runs the
-CLI as a bounded child process with `--jev-only`. The `spark`, `claude`, and `glm` presets use the
-Messages API and serve library callers.
+CLI as a bounded child process with `--jev-only`. The `spark`, `claude`, `glm`, and `messages`
+classifier kinds use the Messages API and serve library callers.
 
 ## Library
 

package/dist/cli.js

@@ -1,11 +1,147 @@
 #!/usr/bin/env node
-import { n as parseActionRequest, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-9pnm4JBS.js";
-import { appendFile, mkdir } from "node:fs/promises";
+import { _ as string, f as resolveConfigPath, g as strictObject, h as number, l as DEFAULT_DENIAL_BUDGET, n as parseActionRequest, p as normalizeConfigFile, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-DePMDXKz.js";
+import { appendFile, constants, copyFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 import { parseArgs } from "node:util";
+//#region src/budget/build-retry-key.ts
+const DESCRIPTIVE_FIELDS = { Bash: [
+	"description",
+	"timeout",
+	"run_in_background"
+] };
+function buildRetryKey(request) {
+	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
+	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const canonical = JSON.stringify(sortKeys({
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: input,
+		lastDirectUserMessage: request.decisionContext?.lastDirectUserMessage?.text ?? null
+	}));
+	return createHash("sha256").update(canonical).digest("hex");
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
+	return value;
+}
+//#endregion
+//#region src/budget/find-retry-deny.ts
+function findRetryDeny(state, retryKey) {
+	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
+	return {
+		kind: "deny",
+		rule: state.lastDenied.rule,
+		reason: state.lastDenied.reason
+	};
+}
+//#endregion
+//#region src/budget/types.ts
+const EMPTY_DENIAL_STATE = {
+	consecutive: 0,
+	session: 0,
+	lastDenied: null
+};
+//#endregion
+//#region src/budget/load-denial-state.ts
+const count = number().int().nonnegative();
+const stateSchema = strictObject({
+	consecutive: count,
+	session: count,
+	lastDenied: strictObject({
+		retryKey: string().min(1),
+		rule: string(),
+		reason: string()
+	}).nullable()
+});
+async function loadDenialState(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_DENIAL_STATE;
+	}
+	try {
+		const parsed = stateSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_DENIAL_STATE;
+	} catch {
+		return EMPTY_DENIAL_STATE;
+	}
+}
+//#endregion
+//#region src/budget/plan-denial-budget.ts
+function planDenialBudget(state, verdict, retryKey, budget) {
+	if (verdict === null) return {
+		verdict: null,
+		state,
+		escalation: false
+	};
+	if (verdict.kind === "allow") return {
+		verdict,
+		state: {
+			...state,
+			consecutive: 0,
+			lastDenied: null
+		},
+		escalation: false
+	};
+	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
+		verdict: null,
+		state: EMPTY_DENIAL_STATE,
+		escalation: true
+	};
+	const next = {
+		consecutive: state.consecutive + 1,
+		session: state.session + 1,
+		lastDenied: {
+			retryKey,
+			rule: verdict.rule,
+			reason: verdict.reason
+		}
+	};
+	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
+	return {
+		verdict: {
+			...verdict,
+			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
+		},
+		state: next,
+		escalation: false
+	};
+}
+function formatDenialsLeft(left) {
+	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
+	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
+//#region src/budget/resolve-denial-state-path.ts
+function resolveDenialStatePath(request) {
+	const agentID = request.decisionContext?.agentID ?? "";
+	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
+	return join(resolveStateDir(), "denials", `${key}.json`);
+}
+//#endregion
+//#region src/budget/write-denial-state.ts
+async function writeDenialState(path, state) {
+	const staged = `${path}.${randomUUID()}.tmp`;
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(staged, `${JSON.stringify(state)}\n`, { mode: 384 });
+	await rename(staged, path);
+}
+//#endregion
 //#region src/config/build-jev-only-config.ts
 function buildJevOnlyConfig(config) {
 	if (config.provider.protocol !== "system-one") return null;
@@ -18,20 +154,51 @@ function buildJevOnlyConfig(config) {
 	};
 }
 //#endregion
+//#region src/config/write-migrated-config.ts
+async function writeMigratedConfig(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return `${path} does not exist; nothing to migrate`;
+		throw new Error(`${path} is unreadable`, { cause: error });
+	}
+	let json;
+	try {
+		json = JSON.parse(raw);
+	} catch {
+		throw new Error(`${path} is not valid JSON`);
+	}
+	const normalized = normalizeConfigFile(json, path);
+	if (!normalized.isLegacy) return `${path} already uses the current shape`;
+	const backup = `${path}.bak`;
+	const staged = `${path}.migrating`;
+	try {
+		await copyFile(path, backup, constants.COPYFILE_EXCL);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "EEXIST") throw new Error(`${backup} already exists; move it aside and run the migration again`, { cause: error });
+		throw error;
+	}
+	await writeFile(staged, `${JSON.stringify(normalized.file, null, 2)}\n`, { mode: 384 });
+	await rename(staged, path);
+	return `rewrote ${path} in the current shape; the old file is at ${backup}`;
+}
+//#endregion
 //#region src/diagnostics/write-action-diagnostic.ts
 async function writeActionDiagnostic(payload, entry) {
-	const stateHome = process.env["XDG_STATE_HOME"];
-	const stateDir = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
-	const path = process.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(stateDir, "auto-mode", "actions.jsonl");
+	const path = process.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(), "actions.jsonl");
 	if (path === "") return;
 	const record = {
-		schemaVersion: 2,
+		schemaVersion: 3,
 		time: (/* @__PURE__ */ new Date()).toISOString(),
 		invocationID: entry.invocationID,
 		sessionHash: toHash(payload.sessionID),
 		actionHash: payload.toolUseID === void 0 ? null : toHash(payload.toolUseID),
 		status: entry.status,
 		verdict: entry.verdict ?? null,
+		decidingStage: entry.decidingStage ?? null,
+		denials: entry.denials ?? null,
+		escalation: entry.escalation ?? false,
 		diagnostics: entry.diagnostics ?? null
 	};
 	try {
@@ -54,6 +221,7 @@ const USAGE = `auto-mode — a permission classifier for the auto-mode Claude Co
 Usage:
   auto-mode run              Read an action request on stdin, write a verdict on stdout
   auto-mode print-prompt     Print the system prompt the classifier receives
+  auto-mode config migrate   Rewrite the config file from the old keys into the current shape
 
 Options:
   --classifier <path>   Use this framework file instead of the shipped one
@@ -92,6 +260,7 @@ async function run(explain, localOnly, jevOnly, deadline) {
 		});
 		return printNote(true, "configuration unreadable; no verdict");
 	}
+	printWarnings(loaded.warnings);
 	const config = jevOnly ? buildJevOnlyConfig(loaded) : loaded;
 	if (config === null) {
 		await writeActionDiagnostic(request, {
@@ -119,27 +288,56 @@ async function run(explain, localOnly, jevOnly, deadline) {
 		process.on("SIGINT", stopEvaluation);
 	}
 	try {
-		const outcome = await classifyAction(request, config, {
+		const statePath = resolveDenialStatePath(request);
+		const retryKey = buildRetryKey(request);
+		const before = await loadDenialState(statePath);
+		const retry = findRetryDeny(before, retryKey);
+		const outcome = retry === null ? await classifyAction(request, config, {
 			localOnly,
 			deadlineAt,
 			signal: controller.signal
-		});
-		if (outcome.verdict !== null) writeVerdict(outcome.verdict);
+		}) : {
+			verdict: retry,
+			decidingStage: "retry",
+			note: "retry of the action just denied; denied again",
+			status: "deny"
+		};
+		const latest = retry === null ? await loadDenialState(statePath) : before;
+		const plan = planDenialBudget(latest, outcome.verdict, retryKey, config.denialBudget ?? DEFAULT_DENIAL_BUDGET);
+		if (plan.state !== latest) await tryWriteDenialState(statePath, plan.state);
+		if (plan.verdict !== null) writeVerdict(plan.verdict);
 		await writeActionDiagnostic(request, {
 			invocationID,
 			status: outcome.status,
-			verdict: outcome.verdict?.kind ?? "defer",
+			verdict: plan.verdict?.kind ?? "defer",
+			decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
+			denials: {
+				consecutive: plan.state.consecutive,
+				session: plan.state.session
+			},
+			escalation: plan.escalation,
 			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics }
 		});
-		return printNote(explain || outcome.unavailable === true, outcome.note);
+		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
+		return printNote(explain || outcome.unavailable === true, note);
 	} finally {
 		process.off("SIGTERM", stopEvaluation);
 		process.off("SIGINT", stopEvaluation);
 	}
 }
+async function tryWriteDenialState(path, state) {
+	try {
+		await writeDenialState(path, state);
+	} catch {
+		process.stderr.write("auto-mode: denial counts unavailable\n");
+	}
+}
 function writeVerdict(verdict) {
 	process.stdout.write(renderVerdict(verdict));
 }
+function printWarnings(warnings = []) {
+	for (const warning of warnings) process.stderr.write(`auto-mode: ${warning}\n`);
+}
 function printNote(explain, message) {
 	if (explain) process.stderr.write(`auto-mode: ${message}\n`);
 	return 0;
@@ -174,6 +372,7 @@ async function main(argv) {
 	}
 	if (command === "print-prompt") {
 		const config = await loadConfig();
+		printWarnings(config.warnings);
 		const framework = config.provider.protocol === "system-one" ? "decision.md" : "classifier.md";
 		const prompt = await loadPolicy({
 			classifierPath: args.values.classifier ?? config.classifierPath,
@@ -182,9 +381,21 @@ async function main(argv) {
 		process.stdout.write(`${prompt}\n`);
 		return 0;
 	}
+	if (command === "config" && args.positionals[1] === "migrate") return runConfigMigration();
 	process.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
 	return 2;
 }
+async function runConfigMigration() {
+	const path = resolveConfigPath();
+	try {
+		const result = await writeMigratedConfig(path);
+		process.stdout.write(`${result}\n`);
+		return 0;
+	} catch (error) {
+		process.stderr.write(`auto-mode: ${error instanceof Error ? error.message : "config migration failed"}\n`);
+		return 1;
+	}
+}
 process.exitCode = await main(process.argv.slice(2));
 //#endregion
 export {};

package/dist/index.d.ts

@@ -1,9 +1,18 @@
+//#region src/budget/types.d.ts
+interface DenialBudget {
+  readonly consecutive: number;
+  readonly perSession: number;
+}
+//#endregion
 //#region src/config/types.d.ts
 interface EvaluationOptions {
   readonly deadlineAt?: number | undefined;
   readonly signal?: Readonly<AbortSignal> | undefined;
 }
 //#endregion
+//#region src/config/presets.d.ts
+export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
+//#endregion
 //#region src/config/config.d.ts
 interface ProviderConfig {
   readonly protocol?: 'messages' | 'system-one';
@@ -15,16 +24,25 @@ interface ProviderConfig {
   readonly maxTokens: number;
   readonly timeoutMs: number;
 }
+interface ScopeSource {
+  readonly kind: ScopeSourceKind;
+  readonly paths?: readonly string[];
+}
+type ScopeSourceKind = (typeof SCOPE_SOURCE_KINDS)[number];
+declare const SCOPE_SOURCE_KINDS: readonly ['cwd', 'session', 'globs', 'atc'];
 interface Config {
   readonly provider: ProviderConfig;
+  readonly judge?: ProviderConfig | null;
+  readonly scopeSources?: Readonly<Record<string, ScopeSource>>;
   readonly classifierPath?: string | undefined;
   readonly rulesPath?: string | undefined;
   readonly onFailure: 'defer' | 'deny';
   readonly claudeSettingsPath?: string | null | undefined;
   readonly minConfidence?: number | undefined;
+  readonly denialBudget?: DenialBudget;
+  readonly warnings?: readonly string[];
 }
 export declare const DEFAULT_CONFIG: Config;
-export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
 export declare function resolveConfigPath(): string;
 export declare function loadConfig(path?: string): Promise<Config>;
 export declare function resolveApiKey(provider: ProviderConfig, options?: EvaluationOptions): Promise<string | null>;
@@ -97,8 +115,10 @@ interface DecisionDiagnostics {
 }
 //#endregion
 //#region src/classify-action.d.ts
+type DecidingStage = 'local' | 'jev' | 'messages' | 'retry';
 interface ActionOutcome {
   readonly verdict: Verdict | null;
+  readonly decidingStage: DecidingStage;
   readonly note: string;
   readonly status: 'allow' | 'skipped' | 'failure' | DecisionDiagnostics['status'];
   readonly unavailable?: boolean;
@@ -143,4 +163,4 @@ type LocalVerdict = {
 };
 export declare function classifyLocally(payload: ActionRequest): LocalVerdict;
 //#endregion
-export type { ActionOutcome, ActionRequest, ClassifyOptions, Config, DecisionContext, LocalVerdict, ModelOutcome, PolicyPaths, ProviderConfig, Verdict };
+export type { ActionOutcome, ActionRequest, ClassifyOptions, Config, DecisionContext, LocalVerdict, ModelOutcome, PolicyPaths, ProviderConfig, ScopeSource, Verdict };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveApiKey, f as resolveConfigPath, i as classifyLocally, l as PRESETS, n as parseActionRequest, o as parseModelVerdict, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-9pnm4JBS.js";
+import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveApiKey, f as resolveConfigPath, i as classifyLocally, m as PRESETS, n as parseActionRequest, o as parseModelVerdict, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-DePMDXKz.js";
 export { DEFAULT_CONFIG, PRESETS, classifyAction, classifyLocally, classifyWithModel, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath };

package/dist/{render-verdict-9pnm4JBS.js → render-verdict-DePMDXKz.js}

@@ -252,7 +252,7 @@ function safeExtend(schema, shape) {
 	if (!isPlainObject(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
 	return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
 }
-function merge$1(a, b) {
+function merge(a, b) {
 	if (!b?._zod?.def) throw new Error("Invalid input to merge: expected an object schema. To merge a plain shape, use `.extend()`.");
 	if (a._zod.def.checks?.length) throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");
 	const newShape = {};
@@ -5218,7 +5218,7 @@ const ZodObject = /*@__PURE__*/ $constructor("ZodObject", (inst, def) => {
 		return safeExtend(this, incoming);
 	},
 	merge(other) {
-		return merge$1(this, other);
+		return merge(this, other);
 	},
 	pick(mask) {
 		return pick(this, mask);
@@ -5569,6 +5569,171 @@ async function loadClaudeRules(path) {
 		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
 	};
 }
+const PRESETS = {
+	jev: {
+		protocol: "system-one",
+		baseURL: "https://api.typesafe.ai",
+		model: "jev-1.13.0",
+		apiKeyEnv: "TYPESAFE_API_KEY",
+		reasoning: false,
+		maxTokens: 3e3,
+		timeoutMs: 5e3
+	},
+	spark: {
+		baseURL: "https://api.meta.ai",
+		model: "muse-spark-1.3-contributor",
+		apiKeyEnv: "META_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	claude: {
+		baseURL: "https://api.anthropic.com",
+		model: "claude-haiku-4-5-20251001",
+		apiKeyEnv: "ANTHROPIC_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	glm: {
+		baseURL: "https://api.z.ai/api/anthropic",
+		model: "glm-5.3-flash",
+		apiKeyEnv: "ZAI_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 6e4
+	}
+};
+const MESSAGES_DEFAULTS = {
+	protocol: "messages",
+	baseURL: "https://api.anthropic.com",
+	reasoning: true,
+	maxTokens: 3e3,
+	timeoutMs: 45e3
+};
+function findPreset(id) {
+	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
+}
+//#endregion
+//#region src/config/normalize-config-file.ts
+function normalizeConfigFile(json, path) {
+	if (!isRecord(json)) return {
+		file: json,
+		isLegacy: false,
+		warnings: []
+	};
+	const legacyKeys = Object.keys(json).filter((key) => LEGACY_KEYS.has(key));
+	if (legacyKeys.length === 0) return {
+		file: json,
+		isLegacy: false,
+		warnings: []
+	};
+	const currentKeys = Object.keys(json).filter((key) => !LEGACY_KEYS.has(key));
+	if (currentKeys.length > 0) throw new Error(`${path} mixes the old keys (${legacyKeys.join(", ")}) with the new ones (${currentKeys.join(", ")}); run \`auto-mode config migrate\` on a copy without the new keys`);
+	const parsed = legacyConfigSchema.safeParse(json);
+	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
+	const legacy = parsed.data;
+	const warnings = [`${path} uses the old config keys (${legacyKeys.join(", ")}); run \`auto-mode config migrate\` to rewrite it`, ...legacy.transcriptEntries === void 0 ? [] : [`${path} sets transcriptEntries, which has no effect; migration drops it`]];
+	return {
+		file: buildFileFromLegacy(legacy, path),
+		isLegacy: true,
+		warnings
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const LEGACY_KEYS = /* @__PURE__ */ new Set([
+	"preset",
+	"provider",
+	"classifierPath",
+	"rulesPath",
+	"transcriptEntries",
+	"onFailure",
+	"claudeSettingsPath",
+	"minConfidence"
+]);
+const text$1 = string().min(1);
+const positive$1 = number().positive();
+const legacyConfigSchema = strictObject({
+	preset: text$1.optional(),
+	provider: strictObject({
+		protocol: _enum(["messages", "system-one"]).optional(),
+		baseURL: text$1.optional(),
+		model: text$1.optional(),
+		apiKeyEnv: text$1.optional(),
+		apiKeyCommand: text$1.optional(),
+		reasoning: boolean().optional(),
+		maxTokens: positive$1.optional(),
+		timeoutMs: positive$1.optional()
+	}).optional(),
+	classifierPath: text$1.optional(),
+	rulesPath: text$1.optional(),
+	transcriptEntries: number().nonnegative().optional(),
+	onFailure: _enum(["defer", "deny"]).optional(),
+	claudeSettingsPath: text$1.nullable().optional(),
+	minConfidence: number().min(.5).max(1).optional()
+});
+function buildFileFromLegacy(legacy, path) {
+	const hasClassifier = legacy.preset !== void 0 || legacy.provider !== void 0;
+	const decision = {
+		...hasClassifier ? { classifier: getLegacyClassifierID(legacy) } : {},
+		...legacy.minConfidence === void 0 ? {} : { minConfidence: legacy.minConfidence },
+		...legacy.onFailure === void 0 ? {} : { onFailure: legacy.onFailure }
+	};
+	const policy = {
+		...legacy.rulesPath === void 0 ? {} : { rulesPath: legacy.rulesPath },
+		...legacy.classifierPath === void 0 ? {} : { frameworkPath: legacy.classifierPath },
+		...legacy.claudeSettingsPath === void 0 ? {} : { claudeSettingsPath: legacy.claudeSettingsPath }
+	};
+	return {
+		...hasClassifier ? { classifiers: { [getLegacyClassifierID(legacy)]: buildClassifierEntry(getLegacyClassifierID(legacy), buildLegacyProvider(legacy, path)) } } : {},
+		...Object.keys(decision).length === 0 ? {} : { decision },
+		...Object.keys(policy).length === 0 ? {} : { policy }
+	};
+}
+function getLegacyClassifierID(legacy) {
+	if (legacy.preset !== void 0) return legacy.preset;
+	return legacy.provider !== void 0 && legacy.provider.protocol !== "system-one" ? "spark" : "jev";
+}
+function buildLegacyProvider(legacy, path) {
+	const preset = findPreset(getLegacyClassifierID(legacy));
+	if (preset === void 0) throw new Error(`${path} names an unknown preset '${legacy.preset}'; known presets are ${Object.keys(PRESETS).join(", ")}`);
+	const override = legacy.provider ?? {};
+	return {
+		protocol: override.protocol ?? preset.protocol ?? "messages",
+		baseURL: override.baseURL ?? preset.baseURL,
+		model: override.model ?? preset.model,
+		apiKeyEnv: override.apiKeyEnv ?? preset.apiKeyEnv,
+		apiKeyCommand: override.apiKeyCommand ?? preset.apiKeyCommand,
+		reasoning: override.reasoning ?? preset.reasoning,
+		maxTokens: override.maxTokens ?? preset.maxTokens,
+		timeoutMs: override.timeoutMs ?? preset.timeoutMs
+	};
+}
+const PROVIDER_FIELDS = [
+	"baseURL",
+	"model",
+	"apiKeyEnv",
+	"apiKeyCommand",
+	"reasoning",
+	"maxTokens",
+	"timeoutMs"
+];
+function buildClassifierEntry(id, provider) {
+	const kind = pickEntryKind(id, provider);
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind) ?? {};
+	const fields = Object.fromEntries(PROVIDER_FIELDS.filter((field) => provider[field] !== void 0 && provider[field] !== base[field]).map((field) => [field, provider[field]]));
+	return {
+		...kind === id ? {} : { kind },
+		...fields
+	};
+}
+function pickEntryKind(id, provider) {
+	const preset = findPreset(id);
+	if (preset !== void 0 && (preset.protocol ?? "messages") === provider.protocol) return id;
+	return provider.protocol === "system-one" ? "jev" : "messages";
+}
 //#endregion
 //#region src/config/read-api-key-from-command.ts
 function readApiKeyFromCommand(command, options = {}) {
@@ -5624,73 +5789,29 @@ function readApiKeyFromCommand(command, options = {}) {
 }
 //#endregion
 //#region src/config/config.ts
+const SCOPE_SOURCE_KINDS = [
+	"cwd",
+	"session",
+	"globs",
+	"atc"
+];
+const DEFAULT_PROVIDER = findPreset("jev");
+if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
+const DEFAULT_DENIAL_BUDGET = {
+	consecutive: 3,
+	perSession: 20
+};
 const DEFAULT_CONFIG = {
-	provider: {
-		protocol: "system-one",
-		baseURL: "https://api.typesafe.ai",
-		model: "jev-1.13.0",
-		apiKeyEnv: "TYPESAFE_API_KEY",
-		reasoning: false,
-		maxTokens: 3e3,
-		timeoutMs: 5e3
-	},
+	provider: DEFAULT_PROVIDER,
 	onFailure: "defer",
-	minConfidence: .8
-};
-const SPARK_PROVIDER = {
-	baseURL: "https://api.meta.ai",
-	model: "muse-spark-1.3-contributor",
-	apiKeyEnv: "META_API_KEY",
-	reasoning: true,
-	maxTokens: 3e3,
-	timeoutMs: 45e3
-};
-const PRESETS = {
-	jev: DEFAULT_CONFIG.provider,
-	spark: SPARK_PROVIDER,
-	claude: {
-		baseURL: "https://api.anthropic.com",
-		model: "claude-haiku-4-5-20251001",
-		apiKeyEnv: "ANTHROPIC_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	glm: {
-		baseURL: "https://api.z.ai/api/anthropic",
-		model: "glm-5.3-flash",
-		apiKeyEnv: "ZAI_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 6e4
-	}
+	minConfidence: .8,
+	denialBudget: DEFAULT_DENIAL_BUDGET
 };
 function resolveConfigPath() {
 	const xdg = process.env["XDG_CONFIG_HOME"];
 	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
 	return join(base, "auto-mode", "config.json");
 }
-const text = string().min(1);
-const positive = number().positive();
-const configFileSchema = strictObject({
-	preset: text.optional(),
-	provider: strictObject({
-		protocol: _enum(["messages", "system-one"]).optional(),
-		baseURL: text.optional(),
-		model: text.optional(),
-		apiKeyEnv: text.optional(),
-		apiKeyCommand: text.optional(),
-		reasoning: boolean().optional(),
-		maxTokens: positive.optional(),
-		timeoutMs: positive.optional()
-	}).optional(),
-	classifierPath: text.optional(),
-	rulesPath: text.optional(),
-	transcriptEntries: number().nonnegative().optional(),
-	onFailure: _enum(["defer", "deny"]).optional(),
-	claudeSettingsPath: text.nullable().optional(),
-	minConfidence: number().min(.5).max(1).optional()
-});
 async function loadConfig(path = resolveConfigPath()) {
 	let raw;
 	try {
@@ -5705,33 +5826,150 @@ async function loadConfig(path = resolveConfigPath()) {
 	} catch {
 		throw new Error(`${path} is not valid JSON`);
 	}
+	const normalized = normalizeConfigFile(json, path);
+	return buildConfig(normalized.file, path, normalized.warnings);
+}
+const text = string().min(1);
+const positive = number().positive();
+const denialBudgetSchema = strictObject({
+	consecutive: number().int().positive().optional(),
+	perSession: number().int().positive().optional()
+});
+const configFileSchema = strictObject({
+	classifiers: record(text, unknown()).optional(),
+	scopeSources: record(text, unknown()).optional(),
+	decision: strictObject({
+		classifier: text.optional(),
+		judge: text.nullable().optional(),
+		minConfidence: number().min(.5).max(1).optional(),
+		onFailure: _enum(["defer", "deny"]).optional(),
+		denialBudget: denialBudgetSchema.optional()
+	}).optional(),
+	policy: strictObject({
+		rulesPath: text.nullable().optional(),
+		frameworkPath: text.nullable().optional(),
+		claudeSettingsPath: text.nullable().optional()
+	}).optional()
+});
+function buildConfig(json, path, legacyWarnings) {
 	const parsed = configFileSchema.safeParse(json);
 	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
-	return merge(parsed.data, path);
-}
-function merge(file, path) {
-	const implicitProvider = file.provider !== void 0 && file.provider.protocol !== "system-one" ? SPARK_PROVIDER : DEFAULT_CONFIG.provider;
-	const preset = file.preset === void 0 ? implicitProvider : PRESETS[file.preset];
-	if (preset === void 0) throw new Error(`${path} names an unknown preset '${file.preset}'; known presets are ${Object.keys(PRESETS).join(", ")}`);
-	const override = file.provider ?? {};
+	const file = parsed.data;
+	const warnings = [...legacyWarnings];
+	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
+	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
+	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`));
+	const decision = file.decision ?? {};
+	const policy = file.policy ?? {};
+	const judgeID = decision.judge ?? null;
 	return {
-		provider: {
-			protocol: override.protocol ?? preset.protocol ?? "messages",
-			baseURL: override.baseURL ?? preset.baseURL,
-			model: override.model ?? preset.model,
-			apiKeyEnv: override.apiKeyEnv ?? preset.apiKeyEnv,
-			apiKeyCommand: override.apiKeyCommand ?? preset.apiKeyCommand,
-			reasoning: override.reasoning ?? preset.reasoning,
-			maxTokens: override.maxTokens ?? preset.maxTokens,
-			timeoutMs: override.timeoutMs ?? preset.timeoutMs
+		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
+		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
+		scopeSources: scopeSources.entries,
+		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
+		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
+		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
+		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
+		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
+		denialBudget: {
+			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
+			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
 		},
-		classifierPath: file.classifierPath,
-		rulesPath: file.rulesPath,
-		onFailure: file.onFailure ?? DEFAULT_CONFIG.onFailure,
-		claudeSettingsPath: file.claudeSettingsPath,
-		minConfidence: file.minConfidence ?? DEFAULT_CONFIG.minConfidence
+		warnings
 	};
 }
+function buildRegistry(raw, parseEntry) {
+	const entries = /* @__PURE__ */ new Map();
+	const dropped = [];
+	const droppedIDs = [];
+	for (const [id, entry] of Object.entries(raw)) {
+		const result = parseEntry(id, entry);
+		if (typeof result === "string") {
+			dropped.push(`${id} dropped: ${result}`);
+			droppedIDs.push(id);
+		} else entries.set(id, result);
+	}
+	return {
+		entries: Object.fromEntries(entries),
+		dropped,
+		droppedIDs
+	};
+}
+const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
+const classifierEntrySchema = strictObject({
+	kind: text.optional(),
+	baseURL: text.optional(),
+	model: text.optional(),
+	apiKeyEnv: text.optional(),
+	apiKeyCommand: text.optional(),
+	reasoning: boolean().optional(),
+	maxTokens: positive.optional(),
+	timeoutMs: positive.optional()
+});
+const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+	"apiKey",
+	"key",
+	"token",
+	"secret"
+]);
+function parseClassifierEntry(id, entry) {
+	if (typeof entry === "object" && entry !== null) {
+		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
+		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
+	}
+	const parsed = classifierEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = parsed.data.kind ?? id;
+	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
+	const model = parsed.data.model ?? base?.model;
+	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
+	return {
+		protocol: base.protocol ?? "messages",
+		baseURL: parsed.data.baseURL ?? base.baseURL,
+		model,
+		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
+		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
+		reasoning: parsed.data.reasoning ?? base.reasoning,
+		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
+		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
+	};
+}
+const scopeSourceEntrySchema = strictObject({
+	kind: text.optional(),
+	paths: array(text).min(1).optional()
+});
+function parseScopeSourceEntry(id, entry) {
+	const parsed = scopeSourceEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
+	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
+	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
+		kind,
+		paths: parsed.data.paths
+	};
+	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
+}
+function formatFirstIssue(issues) {
+	const [issue] = issues;
+	if (issue === void 0) return "invalid entry";
+	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
+}
+function resolveRole(role, id, entries, droppedIDs, path) {
+	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
+	if (entry !== void 0) return entry;
+	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
+	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
+	return parseBuiltIn(id);
+}
+function parseBuiltIn(id) {
+	const resolved = parseClassifierEntry(id, {});
+	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
+	return resolved;
+}
+function expandHomePath(path) {
+	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+}
 function resolveApiKey(provider, options = {}) {
 	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
 	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
@@ -6980,6 +7218,7 @@ async function classifyAction(request, config, options = {}) {
 		const guidance = config.onFailure === "deny" ? await tryReadDenialGuidance() : null;
 		return {
 			verdict: config.onFailure === "deny" ? buildGuidedDeny("Classifier Unavailable", "Claude settings unreadable.", guidance) : null,
+			decidingStage: "jev",
 			note: "Claude settings unreadable; classifier unavailable",
 			status: "failure",
 			unavailable: true
@@ -6988,17 +7227,20 @@ async function classifyAction(request, config, options = {}) {
 	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow") return {
 		verdict: { kind: "allow" },
+		decidingStage: "local",
 		note: `allowed by ${local.exception} (local)`,
 		status: "allow"
 	};
 	if (options.localOnly === true) return {
 		verdict: null,
+		decidingStage: "local",
 		note: `${request.toolName} needs the model tier, which this run skipped`,
 		status: "skipped"
 	};
 	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, options), tryReadDenialGuidance()]);
 	return {
 		...outcome,
+		decidingStage: config.provider.protocol === "system-one" ? "jev" : "messages",
 		verdict: outcome.verdict?.kind === "deny" ? buildGuidedDeny(outcome.verdict.rule, outcome.verdict.reason, guidance) : outcome.verdict,
 		status: outcome.diagnostics?.status ?? outcome.verdict?.kind ?? "failure"
 	};
@@ -7076,4 +7318,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, classifyLocally as i, PRESETS as l, parseActionRequest as n, parseModelVerdict as o, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };
+export { string as _, classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, strictObject as g, number as h, classifyLocally as i, DEFAULT_DENIAL_BUDGET as l, PRESETS as m, parseActionRequest as n, parseModelVerdict as o, normalizeConfigFile as p, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",