auto-mode 0.7.0 → 0.8.0

package/dist/cli.js

@@ -1,11 +1,147 @@
 #!/usr/bin/env node
-import { d as resolveConfigPath, f as normalizeConfigFile, l as loadConfig, n as parseActionRequest, r as classifyAction, s as loadPolicy, t as renderVerdict } from "./render-verdict-CAg3AKWH.js";
+import { _ as string, f as resolveConfigPath, g as strictObject, h as number, l as DEFAULT_DENIAL_BUDGET, n as parseActionRequest, p as normalizeConfigFile, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-DePMDXKz.js";
 import { appendFile, constants, copyFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 import { parseArgs } from "node:util";
+//#region src/budget/build-retry-key.ts
+const DESCRIPTIVE_FIELDS = { Bash: [
+	"description",
+	"timeout",
+	"run_in_background"
+] };
+function buildRetryKey(request) {
+	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
+	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const canonical = JSON.stringify(sortKeys({
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: input,
+		lastDirectUserMessage: request.decisionContext?.lastDirectUserMessage?.text ?? null
+	}));
+	return createHash("sha256").update(canonical).digest("hex");
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
+	return value;
+}
+//#endregion
+//#region src/budget/find-retry-deny.ts
+function findRetryDeny(state, retryKey) {
+	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
+	return {
+		kind: "deny",
+		rule: state.lastDenied.rule,
+		reason: state.lastDenied.reason
+	};
+}
+//#endregion
+//#region src/budget/types.ts
+const EMPTY_DENIAL_STATE = {
+	consecutive: 0,
+	session: 0,
+	lastDenied: null
+};
+//#endregion
+//#region src/budget/load-denial-state.ts
+const count = number().int().nonnegative();
+const stateSchema = strictObject({
+	consecutive: count,
+	session: count,
+	lastDenied: strictObject({
+		retryKey: string().min(1),
+		rule: string(),
+		reason: string()
+	}).nullable()
+});
+async function loadDenialState(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_DENIAL_STATE;
+	}
+	try {
+		const parsed = stateSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_DENIAL_STATE;
+	} catch {
+		return EMPTY_DENIAL_STATE;
+	}
+}
+//#endregion
+//#region src/budget/plan-denial-budget.ts
+function planDenialBudget(state, verdict, retryKey, budget) {
+	if (verdict === null) return {
+		verdict: null,
+		state,
+		escalation: false
+	};
+	if (verdict.kind === "allow") return {
+		verdict,
+		state: {
+			...state,
+			consecutive: 0,
+			lastDenied: null
+		},
+		escalation: false
+	};
+	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
+		verdict: null,
+		state: EMPTY_DENIAL_STATE,
+		escalation: true
+	};
+	const next = {
+		consecutive: state.consecutive + 1,
+		session: state.session + 1,
+		lastDenied: {
+			retryKey,
+			rule: verdict.rule,
+			reason: verdict.reason
+		}
+	};
+	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
+	return {
+		verdict: {
+			...verdict,
+			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
+		},
+		state: next,
+		escalation: false
+	};
+}
+function formatDenialsLeft(left) {
+	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
+	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
+//#region src/budget/resolve-denial-state-path.ts
+function resolveDenialStatePath(request) {
+	const agentID = request.decisionContext?.agentID ?? "";
+	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
+	return join(resolveStateDir(), "denials", `${key}.json`);
+}
+//#endregion
+//#region src/budget/write-denial-state.ts
+async function writeDenialState(path, state) {
+	const staged = `${path}.${randomUUID()}.tmp`;
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(staged, `${JSON.stringify(state)}\n`, { mode: 384 });
+	await rename(staged, path);
+}
+//#endregion
 //#region src/config/build-jev-only-config.ts
 function buildJevOnlyConfig(config) {
 	if (config.provider.protocol !== "system-one") return null;
@@ -50,18 +186,19 @@ async function writeMigratedConfig(path) {
 //#endregion
 //#region src/diagnostics/write-action-diagnostic.ts
 async function writeActionDiagnostic(payload, entry) {
-	const stateHome = process.env["XDG_STATE_HOME"];
-	const stateDir = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
-	const path = process.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(stateDir, "auto-mode", "actions.jsonl");
+	const path = process.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(), "actions.jsonl");
 	if (path === "") return;
 	const record = {
-		schemaVersion: 2,
+		schemaVersion: 3,
 		time: (/* @__PURE__ */ new Date()).toISOString(),
 		invocationID: entry.invocationID,
 		sessionHash: toHash(payload.sessionID),
 		actionHash: payload.toolUseID === void 0 ? null : toHash(payload.toolUseID),
 		status: entry.status,
 		verdict: entry.verdict ?? null,
+		decidingStage: entry.decidingStage ?? null,
+		denials: entry.denials ?? null,
+		escalation: entry.escalation ?? false,
 		diagnostics: entry.diagnostics ?? null
 	};
 	try {
@@ -151,24 +288,50 @@ async function run(explain, localOnly, jevOnly, deadline) {
 		process.on("SIGINT", stopEvaluation);
 	}
 	try {
-		const outcome = await classifyAction(request, config, {
+		const statePath = resolveDenialStatePath(request);
+		const retryKey = buildRetryKey(request);
+		const before = await loadDenialState(statePath);
+		const retry = findRetryDeny(before, retryKey);
+		const outcome = retry === null ? await classifyAction(request, config, {
 			localOnly,
 			deadlineAt,
 			signal: controller.signal
-		});
-		if (outcome.verdict !== null) writeVerdict(outcome.verdict);
+		}) : {
+			verdict: retry,
+			decidingStage: "retry",
+			note: "retry of the action just denied; denied again",
+			status: "deny"
+		};
+		const latest = retry === null ? await loadDenialState(statePath) : before;
+		const plan = planDenialBudget(latest, outcome.verdict, retryKey, config.denialBudget ?? DEFAULT_DENIAL_BUDGET);
+		if (plan.state !== latest) await tryWriteDenialState(statePath, plan.state);
+		if (plan.verdict !== null) writeVerdict(plan.verdict);
 		await writeActionDiagnostic(request, {
 			invocationID,
 			status: outcome.status,
-			verdict: outcome.verdict?.kind ?? "defer",
+			verdict: plan.verdict?.kind ?? "defer",
+			decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
+			denials: {
+				consecutive: plan.state.consecutive,
+				session: plan.state.session
+			},
+			escalation: plan.escalation,
 			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics }
 		});
-		return printNote(explain || outcome.unavailable === true, outcome.note);
+		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
+		return printNote(explain || outcome.unavailable === true, note);
 	} finally {
 		process.off("SIGTERM", stopEvaluation);
 		process.off("SIGINT", stopEvaluation);
 	}
 }
+async function tryWriteDenialState(path, state) {
+	try {
+		await writeDenialState(path, state);
+	} catch {
+		process.stderr.write("auto-mode: denial counts unavailable\n");
+	}
+}
 function writeVerdict(verdict) {
 	process.stdout.write(renderVerdict(verdict));
 }

package/dist/index.d.ts

@@ -1,3 +1,9 @@
+//#region src/budget/types.d.ts
+interface DenialBudget {
+  readonly consecutive: number;
+  readonly perSession: number;
+}
+//#endregion
 //#region src/config/types.d.ts
 interface EvaluationOptions {
   readonly deadlineAt?: number | undefined;
@@ -33,6 +39,7 @@ interface Config {
   readonly onFailure: 'defer' | 'deny';
   readonly claudeSettingsPath?: string | null | undefined;
   readonly minConfidence?: number | undefined;
+  readonly denialBudget?: DenialBudget;
   readonly warnings?: readonly string[];
 }
 export declare const DEFAULT_CONFIG: Config;
@@ -108,8 +115,10 @@ interface DecisionDiagnostics {
 }
 //#endregion
 //#region src/classify-action.d.ts
+type DecidingStage = 'local' | 'jev' | 'messages' | 'retry';
 interface ActionOutcome {
   readonly verdict: Verdict | null;
+  readonly decidingStage: DecidingStage;
   readonly note: string;
   readonly status: 'allow' | 'skipped' | 'failure' | DecisionDiagnostics['status'];
   readonly unavailable?: boolean;

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveConfigPath, i as classifyLocally, l as loadConfig, n as parseActionRequest, o as parseModelVerdict, p as PRESETS, r as classifyAction, s as loadPolicy, t as renderVerdict, u as resolveApiKey } from "./render-verdict-CAg3AKWH.js";
+import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveApiKey, f as resolveConfigPath, i as classifyLocally, m as PRESETS, n as parseActionRequest, o as parseModelVerdict, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-DePMDXKz.js";
 export { DEFAULT_CONFIG, PRESETS, classifyAction, classifyLocally, classifyWithModel, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath };

package/dist/{render-verdict-CAg3AKWH.js → render-verdict-DePMDXKz.js}

@@ -5797,10 +5797,15 @@ const SCOPE_SOURCE_KINDS = [
 ];
 const DEFAULT_PROVIDER = findPreset("jev");
 if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
+const DEFAULT_DENIAL_BUDGET = {
+	consecutive: 3,
+	perSession: 20
+};
 const DEFAULT_CONFIG = {
 	provider: DEFAULT_PROVIDER,
 	onFailure: "defer",
-	minConfidence: .8
+	minConfidence: .8,
+	denialBudget: DEFAULT_DENIAL_BUDGET
 };
 function resolveConfigPath() {
 	const xdg = process.env["XDG_CONFIG_HOME"];
@@ -5826,6 +5831,10 @@ async function loadConfig(path = resolveConfigPath()) {
 }
 const text = string().min(1);
 const positive = number().positive();
+const denialBudgetSchema = strictObject({
+	consecutive: number().int().positive().optional(),
+	perSession: number().int().positive().optional()
+});
 const configFileSchema = strictObject({
 	classifiers: record(text, unknown()).optional(),
 	scopeSources: record(text, unknown()).optional(),
@@ -5833,7 +5842,8 @@ const configFileSchema = strictObject({
 		classifier: text.optional(),
 		judge: text.nullable().optional(),
 		minConfidence: number().min(.5).max(1).optional(),
-		onFailure: _enum(["defer", "deny"]).optional()
+		onFailure: _enum(["defer", "deny"]).optional(),
+		denialBudget: denialBudgetSchema.optional()
 	}).optional(),
 	policy: strictObject({
 		rulesPath: text.nullable().optional(),
@@ -5861,6 +5871,10 @@ function buildConfig(json, path, legacyWarnings) {
 		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
 		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
 		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
+		denialBudget: {
+			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
+			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
+		},
 		warnings
 	};
 }
@@ -7204,6 +7218,7 @@ async function classifyAction(request, config, options = {}) {
 		const guidance = config.onFailure === "deny" ? await tryReadDenialGuidance() : null;
 		return {
 			verdict: config.onFailure === "deny" ? buildGuidedDeny("Classifier Unavailable", "Claude settings unreadable.", guidance) : null,
+			decidingStage: "jev",
 			note: "Claude settings unreadable; classifier unavailable",
 			status: "failure",
 			unavailable: true
@@ -7212,17 +7227,20 @@ async function classifyAction(request, config, options = {}) {
 	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow") return {
 		verdict: { kind: "allow" },
+		decidingStage: "local",
 		note: `allowed by ${local.exception} (local)`,
 		status: "allow"
 	};
 	if (options.localOnly === true) return {
 		verdict: null,
+		decidingStage: "local",
 		note: `${request.toolName} needs the model tier, which this run skipped`,
 		status: "skipped"
 	};
 	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, options), tryReadDenialGuidance()]);
 	return {
 		...outcome,
+		decidingStage: config.provider.protocol === "system-one" ? "jev" : "messages",
 		verdict: outcome.verdict?.kind === "deny" ? buildGuidedDeny(outcome.verdict.rule, outcome.verdict.reason, guidance) : outcome.verdict,
 		status: outcome.diagnostics?.status ?? outcome.verdict?.kind ?? "failure"
 	};
@@ -7300,4 +7318,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveConfigPath as d, normalizeConfigFile as f, classifyLocally as i, loadConfig as l, parseActionRequest as n, parseModelVerdict as o, PRESETS as p, classifyAction as r, loadPolicy as s, renderVerdict as t, resolveApiKey as u };
+export { string as _, classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, strictObject as g, number as h, classifyLocally as i, DEFAULT_DENIAL_BUDGET as l, PRESETS as m, parseActionRequest as n, parseModelVerdict as o, normalizeConfigFile as p, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",