auto-mode 3.0.0 → 3.1.0

package/README.md

@@ -33,6 +33,8 @@ undo.
   ([containment](./docs/architecture/stages/containment.md)).
 - **The edit bypass** allows an in-scope file edit once a secret scan finds nothing
   ([the edit bypass](./docs/architecture/stages/edit-bypass.md)).
+- **The reply channel** allows a message to a recipient the session's launcher declared as its own
+  ([the reply channel](./docs/architecture/stages/reply-channel.md)).
 - **Jev** judges the remaining calls against the shipped rules and your own
   ([Jev](./docs/architecture/stages/jev.md)).
 - **The judge**, on by default, reviews every Jev deny, and overturns it when your last message

package/dist/classify-edit-O8JNCVde.js

@@ -0,0 +1,138 @@
+import { t as findEditFields } from "./find-edit-fields-CzkhPA4j.js";
+import { t as findSecret } from "./find-secret-DUEWxfkc.js";
+import { basename, relative, sep } from "node:path";
+import { Buffer } from "node:buffer";
+//#region src/bypass/classify-edit.ts
+const MAX_SCANNED_BYTES = 262144;
+function classifyEdit(action, scope) {
+	const fields = findEditFields(action.toolName);
+	if (fields === null) return {
+		kind: "jev",
+		reason: "not a file-tool edit"
+	};
+	const worktree = findWorktree(action.target, scope.worktrees);
+	if (worktree === null) return {
+		kind: "jev",
+		reason: "target outside every in-scope worktree"
+	};
+	const path = relative(worktree, action.target).split(sep).join("/");
+	if (path.startsWith(".worktrees/")) return {
+		kind: "jev",
+		reason: "target in a nested worktree outside the scope"
+	};
+	if (action.checkout !== null && action.checkout !== worktree) return {
+		kind: "jev",
+		reason: "target in a checkout outside the scope"
+	};
+	const exclusion = [action.target, action.requested].some((each) => scope.protectedDirs.some((directory) => isWithin(each, directory))) ? "auto-mode configuration or state" : findExclusion(path) ?? findExclusion(toWorktreePath(action.requested, scope.worktrees));
+	if (exclusion !== null) return {
+		kind: "jev",
+		reason: `target is ${exclusion}`
+	};
+	const text = buildScanText(action, fields.content);
+	if (typeof text !== "string") return {
+		kind: "jev",
+		reason: text.reason
+	};
+	if (Buffer.byteLength(text, "utf8") > MAX_SCANNED_BYTES) return {
+		kind: "jev",
+		reason: "content larger than the secret scan reads"
+	};
+	const secret = findSecret({
+		text,
+		path
+	});
+	return secret === null ? {
+		kind: "bypass",
+		target: action.target
+	} : {
+		kind: "jev",
+		reason: `secret scan matched ${secret.rule}`
+	};
+}
+function findWorktree(target, worktrees) {
+	return worktrees.filter((worktree) => isWithin(target, worktree)).toSorted((left, right) => right.length - left.length)[0] ?? null;
+}
+function isWithin(path, directory) {
+	const offset = relative(directory, path);
+	return offset !== "" && !offset.startsWith("..") && !offset.startsWith(sep);
+}
+const EXCLUDED_PATHS = [
+	[".git", "git metadata"],
+	[".claude", "agent configuration"],
+	[".codex", "agent configuration"],
+	[".muse", "agent configuration"],
+	[".husky", "a hook file"],
+	[".githooks", "a hook file"],
+	[".vscode/tasks.json", "a hook file"],
+	[".github/workflows", "a CI workflow"],
+	[".circleci", "a CI workflow"],
+	[".ssh", "a credential file"],
+	[".aws", "a credential file"],
+	[".kube", "a credential file"],
+	[".docker", "a credential file"],
+	[".gnupg", "a credential file"]
+];
+const EXCLUDED_NAMES = [
+	[/^(?:agents|claude)(?:\.[\w-]+)?\.md$/iu, "agent configuration"],
+	[/^\.mcp\.json$/iu, "agent configuration"],
+	[/^settings(?:\.[\w-]+)?\.json$/iu, "a settings file"],
+	[/^(?:hooks\.json|\.?lefthook(?:-local)?\.ya?ml|\.pre-commit-config\.ya?ml)$/iu, "a hook file"],
+	[/^(?:package\.json|\.?bunfig\.toml|\.gitattributes)$/iu, "a hook file"],
+	[/^\.gitlab-ci\.ya?ml$/iu, "a CI workflow"],
+	[/^\.env(?:\..*)?$|^\.envrc$/iu, "an env file"],
+	[/^(?:\.netrc|\.npmrc|\.pypirc|\.git-credentials|\.dockercfg|kubeconfig)$/iu, "a credential file"],
+	[/^credentials(?:\.\w+)?$|^secrets?\.(?:json|ya?ml|toml|env)$/iu, "a credential file"],
+	[/^id_(?:rsa|dsa|ecdsa|ed25519)|\.(?:pem|key|p12|pfx|jks|keystore|tfvars)$/iu, "a credential file"]
+];
+function findExclusion(path) {
+	const lower = path.toLowerCase();
+	const excludedPath = EXCLUDED_PATHS.find(([prefix]) => lower === prefix || lower.endsWith(`/${prefix}`) || lower.startsWith(`${prefix}/`) || lower.includes(`/${prefix}/`));
+	if (excludedPath !== void 0) return excludedPath[1];
+	const name = basename(path);
+	return EXCLUDED_NAMES.find(([pattern]) => pattern.test(name))?.[1] ?? null;
+}
+function toWorktreePath(path, worktrees) {
+	const worktree = findWorktree(path, worktrees);
+	return worktree === null ? path : relative(worktree, path).split(sep).join("/");
+}
+function buildScanText(action, field) {
+	const content = action.toolInput[field] ?? "";
+	if (typeof content !== "string") return { reason: "edit content is not text" };
+	if (action.toolName !== "Edit") return content;
+	const old = action.toolInput["old_string"];
+	if (typeof old !== "string" || old === "" || action.current === null) return { reason: "the edit cannot be read in the context of its file" };
+	const parts = action.current.split(old);
+	if (parts.length === 1) return { reason: "the edit text is not in the file" };
+	const replaced = action.toolInput["replace_all"] === true ? parts.length - 1 : 1;
+	const spans = [];
+	let produced = parts[0] ?? "";
+	for (let index = 1; index < parts.length; index += 1) {
+		const isReplaced = index <= replaced;
+		if (isReplaced) spans.push({
+			start: produced.length,
+			end: produced.length + content.length
+		});
+		produced += `${isReplaced ? content : old}${parts[index] ?? ""}`;
+	}
+	return collectContext(produced, spans);
+}
+const CONTEXT_LINES = 12;
+function collectContext(text, spans) {
+	const lines = text.split("\n");
+	const starts = [];
+	let offset = 0;
+	for (const line of lines) {
+		starts.push(offset);
+		offset += line.length + 1;
+	}
+	const keep = /* @__PURE__ */ new Set();
+	for (const span of spans) {
+		const first = starts.findLastIndex((start) => start <= span.start);
+		const last = starts.findLastIndex((start) => start <= span.end);
+		for (let line = first - CONTEXT_LINES; line <= last + CONTEXT_LINES; line += 1) keep.add(line);
+	}
+	return lines.filter((_, index) => keep.has(index)).join("\n");
+}
+//#endregion
+export { classifyEdit };

package/dist/classify-reply-message-CrZ6S-AR.js

@@ -0,0 +1,28 @@
+import { t as findSecret } from "./find-secret-DUEWxfkc.js";
+import { Buffer } from "node:buffer";
+//#region src/bypass/classify-reply-message.ts
+const MAX_SCANNED_BYTES = 262144;
+function classifyReplyMessage(toolInput) {
+	const text = [JSON.stringify(toolInput), ...collectStrings(toolInput)].join("\n");
+	if (Buffer.byteLength(text, "utf8") > MAX_SCANNED_BYTES) return {
+		kind: "jev",
+		reason: "message larger than the secret scan reads"
+	};
+	const secret = findSecret({
+		text,
+		path: null
+	});
+	return secret === null ? { kind: "bypass" } : {
+		kind: "jev",
+		reason: `secret scan matched ${secret.rule}`
+	};
+}
+function collectStrings(value) {
+	if (typeof value === "string") return [value];
+	if (typeof value !== "object" || value === null) return [];
+	const strings = [];
+	for (const [key, entry] of Object.entries(value)) strings.push(key, ...collectStrings(entry));
+	return strings;
+}
+//#endregion
+export { classifyReplyMessage };

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as pickJudgeLane, E as updateJSONFile, S as CLI_LIMITS, T as resolveXDGDir, _ as readCheckout, a as resolveSessionScopePath, b as loadConfig, c as splitGitCommand, d as loadCheckoutFacts, f as writeActionDiagnostic, g as isUnresolvedWord, h as resolveShellPath, i as classifyAction, l as loadPolicy, m as collectShellCommands, n as readRuntime, o as loadSessionScope, p as toRepositorySlug, s as EMPTY_SESSION_SCOPE, t as parseActionRequest, u as resolveShippedPolicyDir, v as readGitEntry, w as M, x as runCapped, y as DEFAULT_SCOPE_SOURCES } from "./parse-action-request-C55m5DlM.js";
-import { a as literal, d as string, i as discriminatedUnion, r as boolean, s as number, u as strictObject } from "./schemas-B_w83Dze.js";
+import { C as pickJudgeLane, E as updateJSONFile, S as CLI_LIMITS, T as resolveXDGDir, _ as readCheckout, a as resolveSessionScopePath, b as loadConfig, c as splitGitCommand, d as loadCheckoutFacts, f as writeActionDiagnostic, g as isUnresolvedWord, h as resolveShellPath, i as classifyAction, l as loadPolicy, m as collectShellCommands, n as readRuntime, o as loadSessionScope, p as toRepositorySlug, s as EMPTY_SESSION_SCOPE, t as parseActionRequest, u as resolveShippedPolicyDir, v as readGitEntry, w as M, x as runCapped, y as DEFAULT_SCOPE_SOURCES } from "./parse-action-request-DySYvZxl.js";
+import { a as literal, d as string, i as discriminatedUnion, r as boolean, s as number, u as strictObject } from "./schemas-B80Yxv6m.js";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, open, readFile, realpath, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
@@ -3283,7 +3283,7 @@ async function runJudgeServer(io, socketPath) {
 		io.stderr.write(`auto-mode: judge-server needs a socket path\n\n${USAGE}`);
 		return 2;
 	}
-	await (await (await import("./start-judge-server-BlhDO_4A.js")).startJudgeServer({
+	await (await (await import("./start-judge-server-CDYdRR4I.js")).startJudgeServer({
 		socketPath,
 		env: io.runtime.host.env,
 		idleMs: JUDGE_IDLE_MS