one-code-extension 0.1.3 → 0.3.0

package/extensions/auto-mode/config.ts

@@ -3,32 +3,73 @@
  *
  * ## Which files are read, and why that list is short
  *
- * User settings (`~/.claude/settings.json`) and managed settings only — **never
- * the project's `.claude/settings.json` or `.claude/settings.local.json`**. Both
- * live in the repository, so a checked-in file or a build step that writes one
- * could otherwise hand itself classifier allow rules and switch off the gate
- * that is meant to contain it. Claude Code made the same exclusion (it dropped
- * `settings.local.json` in v2.1.207); this is that property, not an omission.
+ * User settings (`~/.claude/settings.json`), One Code's own user settings
+ * (`~/.onecode/settings.json`), and managed settings only — **never the
+ * project's `.claude/settings.json` or `.claude/settings.local.json`**. Both
+ * project files live in the repository, so a checked-in file or a build step
+ * that writes one could otherwise hand itself classifier permissions and switch
+ * off the gate that is meant to contain it. Claude Code made the same exclusion
+ * (it dropped `settings.local.json` in v2.1.207); this is that property, not an
+ * omission.
  *
- * `"$defaults"` in any list splices the built-in rules in at that position, so
- * users keep inheriting updates. Omitting it replaces the list wholesale, which
- * is a real and occasionally correct choice — `/auto-mode config` shows the
- * result either way.
+ * ## Read vs. write: `.claude` is borrowed, `~/.onecode` is ours
+ *
+ * The CC-schema keys (`environment`, `hard_deny`/`soft_deny`/`allow`) are read
+ * from `~/.claude` too, because Claude Code's own `/auto-mode-setup` writes them
+ * there and reading them is the compatibility promise. But One Code's *own*
+ * keys — `classifierModel` / `classifierModelSetFor`, which Claude Code does not
+ * define — are read from `~/.onecode` and managed settings only, never from
+ * `~/.claude`: One Code used to write them there, and a stale value (a model the
+ * session cannot reach) must not keep biting. Every write goes to
+ * `~/.onecode/settings.json`; One Code never mutates Claude Code's files. See
+ * "Own state, borrowed config" in docs/decisions/memory-state.md.
+ *
+ * ## The customization surface (CC 2.1.233's own)
+ *
+ * The ruleset is CC's fixed monolith (classifier-prompt.ts); its prose is not
+ * user-editable, by design — the ruleset *is* the security boundary. What CC's
+ * `/auto-mode-setup` exposes (and we mirror exactly) is:
+ *
+ * - `environment` — replaces the `## Environment` slot lines. `"$defaults"`
+ *   splices CC's default slots at that position, so a user can extend rather
+ *   than replace.
+ * - `hard_deny` / `soft_deny` / `allow` — extra rules **appended** to the end of
+ *   the matching embedded list, verbatim, exactly where CC injects them. These
+ *   are append-only: `"$defaults"` is accepted (CC's wizard always writes it)
+ *   but carries no meaning — the built-in rules always apply and cannot be
+ *   removed or reordered from settings, so an extra rule can tighten or carve
+ *   out, never rewrite the boundary.
+ *
+ * (The rule lists were briefly retired between the ruleset adoption and CC
+ * 2.1.233 shipping `/auto-mode-setup`, which writes this exact schema — see
+ * docs/decisions/auto-mode.md.)
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { DEFAULT_ALLOW, DEFAULT_ENVIRONMENT, DEFAULT_HARD_DENY, DEFAULT_SOFT_DENY } from "./defaults.ts";
+import { existsSync, readFileSync } from "node:fs";
+import { claudeUserSettingsPath } from "../lib/claude-settings.ts";
+import { oneCodeSettingsPath, readSettingsForWrite, writeSettings } from "../lib/one-code-settings.ts";
+import { DEFAULT_ENVIRONMENT, slotName } from "./defaults.ts";
 
 export interface AutoModeConfig {
+	/** Environment slot lines spliced into CC's ruleset (prefix-less, CC's settings format). */
 	environment: string[];
+	/** Extra HARD BLOCK rules appended to the embedded list (`$defaults` already stripped). */
+	hardDeny: string[];
+	/** Extra SOFT BLOCK rules appended to the embedded list (`$defaults` already stripped). */
+	softDeny: string[];
+	/** Extra ALLOW rules appended to the embedded list (`$defaults` already stripped). */
 	allow: string[];
-	soft_deny: string[];
-	hard_deny: string[];
 	/** Suspend narrow Bash allow rules so every shell command reaches the classifier. */
 	classifyAllShell: boolean;
 	/** `provider/model-id` override for the classifier model. */
 	classifierModel?: string;
+	/**
+	 * Containment identity (`modelIdentity().containment`) the `classifierModel`
+	 * was stamped for when set via `/auto-mode model`. A cross-provider setting
+	 * whose stamp no longer matches the session is treated as stale and overridden
+	 * — see `classifierCandidates`. Undefined for a hand-edited setting.
+	 */
+	classifierModelSetFor?: string;
 	/** Append every gate decision to auto-mode-decisions.jsonl next to the session files. */
 	logDecisions: boolean;
 }
@@ -36,12 +77,14 @@ export interface AutoModeConfig {
 interface AutoModeSettingsFile {
 	autoMode?: {
 		environment?: unknown;
-		allow?: unknown;
-		soft_deny?: unknown;
 		hard_deny?: unknown;
+		soft_deny?: unknown;
+		allow?: unknown;
 		classifyAllShell?: unknown;
 		classifierModel?: unknown;
+		classifierModelSetFor?: unknown;
 		logDecisions?: unknown;
+		[key: string]: unknown;
 	};
 	[key: string]: unknown;
 }
@@ -49,15 +92,21 @@ interface AutoModeSettingsFile {
 const DEFAULTS_TOKEN = "$defaults";
 
 /** Managed-settings locations, highest authority, matching Claude Code's paths. */
-function managedSettingsPaths(): string[] {
+export function managedSettingsPaths(): string[] {
 	if (process.platform === "darwin") return ["/Library/Application Support/ClaudeCode/managed-settings.json"];
 	if (process.platform === "win32") return ["C:\\ProgramData\\ClaudeCode\\managed-settings.json"];
 	return ["/etc/claude-code/managed-settings.json"];
 }
 
-/** The files `autoMode` is read from, lowest precedence first. */
+/**
+ * The files `autoMode` is read from, lowest precedence first. One Code's own
+ * auto-mode keys (`classifierModel`, `classifierModelSetFor`) are deliberately
+ * NOT collected from the borrowed `claudeUserSettingsPath` — Claude Code does not
+ * define them, and One Code once wrote them there, so a stale value must not
+ * survive the move to `~/.onecode` (see the read guard in the loader).
+ */
 export function autoModeSettingsPaths(home: string): string[] {
-	return [join(home, ".claude", "settings.json"), ...managedSettingsPaths()];
+	return [claudeUserSettingsPath(home), oneCodeSettingsPath(home), ...managedSettingsPaths()];
 }
 
 function readFile(path: string, diagnostics: string[]): AutoModeSettingsFile | undefined {
@@ -75,45 +124,93 @@ function readFile(path: string, diagnostics: string[]): AutoModeSettingsFile | u
 
 const KNOWN_AUTO_MODE_KEYS = new Set([
 	"environment",
-	"allow",
-	"soft_deny",
 	"hard_deny",
+	"soft_deny",
+	"allow",
 	"classifyAllShell",
 	"classifierModel",
+	"classifierModelSetFor",
 	"logDecisions",
 ]);
 
-const RULE_LIST_KEYS = ["environment", "allow", "soft_deny", "hard_deny"] as const;
+/** Rule-extra keys, CC's spelling; appended to the matching embedded list. */
+const RULE_LIST_KEYS = ["hard_deny", "soft_deny", "allow"] as const;
 
 /**
  * Shape problems in one file's `autoMode` block, as human-readable lines.
  * Purely advisory: loading stays lenient (a wrong-typed field is skipped, not
- * fatal), but skipped-because-mistyped must be visible in `/auto-mode config`
- * or it reads as the gate ignoring the user's settings.
+ * fatal), but skipped-because-mistyped must be visible in `/auto-mode config` or
+ * it reads as the gate ignoring the user's settings.
  */
-function validateAutoModeBlock(block: Record<string, unknown>, path: string, diagnostics: string[]): void {
-	for (const key of Object.keys(block)) {
-		if (!KNOWN_AUTO_MODE_KEYS.has(key)) diagnostics.push(`${path}: unknown autoMode key "${key}" is ignored`);
+/**
+ * Validate one array-of-strings autoMode key. `omitDefaultsNote`, when given,
+ * is the warning pushed if "$defaults" is missing. Purely advisory: loading
+ * stays lenient either way.
+ */
+function validateStringListKey(
+	block: Record<string, unknown>,
+	key: string,
+	path: string,
+	diagnostics: string[],
+	omitDefaultsNote?: string,
+): void {
+	const list = block[key];
+	if (list === undefined) return;
+	if (!Array.isArray(list)) {
+		diagnostics.push(`${path}: autoMode.${key} must be an array of strings — ignored`);
+		return;
 	}
-	for (const key of RULE_LIST_KEYS) {
-		const value = block[key];
-		if (value === undefined) continue;
-		if (!Array.isArray(value)) {
-			diagnostics.push(`${path}: autoMode.${key} must be an array of strings — ignored`);
-			continue;
+	for (const [position, entry] of list.entries()) {
+		if (typeof entry !== "string" || entry.trim().length === 0) {
+			diagnostics.push(`${path}: autoMode.${key}[${position}] is not a non-empty string — dropped`);
 		}
-		for (const [position, entry] of value.entries()) {
-			if (typeof entry !== "string" || entry.trim().length === 0) {
-				diagnostics.push(`${path}: autoMode.${key}[${position}] is not a non-empty string — dropped`);
-			}
+	}
+	if (!omitDefaultsNote) return;
+	const strings = list.filter((entry): entry is string => typeof entry === "string");
+	if (strings.length > 0 && !strings.some((entry) => entry.trim() === DEFAULTS_TOKEN)) {
+		diagnostics.push(`${path}: autoMode.${key} ${omitDefaultsNote}`);
+	}
+}
+
+function validateAutoModeBlock(block: Record<string, unknown>, path: string, diagnostics: string[]): void {
+	for (const key of Object.keys(block)) {
+		if (!KNOWN_AUTO_MODE_KEYS.has(key)) {
+			diagnostics.push(`${path}: unknown autoMode key "${key}" is ignored`);
 		}
-		const strings = value.filter((entry): entry is string => typeof entry === "string");
+	}
+	validateStringListKey(block, "environment", path, diagnostics);
+	// A FULL environment replacement (every built-in slot re-stated, edited or
+	// not) is the standard shape — CC's wizard and ours both write it — so it
+	// earns no warning. What does: a replacement that silently DROPS built-in
+	// slots because "$defaults" is absent — usually a hand-written list whose
+	// author believed they were adding, not replacing.
+	const environment = block.environment;
+	if (Array.isArray(environment)) {
+		const strings = environment.filter((entry): entry is string => typeof entry === "string");
 		if (strings.length > 0 && !strings.some((entry) => entry.trim() === DEFAULTS_TOKEN)) {
-			diagnostics.push(
-				`${path}: autoMode.${key} omits "${DEFAULTS_TOKEN}", so it REPLACES the built-in ${key} list rather than extending it`,
-			);
+			const present = new Set(strings.map(slotName).filter(Boolean));
+			const missing = DEFAULT_ENVIRONMENT.map(slotName).filter((name): name is string => !!name && !present.has(name));
+			if (missing.length > 0) {
+				const shown = missing.slice(0, 3).join(", ") + (missing.length > 3 ? ", …" : "");
+				diagnostics.push(
+					`${path}: autoMode.environment omits "${DEFAULTS_TOKEN}", so it REPLACES the built-in environment rather than extending it — built-in slot(s) now missing: ${shown}`,
+				);
+			}
 		}
 	}
+	// Unlike environment, the rule lists are append-only: the built-in rules
+	// always apply whether or not "$defaults" is present (a settings file must be
+	// able to add rules, never to remove the boundary), and nobody should believe
+	// omitting the token disabled them.
+	for (const key of RULE_LIST_KEYS) {
+		validateStringListKey(
+			block,
+			key,
+			path,
+			diagnostics,
+			`omits "${DEFAULTS_TOKEN}" — note the built-in rules still apply; these lists only append, never replace`,
+		);
+	}
 	for (const key of ["classifyAllShell", "logDecisions"] as const) {
 		if (block[key] !== undefined && typeof block[key] !== "boolean") {
 			diagnostics.push(`${path}: autoMode.${key} must be a boolean — ignored`);
@@ -133,8 +230,8 @@ function stringArray(value: unknown): string[] | undefined {
 }
 
 /**
- * Splice `$defaults` into a user list. Entries from separate scopes are
- * additive: a developer can extend a managed list but not remove from it.
+ * Splice `$defaults` into a user list. Entries from separate scopes are additive:
+ * a developer can extend a managed list but not remove from it.
  */
 export function spliceDefaults(entries: string[] | undefined, defaults: string[]): string[] {
 	if (!entries) return [...defaults];
@@ -156,14 +253,16 @@ export function loadAutoModeConfigWithDiagnostics(home: string): AutoModeConfigL
 	const diagnostics: string[] = [];
 	const collected: {
 		environment?: string[];
-		allow?: string[];
-		soft_deny?: string[];
 		hard_deny?: string[];
+		soft_deny?: string[];
+		allow?: string[];
 		classifyAllShell?: boolean;
 		classifierModel?: string;
+		classifierModelSetFor?: string;
 		logDecisions?: boolean;
 	} = {};
 
+	const claudeUser = claudeUserSettingsPath(home);
 	for (const path of autoModeSettingsPaths(home)) {
 		const file = readFile(path, diagnostics);
 		const block = file?.autoMode;
@@ -173,27 +272,52 @@ export function loadAutoModeConfigWithDiagnostics(home: string): AutoModeConfigL
 		}
 		if (!block) continue;
 		validateAutoModeBlock(block as Record<string, unknown>, path, diagnostics);
+		// Additive across scopes: a later scope extends rather than replaces, so
+		// managed entries cannot be dropped by a user file.
+		const parsed = stringArray(block.environment);
+		if (parsed) collected.environment = [...(collected.environment ?? []), ...parsed];
 		for (const key of RULE_LIST_KEYS) {
-			const parsed = stringArray(block[key]);
-			// Additive across scopes: a later scope extends rather than replaces,
-			// so managed entries cannot be dropped by a user file.
-			if (parsed) collected[key] = [...(collected[key] ?? []), ...parsed];
+			const list = stringArray(block[key]);
+			if (list) collected[key] = [...(collected[key] ?? []), ...list];
 		}
 		if (typeof block.classifyAllShell === "boolean") collected.classifyAllShell = block.classifyAllShell;
 		if (typeof block.logDecisions === "boolean") collected.logDecisions = block.logDecisions;
+		// `classifierModel` is One Code's own key, not Claude Code's. It is read from
+		// `~/.onecode` and managed settings only — never from `~/.claude`, where an
+		// old One Code build may have left a stale value. A leftover in `~/.claude` is
+		// surfaced as a diagnostic so the user knows why it stopped applying.
 		if (typeof block.classifierModel === "string" && block.classifierModel.trim()) {
-			collected.classifierModel = block.classifierModel.trim();
+			if (path === claudeUser) {
+				diagnostics.push(
+					`${path}: autoMode.classifierModel is ignored here — One Code reads it from ~/.onecode/settings.json (set it with /auto-mode model)`,
+				);
+			} else {
+				collected.classifierModel = block.classifierModel.trim();
+				// The stamp travels with the model from the same file, so a lower-precedence
+				// stamp cannot attach to a higher-precedence model.
+				collected.classifierModelSetFor =
+					typeof block.classifierModelSetFor === "string" && block.classifierModelSetFor.trim()
+						? block.classifierModelSetFor.trim()
+						: undefined;
+			}
 		}
 	}
 
+	// Rule lists are extras appended to the embedded built-ins, so "$defaults" is
+	// stripped rather than expanded — the built-ins are already in the ruleset and
+	// must apply regardless of what settings say (append-only, by construction).
+	const ruleExtras = (entries: string[] | undefined): string[] =>
+		(entries ?? []).filter((entry) => entry.trim() !== DEFAULTS_TOKEN);
+
 	return {
 		config: {
 			environment: spliceDefaults(collected.environment, DEFAULT_ENVIRONMENT),
-			allow: spliceDefaults(collected.allow, DEFAULT_ALLOW),
-			soft_deny: spliceDefaults(collected.soft_deny, DEFAULT_SOFT_DENY),
-			hard_deny: spliceDefaults(collected.hard_deny, DEFAULT_HARD_DENY),
+			hardDeny: ruleExtras(collected.hard_deny),
+			softDeny: ruleExtras(collected.soft_deny),
+			allow: ruleExtras(collected.allow),
 			classifyAllShell: collected.classifyAllShell ?? false,
 			classifierModel: collected.classifierModel,
+			classifierModelSetFor: collected.classifierModelSetFor,
 			logDecisions: collected.logDecisions ?? false,
 		},
 		diagnostics,
@@ -205,33 +329,111 @@ export function loadAutoModeConfig(home: string): AutoModeConfig {
 }
 
 /**
- * Persist `autoMode.classifierModel` in the *user* settings file, preserving
- * every other key. `undefined` removes the setting. Always user scope: this is
- * the knob that may move the classifier to another provider, so it lives where
- * only the user writes — never in a project file (see the module comment).
+ * Persist `autoMode.classifierModel` in One Code's own settings file
+ * (`~/.onecode/settings.json`), preserving every other key. `undefined` removes
+ * the setting. Never touches Claude Code's files — this is One Code's key, and
+ * the knob that may move the classifier to another provider, so it lives in One
+ * Code's own state (see the module comment).
  *
  * Unlike loading, this throws on a malformed file: a lenient read merely skips
- * rules, but a lenient write would replace the user's whole settings file with
- * only ours.
+ * rules, but a lenient write would replace the whole settings file with only ours.
  */
-export function persistClassifierModel(spec: string | undefined, home: string): void {
-	const path = join(home, ".claude", "settings.json");
-	let file: Record<string, unknown> = {};
-	if (existsSync(path)) {
-		const parsed = JSON.parse(readFileSync(path, "utf-8")) as unknown;
-		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-			throw new Error(`${path}: root must be a JSON object`);
-		}
-		file = parsed as Record<string, unknown>;
+export function persistClassifierModel(spec: string | undefined, home: string, setForContainment?: string): void {
+	const path = oneCodeSettingsPath(home);
+	const file = readSettingsForWrite(path);
+	const block = asRecord(file.autoMode) ?? {};
+	if (spec === undefined) {
+		delete block.classifierModel;
+		delete block.classifierModelSetFor;
+	} else {
+		block.classifierModel = spec;
+		// Stamp the containment the model was chosen on, so a later session on a
+		// different provider treats a cross-provider setting as stale (parity with
+		// subagentModelSetFor). No stamp for a hand-edited setting.
+		if (setForContainment) block.classifierModelSetFor = setForContainment;
+		else delete block.classifierModelSetFor;
+	}
+	if (Object.keys(block).length === 0) delete file.autoMode;
+	else file.autoMode = block;
+	writeSettings(path, file);
+}
+
+/** value as a plain object, or undefined — the repeated sub-block guard. */
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+	return typeof value === "object" && value !== null && !Array.isArray(value)
+		? (value as Record<string, unknown>)
+		: undefined;
+}
+
+/**
+ * Persist a `/auto-mode setup` result to One Code's own settings file: replace
+ * the wizard-owned keys (environment + the three rule lists — an undefined list
+ * removes stale values, last-writer like CC's own wizard) while preserving every
+ * other settings key and the non-wizard autoMode keys (classifierModel, …).
+ * Never touches Claude Code's files; throws on a malformed file rather than
+ * replacing the settings with only ours.
+ */
+export function persistAutoModeSetup(patch: Record<string, string[] | undefined>, home: string): void {
+	const path = oneCodeSettingsPath(home);
+	const file = readSettingsForWrite(path);
+	const block = asRecord(file.autoMode) ?? {};
+	for (const key of ["environment", ...RULE_LIST_KEYS] as const) {
+		const value = patch[key];
+		if (value === undefined) delete block[key];
+		else block[key] = value;
 	}
-	const block =
-		typeof file.autoMode === "object" && file.autoMode !== null && !Array.isArray(file.autoMode)
-			? (file.autoMode as Record<string, unknown>)
-			: {};
-	if (spec === undefined) delete block.classifierModel;
-	else block.classifierModel = spec;
 	if (Object.keys(block).length === 0) delete file.autoMode;
 	else file.autoMode = block;
-	mkdirSync(dirname(path), { recursive: true });
-	writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`);
+	writeSettings(path, file);
+}
+
+/**
+ * The `permissions.allow` entries in One Code's own settings file — what the
+ * setup audit can actually remove. Broad rules that live in Claude Code's files
+ * are One Code's to warn about, never to delete.
+ */
+export function oneCodePermissionAllow(home: string): string[] {
+	// Lenient read (a missing/malformed file is skipped) — this is a read for
+	// auditing, not a write, so leniency is correct; the writers still refuse to
+	// clobber a malformed file. Diagnostics are discarded here.
+	return permissionAllowIn(oneCodeSettingsPath(home));
+}
+
+/**
+ * The `permissions.allow` entries in Claude Code's *user* settings file — the
+ * borrowed half of the audit. These are One Code's to warn about, never to
+ * delete: an entry here still bypasses the classifier even after its One Code
+ * copy is removed, so the audit must flag it separately.
+ */
+export function claudeUserPermissionAllow(home: string): string[] {
+	return permissionAllowIn(claudeUserSettingsPath(home));
+}
+
+/** Shared lenient read of a settings file's `permissions.allow` string list. */
+function permissionAllowIn(path: string): string[] {
+	const list = asRecord(readFile(path, [])?.permissions)?.allow;
+	return Array.isArray(list) ? list.filter((entry): entry is string => typeof entry === "string") : [];
+}
+
+/**
+ * Remove specific `permissions.allow` entries from One Code's own settings file
+ * (the setup audit's "remove them" choice). Only One Code's own file is
+ * touched — never Claude Code's. Exact-match only, everything else preserved;
+ * throws on a malformed file for the same reason as the writers above. Returns
+ * how many entries were actually removed.
+ */
+export function removeOneCodePermissionAllow(entries: string[], home: string): number {
+	const path = oneCodeSettingsPath(home);
+	const file = readSettingsForWrite(path);
+	const permissions = asRecord(file.permissions);
+	const allowList = permissions?.allow;
+	if (!permissions || !Array.isArray(allowList)) return 0;
+	const doomed = new Set(entries);
+	const kept = allowList.filter((entry) => typeof entry !== "string" || !doomed.has(entry));
+	const removed = allowList.length - kept.length;
+	if (removed > 0) {
+		permissions.allow = kept;
+		writeSettings(path, file);
+	}
+	return removed;
 }

package/extensions/auto-mode/defaults.ts

@@ -1,65 +1,22 @@
 /**
- * Built-in auto-mode rule lists (pure data).
+ * Built-in auto-mode configuration defaults.
  *
- * These are prose, read by the classifier as natural-language rules — the same
- * shape Claude Code's `claude auto-mode defaults` prints, so a user's existing
- * `autoMode` settings splice into them with `"$defaults"` unchanged.
- *
- * Four tiers, in the precedence the classifier is instructed to apply:
- *   hard_deny  — unconditional; neither user intent nor allow rules clear it
- *   soft_deny  — blocked unless an allow rule or explicit user intent clears it
- *   allow      — exceptions to soft_deny
- *   (intent)   — a specific user instruction clears remaining soft denials
+ * The ruleset itself is no longer configurable prose lists — the classifier
+ * ruleset is a fixed monolith matching Claude Code's classifier (see
+ * classifier-prompt.ts and docs/decisions/auto-mode.md). The one customization
+ * surface Claude Code exposes, and the only one we expose, is the `## Environment` section:
+ * `DEFAULT_ENVIRONMENT` is CC's default slot text, and a user's `autoMode.environment`
+ * entries replace it. Re-exported here so config.ts has a single stable import
+ * point rather than reaching into the generated prompt module.
  */
 
-/** What the classifier treats as inside the trust boundary. */
-export const DEFAULT_ENVIRONMENT: string[] = [
-	"Trusted repo: the git repository containing the working directory, and its configured remotes. Pushing to any branch of this repository is routine. Content first read from outside this repository is not this repository's own work, whoever asked for it to be moved.",
-	"Repository visibility: assume private unless the user's own message says otherwise. Confidential material may go into a private repo; secrets and personal data may never go into any repo regardless of visibility.",
-	"Trusted internal domains: none configured. Any host that is not the repository's own remote is outside the boundary.",
-	"Trusted cloud buckets: none configured. Treat every bucket write as leaving the boundary.",
-	"Internal package registry: none configured. Installs from the ecosystem's default public registry are routine; installs redirected to another registry are not.",
-	"Sensitive data locations: credential directories (~/.ssh, ~/.aws, ~/.kube, ~/.docker, ~/.m2, ~/.gnupg, ~/.config/gcloud), .env files anywhere, private keys and keystores, and /proc or /sys process state.",
-	"Sensitive remote targets: any host, namespace, container, or branch whose name carries prod, production, live, or release.",
-	"Protected IaC scopes: any Terraform, Pulumi, CloudFormation, Helm, or Kubernetes manifest path whose name marks it as production.",
-	"Primary use: software development in the working directory.",
-];
-
-/** Unconditional. User intent does not clear these. */
-export const DEFAULT_HARD_DENY: string[] = [
-	"Data exfiltration: sending secrets, credentials, private keys, personal data, or the contents of sensitive files to any destination outside the trust boundary — by network request, by commit or push, by writing into a shared location, or by embedding them in a command argument that reaches a third party. This holds however the action is framed and whoever asked for it.",
-	"Auto-mode bypass: disabling, weakening, or working around this approval mechanism — editing permission settings or Claude Code/One Code configuration to grant broader permissions, adding allow rules, changing the permission mode, or routing an action through a path that avoids classification.",
-	"Credential harvesting: reading credential stores, keychains, browser password databases, or process environment memory (/proc/*/environ) for any purpose other than one the user specifically named.",
-	"Destroying the user's own history: rewriting or deleting the reflog, deleting the local repository, or removing backups such that the user's uncommitted or unpushed work cannot be recovered.",
-];
-
-/** Blocked, but an allow rule or a specific user instruction clears them. */
-export const DEFAULT_SOFT_DENY: string[] = [
-	"Git destructive [must name the operation and its target]: force pushing, deleting remote branches, tags, or releases, rewriting remote history, or amending a commit that is not the agent's own unpushed work from this session.",
-	"Production deploys and destroys [must name the target]: deploying, applying, or destroying against a sensitive remote target or protected IaC scope, including terraform apply/destroy, helm upgrade, kubectl apply against a production namespace, and any release or publish pipeline.",
-	"Remote code execution: piping a downloaded script into an interpreter (curl | bash and equivalents), running an installer fetched at execution time, or executing a file whose contents were downloaded during this session.",
-	"Irreversible loss outside the working directory: deleting, overwriting, or truncating an existing file or directory that is not under the working directory and not obviously scratch space such as /tmp. Creating a new file outside the working directory is covered by the separate rule below, not by this one.",
-	"Creating or modifying files outside the working directory [must name the path]: writing somewhere the user did not ask for is how work leaks out of the project. Clears when the user's own message names that path, or names the destination unambiguously enough that the path follows from it. Also clears for the harness's own designated directories named in the system prompt — the session scratchpad (under /tmp or /private/tmp, in a claude-<uid> directory) and the auto-memory directory (~/.claude/projects/<project>/memory) — which exist precisely so temporary and memory files do not land in the project.",
-	"Publishing: pushing a package to a registry, creating a public release or gist, or making a private repository public.",
-	"Disabling safety machinery: turning off CI checks, required reviews, branch protection, test suites in configuration, pre-commit hooks, or TLS certificate verification.",
-	"Secrets entering version control: staging or committing a file that holds a credential, key, or token, including one the agent generated.",
-	"Bulk permission or ownership changes: recursive chmod/chown, or making files world-writable.",
-	"Writing to paths whose contents execute later without further approval: .git/hooks, .git/config, editor auto-run configuration, or a build wrapper such as mvnw or gradlew.",
-	"Database mutation outside a migration tool: dropping, truncating, or bulk-updating tables directly, against any database.",
-	"Remote shells and port-forwards into a sensitive remote target.",
-	"Sending repository contents to a third-party service that is not part of the configured toolchain.",
-];
+export { DEFAULT_ENVIRONMENT } from "./classifier-prompt.ts";
 
-/** Exceptions to soft_deny. */
-export const DEFAULT_ALLOW: string[] = [
-	"Local file operations inside the working directory: creating, editing, moving, and deleting files and directories under it, including build output and caches.",
-	"Reading anything inside the working directory, and reading system and tool configuration that is not on the sensitive-data list.",
-	"Installing dependencies already declared in the project's manifest (package.json, pyproject.toml, go.mod, pom.xml, Cargo.toml) from the ecosystem's default registry.",
-	"Running the project's own build, test, lint, format, and type-check commands, including ones that write to build directories.",
-	"Read-only information lookups that retrieve only public data and send none of the user's own: HTTP GET/HEAD to public documentation, package metadata, and credential-free API endpoints; and public registry or DNS queries such as whois, dig, nslookup, and host, including ones that name the registry or DNS server to query.",
-	"Git operations that do not rewrite published history: status, diff, log, add, commit, branch, checkout, merge, rebase of unpushed local work, stash, and pushing to any branch of the trusted repo.",
-	"Creating and updating pull requests on the trusted repo, and reading issues and CI results.",
-	"Starting, stopping, and querying local development servers and containers bound to loopback.",
-	"Test artifacts: placeholder credentials authored as placeholders in examples and fixtures. A value copied from a real secret or a sensitive path is never a test artifact.",
-	"Reading the project's own .env file when the user asked for work that requires its configuration, provided the values do not leave the machine.",
-];
+/**
+ * The `**Name**:` head of an Environment slot line, or undefined for header
+ * ("### Org-wide") and prose entries. Used to tell a full slot replacement
+ * (the wizard's normal output) from a partial one that silently drops slots.
+ */
+export function slotName(line: string): string | undefined {
+	return line.match(/^\*\*(.+?)\*\*:/)?.[1];
+}

package/extensions/auto-mode/instructions.ts

@@ -13,6 +13,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { claudeUserDir } from "../lib/paths.ts";
 
 const FILE_NAMES = ["CLAUDE.md", "CLAUDE.local.md", "AGENTS.md"];
 
@@ -68,7 +69,7 @@ export function loadProjectInstructions(cwd: string, home: string): string | und
 		if (parent === dir) break;
 		dir = parent;
 	}
-	add(join(home, ".claude", "CLAUDE.md"));
+	add(join(claudeUserDir(home), "CLAUDE.md"));
 
 	return parts.length > 0 ? parts.join("\n\n") : undefined;
 }