one-code-extension 0.1.3 → 0.3.0

package/extensions/auto-mode/classifier.ts

@@ -1,29 +1,51 @@
 /**
  * The classifier call itself — the one file here that talks to a provider.
  *
- * A one-shot `completeSimple` rather than an agent session: the classifier gets
- * no tools, no session, and no history beyond the user messages it is handed, so
- * there is nothing for it to be talked into doing. Its only output is a verdict.
+ * Claude Code's two-stage formula, reproduced (docs/decisions/auto-mode.md, P4):
+ *   Stage 1 grades HARM ONLY (maxTokens 64). severity < 50 → allow, no stage 2.
+ *   Stage 2 applies intent + ALLOW (maxTokens 8192, <thinking> CoT) → severity +
+ *   <category> (+ our verified <intent>). Both stages share one system prompt and
+ *   transcript byte-for-byte. Only the system prompt (the ~30k-token ruleset) is
+ *   a cache hit across stages and calls: pi-ai marks a breakpoint on the last
+ *   user block only, so the <transcript> (up to ~15k tokens) is re-read uncached
+ *   by stage 2 and by every gated call on Anthropic-style providers. Known,
+ *   deferred — docs/decisions/caching.md "Classifier transcript" and
+ *   docs/upstream_prs.md #16 (fixable locally via pi-ai's `onPayload`).
  *
- * Model selection prefers a small fast model (Claude Code uses a Sonnet-class
- * model for this), overridable with `autoMode.classifierModel`, falling back to
- * the session's own model so auto mode still works on a single-model setup.
+ * A one-shot `completeSimple` per stage rather than an agent session: no tools,
+ * no history beyond the transcript it is handed, nothing to be talked into. Every
+ * failure path — no model, no credentials, timeout, provider error, truncated or
+ * unparseable reply — returns a block; a gate that cannot reach its classifier
+ * has approved nothing.
  */
 
-import type { Model, Api } from "@earendil-works/pi-ai";
+import type { Model, Api, AssistantMessage, ThinkingLevel } from "@earendil-works/pi-ai";
 import { completeSimple } from "@earendil-works/pi-ai/compat";
 import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import { forcedReasoningLevel, isReasoningMandatoryError, reasoningRetryLevel } from "../lib/model-policy.ts";
 import type { AutoModeConfig } from "./config.ts";
-import { buildClassifierPrompt, type ClassifyRequest, type ClassifyVerdict, parseVerdict } from "./prompt.ts";
+import {
+	buildPayload,
+	type ClassifyRequest,
+	type ClassifyVerdict,
+	parseSeverity,
+	parseStage2,
+	reviewUser,
+	SEVERITY_THRESHOLD,
+	stage1User,
+	stage2User,
+} from "./prompt.ts";
 import {
 	type Candidate,
+	type ClassifierNotice,
 	classifierCandidates,
 	describeCandidate,
 	isModelUnavailableError,
+	replyText,
+	withAuthBaseUrl,
 } from "./model-select.ts";
-import { indexRules } from "./rules.ts";
 
-/** A slow classifier stalls every tool call, so the wait is capped. */
+/** A slow classifier stalls every tool call, so the wait is capped per stage. */
 export const CLASSIFIER_TIMEOUT_MS = 30_000;
 
 /**
@@ -41,9 +63,6 @@ export const ROTATE_AFTER_TIMEOUTS = 2;
  * (`deps.signal?.aborted`) before treating an abort as a timeout.
  */
 export function isClassifierTimeout(message: string): boolean {
-	// `\babort` (no trailing boundary) so "abort", "aborted", and "aborting" all
-	// match — the observed message is "Request aborted", which a trailing \b
-	// would miss. The others are whole words.
 	return /\babort|\btimed?\s*out\b|\btimeout\b|\betimedout\b|\bdeadline\b/i.test(message);
 }
 
@@ -61,14 +80,32 @@ export interface ClassifierState {
 	notified: Set<string>;
 	/**
 	 * Consecutive calls the pinned model has timed out on. Reset by any success;
-	 * at ROTATE_AFTER_TIMEOUTS the pin is released so the session re-picks rather
-	 * than staying bound to a model that has fallen behind demand.
+	 * at ROTATE_AFTER_TIMEOUTS the pin is released so the session re-picks.
 	 */
 	timeoutStreak: number;
+	/**
+	 * The candidate chain cached for the current (session model, classifier config)
+	 * signature, so the O(catalog) ranking is not rebuilt on every gated tool call.
+	 * Invalidated only when the session model or the `classifierModel` setting
+	 * changes — catalog churn is deliberately ignored, matching the pin, which
+	 * already commits the session to one classifier. The live `rejected` filter is
+	 * still applied to the cached chain per call, so a model that dies mid-session
+	 * is still stepped over without a rebuild.
+	 */
+	chainCache?: { signature: string; candidates: Candidate[]; notices: ClassifierNotice[] };
+	/**
+	 * `provider/id` -> the thinking level a model turned out to REQUIRE (its
+	 * provider rejected the thinking-off request with "reasoning is mandatory").
+	 * Learned once per model via a single retry, then sent on every later call so
+	 * the failed round-trip is never paid again. Only needed when the model's
+	 * catalog entry lacks `thinkingLevelMap.off: null` (that case is handled
+	 * proactively, without an error).
+	 */
+	forcedReasoning: Map<string, ThinkingLevel>;
 }
 
 export function createClassifierState(): ClassifierState {
-	return { rejected: new Set(), notified: new Set(), timeoutStreak: 0 };
+	return { rejected: new Set(), notified: new Set(), timeoutStreak: 0, forcedReasoning: new Map() };
 }
 
 export interface ClassifierDeps {
@@ -79,23 +116,66 @@ export interface ClassifierDeps {
 	state: ClassifierState;
 	/** Tell the user something once — which model is in use, or that theirs is dead. */
 	onNotice?: (message: string, level: "info" | "warning") => void;
+	/** Report each classifier reply's usage, for the all-in footer cost. Observer
+	 * only — it never affects the payload sent or the verdict parsed. */
+	onUsage?: (usage: unknown) => void;
+	/**
+	 * A candidate the provider refused as not usable on this account (stepped
+	 * over and recorded in `state.rejected`). The wiring republishes it on
+	 * `lib/model-unusable.ts`'s channel so subagent selection — which shares this
+	 * classifier's floor and therefore its first pick — skips it too.
+	 */
+	onModelUnusable?: (model: string, reason: string) => void;
+	/**
+	 * Completed-run subagent review: evaluate the sequence with a single stage-2
+	 * style full-eval call instead of the two-stage gate (there is no harm floor
+	 * to short-circuit, and the whole point is the intent/ALLOW judgment).
+	 */
+	reviewOnly?: boolean;
+}
+
+/** How a single candidate's attempt failed, so the outer loop can react. */
+type StepKind = "timeout" | "cancelled" | "unavailable" | "error" | "truncated";
+class StepError extends Error {
+	constructor(
+		readonly kind: StepKind,
+		message: string,
+	) {
+		super(message);
+	}
+}
+
+/** Signature that must stay equal for the cached chain to be reused (see ClassifierState.chainCache). */
+function selectionSignature(deps: ClassifierDeps): string {
+	const session = deps.sessionModel ? `${deps.sessionModel.provider}/${deps.sessionModel.id}` : "(none)";
+	return `${session}|${deps.config.classifierModel ?? ""}|${deps.config.classifierModelSetFor ?? ""}`;
 }
 
-/** The candidate chain, minus anything already found unusable this session. */
-function remainingCandidates(deps: ClassifierDeps): Candidate[] {
-	const all = classifierCandidates({
-		available: deps.registry.getAvailable(),
-		sessionModel: deps.sessionModel,
-		configured: deps.config.classifierModel,
-	});
+/** The candidate chain (minus anything already unusable this session) and its notices. */
+function remainingCandidates(deps: ClassifierDeps): { candidates: Candidate[]; notices: ClassifierNotice[] } {
+	const signature = selectionSignature(deps);
+	let cached = deps.state.chainCache;
+	if (!cached || cached.signature !== signature) {
+		const built = classifierCandidates({
+			available: deps.registry.getAvailable(),
+			sessionModel: deps.sessionModel,
+			configured: deps.config.classifierModel,
+			configuredSetForContainment: deps.config.classifierModelSetFor,
+		});
+		cached = { signature, candidates: built.candidates, notices: built.notices };
+		// Don't poison the cache with an empty chain (e.g. a not-yet-populated
+		// registry) — that would permanently block the gate; recompute next call.
+		if (built.candidates.length > 0) deps.state.chainCache = cached;
+	}
+	const { candidates: all, notices } = cached;
 	const usable = all.filter((entry) => !deps.state.rejected.has(`${entry.model.provider}/${entry.model.id}`));
-	if (usable.length > 0) return usable;
+	if (usable.length > 0) return { candidates: usable, notices };
 	// If everything has been rejected, the session model is still worth one more
 	// attempt: a gate that stops asking has stopped gating. It has to be the
-	// session model specifically — the *last* chain entry is the cost-ranked
-	// pick, which nothing price-chosen should lead, let alone be the sole retry.
+	// session model specifically — the *last* chain entry is the cost-ranked pick,
+	// which nothing price-chosen should lead, let alone be the sole retry.
 	const session = all.filter((entry) => entry.source === "session");
-	return session.length > 0 ? session : all.slice(-1);
+	return { candidates: session.length > 0 ? session : all.slice(-1), notices };
 }
 
 function notifyOnce(deps: ClassifierDeps, key: string, message: string, level: "info" | "warning") {
@@ -105,36 +185,35 @@ function notifyOnce(deps: ClassifierDeps, key: string, message: string, level: "
 }
 
 /**
- * Ask the classifier about one tool call. Every failure path — no model, no
- * credentials, timeout, provider error, unparseable reply — returns a block.
- * An approval gate that cannot reach its classifier has not approved anything.
+ * Ask the classifier about one tool call (or, with `reviewOnly`, one finished
+ * subagent run). See the module comment for the two-stage flow.
  */
 export async function classify(request: ClassifyRequest, deps: ClassifierDeps): Promise<ClassifyVerdict> {
-	const candidates = remainingCandidates(deps);
+	const { candidates, notices } = remainingCandidates(deps);
 	if (candidates.length === 0) {
 		return { decision: "block", reason: "No model is available to run the auto-mode classifier.", tier: "unmatched" };
 	}
 
-	// A configured model that matches nothing available would otherwise fall
-	// through in silence, leaving the user believing their setting is in force
-	// while something else screens their calls.
-	const configured = deps.config.classifierModel;
-	if (configured && !candidates.some((entry) => entry.source === "configured")) {
-		notifyOnce(
-			deps,
-			`unresolved:${configured}`,
-			`autoMode.classifierModel is set to "${configured}", which is not an available model — check the name and that its provider is authenticated. Auto mode is using ${describeCandidate(candidates[0])} instead.`,
-			"warning",
-		);
-	}
-
-	const index = indexRules(deps.config);
-	const { system, user } = buildClassifierPrompt(request, deps.config, index);
+	// Selection notices (a configured model unavailable or overridden as stale, a
+	// cross-provider setting honored) — surfaced once each at their own level, keyed
+	// by their text so an informational "honored" line is not shown as a warning.
+	for (const notice of notices) notifyOnce(deps, notice.text, notice.text, notice.level);
+
+	// buildPayload builds the ~110KB ruleset once and returns the grounding index
+	// derived from it, so the ruleset is not rebuilt/re-parsed a second time here.
+	const { system, userPrefix, index } = buildPayload(request);
+	const stage1Text = stage1User(userPrefix);
+	// A permission rule refused something this turn, so stage 2 gets the extra
+	// instruction that the user's intent does not excuse an equivalent-effect
+	// retry (prompt.ts STAGE2_DENIAL_ADDENDUM). Stage 1 grades harm only and is
+	// left byte-identical to CC's.
+	const afterRuleDenial = request.transcript.some((entry) => entry.kind === "denied");
+	const debug = process.env.CC_AUTO_MODE_DEBUG;
 
 	// A model already pinned this session is tried first, so the classifier does
-	// not change under the session while the pin is healthy. The rest of the
-	// chain stays behind it: a pinned model can be withdrawn mid-session, and
-	// the same call must then step onward rather than fail every call forever.
+	// not change under the session while the pin is healthy. The rest of the chain
+	// stays behind it: a pinned model can be withdrawn mid-session, and the same
+	// call must then step onward rather than fail every call forever.
 	const pinned = deps.state.pinned;
 	const attempts = pinned
 		? [
@@ -155,234 +234,233 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 
 	let lastError = "";
 	let sawTimeout = false;
-	for (const candidate of attempts) {
+	let timedOutKey: string | undefined;
+	// Walks `attempts` in order; a candidate that turns out to require thinking is
+	// re-queued at the front for exactly one retry (see the reasoning-mandatory
+	// branch below). The `!== undefined` guard narrows `candidate`, so no cast.
+	const queue = [...attempts];
+	for (let candidate = queue.shift(); candidate !== undefined; candidate = queue.shift()) {
 		const model = candidate.model;
 		const key = `${model.provider}/${model.id}`;
 
 		const auth = await deps.registry.getApiKeyAndHeaders(model);
 		if (!auth.ok) {
+			// No working credentials for this model: a subagent on it would fail the
+			// same way, so it is published like a provider refusal.
 			reject(key);
+			deps.onModelUnusable?.(key, auth.error);
 			lastError = auth.error;
 			continue;
 		}
-
-		// Some pi builds resolve a per-provider baseUrl alongside the key; it is not
-		// in every published version of the auth type, so it is read defensively.
-		const baseUrl = (auth as { baseUrl?: string }).baseUrl;
-
-		const attempt = (maxTokens: number) => {
+		const resolvedModel = withAuthBaseUrl(model, auth);
+
+		// One provider call. `reasoning`/`temperature` are deliberately omitted: pi
+		// turns thinking off entirely when `reasoning` is absent (what a classifier
+		// wants), and `temperature` is deprecated/unsupported on several models and
+		// fails closed. See docs/decisions/auto-mode.md. The one exception: a model
+		// that CANNOT disable thinking (catalog-marked, or learned via the
+		// reasoning-mandatory retry below) gets its lowest supported level — the
+		// off-request would 400 and the gate would fail closed on every call.
+		const reasoning = deps.state.forcedReasoning.get(key) ?? forcedReasoningLevel(model);
+		const runCall = (userText: string, maxTokens: number, stage: number) => {
+			if (debug === "2") {
+				process.stderr.write(
+					`\n[auto-mode payload] stage=${stage} model=${key} maxTokens=${maxTokens} systemLen=${system.length} userLen=${userText.length}\n` +
+						`===SYSTEM===\n${system}\n===USER===\n${userText}\n===END===\n`,
+				);
+			}
 			const timeout = AbortSignal.timeout(CLASSIFIER_TIMEOUT_MS);
 			return completeSimple(
-				baseUrl ? ({ ...model, baseUrl } as Model<Api>) : model,
-				{ systemPrompt: system, messages: [{ role: "user", content: user, timestamp: Date.now() }] },
+				resolvedModel,
+				{ systemPrompt: system, messages: [{ role: "user", content: userText, timestamp: Date.now() }] },
 				{
 					apiKey: auth.apiKey,
 					headers: auth.headers,
 					env: auth.env,
 					signal: deps.signal ? AbortSignal.any([deps.signal, timeout]) : timeout,
-					...(process.env.CC_AUTO_MODE_DEBUG === "2"
-						? {
-								onPayload: (payload: unknown) => {
-									const body = payload as { system?: Array<Record<string, unknown>> };
-									const blocks = (body.system ?? []).map(
-										(b) =>
-											`{keys=${Object.keys(b).join(",")} textLen=${String((b as { text?: string }).text ?? "").length} cache=${JSON.stringify((b as { cache_control?: unknown }).cache_control)}}`,
-									);
-									process.stderr.write(`[auto-mode payload] systemBlocks=${blocks.join(" ")}\n`);
-									return undefined;
-								},
-							}
-						: {}),
 					maxTokens,
-					// `reasoning` is deliberately omitted: pi turns thinking off entirely
-					// when it is absent, which is what a classifier wants (fast, cheap,
-					// deterministic). Passing even "minimal" enables thinking, and the
-					// resulting budget is derived from maxTokens — at 512 that lands under
-					// Anthropic's 1024-token floor and every request 400s, which the gate
-					// then correctly but uselessly reports as a block.
-					//
-					// `temperature` is likewise NOT passed. It looks free — a classifier
-					// wants determinism — but it is deprecated on Claude Sonnet 5 and
-					// unsupported on Opus 4.7+, and pi's compat data still advertises it,
-					// so the request 400s and the gate blocks every single call. Several
-					// OpenAI reasoning models reject it too. A gate that must work across
-					// 38 providers cannot afford an option that fails closed on some of
-					// them for a property it does not need.
 					cacheRetention: "long",
+					...(reasoning ? { reasoning } : {}),
 				},
 			);
 		};
 
-		// A cut-off reply (stopReason "length") voids the verdict, so retry once with
-		// real headroom. Used for both the initial call and the post-timeout retry.
-		const attemptWithLengthRetry = async () => {
-			let reply = await attempt(1024);
-			if (reply.stopReason === "length") reply = await attempt(4096);
-			return reply;
+		// Turn one reply into text, or throw a StepError the loop knows how to route.
+		// `big` is the retry cap for a length-truncated reply; a still-truncated reply
+		// at `big` is its own outcome (not a candidate to step past).
+		const call = async (userText: string, base: number, big: number, stage: number): Promise<string> => {
+			const inspect = (reply: AssistantMessage): string | "length" => {
+				deps.onUsage?.(reply.usage);
+				if (deps.signal?.aborted) throw new StepError("cancelled", "cancelled");
+				if (reply.stopReason === "error" || reply.stopReason === "aborted") {
+					const msg = reply.errorMessage ?? reply.stopReason ?? "provider error";
+					if (isClassifierTimeout(msg)) throw new StepError("timeout", msg);
+					throw new StepError(isModelUnavailableError(msg) ? "unavailable" : "error", msg);
+				}
+				if (reply.stopReason === "length") return "length";
+				return replyText(reply);
+			};
+
+			let reply = await runCall(userText, base, stage);
+			let seen: string | "length";
+			try {
+				seen = inspect(reply);
+			} catch (error) {
+				// One retry on a timeout, before giving up on this model — a stall under
+				// load usually clears on a second try. A user cancel or a substantive
+				// error is not retried.
+				if (error instanceof StepError && error.kind === "timeout") {
+					reply = await runCall(userText, base, stage);
+					seen = inspect(reply);
+				} else {
+					throw error;
+				}
+			}
+			if (seen !== "length") return seen;
+			// A cut-off reply voids the verdict, so retry once with real headroom.
+			reply = await runCall(userText, big, stage);
+			const retried = inspect(reply);
+			if (retried === "length") throw new StepError("truncated", "verdict truncated at maxTokens");
+			return retried;
 		};
 
-		let failure: string | undefined;
 		try {
-			// A verdict is one JSON object, but the cap needs headroom over "one
-			// JSON object": models that reasoning cannot be disabled on (deepseek
-			// via opencode, observed live) burn output budget on deliberation —
-			// most on exactly the risky calls that deserve it — and a truncated
-			// reply voids the verdict. So a cut-off reply gets one retry with real
-			// headroom and a fresh timeout; the cap bounds runaway output, not
-			// typical cost, since replies still stop at the closing brace.
-			let reply = await attemptWithLengthRetry();
+			let verdict: ClassifyVerdict;
+			let stageInfo: string;
+
+			if (deps.reviewOnly) {
+				// A finished run has no harm floor to short-circuit — go straight to the
+				// full stage-2 evaluation, reframed to judge the whole sequence.
+				const text = await call(reviewUser(userPrefix), 1024, 4096, 2);
+				verdict = parseStage2(text, index, request.userMessages);
+				stageInfo = `review sev=${parseSeverity(text) ?? "?"}`;
+			} else {
+				// STAGE 1 — harm only. maxTokens 64 like CC; if the reply overruns 64
+				// without a readable severity, one retry with headroom recovers it.
+				const s1 = await call(stage1Text, 64, 1024, 1);
+				const sev1 = parseSeverity(s1);
+				if (sev1 !== null && sev1 < SEVERITY_THRESHOLD) {
+					verdict = { decision: "allow", reason: "", tier: "allow" };
+					stageInfo = `s1=${sev1} (cleared, no stage 2)`;
+				} else {
+					// sev1 >= 50, or unparseable → fall to the fuller stage-2 evaluation.
+					// stage2User is built here (not eagerly) so the common allow case
+					// does not concatenate the transcript prefix a second time.
+					const s2 = await call(stage2User(userPrefix, afterRuleDenial), 1024, 4096, 2);
+					verdict = parseStage2(s2, index, request.userMessages);
+					stageInfo = `s1=${sev1 ?? "?"} s2=${parseSeverity(s2) ?? "?"}`;
+					// Stage 1 flagged the call and stage 2 cleared it without quoting the
+					// user's intent or citing any rule. CC allows here (severity rules),
+					// so this stays an allow — but tagged, so the decision log and debug
+					// trace show a clear that rests on nothing checkable (review P11).
+					if (verdict.decision === "allow" && verdict.tier === "allow" && !verdict.ruleId) {
+						verdict = { ...verdict, ruleId: "unverified-clear" };
+					}
+				}
+			}
 
-			// One retry on a timeout, before giving up on this model. A stall under
-			// load usually clears on a second try; a model that is simply too slow
-			// times out again, and the loop then steps to the next candidate (or, if
-			// none remains, the call falls through to a user prompt). A *user* cancel
-			// also aborts — that is not a timeout and must not be retried.
-			if (
-				(reply.stopReason === "aborted" || reply.stopReason === "error") &&
-				!deps.signal?.aborted &&
-				isClassifierTimeout(reply.errorMessage ?? reply.stopReason ?? "")
-			) {
-				reply = await attemptWithLengthRetry();
+			// A verdict came back, so any building timeout streak is over.
+			deps.state.timeoutStreak = 0;
+			// Pin on the first success, so the classifier cannot change under the
+			// session and a working model is not re-litigated per call.
+			if (!deps.state.pinned) {
+				deps.state.pinned = model;
+				notifyOnce(deps, `using:${key}`, `Auto mode is screening calls with ${describeCandidate(candidate)}.`, "info");
+			}
+			if (debug) {
+				process.stderr.write(
+					`[auto-mode] ${key} ${request.toolName} → ${verdict.decision}` +
+						`${verdict.ruleId ? ` (${verdict.ruleId})` : ""} [${stageInfo}]\n` +
+						// An unverified intent quote is printed whole: the next mismatch class
+						// (2026-09-05 H4 was wrapping quotation marks) is only visible in the
+						// exact text the model produced.
+						(verdict.raw ? `  raw: ${verdict.ruleId === "intent-unverified" ? verdict.raw : verdict.raw.slice(0, 300)}\n` : ""),
+				);
 			}
+			return verdict;
+		} catch (error) {
+			// A non-StepError is an unexpected throw; treat it as a substantive
+			// "error" (surface it, don't step past it) — same as StepError("error").
+			const kind: StepKind = error instanceof StepError ? error.kind : "error";
+			lastError = error instanceof Error ? error.message : String(error);
 
-			if (reply.stopReason === "error" || reply.stopReason === "aborted") {
-				failure = reply.errorMessage ?? reply.stopReason;
-			} else if (reply.stopReason === "length") {
-				// Still cut off at 4096 — same treatment as an unparseable reply (a
-				// verdict that cannot be read approved nothing), but named, because
-				// "unreadable response" sent a live debugging session hunting for
-				// JSON bugs when the real cause was the output budget.
-				if (process.env.CC_AUTO_MODE_DEBUG) {
-					const u = reply.usage as { input?: number; output?: number; reasoning?: number } | undefined;
-					process.stderr.write(
-						`[auto-mode] ${key} ${request.toolName} → verdict truncated at maxTokens ` +
-							`(in=${u?.input ?? "?"} out=${u?.output ?? "?"} reasoning=${u?.reasoning ?? 0})\n`,
-					);
-				}
+			if (kind === "cancelled") {
+				return { decision: "block", reason: "Auto-mode classification was cancelled.", tier: "unmatched" };
+			}
+			if (kind === "truncated") {
+				if (debug) process.stderr.write(`[auto-mode] ${key} ${request.toolName} → verdict truncated at maxTokens\n`);
 				return {
 					decision: "block",
 					reason:
-						"The approval classifier's reply was cut off by its output limit before the verdict completed — its analysis ran too long. If this keeps happening, pin a stronger classifier model with /auto-mode model.",
+						"The approval classifier's reply was cut off by its output limit before the verdict completed. If this keeps happening, pin a stronger classifier model with /auto-mode model.",
 					tier: "unmatched",
 				};
-			} else {
-				const text = reply.content
-					.filter((block): block is { type: "text"; text: string } => block.type === "text")
-					.map((block) => block.text)
-					.join("");
-				const verdict = parseVerdict(text, index, request.userMessages);
-
-				// A verdict came back, so the timeout streak that might have been
-				// building is over.
-				deps.state.timeoutStreak = 0;
-
-				// Pin on the first success, so the classifier cannot change under the
-				// session and a working model is not re-litigated per call.
-				if (!deps.state.pinned) {
-					deps.state.pinned = model;
-					notifyOnce(deps, `using:${key}`, `Auto mode is screening calls with ${describeCandidate(candidate)}.`, "info");
-				}
-
-				// Allows carry no reason, so without this the permissive direction is
-				// invisible — which is the harder one to notice and the more costly one
-				// to get wrong. `CC_AUTO_MODE_DEBUG=1` puts the raw reply on stderr.
-				if (process.env.CC_AUTO_MODE_DEBUG) {
-					const u = reply.usage as
-						| {
-								input?: number;
-								output?: number;
-								reasoning?: number;
-								cacheRead?: number;
-								cacheWrite?: number;
-								cost?: unknown;
-						  }
-						| undefined;
-					const cost = u?.cost;
-					const spend =
-						cost && typeof cost === "object"
-							? Object.entries(cost as Record<string, unknown>)
-									.filter(([, value]) => typeof value === "number" && value > 0)
-									.map(([name, value]) => `${name}=$${(value as number).toFixed(6)}`)
-									.join(" ")
-							: "";
-					process.stderr.write(
-						`[auto-mode] ${key} ${request.toolName} → ${verdict.decision}${verdict.ruleId ? ` (${verdict.ruleId})` : ""}\n` +
-							`  usage: in=${u?.input ?? "?"} out=${u?.output ?? "?"} reasoning=${u?.reasoning ?? 0} cacheRead=${u?.cacheRead ?? 0} cacheWrite=${u?.cacheWrite ?? 0} ${spend}\n` +
-							`  raw: ${text.replace(/\s+/g, " ").slice(0, 400)}\n`,
+			}
+			if (kind === "error") {
+				// The provider refused the thinking-off request outright (metadata gap:
+				// no `thinkingLevelMap.off: null` on this catalog entry). Learn the
+				// model's floor once and retry the same candidate with it.
+				if (!reasoning && isReasoningMandatoryError(lastError)) {
+					const level = reasoningRetryLevel(model);
+					deps.state.forcedReasoning.set(key, level);
+					notifyOnce(
+						deps,
+						`forced-reasoning:${key}`,
+						`${key} cannot run with thinking disabled; the classifier now runs it at ${level} thinking.`,
+						"info",
 					);
+					queue.unshift(candidate);
+					continue;
 				}
-				return verdict;
+				// A substantive, non-transient failure that is not "model unusable here":
+				// surface it rather than papering over something about to clear.
+				return { decision: "block", reason: `Auto-mode classifier could not be reached (${lastError}).`, tier: "unmatched" };
 			}
-		} catch (error) {
-			failure = error instanceof Error ? error.message : String(error);
-		}
-
-		lastError = failure ?? "unknown error";
-
-		// A user cancel aborts the same way a timeout does. It is not a failure to
-		// route around — the user asked to stop, so stop.
-		if (deps.signal?.aborted) {
-			return { decision: "block", reason: "Auto-mode classification was cancelled.", tier: "unmatched" };
-		}
-
-		// A timeout (after the one retry above) is transient, so the model is NOT
-		// rejected — it may be fine on the next call. Instead we step to the next
-		// candidate, which is a different model of the *same or cheaper* price in
-		// the same provider (the chain is privacy- and budget-contained upstream).
-		// A pinned model that keeps timing out is unpinned so the session re-picks.
-		if (isClassifierTimeout(lastError)) {
-			sawTimeout = true;
-			if (deps.state.pinned && `${deps.state.pinned.provider}/${deps.state.pinned.id}` === key) {
-				deps.state.timeoutStreak += 1;
-				if (deps.state.timeoutStreak >= ROTATE_AFTER_TIMEOUTS) deps.state.pinned = undefined;
+			if (kind === "timeout") {
+				// Transient — do NOT reject the model, it may be fine next call. Step to
+				// the next candidate; a pinned model that keeps timing out is unpinned.
+				sawTimeout = true;
+				timedOutKey = key;
+				if (deps.state.pinned && `${deps.state.pinned.provider}/${deps.state.pinned.id}` === key) {
+					deps.state.timeoutStreak += 1;
+					if (deps.state.timeoutStreak >= ROTATE_AFTER_TIMEOUTS) deps.state.pinned = undefined;
+				}
+				continue;
 			}
-			continue;
-		}
-
-		// A model that is simply not usable here is worth stepping over. Any other
-		// transient failure is not: switching models would paper over something
-		// about to clear, so that surfaces as a block and the same model is tried
-		// again next call.
-		if (!isModelUnavailableError(lastError)) {
-			return {
-				decision: "block",
-				reason: `Auto-mode classifier could not be reached (${lastError}).`,
-				tier: "unmatched",
-			};
+			// unavailable: this model is not usable here — step over it and record it.
+			reject(key);
+			deps.onModelUnusable?.(key, lastError);
+			const isConfigured = candidate.source === "configured";
+			notifyOnce(
+				deps,
+				`rejected:${key}`,
+				isConfigured
+					? `Auto mode cannot use ${key} from autoMode.classifierModel (${lastError}). Set a different model in ~/.onecode/settings.json.`
+					: `Auto mode cannot use ${key} as its classifier (${lastError}); trying another model. Set autoMode.classifierModel in ~/.onecode/settings.json to choose one.`,
+				"warning",
+			);
 		}
-
-		reject(key);
-		const isConfigured = candidate.source === "configured";
-		notifyOnce(
-			deps,
-			`rejected:${key}`,
-			isConfigured
-				? `Auto mode cannot use ${key} from autoMode.classifierModel (${lastError}). Set a different model in ~/.claude/settings.json.`
-				: `Auto mode cannot use ${key} as its classifier (${lastError}); trying another model. Set autoMode.classifierModel in ~/.claude/settings.json to choose one.`,
-			"warning",
-		);
 	}
 
-	// Every candidate timed out (with a retry each) and none was reachable in
-	// time. This is NOT a judgement that the call is unsafe — it was never
-	// screened — so it is surfaced as its own tier. The gate turns a `timeout`
-	// into a user prompt where it can (there is someone to ask), and only blocks
-	// outright when running non-interactively.
+	// Every candidate timed out (with a retry each) and none was reachable in time.
+	// This is NOT a judgement that the call is unsafe — it was never screened — so
+	// it is surfaced as its own tier. The gate turns a timeout into a user prompt
+	// where it can, and only blocks outright when running non-interactively.
 	if (sawTimeout) {
+		const model = timedOutKey ? timedOutKey.split("/").pop() : undefined;
 		return {
 			decision: "block",
 			tier: "timeout",
 			reason:
-				"Auto mode could not screen this call in time — the approval classifier timed out, so the call was not judged either way. " +
-				"Approve it if you recognise it as safe, or pin a faster classifier with /auto-mode model.",
+				`Auto mode could not screen this ${request.toolName} call in time — the approval classifier${model ? ` (${model})` : ""} ` +
+				"is temporarily unavailable (timed out), so the call was not judged either way.",
 		};
 	}
 
-	// Every candidate was unusable — say which knob fixes it rather than leaving
-	// the user with a gate that blocks everything for no stated reason.
+	// Every candidate was unusable — say which knob fixes it.
 	return {
 		decision: "block",
-		reason: `No usable auto-mode classifier model (last error: ${lastError}). Set autoMode.classifierModel in ~/.claude/settings.json.`,
+		reason: `No usable auto-mode classifier model (last error: ${lastError}). Set autoMode.classifierModel in ~/.onecode/settings.json.`,
 		tier: "unmatched",
 	};
 }