one-code-extension 0.1.4 → 0.3.0

package/extensions/auto-mode/setup-run.ts

@@ -0,0 +1,245 @@
+/**
+ * `/auto-mode setup` — the impure half: gathering facts (exec/fs) and the
+ * drafting model call. Parsing, prompts, and validation live in setup.ts; UI
+ * wiring in extensions/permissions/index.ts.
+ *
+ * Gathering is best-effort probe-by-probe: any probe that fails lands in
+ * `gatherNotes` instead of the draft silently pretending it ran (the drafting
+ * prompt's evidence rules key off those notes). The model call mirrors the
+ * classifier's fail-loud shape — no reasoning/temperature, hard timeout, and a
+ * parse failure throws rather than persisting a half-read draft — but tries
+ * the SESSION model first: drafting wants the most capable model available,
+ * where the per-call classifier wants small-and-contained.
+ */
+
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { Api, Model } from "@earendil-works/pi-ai";
+import { completeSimple } from "@earendil-works/pi-ai/compat";
+import { claudeUserSettingsPath, readSettingsFile } from "../lib/claude-settings.ts";
+import { withReasoningFallback } from "../lib/model-policy.ts";
+import { oneCodeSettingsPath } from "../lib/one-code-settings.ts";
+import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
+import type { AutoModeConfig } from "./config.ts";
+import { classifierCandidates, replyText, withAuthBaseUrl } from "./model-select.ts";
+import { buildSetupPrompt, parseGitRemotes, redactSecrets, type SetupDraft, parseSetupDraft, type SetupFacts } from "./setup.ts";
+import { claudeUserDir } from "../lib/paths.ts";
+
+const PROBE_TIMEOUT_MS = 10_000;
+/** Drafting reads a big fact dump and writes a full slot list — give it room. */
+const DRAFT_TIMEOUT_MS = 120_000;
+const DRAFT_MAX_TOKENS = 8192;
+const CLAUDE_MD_LIMIT = 4_000;
+const HISTORY_LINES = 200;
+
+/** One probe: run a command, return trimmed stdout, or undefined on any failure. */
+function probe(cmd: string, args: string[], cwd: string, notes: string[], what: string): Promise<string | undefined> {
+	return new Promise((resolve) => {
+		execFile(cmd, args, { cwd, timeout: PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) => {
+			if (error) {
+				notes.push(`${what} was not gathered (${cmd} failed: ${error.message.split("\n")[0]})`);
+				resolve(undefined);
+			} else {
+				resolve(stdout.trim());
+			}
+		});
+	});
+}
+
+/**
+ * Read a file if it exists, truncated to `limit`. A file that exists but
+ * cannot be read is NOT the same as no file: it lands in `notes` so the
+ * drafting prompt's evidence rules see "present but unreadable" rather than
+ * silently treating it as absent.
+ */
+const readIfPresent = (path: string, limit: number, notes: string[], what: string): string | undefined => {
+	try {
+		if (!existsSync(path)) return undefined;
+		const text = readFileSync(path, "utf-8");
+		return text.length > limit ? `${text.slice(0, limit)}\n…[truncated]` : text;
+	} catch (error) {
+		notes.push(`${what} exists but could not be read (${(error as Error).message.split("\n")[0]})`);
+		return undefined;
+	}
+};
+
+export interface GatherOptions {
+	cwd: string;
+	home: string;
+	username: string;
+	/** The user's answer to the usage question, verbatim. */
+	usage: string;
+	includeShellHistory: boolean;
+}
+
+export async function gatherFacts(options: GatherOptions): Promise<SetupFacts> {
+	const { cwd, home } = options;
+	const notes: string[] = [];
+
+	const gitRoot = await probe("git", ["rev-parse", "--show-toplevel"], cwd, notes, "git root");
+	// The three follow-ups depend only on gitRoot, not on each other — run them
+	// concurrently so a slow `gh` (network) does not stack on the local git calls.
+	const [remotesRaw, branch, ghRaw] = gitRoot
+		? await Promise.all([
+				probe("git", ["remote", "-v"], cwd, notes, "git remotes"),
+				probe("git", ["branch", "--show-current"], cwd, notes, "current branch"),
+				// gh gives visibility/default branch for the repo the cwd is in; treat
+				// its absence as "unknown", never as "private".
+				probe("gh", ["repo", "view", "--json", "visibility,nameWithOwner,defaultBranchRef"], cwd, notes, "repository visibility (gh)"),
+			])
+		: [undefined, undefined, undefined];
+
+	let repoVisibility: string | undefined;
+	let repoNameWithOwner: string | undefined;
+	let defaultBranch: string | undefined;
+	if (ghRaw) {
+		try {
+			const parsed = JSON.parse(ghRaw) as {
+				visibility?: string;
+				nameWithOwner?: string;
+				defaultBranchRef?: { name?: string };
+			};
+			repoVisibility = parsed.visibility;
+			repoNameWithOwner = parsed.nameWithOwner;
+			defaultBranch = parsed.defaultBranchRef?.name;
+		} catch {
+			notes.push("gh repo view returned unparseable JSON — repository visibility unknown");
+		}
+	}
+
+	let shellHistory: string[] | undefined;
+	if (options.includeShellHistory) {
+		const histFile = [process.env.HISTFILE, join(home, ".zsh_history"), join(home, ".bash_history")]
+			.filter((path): path is string => !!path)
+			.find((path) => existsSync(path));
+		if (histFile) {
+			const raw = readIfPresent(histFile, 1024 * 1024, notes, "shell history") ?? "";
+			shellHistory = raw
+				.split("\n")
+				.slice(-HISTORY_LINES)
+				// zsh extended history stamps "": 1699999999:0;cmd" — keep the command half.
+				.map((line) => redactSecrets(line.replace(/^:\s*\d+:\d+;/, "").trim()))
+				.filter(Boolean);
+		} else {
+			notes.push("no shell history file found — usage patterns not gathered");
+		}
+	} else {
+		notes.push("shell history scan declined by the user");
+	}
+
+	// User-scope permissions.allow — audit input, and evidence for carve-outs. Both
+	// the borrowed `.claude` file (read-only) and One Code's own file are gathered:
+	// a broad rule in either bypasses the classifier, and the audit later splits
+	// them (One Code's are removable; Claude Code's it can only warn about).
+	const claudeUserPath = claudeUserSettingsPath(home);
+	const permissionsAllow: string[] = [];
+	for (const path of [claudeUserPath, oneCodeSettingsPath(home)]) {
+		const file = readSettingsFile(path) as { permissions?: { allow?: unknown } } | undefined;
+		// Present-but-unreadable is not the same as absent (readIfPresent's rule):
+		// a malformed `.claude` file must land in notes so the drafting evidence
+		// sees "present but unreadable", not silently "no broad rules here".
+		if (file === undefined && path === claudeUserPath && existsSync(path)) {
+			notes.push("user settings permissions.allow could not be read");
+			continue;
+		}
+		const allow = file?.permissions?.allow;
+		if (Array.isArray(allow)) permissionsAllow.push(...allow.filter((entry): entry is string => typeof entry === "string"));
+	}
+
+	return {
+		cwd,
+		username: options.username,
+		usage: options.usage,
+		gitRoot: gitRoot || undefined,
+		remotes: remotesRaw ? parseGitRemotes(remotesRaw) : [],
+		currentBranch: branch || undefined,
+		repoVisibility,
+		repoNameWithOwner,
+		defaultBranch,
+		claudeMdProject: readIfPresent(join(gitRoot || cwd, "CLAUDE.md"), CLAUDE_MD_LIMIT, notes, "project CLAUDE.md"),
+		claudeMdGlobal: readIfPresent(join(claudeUserDir(home), "CLAUDE.md"), CLAUDE_MD_LIMIT, notes, "global CLAUDE.md"),
+		shellHistory,
+		permissionsAllow,
+		gatherNotes: notes,
+	};
+}
+
+export interface DraftDeps {
+	registry: ModelRegistry;
+	sessionModel: Model<Api> | undefined;
+	config: AutoModeConfig;
+	defaultEnvironment: string[];
+	signal?: AbortSignal;
+	/** Surfaces candidate-chain warnings (a stale or cross-provider classifierModel) to the user. */
+	onNotice?: (message: string, level: "info" | "warning") => void;
+	/** Reports the drafting call's usage to the all-in footer cost. */
+	onUsage?: (usage: unknown) => void;
+}
+
+/**
+ * Draft the setup with the most capable model reachable: the session model
+ * first, then the classifier candidate chain. Throws on total failure or an
+ * unusable draft — the wizard has a user in front of it; nothing here may
+ * persist silently wrong.
+ */
+export async function draftSetup(facts: SetupFacts, deps: DraftDeps): Promise<SetupDraft> {
+	const built = classifierCandidates({
+		available: deps.registry.getAvailable(),
+		sessionModel: deps.sessionModel,
+		configured: deps.config.classifierModel,
+		configuredSetForContainment: deps.config.classifierModelSetFor,
+	});
+	// The same warnings runClassifier surfaces during real gating (a stale or
+	// cross-provider classifierModel) — setup is exactly where the user can fix
+	// them, so they must not be dropped here.
+	for (const notice of built.notices) deps.onNotice?.(notice.text, notice.level);
+	const chain = built.candidates.map((entry) => entry.model);
+	const models: Model<Api>[] = [];
+	for (const model of deps.sessionModel ? [deps.sessionModel, ...chain] : chain) {
+		if (!models.some((seen) => seen.provider === model.provider && seen.id === model.id)) models.push(model);
+	}
+	if (models.length === 0) throw new Error("no model is available to draft the setup");
+
+	const { system, user } = buildSetupPrompt(facts, deps.defaultEnvironment);
+	let lastError = "";
+	for (const model of models) {
+		const auth = await deps.registry.getApiKeyAndHeaders(model);
+		if (!auth.ok) {
+			lastError = auth.error;
+			continue;
+		}
+		const resolved = withAuthBaseUrl(model, auth);
+		// Thinking stays off unless the model cannot disable it (withReasoningFallback
+		// sends a level up front for catalog-marked models and retries on the 400 for
+		// the rest). A rare one-off, so no cross-run memo.
+		const reply = await withReasoningFallback(model, (reasoning) => {
+			const timeout = AbortSignal.timeout(DRAFT_TIMEOUT_MS);
+			return completeSimple(
+				resolved,
+				{ systemPrompt: system, messages: [{ role: "user", content: user, timestamp: Date.now() }] },
+				{
+					apiKey: auth.apiKey,
+					headers: auth.headers,
+					env: auth.env,
+					signal: deps.signal ? AbortSignal.any([deps.signal, timeout]) : timeout,
+					maxTokens: DRAFT_MAX_TOKENS,
+					...(reasoning ? { reasoning } : {}),
+				},
+			);
+		}, undefined, deps.onUsage);
+		if (reply.stopReason === "error" || reply.stopReason === "aborted") {
+			if (deps.signal?.aborted) throw new Error("setup drafting was cancelled");
+			lastError = reply.errorMessage ?? reply.stopReason;
+			continue; // a dead model steps to the next candidate; a bad draft does not
+		}
+		if (reply.stopReason === "length") {
+			lastError = "draft truncated at maxTokens";
+			continue;
+		}
+		// Parse errors are NOT stepped past: the model responded, its output is
+		// unusable, and retrying a different model would hide a prompt bug.
+		return parseSetupDraft(replyText(reply), deps.defaultEnvironment);
+	}
+	throw new Error(`no model could draft the setup (last error: ${lastError})`);
+}

package/extensions/auto-mode/setup.ts

@@ -0,0 +1,235 @@
+/**
+ * `/auto-mode setup` — the pure half (Claude Code's `/auto-mode-setup` parity).
+ *
+ * CC 2.1.233 ships a setup wizard: it scans the project, recent usage, and
+ * optionally shell history, drafts an auto-mode config (Environment slots,
+ * allow carve-outs, extra soft/hard blocks), shows it for review, and writes
+ * the `autoMode` object to user settings. It also audits `permissions.allow`
+ * for entries broad enough to bypass the classifier ("rules that skip
+ * checks"). This module holds everything unit-testable about ours: fact
+ * parsing, the drafting prompt, strict draft parsing, proposal rendering, and
+ * the allow-rule audit. Gathering (exec/fs) and the model call live in
+ * setup-run.ts; UI wiring in extensions/permissions/index.ts.
+ *
+ * Evidence discipline (CC's, kept deliberately): the draft may only assert
+ * what the gathered facts show — everything else stays at its shipped
+ * default ("None configured" / the conservative heuristic). A wizard that
+ * guesses trust boundaries manufactures authorization; one that leaves gaps
+ * merely classifies a little more often.
+ */
+
+import { isBroadExecutionRule, parseRule } from "../permissions/matcher.ts";
+import { slotName } from "./defaults.ts";
+
+export interface SetupFacts {
+	cwd: string;
+	username: string;
+	/** The user's own answer to "how do you use this project" — verbatim. */
+	usage: string;
+	gitRoot?: string;
+	remotes: { name: string; url: string }[];
+	currentBranch?: string;
+	/** From `gh repo view` — "PUBLIC"/"PRIVATE"/"INTERNAL", or undefined if unknown. */
+	repoVisibility?: string;
+	repoNameWithOwner?: string;
+	defaultBranch?: string;
+	/** Truncated CLAUDE.md contents, project and global. */
+	claudeMdProject?: string;
+	claudeMdGlobal?: string;
+	/** Recent shell-history lines (opt-in), secrets already redacted. */
+	shellHistory?: string[];
+	/** User-scope permissions.allow rules — audit input and carve-out evidence. */
+	permissionsAllow: string[];
+	/** What could NOT be gathered, so the draft cannot pretend it was. */
+	gatherNotes: string[];
+}
+
+/** What the drafting model must return; also the shape persisted to settings. */
+export interface SetupDraft {
+	environment: string[];
+	allow: string[];
+	soft_deny: string[];
+	hard_deny: string[];
+	notes: string[];
+}
+
+/** `git remote -v` output → unique {name, url} pairs (fetch/push collapsed). */
+export function parseGitRemotes(output: string): { name: string; url: string }[] {
+	const seen = new Map<string, string>();
+	for (const line of output.split("\n")) {
+		const match = line.match(/^(\S+)\s+(\S+)\s+\((?:fetch|push)\)$/);
+		if (match && !seen.has(match[1])) seen.set(match[1], match[2]);
+	}
+	return [...seen.entries()].map(([name, url]) => ({ name, url }));
+}
+
+/** Redact obvious secret material before shell history leaves the machine. */
+export function redactSecrets(line: string): string {
+	return line
+		.replace(/\b([A-Za-z_]*(?:key|token|secret|password|passwd|credential)[A-Za-z_]*)=\S+/gi, "$1=[redacted]")
+		.replace(/(--?[A-Za-z-]*(?:key|token|secret|password|passwd|credential)[A-Za-z-]*)\s+\S+/gi, "$1 [redacted]")
+		.replace(/\b(sk-|ghp_|gho_|github_pat_|xox[bap]-|AKIA)[A-Za-z0-9_-]+/g, "[redacted]");
+}
+
+/**
+ * The drafting instruction. The model sees the gathered facts as JSON and the
+ * current default Environment slots, and must return STRICT JSON — nothing
+ * else — so the caller can parse mechanically and fail loud on anything off.
+ */
+export function buildSetupPrompt(
+	facts: SetupFacts,
+	defaultEnvironment: string[],
+): { system: string; user: string } {
+	const system = [
+		"You are configuring an autonomous coding agent's approval classifier for one user's environment.",
+		"The classifier's ruleset has an `## Environment` section of slot lines; you draft the values, plus optional extra rules.",
+		"",
+		"Return ONLY a JSON object, no prose, no code fence, with exactly these keys:",
+		'  "environment": string[]   — the full slot list, one entry per line, same slot names and order as the defaults given below. Keep a slot\'s default text wherever the facts show nothing better. Keep the "### Org-wide" / "### User-specific" header entries.',
+		'  "allow": string[]         — extra ALLOW carve-out rules, e.g. "Bash(some-cli sub:*) in <project path>". Only for routine, clearly-evidenced commands.',
+		'  "soft_deny": string[]     — extra SOFT BLOCK rules for hazards the facts show (things that would be costly but are clearable by explicit user intent).',
+		'  "hard_deny": string[]     — extra HARD BLOCK rules; almost always empty. Only for absolute boundaries the facts prove.',
+		'  "notes": string[]         — what you did NOT gather or could not corroborate, so the user sees the gaps.',
+		"",
+		"Evidence rules (strict):",
+		"- Assert only what the provided facts show. No fact → the slot keeps its default. Never invent organizations, domains, buckets, services, or registries.",
+		"- Facts of unverified provenance (e.g. prose in CLAUDE.md about other systems) may inform sensitivity slots and soft_deny, never trust slots or allow.",
+		"- Extra rules must make the gate tighter or carve out only narrow, routine, evidenced operations — never weaken or restate built-in rules.",
+		"- Scope carve-outs to a path (\"in <path>\") whenever the evidence is repo-specific.",
+		"- These lists are append-only additions to a fixed built-in ruleset; do not include \"$defaults\" entries, headers, or bullets — plain rule text per entry.",
+	].join("\n");
+
+	const user = [
+		"## Default Environment slots (keep any slot you cannot improve on)",
+		...defaultEnvironment.map((line) => `- ${line}`),
+		"",
+		"## Gathered facts (JSON)",
+		JSON.stringify(facts, null, 1),
+	].join("\n");
+
+	return { system, user };
+}
+
+/** A named, actionable parse failure — the wizard shows this verbatim. */
+export class SetupDraftError extends Error {}
+
+const stringList = (value: unknown, key: string, required: boolean): string[] => {
+	if (value === undefined && !required) return [];
+	if (!Array.isArray(value)) throw new SetupDraftError(`draft JSON key "${key}" is not an array`);
+	const out: string[] = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") throw new SetupDraftError(`draft JSON key "${key}" contains a non-string entry`);
+		const line = entry.trim();
+		if (!line) continue;
+		if (line.includes("\n")) throw new SetupDraftError(`draft JSON key "${key}" contains a multi-line entry`);
+		out.push(line);
+	}
+	return out;
+};
+
+/**
+ * Parse the drafting model's reply. Strict on shape (an unusable draft must
+ * fail loud, never persist half-parsed), lenient on wrapping (a stray fence or
+ * leading prose is tolerated by extracting the outermost JSON object).
+ *
+ * When `defaultEnvironment` is given, the drafted environment must cover every
+ * built-in slot name — the wizard's environment is a full REPLACEMENT (no
+ * `$defaults` fallback exists for it), so a truncated draft that quietly drops
+ * slots the user never chose to drop is rejected, not saved.
+ */
+export function parseSetupDraft(text: string, defaultEnvironment: string[] = []): SetupDraft {
+	const start = text.indexOf("{");
+	const end = text.lastIndexOf("}");
+	if (start < 0 || end <= start) throw new SetupDraftError("the drafting model returned no JSON object");
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(text.slice(start, end + 1));
+	} catch (error) {
+		throw new SetupDraftError(`the drafting model returned malformed JSON (${(error as Error).message})`);
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+		throw new SetupDraftError("the drafting model's JSON is not an object");
+	}
+	const record = parsed as Record<string, unknown>;
+	// "$defaults" is stripped everywhere: the prompt forbids it, and in the
+	// environment specifically a stray one would later splice the entire built-in
+	// slot block into the middle of the curated list (config.ts spliceDefaults).
+	const noDefaults = (entries: string[]) => entries.filter((entry) => entry !== "$defaults");
+	const environment = noDefaults(
+		stringList(record.environment, "environment", true).map((entry) =>
+			// Tolerate a model that bullets the lines anyway — entries are stored bare.
+			entry.startsWith("- ") ? entry.slice(2) : entry,
+		),
+	);
+	if (environment.length === 0) throw new SetupDraftError('draft JSON key "environment" is empty');
+	const drafted = new Set(environment.map(slotName).filter(Boolean));
+	const missing = defaultEnvironment.map(slotName).filter((name): name is string => !!name && !drafted.has(name));
+	if (missing.length > 0) {
+		throw new SetupDraftError(`draft environment is missing built-in slot(s): ${missing.join(", ")}`);
+	}
+	return {
+		environment,
+		allow: noDefaults(stringList(record.allow, "allow", false)),
+		soft_deny: noDefaults(stringList(record.soft_deny, "soft_deny", false)),
+		hard_deny: noDefaults(stringList(record.hard_deny, "hard_deny", false)),
+		notes: stringList(record.notes, "notes", false),
+	};
+}
+
+/** The review text — CC's proposal screen, in plain notify-able form. */
+export function renderProposal(draft: SetupDraft): string {
+	const section = (title: string, entries: string[], empty: string) =>
+		entries.length > 0 ? `${title}\n${entries.map((entry) => `  · ${entry}`).join("\n")}` : `${title}\n  ${empty}`;
+	return [
+		section("Environment", draft.environment, "(none — this should not happen)"),
+		section("Allow carve-outs", draft.allow, "none suggested"),
+		section("Extra soft blocks", draft.soft_deny, "none suggested"),
+		section("Extra hard blocks", draft.hard_deny, "none suggested"),
+		...(draft.notes.length > 0 ? [section("Notes", draft.notes, "")] : []),
+	].join("\n\n");
+}
+
+/**
+ * The `autoMode` keys the wizard persists (merged over other autoMode keys by
+ * config.persistAutoModeSetup). Rule lists carry the "$defaults" sentinel the
+ * way CC's wizard writes them; lists with no extras are omitted entirely so
+ * settings stay minimal.
+ */
+export function settingsPatch(draft: SetupDraft): Record<string, string[] | undefined> {
+	const listOrOmit = (entries: string[]) => (entries.length > 0 ? ["$defaults", ...entries] : undefined);
+	return {
+		environment: draft.environment,
+		allow: listOrOmit(draft.allow),
+		soft_deny: listOrOmit(draft.soft_deny),
+		hard_deny: listOrOmit(draft.hard_deny),
+	};
+}
+
+export interface FlaggedAllowRule {
+	rule: string;
+	why: string;
+}
+
+/**
+ * CC's "rules that skip checks" audit: permissions.allow entries broad enough
+ * to hand the model a standing way past the classifier. The judgement is the
+ * gate's own `isBroadExecutionRule` — the exact predicate auto mode already
+ * uses to suspend such rules at decision time — so the audit can never flag
+ * differently than the gate behaves. Flagging is advice; removal is the
+ * user's call.
+ */
+export function auditPermissionAllow(rules: string[]): FlaggedAllowRule[] {
+	const flagged: FlaggedAllowRule[] = [];
+	for (const raw of rules) {
+		const rule = parseRule(raw);
+		if (!rule || !isBroadExecutionRule(rule)) continue;
+		flagged.push({
+			rule: raw,
+			why:
+				rule.tool === "bash"
+					? "grants arbitrary code execution — matching commands never reach auto mode's checks"
+					: "pre-approves a fresh agent loop — whatever the delegated agent does is unchecked",
+		});
+	}
+	return flagged;
+}