one-code-extension 0.4.0 → 0.5.0

package/extensions/auto-mode/history.ts

@@ -0,0 +1,189 @@
+/** Project the active session branch for the classifier; never keep a second transcript. */
+import { createHash } from "node:crypto";
+import { inContextEntries, latestCompaction } from "../lib/compaction-boundary.ts";
+import { isHistoricalRead, type TranscriptEntry } from "./transcript.ts";
+
+/** Non-model-facing provenance for user messages and harness permission facts. */
+export const CLASSIFIER_USER_INPUT = "auto-mode-user-input";
+export const CLASSIFIER_TOOL_META = "auto-mode-tool-meta";
+
+export function messageText(content: unknown): string {
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	return content.map((block) => block?.type === "text" && typeof block.text === "string" ? block.text : "").filter(Boolean).join("\n");
+}
+
+function record(value: unknown): Record<string, any> {
+	return value !== null && typeof value === "object" ? value as Record<string, any> : {};
+}
+
+/**
+ * A user message's identity in the provenance entries: its timestamp and a
+ * digest of its text. Provenance only has to recognise the message, so the
+ * text itself is not stored a second time.
+ */
+export function userMessageDigest(text: string): string {
+	return createHash("sha256").update(text).digest("hex").slice(0, 32);
+}
+
+function userMessageKey(timestamp: unknown, digest: string): string {
+	return JSON.stringify([timestamp, digest]);
+}
+
+/** What a branch's provenance entries say, and how far into the branch that was read. */
+interface ProvenanceIndex {
+	head?: string;
+	length: number;
+	tail?: unknown;
+	/** Whether the branch has any provenance entry: none means a session from before provenance. */
+	recorded: boolean;
+	byKey: Map<string, string | null>;
+	/** Entry id → digest of that user message's text. */
+	digests: Map<string, string>;
+}
+
+let provenanceMemo: ProvenanceIndex | undefined;
+
+/**
+ * The provenance entries of a branch. pi only appends, so a gated call
+ * resumes the scan where the previous one stopped; a branch whose prefix
+ * changed (a new session, a /tree switch past the read point) is read again.
+ * Entries without ids are never memoised.
+ */
+function provenanceIndex(branch: readonly unknown[]): ProvenanceIndex {
+	const id = (i: number): unknown => record(branch[i]).id;
+	const head = id(0);
+	const memo = provenanceMemo;
+	const resumable = typeof head === "string" && memo !== undefined && memo.head === head && memo.length <= branch.length && (memo.length === 0 || id(memo.length - 1) === memo.tail);
+	const index: ProvenanceIndex = resumable ? memo : { head: typeof head === "string" ? head : undefined, length: 0, recorded: false, byKey: new Map(), digests: new Map() };
+	for (let i = index.length; i < branch.length; i++) {
+		const entry = record(branch[i]);
+		if (entry.type !== "custom" || entry.customType !== CLASSIFIER_USER_INPUT) continue;
+		index.recorded = true;
+		const data = record(entry.data);
+		if (typeof data.userText !== "string" && data.userText !== null) continue;
+		// Entries written before the digest carry the message text itself.
+		const digest = typeof data.messageDigest === "string" ? data.messageDigest : typeof data.messageText === "string" ? userMessageDigest(data.messageText) : undefined;
+		if (digest !== undefined) index.byKey.set(userMessageKey(data.timestamp, digest), data.userText);
+	}
+	index.length = branch.length;
+	index.tail = id(branch.length - 1);
+	provenanceMemo = typeof head === "string" && typeof index.tail === "string" ? index : undefined;
+	return index;
+}
+
+/**
+ * The words a user-role message gives the classifier as the user's own: the
+ * input event's text when recorded, null for an extension-generated turn.
+ * Every user message gets an entry once the gate is loaded, so a message
+ * without one was written before it (plain pi, or a build before provenance)
+ * and is unverified (null), even after the resumed session records new ones.
+ */
+function userWords(index: ProvenanceIndex, entry: Record<string, any>, message: Record<string, any>, text: string): string | null {
+	if (!index.recorded) return null;
+	let digest = typeof entry.id === "string" ? index.digests.get(entry.id) : undefined;
+	if (digest === undefined) {
+		digest = userMessageDigest(text);
+		if (typeof entry.id === "string") index.digests.set(entry.id, digest);
+	}
+	return index.byKey.get(userMessageKey(message.timestamp, digest)) ?? null;
+}
+
+/** Where the projected history ends; neither field reads the whole active branch. */
+export interface HistoryCursor {
+	beforeToolCallId?: string;
+	throughToolCallId?: string;
+}
+
+/**
+ * Where a subagent's view of the main session ends, for its own gated calls
+ * and its hand-back review. pi persists the main turn's whole tool-call batch
+ * before any of it runs, so a later call in that batch is not yet context.
+ * A child started by a call in the batch in flight (its Agent call, or the
+ * SendMessage call that began this turn) sees through that call; one started
+ * in an earlier turn sees every finished turn and none of the batch in
+ * flight; with nothing in flight it sees the whole branch. A child whose
+ * starting call is unknown (a workflow agent, a cron fire) keeps the last
+ * main call as its cursor.
+ */
+export function childHistoryCursor(startedBy: string | undefined, inFlight: readonly string[], lastMainCall: string | undefined): HistoryCursor {
+	if (startedBy === undefined) return { throughToolCallId: lastMainCall };
+	if (inFlight.includes(startedBy)) return { throughToolCallId: startedBy };
+	return inFlight.length > 0 ? { beforeToolCallId: inFlight[0] } : {};
+}
+
+/**
+ * The summary comes before the kept tail, though its stored entry follows it.
+ * `beforeToolCallId` excludes the pending call and later calls from the same
+ * assistant message (pi persists the whole tool-call batch before executing it).
+ * A bridged child uses `throughToolCallId` to include its parent's running call.
+ */
+export function classifierHistory(branch: readonly unknown[], options: HistoryCursor = {}): {
+	transcript: TranscriptEntry[];
+	userMessages: string[];
+} {
+	const transcript: TranscriptEntry[] = [];
+	const userMessages: string[] = [];
+	const boundary = latestCompaction(branch);
+	if (boundary) {
+		const summary = record(branch[boundary.index]).summary;
+		if (typeof summary === "string" && summary) transcript.push({ kind: "summary", text: summary });
+	}
+	const provenance = provenanceIndex(branch);
+	const active = inContextEntries(branch).map(record);
+	const facts = new Map<string, Record<string, any>[]>();
+	for (const entry of active) {
+		if (entry.type !== "custom" || entry.customType !== CLASSIFIER_TOOL_META) continue;
+		const data = record(entry.data);
+		if (typeof data.toolCallId !== "string") continue;
+		const list = facts.get(data.toolCallId) ?? [];
+		list.push(data);
+		facts.set(data.toolCallId, list);
+	}
+	let reachedPending = false;
+	for (const entry of active) {
+		if (reachedPending) break;
+		if (entry.type === "branch_summary" && typeof entry.summary === "string") {
+			transcript.push({ kind: "summary", text: entry.summary });
+			continue;
+		}
+		if (entry.type !== "message") continue;
+		const message = record(entry.message);
+		if (message.role === "user") {
+			// Sessions preserve the input event's source, so extension-generated
+			// turns never gain intent authority on resume and expanded skill text
+			// is not credited as typed.
+			const userText = userWords(provenance, entry, message, messageText(message.content));
+			if (userText?.trim()) {
+				transcript.push({ kind: "user", text: userText.trim() });
+				userMessages.push(userText.trim());
+			}
+		} else if (message.role === "assistant" && Array.isArray(message.content)) {
+			for (const rawBlock of message.content) {
+				const block = record(rawBlock);
+				if (block.type !== "toolCall" || typeof block.name !== "string") continue;
+				if (options.beforeToolCallId !== undefined && block.id === options.beforeToolCallId) {
+					reachedPending = true;
+					break;
+				}
+				const tool: TranscriptEntry = { kind: "tool", tool: block.name, input: record(block.arguments) };
+				if (!isHistoricalRead(tool)) {
+					for (const fact of facts.get(block.id) ?? []) if (fact.gitStatus) transcript.push({ kind: "meta", gitStatus: fact.gitStatus });
+					transcript.push(tool);
+				}
+				// A standing permission-rule denial is relevant even when the local
+				// read input itself is omitted from ordinary history.
+				for (const fact of facts.get(block.id) ?? []) {
+					if (typeof fact.deniedSubject === "string" && typeof fact.rule === "string") {
+						transcript.push({ kind: "denied", tool: block.name, subject: fact.deniedSubject, rule: fact.rule });
+					}
+				}
+				if (options.throughToolCallId !== undefined && block.id === options.throughToolCallId) {
+					reachedPending = true;
+					break;
+				}
+			}
+		}
+	}
+	return { transcript, userMessages };
+}

package/extensions/auto-mode/instructions.ts

@@ -2,8 +2,16 @@
  * Project instruction files for the classifier (pure fs).
  *
  * Claude Code's classifier reads the same CLAUDE.md the agent does, so an
- * instruction like "never force push" steers both at once. This collects the
- * same files: cwd upward to the git root, plus the user's global file.
+ * instruction like "never force push" steers both at once. This runs the
+ * agent's own discovery (lib/claude-context.ts, lib/claude-rules.ts): the
+ * managed and global files, every ancestor's CLAUDE.md, `.claude/CLAUDE.md`,
+ * `.claude/rules` and CLAUDE.local.md, ONECODE.md, with the same external
+ * import consent and symlink confinement, and in independent mode only the
+ * AGENTS.md and ONECODE.md files. Two widenings, since an instruction here can
+ * only tighten: AGENTS.md loads whatever `instructionFiles` picks for the
+ * agent, and every path-conditional rule loads, labelled with its paths, not
+ * only those for files the agent has read (the block opens the cached
+ * classifier prefix, so it must not change as the session touches new paths).
  *
  * These files are checked in, so they are untrusted input in a way the user's
  * own messages are not — the classifier prompt tells the model they may tighten
@@ -11,65 +19,63 @@
  * them safe; without it, a repository could ship its own authorisation.
  */
 
-import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { claudeUserDir } from "../lib/paths.ts";
+import { ancestorDirs, discoverContextFiles, discoverOneCodeFiles } from "../lib/claude-context.ts";
+import { readExternalIncludesApproval } from "../lib/claude-external-includes.ts";
+import { discoverRules, type RuleFile } from "../lib/claude-rules.ts";
+import { claudeSourcesOn } from "../lib/config-mode.ts";
+import { claudeManagedDir, claudeUserDir, oneCodeStateDir, tryRealpath } from "../lib/paths.ts";
 
-const FILE_NAMES = ["CLAUDE.md", "CLAUDE.local.md", "AGENTS.md"];
-
-/** Per-file and total caps, so a large instruction file cannot crowd out rules. */
-const PER_FILE_LIMIT = 6_000;
-const TOTAL_LIMIT = 12_000;
-
-function readCapped(path: string): string | undefined {
-	try {
-		// readFileSync loads the whole file regardless, so the cap is applied to the
-		// decoded string. (A prior statSync branch claimed to bound the read but did
-		// the same full read either way.)
-		return readFileSync(path, "utf-8").slice(0, PER_FILE_LIMIT);
-	} catch {
-		return undefined;
-	}
+/** One file the classifier is shown. */
+interface InstructionFile {
+	path: string;
+	content: string;
+	/** A path-conditional rule's globs, named in its heading. */
+	globs?: string[];
 }
 
-function findGitRoot(from: string): string | undefined {
-	let dir = from;
-	for (;;) {
-		if (existsSync(join(dir, ".git"))) return dir;
-		const parent = dirname(dir);
-		if (parent === dir) return undefined;
-		dir = parent;
-	}
+/**
+ * Every path-conditional rule from the directories the agent reads rules
+ * from, under the same consent: managed, the user's, and each ancestor's
+ * `.claude/rules`.
+ */
+function conditionalRules(cwd: string, home: string, homeClaudeDir: string, includeExternal: boolean): RuleFile[] {
+	const dirs: { rulesDir: string; scope: "Managed" | "User" | "Project" }[] = [
+		{ rulesDir: join(claudeManagedDir(), ".claude", "rules"), scope: "Managed" },
+		{ rulesDir: join(homeClaudeDir, "rules"), scope: "User" },
+		...ancestorDirs(cwd).filter((dir) => dirname(dir) !== dir).map((dir) => ({ rulesDir: join(dir, ".claude", "rules"), scope: "Project" as const })),
+	];
+	return dirs.flatMap(({ rulesDir, scope }) =>
+		discoverRules({ rulesDir, scope, cwd, home, allConditional: true, ...(scope !== "User" ? { includeExternal } : {}) }),
+	);
 }
 
 /**
- * Concatenated instruction files, nearest first, or undefined when there are
- * none. Each is labelled with its path so the classifier can tell project
- * convention from user-global preference.
+ * Concatenated instruction files in the agent's order (managed and global,
+ * then each directory from the farthest down, ONECODE.md last), each labelled
+ * with its path so the classifier can tell project convention from
+ * user-global preference; undefined when there are none. Every file is whole,
+ * as Claude Code's classifier gets the agent's CLAUDE.md: a cut would drop the
+ * restrictions past it. A transcript too large for the classifier's window is
+ * not judged (`decisions/auto-mode.md`).
  */
 export function loadProjectInstructions(cwd: string, home: string): string | undefined {
-	const stop = findGitRoot(cwd) ?? cwd;
-	const parts: string[] = [];
-	let total = 0;
-
-	const add = (path: string) => {
-		if (total >= TOTAL_LIMIT || !existsSync(path)) return;
-		const body = readCapped(path)?.trim();
-		if (!body) return;
-		const chunk = `# ${path}\n${body}`;
-		parts.push(chunk.slice(0, TOTAL_LIMIT - total));
-		total += chunk.length;
+	const claude = claudeSourcesOn();
+	const homeClaudeDir = claudeUserDir(home);
+	const includeExternal = claude && readExternalIncludesApproval(cwd, home).approved;
+	const files: InstructionFile[] = [];
+	const seen = new Set<string>();
+	const add = (file: InstructionFile) => {
+		const key = tryRealpath(file.path) ?? file.path;
+		if (seen.has(key) || !file.content.trim()) return;
+		seen.add(key);
+		files.push(file);
 	};
+	if (claude) for (const rule of conditionalRules(cwd, home, homeClaudeDir, includeExternal)) add(rule);
+	const rule = claude ? "claude-md-and-agents-md" : "agents-md";
+	for (const file of discoverContextFiles({ cwd, homeClaudeDir, rule, home, includeExternal })) add(file);
+	for (const file of discoverOneCodeFiles({ cwd, homeOneCodeDir: oneCodeStateDir(process.env, home), home })) add(file);
 
-	let dir = cwd;
-	for (;;) {
-		for (const name of FILE_NAMES) add(join(dir, name));
-		if (dir === stop) break;
-		const parent = dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	add(join(claudeUserDir(home), "CLAUDE.md"));
-
-	return parts.length > 0 ? parts.join("\n\n") : undefined;
+	if (files.length === 0) return undefined;
+	return files.map((file) => `# ${file.path}${file.globs ? ` (applies to ${file.globs.join(", ")})` : ""}\n${file.content.trim()}`).join("\n\n");
 }