one-code-extension 0.4.1 → 0.5.0

package/extensions/auto-mode/system-note.ts

@@ -0,0 +1,33 @@
+/**
+ * Claude Code's auto-mode note (pure): the part of its mid-conversation system
+ * message that tells a model in auto mode to work through the shell. Fable gets
+ * the firmer wording, every other model the Opus one; tool names are One Code's.
+ * It rides only that system message (`systemRoleOnly`), never a user message,
+ * and only when the conversation opens in auto mode: the permission-mode
+ * reminder carries every later change (decisions/tools.md).
+ *
+ * Only on the tiers that take Claude Code's fast paths (frontier and
+ * workhorse). Claude Code has no auto mode below its Sonnet class, the cheap
+ * and tiny tool texts tell the model to read with the read tool, and their
+ * stricter gate screens shell edits, so the note there contradicted the tool
+ * texts and steered weak models into more classifier calls.
+ */
+
+import type { Api, Model } from "@earendil-works/pi-ai";
+import { claudeFamily, usesClaudeCodeFastPaths } from "../lib/model-tier.ts";
+
+const OPUS_NOTE =
+	"While auto mode is active:\n\n" +
+	"You can do much of your work through the bash tool when it is the simpler route: read files with cat, head, or sed -n, search with grep and find, and make small, mechanical file changes with sed, heredocs, or short scripts instead of the dedicated read, edit, or write tools. " +
+	"The choice is yours: prefer edit or write when a shell edit would be fragile, such as exact or multi-line replacements, or sed/awk flags that differ between GNU and BSD/macOS.";
+
+const FABLE_NOTE =
+	"While auto mode is active:\n\n" +
+	"Do your work through the bash tool wherever it can accomplish the job: read files with cat, head, or sed -n, search with grep and find, and make file changes with sed, heredocs, or short scripts, rather than using the dedicated read, edit, or write tools. " +
+	"Fall back to a dedicated tool only when bash genuinely cannot do the job.";
+
+/** The note for a session opening in auto mode on `model`, or undefined on a cheap or tiny model. */
+export function autoModeSystemNote(model: Model<Api>): string | undefined {
+	if (!usesClaudeCodeFastPaths(model)) return undefined;
+	return claudeFamily(model.id) === "fable" ? FABLE_NOTE : OPUS_NOTE;
+}

package/extensions/auto-mode/transcript.ts

@@ -5,7 +5,7 @@
  * user messages and tool-call *inputs only*, with tool RESULTS stripped so
  * hostile content the agent read cannot reach the classifier as if it were
  * context. Tool names are CC's PascalCase (`Bash`, `Edit`, …). We mirror that
- * shape exactly (see docs/decisions/auto-mode.md, P5).
+ * shape exactly (see working-docs/decisions/auto-mode.md, P5).
  *
  * The last entry is always the action under review — permissions/index.ts appends
  * the call being judged before rendering. Results are never appended here; only
@@ -18,6 +18,8 @@
 import { ccToolName } from "../hooks/matcher.ts";
 // The shell tools render as `{"<Tool>":"<command>"}` (lib/shell-tools.ts is the one list).
 import { SHELL_TOOLS } from "../lib/shell-tools.ts";
+import type { GitStatusMeta } from "./git-status-meta.ts";
+import { RESOLVED_PATHS_NOTE, type ResolvedPathFact } from "./resolved-paths-meta.ts";
 
 export { ccToolName };
 
@@ -31,82 +33,109 @@ export { ccToolName };
  */
 export type TranscriptEntry =
 	| { kind: "user"; text: string }
+	/** Model-generated context, not the user's own words for intent verification. */
+	| { kind: "summary"; text: string }
 	| { kind: "tool"; tool: string; input: Record<string, unknown> }
 	| { kind: "denied"; tool: string; subject: string; rule: string }
 	/**
-	 * Harness ground truth, Claude Code's `{"meta":{"gitStatus":{"clean":…}}}`
-	 * line after a `git status` call (captured 2.1.276, findings §22): the
-	 * classifier reads the tree's real state, not the model's account of it.
+	 * Harness ground truth, the Claude Code-compatible
+	 * `{"meta":{"gitStatus":…}}` line, directly above a shell command that can
+	 * destroy uncommitted work (auto-mode/git-status-meta.ts): the classifier
+	 * reads the tree's real state, not the model's account of it.
 	 */
-	| { kind: "meta"; gitStatus: { clean: boolean } };
+	| { kind: "meta"; gitStatus: GitStatusMeta }
+	/**
+	 * Harness ground truth, directly above an action that names a path inside
+	 * the working directory which resolves outside it through a symlink
+	 * (auto-mode/resolved-paths-meta.ts). Not a Claude Code line.
+	 */
+	| { kind: "resolved-paths"; resolvedPaths: ResolvedPathFact[] };
 
-/** Truncate one field so a single huge argument cannot dominate the transcript. */
+/** Clip a diagnostic field; classifier transcript entries are never clipped. */
 export function clip(value: string, max: number): string {
 	return value.length <= max ? value : `${value.slice(0, max)}… [truncated, ${value.length} chars]`;
 }
 
-/** Clip every string leaf of a tool input, leaving structure intact. */
-function clipInput(input: Record<string, unknown>, max: number): Record<string, unknown> {
-	const out: Record<string, unknown> = {};
-	for (const [key, value] of Object.entries(input)) {
-		out[key] = typeof value === "string" ? clip(value, max) : value;
-	}
-	return out;
-}
-
 /**
  * Render one entry as its compact JSON line. The shell tools render as
  * `{"Bash":"<command>"}` / `{"PowerShell":"<command>"}` (the command string,
- * as Claude Code does); every other tool renders as `{"<Tool>":{…input…}}`
- * with string fields clipped.
+ * as Claude Code does); every other tool renders as `{"<Tool>":{…input…}}`.
+ * Keep the input intact, including earlier commands and file contents.
  */
-function renderEntry(entry: TranscriptEntry, maxField: number): string {
-	if (entry.kind === "user") return JSON.stringify({ user: clip(entry.text, maxField) });
-	if (entry.kind === "meta") return JSON.stringify({ meta: { gitStatus: { clean: entry.gitStatus.clean } } });
+function renderEntry(entry: TranscriptEntry): string {
+	if (entry.kind === "user") return JSON.stringify({ user: entry.text });
+	if (entry.kind === "summary") return JSON.stringify({ summary: entry.text });
+	if (entry.kind === "meta") return JSON.stringify({ meta: { gitStatus: entry.gitStatus } });
+	if (entry.kind === "resolved-paths") return JSON.stringify({ meta: { resolvedPaths: entry.resolvedPaths, note: RESOLVED_PATHS_NOTE } });
 	if (entry.kind === "denied") {
 		return JSON.stringify({
-			denied_by_permission_rule: { tool: ccToolName(entry.tool), attempted: clip(entry.subject, maxField), rule: entry.rule },
+			denied_by_permission_rule: { tool: ccToolName(entry.tool), attempted: entry.subject, rule: entry.rule },
 		});
 	}
 	const name = ccToolName(entry.tool);
 	const command = entry.input.command;
 	if (SHELL_TOOLS.has(entry.tool) && typeof command === "string") {
-		return JSON.stringify({ [name]: clip(command, maxField) });
+		return JSON.stringify({ [name]: command });
 	}
-	return JSON.stringify({ [name]: clipInput(entry.input, maxField) });
+	return JSON.stringify({ [name]: entry.input });
 }
 
-export interface RenderOptions {
-	/** Max chars per string field. */
-	maxField?: number;
-	/** Max chars for the whole rendered transcript; oldest entries drop first. */
-	maxChars?: number;
+/**
+ * The most characters of the action under review the classifier is sent. That
+ * action is never clipped: the tool runs the whole input, so a classifier that
+ * saw only its first 2,000 characters cleared a suffix it never read
+ * (AUTO-MODE-SECURITY-REVIEW-2026-09-24 M1). A larger action is refused with
+ * its size named (classifier.ts), as Claude Code sends the action whole.
+ */
+export const MAX_ACTION_CHARS = 100_000;
+
+/** The rendered length of the action under review, the last entry, unclipped. */
+export function actionLength(entries: readonly TranscriptEntry[]): number {
+	const action = entries.at(-1);
+	return action ? renderEntry(action).length : 0;
 }
 
 /**
- * Render the ordered entries into a `<transcript>…</transcript>` block. When the
- * rendered lines exceed `maxChars`, the oldest are dropped and a marker records
- * it — the action under review (the last entry) is always kept. The full user
- * messages are carried separately for intent verification, so dropping old lines
- * here never weakens that check.
+ * Claude Code omits these local read/search calls from prior history. Only the
+ * session-history projection applies it (history.ts); a rendered transcript
+ * keeps every entry it is given, so a finished subagent's reads stay in its
+ * hand-back review beside what it did with them.
  */
-export function renderTranscript(entries: TranscriptEntry[], options: RenderOptions = {}): string {
-	const maxField = options.maxField ?? 2000;
-	const maxChars = options.maxChars ?? 60_000;
-	const lines = entries.map((entry) => renderEntry(entry, maxField));
+const HISTORICAL_READ_TOOLS = new Set([
+	"Read", "Grep", "Glob", "LSP", "ToolSearch", "ListMcpResourcesTool", "ReadMcpResourceTool", "ReadMcpResourceDirTool",
+	"lsp_diagnostics", "tool_search", "list_mcp_resources", "read_mcp_resource", "read_mcp_resource_dir",
+]);
 
-	// Keep the newest lines that fit the budget, walking from the end in one pass
-	// (the last line — the action under review — is always kept). +1 per line for
-	// the joining "\n".
-	let firstKept = lines.length;
-	let running = 0;
-	for (let i = lines.length - 1; i >= 0; i--) {
-		running += lines[i].length + 1;
-		if (i < lines.length - 1 && running > maxChars) break;
-		firstKept = i;
-	}
-	const kept = lines.slice(firstKept);
-	const dropped = firstKept;
-	const body = dropped > 0 ? [`{"note":"${dropped} earlier transcript entr${dropped === 1 ? "y" : "ies"} omitted for length"}`, ...kept] : kept;
-	return `<transcript>\n${body.join("\n")}\n</transcript>`;
+export function isHistoricalRead(entry: TranscriptEntry): boolean {
+	if (entry.kind !== "tool" || !HISTORICAL_READ_TOOLS.has(ccToolName(entry.tool))) return false;
+	// CC retains forwarded reads. We do not infer routing authority from an
+	// input field, but conservatively retain a named remote destination.
+	const host = entry.input._host;
+	return typeof host !== "string" || !host.trim() || host.trim() === "container" || host.trim() === "this-machine";
+}
+
+/**
+ * Render the ordered entries whole, as Claude Code does. A rolling
+ * suffix loses the evidence that a cleanup target was created this session;
+ * clipping an earlier shell command can hide its redirect or copy destination.
+ * If the provider cannot fit the transcript, classification fails closed rather
+ * than judging an action with silently missing history.
+ */
+export function renderTranscript(entries: TranscriptEntry[]): string {
+	const { history, tail } = transcriptBlocks(entries);
+	return history.join("") + tail;
+}
+
+/**
+ * Stable entry boundaries; the pending action and its harness facts stay in the
+ * tail. Every entry is rendered: what to leave out of the session's history is
+ * history.ts's decision, made before the entries get here.
+ */
+export function transcriptBlocks(entries: TranscriptEntry[]): { history: string[]; tail: string } {
+	let historyEnd = Math.max(0, entries.length - 1);
+	while (historyEnd > 0 && ["meta", "resolved-paths"].includes(entries[historyEnd - 1].kind)) historyEnd--;
+	return {
+		history: ["<transcript>", ...entries.slice(0, historyEnd).map((entry) => `\n${renderEntry(entry)}`)],
+		tail: `\n${entries.slice(historyEnd).map(renderEntry).join("\n")}\n</transcript>`,
+	};
 }