one-code-extension 0.4.1 → 0.6.0

package/extensions/auto-mode/classifier.ts

@@ -1,16 +1,17 @@
 /**
  * The classifier call itself — the one file here that talks to a provider.
  *
- * Claude Code's two-stage formula, reproduced (docs/decisions/auto-mode.md, P4):
+ * Claude Code's two-stage formula, reproduced (working-docs/decisions/auto-mode.md, P4):
  *   Stage 1 grades HARM ONLY (maxTokens 64). severity < 50 → allow, no stage 2.
- *   Stage 2 applies intent + ALLOW (maxTokens 8192, <thinking> CoT) → severity +
+ *   Stage 2 applies intent + ALLOW (maxTokens 4096, <thinking> CoT) → severity +
  *   <category> (+ our verified <intent>). Both stages share one system prompt and
- *   transcript byte-for-byte. Only the system prompt (the ~30k-token ruleset) is
- *   a cache hit across stages and calls: pi-ai marks a breakpoint on the last
- *   user block only, so the <transcript> (up to ~15k tokens) is re-read uncached
- *   by stage 2 and by every gated call on Anthropic-style providers. Known,
- *   deferred — docs/decisions/caching.md "Classifier transcript" and
- *   docs/upstream_prs.md #16 (fixable locally via pi-ai's `onPayload`).
+ *   transcript byte-for-byte. Where the request carries explicit breakpoints
+ *   (Anthropic Messages, OpenRouter's Anthropic-format Chat Completions,
+ *   Bedrock Converse), onPayload splits the user text at stable history-entry
+ *   boundaries and moves the user cache marker before the pending action and
+ *   stage instruction (cache.ts). Both stages and later gated calls can read
+ *   that prefix; the system markers stay intact. Other APIs keep the single
+ *   string and their provider's prefix caching.
  *
  * A one-shot `completeSimple` per stage rather than an agent session: no tools,
  * no history beyond the transcript it is handed, nothing to be talked into. Every
@@ -19,11 +20,15 @@
  * has approved nothing.
  */
 
-import type { Model, Api, AssistantMessage, ThinkingLevel } from "@earendil-works/pi-ai";
+import { appendFileSync } from "node:fs";
+import { cleanupSessionResources, isContextOverflow, type Model, type Api, type AssistantMessage, type ThinkingLevel } from "@earendil-works/pi-ai";
 import { completeSimple } from "@earendil-works/pi-ai/compat";
 import type { ModelRegistry } from "@earendil-works/pi-coding-agent";
-import { forcedReasoningLevel, isReasoningMandatoryError, reasoningRetryLevel } from "../lib/model-policy.ts";
+import { costRatioText, isNotablyCostlier } from "../lib/model-choice-warnings.ts";
+import { modeCycleKey } from "../lib/keys.ts";
+import { classifierCostRatio, forcedReasoningLevel, isReasoningMandatoryError, modelSpec as spec, reasoningRetryLevel } from "../lib/model-policy.ts";
 import type { AutoModeConfig } from "./config.ts";
+import { CLASSIFIER_CACHE_APIS, cacheClassifierHistory } from "./cache.ts";
 import {
 	buildPayload,
 	type ClassifyRequest,
@@ -37,6 +42,7 @@ import {
 } from "./prompt.ts";
 import {
 	type Candidate,
+	type ClassifierFallback,
 	type ClassifierNotice,
 	classifierCandidates,
 	describeCandidate,
@@ -44,10 +50,25 @@ import {
 	replyText,
 	withAuthBaseUrl,
 } from "./model-select.ts";
+import { actionLength, MAX_ACTION_CHARS } from "./transcript.ts";
 
 /** A slow classifier stalls every tool call, so the wait is capped per stage. */
 export const CLASSIFIER_TIMEOUT_MS = 30_000;
 
+/**
+ * Claude Code's default retry count for a rate limit or server error (its
+ * classifier's side query uses it). pi-ai's default is none, so one 429 left
+ * the call unjudged; the stage timeout above still bounds the retries.
+ */
+export const CLASSIFIER_MAX_RETRIES = 10;
+
+/**
+ * Output headroom for a model that cannot turn thinking off, added to both
+ * stages' caps as Claude Code pads its always-on-thinking models: the
+ * reasoning otherwise spends the budget before the verdict is written.
+ */
+export const FORCED_THINKING_PADDING = 2048;
+
 /**
  * A pinned model that times out this many calls in a row is unpinned, so a model
  * that was fast when first chosen but has since fallen behind demand does not
@@ -55,6 +76,19 @@ export const CLASSIFIER_TIMEOUT_MS = 30_000;
  */
 export const ROTATE_AFTER_TIMEOUTS = 2;
 
+/**
+ * The provider refused the classifier's prompt as a possible usage-policy
+ * violation ("Invalid prompt: your prompt was flagged as potentially violating
+ * our usage policy"). GPT-6 Luna on Codex did this to about one classifier
+ * prompt in ten, at random, and passed the same prompt on a retry (findings
+ * §59). A refused call is retried once on the same model; a second refusal
+ * drops the model for the rest of the session (decisions/auto-mode.md,
+ * "A classifier that refuses its prompt").
+ */
+export function isPromptPolicyRefusal(message: string): boolean {
+	return /invalid prompt\b[^.\n]{0,80}\bflagged\b[^.\n]{0,80}usage policy/i.test(message);
+}
+
 /**
  * Whether a failure is our own classifier timeout (or an equivalent abort/stall)
  * rather than a substantive provider error. A timeout is transient — worth a
@@ -66,6 +100,42 @@ export function isClassifierTimeout(message: string): boolean {
 	return /\babort|\btimed?\s*out\b|\btimeout\b|\betimedout\b|\bdeadline\b/i.test(message);
 }
 
+/**
+ * Whether a failure happened below HTTP: the request never got an answer
+ * (`fetch failed`, a reset or refused connection, a DNS miss). Like a timeout it
+ * says nothing about the call or the model, so it takes the timeout path: one
+ * retry, then a "not judged" block. A provider's own error reply (a 500, a 429)
+ * is not one; it stays a substantive error. Observed 2026-10-04: a few minutes
+ * of `fetch failed` on openai-codex blocked read-only calls as "denied".
+ */
+export function isTransportFailure(message: string): boolean {
+	return /\bfetch failed\b|\beconn(reset|refused|aborted)\b|\benotfound\b|\beai_again\b|\bepipe\b|socket hang up|other side closed|\bund_err_socket\b|network (error|is unreachable)|\bwebsocket (closed|error)\b/i.test(
+		message,
+	);
+}
+
+/**
+ * A provider's error without its advice to the user ("Please try again with a
+ * different prompt", "try rephrasing your request", a link): handed to the
+ * model in a block, that advice invites rephrasing the call past the gate.
+ */
+export function providerErrorSummary(message: string): string {
+	// Advice follows a sentence end, a colon or semicolon, or a line break.
+	const cut = message.search(/(?:[.!:;]\s+|\n\s*)(please\b|if this seems|try\b|you can\b|learn more|see\b)/i);
+	const kept = cut >= 0 ? message.slice(0, cut + 1) : message;
+	return kept.replace(/:?\s*https?:\/\/\S+/g, "").trim().replace(/[:;]$/, "");
+}
+
+/** A provider rejected the input window, not the action's safety or output limit. */
+export function isClassifierTranscriptTooLong(message: string): boolean {
+	// Only pi-ai's error-pattern branch: no catalog window means this never
+	// infers overflow from an estimate or a model's reported usage.
+	return isContextOverflow({ stopReason: "error", errorMessage: message } as AssistantMessage);
+}
+
+/** Pause before retrying after a transport failure, so a brief network drop can clear. */
+export const TRANSPORT_RETRY_DELAY_MS = 1500;
+
 /**
  * Which model the classifier settled on, and which candidates turned out to be
  * unusable. Owned by the caller so this module stays stateless, and so the
@@ -76,6 +146,12 @@ export interface ClassifierState {
 	pinned?: Model<Api>;
 	/** `provider/id` of candidates that failed as unusable. */
 	rejected: Set<string>;
+	/**
+	 * The subset of `rejected` that refused the classifier's prompt twice. Unlike
+	 * another rejection, such a model is not retried when every candidate is
+	 * gone: it would refuse again, so the gate stops and says how to go on.
+	 */
+	refused: Set<string>;
 	/** Notices already delivered, so a per-call warning is not repeated per call. */
 	notified: Set<string>;
 	/**
@@ -84,15 +160,15 @@ export interface ClassifierState {
 	 */
 	timeoutStreak: number;
 	/**
-	 * The candidate chain cached for the current (session model, classifier config)
-	 * signature, so the O(catalog) ranking is not rebuilt on every gated tool call.
-	 * Invalidated only when the session model or the `classifierModel` setting
-	 * changes — catalog churn is deliberately ignored, matching the pin, which
+	 * The candidate chain cached for the current session-model/window signature,
+	 * so the O(catalog) ranking is not rebuilt on every gated tool call.
+	 * Invalidated when the session model or its catalog context window changes —
+	 * catalog churn is otherwise deliberately ignored, matching the pin, which
 	 * already commits the session to one classifier. The live `rejected` filter is
 	 * still applied to the cached chain per call, so a model that dies mid-session
 	 * is still stepped over without a rebuild.
 	 */
-	chainCache?: { signature: string; candidates: Candidate[]; notices: ClassifierNotice[] };
+	chainCache?: { signature: string; candidates: Candidate[]; notices: ClassifierNotice[]; fallback?: ClassifierFallback };
 	/**
 	 * `provider/id` -> the thinking level a model turned out to REQUIRE (its
 	 * provider rejected the thinking-off request with "reasoning is mandatory").
@@ -102,10 +178,28 @@ export interface ClassifierState {
 	 * proactively, without an error).
 	 */
 	forcedReasoning: Map<string, ThinkingLevel>;
+	/** Previous history boundary on a breakpoint API, a cache lookup hint only (cache.ts). */
+	cacheHistoryEnd?: number;
 }
 
 export function createClassifierState(): ClassifierState {
-	return { rejected: new Set(), notified: new Set(), timeoutStreak: 0, forcedReasoning: new Map() };
+	return { rejected: new Set(), refused: new Set(), notified: new Set(), timeoutStreak: 0, forcedReasoning: new Map() };
+}
+
+/** The `cacheKey` a session's classifier calls pass (`ClassifierDeps.cacheKey`). */
+export function classifierCacheKey(sessionId: string): string {
+	return `${sessionId}:auto-mode`;
+}
+
+/**
+ * Close what pi-ai holds open under the session's classifier key. The key
+ * doubles as pi-ai's `sessionId`, and on openai-codex that keeps one WebSocket
+ * per id with a 5-minute idle timer holding the process; pi's own dispose
+ * closes only the session's id, so without this a `pi -p` run waits out the
+ * timer after its answer (findings §59).
+ */
+export function releaseClassifierResources(sessionId: string): void {
+	cleanupSessionResources(classifierCacheKey(sessionId));
 }
 
 export interface ClassifierDeps {
@@ -114,8 +208,15 @@ export interface ClassifierDeps {
 	config: AutoModeConfig;
 	signal?: AbortSignal;
 	state: ClassifierState;
+	/**
+	 * A stable key for this session's classifier calls. pi-ai sends it as
+	 * OpenAI's prompt_cache_key (Codex and the OpenAI APIs), which routes the
+	 * calls to the cache that holds the previous call's prefix; without it
+	 * consecutive calls landed on different cache machines and missed.
+	 */
+	cacheKey?: string;
 	/** Tell the user something once — which model is in use, or that theirs is dead. */
-	onNotice?: (message: string, level: "info" | "warning") => void;
+	onNotice?: (message: string, level: "info" | "warning", notice?: ClassifierNotice) => void;
 	/** Report each classifier reply's usage, for the all-in footer cost. Observer
 	 * only — it never affects the payload sent or the verdict parsed. */
 	onUsage?: (usage: unknown) => void;
@@ -135,7 +236,7 @@ export interface ClassifierDeps {
 }
 
 /** How a single candidate's attempt failed, so the outer loop can react. */
-type StepKind = "timeout" | "cancelled" | "unavailable" | "error" | "truncated";
+type StepKind = "timeout" | "cancelled" | "unavailable" | "refused" | "error" | "truncated" | "transcript-too-long";
 class StepError extends Error {
 	constructor(
 		readonly kind: StepKind,
@@ -146,42 +247,80 @@ class StepError extends Error {
 }
 
 /** Signature that must stay equal for the cached chain to be reused (see ClassifierState.chainCache). */
-function selectionSignature(deps: ClassifierDeps): string {
-	const session = deps.sessionModel ? `${deps.sessionModel.provider}/${deps.sessionModel.id}` : "(none)";
-	return `${session}|${deps.config.classifierModel ?? ""}|${deps.config.classifierModelSetFor ?? ""}`;
+function selectionSignature(sessionModel: Model<Api> | undefined, config: Pick<AutoModeConfig, "classifierModel" | "classifierModelSetFor">): string {
+	const configured = `${config.classifierModel ?? ""}|${config.classifierModelSetFor ?? ""}`;
+	return sessionModel ? `${sessionModel.provider}/${sessionModel.id}|${sessionModel.contextWindow ?? "unknown"}|${configured}` : `(none)|${configured}`;
+}
+
+/**
+ * The selection chain for this session model and setting, built once per
+ * signature and shared by every reader: the gate, the badge and banner that
+ * name the next classifier, and the announcement. The newer-model warnings
+ * are always in it; a reader that honours `suggestNewerModels` drops them.
+ */
+export function classifierChain(
+	state: ClassifierState,
+	input: { available: () => Model<Api>[]; sessionModel: Model<Api> | undefined; config: Pick<AutoModeConfig, "classifierModel" | "classifierModelSetFor"> },
+): NonNullable<ClassifierState["chainCache"]> {
+	const signature = selectionSignature(input.sessionModel, input.config);
+	const cached = state.chainCache;
+	if (cached && cached.signature === signature) return cached;
+	const built = classifierCandidates({
+		available: input.available(),
+		sessionModel: input.sessionModel,
+		configured: input.config.classifierModel,
+		configuredSetForContainment: input.config.classifierModelSetFor,
+	});
+	const chain = { signature, candidates: built.candidates, notices: built.notices, ...(built.fallback ? { fallback: built.fallback } : {}) };
+	// Don't poison the cache with an empty chain (e.g. a not-yet-populated
+	// registry) — that would permanently block the gate; recompute next call.
+	if (built.candidates.length > 0) state.chainCache = chain;
+	return chain;
 }
 
 /** The candidate chain (minus anything already unusable this session) and its notices. */
 function remainingCandidates(deps: ClassifierDeps): { candidates: Candidate[]; notices: ClassifierNotice[] } {
-	const signature = selectionSignature(deps);
-	let cached = deps.state.chainCache;
-	if (!cached || cached.signature !== signature) {
-		const built = classifierCandidates({
-			available: deps.registry.getAvailable(),
-			sessionModel: deps.sessionModel,
-			configured: deps.config.classifierModel,
-			configuredSetForContainment: deps.config.classifierModelSetFor,
-		});
-		cached = { signature, candidates: built.candidates, notices: built.notices };
-		// Don't poison the cache with an empty chain (e.g. a not-yet-populated
-		// registry) — that would permanently block the gate; recompute next call.
-		if (built.candidates.length > 0) deps.state.chainCache = cached;
-	}
-	const { candidates: all, notices } = cached;
+	const { candidates: all, notices } = classifierChain(deps.state, { available: () => deps.registry.getAvailable(), sessionModel: deps.sessionModel, config: deps.config });
 	const usable = all.filter((entry) => !deps.state.rejected.has(`${entry.model.provider}/${entry.model.id}`));
 	if (usable.length > 0) return { candidates: usable, notices };
 	// If everything has been rejected, the session model is still worth one more
 	// attempt: a gate that stops asking has stopped gating. It has to be the
 	// session model specifically — the *last* chain entry is the cost-ranked pick,
-	// which nothing price-chosen should lead, let alone be the sole retry.
+	// which nothing price-chosen should lead, let alone be the sole retry. A model
+	// that refused the prompt is not retried: it would refuse again
+	// (`refusalStop`).
 	const session = all.filter((entry) => entry.source === "session");
-	return { candidates: session.length > 0 ? session : all.slice(-1), notices };
+	const retry = session.length > 0 ? session : all.slice(-1);
+	return { candidates: retry.filter((entry) => !deps.state.refused.has(`${entry.model.provider}/${entry.model.id}`)), notices };
 }
 
-function notifyOnce(deps: ClassifierDeps, key: string, message: string, level: "info" | "warning") {
+/**
+ * Every candidate is gone and one refused the classifier's prompt: the call is
+ * not judged, and the user is told once how to go on.
+ */
+function refusalStop(deps: ClassifierDeps, unusable: readonly string[] = []): ClassifyVerdict {
+	const refused = [...deps.state.refused].join(", ");
+	// A model that failed this call for another cause has its own fix: name it too.
+	const others = unusable.length > 0 ? ` ${unusable.join("; ")}.` : "";
+	notifyOnce(
+		deps,
+		"refusal-stop",
+		`Auto mode has no classifier left: ${refused} refused the classifier's prompt as a possible usage-policy violation, and no other eligible model can screen calls.${others} ` +
+			`Calls are not judged and do not run. Switch to manual approval (${modeCycleKey()} cycles permission modes), or choose another classifier with /auto-mode model <provider/id>.`,
+		"warning",
+	);
+	return {
+		decision: "block",
+		reason: `Auto mode has no classifier: ${refused} refused the classifier's prompt as a possible usage-policy violation.${others}`,
+		tier: "unmatched",
+		noVerdict: true,
+	};
+}
+
+function notifyOnce(deps: ClassifierDeps, key: string, message: string, level: "info" | "warning", notice?: ClassifierNotice) {
 	if (deps.state.notified.has(key)) return;
 	deps.state.notified.add(key);
-	deps.onNotice?.(message, level);
+	deps.onNotice?.(message, level, notice);
 }
 
 /**
@@ -191,17 +330,31 @@ function notifyOnce(deps: ClassifierDeps, key: string, message: string, level: "
 export async function classify(request: ClassifyRequest, deps: ClassifierDeps): Promise<ClassifyVerdict> {
 	const { candidates, notices } = remainingCandidates(deps);
 	if (candidates.length === 0) {
-		return { decision: "block", reason: "No model is available to run the auto-mode classifier.", tier: "unmatched" };
+		if (deps.state.refused.size > 0) return refusalStop(deps);
+		return { decision: "block", reason: "No model is available to run the auto-mode classifier.", tier: "unmatched", noVerdict: true };
 	}
 
-	// Selection notices (a configured model unavailable or overridden as stale, a
-	// cross-provider setting honored) — surfaced once each at their own level, keyed
-	// by their text so an informational "honored" line is not shown as a warning.
-	for (const notice of notices) notifyOnce(deps, notice.text, notice.text, notice.level);
+	// Automatic-selection fallback explanations are surfaced once per distinct message.
+	// A newer-model hint about a chosen classifier is the session-start
+	// announcement's to make (it honours suggestNewerModels), not a gated call's.
+	for (const notice of notices) if (notice.choiceWarning !== "newer") notifyOnce(deps, notice.text, notice.text, notice.level, notice);
+
+	// The action is sent whole (transcript.ts MAX_ACTION_CHARS); one too large for
+	// that is refused with its size, never judged from a prefix.
+	const actionChars = deps.reviewOnly ? 0 : actionLength(request.transcript);
+	if (actionChars > MAX_ACTION_CHARS) {
+		return {
+			decision: "block",
+			reason: `This call is ${actionChars} characters, more than the ${MAX_ACTION_CHARS} the auto-mode classifier reviews in full. Split it into smaller calls.`,
+			tier: "unmatched",
+			noVerdict: true,
+		};
+	}
 
 	// buildPayload builds the ~110KB ruleset once and returns the grounding index
 	// derived from it, so the ruleset is not rebuilt/re-parsed a second time here.
-	const { system, userPrefix, index } = buildPayload(request);
+	const { system, userPrefix, history, tail, index } = buildPayload(request);
+	const previousHistoryEnd = deps.state.cacheHistoryEnd;
 	const stage1Text = stage1User(userPrefix);
 	// A permission rule refused something this turn, so stage 2 gets the extra
 	// instruction that the user's intent does not excuse an equivalent-effect
@@ -209,6 +362,10 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 	// left byte-identical to CC's.
 	const afterRuleDenial = request.transcript.some((entry) => entry.kind === "denied");
 	const debug = process.env.CC_AUTO_MODE_DEBUG;
+	// Probe hook (test/e2e/cache-probe.sh): one JSON line per classifier reply with
+	// its text and pi-ai's normalized usage, whatever the transport (Codex runs
+	// over WebSocket, where a fetch wrapper sees nothing). Opt-in, never read back.
+	const usageLog = process.env.CC_AUTO_MODE_LOG;
 
 	// A model already pinned this session is tried first, so the classifier does
 	// not change under the session while the pin is healthy. The rest of the chain
@@ -234,7 +391,11 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 
 	let lastError = "";
 	let sawTimeout = false;
+	/** Candidates rejected this call as unusable, with their errors. */
+	const unusable: string[] = [];
 	let timedOutKey: string | undefined;
+	/** The timed-out candidate's own error: a later candidate's failure must not relabel it. */
+	let timedOutError = "";
 	// Walks `attempts` in order; a candidate that turns out to require thinking is
 	// re-queued at the front for exactly one retry (see the reasoning-mandatory
 	// branch below). The `!== undefined` guard narrows `candidate`, so no cast.
@@ -257,7 +418,7 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 		// One provider call. `reasoning`/`temperature` are deliberately omitted: pi
 		// turns thinking off entirely when `reasoning` is absent (what a classifier
 		// wants), and `temperature` is deprecated/unsupported on several models and
-		// fails closed. See docs/decisions/auto-mode.md. The one exception: a model
+		// fails closed. See working-docs/decisions/auto-mode.md. The one exception: a model
 		// that CANNOT disable thinking (catalog-marked, or learned via the
 		// reasoning-mandatory retry below) gets its lowest supported level — the
 		// off-request would 400 and the gate would fail closed on every call.
@@ -279,7 +440,15 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 					env: auth.env,
 					signal: deps.signal ? AbortSignal.any([deps.signal, timeout]) : timeout,
 					maxTokens,
+					maxRetries: CLASSIFIER_MAX_RETRIES,
 					cacheRetention: "long",
+					...(deps.cacheKey ? { sessionId: deps.cacheKey } : {}),
+					...(CLASSIFIER_CACHE_APIS.has(model.api) ? {
+						onPayload: (payload: unknown) => {
+							cacheClassifierHistory(payload, [...history, tail, userText.slice(userPrefix.length)], history.length - 1, previousHistoryEnd);
+							deps.state.cacheHistoryEnd = history.length - 1;
+						},
+					} : {}),
 					...(reasoning ? { reasoning } : {}),
 				},
 			);
@@ -288,13 +457,25 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 		// Turn one reply into text, or throw a StepError the loop knows how to route.
 		// `big` is the retry cap for a length-truncated reply; a still-truncated reply
 		// at `big` is its own outcome (not a candidate to step past).
+		const padding = reasoning ? FORCED_THINKING_PADDING : 0;
 		const call = async (userText: string, base: number, big: number, stage: number): Promise<string> => {
+			base += padding;
+			big += padding;
 			const inspect = (reply: AssistantMessage): string | "length" => {
 				deps.onUsage?.(reply.usage);
+				if (usageLog) {
+					try {
+						appendFileSync(usageLog, `${JSON.stringify({ model: key, api: model.api, stage, system, user: userText, usage: reply.usage, stopReason: reply.stopReason })}\n`);
+					} catch {
+						// A probe log that cannot be written must not fail the gate.
+					}
+				}
 				if (deps.signal?.aborted) throw new StepError("cancelled", "cancelled");
 				if (reply.stopReason === "error" || reply.stopReason === "aborted") {
 					const msg = reply.errorMessage ?? reply.stopReason ?? "provider error";
-					if (isClassifierTimeout(msg)) throw new StepError("timeout", msg);
+					if (isContextOverflow(reply)) throw new StepError("transcript-too-long", msg);
+					if (isClassifierTimeout(msg) || isTransportFailure(msg)) throw new StepError("timeout", msg);
+					if (isPromptPolicyRefusal(msg)) throw new StepError("refused", msg);
 					throw new StepError(isModelUnavailableError(msg) ? "unavailable" : "error", msg);
 				}
 				if (reply.stopReason === "length") return "length";
@@ -306,10 +487,13 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 			try {
 				seen = inspect(reply);
 			} catch (error) {
-				// One retry on a timeout, before giving up on this model — a stall under
-				// load usually clears on a second try. A user cancel or a substantive
-				// error is not retried.
-				if (error instanceof StepError && error.kind === "timeout") {
+				// One retry on a timeout or a usage-policy refusal, before giving up on
+				// this model: a stall under load usually clears on a second try, and a
+				// refused prompt usually passes. The identical request still reads the
+				// session's cached prefix. A user cancel or a substantive error is not
+				// retried.
+				if (error instanceof StepError && (error.kind === "timeout" || error.kind === "refused")) {
+					if (error.kind === "timeout" && isTransportFailure(error.message)) await new Promise((resolve) => setTimeout(resolve, TRANSPORT_RETRY_DELAY_MS));
 					reply = await runCall(userText, base, stage);
 					seen = inspect(reply);
 				} else {
@@ -331,12 +515,13 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 			if (deps.reviewOnly) {
 				// A finished run has no harm floor to short-circuit — go straight to the
 				// full stage-2 evaluation, reframed to judge the whole sequence.
-				const text = await call(reviewUser(userPrefix), 1024, 4096, 2);
+				const text = await call(reviewUser(userPrefix), 4096, 8192, 2);
 				verdict = parseStage2(text, index, request.userMessages);
 				stageInfo = `review sev=${parseSeverity(text) ?? "?"}`;
 			} else {
 				// STAGE 1 — harm only. maxTokens 64 like CC; if the reply overruns 64
 				// without a readable severity, one retry with headroom recovers it.
+				// Stage 2's 4096 is CC's too, with one retry at 8192.
 				const s1 = await call(stage1Text, 64, 1024, 1);
 				const sev1 = parseSeverity(s1);
 				if (sev1 !== null && sev1 < SEVERITY_THRESHOLD) {
@@ -346,7 +531,7 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 					// sev1 >= 50, or unparseable → fall to the fuller stage-2 evaluation.
 					// stage2User is built here (not eagerly) so the common allow case
 					// does not concatenate the transcript prefix a second time.
-					const s2 = await call(stage2User(userPrefix, afterRuleDenial), 1024, 4096, 2);
+					const s2 = await call(stage2User(userPrefix, afterRuleDenial), 4096, 8192, 2);
 					verdict = parseStage2(s2, index, request.userMessages);
 					stageInfo = `s1=${sev1 ?? "?"} s2=${parseSeverity(s2) ?? "?"}`;
 					// Stage 1 flagged the call and stage 2 cleared it without quoting the
@@ -385,15 +570,27 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 			lastError = error instanceof Error ? error.message : String(error);
 
 			if (kind === "cancelled") {
-				return { decision: "block", reason: "Auto-mode classification was cancelled.", tier: "unmatched" };
+				return { decision: "block", reason: "Auto-mode classification was cancelled.", tier: "unmatched", noVerdict: true };
+			}
+			// The provider is authoritative about its token window. Do not clip the
+			// history or retry another model: the gate must offer manual approval
+			// interactively, or stop a headless run, rather than invent a verdict.
+			if (kind === "transcript-too-long" || (kind === "error" && isClassifierTranscriptTooLong(lastError))) {
+				return {
+					decision: "block",
+					reason: `Classifier transcript exceeded context window (${key}). The action was not judged. Compact the session (/compact) and continue.`,
+					tier: "unmatched",
+					noVerdict: true,
+					transcriptTooLong: true,
+				};
 			}
 			if (kind === "truncated") {
 				if (debug) process.stderr.write(`[auto-mode] ${key} ${request.toolName} → verdict truncated at maxTokens\n`);
 				return {
 					decision: "block",
-					reason:
-						"The approval classifier's reply was cut off by its output limit before the verdict completed. If this keeps happening, pin a stronger classifier model with /auto-mode model.",
+					reason: "The approval classifier's reply was cut off by its output limit before the verdict completed.",
 					tier: "unmatched",
+					noVerdict: true,
 				};
 			}
 			if (kind === "error") {
@@ -414,29 +611,53 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 				}
 				// A substantive, non-transient failure that is not "model unusable here":
 				// surface it rather than papering over something about to clear.
-				return { decision: "block", reason: `Auto-mode classifier could not be reached (${lastError}).`, tier: "unmatched" };
+				return { decision: "block", reason: `The auto-mode classifier returned no verdict (${providerErrorSummary(lastError)}).`, tier: "unmatched", noVerdict: true };
 			}
 			if (kind === "timeout") {
 				// Transient — do NOT reject the model, it may be fine next call. Step to
 				// the next candidate; a pinned model that keeps timing out is unpinned.
 				sawTimeout = true;
 				timedOutKey = key;
+				timedOutError = lastError;
 				if (deps.state.pinned && `${deps.state.pinned.provider}/${deps.state.pinned.id}` === key) {
 					deps.state.timeoutStreak += 1;
 					if (deps.state.timeoutStreak >= ROTATE_AFTER_TIMEOUTS) deps.state.pinned = undefined;
 				}
 				continue;
 			}
+			if (kind === "refused") {
+				// Refused twice in a row: drop the model for the session and pin the next
+				// one, rather than pay a fallback's uncached prefix on every refusal. The
+				// refusal is about the classifier's prompt, not the account, so the
+				// subagent selector is not told.
+				reject(key);
+				deps.state.refused.add(key);
+				const next = queue[0]?.model;
+				// A candidate that timed out on this call is still eligible: end the
+				// chain as a timeout (after the loop), not as "no classifier left".
+				if (!next) {
+					if (sawTimeout) continue;
+					return refusalStop(deps, unusable);
+				}
+				const ratio = classifierCostRatio(next, model);
+				notifyOnce(
+					deps,
+					`refused:${key}`,
+					`${key} refused the auto-mode classifier's prompt twice as a possible usage-policy violation, so auto mode screens calls with ` +
+						`${spec(next)} for the rest of this session${isNotablyCostlier(ratio) ? `, at about ${costRatioText(ratio)} the cost per call` : ""}. ` +
+						"Choose another classifier with /auto-mode model <provider/id>.",
+					"warning",
+				);
+				continue;
+			}
 			// unavailable: this model is not usable here — step over it and record it.
 			reject(key);
 			deps.onModelUnusable?.(key, lastError);
-			const isConfigured = candidate.source === "configured";
+			unusable.push(`${key} cannot be used (${lastError})`);
 			notifyOnce(
 				deps,
 				`rejected:${key}`,
-				isConfigured
-					? `Auto mode cannot use ${key} from autoMode.classifierModel (${lastError}). Set a different model in ~/.onecode/settings.json.`
-					: `Auto mode cannot use ${key} as its classifier (${lastError}); trying another model. Set autoMode.classifierModel in ~/.onecode/settings.json to choose one.`,
+				`Auto mode cannot use ${key} as its classifier (${lastError}); trying another eligible model.`,
 				"warning",
 			);
 		}
@@ -448,19 +669,23 @@ export async function classify(request: ClassifyRequest, deps: ClassifierDeps):
 	// where it can, and only blocks outright when running non-interactively.
 	if (sawTimeout) {
 		const model = timedOutKey ? timedOutKey.split("/").pop() : undefined;
+		const network = isTransportFailure(timedOutError);
 		return {
 			decision: "block",
 			tier: "timeout",
+			noVerdict: true,
 			reason:
-				`Auto mode could not screen this ${request.toolName} call in time — the approval classifier${model ? ` (${model})` : ""} ` +
-				"is temporarily unavailable (timed out), so the call was not judged either way.",
+				`Auto mode could not screen this ${request.toolName} call${network ? "" : " in time"} — the approval classifier${model ? ` (${model})` : ""} ` +
+				`is temporarily unavailable (${network ? `network error: ${timedOutError}` : "timed out"}), so the call was not judged either way.`,
 		};
 	}
 
+	if (deps.state.refused.size > 0) return refusalStop(deps, unusable);
 	// Every candidate was unusable — say which knob fixes it.
 	return {
 		decision: "block",
-		reason: `No usable auto-mode classifier model (last error: ${lastError}). Set autoMode.classifierModel in ~/.onecode/settings.json.`,
+		reason: `No usable auto-mode classifier model (last error: ${lastError}).`,
 		tier: "unmatched",
+		noVerdict: true,
 	};
 }