one-code-extension 0.4.1 → 0.6.0

package/extensions/auto-mode/model-select.ts

@@ -11,37 +11,44 @@
  * silently selected `anthropic/claude-haiku-4-5` — shipping that user's prompts to
  * a vendor they had not chosen for this session, through a component with no UI.
  *
- * So: **never leave the session's provider unless the user asked for it.** An
- * explicit `autoMode.classifierModel` may name any provider, because naming it is
- * the asking. Everything else stays where the session already is. This is the same
- * reasoning pi's own subagent config gives for defaulting to the session model —
- * "this keeps new installs from depending on a provider you may not have
- * configured" — and this module follows that precedence shape: explicit override,
- * then a configured default, then something sensible in-provider, then the session
- * model itself.
+ * So: **never leave the session's provider or route.** Automatic selection uses
+ * only contained models. It also requires a catalog context window at least as
+ * large as the session's, because the classifier receives the full transcript;
+ * if that cannot be proved, it screens on the session model instead. And it
+ * never screens with a model in a lower tier than the session's, or one that is
+ * not strictly cheaper per classifier call (a tie keeps the session).
  *
- * Name matching is demoted to a tiebreak because it does not survive contact with
- * real catalogs: of Groq's 7 models and xAI's 3, *none* contain any of those
- * substrings, while OpenRouter has 303 models and 79 substring hits, so the "first
- * match" is arbitrary. Cost is the one signal every provider carries.
+ * "Cheaper" is judged on what a classifier call costs, not on list input
+ * price: a call is mostly cached input (`CLASSIFIER_CALL_TOKENS`), so the
+ * cache-read price dominates. By input price DeepSeek V3.2 screened its own
+ * sessions and timed out (findings §61); per call V4.1 Flash is cheaper and
+ * answers in seconds.
+ *
+ * An explicit `autoMode.classifierModel` may name any provider, because naming
+ * it is choosing it: it leads the chain, with notices for a cross-provider
+ * choice and warnings for what it costs (`lib/model-choice-warnings.ts`).
  */
 
 import type { Api, AssistantMessage, Model } from "@earendil-works/pi-ai";
+import { type ChosenModelWarning, chosenModelWarnings } from "../lib/model-choice-warnings.ts";
 import {
 	crossesProvider,
 	findConfigured,
+	hasCatalogContextWindow,
+	isMovingAlias,
 	isStaleContainmentStamp,
 	modelIdentity,
 	modelSpec as spec,
+	classifierPrice,
+	modelsContainedToSession,
 } from "../lib/model-policy.ts";
-import { capableContainedCandidates } from "../lib/model-tier.ts";
-
-export { findConfigured } from "../lib/model-policy.ts";
+import { pairedModel } from "../lib/model-pairings.ts";
+import { intrinsicTier, sameTierContainedCandidates } from "../lib/model-tier.ts";
 
 export interface Candidate {
 	model: Model<Api>;
 	/** How this candidate was arrived at, for the notice shown to the user. */
-	source: "configured" | "economical" | "session";
+	source: "configured" | "paired" | "economical" | "session";
 }
 
 export interface SelectInput {
@@ -51,142 +58,158 @@ export interface SelectInput {
 	/** `autoMode.classifierModel`, if set. May name any provider. */
 	configured?: string;
 	/**
-	 * The containment identity (`modelIdentity().containment`) the `classifierModel`
-	 * setting was stamped for when set via `/auto-mode model`. When it differs from
-	 * the current session's containment, a cross-provider setting is treated as
-	 * stale (set for a session since left) and overridden with a warning — the same
-	 * shape as the subagent `subagentModelSetFor` stamp. Undefined for a hand-edited
-	 * setting.
+	 * The containment identity the `classifierModel` setting was stamped for by
+	 * `/auto-mode model`. When it differs from this session's, a cross-provider
+	 * setting is stale (set for a session since left) and is replaced, with a
+	 * warning. Undefined for a hand-edited setting.
 	 */
 	configuredSetForContainment?: string;
+	/** `suggestNewerModels` in ~/.onecode/settings.json; false drops the chosen model's newer-model warning. */
+	suggestNewer?: boolean;
+}
+
+/** Why automatic selection had to keep the session model. */
+export type ClassifierFallbackReason = "unknown-session-context-window" | "paired-session" | "no-qualifying-model";
+
+/** Structured selection fallback, retained with the chain for permission UI and logging. */
+export interface ClassifierFallback {
+	reason: ClassifierFallbackReason;
+	text: string;
 }
 
 /** A user-facing selection notice, tagged so an informational one is not shown as a warning. */
 export interface ClassifierNotice {
 	level: "info" | "warning";
 	text: string;
+	/** Present for a session fallback, so renderers need not parse `text`. */
+	fallbackReason?: ClassifierFallbackReason;
+	/** Present for a warning about the user's chosen classifier (`lib/model-choice-warnings.ts`). */
+	choiceWarning?: ChosenModelWarning["kind"];
+}
+
+export interface ClassifierChain {
+	candidates: Candidate[];
+	notices: ClassifierNotice[];
+	fallback?: ClassifierFallback;
 }
 
 /**
- * The ordered candidate chain plus any user-facing notices. More than one
- * candidate is returned so one that turns out to be unusable at call time (not
- * entitled on this account, withdrawn by the provider) can be stepped over
- * instead of failing every tool call — the same shape as pi's subagent
- * `fallbackModels`.
- *
- * The chain always ends at the session model when there is one, so auto mode
- * degrades to "correct but not cheap" rather than to "broken".
- *
- * The automatic pick is the SAME floor-gated selector the subagent default uses
- * (`capableContainedCandidates`): the cheapest same-provider model (cheap →
- * workhorse → frontier, never `tiny`) at or above `automaticTierFloor` — a
- * session on a workhorse-or-better model is screened by a workhorse-or-better
- * model, Claude Code's `min(main, sonnet)`. `docs/decisions/auto-mode.md`
- * measured the same `rm -rf` grading stage-1 62 on Sonnet and ~22 on Haiku —
- * "a weak classifier is a weak boundary" — yet until 2026-09-05 the selector
- * picked Haiku even when the session itself was Sonnet, so the gate's threshold
- * behaviour depended on which model happened to be cheapest
- * (PERMISSIONS-REVIEW-2026-09-05 M6). A cheap session keeps a cheap screener
- * (nothing cheaper and capable exists), and `autoMode.classifierModel`
- * overrides either way. The `tiny` exclusion is the capability floor
- * `auto-mode.md` recorded as still-missing. Since 2026-09-11 subagents share
- * the floor, so a session screens and delegates on one model.
- *
- * The floor governs the AUTOMATIC pick only; the terminal fallback is never
- * refused, so the chain is empty only when there is no session model and nothing
- * available at all.
+ * The ordered fallback chain for the permission classifier. The user's
+ * `autoMode.classifierModel` leads when it resolves and is not stale; its
+ * warnings ride the notices. Then the automatic chain
+ * (`automaticClassifierCandidates`), which ends at the session model.
  */
-export function classifierCandidates({
-	available,
-	sessionModel,
-	configured,
-	configuredSetForContainment,
-}: SelectInput): { candidates: Candidate[]; notices: ClassifierNotice[] } {
-	const candidates: Candidate[] = [];
+export function classifierCandidates({ available, sessionModel, configured, configuredSetForContainment, suggestNewer = true }: SelectInput): ClassifierChain {
+	const automatic = automaticClassifierCandidates(available, sessionModel);
+	if (!configured) return automatic;
+	/** The setting does not apply: the automatic chain, led by a warning saying why. */
+	const automaticBecause = (text: string): ClassifierChain => ({ ...automatic, notices: [{ level: "warning", text }, ...automatic.notices] });
+	const resolved = findConfigured(available, configured);
+	if (!resolved) {
+		return automaticBecause(
+			`autoMode.classifierModel ${configured} is not an available model (unknown id, or no credentials for its provider); auto mode chooses automatically instead.`,
+		);
+	}
 	const notices: ClassifierNotice[] = [];
-	const push = (model: Model<Api> | undefined, source: Candidate["source"]) => {
-		if (!model) return;
-		if (candidates.some((entry) => entry.model.provider === model.provider && entry.model.id === model.id)) return;
-		candidates.push({ model, source });
-	};
-
-	// 1. What the user asked for. Naming a provider is choosing it — but a setting
-	//    stamped for a provider this session has since left is stale and overridden
-	//    with a warning (parity with the subagent setting); a genuine cross-provider
-	//    choice made for THIS session is honored with an announcement, because the
-	//    classifier reads the user's prompts and CLAUDE.md.
-	const resolved = configured ? findConfigured(available, configured) : undefined;
-	if (resolved) {
-		if (sessionModel && crossesProvider(resolved, sessionModel)) {
-			if (isStaleContainmentStamp(configuredSetForContainment, sessionModel)) {
-				notices.push({
-					level: "warning",
-					text:
-						`autoMode.classifierModel ${spec(resolved)} was set for a different provider than this session (${spec(sessionModel)}); ` +
-						"a same-provider model screens calls instead. Re-set it with /auto-mode model on this session to use it here.",
-				});
-			} else {
-				// Informational, not a warning: the user deliberately set this for this
-				// session, so it is doing exactly what they asked.
-				notices.push({
-					level: "info",
-					text:
-						`autoMode.classifierModel ${spec(resolved)} is a different provider than this session (${spec(sessionModel)}) — ` +
-						"it reads your prompts and CLAUDE.md, so those go to that provider. It was set for this session, so it is honored.",
-				});
-				push(resolved, "configured");
-			}
-		} else {
-			push(resolved, "configured");
+	if (sessionModel && crossesProvider(resolved, sessionModel)) {
+		// Naming a provider is choosing it, but a setting stamped for a provider
+		// this session has since left is stale (parity with the subagent setting).
+		if (isStaleContainmentStamp(configuredSetForContainment, sessionModel)) {
+			return automaticBecause(
+				`autoMode.classifierModel ${spec(resolved)} was set for a different provider than this session (${spec(sessionModel)}); ` +
+					"a same-provider model screens calls instead. Re-set it with /auto-mode model on this session to use it here.",
+			);
 		}
-	}
-
-	// 2. The cheapest capable same-provider model, no dearer than the work being
-	//    screened — screening a call more expensively than making it is
-	//    indefensible. The shared gate excludes `tiny`, unpriced/opaque rows, and
-	//    the session model itself, so an unpriced provider yields nothing here and
-	//    the session model (step 3) screens the calls.
-	//    With an Artificial Analysis snapshot (an optional user key —
-	//    lib/capability-index.ts) the floor is MEASURED: a candidate whose coding
-	//    index reaches min(session, Sonnet 5), on the thinking-off variant the
-	//    classifier actually runs, screens — Claude Code's min(main, Sonnet) taken
-	//    literally, so a flash-class model that measurably matches its vendor's
-	//    flagship may screen it. A measured failure is never admitted; an
-	//    unscored candidate (no key, no confirmed match) is judged by the
-	//    name-class tier floor below, exactly as before the snapshot existed.
-	if (sessionModel) {
-		for (const model of capableContainedCandidates(available, sessionModel, "classifier")) push(model, "economical");
-	}
-
-	// 3. The session's own model: always correct, just not cheap. Terminal
-	//    fallback, so the gate degrades to screening on it rather than to broken.
-	//    No tier floor here: a floor that refused a `tiny` session model would
-	//    disarm auto mode on exactly the sessions least able to do without it,
-	//    on a price-and-name heuristic rather than measured competence. The
-	//    circumvention of a permission rule that motivated one is handled by
-	//    giving the classifier the user's own deny rules to judge by effect
-	//    (permissions/rule-prose.ts), not by picking a different screener.
-	push(sessionModel, "session");
-
-	// Nothing configured and no session model (a headless run with a bare
-	// registry) — take anything available rather than refusing outright.
-	if (candidates.length === 0) push(available[0], "session");
-
-	// A configured spec that matched nothing available would otherwise fall through
-	// in silence, leaving the user believing their setting is in force.
-	if (configured && !resolved) {
-		const instead = candidates[0];
+		// Informational: the user chose this for this session.
 		notices.push({
-			level: "warning",
+			level: "info",
 			text:
-				`autoMode.classifierModel is set to "${configured}", which is not an available model — check the name and that its provider is authenticated.` +
-				(instead ? ` Auto mode is using ${describeCandidate(instead)} instead.` : ""),
+				`autoMode.classifierModel ${spec(resolved)} is a different provider than this session (${spec(sessionModel)}): ` +
+				"it reads your messages and CLAUDE.md, so those go to that provider. It was set for this session, so it is used.",
 		});
 	}
-
+	for (const warning of chosenModelWarnings({ available, sessionModel, chosen: resolved, role: "classifier", suggestNewer })) {
+		notices.push({ level: "warning", text: `${warning.text} ${warning.fix}`, choiceWarning: warning.kind });
+	}
+	const candidates: Candidate[] = [{ model: resolved, source: "configured" }];
+	for (const entry of automatic.candidates) {
+		if (entry.model.provider !== resolved.provider || entry.model.id !== resolved.id) candidates.push(entry);
+	}
+	// The automatic chain's "why the session screens" notice does not describe a
+	// chain the user's choice leads, so it is dropped with its fallback.
 	return { candidates, notices };
 }
 
+/**
+ * The automatic chain. For a session model the pairing table names
+ * (`lib/model-pairings.ts`), its pick leads (or the session alone screens);
+ * otherwise the cost algorithm below. Entries stay on the session provider/route, sit in the
+ * session's tier or above (`model-tier.ts`, from the public catalogs), cost
+ * strictly less than the session model, are not experimental builds or moving
+ * `-latest` aliases (what answers one changes without notice), and have
+ * a known catalog window at least as large as the session's: the same rule as
+ * the subagent default (`sameTierContainedCandidates`), priced per classifier
+ * call, plus the window. The
+ * cheapest qualifying model screens first, with the session retained as an
+ * availability fallback.
+ */
+function automaticClassifierCandidates(available: Model<Api>[], sessionModel: Model<Api> | undefined): ClassifierChain {
+	// A classifier gets the whole user transcript. It must stay on the session's
+	// provider/route, sit in the session's tier, and be able to receive every
+	// token the session catalog says the main model can receive. Catalog
+	// omissions are unsafe to guess at: an unknown candidate window is ineligible.
+	if (!sessionModel) return { candidates: [], notices: [] };
+	const sessionOnly = (fallback: ClassifierFallback): ClassifierChain => ({
+		candidates: [{ model: sessionModel, source: "session" }],
+		notices: [{ level: "info", text: fallback.text, fallbackReason: fallback.reason }],
+		fallback,
+	});
+	if (!hasCatalogContextWindow(sessionModel)) {
+		return sessionOnly({
+			reason: "unknown-session-context-window",
+			text: `Auto mode is screening calls with ${spec(sessionModel)}, this session's model, because its catalog context window is unknown and no alternate classifier can be verified to contain it.`,
+		});
+	}
+	// The pairing table speaks first for the models it names (lib/model-pairings.ts),
+	// under the same window and moving-alias gates; it may also keep the session.
+	const fits = (model: Model<Api>) => !isMovingAlias(model.id) && hasCatalogContextWindow(model) && model.contextWindow >= sessionModel.contextWindow;
+	const contained = modelsContainedToSession(available, sessionModel);
+	const price = classifierPrice(sessionModel);
+	const paired = pairedModel("classifier", available, sessionModel, { contained, price, accept: fits });
+	if (paired?.kind === "session") {
+		return sessionOnly({
+			reason: "paired-session",
+			text: `Auto mode is screening calls with ${spec(sessionModel)}, this session's model: One Code's model pairing table finds no smaller model of its vendor close enough in capability to screen for it.`,
+		});
+	}
+	// Never weaker than the session, strictly cheaper per call (the user,
+	// 2026-10-05: Qwen 3.8 27B drew a 2.4T model at five times its input price;
+	// 2026-10-07: a same-price older model saves nothing; 2026-10-12: judged on
+	// a call's own cost shape), and an unpriced session cannot prove an
+	// alternate cheaper. The classifier adds a window that contains the
+	// session's and never a moving alias (experimental builds are never
+	// auto-selectable at all). A session with no catalog cache-read price is
+	// compared by list input price (classifierPrice).
+	const cheaper = sameTierContainedCandidates(available, sessionModel, { contained, price }).filter(fits);
+	// The cost algorithm's picks stay behind the table's, in case the provider
+	// lists the paired model but refuses it to this account at call time.
+	if (paired) {
+		const backups = cheaper.filter((model) => model !== paired.model).map((model): Candidate => ({ model, source: "economical" }));
+		return { candidates: [{ model: paired.model, source: "paired" }, ...backups, { model: sessionModel, source: "session" }], notices: [] };
+	}
+	if (cheaper.length === 0) {
+		return sessionOnly({
+			reason: "no-qualifying-model",
+			text: `Auto mode is screening calls with ${spec(sessionModel)}, this session's model, because no cheaper same-provider/route model in its ${intrinsicTier(sessionModel)} tier or above contains its ${sessionModel.contextWindow}-token catalog context window.`,
+		});
+	}
+	// The session stays last as the availability fallback.
+	return {
+		candidates: [...cheaper.map((model): Candidate => ({ model, source: "economical" })), { model: sessionModel, source: "session" }],
+		notices: [],
+	};
+}
+
 /**
  * Whether an error means "this model is not usable on this account" — in which
  * case stepping to the next candidate is right — as opposed to a transient
@@ -222,11 +245,13 @@ export function describeCandidate(candidate: Candidate): string {
 	const where = modelIdentity(candidate.model).profile ?? candidate.model.provider;
 	switch (candidate.source) {
 		case "configured":
-			return `${name} (from autoMode.classifierModel)`;
+			return `${name} (autoMode.classifierModel)`;
+		case "paired":
+			return `${name} (paired with the session model in One Code's model pairing table)`;
 		case "economical":
-			return `${name} (cheapest model within ${where} that meets the capability floor — measured coding index when an Artificial Analysis snapshot is cached, else the session's tier)`;
+			return `${name} (cheapest model within ${where} in the session's tier or above that contains the session catalog context window)`;
 		case "session":
-			return `${name} (this session's model — nothing cheaper within ${where} meets the capability floor)`;
+			return `${name} (this session's model)`;
 	}
 }
 

package/extensions/auto-mode/paths.ts

@@ -15,7 +15,7 @@
  *    and every caller treats that as "not provably contained".
  */
 
-import { lstatSync, readlinkSync } from "node:fs";
+import { type Dirent, lstatSync, readdirSync, readlinkSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { comparablePath, expandTilde, gitBashPathToNative, isPathAtOrUnder, tryRealpath } from "../lib/paths.ts";
 
@@ -41,6 +41,19 @@ export function pathArgument(input: Record<string, unknown> | undefined): string
 	return typeof path === "string" ? path : undefined;
 }
 
+/**
+ * The fix to name when a call spells its target in two path fields with
+ * different values (`path` and `file_path`), undefined otherwise. The tool
+ * validator keeps both and the tool reads only one, so a gate that picked the
+ * other judged a file the call never touches
+ * (AUTO-MODE-SECURITY-REVIEW-2026-09-24 H1).
+ */
+export function conflictingPathArguments(input: Record<string, unknown> | undefined): string | undefined {
+	const fields = ["path", "file_path", "notebook_path"].filter((key) => input?.[key] !== undefined);
+	if (new Set(fields.map((key) => input?.[key])).size < 2) return undefined;
+	return `This call names its target in ${fields.map((key) => `\`${key}\``).join(" and ")} with different values. Pass the target once, in the field the tool's schema defines.`;
+}
+
 /** The shared comparison form (lib/paths.ts): `/` separators, case-folded on darwin/win32. */
 const normalize = comparablePath;
 
@@ -50,21 +63,32 @@ const normalize = comparablePath;
  * resolved — callers must not treat that as contained.
  */
 export function resolveForContainment(target: string): string | undefined {
+	const resolved = resolveThroughLinks(target);
+	return resolved === undefined ? undefined : normalize(resolved);
+}
+
+/**
+ * {@link resolveForContainment} in the filesystem's own spelling (not
+ * case-folded), for showing where a path lands.
+ */
+export function resolveThroughLinks(target: string, hops = 0): string | undefined {
 	const absolute = resolve(target);
 
 	const direct = tryRealpath(absolute);
-	if (direct) return normalize(direct);
+	if (direct) return direct;
 
 	// The leaf may be a dangling symlink: realpath fails on it, but writes still
 	// follow it. Read the link and resolve its target instead of assuming the
 	// literal path (N9).
 	try {
 		const stats = lstatSync(absolute);
-		if (stats.isSymbolicLink()) {
+		// A link cycle (`a -> a`) stops at the kernel's usual 40 hops, then
+		// resolves like any other leaf, below, instead of overflowing the stack.
+		if (stats.isSymbolicLink() && hops < 40) {
 			const linkTarget = readlinkSync(absolute);
 			const resolvedTarget = isAbsolute(linkTarget) ? linkTarget : resolve(dirname(absolute), linkTarget);
 			// One hop is enough: the target's own realpath covers the rest of a chain.
-			return resolveForContainment(resolvedTarget) ?? normalize(resolvedTarget);
+			return resolveThroughLinks(resolvedTarget, hops + 1) ?? resolvedTarget;
 		}
 	} catch {
 		// Does not exist yet — fall through to ancestor resolution below.
@@ -79,7 +103,7 @@ export function resolveForContainment(target: string): string | undefined {
 		if (parent === cursor) return undefined;
 		tail.unshift(basename(cursor));
 		const realParent = tryRealpath(parent);
-		if (realParent) return normalize(join(realParent, ...tail));
+		if (realParent) return join(realParent, ...tail);
 		cursor = parent;
 	}
 }
@@ -117,3 +141,31 @@ export function toAbsolute(cwd: string, token: string, home: string): string {
 export function toAbsoluteBash(cwd: string, token: string, home: string): string {
 	return toAbsolute(cwd, gitBashPathToNative(token), home);
 }
+
+/**
+ * Whether moving, copying or removing `source` touches a path `guarded`
+ * flags beneath it: walks `source` without following symlinks, at most
+ * `budget` entries, and tests each entry's counterpart under `target` (the
+ * same path for a removal). A walk that runs out of budget counts as touching
+ * one, so the command is judged, not cleared. A file source walks nothing.
+ * `guarded` also gets the source's directory entry (a symbolic link is one).
+ */
+export function touchesGuardedPath(source: string, target: string, guarded: (path: string, entry: Dirent) => boolean, budget = 5_000): boolean {
+	const stack = [""];
+	let seen = 0;
+	while (stack.length > 0) {
+		const relative = stack.pop() as string;
+		let entries;
+		try {
+			entries = readdirSync(join(source, relative), { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const child = join(relative, entry.name);
+			if (++seen > budget || guarded(join(target, child), entry)) return true;
+			if (entry.isDirectory()) stack.push(child);
+		}
+	}
+	return false;
+}

package/extensions/auto-mode/pause.ts

@@ -12,6 +12,27 @@
 export const CONSECUTIVE_BLOCK_LIMIT = 3;
 export const TOTAL_BLOCK_LIMIT = 20;
 
+/**
+ * How long a timed resume prompt waits before denying the call, as Claude
+ * Code's denial-limit fallback does (2.1.282: 120 s, overridden by
+ * `CLAUDE_CODE_TICKLISH_WHISPER_TIMEOUT_MS`), so an unattended session is not
+ * held by a prompt nobody will answer.
+ */
+export const UNATTENDED_PROMPT_TIMEOUT_MS = 120_000;
+
+export function unattendedPromptTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
+	const value = Number(env.CLAUDE_CODE_TICKLISH_WHISPER_TIMEOUT_MS);
+	return Number.isFinite(value) && value > 0 ? value : UNATTENDED_PROMPT_TIMEOUT_MS;
+}
+
+/** Claude Code's warning line on a timed prompt, in its "about N minutes" form (the dialog adds a live countdown). */
+export function unattendedPromptNotice(timeoutMs: number): string {
+	const minutes = Math.round(timeoutMs / 60_000);
+	const seconds = Math.max(1, Math.round(timeoutMs / 1000));
+	const left = timeoutMs >= 60_000 ? `about ${minutes} ${minutes === 1 ? "minute" : "minutes"}` : `about ${seconds} ${seconds === 1 ? "second" : "seconds"}`;
+	return `⚠ One Code will automatically deny this request in ${left}, to avoid blocking progress on an unattended session`;
+}
+
 export interface Denial {
 	toolName: string;
 	/** The command or path the call targeted, for the /permissions listing. */
@@ -33,6 +54,10 @@ export class PauseTracker {
 	private consecutive = 0;
 	private total = 0;
 	private paused = false;
+	/** Which limit tripped the current pause. */
+	private trippedBy: "consecutive" | "total" | undefined;
+	/** The timed resume prompt was shown in this block streak (Claude Code's `timedFallbackShown`). */
+	private timedShown = false;
 	private readonly denials: Denial[] = [];
 
 	/** Record a classifier block. Returns true if this one tripped the pause. */
@@ -44,10 +69,12 @@ export class PauseTracker {
 
 		if (this.consecutive >= CONSECUTIVE_BLOCK_LIMIT) {
 			this.paused = true;
+			this.trippedBy = "consecutive";
 			return true;
 		}
 		if (this.total >= TOTAL_BLOCK_LIMIT) {
 			this.paused = true;
+			this.trippedBy = "total";
 			// The total counter resets when it is what triggered the fallback.
 			// Without this, resuming leaves it at the limit and the very next block
 			// re-pauses immediately, making the resume single-use.
@@ -57,9 +84,33 @@ export class PauseTracker {
 		return false;
 	}
 
-	/** A classifier approval breaks a consecutive-block run. */
-	recordAllow(): void {
+	/**
+	 * Any allowed call in auto mode breaks a consecutive-block run, as in Claude
+	 * Code, whose denial count resets on every allow in auto mode (2.1.282).
+	 * Claude Code has no pause state: a block falls back to a prompt only while
+	 * the count is at the limit, so an allow ends a pause the consecutive limit
+	 * tripped. A 20-total pause still waits for the user. Returns true when this
+	 * allow ended a pause.
+	 */
+	recordAllow(): boolean {
 		this.consecutive = 0;
+		this.timedShown = false;
+		if (!this.paused || this.trippedBy !== "consecutive") return false;
+		this.paused = false;
+		this.trippedBy = undefined;
+		return true;
+	}
+
+	/**
+	 * Whether this resume prompt auto-denies after `unattendedPromptTimeoutMs`,
+	 * and marks it shown. As in Claude Code, only a pause the consecutive limit
+	 * tripped is timed, and only once until the streak breaks: the next prompt
+	 * in the same streak waits for the user. A 20-total pause always waits.
+	 */
+	takeTimedPrompt(): boolean {
+		if (!this.paused || this.trippedBy !== "consecutive" || this.timedShown) return false;
+		this.timedShown = true;
+		return true;
 	}
 
 	/**
@@ -70,6 +121,8 @@ export class PauseTracker {
 	resume(): void {
 		this.paused = false;
 		this.consecutive = 0;
+		this.trippedBy = undefined;
+		this.timedShown = false;
 	}
 
 	isPaused(): boolean {
@@ -81,6 +134,8 @@ export class PauseTracker {
 		this.consecutive = 0;
 		this.total = 0;
 		this.paused = false;
+		this.trippedBy = undefined;
+		this.timedShown = false;
 		this.denials.length = 0;
 	}