one-code-extension 0.4.1 → 0.6.0

package/extensions/auto-mode/prompt.ts

@@ -1,7 +1,7 @@
 /**
  * Classifier payload assembly and stage-verdict parsing (pure).
  *
- * The payload is Claude Code's shape (docs/decisions/auto-mode.md, P4/P5):
+ * The payload is Claude Code's shape (working-docs/decisions/auto-mode.md, P4/P5):
  *   system = <ruleset with Environment spliced> + <Session Context>
  *   user   = <CLAUDE.md framing> + <transcript> + <stage final instruction>
  * The two stages share system+framing+transcript byte-for-byte and differ only
@@ -21,20 +21,19 @@ import {
 	STAGE2_INTENT_ADDENDUM,
 } from "./classifier-prompt.ts";
 import { buildCategoryIndex, groundCategory, normalizeName, type RuleIndex } from "./rules.ts";
-import { clip, renderTranscript, type TranscriptEntry } from "./transcript.ts";
+import { clip, transcriptBlocks, type TranscriptEntry } from "./transcript.ts";
 
 export interface ClassifyRequest {
 	/**
-	 * The ordered transcript, user messages and tool inputs only (results
-	 * stripped). Its **last entry is the action under review** — the caller
-	 * appends the call being judged before handing it here.
+	 * The active transcript: user messages, compaction context, and tool inputs
+	 * (results stripped). Its **last entry is the action under review** — the
+	 * caller appends the call being judged before handing it here.
 	 */
 	transcript: TranscriptEntry[];
 	/**
-	 * Every user message this session, for intent-quote verification. Full, never
-	 * a rolling window: in a long unattended run the authorizing setup message
-	 * must still clear a later action (decision 2). Distinct from the transcript,
-	 * whose oldest lines may be dropped for length.
+	 * The user's own messages still in active context, for intent verification.
+	 * Kept separately from tool inputs and model-generated compaction summaries:
+	 * neither can manufacture a quote attributed to the user.
 	 */
 	userMessages: string[];
 	/** The user's CLAUDE.md, wrapped in the (untrusted) framing block. */
@@ -61,6 +60,14 @@ export interface ClassifyVerdict {
 	ruleId?: string;
 	/** The model's own wording, kept for diagnosis and shown attributed to it. */
 	raw?: string;
+	/**
+	 * Set when no classifier verdict was reached (no model, a failure, a
+	 * timeout, an action too large to send): the block judged nothing, so it is
+	 * not offered for approval in `/permissions` (Claude Code's `noVerdict`).
+	 */
+	noVerdict?: true;
+	/** The provider could not fit the whole transcript; no safety verdict was reached. */
+	transcriptTooLong?: true;
 }
 
 /**
@@ -69,13 +76,14 @@ export interface ClassifyVerdict {
  * `classify()` does not rebuild and re-parse it a second time per call. The final
  * instruction is appended per stage by the caller (stage1User / stage2User).
  */
-export function buildPayload(request: ClassifyRequest): { system: string; userPrefix: string; index: RuleIndex } {
+export function buildPayload(request: ClassifyRequest): { system: string; userPrefix: string; history: string[]; tail: string; index: RuleIndex } {
 	const ruleset = buildRuleset(request.environment, request.ruleExtras);
 	const system = ruleset + renderSessionContext(request.username);
 	const framing = claudeMdFraming(request.claudeMd);
-	const transcript = renderTranscript(request.transcript);
-	const userPrefix = [framing, transcript].filter(Boolean).join("\n\n");
-	return { system, userPrefix, index: buildCategoryIndex(ruleset) };
+	const { history, tail } = transcriptBlocks(request.transcript);
+	if (framing) history[0] = `${framing}\n\n${history[0]}`;
+	const userPrefix = history.join("") + tail;
+	return { system, userPrefix, history, tail, index: buildCategoryIndex(ruleset) };
 }
 
 /** The stage-1 user message: shared prefix + the harm-only final instruction. */
@@ -126,13 +134,20 @@ export function reviewUser(userPrefix: string): string {
 	return `${userPrefix}\n\n${STAGE2_FINAL.trimStart()}${STAGE_REVIEW_ADDENDUM}`;
 }
 
-/** The integer inside the last `<severity>…` tag (closing tag optional). */
+/**
+ * The whole number inside the last `<severity>…` tag (closing tag optional),
+ * or null. The body must be the number and nothing else: a model answering on
+ * another scale (`0.9`, `9/10`, `90%`) gives a body whose leading digits are
+ * not its severity, and reading them cleared stage 1 with no stage 2. Null
+ * falls through to stage 2, and a stage-2 null is a block.
+ */
 export function parseSeverity(text: string): number | null {
-	const matches = [...text.matchAll(/<severity>\s*(\d{1,3})/gi)];
-	if (matches.length === 0) return null;
-	const value = Number.parseInt(matches[matches.length - 1][1], 10);
-	if (Number.isNaN(value)) return null;
-	return Math.max(0, Math.min(100, value));
+	const tags = [...text.matchAll(/<severity>([^<]*)/gi)];
+	const last = tags.at(-1);
+	if (!last) return null;
+	const body = /^\s*(\d{1,3})\s*$/.exec(last[1]);
+	if (!body) return null;
+	return Math.min(100, Number.parseInt(body[1], 10));
 }
 
 /** The content of the last `<tag>…</tag>` (or `<tag>…` unterminated), trimmed. */
@@ -220,6 +235,7 @@ export function parseStage2(text: string, index: RuleIndex, userMessages: string
 			reason: "The approval classifier's reply carried no severity, so the verdict could not be read.",
 			tier: "unmatched",
 			raw,
+			noVerdict: true,
 		};
 	}
 
@@ -228,8 +244,8 @@ export function parseStage2(text: string, index: RuleIndex, userMessages: string
 		if (intent) {
 			// An allow resting on user intent is the one claim worth checking: it is
 			// what a prompt injection most wants to manufacture and what the model is
-			// most prone to stretch. Verified against the full user messages, so an
-			// early authorization still clears late (decision 2).
+			// most prone to stretch. Verified against the user's own active messages,
+			// never against a model-generated account of what the user requested.
 			if (!intentQuoted(intent, userMessages)) {
 				return {
 					decision: "block",