titan-agent 6.5.2 → 7.0.0

package/dist/agent/autoModeClassifier.js

@@ -20,6 +20,22 @@ function getAutoModePolicy() {
   }
   return "standard";
 }
+const NAME_GATED_EXACT = /* @__PURE__ */ new Set([
+  "shell",
+  "run_shell",
+  "bash",
+  "run_command",
+  "execute_command",
+  "exec",
+  "delete_file",
+  "bulk_delete_labels",
+  "phone_call",
+  "make_call"
+]);
+const NAME_GATED_PATTERN = /(^|_)(delete|destroy|wipe|purge|deploy|publish|transfer|payment|purchase|wire|send_email|email_send)(_|$)/i;
+function nameLooksHighImpact(toolName) {
+  return NAME_GATED_EXACT.has(toolName) || NAME_GATED_PATTERN.test(toolName);
+}
 function classifyToolCall(toolName) {
   const policy = getAutoModePolicy();
   const contract = getToolContract(toolName);
@@ -42,9 +58,16 @@ function classifyToolCall(toolName) {
     };
   }
   if (!contract) {
+    if (nameLooksHighImpact(toolName)) {
+      return {
+        decision: "gate",
+        reason: `no contract + high-impact name "${toolName}" \u2014 gating`,
+        policy
+      };
+    }
     return {
-      decision: "gate",
-      reason: `no contract registered for "${toolName}" \u2014 gating by default`,
+      decision: "notify",
+      reason: `no contract for "${toolName}" \u2014 notify (benign long-tail)`,
       policy
     };
   }
@@ -90,6 +113,7 @@ export {
   classifyToolCall,
   formatBreadcrumb,
   getAutoModePolicy,
+  nameLooksHighImpact,
   shouldGate
 };
 //# sourceMappingURL=autoModeClassifier.js.map

package/dist/agent/autoModeClassifier.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/agent/autoModeClassifier.ts"],"sourcesContent":["/**\n * TITAN — Auto-Mode Classifier (v6.1.0-beta.16, Phase D.4)\n *\n * Reads the tool contract registry to decide whether an incoming\n * tool call can run autonomously, deserves a passive notification,\n * or requires explicit human approval. Pattern from Anthropic's\n * \"Claude Code auto-mode\" blog (in the Picrew/awesome-agent-harness\n * featured-reading list): classifier-backed approval delegation\n * gives the agent autonomy on safe paths while keeping a kill\n * switch on the risky ones.\n *\n * THREE DECISIONS:\n *\n *   - 'auto'    — run without prompting. Read-only ops + workspace\n *                 writes. Most missions run mostly 'auto' calls.\n *   - 'notify'  — run, but record a passive notification so a\n *                 watcher (Mission Canvas, log tail) can see it\n *                 happened. Default for network calls.\n *   - 'gate'    — require explicit human approval before running.\n *                 Default for destructive ops (shell, delete, etc.)\n *                 AND for any tool without a registered contract\n *                 (unknown → conservative).\n *\n * POLICY OVERRIDES (config.security.autoMode.policy):\n *\n *   - 'standard'  (default) — riskLevel drives the decision per\n *                             the table above.\n *   - 'paranoid'             — every tool call is 'gate'. For\n *                             demos, regulated environments, or\n *                             when Tony is debugging a misbehaving\n *                             agent.\n *   - 'permissive'           — riskLevel 'moderate' is auto-run\n *                             (still 'gate' on 'high'). For\n *                             trusted hot loops where ping-the-user\n *                             on every web_search is annoying.\n *   - 'yolo'                 — everything auto, including 'high'.\n *                             ONLY for sandboxed eval runs. Logs\n *                             a loud warning on init.\n *\n * WHY this module exists:\n *\n *   - Phase D.3 added riskLevel + sideEffects metadata to the 9\n *     canonical contracts. D.4 makes the metadata actually do\n *     something — gating decisions, not just labels.\n *\n *   - The existing approval-gate path in toolRunner uses a hardcoded\n *     \"is this tool name dangerous?\" list. That's a string-match\n *     allowlist that doesn't scale and doesn't account for HOW the\n *     tool is being used. The classifier is the structural answer:\n *     contracts declare risk; the classifier reads contracts.\n *\n *   - Decoupling the policy from the runner means changing the\n *     gating semantics (e.g. add a new 'risky-during-business-hours'\n *     decision) is a one-file change — never a wholesale runner\n *     refactor.\n *\n * TRADE-OFFS:\n *\n *   - First cut keys decisions on contract.riskLevel alone. A\n *     follow-up could consider call ARGS (e.g. shell with\n *     `command: 'ls'` could be 'auto' while shell with\n *     `command: 'rm -rf'` is still 'gate'). Skipped for now to\n *     keep the surface small + predictable.\n *\n *   - Tools without a registered contract default to 'gate'. This\n *     is conservative but means the long-tail 239 skills will hit\n *     the approval gate on every call until their contracts ship.\n *     If that becomes painful, lift the default to 'notify' via\n *     the `unknownToolDefault` config field.\n *\n * FOLLOW-UP:\n *\n *   - Phase D.5 reads sideEffects==='destructive' to route the\n *     call into a worktree-isolated executor.\n *   - Args-aware classification (shell `rm -rf` vs shell `ls`).\n *   - Per-session policy override so a \"draft a quick email\"\n *     mission can opt into 'permissive' while a \"review and merge\n *     this PR\" mission stays on 'paranoid'.\n */\n\nimport { getToolContract, type RiskLevel } from './toolContract.js';\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'autoMode';\n\n/* ──────────────────────────  Types  ────────────────────────── */\n\nexport type AutoModeDecision = 'auto' | 'notify' | 'gate';\nexport type AutoModePolicy = 'standard' | 'paranoid' | 'permissive' | 'yolo';\n\nexport interface ClassificationResult {\n    /** What the runner should do with the call. */\n    decision: AutoModeDecision;\n    /** Plain-english reason — logged and surfaced in the trajectory. */\n    reason: string;\n    /** Policy that produced this decision (drives observability). */\n    policy: AutoModePolicy;\n    /** Risk level from the contract, if any. Undefined for unknown tools. */\n    riskLevel?: RiskLevel;\n}\n\n/* ──────────────────────────  Policy loader  ────────────────────────── */\n\n/**\n * Resolve the current auto-mode policy. Reads\n * `config.security.autoMode.policy` if present; defaults to 'standard'.\n * Pure synchronous lookup — no IO, safe to call per-tool-call.\n */\nexport function getAutoModePolicy(): AutoModePolicy {\n    // beta.21 — env override. Lets the test suite (and any embedder\n    // that wants a process-wide policy without touching config files)\n    // short-circuit the classifier without mutating loaded config.\n    // Production callers should configure via `config.security.autoMode.policy`\n    // — this env hook is opt-in and silent when unset.\n    const envPolicy = process.env.TITAN_AUTOMODE_POLICY;\n    if (envPolicy === 'paranoid' || envPolicy === 'permissive' || envPolicy === 'yolo' || envPolicy === 'standard') {\n        return envPolicy;\n    }\n    try {\n        const cfg = loadConfig();\n        const sec = (cfg as Record<string, unknown>).security as Record<string, unknown> | undefined;\n        const am = sec?.autoMode as Record<string, unknown> | undefined;\n        const policy = am?.policy as string | undefined;\n        if (policy === 'paranoid' || policy === 'permissive' || policy === 'yolo' || policy === 'standard') {\n            return policy;\n        }\n    } catch { /* config unavailable — fall through */ }\n    return 'standard';\n}\n\n/* ──────────────────────────  Classifier  ────────────────────────── */\n\n/**\n * Decide whether a tool call should run automatically, with a\n * notification, or with explicit approval. The runner uses this to\n * decide whether to short-circuit the existing approval-gate path.\n *\n * Pure: no IO beyond reading the config + contract registry. Cheap\n * enough to call on every tool call without measuring.\n */\nexport function classifyToolCall(toolName: string): ClassificationResult {\n    const policy = getAutoModePolicy();\n    const contract = getToolContract(toolName);\n    const riskLevel = contract?.riskLevel;\n\n    // yolo short-circuit: regardless of risk, run. ONLY for sandboxed\n    // eval runs — logs a loud warning the first time per process.\n    if (policy === 'yolo') {\n        warnYoloOnce();\n        return {\n            decision: 'auto',\n            reason: 'yolo policy — gating disabled',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // paranoid short-circuit: every call gated.\n    if (policy === 'paranoid') {\n        return {\n            decision: 'gate',\n            reason: 'paranoid policy — every tool call requires approval',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // Unknown tool (no registered contract) → conservative 'gate'.\n    // The long-tail 239 skills without contracts hit this branch\n    // until their contracts ship. Override via config if the prompt\n    // pings become annoying.\n    if (!contract) {\n        return {\n            decision: 'gate',\n            reason: `no contract registered for \"${toolName}\" — gating by default`,\n            policy,\n        };\n    }\n\n    // Standard + permissive paths read riskLevel.\n    if (riskLevel === 'safe') {\n        return { decision: 'auto', reason: 'contract riskLevel=safe', policy, riskLevel };\n    }\n    if (riskLevel === 'moderate') {\n        if (policy === 'permissive') {\n            return { decision: 'auto', reason: 'permissive policy — moderate risk auto-runs', policy, riskLevel };\n        }\n        return { decision: 'notify', reason: 'contract riskLevel=moderate', policy, riskLevel };\n    }\n    if (riskLevel === 'high') {\n        return { decision: 'gate', reason: 'contract riskLevel=high', policy, riskLevel };\n    }\n\n    // Defensive fallback for an unknown future riskLevel value.\n    return {\n        decision: 'gate',\n        reason: `unrecognised riskLevel \"${riskLevel}\" — gating defensively`,\n        policy,\n        riskLevel,\n    };\n}\n\n/* ──────────────────────────  Helpers  ────────────────────────── */\n\nlet _yoloWarned = false;\nfunction warnYoloOnce(): void {\n    if (_yoloWarned) return;\n    _yoloWarned = true;\n    logger.warn(\n        COMPONENT,\n        'AUTO_MODE=yolo — every tool call will run without approval. This mode is ONLY intended for sandboxed eval runs. If you see this in production logs, something is misconfigured.',\n    );\n}\n\n/** For tests. */\nexport function _resetYoloWarning(): void {\n    _yoloWarned = false;\n}\n\n/**\n * Convenience: returns true iff the decision means the call should\n * NOT proceed without explicit human approval. Used by the runner\n * to short-circuit the existing approval-gate path on 'auto' /\n * 'notify' decisions.\n */\nexport function shouldGate(result: ClassificationResult): boolean {\n    return result.decision === 'gate';\n}\n\n/**\n * Format the classification as a one-line breadcrumb suitable for\n * the trajectory `note` event. Used by the runner on 'notify'\n * decisions so the trajectory captures what the agent did\n * autonomously vs what required a human prompt.\n */\nexport function formatBreadcrumb(toolName: string, result: ClassificationResult): string {\n    return `automode:${result.decision} tool=${toolName} risk=${result.riskLevel ?? 'unknown'} policy=${result.policy} (${result.reason})`;\n}\n"],"mappings":";AAgFA,SAAS,uBAAuC;AAChD,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAyBX,SAAS,oBAAoC;AAMhD,QAAM,YAAY,QAAQ,IAAI;AAC9B,MAAI,cAAc,cAAc,cAAc,gBAAgB,cAAc,UAAU,cAAc,YAAY;AAC5G,WAAO;AAAA,EACX;AACA,MAAI;AACA,UAAM,MAAM,WAAW;AACvB,UAAM,MAAO,IAAgC;AAC7C,UAAM,KAAK,KAAK;AAChB,UAAM,SAAS,IAAI;AACnB,QAAI,WAAW,cAAc,WAAW,gBAAgB,WAAW,UAAU,WAAW,YAAY;AAChG,aAAO;AAAA,IACX;AAAA,EACJ,QAAQ;AAAA,EAA0C;AAClD,SAAO;AACX;AAYO,SAAS,iBAAiB,UAAwC;AACrE,QAAM,SAAS,kBAAkB;AACjC,QAAM,WAAW,gBAAgB,QAAQ;AACzC,QAAM,YAAY,UAAU;AAI5B,MAAI,WAAW,QAAQ;AACnB,iBAAa;AACb,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,WAAW,YAAY;AACvB,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAMA,MAAI,CAAC,UAAU;AACX,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ,+BAA+B,QAAQ;AAAA,MAC/C;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AACA,MAAI,cAAc,YAAY;AAC1B,QAAI,WAAW,cAAc;AACzB,aAAO,EAAE,UAAU,QAAQ,QAAQ,oDAA+C,QAAQ,UAAU;AAAA,IACxG;AACA,WAAO,EAAE,UAAU,UAAU,QAAQ,+BAA+B,QAAQ,UAAU;AAAA,EAC1F;AACA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AAGA,SAAO;AAAA,IACH,UAAU;AAAA,IACV,QAAQ,2BAA2B,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACJ;AACJ;AAIA,IAAI,cAAc;AAClB,SAAS,eAAqB;AAC1B,MAAI,YAAa;AACjB,gBAAc;AACd,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;AAGO,SAAS,oBAA0B;AACtC,gBAAc;AAClB;AAQO,SAAS,WAAW,QAAuC;AAC9D,SAAO,OAAO,aAAa;AAC/B;AAQO,SAAS,iBAAiB,UAAkB,QAAsC;AACrF,SAAO,YAAY,OAAO,QAAQ,SAAS,QAAQ,SAAS,OAAO,aAAa,SAAS,WAAW,OAAO,MAAM,KAAK,OAAO,MAAM;AACvI;","names":[]}
+{"version":3,"sources":["../../src/agent/autoModeClassifier.ts"],"sourcesContent":["/**\n * TITAN — Auto-Mode Classifier (v6.1.0-beta.16, Phase D.4)\n *\n * Reads the tool contract registry to decide whether an incoming\n * tool call can run autonomously, deserves a passive notification,\n * or requires explicit human approval. Pattern from Anthropic's\n * \"Claude Code auto-mode\" blog (in the Picrew/awesome-agent-harness\n * featured-reading list): classifier-backed approval delegation\n * gives the agent autonomy on safe paths while keeping a kill\n * switch on the risky ones.\n *\n * THREE DECISIONS:\n *\n *   - 'auto'    — run without prompting. Read-only ops + workspace\n *                 writes. Most missions run mostly 'auto' calls.\n *   - 'notify'  — run, but record a passive notification so a\n *                 watcher (Mission Canvas, log tail) can see it\n *                 happened. Default for network calls.\n *   - 'gate'    — require explicit human approval before running.\n *                 Default for destructive ops (shell, delete, etc.)\n *                 AND for any tool without a registered contract\n *                 (unknown → conservative).\n *\n * POLICY OVERRIDES (config.security.autoMode.policy):\n *\n *   - 'standard'  (default) — riskLevel drives the decision per\n *                             the table above.\n *   - 'paranoid'             — every tool call is 'gate'. For\n *                             demos, regulated environments, or\n *                             when Tony is debugging a misbehaving\n *                             agent.\n *   - 'permissive'           — riskLevel 'moderate' is auto-run\n *                             (still 'gate' on 'high'). For\n *                             trusted hot loops where ping-the-user\n *                             on every web_search is annoying.\n *   - 'yolo'                 — everything auto, including 'high'.\n *                             ONLY for sandboxed eval runs. Logs\n *                             a loud warning on init.\n *\n * WHY this module exists:\n *\n *   - Phase D.3 added riskLevel + sideEffects metadata to the 9\n *     canonical contracts. D.4 makes the metadata actually do\n *     something — gating decisions, not just labels.\n *\n *   - The existing approval-gate path in toolRunner uses a hardcoded\n *     \"is this tool name dangerous?\" list. That's a string-match\n *     allowlist that doesn't scale and doesn't account for HOW the\n *     tool is being used. The classifier is the structural answer:\n *     contracts declare risk; the classifier reads contracts.\n *\n *   - Decoupling the policy from the runner means changing the\n *     gating semantics (e.g. add a new 'risky-during-business-hours'\n *     decision) is a one-file change — never a wholesale runner\n *     refactor.\n *\n * TRADE-OFFS:\n *\n *   - First cut keys decisions on contract.riskLevel alone. A\n *     follow-up could consider call ARGS (e.g. shell with\n *     `command: 'ls'` could be 'auto' while shell with\n *     `command: 'rm -rf'` is still 'gate'). Skipped for now to\n *     keep the surface small + predictable.\n *\n *   - Tools without a registered contract default to 'gate'. This\n *     is conservative but means the long-tail 239 skills will hit\n *     the approval gate on every call until their contracts ship.\n *     If that becomes painful, lift the default to 'notify' via\n *     the `unknownToolDefault` config field.\n *\n * FOLLOW-UP:\n *\n *   - Phase D.5 reads sideEffects==='destructive' to route the\n *     call into a worktree-isolated executor.\n *   - Args-aware classification (shell `rm -rf` vs shell `ls`).\n *   - Per-session policy override so a \"draft a quick email\"\n *     mission can opt into 'permissive' while a \"review and merge\n *     this PR\" mission stays on 'paranoid'.\n */\n\nimport { getToolContract, type RiskLevel } from './toolContract.js';\nimport { loadConfig } from '../config/config.js';\nimport logger from '../utils/logger.js';\n\nconst COMPONENT = 'autoMode';\n\n/* ──────────────────────────  Types  ────────────────────────── */\n\nexport type AutoModeDecision = 'auto' | 'notify' | 'gate';\nexport type AutoModePolicy = 'standard' | 'paranoid' | 'permissive' | 'yolo';\n\nexport interface ClassificationResult {\n    /** What the runner should do with the call. */\n    decision: AutoModeDecision;\n    /** Plain-english reason — logged and surfaced in the trajectory. */\n    reason: string;\n    /** Policy that produced this decision (drives observability). */\n    policy: AutoModePolicy;\n    /** Risk level from the contract, if any. Undefined for unknown tools. */\n    riskLevel?: RiskLevel;\n}\n\n/* ──────────────────────────  Policy loader  ────────────────────────── */\n\n/**\n * Resolve the current auto-mode policy. Reads\n * `config.security.autoMode.policy` if present; defaults to 'standard'.\n * Pure synchronous lookup — no IO, safe to call per-tool-call.\n */\nexport function getAutoModePolicy(): AutoModePolicy {\n    // beta.21 — env override. Lets the test suite (and any embedder\n    // that wants a process-wide policy without touching config files)\n    // short-circuit the classifier without mutating loaded config.\n    // Production callers should configure via `config.security.autoMode.policy`\n    // — this env hook is opt-in and silent when unset.\n    const envPolicy = process.env.TITAN_AUTOMODE_POLICY;\n    if (envPolicy === 'paranoid' || envPolicy === 'permissive' || envPolicy === 'yolo' || envPolicy === 'standard') {\n        return envPolicy;\n    }\n    try {\n        const cfg = loadConfig();\n        const sec = (cfg as Record<string, unknown>).security as Record<string, unknown> | undefined;\n        const am = sec?.autoMode as Record<string, unknown> | undefined;\n        const policy = am?.policy as string | undefined;\n        if (policy === 'paranoid' || policy === 'permissive' || policy === 'yolo' || policy === 'standard') {\n            return policy;\n        }\n    } catch { /* config unavailable — fall through */ }\n    return 'standard';\n}\n\n/**\n * Inherently high-impact operations that stay gated even without a declared\n * contract — arbitrary command execution, destructive deletes, deploys, and\n * irreversible external sends/payments. Everything else uncontracted runs with\n * a notify (see classifyToolCall). Curated conservatively; a tool that should\n * gate but is missing here can still be added to the user approval list.\n */\nconst NAME_GATED_EXACT = new Set<string>([\n    'shell', 'run_shell', 'bash', 'run_command', 'execute_command', 'exec',\n    'delete_file', 'bulk_delete_labels', 'phone_call', 'make_call',\n]);\nconst NAME_GATED_PATTERN = /(^|_)(delete|destroy|wipe|purge|deploy|publish|transfer|payment|purchase|wire|send_email|email_send)(_|$)/i;\n\nexport function nameLooksHighImpact(toolName: string): boolean {\n    return NAME_GATED_EXACT.has(toolName) || NAME_GATED_PATTERN.test(toolName);\n}\n\n/* ──────────────────────────  Classifier  ────────────────────────── */\n\n/**\n * Decide whether a tool call should run automatically, with a\n * notification, or with explicit approval. The runner uses this to\n * decide whether to short-circuit the existing approval-gate path.\n *\n * Pure: no IO beyond reading the config + contract registry. Cheap\n * enough to call on every tool call without measuring.\n */\nexport function classifyToolCall(toolName: string): ClassificationResult {\n    const policy = getAutoModePolicy();\n    const contract = getToolContract(toolName);\n    const riskLevel = contract?.riskLevel;\n\n    // yolo short-circuit: regardless of risk, run. ONLY for sandboxed\n    // eval runs — logs a loud warning the first time per process.\n    if (policy === 'yolo') {\n        warnYoloOnce();\n        return {\n            decision: 'auto',\n            reason: 'yolo policy — gating disabled',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // paranoid short-circuit: every call gated.\n    if (policy === 'paranoid') {\n        return {\n            decision: 'gate',\n            reason: 'paranoid policy — every tool call requires approval',\n            policy,\n            riskLevel,\n        };\n    }\n\n    // Unknown tool (no registered contract). The long-tail of ~239 skills has\n    // no contract, so gating ALL of them walled benign actions (search, read,\n    // widget-building, …) behind approval on every call — which broke the\n    // \"ask TITAN to build a weather widget\" flow and made the agent feel broken.\n    //\n    // v7.0 fix: uncontracted tools run with a 'notify' (visible, logged) by\n    // default, EXCEPT a curated set of inherently high-impact operations that\n    // stay gated by name. Dangerous shell commands + URLs are independently\n    // caught by preExecScan (toolRunner), and external-send tools (email/slack/\n    // x/publisher) self-gate via the approval_gates skill — so 'notify' here is\n    // safe for the benign majority. Strict users can still set policy='paranoid'.\n    if (!contract) {\n        if (nameLooksHighImpact(toolName)) {\n            return {\n                decision: 'gate',\n                reason: `no contract + high-impact name \"${toolName}\" — gating`,\n                policy,\n            };\n        }\n        return {\n            decision: 'notify',\n            reason: `no contract for \"${toolName}\" — notify (benign long-tail)`,\n            policy,\n        };\n    }\n\n    // Standard + permissive paths read riskLevel.\n    if (riskLevel === 'safe') {\n        return { decision: 'auto', reason: 'contract riskLevel=safe', policy, riskLevel };\n    }\n    if (riskLevel === 'moderate') {\n        if (policy === 'permissive') {\n            return { decision: 'auto', reason: 'permissive policy — moderate risk auto-runs', policy, riskLevel };\n        }\n        return { decision: 'notify', reason: 'contract riskLevel=moderate', policy, riskLevel };\n    }\n    if (riskLevel === 'high') {\n        return { decision: 'gate', reason: 'contract riskLevel=high', policy, riskLevel };\n    }\n\n    // Defensive fallback for an unknown future riskLevel value.\n    return {\n        decision: 'gate',\n        reason: `unrecognised riskLevel \"${riskLevel}\" — gating defensively`,\n        policy,\n        riskLevel,\n    };\n}\n\n/* ──────────────────────────  Helpers  ────────────────────────── */\n\nlet _yoloWarned = false;\nfunction warnYoloOnce(): void {\n    if (_yoloWarned) return;\n    _yoloWarned = true;\n    logger.warn(\n        COMPONENT,\n        'AUTO_MODE=yolo — every tool call will run without approval. This mode is ONLY intended for sandboxed eval runs. If you see this in production logs, something is misconfigured.',\n    );\n}\n\n/** For tests. */\nexport function _resetYoloWarning(): void {\n    _yoloWarned = false;\n}\n\n/**\n * Convenience: returns true iff the decision means the call should\n * NOT proceed without explicit human approval. Used by the runner\n * to short-circuit the existing approval-gate path on 'auto' /\n * 'notify' decisions.\n */\nexport function shouldGate(result: ClassificationResult): boolean {\n    return result.decision === 'gate';\n}\n\n/**\n * Format the classification as a one-line breadcrumb suitable for\n * the trajectory `note` event. Used by the runner on 'notify'\n * decisions so the trajectory captures what the agent did\n * autonomously vs what required a human prompt.\n */\nexport function formatBreadcrumb(toolName: string, result: ClassificationResult): string {\n    return `automode:${result.decision} tool=${toolName} risk=${result.riskLevel ?? 'unknown'} policy=${result.policy} (${result.reason})`;\n}\n"],"mappings":";AAgFA,SAAS,uBAAuC;AAChD,SAAS,kBAAkB;AAC3B,OAAO,YAAY;AAEnB,MAAM,YAAY;AAyBX,SAAS,oBAAoC;AAMhD,QAAM,YAAY,QAAQ,IAAI;AAC9B,MAAI,cAAc,cAAc,cAAc,gBAAgB,cAAc,UAAU,cAAc,YAAY;AAC5G,WAAO;AAAA,EACX;AACA,MAAI;AACA,UAAM,MAAM,WAAW;AACvB,UAAM,MAAO,IAAgC;AAC7C,UAAM,KAAK,KAAK;AAChB,UAAM,SAAS,IAAI;AACnB,QAAI,WAAW,cAAc,WAAW,gBAAgB,WAAW,UAAU,WAAW,YAAY;AAChG,aAAO;AAAA,IACX;AAAA,EACJ,QAAQ;AAAA,EAA0C;AAClD,SAAO;AACX;AASA,MAAM,mBAAmB,oBAAI,IAAY;AAAA,EACrC;AAAA,EAAS;AAAA,EAAa;AAAA,EAAQ;AAAA,EAAe;AAAA,EAAmB;AAAA,EAChE;AAAA,EAAe;AAAA,EAAsB;AAAA,EAAc;AACvD,CAAC;AACD,MAAM,qBAAqB;AAEpB,SAAS,oBAAoB,UAA2B;AAC3D,SAAO,iBAAiB,IAAI,QAAQ,KAAK,mBAAmB,KAAK,QAAQ;AAC7E;AAYO,SAAS,iBAAiB,UAAwC;AACrE,QAAM,SAAS,kBAAkB;AACjC,QAAM,WAAW,gBAAgB,QAAQ;AACzC,QAAM,YAAY,UAAU;AAI5B,MAAI,WAAW,QAAQ;AACnB,iBAAa;AACb,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,WAAW,YAAY;AACvB,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACJ;AAAA,EACJ;AAaA,MAAI,CAAC,UAAU;AACX,QAAI,oBAAoB,QAAQ,GAAG;AAC/B,aAAO;AAAA,QACH,UAAU;AAAA,QACV,QAAQ,mCAAmC,QAAQ;AAAA,QACnD;AAAA,MACJ;AAAA,IACJ;AACA,WAAO;AAAA,MACH,UAAU;AAAA,MACV,QAAQ,oBAAoB,QAAQ;AAAA,MACpC;AAAA,IACJ;AAAA,EACJ;AAGA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AACA,MAAI,cAAc,YAAY;AAC1B,QAAI,WAAW,cAAc;AACzB,aAAO,EAAE,UAAU,QAAQ,QAAQ,oDAA+C,QAAQ,UAAU;AAAA,IACxG;AACA,WAAO,EAAE,UAAU,UAAU,QAAQ,+BAA+B,QAAQ,UAAU;AAAA,EAC1F;AACA,MAAI,cAAc,QAAQ;AACtB,WAAO,EAAE,UAAU,QAAQ,QAAQ,2BAA2B,QAAQ,UAAU;AAAA,EACpF;AAGA,SAAO;AAAA,IACH,UAAU;AAAA,IACV,QAAQ,2BAA2B,SAAS;AAAA,IAC5C;AAAA,IACA;AAAA,EACJ;AACJ;AAIA,IAAI,cAAc;AAClB,SAAS,eAAqB;AAC1B,MAAI,YAAa;AACjB,gBAAc;AACd,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;AAGO,SAAS,oBAA0B;AACtC,gBAAc;AAClB;AAQO,SAAS,WAAW,QAAuC;AAC9D,SAAO,OAAO,aAAa;AAC/B;AAQO,SAAS,iBAAiB,UAAkB,QAAsC;AACrF,SAAO,YAAY,OAAO,QAAQ,SAAS,QAAQ,SAAS,OAAO,aAAa,SAAS,WAAW,OAAO,MAAM,KAAK,OAAO,MAAM;AACvI;","names":[]}

package/dist/agent/goalDriver.js

@@ -817,6 +817,7 @@ ${spawn.artifacts.map((a) => `  - [${a.type}] ${a.ref}${a.description ? ` \u2014
     state.phase = "iterating";
   }
 }
+const __internal_tickVerifying = tickVerifying;
 async function tickReporting(goal, state) {
   const durationMs = Date.now() - new Date(state.startedAt).getTime();
   const specialistsUsed = [...new Set(
@@ -1366,6 +1367,7 @@ function _resetDriverStateForTests(goalId) {
 }
 export {
   SAME_BLOCK_TWICE_WINDOW_MS,
+  __internal_tickVerifying,
   _resetDriverStateForTests,
   cancelDriver,
   composeApprovalGuidance,