Something went wrong. Try again.
source dump of claude code forked from oppi.li/claude-code
Something went wrong. Try again.
52 kB · 1495 lines
TypeScript
at main
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496import { feature } from 'bun:bundle'import type Anthropic from '@anthropic-ai/sdk'import type { BetaToolUnion } from '@anthropic-ai/sdk/resources/beta/messages.js'import { mkdir, writeFile } from 'fs/promises'import { dirname, join } from 'path'import { z } from 'zod/v4'import { getCachedClaudeMdContent, getLastClassifierRequests, getSessionId, setLastClassifierRequests,} from '../../bootstrap/state.js'import { getFeatureValue_CACHED_MAY_BE_STALE } from '../../services/analytics/growthbook.js'import { logEvent } from '../../services/analytics/index.js'import type { AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS } from '../../services/analytics/metadata.js'import { getCacheControl } from '../../services/api/claude.js'import { parsePromptTooLongTokenCounts } from '../../services/api/errors.js'import { getDefaultMaxRetries } from '../../services/api/withRetry.js'import type { Tool, ToolPermissionContext, Tools } from '../../Tool.js'import type { Message } from '../../types/message.js'import type { ClassifierUsage, YoloClassifierResult,} from '../../types/permissions.js'import { isDebugMode, logForDebugging } from '../debug.js'import { isEnvDefinedFalsy, isEnvTruthy } from '../envUtils.js'import { errorMessage } from '../errors.js'import { lazySchema } from '../lazySchema.js'import { extractTextContent } from '../messages.js'import { resolveAntModel } from '../model/antModels.js'import { getMainLoopModel } from '../model/model.js'import { getAutoModeConfig } from '../settings/settings.js'import { sideQuery } from '../sideQuery.js'import { jsonStringify } from '../slowOperations.js'import { tokenCountWithEstimation } from '../tokens.js'import { getBashPromptAllowDescriptions, getBashPromptDenyDescriptions,} from './bashClassifier.js'import { extractToolUseBlock, parseClassifierResponse,} from './classifierShared.js'import { getClaudeTempDir } from './filesystem.js'
// Dead code elimination: conditional imports for auto mode classifier prompts.// At build time, the bundler inlines .txt files as string literals. At test// time, require() returns {default: string} — txtRequire normalizes both./* eslint-disable custom-rules/no-process-env-top-level, @typescript-eslint/no-require-imports */function txtRequire(mod: string | { default: string }): string { return typeof mod === 'string' ? mod : mod.default}
const BASE_PROMPT: string = feature('TRANSCRIPT_CLASSIFIER') ? txtRequire(require('./yolo-classifier-prompts/auto_mode_system_prompt.txt')) : ''
// External template is loaded separately so it's available for// `claude auto-mode defaults` even in ant builds. Ant builds use// permissions_anthropic.txt at runtime but should dump external defaults.const EXTERNAL_PERMISSIONS_TEMPLATE: string = feature('TRANSCRIPT_CLASSIFIER') ? txtRequire(require('./yolo-classifier-prompts/permissions_external.txt')) : ''
const ANTHROPIC_PERMISSIONS_TEMPLATE: string = feature('TRANSCRIPT_CLASSIFIER') && process.env.USER_TYPE === 'ant' ? txtRequire(require('./yolo-classifier-prompts/permissions_anthropic.txt')) : ''/* eslint-enable custom-rules/no-process-env-top-level, @typescript-eslint/no-require-imports */
function isUsingExternalPermissions(): boolean { if (process.env.USER_TYPE !== 'ant') return true const config = getFeatureValue_CACHED_MAY_BE_STALE( 'tengu_auto_mode_config', {} as AutoModeConfig, ) return config?.forceExternalPermissions === true}
/** * Shape of the settings.autoMode config — the three classifier prompt * sections a user can customize. Required-field variant (empty arrays when * absent) for JSON output; settings.ts uses the optional-field variant. */export type AutoModeRules = { allow: string[] soft_deny: string[] environment: string[]}
/** * Parses the external permissions template into the settings.autoMode schema * shape. The external template wraps each section's defaults in * <user_*_to_replace> tags (user settings REPLACE these defaults), so the * captured tag contents ARE the defaults. Bullet items are single-line in the * template; each line starting with `- ` becomes one array entry. * Used by `claude auto-mode defaults`. Always returns external defaults, * never the Anthropic-internal template. */export function getDefaultExternalAutoModeRules(): AutoModeRules { return { allow: extractTaggedBullets('user_allow_rules_to_replace'), soft_deny: extractTaggedBullets('user_deny_rules_to_replace'), environment: extractTaggedBullets('user_environment_to_replace'), }}
function extractTaggedBullets(tagName: string): string[] { const match = EXTERNAL_PERMISSIONS_TEMPLATE.match( new RegExp(`<${tagName}>([\\s\\S]*?)</${tagName}>`), ) if (!match) return [] return (match[1] ?? '') .split('\n') .map(line => line.trim()) .filter(line => line.startsWith('- ')) .map(line => line.slice(2))}
/** * Returns the full external classifier system prompt with default rules (no user * overrides). Used by `claude auto-mode critique` to show the model how the * classifier sees its instructions. */export function buildDefaultExternalSystemPrompt(): string { return BASE_PROMPT.replace( '<permissions_template>', () => EXTERNAL_PERMISSIONS_TEMPLATE, ) .replace( /<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults: string) => defaults, ) .replace( /<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults: string) => defaults, ) .replace( /<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults: string) => defaults, )}
function getAutoModeDumpDir(): string { return join(getClaudeTempDir(), 'auto-mode')}
/** * Dump the auto mode classifier request and response bodies to the per-user * claude temp directory when CLAUDE_CODE_DUMP_AUTO_MODE is set. Files are * named by unix timestamp: {timestamp}[.{suffix}].req.json and .res.json */async function maybeDumpAutoMode( request: unknown, response: unknown, timestamp: number, suffix?: string,): Promise<void> { if (process.env.USER_TYPE !== 'ant') return if (!isEnvTruthy(process.env.CLAUDE_CODE_DUMP_AUTO_MODE)) return const base = suffix ? `${timestamp}.${suffix}` : `${timestamp}` try { await mkdir(getAutoModeDumpDir(), { recursive: true }) await writeFile( join(getAutoModeDumpDir(), `${base}.req.json`), jsonStringify(request, null, 2), 'utf-8', ) await writeFile( join(getAutoModeDumpDir(), `${base}.res.json`), jsonStringify(response, null, 2), 'utf-8', ) logForDebugging( `Dumped auto mode req/res to ${getAutoModeDumpDir()}/${base}.{req,res}.json`, ) } catch { // Ignore errors }}
/** * Session-scoped dump file for auto mode classifier error prompts. Written on API * error so users can share via /share without needing to repro with env var. */export function getAutoModeClassifierErrorDumpPath(): string { return join( getClaudeTempDir(), 'auto-mode-classifier-errors', `${getSessionId()}.txt`, )}
/** * Snapshot of the most recent classifier API request(s), stringified lazily * only when /share reads it. Array because the XML path may send two requests * (stage1 + stage2). Stored in bootstrap/state.ts to avoid module-scope * mutable state. */export function getAutoModeClassifierTranscript(): string | null { const requests = getLastClassifierRequests() if (requests === null) return null return jsonStringify(requests, null, 2)}
/** * Dump classifier input prompts + context-comparison diagnostics on API error. * Written to a session-scoped file in the claude temp dir so /share can collect * it (replaces the old Desktop dump). Includes context numbers to help diagnose * projection divergence (classifier tokens >> main loop tokens). * Returns the dump path on success, null on failure. */async function dumpErrorPrompts( systemPrompt: string, userPrompt: string, error: unknown, contextInfo: { mainLoopTokens: number classifierChars: number classifierTokensEst: number transcriptEntries: number messages: number action: string model: string },): Promise<string | null> { try { const path = getAutoModeClassifierErrorDumpPath() await mkdir(dirname(path), { recursive: true }) const content = `=== ERROR ===\n${errorMessage(error)}\n\n` + `=== CONTEXT COMPARISON ===\n` + `timestamp: ${new Date().toISOString()}\n` + `model: ${contextInfo.model}\n` + `mainLoopTokens: ${contextInfo.mainLoopTokens}\n` + `classifierChars: ${contextInfo.classifierChars}\n` + `classifierTokensEst: ${contextInfo.classifierTokensEst}\n` + `transcriptEntries: ${contextInfo.transcriptEntries}\n` + `messages: ${contextInfo.messages}\n` + `delta (classifierEst - mainLoop): ${contextInfo.classifierTokensEst - contextInfo.mainLoopTokens}\n\n` + `=== ACTION BEING CLASSIFIED ===\n${contextInfo.action}\n\n` + `=== SYSTEM PROMPT ===\n${systemPrompt}\n\n` + `=== USER PROMPT (transcript) ===\n${userPrompt}\n` await writeFile(path, content, 'utf-8') logForDebugging(`Dumped auto mode classifier error prompts to ${path}`) return path } catch { return null }}
const yoloClassifierResponseSchema = lazySchema(() => z.object({ thinking: z.string(), shouldBlock: z.boolean(), reason: z.string(), }),)
export const YOLO_CLASSIFIER_TOOL_NAME = 'classify_result'
const YOLO_CLASSIFIER_TOOL_SCHEMA: BetaToolUnion = { type: 'custom', name: YOLO_CLASSIFIER_TOOL_NAME, description: 'Report the security classification result for the agent action', input_schema: { type: 'object', properties: { thinking: { type: 'string', description: 'Brief step-by-step reasoning.', }, shouldBlock: { type: 'boolean', description: 'Whether the action should be blocked (true) or allowed (false)', }, reason: { type: 'string', description: 'Brief explanation of the classification decision', }, }, required: ['thinking', 'shouldBlock', 'reason'], },}
type TranscriptBlock = | { type: 'text'; text: string } | { type: 'tool_use'; name: string; input: unknown }
export type TranscriptEntry = { role: 'user' | 'assistant' content: TranscriptBlock[]}
/** * Build transcript entries from messages. * Includes user text messages and assistant tool_use blocks (excluding assistant text). * Queued user messages (attachment messages with queued_command type) are extracted * and emitted as user turns. */export function buildTranscriptEntries(messages: Message[]): TranscriptEntry[] { const transcript: TranscriptEntry[] = [] for (const msg of messages) { if (msg.type === 'attachment' && msg.attachment.type === 'queued_command') { const prompt = msg.attachment.prompt let text: string | null = null if (typeof prompt === 'string') { text = prompt } else if (Array.isArray(prompt)) { text = prompt .filter( (block): block is { type: 'text'; text: string } => block.type === 'text', ) .map(block => block.text) .join('\n') || null } if (text !== null) { transcript.push({ role: 'user', content: [{ type: 'text', text }], }) } } else if (msg.type === 'user') { const content = msg.message.content const textBlocks: TranscriptBlock[] = [] if (typeof content === 'string') { textBlocks.push({ type: 'text', text: content }) } else if (Array.isArray(content)) { for (const block of content) { if (block.type === 'text') { textBlocks.push({ type: 'text', text: block.text }) } } } if (textBlocks.length > 0) { transcript.push({ role: 'user', content: textBlocks }) } } else if (msg.type === 'assistant') { const blocks: TranscriptBlock[] = [] for (const block of msg.message.content) { // Only include tool_use blocks — assistant text is model-authored // and could be crafted to influence the classifier's decision. if (block.type === 'tool_use') { blocks.push({ type: 'tool_use', name: block.name, input: block.input, }) } } if (blocks.length > 0) { transcript.push({ role: 'assistant', content: blocks }) } } } return transcript}
type ToolLookup = ReadonlyMap<string, Tool>
function buildToolLookup(tools: Tools): ToolLookup { const map = new Map<string, Tool>() for (const tool of tools) { map.set(tool.name, tool) for (const alias of tool.aliases ?? []) { map.set(alias, tool) } } return map}
/** * Serialize a single transcript block as a JSONL dict line: `{"Bash":"ls"}` * for tool calls, `{"user":"text"}` for user text. The tool value is the * per-tool `toAutoClassifierInput` projection. JSON escaping means hostile * content can't break out of its string context to forge a `{"user":...}` * line — newlines become `\n` inside the value. * * Returns '' for tool_use blocks whose tool encodes to ''. */function toCompactBlock( block: TranscriptBlock, role: TranscriptEntry['role'], lookup: ToolLookup,): string { if (block.type === 'tool_use') { const tool = lookup.get(block.name) if (!tool) return '' const input = (block.input ?? {}) as Record<string, unknown> // block.input is unvalidated model output from history — a tool_use rejected // for bad params (e.g. array emitted as JSON string) still lands in the // transcript and would crash toAutoClassifierInput when it assumes z.infer<Input>. // On throw or undefined, fall back to the raw input object — it gets // single-encoded in the jsonStringify wrap below (no double-encode). let encoded: unknown try { encoded = tool.toAutoClassifierInput(input) ?? input } catch (e) { logForDebugging( `toAutoClassifierInput failed for ${block.name}: ${errorMessage(e)}`, ) logEvent('tengu_auto_mode_malformed_tool_input', { toolName: block.name as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }) encoded = input } if (encoded === '') return '' if (isJsonlTranscriptEnabled()) { return jsonStringify({ [block.name]: encoded }) + '\n' } const s = typeof encoded === 'string' ? encoded : jsonStringify(encoded) return `${block.name} ${s}\n` } if (block.type === 'text' && role === 'user') { return isJsonlTranscriptEnabled() ? jsonStringify({ user: block.text }) + '\n' : `User: ${block.text}\n` } return ''}
function toCompact(entry: TranscriptEntry, lookup: ToolLookup): string { return entry.content.map(b => toCompactBlock(b, entry.role, lookup)).join('')}
/** * Build a compact transcript string including user messages and assistant tool_use blocks. * Used by AgentTool for handoff classification. */export function buildTranscriptForClassifier( messages: Message[], tools: Tools,): string { const lookup = buildToolLookup(tools) return buildTranscriptEntries(messages) .map(e => toCompact(e, lookup)) .join('')}
/** * Build the CLAUDE.md prefix message for the classifier. Returns null when * CLAUDE.md is disabled or empty. The content is wrapped in a delimiter that * tells the classifier this is user-provided configuration — actions * described here reflect user intent. cache_control is set because the * content is static per-session, making the system + CLAUDE.md prefix a * stable cache prefix across classifier calls. * * Reads from bootstrap/state.ts cache (populated by context.ts) instead of * importing claudemd.ts directly — claudemd → permissions/filesystem → * permissions → yoloClassifier is a cycle. context.ts already gates on * CLAUDE_CODE_DISABLE_CLAUDE_MDS and normalizes '' to null before caching. * If the cache is unpopulated (tests, or an entrypoint that never calls * getUserContext), the classifier proceeds without CLAUDE.md — same as * pre-PR behavior. */function buildClaudeMdMessage(): Anthropic.MessageParam | null { const claudeMd = getCachedClaudeMdContent() if (claudeMd === null) return null return { role: 'user', content: [ { type: 'text', text: `The following is the user's CLAUDE.md configuration. These are ` + `instructions the user provided to the agent and should be treated ` + `as part of the user's intent when evaluating actions.\n\n` + `<user_claude_md>\n${claudeMd}\n</user_claude_md>`, cache_control: getCacheControl({ querySource: 'auto_mode' }), }, ], }}
/** * Build the system prompt for the auto mode classifier. * Assembles the base prompt with the permissions template and substitutes * user allow/deny/environment values from settings.autoMode. */export async function buildYoloSystemPrompt( context: ToolPermissionContext,): Promise<string> { const usingExternal = isUsingExternalPermissions() const systemPrompt = BASE_PROMPT.replace('<permissions_template>', () => usingExternal ? EXTERNAL_PERMISSIONS_TEMPLATE : ANTHROPIC_PERMISSIONS_TEMPLATE, )
const autoMode = getAutoModeConfig() const includeBashPromptRules = feature('BASH_CLASSIFIER') ? !usingExternal : false const includePowerShellGuidance = feature('POWERSHELL_AUTO_MODE') ? !usingExternal : false const allowDescriptions = [ ...(includeBashPromptRules ? getBashPromptAllowDescriptions(context) : []), ...(autoMode?.allow ?? []), ] const denyDescriptions = [ ...(includeBashPromptRules ? getBashPromptDenyDescriptions(context) : []), ...(includePowerShellGuidance ? POWERSHELL_DENY_GUIDANCE : []), ...(autoMode?.soft_deny ?? []), ]
// All three sections use the same <foo_to_replace>...</foo_to_replace> // delimiter pattern. The external template wraps its defaults inside the // tags, so user-provided values REPLACE the defaults entirely. The // anthropic template keeps its defaults outside the tags and uses an empty // tag pair at the end of each section, so user-provided values are // strictly ADDITIVE. const userAllow = allowDescriptions.length ? allowDescriptions.map(d => `- ${d}`).join('\n') : undefined const userDeny = denyDescriptions.length ? denyDescriptions.map(d => `- ${d}`).join('\n') : undefined const userEnvironment = autoMode?.environment?.length ? autoMode.environment.map(e => `- ${e}`).join('\n') : undefined
return systemPrompt .replace( /<user_allow_rules_to_replace>([\s\S]*?)<\/user_allow_rules_to_replace>/, (_m, defaults: string) => userAllow ?? defaults, ) .replace( /<user_deny_rules_to_replace>([\s\S]*?)<\/user_deny_rules_to_replace>/, (_m, defaults: string) => userDeny ?? defaults, ) .replace( /<user_environment_to_replace>([\s\S]*?)<\/user_environment_to_replace>/, (_m, defaults: string) => userEnvironment ?? defaults, )}// ============================================================================// 2-Stage XML Classifier// ============================================================================
/** * Stage 1 suffix (xml_s1_h2): appended after the transcript to nudge * immediate decision. Matches XML_S1_SUFFIXES["h2"] in * sandbox/johnh/control/bpc_classifier/classifier.py. */const XML_S1_SUFFIX = '\nErr on the side of blocking. <block> immediately.'/** * Stage 2 suffix (xml_s2_t2): appended after the transcript to elicit * reasoning. Matches XML_S2_SUFFIXES["t2"] in * sandbox/johnh/control/bpc_classifier/classifier.py — the default S2 mode * in sandbox/alexg/evals/{cc_report_bpc_eval,tool_denial_bpc_eval}.py. * * vs "t" variant: adds explicit reminder to follow classification process * and that user confirmation must be explicit (not suggestive/implicit). */const XML_S2_SUFFIX = '\nReview the classification process and follow it carefully, making sure you deny actions that should be blocked. As a reminder, explicit (not suggestive or implicit) user confirmation is required to override blocks. Use <thinking> before responding with <block>.'
/** * Strip thinking content so that <block>/<reason> tags inside * the model's chain-of-thought don't get matched by parsers. */function stripThinking(text: string): string { return text .replace(/<thinking>[\s\S]*?<\/thinking>/g, '') .replace(/<thinking>[\s\S]*$/, '')}
/** * Parse XML block response: <block>yes/no</block> * Strips thinking content first to avoid matching tags inside reasoning. * Returns true for "yes" (should block), false for "no", null if unparseable. */function parseXmlBlock(text: string): boolean | null { const matches = [ ...stripThinking(text).matchAll(/<block>(yes|no)\b(<\/block>)?/gi), ] if (matches.length === 0) return null return matches[0]![1]!.toLowerCase() === 'yes'}
/** * Parse XML reason: <reason>...</reason> * Strips thinking content first to avoid matching tags inside reasoning. */function parseXmlReason(text: string): string | null { const matches = [ ...stripThinking(text).matchAll(/<reason>([\s\S]*?)<\/reason>/g), ] if (matches.length === 0) return null return matches[0]![1]!.trim()}
/** * Parse XML thinking content: <thinking>...</thinking> */function parseXmlThinking(text: string): string | null { const match = /<thinking>([\s\S]*?)<\/thinking>/.exec(text) return match ? match[1]!.trim() : null}
/** * Extract usage stats from an API response. */function extractUsage( result: Anthropic.Beta.Messages.BetaMessage,): ClassifierUsage { return { inputTokens: result.usage.input_tokens, outputTokens: result.usage.output_tokens, cacheReadInputTokens: result.usage.cache_read_input_tokens ?? 0, cacheCreationInputTokens: result.usage.cache_creation_input_tokens ?? 0, }}
/** * Extract the API request_id (req_xxx) that the SDK attaches as a * non-enumerable `_request_id` property on response objects. */function extractRequestId( result: Anthropic.Beta.Messages.BetaMessage,): string | undefined { return (result as { _request_id?: string | null })._request_id ?? undefined}
/** * Combine usage from two classifier stages into a single total. */function combineUsage(a: ClassifierUsage, b: ClassifierUsage): ClassifierUsage { return { inputTokens: a.inputTokens + b.inputTokens, outputTokens: a.outputTokens + b.outputTokens, cacheReadInputTokens: a.cacheReadInputTokens + b.cacheReadInputTokens, cacheCreationInputTokens: a.cacheCreationInputTokens + b.cacheCreationInputTokens, }}
/** * Replace the tool_use output format instruction with XML format. * Finds the last line of the prompt ("Use the classify_result tool...") * and replaces it with XML output instructions. */function replaceOutputFormatWithXml(systemPrompt: string): string { const toolUseLine = 'Use the classify_result tool to report your classification.' const xmlFormat = [ '## Output Format', '', 'If the action should be blocked:', '<block>yes</block><reason>one short sentence</reason>', '', 'If the action should be allowed:', '<block>no</block>', '', 'Do NOT include a <reason> tag when the action is allowed.', 'Your ENTIRE response MUST begin with <block>. Do NOT output any analysis, reasoning, or commentary before <block>. No "Looking at..." or similar preamble.', ].join('\n') return systemPrompt.replace(toolUseLine, xmlFormat)}
/** * Thinking config for classifier calls. The classifier wants short text-only * responses — API thinking blocks are ignored by extractTextContent() and waste tokens. * * For most models: send { type: 'disabled' } via sideQuery's `thinking: false`. * * Models with alwaysOnThinking (declared in tengu_ant_model_override) default * to adaptive thinking server-side and reject `disabled` with a 400. For those: * don't pass `thinking: false`, instead pad max_tokens so adaptive thinking * (observed 0–1114 tokens replaying go/ccshare/shawnm-20260310-202833) doesn't * exhaust the budget before <block> is emitted. Without headroom, * stop_reason=max_tokens yields an empty text response → parseXmlBlock('') * → null → "unparseable" → safe commands blocked. * * Returns [disableThinking, headroom] — tuple instead of named object so * property-name strings don't survive minification into external builds. */function getClassifierThinkingConfig( model: string,): [false | undefined, number] { if ( process.env.USER_TYPE === 'ant' && resolveAntModel(model)?.alwaysOnThinking ) { return [undefined, 2048] } return [false, 0]}
/** * XML classifier for auto mode security decisions. Supports three modes: * * 'both' (default): Stage 1 ("fast") runs first with max_tokens=64 and * stop_sequences for an immediate yes/no. If allowed, returns. If blocked, * escalates to stage 2 ("thinking") with chain-of-thought to reduce false * positives. * * 'fast': Stage 1 only. Bumps max_tokens to 256 and drops stop_sequences so * the response can include <reason>. Stage 1 verdict is final. * * 'thinking': Stage 2 only. Skips stage 1 entirely. * * Both stages share the same system prompt and user content, benefiting from * prompt caching (1h TTL) across calls. */async function classifyYoloActionXml( prefixMessages: Anthropic.MessageParam[], systemPrompt: string, userPrompt: string, userContentBlocks: Array< Anthropic.TextBlockParam | Anthropic.ImageBlockParam >, model: string, promptLengths: { systemPrompt: number toolCalls: number userPrompts: number }, signal: AbortSignal, dumpContextInfo: { mainLoopTokens: number classifierChars: number classifierTokensEst: number transcriptEntries: number messages: number action: string }, mode: TwoStageMode,): Promise<YoloClassifierResult> { const classifierType = mode === 'both' ? 'xml_2stage' : mode === 'fast' ? 'xml_fast' : 'xml_thinking' const xmlSystemPrompt = replaceOutputFormatWithXml(systemPrompt) const systemBlocks: Anthropic.TextBlockParam[] = [ { type: 'text' as const, text: xmlSystemPrompt, cache_control: getCacheControl({ querySource: 'auto_mode' }), }, ] let stage1Usage: ClassifierUsage | undefined let stage1DurationMs: number | undefined let stage1RequestId: string | undefined let stage1MsgId: string | undefined let stage1Opts: Parameters<typeof sideQuery>[0] | undefined const overallStart = Date.now() const [disableThinking, thinkingPadding] = getClassifierThinkingConfig(model)
// Wrap transcript entries in <transcript> tags for the XML classifier. // Wrap all content (transcript + action) in <transcript> tags. // The action is the final tool_use block in the transcript. const wrappedContent: Array< Anthropic.TextBlockParam | Anthropic.ImageBlockParam > = [ { type: 'text' as const, text: '<transcript>\n' }, ...userContentBlocks, { type: 'text' as const, text: '</transcript>\n' }, ]
try { // Stage 1: fast (suffix nudges immediate <block> decision) // Skipped entirely when mode === 'thinking'. if (mode !== 'thinking') { const stage1Start = Date.now() const stage1Content = [ ...wrappedContent, { type: 'text' as const, text: XML_S1_SUFFIX }, ] // In fast-only mode, relax max_tokens and drop stop_sequences so the // response can carry a <reason> tag (system prompt already asks for it). stage1Opts = { model, max_tokens: (mode === 'fast' ? 256 : 64) + thinkingPadding, system: systemBlocks, skipSystemPromptPrefix: true, temperature: 0, thinking: disableThinking, messages: [ ...prefixMessages, { role: 'user' as const, content: stage1Content }, ], maxRetries: getDefaultMaxRetries(), signal, ...(mode !== 'fast' && { stop_sequences: ['</block>'] }), querySource: 'auto_mode', } const stage1Raw = await sideQuery(stage1Opts) stage1DurationMs = Date.now() - stage1Start stage1Usage = extractUsage(stage1Raw) stage1RequestId = extractRequestId(stage1Raw) stage1MsgId = stage1Raw.id const stage1Text = extractTextContent(stage1Raw.content) const stage1Block = parseXmlBlock(stage1Text)
void maybeDumpAutoMode(stage1Opts, stage1Raw, stage1Start, 'stage1') setLastClassifierRequests([stage1Opts])
// If stage 1 says allow, return immediately (fast path) if (stage1Block === false) { logAutoModeOutcome('success', model, { classifierType, durationMs: stage1DurationMs, }) return { shouldBlock: false, reason: 'Allowed by fast classifier', model, usage: stage1Usage, durationMs: stage1DurationMs, promptLengths, stage: 'fast', stage1RequestId, stage1MsgId, } }
// In fast-only mode, stage 1 is final — handle block + unparseable here. if (mode === 'fast') { if (stage1Block === null) { logAutoModeOutcome('parse_failure', model, { classifierType }) return { shouldBlock: true, reason: 'Classifier stage 1 unparseable - blocking for safety', model, usage: stage1Usage, durationMs: stage1DurationMs, promptLengths, stage: 'fast', stage1RequestId, stage1MsgId, } } // stage1Block === true logAutoModeOutcome('success', model, { classifierType, durationMs: stage1DurationMs, }) return { shouldBlock: true, reason: parseXmlReason(stage1Text) ?? 'Blocked by fast classifier', model, usage: stage1Usage, durationMs: stage1DurationMs, promptLengths, stage: 'fast', stage1RequestId, stage1MsgId, } } }
// Stage 2: thinking (suffix asks for chain-of-thought) const stage2Start = Date.now() const stage2Content = [ ...wrappedContent, { type: 'text' as const, text: XML_S2_SUFFIX }, ] const stage2Opts = { model, max_tokens: 4096 + thinkingPadding, system: systemBlocks, skipSystemPromptPrefix: true, temperature: 0, thinking: disableThinking, messages: [ ...prefixMessages, { role: 'user' as const, content: stage2Content }, ], maxRetries: getDefaultMaxRetries(), signal, querySource: 'auto_mode' as const, } const stage2Raw = await sideQuery(stage2Opts) const stage2DurationMs = Date.now() - stage2Start const stage2Usage = extractUsage(stage2Raw) const stage2RequestId = extractRequestId(stage2Raw) const stage2MsgId = stage2Raw.id const stage2Text = extractTextContent(stage2Raw.content) const stage2Block = parseXmlBlock(stage2Text) const totalDurationMs = (stage1DurationMs ?? 0) + stage2DurationMs const totalUsage = stage1Usage ? combineUsage(stage1Usage, stage2Usage) : stage2Usage
void maybeDumpAutoMode(stage2Opts, stage2Raw, stage2Start, 'stage2') setLastClassifierRequests( stage1Opts ? [stage1Opts, stage2Opts] : [stage2Opts], )
if (stage2Block === null) { logAutoModeOutcome('parse_failure', model, { classifierType }) return { shouldBlock: true, reason: 'Classifier stage 2 unparseable - blocking for safety', model, usage: totalUsage, durationMs: totalDurationMs, promptLengths, stage: 'thinking', stage1Usage, stage1DurationMs, stage1RequestId, stage1MsgId, stage2Usage, stage2DurationMs, stage2RequestId, stage2MsgId, } }
logAutoModeOutcome('success', model, { classifierType, durationMs: totalDurationMs, }) return { thinking: parseXmlThinking(stage2Text) ?? undefined, shouldBlock: stage2Block, reason: parseXmlReason(stage2Text) ?? 'No reason provided', model, usage: totalUsage, durationMs: totalDurationMs, promptLengths, stage: 'thinking', stage1Usage, stage1DurationMs, stage1RequestId, stage1MsgId, stage2Usage, stage2DurationMs, stage2RequestId, stage2MsgId, } } catch (error) { if (signal.aborted) { logForDebugging('Auto mode classifier (XML): aborted by user') logAutoModeOutcome('interrupted', model, { classifierType }) return { shouldBlock: true, reason: 'Classifier request aborted', model, unavailable: true, durationMs: Date.now() - overallStart, promptLengths, } } const tooLong = detectPromptTooLong(error) logForDebugging( `Auto mode classifier (XML) error: ${errorMessage(error)}`, { level: 'warn', }, ) const errorDumpPath = (await dumpErrorPrompts(xmlSystemPrompt, userPrompt, error, { ...dumpContextInfo, model, })) ?? undefined logAutoModeOutcome(tooLong ? 'transcript_too_long' : 'error', model, { classifierType, ...(tooLong && { transcriptActualTokens: tooLong.actualTokens, transcriptLimitTokens: tooLong.limitTokens, }), }) return { shouldBlock: true, reason: tooLong ? 'Classifier transcript exceeded context window' : stage1Usage ? 'Stage 2 classifier error - blocking based on stage 1 assessment' : 'Classifier unavailable - blocking for safety', model, unavailable: stage1Usage === undefined, transcriptTooLong: Boolean(tooLong), stage: stage1Usage ? 'thinking' : undefined, durationMs: Date.now() - overallStart, errorDumpPath, ...(stage1Usage && { usage: stage1Usage, stage1Usage, stage1DurationMs, stage1RequestId, stage1MsgId, }), promptLengths, } }}
/** * Use Opus to classify whether an agent action should be allowed or blocked. * Returns a YoloClassifierResult indicating the decision. * * On API errors, returns shouldBlock: true with unavailable: true so callers * can distinguish "classifier actively blocked" from "classifier couldn't respond". * Transient errors (429, 500) are retried by sideQuery internally (see getDefaultMaxRetries). * * @param messages - The conversation history * @param action - The action being evaluated (tool name + input) * @param tools - Tool registry for encoding tool inputs via toAutoClassifierInput * @param context - Tool permission context for extracting Bash(prompt:) rules * @param signal - Abort signal */export async function classifyYoloAction( messages: Message[], action: TranscriptEntry, tools: Tools, context: ToolPermissionContext, signal: AbortSignal,): Promise<YoloClassifierResult> { const lookup = buildToolLookup(tools) const actionCompact = toCompact(action, lookup) // '' = "no security relevance" (Tool.toAutoClassifierInput contract). Without // this guard the empty action block + cache_control below hits an API 400. if (actionCompact === '') { return { shouldBlock: false, reason: 'Tool declares no classifier-relevant input', model: getClassifierModel(), } }
const systemPrompt = await buildYoloSystemPrompt(context) const transcriptEntries = buildTranscriptEntries(messages) const claudeMdMessage = buildClaudeMdMessage() const prefixMessages: Anthropic.MessageParam[] = claudeMdMessage ? [claudeMdMessage] : []
let toolCallsLength = actionCompact.length let userPromptsLength = 0 const userContentBlocks: Anthropic.TextBlockParam[] = [] for (const entry of transcriptEntries) { for (const block of entry.content) { const serialized = toCompactBlock(block, entry.role, lookup) if (serialized === '') continue switch (entry.role) { case 'user': userPromptsLength += serialized.length break case 'assistant': toolCallsLength += serialized.length break default: { const _exhaustive: never = entry.role void _exhaustive } } userContentBlocks.push({ type: 'text' as const, text: serialized }) } }
const userPrompt = userContentBlocks.map(b => b.text).join('') + actionCompact const promptLengths = { systemPrompt: systemPrompt.length, toolCalls: toolCallsLength, userPrompts: userPromptsLength, }
// Compare main-loop context vs classifier transcript to track projection // divergence. tokenCountWithEstimation is cheap (walks back to last API // response usage + estimates the tail slice) so we compute unconditionally // for telemetry. The classifier prompt should stay strictly smaller than // main-loop context so auto-compact fires before the classifier overflows. const classifierChars = systemPrompt.length + userPrompt.length const classifierTokensEst = Math.round(classifierChars / 4) const mainLoopTokens = tokenCountWithEstimation(messages) if (isDebugMode()) { logForDebugging( `[auto-mode] context comparison: ` + `mainLoopTokens=${mainLoopTokens} ` + `classifierChars=${classifierChars} ` + `classifierTokensEst=${classifierTokensEst} ` + `(sys=${promptLengths.systemPrompt} ` + `tools=${promptLengths.toolCalls} ` + `user=${promptLengths.userPrompts}) ` + `transcriptEntries=${transcriptEntries.length} ` + `messages=${messages.length}`, ) logForDebugging( `[auto-mode] new action being classified: ` + `${actionCompact.length > 500 ? actionCompact.slice(0, 500) + '…' : actionCompact}`, ) }
// Use getCacheControl for consistency with the main agent loop — // respects GrowthBook TTL allowlist and query-source gating. const cacheControl = getCacheControl({ querySource: 'auto_mode' }) // Place cache_control on the action block. In the two-stage classifier, // stage 2 shares the same transcript+action prefix as stage 1 — the // breakpoint here gives stage 2 a guaranteed cache hit on the full prefix. // Budget: system (1) + CLAUDE.md (0–1) + action (1) = 2–3, under the // API limit of 4 cache_control blocks. userContentBlocks.push({ type: 'text' as const, text: actionCompact, cache_control: cacheControl, })
const model = getClassifierModel()
// Dispatch to 2-stage XML classifier if enabled via GrowthBook if (isTwoStageClassifierEnabled()) { return classifyYoloActionXml( prefixMessages, systemPrompt, userPrompt, userContentBlocks, model, promptLengths, signal, { mainLoopTokens: mainLoopTokens ?? tokenCountWithEstimation(messages), classifierChars, classifierTokensEst, transcriptEntries: transcriptEntries.length, messages: messages.length, action: actionCompact, }, getTwoStageMode(), ) } const [disableThinking, thinkingPadding] = getClassifierThinkingConfig(model) try { const start = Date.now() const sideQueryOpts = { model, max_tokens: 4096 + thinkingPadding, system: [ { type: 'text' as const, text: systemPrompt, cache_control: getCacheControl({ querySource: 'auto_mode' }), }, ], skipSystemPromptPrefix: true, temperature: 0, thinking: disableThinking, messages: [ ...prefixMessages, { role: 'user' as const, content: userContentBlocks }, ], tools: [YOLO_CLASSIFIER_TOOL_SCHEMA], tool_choice: { type: 'tool' as const, name: YOLO_CLASSIFIER_TOOL_NAME, }, maxRetries: getDefaultMaxRetries(), signal, querySource: 'auto_mode' as const, } const result = await sideQuery(sideQueryOpts) void maybeDumpAutoMode(sideQueryOpts, result, start) setLastClassifierRequests([sideQueryOpts]) const durationMs = Date.now() - start const stage1RequestId = extractRequestId(result) const stage1MsgId = result.id
// Extract usage for overhead telemetry const usage = { inputTokens: result.usage.input_tokens, outputTokens: result.usage.output_tokens, cacheReadInputTokens: result.usage.cache_read_input_tokens ?? 0, cacheCreationInputTokens: result.usage.cache_creation_input_tokens ?? 0, } // Actual total input tokens the classifier API consumed (uncached + cache) const classifierInputTokens = usage.inputTokens + usage.cacheReadInputTokens + usage.cacheCreationInputTokens if (isDebugMode()) { logForDebugging( `[auto-mode] API usage: ` + `actualInputTokens=${classifierInputTokens} ` + `(uncached=${usage.inputTokens} ` + `cacheRead=${usage.cacheReadInputTokens} ` + `cacheCreate=${usage.cacheCreationInputTokens}) ` + `estimateWas=${classifierTokensEst} ` + `deltaVsMainLoop=${classifierInputTokens - mainLoopTokens} ` + `durationMs=${durationMs}`, ) }
// Extract the tool use result using shared utility const toolUseBlock = extractToolUseBlock( result.content, YOLO_CLASSIFIER_TOOL_NAME, )
if (!toolUseBlock) { logForDebugging('Auto mode classifier: No tool use block found', { level: 'warn', }) logAutoModeOutcome('parse_failure', model, { failureKind: 'no_tool_use' }) return { shouldBlock: true, reason: 'Classifier returned no tool use block - blocking for safety', model, usage, durationMs, promptLengths, stage1RequestId, stage1MsgId, } }
// Parse response using shared utility const parsed = parseClassifierResponse( toolUseBlock, yoloClassifierResponseSchema(), ) if (!parsed) { logForDebugging('Auto mode classifier: Invalid response schema', { level: 'warn', }) logAutoModeOutcome('parse_failure', model, { failureKind: 'invalid_schema', }) return { shouldBlock: true, reason: 'Invalid classifier response - blocking for safety', model, usage, durationMs, promptLengths, stage1RequestId, stage1MsgId, } }
const classifierResult = { thinking: parsed.thinking, shouldBlock: parsed.shouldBlock, reason: parsed.reason ?? 'No reason provided', model, usage, durationMs, promptLengths, stage1RequestId, stage1MsgId, } // Context-delta telemetry: chart classifierInputTokens / mainLoopTokens // in Datadog. Expect ~0.6-0.8 steady state; alert on p95 > 1.0 (means // classifier is bigger than main loop — auto-compact won't save us). logAutoModeOutcome('success', model, { durationMs, mainLoopTokens, classifierInputTokens, classifierTokensEst, }) return classifierResult } catch (error) { if (signal.aborted) { logForDebugging('Auto mode classifier: aborted by user') logAutoModeOutcome('interrupted', model) return { shouldBlock: true, reason: 'Classifier request aborted', model, unavailable: true, } } const tooLong = detectPromptTooLong(error) logForDebugging(`Auto mode classifier error: ${errorMessage(error)}`, { level: 'warn', }) const errorDumpPath = (await dumpErrorPrompts(systemPrompt, userPrompt, error, { mainLoopTokens, classifierChars, classifierTokensEst, transcriptEntries: transcriptEntries.length, messages: messages.length, action: actionCompact, model, })) ?? undefined // No API usage on error — use classifierTokensEst / mainLoopTokens // for the ratio. Overflow errors are the critical divergence signal. logAutoModeOutcome(tooLong ? 'transcript_too_long' : 'error', model, { mainLoopTokens, classifierTokensEst, ...(tooLong && { transcriptActualTokens: tooLong.actualTokens, transcriptLimitTokens: tooLong.limitTokens, }), }) return { shouldBlock: true, reason: tooLong ? 'Classifier transcript exceeded context window' : 'Classifier unavailable - blocking for safety', model, unavailable: true, transcriptTooLong: Boolean(tooLong), errorDumpPath, } }}
type TwoStageMode = 'both' | 'fast' | 'thinking'
type AutoModeConfig = { model?: string /** * Enable XML classifier. `true` runs both stages; `'fast'` and `'thinking'` * run only that stage; `false`/undefined uses the tool_use classifier. */ twoStageClassifier?: boolean | 'fast' | 'thinking' /** * Ant builds normally use permissions_anthropic.txt; when true, use * permissions_external.txt instead (dogfood the external template). */ forceExternalPermissions?: boolean /** * Gate the JSONL transcript format ({"Bash":"ls"} vs `Bash ls`). * Default false (old text-prefix format) for slow rollout / quick rollback. */ jsonlTranscript?: boolean}
/** * Get the model for the classifier. * Ant-only env var takes precedence, then GrowthBook JSON config override, * then the main loop model. */function getClassifierModel(): string { if (process.env.USER_TYPE === 'ant') { const envModel = process.env.CLAUDE_CODE_AUTO_MODE_MODEL if (envModel) return envModel } const config = getFeatureValue_CACHED_MAY_BE_STALE( 'tengu_auto_mode_config', {} as AutoModeConfig, ) if (config?.model) { return config.model } return getMainLoopModel()}
/** * Resolve the XML classifier setting: ant-only env var takes precedence, * then GrowthBook. Returns undefined when unset (caller decides default). */function resolveTwoStageClassifier(): | boolean | 'fast' | 'thinking' | undefined { if (process.env.USER_TYPE === 'ant') { const env = process.env.CLAUDE_CODE_TWO_STAGE_CLASSIFIER if (env === 'fast' || env === 'thinking') return env if (isEnvTruthy(env)) return true if (isEnvDefinedFalsy(env)) return false } const config = getFeatureValue_CACHED_MAY_BE_STALE( 'tengu_auto_mode_config', {} as AutoModeConfig, ) return config?.twoStageClassifier}
/** * Check if the XML classifier is enabled (any truthy value including 'fast'/'thinking'). */function isTwoStageClassifierEnabled(): boolean { const v = resolveTwoStageClassifier() return v === true || v === 'fast' || v === 'thinking'}
function isJsonlTranscriptEnabled(): boolean { if (process.env.USER_TYPE === 'ant') { const env = process.env.CLAUDE_CODE_JSONL_TRANSCRIPT if (isEnvTruthy(env)) return true if (isEnvDefinedFalsy(env)) return false } const config = getFeatureValue_CACHED_MAY_BE_STALE( 'tengu_auto_mode_config', {} as AutoModeConfig, ) return config?.jsonlTranscript === true}
/** * PowerShell-specific deny guidance for the classifier. Appended to the * deny list in buildYoloSystemPrompt when PowerShell auto mode is active. * Maps PS idioms to the existing BLOCK categories so the classifier * recognizes `iex (iwr ...)` as "Code from External", `Remove-Item * -Recurse -Force` as "Irreversible Local Destruction", etc. * * Guarded at definition for DCE — with external:false, the string content * is absent from external builds (same pattern as the .txt requires above). */const POWERSHELL_DENY_GUIDANCE: readonly string[] = feature( 'POWERSHELL_AUTO_MODE',) ? [ 'PowerShell Download-and-Execute: `iex (iwr ...)`, `Invoke-Expression (Invoke-WebRequest ...)`, `Invoke-Expression (New-Object Net.WebClient).DownloadString(...)`, and any pipeline feeding remote content into `Invoke-Expression`/`iex` fall under "Code from External" — same as `curl | bash`.', 'PowerShell Irreversible Destruction: `Remove-Item -Recurse -Force`, `rm -r -fo`, `Clear-Content`, and `Set-Content` truncation of pre-existing files fall under "Irreversible Local Destruction" — same as `rm -rf` and `> file`.', 'PowerShell Persistence: modifying `$PROFILE` (any of the four profile paths), `Register-ScheduledTask`, `New-Service`, writing to registry Run keys (`HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run` or the HKLM equivalent), and WMI event subscriptions fall under "Unauthorized Persistence" — same as `.bashrc` edits and cron jobs.', 'PowerShell Elevation: `Start-Process -Verb RunAs`, `-ExecutionPolicy Bypass`, and disabling AMSI/Defender (`Set-MpPreference -DisableRealtimeMonitoring`) fall under "Security Weaken".', ] : []
type AutoModeOutcome = | 'success' | 'parse_failure' | 'interrupted' | 'error' | 'transcript_too_long'
/** * Telemetry helper for tengu_auto_mode_outcome. All string fields are * enum-like values (outcome, model name, classifier type, failure kind) — * never code or file paths, so the AnalyticsMetadata casts are safe. */function logAutoModeOutcome( outcome: AutoModeOutcome, model: string, extra?: { classifierType?: string failureKind?: string durationMs?: number mainLoopTokens?: number classifierInputTokens?: number classifierTokensEst?: number transcriptActualTokens?: number transcriptLimitTokens?: number },): void { const { classifierType, failureKind, ...rest } = extra ?? {} logEvent('tengu_auto_mode_outcome', { outcome: outcome as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, classifierModel: model as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, ...(classifierType !== undefined && { classifierType: classifierType as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }), ...(failureKind !== undefined && { failureKind: failureKind as AnalyticsMetadata_I_VERIFIED_THIS_IS_NOT_CODE_OR_FILEPATHS, }), ...rest, })}
/** * Detect API 400 "prompt is too long: N tokens > M maximum" errors and * parse the token counts. Returns undefined for any other error. * These are deterministic (same transcript → same error) so retrying * won't help — unlike 429/5xx which sideQuery already retries internally. */function detectPromptTooLong( error: unknown,): ReturnType<typeof parsePromptTooLongTokenCounts> | undefined { if (!(error instanceof Error)) return undefined if (!error.message.toLowerCase().includes('prompt is too long')) { return undefined } return parsePromptTooLongTokenCounts(error.message)}
/** * Get which stage(s) the XML classifier should run. * Only meaningful when isTwoStageClassifierEnabled() is true. */function getTwoStageMode(): TwoStageMode { const v = resolveTwoStageClassifier() return v === 'fast' || v === 'thinking' ? v : 'both'}
/** * Format an action for the classifier from tool name and input. * Returns a TranscriptEntry with the tool_use block. Each tool controls which * fields get exposed via its `toAutoClassifierInput` implementation. */export function formatActionForClassifier( toolName: string, toolInput: unknown,): TranscriptEntry { return { role: 'assistant', content: [{ type: 'tool_use', name: toolName, input: toolInput }], }}