Make read-only tool classification and fast-stage token budget configurable

[alexander-potemkin]

Summary

Two backward-compatible, opt-in config additions to autoMode:

• classifyReadOnlyTools (default false): when true, read-only tools (read, grep, find, ls) are routed through the classifier instead of the built-in read-only fast path. This lets policy deny reads outside the trusted working tree (e.g. ~/.ssh, /etc/shadow) rather than always auto-allowing them.
• fastClassifierMaxTokens (default 512, integer ≥ 16): overrides the hardcoded fast-stage completion budget. Reasoning classifiers can consume the 512-token budget on hidden reasoning before emitting the required 0/1 digit, truncating and failing closed; this lets users raise it.

Why

The read-only fast path is currently unconditional — reads never consult the classifier, so the only way to gate out-of-tree reads is permissions.deny patterns, which are coarser than policy. Making it configurable enables a Codex/Claude Code-style auto-review pattern where every action (including reads) is subject to the safety classifier.

fastClassifierMaxTokens addresses the same class of failure: with a reasoning classifier the fixed 512 budget can truncate the fast stage. It is already a named constant; this just exposes it.

Behavior

• Default config is unchanged: classifyReadOnlyTools: false keeps the read-only bypass; fastClassifierMaxTokens: 512 is the prior value.
• Both fields are validated in validateSettingsFile (boolean / integer ≥ 16) and merged with the existing scalar precedence.

Test plan

• Added unit tests for config defaults/merge, validation, and the tool_call hook routing reads through the classifier when classifyReadOnlyTools is true (allow and deny paths).
• npm run check and npm test pass (104 tests).

🤖 Generated with OpenCode