feat(set): validate autoMode structure + flag it in shared settings (CA-SET)

settings-validator now validates the autoMode block (auto-mode classifier
config). Structure (medium): autoMode must be an object whose only keys are
environment/allow/soft_deny/hard_deny, each a string array ("$defaults" is a
valid entry); flags not-an-object, unknown-subkey, not-string-array. Dead-config
(low): Claude Code does not read autoMode from shared project settings
(.claude/settings.json), so an autoMode block committed there has no effect —
keyed on file.scope === 'project'.

Both premises primary-source-verified (code.claude.com/docs/en/auto-mode-config).
The plan's "test per-file scope first" gate passed: ConfigFile already carries
scope. SET is in the orchestrator; SC-5 re-checked, byte-equal (snapshot fixture
has no autoMode). Fixtures force-added (.claude/ is gitignored).

Tests +5 (944->949). Scanner count unchanged (13). --json/--raw byte-stable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8

tests/fixtures/automode-nonobject/.claude/settings.local.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "autoMode": "on"
+}

tests/fixtures/automode-shared/.claude/settings.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "autoMode": {
+    "environment": ["$defaults", "Org: acme"],
+    "hard_deny": ["$defaults"]
+  }
+}

tests/fixtures/automode-structure/.claude/settings.local.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "autoMode": {
+    "environment": ["$defaults"],
+    "allow": "oops-not-an-array",
+    "soft_deny": ["ok", 7],
+    "bogus": ["x"]
+  }
+}

tests/scanners/settings-validator.test.mjs

@@ -208,3 +208,79 @@ describe('SET scanner — empty project', () => {
     assert.strictEqual(result.findings.length, 0);
   });
 });
+
+describe('SET scanner — autoMode validation (CA-SET-NNN)', () => {
+  // All autoMode findings have a title starting with "autoMode".
+  const AM_RE = /^autoMode/;
+  const amFindings = (result) => result.findings.filter(f => f.scanner === 'SET' && AM_RE.test(f.title || ''));
+
+  it('flags structural problems: wrong sub-key type, non-string array entry, unknown sub-key', async () => {
+    resetCounter();
+    // automode-structure/.claude/settings.local.json (scope=local → no dead-config):
+    // environment valid; allow not-array; soft_deny ["ok",7]; bogus unknown sub-key.
+    const path = resolve(FIXTURES, 'automode-structure');
+    const discovery = await discoverConfigFiles(path);
+    const result = await scan(path, discovery);
+    const am = amFindings(result);
+    const problems = am.map(f => f.details && f.details.problem).sort();
+    assert.deepEqual(
+      problems,
+      ['not-string-array', 'not-string-array', 'unknown-subkey'],
+      `Expected 2 not-string-array + 1 unknown-subkey, got ${am.map(f => f.title).join(' | ')}`
+    );
+    for (const f of am) {
+      assert.equal(f.severity, 'medium', `structure problem is medium: ${f.title}`);
+      assert.ok(/settings\.local\.json$/.test(f.file || ''), `points at the settings file: ${f.file}`);
+      assert.ok(f.details && f.details.key === 'autoMode', 'details.key === autoMode');
+    }
+  });
+
+  it('does NOT flag a valid string-array sub-key (incl. "$defaults")', async () => {
+    resetCounter();
+    const path = resolve(FIXTURES, 'automode-structure');
+    const discovery = await discoverConfigFiles(path);
+    const result = await scan(path, discovery);
+    // environment: ["$defaults"] is valid → must not appear.
+    const envFlagged = amFindings(result).some(f => /environment/.test(f.title || ''));
+    assert.equal(envFlagged, false, 'a valid string array (with $defaults) is not flagged');
+  });
+
+  it('flags autoMode that is not an object', async () => {
+    resetCounter();
+    const path = resolve(FIXTURES, 'automode-nonobject');
+    const discovery = await discoverConfigFiles(path);
+    const result = await scan(path, discovery);
+    const am = amFindings(result);
+    assert.equal(am.length, 1, `Expected one not-an-object finding, got ${am.map(f => f.title).join(' | ')}`);
+    assert.equal(am[0].details.problem, 'not-an-object');
+    assert.equal(am[0].severity, 'medium');
+  });
+
+  it('flags autoMode in shared project settings as dead config (and not in local scope)', async () => {
+    resetCounter();
+    // automode-shared/.claude/settings.json → scope=project → dead-config.
+    const sharedPath = resolve(FIXTURES, 'automode-shared');
+    const sharedResult = await scan(sharedPath, await discoverConfigFiles(sharedPath));
+    const dead = amFindings(sharedResult).filter(f => f.details && f.details.problem === 'shared-project-scope');
+    assert.equal(dead.length, 1, 'autoMode in shared .claude/settings.json is dead config');
+    assert.equal(dead[0].severity, 'low', 'dead-config is low severity');
+    // valid structure → no structure findings, only the dead-config one.
+    assert.equal(amFindings(sharedResult).length, 1, 'valid structure in shared scope yields only the dead-config finding');
+
+    // The same-shaped autoMode in LOCAL scope (automode-structure) must NOT be dead config.
+    resetCounter();
+    const localPath = resolve(FIXTURES, 'automode-structure');
+    const localResult = await scan(localPath, await discoverConfigFiles(localPath));
+    const localDead = amFindings(localResult).filter(f => f.details && f.details.problem === 'shared-project-scope');
+    assert.equal(localDead.length, 0, 'autoMode in settings.local.json is read by CC → not dead config');
+  });
+
+  it('does NOT flag a settings file without autoMode', async () => {
+    resetCounter();
+    // healthy-project has .claude/settings.json but no autoMode.
+    const path = resolve(FIXTURES, 'healthy-project');
+    const discovery = await discoverConfigFiles(path);
+    const result = await scan(path, discovery);
+    assert.equal(amFindings(result).length, 0, 'no autoMode key → no autoMode findings');
+  });
+});