@event4u/agent-config 14.14.1 → 14.15.0

package/dist/mcp/server.mjs

@@ -37289,6 +37289,65 @@ function splitFences(prompt) {
 function _commandLines(fence) {
   return fence.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).filter((l) => !/^(remote:|error:|hint:|fatal:|warning:|To |!\s|\s*\^)/i.test(l)).map((l) => l.replace(/^[$>#]\s*/, "")).filter((l) => /^(git|gh|npm|pnpm|yarn|task)\b/.test(l));
 }
+function extractMergeTargets(prompt) {
+  const out = /* @__PURE__ */ new Set();
+  const re = /(?:#|\bpr[- ]?|\bpull[- ]request\s+#?)(\d{1,7})\b/giu;
+  let m;
+  while ((m = re.exec(prompt)) !== null) {
+    const n = Number.parseInt(m[1], 10);
+    if (Number.isSafeInteger(n) && n > 0) {
+      out.add(n);
+    }
+  }
+  return [...out].sort((a, b) => a - b);
+}
+function isRevocation(prompt) {
+  return REVOKE_RE.test(prompt);
+}
+function _grantId(session_id, at, targets) {
+  return `${sessionSlug(session_id) || "nosession"}:${at}:${targets.join(",")}`;
+}
+function foldGrants(prior, prompt, authorized, session_id, now) {
+  if (isRevocation(prompt)) {
+    return [];
+  }
+  const carried = prior.filter((g) => g.consumed.length < g.targets.length);
+  if (!authorized.includes("pr-merge")) {
+    return carried;
+  }
+  const targets = extractMergeTargets(prompt);
+  if (targets.length === 0) {
+    return carried;
+  }
+  const at = now.toISOString();
+  const already = new Set(carried.flatMap((g) => g.targets));
+  const fresh = targets.filter((t) => !already.has(t));
+  if (fresh.length === 0) {
+    return carried;
+  }
+  return [
+    ...carried,
+    {
+      id: _grantId(session_id, at, fresh),
+      op: "pr-merge",
+      targets: fresh,
+      consumed: [],
+      granted_at: at,
+      evidence: prompt.trim().slice(0, 120)
+    }
+  ];
+}
+function negatedBefore(text, index, matched = "") {
+  let start = 0;
+  for (const mark of [".", "!", "?", "\n"]) {
+    const at = text.lastIndexOf(mark, index - 1);
+    if (at + 1 > start) {
+      start = at + 1;
+    }
+  }
+  const before = text.slice(Math.max(start, index - 30), index);
+  return NEGATION_WORD.test(before) || NEGATION_WORD.test(matched);
+}
 function classifyAuthorization(prompt) {
   const { prose, fences } = splitFences(prompt);
   const authorized = /* @__PURE__ */ new Set();
@@ -37296,7 +37355,7 @@ function classifyAuthorization(prompt) {
   const instruction = prose.split("\n").filter((l) => !OUTPUT_LINE.test(l)).join("\n");
   for (const { op, re } of isInterrogative(instruction) ? [] : PHRASES) {
     const m = re.exec(instruction);
-    if (m) {
+    if (m && !negatedBefore(instruction, m.index, m[0])) {
       authorized.add(op);
       evidence[op] = `prose: "${m[0]}"`;
     }
@@ -37318,6 +37377,68 @@ function classifyAuthorization(prompt) {
   }
   return { authorized: [...authorized], evidence };
 }
+function readGrants(consumer_root, session_id) {
+  try {
+    const raw = fs65.readFileSync(path66.join(consumer_root, ledgerFileFor(session_id)), "utf8");
+    const decoded = JSON.parse(raw);
+    if (!_isObject4(decoded) || !Array.isArray(decoded["grants"])) {
+      return [];
+    }
+    const owner = typeof decoded["session_id"] === "string" ? decoded["session_id"] : "";
+    if (session_id && owner && owner !== session_id) {
+      return [];
+    }
+    return decoded["grants"].flatMap((g) => {
+      if (!_isObject4(g)) return [];
+      const op = g["op"];
+      if (typeof op !== "string" || !ALL_OPS.includes(op)) return [];
+      const targets = Array.isArray(g["targets"]) ? g["targets"] : [];
+      const consumed = Array.isArray(g["consumed"]) ? g["consumed"] : [];
+      return [
+        {
+          id: String(g["id"] ?? ""),
+          op,
+          targets: targets.filter((t) => typeof t === "number"),
+          consumed: consumed.filter((t) => typeof t === "number"),
+          granted_at: String(g["granted_at"] ?? ""),
+          evidence: String(g["evidence"] ?? "")
+        }
+      ];
+    });
+  } catch {
+    return [];
+  }
+}
+function consumeGrantTarget(consumer_root, session_id, target) {
+  const file = path66.join(consumer_root, ledgerFileFor(session_id));
+  let decoded;
+  try {
+    decoded = JSON.parse(fs65.readFileSync(file, "utf8"));
+  } catch {
+    return;
+  }
+  if (!_isObject4(decoded) || !Array.isArray(decoded["grants"])) {
+    return;
+  }
+  let touched = false;
+  for (const g of decoded["grants"]) {
+    if (!_isObject4(g) || !Array.isArray(g["targets"]) || !Array.isArray(g["consumed"])) {
+      continue;
+    }
+    const targets = g["targets"];
+    const consumed = g["consumed"];
+    if (targets.includes(target) && !consumed.includes(target)) {
+      consumed.push(target);
+      touched = true;
+    }
+  }
+  if (touched) {
+    try {
+      atomic_write_json(file, decoded);
+    } catch {
+    }
+  }
+}
 function takePending(consumer_root, session_id, now) {
   const file = path66.join(consumer_root, pendingFileFor(session_id));
   let raw;
@@ -37386,12 +37507,24 @@ function run2(stdin_text, options) {
     authorized.push(pending.op);
     evidence[pending.op] = `confirmation of the refused \`${pending.op}\` (refused ${pending.refused_at}): "${prompt.trim().slice(0, 40)}"`;
   }
+  const now = /* @__PURE__ */ new Date();
   const ledger = {
     session_id: typeof envelope["session_id"] === "string" ? envelope["session_id"] : "",
-    detected_at: (/* @__PURE__ */ new Date()).toISOString(),
+    detected_at: now.toISOString(),
     authorized,
     evidence,
-    prompt_chars: prompt.length
+    prompt_chars: prompt.length,
+    // Grants survive this write; `authorized` does not. That asymmetry IS the
+    // decision. A bare operation name stays one-shot exactly as `commit-policy`
+    // requires, and only an authorization that also froze its objects earns a
+    // life longer than the turn. See ADR-252.
+    grants: foldGrants(
+      readGrants(options.consumer_root, session),
+      prompt,
+      authorized,
+      session,
+      now
+    )
   };
   try {
     atomic_write_json(path66.join(options.consumer_root, ledgerFileFor(session)), ledger);
@@ -37432,7 +37565,7 @@ function _isCliEntry19() {
     return false;
   }
 }
-var EXIT_ALLOW2, STATE_FILE2, STATE_DIR2, PENDING_DIR, PENDING_FILE, PENDING_MAX_AGE_MS, ALL_OPS, PHRASES, OUTPUT_LINE, PASTED_COMMANDS;
+var EXIT_ALLOW2, STATE_FILE2, STATE_DIR2, PENDING_DIR, PENDING_FILE, PENDING_MAX_AGE_MS, ALL_OPS, PHRASES, OUTPUT_LINE, PASTED_COMMANDS, REVOKE_RE, NEGATION_WORD;
 var init_git_authorization_hook = __esm({
   "src/scripts/git_authorization_hook.ts"() {
     "use strict";
@@ -37455,12 +37588,39 @@ var init_git_authorization_hook = __esm({
       "pr-merge-auto",
       "tag",
       "release",
-      "publish"
+      "publish",
+      "unpublish",
+      "deprecate",
+      "release-asset",
+      "protection",
+      "workflow-toggle",
+      "repo-lifecycle",
+      "review-approve",
+      "force-push",
+      "worktree-remove",
+      "clean-ignored",
+      "tag-force",
+      "rebase",
+      "reset-hard",
+      "clean",
+      "stash-drop",
+      "branch-delete",
+      "close"
     ];
     PHRASES = [
       { op: "commit", re: /\b(commit(e|et|te|ten)?|committe|einchecken)\b/i },
       { op: "push", re: /\b(push(e|en|t)?|hochladen|hochschieben|raufschieben)\b/i },
-      { op: "branch", re: /\b(branch|feature-branch|zweig)\b/i },
+      // A CREATION VERB IS REQUIRED, as for `pr-create` above and for the same
+      // reason. The bare noun could not tell an authorization from a mention, and
+      // the mention is the dangerous half: "den branch nicht löschen" names the
+      // object precisely in order to forbid acting on it, yet authorized branch
+      // creation — the negation trails a bare-noun match, so neither the
+      // look-behind nor the span check in `negatedBefore` can reach it. Widened
+      // 2026-09-03 alongside the destructive-coverage work that measured it.
+      {
+        op: "branch",
+        re: /\b(erstell(e|en)?|mach(e|en)?|leg(e|en)?\s+an|anleg(e|en)?|(er|be)?(ö|oe)ffne|open|create|new|neuer?|starte?|checkout|wechsl?e|switch)\b[^.\n]{0,30}\b(branch|feature-branch|zweig)\b|\b(branch|feature-branch|zweig)\b[^.\n]{0,25}\b(erstellen|anlegen|aufmachen|(ö|oe)ffnen|starten)\b/i
+      },
       // A creation verb is required — "schau dir den PR an" is not "open a PR".
       {
         op: "pr-create",
@@ -37497,7 +37657,111 @@ var init_git_authorization_hook = __esm({
         op: "release",
         re: /\b(releasen?|ver(ö|oe)ffentlich(e|en))\b(?!\s*[- ]?(notes?|branch|candidate|pr\b|datum|date|zweig))/i
       },
-      { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i }
+      { op: "publish", re: /\b(publish(e|en)?|publiziere[n]?)\b/i },
+      // ── Authorization vocabulary for the ops added 2026-09-03.
+      //
+      // NON-NEGOTIABLE, and the reason it ships in the same change as the new BLOCK
+      // ops: a blocked operation with no phrase that authorizes it is a dead end.
+      // The guard refuses, the user says "doch, mach das", the classifier records
+      // nothing, and the refusal repeats forever. Every op the guard can block must
+      // have a sentence that unblocks it, or the user's override is a claim rather
+      // than a mechanism.
+      //
+      // Tight on purpose. Under-matching costs one confirmation; over-matching
+      // authorizes something the user did not ask for, so each pattern demands the
+      // object noun rather than a bare verb wherever the verb is ordinary German.
+      //
+      // `unpublish` before nothing in particular — `\bpublish\b` does not match
+      // inside "unpublish" (no word boundary between `n` and `p`), so the two never
+      // collide.
+      // TWO SHAPES EVERY GERMAN PATTERN BELOW MUST CARRY, both learned from tests
+      // that went red rather than from inspection:
+      //
+      //   1. THE IMPERATIVE DROPS ITS `-e`. "entfern die worktree", "archivier das
+      //      repo", "deaktivier den workflow" are what people type; `entfern(e|en)`
+      //      matches none of them. Every verb ending is therefore `(e|en)?`.
+      //   2. WORD ORDER GOES BOTH WAYS. "archivier das repo" and "das repo
+      //      archivieren" are one instruction, and a pattern anchored on the noun
+      //      first sees only the second.
+      //
+      // The object noun stays REQUIRED in every pattern that has one. That is what
+      // keeps the loosened verb endings from over-authorizing: "lösch" alone
+      // authorizes nothing, "lösch den branch" authorizes a branch deletion.
+      { op: "unpublish", re: /\bunpublish(e|en)?\b/i },
+      {
+        op: "deprecate",
+        re: /\bdeprecate(d|n)?\b|\bals\s+veraltet\s+markier(e|en)?\b/i
+      },
+      {
+        op: "release-asset",
+        re: /\brelease[-\s]?asset\b|\b(clobber|(ü|ue)berschreib(e|en)?|ersetz(e|en)?|replace|austausch(e|en)?)\b[^.\n]{0,25}\b(asset|artefakt|artifact|tarball|binary)\b|\b(asset|artefakt|artifact)\b[^.\n]{0,25}\b((ü|ue)berschreiben|ersetzen|austauschen|replace)\b/i
+      },
+      // A VERB IS REQUIRED, like `tag` and `release` above and for the same reason.
+      // A bare noun cannot tell an authorization from a mention, and here the
+      // mention is the dangerous half: "die branch-protection nicht anfassen" names
+      // the object precisely in order to forbid touching it. Measured — this was the
+      // one row of the negation corpus that neither the look-behind nor the
+      // span check could reach, because the negation trails a bare-noun match.
+      {
+        op: "protection",
+        re: /\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|deaktivier(e|en)?|nimm|weg|remove|delete|disable|drop|lift)\b[^.\n]{0,30}\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b|\b(branch[-\s]?protection|protection[-\s]?rule|schutzregel|ruleset)\b[^.\n]{0,30}\b(entfernen|l(ö|oe)schen|deaktivieren|abschalten|remove|delete|disable|drop|lift|weg)\b/i
+      },
+      {
+        op: "workflow-toggle",
+        re: /\bworkflow\b[^.\n]{0,25}\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b|\b(deaktivier(e|en)?|aktivier(e|en)?|disable|enable|abschalt(e|en)?|ausschalt(e|en)?)\b[^.\n]{0,25}\bworkflow\b/i
+      },
+      {
+        op: "repo-lifecycle",
+        re: /\b(repo|repository)\b[^.\n]{0,30}\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b|\b(archivier(e|en)?|archive|l(ö|oe)sch(e|en)?|delete)\b[^.\n]{0,25}\b(repo|repository)\b|\b(repo|repository)\b[^.\n]{0,30}\bauf\s+(privat|public|öffentlich|private)\b/i
+      },
+      {
+        op: "review-approve",
+        re: /\b(approve|genehmig(e|en)?|freigeb(e|en)?|abnehm(e|en)?)\b[^.\n]{0,30}\b(review|pr|pull[-\s]request)\b|\b(review|pr|pull[-\s]request)\b[^.\n]{0,20}\b(approve|approven|genehmigen|freigeben)\b/i
+      },
+      {
+        op: "force-push",
+        re: /\bforce[-\s]?push(e|en|st)?\b|--force(-with-lease)?\b|\bmit\s+gewalt\s+push(e|en)?\b/i
+      },
+      {
+        op: "worktree-remove",
+        re: /\bworktree\b[^.\n]{0,25}\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete|weg(werfen|r(ä|ae)umen))\b|\b(entfern(e|en)?|l(ö|oe)sch(e|en)?|remove|delete)\b[^.\n]{0,25}\bworktree\b/i
+      },
+      // The `-x` flag is the whole distinction: without it `git clean` spares
+      // ignored files, with it `.env` and local certificates go too.
+      {
+        op: "clean-ignored",
+        re: /\bgit\s+clean\b[^.\n]{0,20}-[A-Za-z]*x|\b(ignorierte|ignored)\b[^.\n]{0,25}\b(dateien|files)\b[^.\n]{0,25}\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|remove|delete)\b/i
+      },
+      {
+        op: "tag-force",
+        re: /\btag\b[^.\n]{0,25}\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?|umh(ä|ae)ng(e|en)?|force|move)\b|\b(verschieb(e|en)?|(ü|ue)berschreib(e|en)?)\b[^.\n]{0,20}\btag\b/i
+      },
+      { op: "rebase", re: /\brebase(n|st|d)?\b/i },
+      {
+        op: "reset-hard",
+        re: /\breset\s+--hard\b|\bhard\s+reset\b|\bhart\s+zur(ü|ue)cksetz(e|en)?\b/i
+      },
+      { op: "clean", re: /\bgit\s+clean\b/i },
+      {
+        op: "stash-drop",
+        re: /\bstash\b[^.\n]{0,25}\b(drop|clear|verwerf(e|en)?|l(ö|oe)sch(e|en)?)\b|\b(verwerf(e|en)?|l(ö|oe)sch(e|en)?|drop)\b[^.\n]{0,20}\bstash\b/i
+      },
+      {
+        op: "branch-delete",
+        re: /\b(l(ö|oe)sch(e|en)?|entfern(e|en)?|delete|remove)\b[^.\n]{0,25}\b(branch|branches|zweig)\b|\b(branch|branches|zweig)\b[^.\n]{0,25}\b(l(ö|oe)schen|entfernen|delete|remove)\b/i
+      },
+      {
+        op: "close",
+        re: /\b(schlie(ß|ss)(e|en)?|close)\b[^.\n]{0,30}\b(pr|pull[-\s]request|issue|ticket)\b|\b(pr|pull[-\s]request|issue|ticket)\b[^.\n]{0,20}\b(schlie(ß|ss)en|close)\b/i
+      },
+      // Enabling auto-merge is its own op on the guard side, so it needs its own
+      // sentence. Without one it is the dead end this block exists to prevent: the
+      // plain merge phrase authorizes `pr-merge` and never `pr-merge-auto`, so the
+      // refusal would have repeated forever.
+      {
+        op: "pr-merge-auto",
+        re: /\bauto[-\s]?merge\b|\bmerge\b[^.\n]{0,20}\bautomatisch\b|\bautomatisch\b[^.\n]{0,20}\bmerg(e|en)\b/i
+      }
     ];
     OUTPUT_LINE = /^\s*(To\s+\S+|remote:|error:|fatal:|hint:|warning:|!\s|\?\?\s|\s*\^|[-+]{3}\s|@@\s|\$\s|>\s|\d+\s+(pass|fail)|npm ERR!|Error:|Traceback|at\s+\S+:\d+)/i;
     PASTED_COMMANDS = [
@@ -37520,12 +37784,107 @@ var init_git_authorization_hook = __esm({
       { op: "commit", re: /\bgit\s+commit\b/i },
       { op: "branch", re: /\bgit\s+(checkout\s+-b|switch\s+-c|branch)\b/i }
     ];
+    REVOKE_RE = /\b(stop|stopp|halt|abbrechen|abbruch|cancel|revoke|widerruf(en)?|zur(ü|ue)ck(nehmen|ziehen)|hold\s+(everything|on|the\s+merge)|warte|wait)\b|(?:\b(nicht|kein(e|en)?|no|not|dont|don't|never|niemals|nie)\b[^.!?\n]{0,30}\b(merg(e|en|ing)|zusammenf(ü|ue)hren)\b)/iu;
+    NEGATION_WORD = /\b(nicht|nichts|kein(e|en|em|er|es)?|niemals|nie|no|not|dont|don't|never|without|ohne)\b/i;
     if (_isCliEntry19()) {
       process.exit(main23());
     }
   }
 });
 
+// src/scripts/hooks/merge_impact.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+function classifyDiff(patch) {
+  if (patch.trim() === "") {
+    return { verdict: "undecidable", markers: [], reason: "empty diff" };
+  }
+  const markers = [];
+  for (const { label, re } of DESTRUCTIVE_MARKERS) {
+    if (re.test(patch)) {
+      markers.push(label);
+    }
+  }
+  const bump = MAJOR_BUMP.exec(patch);
+  if (bump && bump[1] !== bump[2]) {
+    markers.push(`major version bump ${bump[1]}.x to ${bump[2]}.x`);
+  }
+  const filesChanged = (patch.match(/^diff --git /gm) ?? []).length;
+  if (markers.length > 0) {
+    return { verdict: "destructive", markers, filesChanged };
+  }
+  return { verdict: "additive", markers: [], filesChanged };
+}
+function fetchPatch(pr, opts = {}) {
+  const run6 = opts.exec ?? execFileSync2;
+  const cwd = opts.cwd ?? process.cwd();
+  const capture = (file, args) => run6(file, args, { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
+  for (const ref of [`refs/pull/${pr}/head`, `pull/${pr}/head`]) {
+    try {
+      const base = capture("git", ["merge-base", "HEAD", ref]).trim();
+      if (base) {
+        const patch = capture("git", ["diff", `${base}...${ref}`]);
+        if (patch.trim() !== "") {
+          return { patch, source: "local" };
+        }
+      }
+    } catch {
+    }
+  }
+  if (opts.allowNetwork === false) {
+    return { patch: "", source: "none", reason: "no local ref and network reads disabled" };
+  }
+  try {
+    const patch = capture("gh", ["pr", "diff", String(pr), "--patch"]);
+    if (patch.trim() !== "") {
+      return { patch, source: "gh" };
+    }
+    return { patch: "", source: "none", reason: "gh returned an empty diff" };
+  } catch {
+    return { patch: "", source: "none", reason: "no local ref, and gh pr diff failed" };
+  }
+}
+function analyseMergeImpact(pr, opts = {}) {
+  const got = fetchPatch(pr, opts);
+  if (got.source === "none") {
+    return { verdict: "undecidable", markers: [], ...got.reason ? { reason: got.reason } : {} };
+  }
+  return classifyDiff(got.patch);
+}
+function describeImpact(pr, impact) {
+  const say = `Say "merge #${pr}" to authorize it.`;
+  switch (impact.verdict) {
+    case "additive":
+      return `Impact scan: PR #${pr} touches ${impact.filesChanged ?? 0} file(s) and trips no destructive marker \u2014 no schema drop, no removed export or route, no major bump, no BREAKING CHANGE. Additive as far as the diff can show, which is not the same as safe to merge: the base has moved since review and merging may trigger a deploy. ${say}`;
+    case "destructive":
+      return `Impact scan: PR #${pr} is NOT additive \u2014 ${impact.markers.join("; ")}. Read the diff before authorizing. ${say}`;
+    default:
+      return `Impact scan: could not read the diff for PR #${pr} (${impact.reason ?? "unknown"}), so nothing is known about what it changes. ${say}`;
+  }
+}
+var DESTRUCTIVE_MARKERS, MAJOR_BUMP;
+var init_merge_impact = __esm({
+  "src/scripts/hooks/merge_impact.ts"() {
+    "use strict";
+    DESTRUCTIVE_MARKERS = [
+      // Schema removal. Matched on ADDED lines only — a migration that *removes* a
+      // dropColumn call is the opposite of destructive, and matching the raw patch
+      // would score it the same way.
+      { label: "migration drops a column or table", re: /^\+.*\b(dropColumn|dropTable|dropIfExists|removeColumn|drop_column|drop_table)\b/im },
+      { label: "raw DROP or TRUNCATE in a migration", re: /^\+.*\b(DROP\s+(TABLE|COLUMN|INDEX|CONSTRAINT)|TRUNCATE\s+TABLE)\b/im },
+      // The author said so themselves. Conventional Commits marks a breaking change
+      // with a `!` before the colon or a body trailer.
+      { label: "author marked a BREAKING CHANGE", re: /^\+.*BREAKING[ -]CHANGE/m },
+      // A removed export is the shape most likely to break an importer.
+      { label: "an exported symbol was removed", re: /^-\s*export\s+(default\s+|const\s+|function\s+|class\s+|interface\s+|type\s+|async\s+)/m },
+      { label: "a public PHP or Python symbol was removed", re: /^-\s*(public\s+function|def\s+[a-z_]+\s*\()/m },
+      // Route removal breaks callers that never imported anything.
+      { label: "a route or endpoint was removed", re: /^-.*\b(Route::(get|post|put|patch|delete)|@(Get|Post|Put|Patch|Delete)Mapping|app\.(get|post|put|patch|delete)\s*\()/m },
+      { label: "a whole file was deleted", re: /^deleted file mode /m }
+    ];
+    MAJOR_BUMP = /^-\s*"version"\s*:\s*"(\d+)\.[^"]*"[\s\S]{0,200}?^\+\s*"version"\s*:\s*"(\d+)\./m;
+  }
+});
+
 // src/scripts/hooks/block_unauthorized_git.ts
 import fs66 from "node:fs";
 import path67 from "node:path";
@@ -37716,7 +38075,24 @@ function commandOp(command) {
   }
   return found;
 }
+function mergeTargetOf(command) {
+  const gh = /\bgh\s+pr\s+merge\s+(?:-{1,2}\S+\s+)*?(\d{1,7})\b/i.exec(command);
+  if (gh) {
+    return Number.parseInt(gh[1], 10);
+  }
+  const api = /\/pulls\/(\d{1,7})\/merge\b/i.exec(command);
+  return api ? Number.parseInt(api[1], 10) : null;
+}
+function grantCovers(grants, op, target) {
+  if (op !== "pr-merge" || target === null) {
+    return null;
+  }
+  return grants.find(
+    (g) => g.op === "pr-merge" && g.targets.includes(target) && !g.consumed.includes(target)
+  ) ?? null;
+}
 function _loadLedger(consumer_root, session_id, now) {
+  const grants = readGrants(consumer_root, session_id);
   const candidates = [ledgerFileFor(session_id)];
   if (!candidates.includes(STATE_FILE2)) {
     candidates.push(STATE_FILE2);
@@ -37724,10 +38100,10 @@ function _loadLedger(consumer_root, session_id, now) {
   for (const rel of candidates) {
     const found = _readLedgerFile(path67.join(consumer_root, rel), session_id, now);
     if (found !== null) {
-      return found;
+      return { ...found, grants };
     }
   }
-  return { authorized: /* @__PURE__ */ new Set(), present: false };
+  return { authorized: /* @__PURE__ */ new Set(), present: false, grants };
 }
 function _readLedgerFile(file, session_id, now) {
   try {
@@ -37751,7 +38127,7 @@ function _readLedgerFile(file, session_id, now) {
   }
   return null;
 }
-function decide(command, ledger) {
+function decide(command, ledger, impact) {
   if (command === null) {
     return { exit: EXIT_ALLOW3, stdout: "", stderr: "" };
   }
@@ -37759,9 +38135,14 @@ function decide(command, ledger) {
   if (op === null || ledger.authorized.has(op)) {
     return { exit: EXIT_ALLOW3, stdout: "", stderr: "" };
   }
+  const target = mergeTargetOf(command);
+  if (grantCovers(ledger.grants ?? [], op, target) && target !== null) {
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", consumedTarget: target };
+  }
   const shown = command.length > 120 ? `${command.slice(0, 117)}\u2026` : command;
   if (BLOCK_OPS.has(op)) {
-    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}. Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
+    const scan2 = op === "pr-merge" && target !== null && impact ? ` ${impact}` : "";
+    const reason = `Blocked: \`${op}\` with no authorization in this turn's prompt. This operation is irreversible and non-destructive-by-default already declares it never-autonomous. Command: ${shown}.${scan2} Ask the user, in one numbered-options block, and run it only after they answer this turn.`;
     return { exit: EXIT_BLOCK, stdout: "", stderr: `${reason}
 `, blockedOp: op };
   }
@@ -37789,10 +38170,24 @@ function run3(stdin_text, options) {
     }
   }
   const session_id = typeof envelope["session_id"] === "string" ? envelope["session_id"] : "";
-  const decision = decide(
-    extractCommand(envelope),
-    _loadLedger(options.consumer_root, session_id, Date.now())
-  );
+  const command = extractCommand(envelope);
+  const ledger = _loadLedger(options.consumer_root, session_id, Date.now());
+  let impact;
+  const stage1 = command === null ? null : commandOp(command);
+  const stage2Target = command === null ? null : mergeTargetOf(command);
+  if (stage1 === "pr-merge" && stage2Target !== null && !ledger.authorized.has("pr-merge") && !grantCovers(ledger.grants ?? [], "pr-merge", stage2Target)) {
+    try {
+      impact = describeImpact(
+        stage2Target,
+        analyseMergeImpact(stage2Target, { cwd: options.consumer_root })
+      );
+    } catch {
+    }
+  }
+  const decision = decide(command, ledger, impact);
+  if (decision.consumedTarget !== void 0) {
+    consumeGrantTarget(options.consumer_root, session_id, decision.consumedTarget);
+  }
   if (decision.blockedOp) {
     try {
       atomic_write_json(path67.join(options.consumer_root, pendingFileFor(session_id)), {
@@ -37849,6 +38244,7 @@ var init_block_unauthorized_git = __esm({
   "src/scripts/hooks/block_unauthorized_git.ts"() {
     "use strict";
     init_hook_stdin();
+    init_merge_impact();
     init_state_io();
     init_git_authorization_hook();
     EXIT_ALLOW3 = 0;
@@ -37860,13 +38256,52 @@ var init_block_unauthorized_git = __esm({
       "pr-merge",
       // Enabling auto-merge commits the outcome to a condition the agent does not
       // control, so it is blocked on the same terms as the merge it schedules.
-      "pr-merge-auto"
+      "pr-merge-auto",
+      // ── Added 2026-09-03. Every one is already never-autonomous in the
+      // `non-destructive-by-default` prose; the measurement that drove it is in the
+      // `GitOp` union's own note — 17 of 25 borderline operations classified as
+      // NOTHING, including three worse than anything the guard already caught.
+      /** The undo that is more destructive than the act: lockfiles break. */
+      "unpublish",
+      /** Metadata only, and every install on earth starts warning. */
+      "deprecate",
+      /** Replaces bytes consumers already hold a checksum for. */
+      "release-asset",
+      /** Deletes the guard rather than the data — everything after is unguarded. */
+      "protection",
+      /** No data lost; the gate that protects everything downstream is off. */
+      "workflow-toggle",
+      /** Reach outside the repository, and mostly one-way. */
+      "repo-lifecycle",
+      /** No code moves, and an armed auto-merge is released. */
+      "review-approve",
+      /** Discards commits that landed after the last fetch, on a shared ref. */
+      "force-push",
+      /** Destroys uncommitted work belonging to a session this one cannot see. */
+      "worktree-remove",
+      /** `-x` is the flag that takes `.env` and local certificates. */
+      "clean-ignored"
     ]);
     WARN_OPS = /* @__PURE__ */ new Set([
       "commit",
       "push",
       "pr-create",
-      "branch"
+      "branch",
+      // ── Added 2026-09-03, deliberately at warn rather than block.
+      //
+      // Each is destructive in some reading, and each is also routine enough that
+      // blocking it would be the friction that gets the whole guard routed around —
+      // the failure mode this estate has already recorded twice. `reset-hard` is the
+      // sharpest case and stays here for a decidable reason: the Hard Floor's
+      // qualifier is "past unpushed work", and the command text cannot say whether
+      // the work was pushed.
+      "tag-force",
+      "rebase",
+      "reset-hard",
+      "clean",
+      "stash-drop",
+      "branch-delete",
+      "close"
     ]);
     G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
     P = "^(?:\\S*\\/)?";
@@ -37906,6 +38341,72 @@ var init_block_unauthorized_git = __esm({
         op: "pr-create",
         re: new RegExp(`${P}gh\\s+pr\\s+create\\b|${ghApiWrite("\\/pulls\\b").source}`, "i")
       },
+      // ── Added 2026-09-03. Placement inside this table is as load-bearing as the
+      // patterns: the loop takes the MOST SEVERE match per segment, but within one
+      // op the first pattern wins, so anything more specific than a plain `git push`
+      // has to sit above it.
+      // `npm unpublish` is NOT reached by the publish pattern — `\bpublish\b` needs
+      // a word boundary that `unpublish` does not provide between `n` and `p`. That
+      // is why it classified as nothing for as long as it did.
+      { op: "unpublish", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}unpublish\\b`, "i") },
+      { op: "deprecate", re: new RegExp(`${P}(npm|pnpm|yarn)\\s+${G}deprecate\\b`, "i") },
+      {
+        op: "release-asset",
+        re: new RegExp(`${P}gh\\s+release\\s+(upload|edit|delete)\\b`, "i")
+      },
+      {
+        op: "protection",
+        re: new RegExp(
+          `${P}gh\\s+api\\b(?=[^\\n]*(?:protection|rulesets?)\\b)(?=[^\\n]*(?:-X|--method)\\s+(?:DELETE|PUT|PATCH|POST)\\b)|${P}gh\\s+ruleset\\s+delete\\b`,
+          "i"
+        )
+      },
+      {
+        op: "workflow-toggle",
+        re: new RegExp(`${P}gh\\s+workflow\\s+(disable|enable)\\b`, "i")
+      },
+      {
+        op: "repo-lifecycle",
+        re: new RegExp(
+          `${P}gh\\s+repo\\s+(archive|delete|unarchive)\\b|${P}gh\\s+repo\\s+edit\\b(?=[^\\n]*--visibility\\b)`,
+          "i"
+        )
+      },
+      {
+        op: "review-approve",
+        re: new RegExp(`${P}gh\\s+pr\\s+review\\b(?=[^\\n]*--approve\\b)`, "i")
+      },
+      // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
+      // "safe force" is in the same class here because what it is safe against is a
+      // stale local view, not a collaborator who pushed after your fetch.
+      {
+        op: "force-push",
+        re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i")
+      },
+      {
+        op: "worktree-remove",
+        re: new RegExp(`${P}git\\s+worktree\\s+remove\\b[^\\n;|&]*(--force\\b|\\s-f\\b)`, "i")
+      },
+      // `-x` (or `-X`) anywhere in the flag cluster is what reaches ignored files.
+      {
+        op: "clean-ignored",
+        re: new RegExp(`${P}git\\s+clean\\b[^\\n;|&]*-[A-Za-z]*x`, "i")
+      },
+      { op: "tag-force", re: new RegExp(`${P}git\\s+tag\\b[^\\n;|&]*(-f\\b|--force\\b)`, "i") },
+      { op: "rebase", re: new RegExp(`${P}git\\s+${G}rebase\\b`, "i") },
+      { op: "reset-hard", re: new RegExp(`${P}git\\s+${G}reset\\b[^\\n;|&]*--hard\\b`, "i") },
+      { op: "clean", re: new RegExp(`${P}git\\s+clean\\b`, "i") },
+      { op: "stash-drop", re: new RegExp(`${P}git\\s+stash\\s+(drop|clear)\\b`, "i") },
+      // Remote deletion and the local `-D` are one op: both remove a ref, and the
+      // remote form additionally closes any open PR pointing at it.
+      {
+        op: "branch-delete",
+        re: new RegExp(
+          `${P}git\\s+branch\\b[^\\n;|&]*(-D\\b|--delete\\b)|${P}git\\s+${G}push\\b[^\\n;|&]*(--delete\\b|\\s:\\S)`,
+          "i"
+        )
+      },
+      { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
       { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
       { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
       { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "14.14.1",
+    "version": "14.15.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including the counts in these badges.",
     "license": "MIT",
     "private": false,