@gethmy/agent 1.39.0 → 1.40.0

package/dist/cli.js

@@ -852,6 +852,9 @@ function buildGaveUpComment(maxAttempts, failures, pauseEnabled) {
 function mergeAgentConfig(defaults, overrides) {
   return mergeObjects(defaults, overrides);
 }
+function own(source, key) {
+  return Object.hasOwn(source, key) ? source[key] : undefined;
+}
 function isPlainObject(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -864,7 +867,7 @@ function mergeObjects(base, override) {
   for (const key of Object.keys(base)) {
     if (FORBIDDEN_KEYS.has(key))
       continue;
-    result[key] = mergeValue(base[key], override[key]);
+    result[key] = mergeValue(base[key], own(override, key));
   }
   for (const key of Object.keys(override)) {
     if (FORBIDDEN_KEYS.has(key))
@@ -903,7 +906,7 @@ function walk(base, override, path, found) {
     if (FORBIDDEN_KEYS.has(key))
       continue;
     const baseValue = base[key];
-    const overrideValue = override[key];
+    const overrideValue = own(override, key);
     if (overrideValue === undefined)
       continue;
     const here = `${path}.${key}`;
@@ -948,7 +951,11 @@ function copy(value) {
 }
 var FORBIDDEN_KEYS;
 var init_config_merge = __esm(() => {
-  FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+  FORBIDDEN_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype"
+  ]);
 });
 
 // src/config-validation.ts
@@ -963,8 +970,10 @@ __export(exports_config_validation, {
   validateBudgetConfig: () => validateBudgetConfig,
   validateAutoMergeConfig: () => validateAutoMergeConfig,
   validateAndListColumns: () => validateAndListColumns,
+  repoArmedGatesOf: () => repoArmedGatesOf,
   isLoopbackBindAddr: () => isLoopbackBindAddr,
   findRemovedConfigKeys: () => findRemovedConfigKeys,
+  REPO_ARMABLE_GATES: () => REPO_ARMABLE_GATES,
   REMOVED_CONFIG_KEYS: () => REMOVED_CONFIG_KEYS,
   ConfigValidationError: () => ConfigValidationError
 });
@@ -979,7 +988,7 @@ function findRemovedConfigKeys(rawConfig) {
         cursor = undefined;
         break;
       }
-      cursor = cursor[segment];
+      cursor = own(cursor, segment);
     }
     if (cursor !== undefined) {
       found.push(`${path} is no longer used (#988) — ${note}. Remove it.`);
@@ -1012,9 +1021,49 @@ function validateVerificationConfig(config) {
   - `)}`, issues);
   }
 }
-function validateAutoMergeConfig(config) {
+function repoArmedGatesOf(suppliedPaths, operatorAgent, merged) {
+  const armed = new Set;
+  for (const gate of Object.keys(REPO_ARMABLE_GATES)) {
+    if (!suppliedPaths.has(gate))
+      continue;
+    if (ownValueAt(operatorAgent, gate))
+      continue;
+    if (ownValueAt(merged, gate) !== true)
+      continue;
+    armed.add(gate);
+  }
+  return armed;
+}
+function ownValueAt(root, dotted) {
+  let cursor = root;
+  for (const segment of dotted.split(".")) {
+    if (cursor === null || typeof cursor !== "object" || !Object.hasOwn(cursor, segment)) {
+      return;
+    }
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function armedByRepoPin(gate) {
+  if (REPO_ARMABLE_GATES[gate] === "tightening") {
+    return `This repository's .hmy.json sets "${gate}", and your own config had that gate off — so the repository is what makes this rule apply at all. It is a tightening, so the repository may set it without your "allowRepoOverrides", and your own config was legal until you cloned this checkout. Two remedies: drop "${gate}" from this repository's .hmy.json, or give the key this message names a usable value in ~/.hmy/agent/config.json — which keeps the gate armed, as the repository asked, unless the pin supplies that key too (it is the top rung, and any key it supplied is named in the warnings above).`;
+  }
+  return `This repository's .hmy.json sets "${gate}", and your own config had it off — so the repository is what makes this rule apply at all. That is a loosening, accepted only because your ~/.hmy/agent/config.json sets "allowRepoOverrides": true, and your own config was legal until you cloned this checkout. Two remedies: drop "${gate}" from this repository's .hmy.json, or turn "allowRepoOverrides" off in your own config, which drops every repo-supplied loosening at once. To keep what the repository asked for instead, satisfy the rule this message opens with — unless this repository's .hmy.json supplies that key as well, in which case only the two remedies above can help, because the pin is the top rung.`;
+}
+function validateAutoMergeConfig(config, repoSuppliedPaths = NO_REPO_PATHS, repoArmedGates = NO_REPO_PATHS) {
   const autoMerge = config.review.autoMerge;
   const issues = [];
+  const warnings = [];
+  const armedRefusal = (gate, issue) => {
+    issues.push(repoArmedGates.has(gate) ? `${issue}. ${armedByRepoPin(gate)}` : issue);
+  };
+  const inertCombination = (args) => {
+    if (repoSuppliedPaths.has(args.gate)) {
+      warnings.push(`${args.pin} is inert here: this repository's .hmy.json sets ${args.gate}, and ${args.pin} only runs behind it. The repository's tightening wins — your own config is not wrong, and nothing else is switched off.`);
+      return;
+    }
+    armedRefusal(args.pin, args.issue);
+  };
   const valid = ["squash", "merge", "rebase"];
   const s = autoMerge.strategy;
   if (!valid.includes(s)) {
@@ -1023,34 +1072,44 @@ function validateAutoMergeConfig(config) {
   const repair = autoMerge.ciRepair;
   if (repair.enabled) {
     if (!autoMerge.enabled) {
-      issues.push("review.autoMerge.ciRepair.enabled: needs review.autoMerge.enabled — a repair only runs on a card the daemon would merge itself");
+      inertCombination({
+        pin: "review.autoMerge.ciRepair.enabled",
+        gate: "review.autoMerge.enabled",
+        issue: "review.autoMerge.ciRepair.enabled: needs review.autoMerge.enabled — a repair only runs on a card the daemon would merge itself"
+      });
     }
     if (!autoMerge.requireGreenCi) {
-      issues.push("review.autoMerge.ciRepair.enabled: needs review.autoMerge.requireGreenCi — without it a red CI never reaches the repair branch, so the loop can never run");
+      armedRefusal("review.autoMerge.ciRepair.enabled", "review.autoMerge.ciRepair.enabled: needs review.autoMerge.requireGreenCi — without it a red CI never reaches the repair branch, so the loop can never run");
     }
     if (!Number.isInteger(repair.maxAttempts) || repair.maxAttempts < 1) {
-      issues.push(`review.autoMerge.ciRepair.maxAttempts: must be an integer >= 1 (got ${repair.maxAttempts}) — the cap is the safety property and has no opt-out`);
+      armedRefusal("review.autoMerge.ciRepair.enabled", `review.autoMerge.ciRepair.maxAttempts: must be an integer >= 1 (got ${repair.maxAttempts}) — the cap is the safety property and has no opt-out`);
     }
   }
   const patch = repair.patch;
   if (patch?.enabled) {
     if (!repair.enabled) {
-      issues.push("review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.ciRepair.enabled — the repair runs inside the loop that cap, park latch and ownership re-read belong to");
+      inertCombination({
+        pin: "review.autoMerge.ciRepair.patch.enabled",
+        gate: "review.autoMerge.ciRepair.enabled",
+        issue: "review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.ciRepair.enabled — the repair runs inside the loop that cap, park latch and ownership re-read belong to"
+      });
     }
     if (!autoMerge.reReviewOnBranchChange) {
-      issues.push("review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.reReviewOnBranchChange — without it a machine-authored repair could merge with nothing having reviewed its diff");
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", "review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.reReviewOnBranchChange — without it a machine-authored repair could merge with nothing having reviewed its diff");
     }
-    issues.push(...sandboxConfigIssues({
+    for (const issue of sandboxConfigIssues({
       image: patch.sandboxImage,
       timeoutMs: patch.sandboxTimeoutMs,
       imagePath: "review.autoMerge.ciRepair.patch.sandboxImage",
       timeoutPath: "review.autoMerge.ciRepair.patch.sandboxTimeoutMs"
-    }));
+    })) {
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", issue);
+    }
     if (!Number.isInteger(patch.maxTurns) || patch.maxTurns < 1) {
-      issues.push(`review.autoMerge.ciRepair.patch.maxTurns: must be an integer >= 1 (got ${patch.maxTurns})`);
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", `review.autoMerge.ciRepair.patch.maxTurns: must be an integer >= 1 (got ${patch.maxTurns})`);
     }
     if (!(patch.maxBudgetUsd > 0)) {
-      issues.push(`review.autoMerge.ciRepair.patch.maxBudgetUsd: must be greater than 0 (got ${patch.maxBudgetUsd})`);
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", `review.autoMerge.ciRepair.patch.maxBudgetUsd: must be greater than 0 (got ${patch.maxBudgetUsd})`);
     }
   }
   const independent = autoMerge.independentReview;
@@ -1059,38 +1118,46 @@ function validateAutoMergeConfig(config) {
   }
   if (independent?.enabled) {
     if (typeof independent.checkName !== "string" || !independent.checkName.trim()) {
-      issues.push("review.autoMerge.independentReview.checkName: must name a non-empty check — an unmatched name reads as no review at all and holds every merge");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.checkName: must name a non-empty check — an unmatched name reads as no review at all and holds every merge");
     }
     if (typeof independent.label !== "string" || !independent.label.trim()) {
-      issues.push("review.autoMerge.independentReview.label: must name the PR label that requests a CI review");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.label: must name the PR label that requests a CI review");
     }
     const verdict = independent.verdict;
     if (typeof verdict?.enabled !== "boolean") {
-      issues.push(`review.autoMerge.independentReview.verdict.enabled: must be true or false (got ${JSON.stringify(verdict?.enabled)}) — an absent value would switch this safety gate off without saying so`);
+      armedRefusal("review.autoMerge.independentReview.enabled", `review.autoMerge.independentReview.verdict.enabled: must be true or false (got ${JSON.stringify(verdict?.enabled)}) — an absent value would switch this safety gate off without saying so`);
     }
     if (typeof verdict?.checkName !== "string" || !verdict.checkName.trim()) {
-      issues.push("review.autoMerge.independentReview.verdict.checkName: must name a non-empty check even when verdict.enabled is false — the name keeps that check out of the collapsed CI verdict, so a blank one turns a review finding into a red build");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.verdict.checkName: must name a non-empty check even when verdict.enabled is false — the name keeps that check out of the collapsed CI verdict, so a blank one turns a review finding into a red build");
     }
     if (typeof independent.checkName === "string" && typeof verdict?.checkName === "string" && independent.checkName.trim().toLowerCase() === verdict.checkName.trim().toLowerCase() && independent.checkName.trim()) {
-      issues.push(`review.autoMerge.independentReview.verdict.checkName: must not be the same check as independentReview.checkName ("${independent.checkName}") — one says a review RAN and the other says what it concluded, and each reader skips the other's check, so naming one check for both holds every merge`);
+      armedRefusal("review.autoMerge.independentReview.enabled", `review.autoMerge.independentReview.verdict.checkName: must not be the same check as independentReview.checkName ("${independent.checkName}") — one says a review RAN and the other says what it concluded, and each reader skips the other's check, so naming one check for both holds every merge`);
     }
   }
   if (typeof autoMerge.interactive !== "boolean") {
     issues.push(`review.autoMerge.interactive: must be true or false (got ${JSON.stringify(autoMerge.interactive)}) — an absent value would switch the interactive merge on or off without saying so`);
   }
+  if (autoMerge.interactive || autoMerge.enabled) {
+    const driver = autoMerge.interactive ? "review.autoMerge.interactive" : "review.autoMerge.enabled";
+    for (const named of REPO_UNSETTABLE_CHECK_NAMES) {
+      if (!repoSuppliedPaths.has(named))
+        continue;
+      issues.push(`${named}: must not come from a repository's .hmy.json while ${driver} is on — the named check IS the independent review on that driver, and it is also excluded from the collapsed CI verdict, so a repository choosing the name chooses both what counts as having read the diff and which red check the merge gate stops seeing. Two remedies: set it in your own ~/.hmy/agent/config.json (an operator naming their own checks is untouched), or drop the key from this repository's .hmy.json. Turning off "allowRepoOverrides" in your own config also drops it, at the cost of every other repo-supplied setting.`);
+    }
+  }
   if (autoMerge.interactive) {
     if (independent?.enabled === false) {
-      issues.push("review.autoMerge.independentReview.enabled: must be true while review.autoMerge.interactive is on — the interactive merge relaxes the Reviewed-SHA rule (no hmy card carries that marker), so the independent review is the only thing left that reads the diff, and nobody else is looking");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.independentReview.enabled: must be true while review.autoMerge.interactive is on — the interactive merge relaxes the Reviewed-SHA rule (no hmy card carries that marker), so the independent review is the only thing left that reads the diff, and nobody else is looking");
     }
     if (!autoMerge.reReviewOnBranchChange) {
-      issues.push("review.autoMerge.reReviewOnBranchChange: must be true while review.autoMerge.interactive is on — with the independent review off it is the only rule left that holds an interactive merge, and the interactive driver reads no Reviewed-SHA of its own");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.reReviewOnBranchChange: must be true while review.autoMerge.interactive is on — with the independent review off it is the only rule left that holds an interactive merge, and the interactive driver reads no Reviewed-SHA of its own");
     }
     if (independent?.enabled && independent.verdict?.enabled === false) {
-      issues.push("review.autoMerge.independentReview.verdict.enabled: must be true while review.autoMerge.interactive is on — the interactive driver reads no Reviewed-SHA of its own, so the verdict is the only remaining signal that a review approved the diff, and a green review check alone means the pass ran, not that it approved (#1018)");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.independentReview.verdict.enabled: must be true while review.autoMerge.interactive is on — the interactive driver reads no Reviewed-SHA of its own, so the verdict is the only remaining signal that a review approved the diff, and a green review check alone means the pass ran, not that it approved (#1018)");
     }
     const w = autoMerge.waitMinutes;
     if (!Number.isInteger(w) || w < 1 || w > 55) {
-      issues.push(`review.autoMerge.waitMinutes: must be an integer between 1 and 55 (got ${w}) — an interactive agent session goes stale at about an hour, and a command that outlives its session reports into nothing`);
+      armedRefusal("review.autoMerge.interactive", `review.autoMerge.waitMinutes: must be an integer between 1 and 55 (got ${w}) — an interactive agent session goes stale at about an hour, and a command that outlives its session reports into nothing`);
     }
   }
   if (typeof autoMerge.findingsLoop !== "boolean") {
@@ -1102,16 +1169,21 @@ function validateAutoMergeConfig(config) {
   }
   if (autoMerge.findingsLoop) {
     if (!autoMerge.interactive) {
-      issues.push("review.autoMerge.findingsLoop: needs review.autoMerge.interactive — the loop only runs on the interactive merge path, so armed alone it is inert rather than weaker");
+      inertCombination({
+        pin: "review.autoMerge.findingsLoop",
+        gate: "review.autoMerge.interactive",
+        issue: "review.autoMerge.findingsLoop: needs review.autoMerge.interactive — the loop only runs on the interactive merge path, so armed alone it is inert rather than weaker"
+      });
     }
     const findingAuthors = independent?.findingAuthors;
     if (!Array.isArray(findingAuthors) || findingAuthors.filter((a) => typeof a === "string" && a.trim()).length === 0) {
-      issues.push("review.autoMerge.independentReview.findingAuthors: must name at least one login while review.autoMerge.findingsLoop is on — it is the only thing separating the review's findings from every other commenter's text, and an empty list parks every round");
+      armedRefusal("review.autoMerge.findingsLoop", "review.autoMerge.independentReview.findingAuthors: must name at least one login while review.autoMerge.findingsLoop is on — it is the only thing separating the review's findings from every other commenter's text, and an empty list parks every round");
     }
   }
   if (issues.length > 0) {
     throw new ConfigValidationError(`Invalid agent config — ${issues.join("; ")}`, issues);
   }
+  return warnings;
 }
 function isLoopbackBindAddr(addr) {
   const value = addr.toLowerCase();
@@ -1333,8 +1405,9 @@ async function validateAndListColumns(client, projectId, config) {
   }
   return Array.from(new Set(names.filter(Boolean)));
 }
-var ConfigValidationError, REMOVED_CONFIG_KEYS;
+var ConfigValidationError, REMOVED_CONFIG_KEYS, NO_REPO_PATHS, REPO_UNSETTABLE_CHECK_NAMES, REPO_ARMABLE_GATES;
 var init_config_validation = __esm(() => {
+  init_config_merge();
   ConfigValidationError = class ConfigValidationError extends Error {
     issues;
     constructor(message, issues) {
@@ -1352,6 +1425,18 @@ var init_config_validation = __esm(() => {
       note: "review, auto-fix and deep-review are contained and pin their own sources"
     }
   ];
+  NO_REPO_PATHS = new Set;
+  REPO_UNSETTABLE_CHECK_NAMES = [
+    "review.autoMerge.independentReview.checkName",
+    "review.autoMerge.independentReview.verdict.checkName"
+  ];
+  REPO_ARMABLE_GATES = {
+    "review.autoMerge.independentReview.enabled": "tightening",
+    "review.autoMerge.interactive": "handshake",
+    "review.autoMerge.ciRepair.enabled": "handshake",
+    "review.autoMerge.ciRepair.patch.enabled": "handshake",
+    "review.autoMerge.findingsLoop": "handshake"
+  };
 });
 
 // src/paths.ts
@@ -1498,6 +1583,9 @@ var init_branchRef = __esm(() => {
   PR_LINK_PATTERN = /PR:\s*(https?:\/\/[^\s)]+)/;
 });
 
+// ../harmony-shared/dist/cardLifecycle.js
+var init_cardLifecycle = () => {};
+
 // ../harmony-shared/dist/cardLinks.js
 var init_cardLinks = () => {};
 
@@ -2986,6 +3074,7 @@ function untrustedDataBlock(text, options) {
 var init_dist = __esm(() => {
   init_agentStaleness();
   init_branchRef();
+  init_cardLifecycle();
   init_cardLinks();
   init_cardModelStat();
   init_classification();
@@ -3349,16 +3438,17 @@ var init_types2 = __esm(() => {
     },
     claude: {
       model: "claude-opus-5",
-      escalateModel: "claude-fable-5",
+      escalateModel: "claude-fable-5-1",
       escalateAfterAttempts: 2,
       tiers: {
         simple: "claude-sonnet-5",
         advanced: "claude-opus-5",
-        research: "claude-fable-5"
+        research: "claude-fable-5-1"
       },
       scoreBands: DEFAULT_SCORE_BANDS,
       sizingModel: "",
       reviewModel: "sonnet",
+      deepReviewModel: "sonnet",
       maxTurns: 240,
       reviewMaxTurns: 60,
       additionalArgs: []
@@ -3473,6 +3563,302 @@ var init_types2 = __esm(() => {
   NOTICE_IDENTIFIER = `${DAEMON_IDENTIFIER_BASE}-notice`;
 });
 
+// src/repo-agent-config.ts
+import { readFileSync } from "node:fs";
+import { findLocalConfigPath } from "@gethmy/mcp/src/config.js";
+function isNeverSettable(path) {
+  for (const banned of REPO_NEVER_SETTABLE) {
+    if (path === banned || path.startsWith(`${banned}.`))
+      return true;
+  }
+  return false;
+}
+function renderForWarning(value) {
+  const json = JSON.stringify(clampForRender(value)) ?? String(value);
+  const clean = json.replace(/\p{Cf}/gu, "").replace(/[\p{Cc}\u2028\u2029]/gu, " ");
+  if (clean.length <= MAX_RENDERED_LENGTH)
+    return clean;
+  const head = clean.slice(0, MAX_RENDERED_LENGTH).replace(/\\u[0-9a-fA-F]{0,3}$/, "").replace(/\\+$/, "").replace(/[\uD800-\uDBFF]$/, "");
+  const closer = clean.startsWith('"') ? '"' : "";
+  return `${head}…${closer} (truncated from ${clean.length} characters)`;
+}
+function clampForRender(value, depth = 0) {
+  if (Array.isArray(value)) {
+    if (depth >= MAX_RENDER_DEPTH)
+      return ELISION;
+    const kept = value.slice(0, MAX_RENDER_ENTRIES).map((item) => clampForRender(item, depth + 1));
+    if (value.length > MAX_RENDER_ENTRIES)
+      kept.push(ELISION);
+    return kept;
+  }
+  if (isPlainObject(value)) {
+    if (depth >= MAX_RENDER_DEPTH)
+      return ELISION;
+    const keys = Object.keys(value);
+    const out = Object.create(null);
+    for (const key of keys.slice(0, MAX_RENDER_ENTRIES)) {
+      out[key] = clampForRender(value[key], depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function describeParent(drop) {
+  return drop.parent ? ` inside ${renderForWarning(`agent.${drop.parent}`)}` : ` inside "agent"`;
+}
+function isOneSegment(key) {
+  return key.length > 0 && !key.includes(".") && !UNPRINTABLE.test(key);
+}
+function refuseValue(value, depth = 0) {
+  if (typeof value === "string") {
+    if (UNPRINTABLE.test(value))
+      return `A repo-supplied value may not hold a control or invisible character, and nothing in ${ALLOWED_PREFIX}* is spelled with one.`;
+    if (value.length > MAX_VALUE_LENGTH)
+      return `A repo-supplied value may be at most ${MAX_VALUE_LENGTH} characters, and this one is ${value.length}.`;
+    return null;
+  }
+  if (depth >= MAX_VALUE_DEPTH)
+    return `A repo-supplied value may not nest more than ${MAX_VALUE_DEPTH} levels deep.`;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const why = refuseValue(item, depth + 1);
+      if (why !== null)
+        return why;
+    }
+    return null;
+  }
+  if (isPlainObject(value)) {
+    for (const [key, item] of Object.entries(value)) {
+      const why = refuseValue(key, depth + 1) ?? refuseValue(item, depth + 1);
+      if (why !== null)
+        return why;
+    }
+    return null;
+  }
+  return null;
+}
+function flatten(value, prefix, out, dropped, depth = 0) {
+  if (!isPlainObject(value)) {
+    out.set(prefix, value);
+    return;
+  }
+  if (depth >= MAX_BLOCK_DEPTH) {
+    dropped.push({
+      path: prefix,
+      key: lastSegment(prefix),
+      parent: parentPath(prefix),
+      why: "depth"
+    });
+    return;
+  }
+  const keys = Object.keys(value);
+  if (keys.length === 0)
+    return;
+  for (const key of keys) {
+    const here = prefix ? `${prefix}.${key}` : key;
+    if (FORBIDDEN_KEYS.has(key)) {
+      dropped.push({ path: here, key, parent: prefix, why: "reserved" });
+      continue;
+    }
+    if (!isOneSegment(key)) {
+      dropped.push({
+        path: here,
+        key,
+        parent: prefix,
+        why: UNPRINTABLE.test(key) ? "unprintable" : "segment"
+      });
+      continue;
+    }
+    flatten(value[key], here, out, dropped, depth + 1);
+  }
+}
+function lastSegment(path) {
+  const at = path.lastIndexOf(".");
+  return at === -1 ? path : path.slice(at + 1);
+}
+function parentPath(path) {
+  const at = path.lastIndexOf(".");
+  return at === -1 ? "" : path.slice(0, at);
+}
+function setPath(target, path, value) {
+  const parts = path.split(".");
+  if (parts.some((part) => FORBIDDEN_KEYS.has(part) || !isOneSegment(part)))
+    return false;
+  let node = target;
+  for (const part of parts.slice(0, -1)) {
+    const existing = own(node, part);
+    if (!isPlainObject(existing))
+      node[part] = {};
+    node = node[part];
+  }
+  node[parts[parts.length - 1]] = value;
+  return true;
+}
+function describeDrop(pinPath, drop) {
+  switch (drop.why) {
+    case "reserved":
+      return `${pinPath}: ${renderForWarning(`agent.${drop.path}`)} uses a reserved JavaScript key name — ignoring it. Nothing in ${ALLOWED_PREFIX}* is spelled that way.`;
+    case "unprintable":
+      return `${pinPath}: ${renderForWarning(drop.key)} is not a setting name${describeParent(drop)} — ignoring it. A name may not hold a control or invisible character, and nothing in ${ALLOWED_PREFIX}* is spelled with one.`;
+    case "depth":
+      return `${pinPath}: ${renderForWarning(`agent.${drop.path}`)} nests more than ${MAX_BLOCK_DEPTH} blocks deep — ignoring it and everything under it. The deepest setting anything reads is ${ALLOWED_PREFIX}ciRepair.patch.enabled, which is 5 levels.`;
+    default:
+      return `${pinPath}: ${renderForWarning(drop.key)} is ONE key${describeParent(drop)}, not the nesting it looks like — ignoring it. Write a setting as real nesting: {"review": {"autoMerge": {"enabled": false}}}. A key must be a name, so it may not be empty and may not contain a ".".`;
+  }
+}
+function describeValue(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "a list";
+  if (isPlainObject(value))
+    return "a block of settings";
+  return `a ${typeof value}`;
+}
+function mismatchedPath(message) {
+  return message.slice(0, message.indexOf(" is "));
+}
+function readRepoAgentConfig(args) {
+  const nothing = {
+    overrides: {},
+    warnings: [],
+    suppliedPaths: new Set
+  };
+  const pinPath = findLocalConfigPath(args.repoRoot);
+  if (pinPath === null)
+    return nothing;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(pinPath, "utf-8"));
+  } catch {
+    return nothing;
+  }
+  if (!isPlainObject(parsed))
+    return nothing;
+  const warnings = [];
+  for (const key of Object.keys(parsed)) {
+    if (KNOWN_PIN_KEYS.includes(key))
+      continue;
+    warnings.push(`${pinPath}: ${renderForWarning(key)} is not a key anything reads — ignoring it. Known keys: ${KNOWN_PIN_KEYS.join(", ")}`);
+  }
+  const block = own(parsed, "agent");
+  if (block !== undefined && !isPlainObject(block)) {
+    warnings.push(`${pinPath}: "agent" is ${describeValue(block)} — it must be a block of ${ALLOWED_PREFIX}* settings. Ignoring it.`);
+  }
+  if (!isPlainObject(block))
+    return { overrides: {}, warnings, suppliedPaths: new Set };
+  const leaves = new Map;
+  const dropped = [];
+  flatten(block, "", leaves, dropped);
+  for (const drop of dropped) {
+    warnings.push(describeDrop(pinPath, drop));
+  }
+  const inScope = [];
+  const candidate = {};
+  for (const [path, value] of leaves) {
+    if (path === ALLOWED_BLOCK) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is ${describeValue(value)} — it must be a block of ${ALLOWED_PREFIX}* settings, so there is no setting here to read. Ignoring it.`);
+      continue;
+    }
+    if (!path.startsWith(ALLOWED_PREFIX)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is global config, not repo config — ignoring it. A repository may set ${ALLOWED_PREFIX}* and nothing else.`);
+      continue;
+    }
+    if (isNeverSettable(path)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is an EXECUTION parameter, not merge policy — ignoring it. It decides what the daemon RUNS on this machine (the container image a CI repair is verified in, and how long it may run), so it stays with identity, credentials, "pool" and "claude.*" in ${args.globalConfigPath}. "allowRepoOverrides" does not reach it.`);
+      continue;
+    }
+    const badValue = refuseValue(value);
+    if (badValue !== null) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} is not a value a repository may set — ignoring it. ${badValue}`);
+      continue;
+    }
+    if (!setPath(candidate, path, value)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} contains a reserved JavaScript key name — ignoring it. Nothing in ${ALLOWED_PREFIX}* is spelled that way.`);
+      continue;
+    }
+    inScope.push([path, value]);
+  }
+  const malformed = [];
+  for (const message of findConfigTypeMismatches(DEFAULT_AGENT_CONFIG, candidate)) {
+    warnings.push(`${pinPath}: ${message}`);
+    malformed.push(mismatchedPath(message).replace(/^agent\./, ""));
+  }
+  const kept = {};
+  const suppliedPaths = new Set;
+  for (const [path, value] of inScope) {
+    if (malformed.some((bad) => path === bad || path.startsWith(`${bad}.`)))
+      continue;
+    if (!args.allowRepoOverrides && FREE_VALUE.get(path) !== value) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} would LOOSEN this machine's merge policy — ignoring it. To honour it, set "allowRepoOverrides": true at the TOP LEVEL of ${args.globalConfigPath}, beside "apiKey" — inside the "agent" block it is read by nobody.`);
+      continue;
+    }
+    if (!setPath(kept, path, value))
+      continue;
+    suppliedPaths.add(path);
+    const named = NAMED_REVIEW_PATHS.get(path);
+    if (named !== undefined) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} — ${named.effect} Accepted because "allowRepoOverrides": true is set in ${args.globalConfigPath}.${named.extra ? ` ${named.extra}` : ""}`);
+    }
+  }
+  return {
+    overrides: kept,
+    warnings,
+    suppliedPaths
+  };
+}
+var KNOWN_PIN_KEYS, ALLOWED_PREFIX = "review.autoMerge.", ALLOWED_BLOCK, FREE_VALUE, REPO_NEVER_SETTABLE, MAX_RENDERED_LENGTH = 120, ELISION = "…", MAX_RENDER_DEPTH = 4, MAX_RENDER_ENTRIES = 20, NAMED_REVIEW_PATHS, UNPRINTABLE, MAX_VALUE_LENGTH = 200, MAX_VALUE_DEPTH = 8, MAX_BLOCK_DEPTH = 8;
+var init_repo_agent_config = __esm(() => {
+  init_config_merge();
+  init_types2();
+  KNOWN_PIN_KEYS = [
+    "workspaceId",
+    "projectId",
+    "commands",
+    "agent"
+  ];
+  ALLOWED_BLOCK = ALLOWED_PREFIX.slice(0, -1);
+  FREE_VALUE = new Map([
+    ["review.autoMerge.enabled", false],
+    ["review.autoMerge.interactive", false],
+    ["review.autoMerge.findingsLoop", false],
+    ["review.autoMerge.ciRepair.enabled", false],
+    ["review.autoMerge.ciRepair.patch.enabled", false],
+    ["review.autoMerge.requireGreenCi", true],
+    ["review.autoMerge.reReviewOnBranchChange", true],
+    ["review.autoMerge.independentReview.enabled", true],
+    ["review.autoMerge.independentReview.verdict.enabled", true]
+  ]);
+  REPO_NEVER_SETTABLE = new Set([
+    "review.autoMerge.ciRepair.patch.sandboxImage",
+    "review.autoMerge.ciRepair.patch.sandboxTimeoutMs"
+  ]);
+  NAMED_REVIEW_PATHS = new Map([
+    [
+      "review.autoMerge.independentReview.checkName",
+      {
+        effect: "this repository now decides which CI check stands for the independent review, and a name that resolves to an unrelated green check satisfies the merge gate with nothing having read the diff.",
+        extra: `While ${ALLOWED_PREFIX}interactive or ${ALLOWED_PREFIX}enabled is on, a repo-supplied check name is refused at startup.`
+      }
+    ],
+    [
+      "review.autoMerge.independentReview.verdict.checkName",
+      {
+        effect: "this repository now decides which CI check carries the independent review's VERDICT, and a name that resolves to an unrelated green check satisfies the merge gate with nothing having approved the diff.",
+        extra: `While ${ALLOWED_PREFIX}interactive or ${ALLOWED_PREFIX}enabled is on, a repo-supplied check name is refused at startup.`
+      }
+    ],
+    [
+      "review.autoMerge.independentReview.label",
+      {
+        effect: "this repository now decides which PR label asks CI for the independent review. It names no check and cannot stand in for one: a label CI does not act on means the review never arrives, so the merge gate HOLDS rather than opening.",
+        extra: "Nothing refuses it at startup, for that reason — unlike a repo-supplied check name."
+      }
+    ]
+  ]);
+  UNPRINTABLE = /[\p{Cc}\p{Cf}]/u;
+});
+
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
@@ -3484,11 +3870,11 @@ __export(exports_config, {
   createApiClient: () => createApiClient
 });
 import { execSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import { log as log5 } from "@gethmy/harness";
 import { HarmonyApiClient } from "@gethmy/mcp/src/api-client.js";
 import {
-  findLocalConfigPath,
+  findLocalConfigPath as findLocalConfigPath2,
   getActiveProjectId,
   getActiveWorkspaceId,
   getApiKey,
@@ -3500,9 +3886,9 @@ import {
 import { refreshOAuthToken } from "@gethmy/mcp/src/oauth-refresh.js";
 function readConfigFile() {
   try {
-    return readFileSync(configPath(), "utf-8");
+    return readFileSync2(configPath(), "utf-8");
   } catch {
-    const raw = readFileSync(legacyConfigPath(), "utf-8");
+    const raw = readFileSync2(legacyConfigPath(), "utf-8");
     if (!warnedLegacyConfigDir) {
       warnedLegacyConfigDir = true;
       log5.warn(TAG5, `Read the pre-#1082 config at ${legacyConfigPath()}. The current ` + `location is ${configPath()} — the daemon migrates it on its next ` + `\`run\`, and this fallback is temporary.`);
@@ -3556,22 +3942,37 @@ function loadDaemonConfig() {
   let agentName = "Harmony Agent";
   let agentIdentifier2 = "harmony-daemon";
   let agentColor = "#57b8a5";
+  let allowRepoOverrides = false;
   const configWarnings = [...contextWarnings];
   try {
     const raw = readConfigFile();
     const parsed = JSON.parse(raw);
     configWarnings.push(...findRemovedConfigKeys(parsed));
-    if (parsed.agent) {
-      agentOverrides = parsed.agent;
-    }
-    if (typeof parsed.agentName === "string" && parsed.agentName.trim())
-      agentName = parsed.agentName.trim();
-    if (typeof parsed.agentIdentifier === "string" && parsed.agentIdentifier.trim())
-      agentIdentifier2 = parsed.agentIdentifier.trim();
-    if (typeof parsed.agentColor === "string" && parsed.agentColor.trim())
-      agentColor = parsed.agentColor.trim();
+    const block = own(parsed, "agent");
+    if (block) {
+      agentOverrides = block;
+    }
+    const rawName = own(parsed, "agentName");
+    if (typeof rawName === "string" && rawName.trim())
+      agentName = rawName.trim();
+    const rawIdentifier = own(parsed, "agentIdentifier");
+    if (typeof rawIdentifier === "string" && rawIdentifier.trim())
+      agentIdentifier2 = rawIdentifier.trim();
+    const rawColor = own(parsed, "agentColor");
+    if (typeof rawColor === "string" && rawColor.trim())
+      agentColor = rawColor.trim();
+    if (own(parsed, "allowRepoOverrides") === true)
+      allowRepoOverrides = true;
   } catch {}
-  const agent = mergeAgentConfig(DEFAULT_AGENT_CONFIG, agentOverrides);
+  const repo = readRepoAgentConfig({
+    repoRoot,
+    globalConfigPath: contextSource.globalPath,
+    allowRepoOverrides
+  });
+  configWarnings.push(...repo.warnings);
+  const operatorAgent = mergeAgentConfig(DEFAULT_AGENT_CONFIG, agentOverrides);
+  const agent = mergeAgentConfig(operatorAgent, repo.overrides);
+  const repoArmedGates = repoArmedGatesOf(repo.suppliedPaths, operatorAgent, agent);
   configWarnings.push(...findConfigTypeMismatches(DEFAULT_AGENT_CONFIG, agentOverrides));
   if (agent.runner !== "cli" && agent.runner !== "sdk") {
     agent.runner = DEFAULT_AGENT_CONFIG.runner;
@@ -3588,13 +3989,16 @@ function loadDaemonConfig() {
     agentColor,
     agent,
     agentOverrides,
+    repoAgentOverrides: repo.overrides,
+    repoAgentPaths: repo.suppliedPaths,
+    repoArmedGates,
     contextSource,
     configWarnings
   };
 }
 function resolveContextSource(repoRoot) {
   const globalPath = getConfigPath();
-  const localPath = findLocalConfigPath(repoRoot);
+  const localPath = findLocalConfigPath2(repoRoot);
   if (localPath === null) {
     return {
       source: {
@@ -3648,6 +4052,7 @@ var init_config = __esm(() => {
   init_config_merge();
   init_config_validation();
   init_paths();
+  init_repo_agent_config();
   init_types2();
 });
 
@@ -4157,7 +4562,7 @@ import {
   mkdirSync as mkdirSync2,
   mkdtempSync,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   rmSync,
   statSync as statSync2,
   unlinkSync,
@@ -4234,7 +4639,7 @@ function sameBytes(a, b) {
       return false;
     if (sa.size > MAX_FILE_BYTES)
       return false;
-    return readFileSync2(a).equals(readFileSync2(b));
+    return readFileSync3(a).equals(readFileSync3(b));
   } catch {
     return false;
   }
@@ -4258,7 +4663,7 @@ function applyChanges(args) {
   for (const path of [...changes.modified, ...changes.added]) {
     const from = join3(scratch, path);
     const to = safeDestination(clean, path);
-    const bytes = readFileSync2(from);
+    const bytes = readFileSync3(from);
     if (bytes.byteLength > MAX_FILE_BYTES) {
       throw new Error(`the repair wrote ${path} at ${bytes.byteLength} bytes, over the ${MAX_FILE_BYTES} cap`);
     }
@@ -4315,7 +4720,8 @@ import {
   isPrUrlOnOrigin,
   log as log9,
   removeWorktreeHoldingBranch,
-  resolvePrHeadBranch
+  resolvePrHeadBranch,
+  shouldInstall
 } from "@gethmy/harness";
 function gitErrorDetail(err) {
   const e = err;
@@ -4372,6 +4778,8 @@ function checkoutExistingBranch(basePath, branchName, opts = {}) {
   } catch (err) {
     throw new Error(`Failed to create review worktree for ${branchName}: ${gitErrorDetail(err)}`);
   }
+  if (!shouldInstall(worktreeDir, opts.commands))
+    return worktreeDir;
   log9.info(TAG9, "Installing dependencies in review worktree...");
   try {
     execSync2(installCommand(opts.ignoreScripts !== false), {
@@ -4458,7 +4866,7 @@ var init_review_worktree = __esm(() => {
 // src/ci-patch.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 import {
   buildCommand,
@@ -4468,6 +4876,7 @@ import {
   GIT_NO_HOOKS as GIT_NO_HOOKS4,
   HARMONY_CREDENTIAL_KEYS,
   log as log10,
+  REPO_CONFIG_FILENAMES,
   runInSandbox,
   SdkAgentRunner,
   sandboxAvailable,
@@ -4559,7 +4968,10 @@ async function verifyInSandbox(worktree, config) {
     return null;
   }
   let ran = null;
-  for (const command of [buildCommand(worktree), testCommand(worktree)]) {
+  for (const command of [
+    buildCommand(worktree, config.commands),
+    testCommand(worktree, config.commands)
+  ]) {
     if (!command)
       continue;
     ran = command;
@@ -4593,7 +5005,7 @@ function commitRepair(worktree, card) {
 }
 function readGitPointer(worktree) {
   try {
-    return readFileSync3(join4(worktree, ".git"), "utf-8");
+    return readFileSync4(join4(worktree, ".git"), "utf-8");
   } catch {
     return null;
   }
@@ -4620,7 +5032,8 @@ async function repairBranch(deps) {
   let trees = null;
   try {
     worktree = checkoutExistingBranch(config.worktree.basePath, branch, {
-      ignoreScripts: true
+      ignoreScripts: true,
+      commands: config.commands
     });
     const baseSha = remoteSha(branch, worktree);
     if (!baseSha) {
@@ -4762,7 +5175,8 @@ var init_ci_patch = __esm(() => {
     /(^|\/)\.yarnrc\.ya?ml$/i,
     /(^|\/)\.tool-versions$/i,
     /(^|\/)\.gitattributes$/i,
-    /(^|\/)\.gitconfig$/i
+    /(^|\/)\.gitconfig$/i,
+    ...REPO_CONFIG_FILENAMES.map((name) => new RegExp(`(^|/)${name.replace(/\./g, "\\.")}$`, "i"))
   ];
 });
 
@@ -6478,7 +6892,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
     revertWarnings: []
   };
   if (config.verification.enabled && config.verification.lint) {
-    await runFormatFix(worktreePath, config.verification.timeout, workerId, verificationSandbox(config));
+    await runFormatFix(worktreePath, config.verification.timeout, workerId, verificationSandbox(config), config.commands);
   }
   commitUncommittedChanges(worktreePath, card);
   const hasCommits = checkHasCommits(worktreePath, config.worktree.baseBranch, runBaselineSha);
@@ -7447,7 +7861,7 @@ var init_prompt = __esm(() => {
 });
 
 // src/review-completion.ts
-import { readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
 import {
   cleanupWorktree as cleanupWorktree3,
   createPullRequest as createPullRequest2,
@@ -7529,7 +7943,7 @@ function tailRunLog(path, bytes = RUN_LOG_TAIL_BYTES) {
     if (size === 0)
       return null;
     const start = Math.max(0, size - bytes);
-    const buf = readFileSync4(path);
+    const buf = readFileSync5(path);
     return buf.subarray(start).toString("utf-8");
   } catch {
     return null;
@@ -8253,7 +8667,7 @@ __export(exports_state_store, {
 import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -8390,7 +8804,7 @@ class StateStore {
     if (!existsSync3(this.path))
       return emptyState();
     try {
-      const raw = readFileSync5(this.path, "utf-8");
+      const raw = readFileSync6(this.path, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed?.version !== SCHEMA_VERSION) {
         log26.warn(TAG23, `state file has version ${parsed?.version}, expected ${SCHEMA_VERSION} — migrating (preserving card budget/attempts, dropping in-flight runs)`);
@@ -9059,6 +9473,7 @@ import {
   buildGateCollectorRegistry,
   cleanupWorktree as cleanupWorktree4,
   collectGateEvidence,
+  DEV_SERVER_READY_TIMEOUT_MS,
   DevServerReadinessError,
   devServerLaunch,
   devServerSkipReason,
@@ -9322,7 +9737,7 @@ class ReviewWorker {
         }
         this.sessionId = reviewSession && typeof reviewSession === "object" && "id" in reviewSession ? reviewSession.id ?? null : null;
         const labelPromise = addLabelByName(this.client, card, "agent", "#8b5cf6");
-        this.worktreePath = checkoutExistingBranch(this.config.worktree.basePath, this.branchName);
+        this.worktreePath = checkoutExistingBranch(this.config.worktree.basePath, this.branchName, { commands: this.config.commands });
         await labelPromise;
       }
       if (this.aborted)
@@ -9845,14 +10260,15 @@ No verdict was produced, so this card has not been reviewed. The run's log is at
     }
   }
   async startDevServer(card, cwd, port) {
-    const declined = devServerSkipReason(cwd);
+    const declined = devServerSkipReason(cwd, this.config.commands);
     if (declined)
       return { previewUrl: null, skipReason: declined };
     log29.info(this.tag, `Starting dev server on port ${port}...`);
     const launch = devServerLaunch({
       worktreePath: cwd,
       port,
-      sandbox: verificationSandbox2(this.config)
+      sandbox: verificationSandbox2(this.config),
+      operator: this.config.commands
     });
     this.devServerContainer = launch.containerName ?? null;
     if (launch.containerName) {
@@ -9878,13 +10294,14 @@ No verdict was produced, so this card has not been reviewed. The run's log is at
       if (devServerSpawnError) {
         throw new DevServerReadinessError(`dev server failed to start (${launch.cmd}): ${devServerSpawnError.message}`);
       }
-      await waitForDevServer(this.devServerProcess, 30000);
+      await waitForDevServer(this.devServerProcess, DEV_SERVER_READY_TIMEOUT_MS);
       await probeDevServer(port);
     } catch (err) {
       this.killDevServer();
+      const failure = sanitizeCiText3(err instanceof Error ? err.message : String(err), REVIEW_FAILURE_REASON_MAX);
       return {
         previewUrl: null,
-        skipReason: sanitizeCiText3(err instanceof Error ? err.message : String(err), REVIEW_FAILURE_REASON_MAX)
+        skipReason: launch.origin ? `${launch.origin}, and ${failure}` : failure
       };
     }
     log29.info(this.tag, `Dev server ready on port ${port}`);
@@ -11257,7 +11674,7 @@ function workspaceConfigToPartial(ws) {
 }
 function resolveEffectiveAgentConfig(cfg, ws) {
   const withWorkspace = ws ? mergeAgentConfig(DEFAULT_AGENT_CONFIG, workspaceConfigToPartial(ws)) : DEFAULT_AGENT_CONFIG;
-  return mergeAgentConfig(withWorkspace, cfg.agentOverrides);
+  return mergeAgentConfig(mergeAgentConfig(withWorkspace, cfg.agentOverrides), cfg.repoAgentOverrides);
 }
 var init_workspace_model_config = __esm(() => {
   init_config_merge();
@@ -11750,7 +12167,8 @@ class Worker {
         }
         this.worktreePath = createWorktree(this.config.worktree.basePath, this.config.worktree.baseBranch, this.branchName, {
           continueExisting: target.continueExisting,
-          branchExistsOnOrigin: target.existsOnOrigin
+          branchExistsOnOrigin: target.existsOnOrigin,
+          commands: this.config.commands
         });
         this.runBaselineSha = readWorktreeHead(this.worktreePath);
       }
@@ -14424,7 +14842,7 @@ __export(exports_port_registry, {
 import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync as renameSync3,
   writeFileSync as writeFileSync4
 } from "node:fs";
@@ -14437,7 +14855,7 @@ function load(path) {
   if (!existsSync4(path))
     return {};
   try {
-    const raw = readFileSync6(path, "utf-8");
+    const raw = readFileSync7(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object")
       return parsed;
@@ -15889,7 +16307,11 @@ function contextSourceLine(config) {
   if (unreadablePin !== null) {
     return `all of it ${globalPath} (global) — ${unreadablePin} is present but UNREADABLE, so its pin was ignored`;
   }
-  return scope === "repo" ? `project+workspace ${path} (repo pin)  ·  all else ${globalPath}` : `all of it ${globalPath} (global; no repo pin found)`;
+  if (scope !== "repo") {
+    return `all of it ${globalPath} (global; no repo pin found)`;
+  }
+  const pinLabel = config.repoAgentPaths.size > 0 ? "repo pin, +auto-merge" : "repo pin";
+  return `project+workspace ${path} (${pinLabel})  ·  rest ${globalPath}`;
 }
 function titleRule(title) {
   const prefix = "─── ";
@@ -15930,7 +16352,7 @@ import {
   copyFileSync,
   existsSync as existsSync5,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
   writeFileSync as writeFileSync5
 } from "node:fs";
@@ -15952,7 +16374,7 @@ function atomicWriteJson(path, value) {
 }
 function readTargetFile(path) {
   try {
-    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     return parsed;
@@ -16006,7 +16428,7 @@ function migrateLegacyStateFile(opts) {
     return NO_MIGRATION;
   let legacy;
   try {
-    const parsed = JSON.parse(readFileSync7(legacyPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(legacyPath, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       throw new Error("not an object");
     legacy = parsed;
@@ -16535,7 +16957,7 @@ __export(exports_run_stats, {
   computeRunStats: () => computeRunStats,
   buildRunListRows: () => buildRunListRows
 });
-import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
 import { join as join8 } from "node:path";
 function runsDir2(base) {
   return runsDir(base);
@@ -16618,7 +17040,7 @@ function tailText(path, bytes = 4096) {
     const size = statSync4(path).size;
     if (size === 0)
       return "";
-    const buf = readFileSync8(path);
+    const buf = readFileSync9(path);
     const start = Math.max(0, size - bytes);
     let text = buf.subarray(start).toString("utf-8");
     if (start > 0) {
@@ -16640,7 +17062,7 @@ function grepRunLogs(files, pattern, opts = {}) {
       continue;
     let content;
     try {
-      content = readFileSync8(file.path, "utf-8");
+      content = readFileSync9(file.path, "utf-8");
     } catch {
       continue;
     }
@@ -17240,7 +17662,9 @@ async function main() {
     throw err;
   }
   try {
-    validateAutoMergeConfig(config.agent);
+    for (const warning of validateAutoMergeConfig(config.agent, config.repoAgentPaths, config.repoArmedGates)) {
+      banner.warn(warning);
+    }
     validateBudgetConfig(config.agent);
     validateSweepConfig(config.agent);
     validateRankingConfig(config.agent);
@@ -17618,14 +18042,14 @@ import { realpathSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname7, resolve as resolve5, sep as sep3 } from "node:path";
 import { GIT_NO_HOOKS as GIT_NO_HOOKS11 } from "@gethmy/harness";
 import {
-  findLocalConfigPath as findLocalConfigPath2,
+  findLocalConfigPath as findLocalConfigPath3,
   getLocalConfigPath,
   loadLocalConfig as loadLocalConfig2
 } from "@gethmy/mcp/src/config.js";
 function migrateLocalPin(cwd, opts = {}) {
   const here = resolve5(cwd ?? process.cwd());
   const boundary = opts.repoRoot ?? gitTopLevel(here) ?? here;
-  const found = findLocalConfigPath2(boundary);
+  const found = findLocalConfigPath3(boundary);
   if (found === null) {
     return { outcome: "no-pin", from: null, to: null };
   }
@@ -17700,11 +18124,23 @@ function realOrResolved(path) {
 }
 var init_local_pin_migration = () => {};
 
+// src/head-anchor.ts
+import { log as log52 } from "@gethmy/harness";
+function sealProvenHead(sha, provenance) {
+  if (!/^[0-9a-f]{40}$/.test(sha)) {
+    log52.warn(TAG48, `refusing to seal "${sha}" as a head anchor (${provenance}) — an anchor is compared against the pull request's own head for equality, so an abbreviated or malformed sha would read as a mismatch rather than as the unreadable head it is`);
+    return;
+  }
+  return sha;
+}
+var TAG48 = "head-anchor";
+var init_head_anchor = () => {};
+
 // src/merge-cleanup.ts
 import { execFileSync as execFileSync11 } from "node:child_process";
-import { existsSync as existsSync7, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync7, realpathSync as realpathSync2, statSync as statSync6 } from "node:fs";
 import { basename, dirname as dirname8, isAbsolute, resolve as resolve6, sep as sep4 } from "node:path";
-import { cleanupWorktree as cleanupWorktree6, GIT_NO_HOOKS as GIT_NO_HOOKS12, log as log52 } from "@gethmy/harness";
+import { cleanupWorktree as cleanupWorktree6, GIT_NO_HOOKS as GIT_NO_HOOKS12, log as log53 } from "@gethmy/harness";
 function canonicalize(p) {
   const original = isAbsolute(p) ? p : `${process.cwd()}${sep4}${p}`;
   try {
@@ -17731,36 +18167,97 @@ function cwdIsInsideWorktree(cwd, worktreePath) {
   const b = canonicalize(worktreePath);
   return a === b || a.startsWith(b + sep4);
 }
-function linkedWorktreePaths(cwd) {
+function worktreeRecords(cwd) {
   let listing;
   try {
     listing = execFileSync11("git", [...GIT_NO_HOOKS12, "worktree", "list", "--porcelain", "-z"], { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] });
   } catch {
     return null;
   }
-  return listing.split("\x00").filter((line) => line.startsWith("worktree ")).map((line) => line.slice("worktree ".length)).slice(1).map(canonicalize);
+  const records = [];
+  let current = null;
+  for (const field of listing.split("\x00")) {
+    if (field === "") {
+      current = null;
+      continue;
+    }
+    if (field.startsWith("worktree ")) {
+      current = {
+        path: canonicalize(field.slice("worktree ".length)),
+        bare: false
+      };
+      records.push(current);
+      continue;
+    }
+    if (current && field === "bare")
+      current.bare = true;
+  }
+  return records;
+}
+function mainWorktreePath(cwd) {
+  try {
+    const out = execFileSync11("git", [...GIT_NO_HOOKS12, "rev-parse", "--git-common-dir"], { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    if (!out)
+      return null;
+    return canonicalize(dirname8(resolve6(cwd, out)));
+  } catch {
+    return null;
+  }
 }
-function isRegisteredWorktree(worktreePath, cwd) {
+function linkedWorktreePaths(cwd) {
+  const records = worktreeRecords(cwd);
+  if (records === null)
+    return null;
+  if (records.some((r) => r.bare)) {
+    return records.filter((r) => !r.bare).map((r) => r.path);
+  }
+  const main2 = mainWorktreePath(cwd);
+  if (main2 !== null && records.some((r) => r.path === main2)) {
+    return records.filter((r) => r.path !== main2).map((r) => r.path);
+  }
+  log53.warn(TAG49, `could not identify the main working tree of ${cwd} by path (git derived ${main2 ?? "nothing"} from --git-common-dir, which names no worktree in the listing) — falling back to dropping the first record, which git documents as the main tree. A merge or cleanup that then refuses a worktree it should accept is this fallback, not a forged registration.`);
+  return records.slice(1).map((r) => r.path);
+}
+function sameDirectoryIgnoringCase(asked, registered) {
+  try {
+    const a = statSync6(asked);
+    const b = statSync6(registered);
+    return a.dev === b.dev && a.ino === b.ino;
+  } catch {
+    return false;
+  }
+}
+function classifyWorktreeRegistration(worktreePath, cwd) {
   const registered = linkedWorktreePaths(cwd);
   if (registered === null)
-    return false;
-  return registered.includes(canonicalize(worktreePath));
+    return { kind: "unanswerable" };
+  const asked = canonicalize(worktreePath);
+  if (registered.includes(asked))
+    return { kind: "registered" };
+  const folded = registered.find((p) => p !== asked && p.toLowerCase() === asked.toLowerCase() && sameDirectoryIgnoringCase(asked, p));
+  if (folded !== undefined) {
+    return { kind: "case-mismatch", registered: folded };
+  }
+  return { kind: "unregistered" };
+}
+function isRegisteredWorktree(worktreePath, cwd) {
+  return classifyWorktreeRegistration(worktreePath, cwd).kind === "registered";
 }
 function cleanupMergedWorktree(args) {
   if (!isRegisteredWorktree(args.worktreePath, args.cwd)) {
     const reason = `refusing to clean up ${args.worktreePath} — git does not list it as a ` + `worktree of the repository at ${args.cwd}, and removing a path git ` + `does not manage would be a recursive delete of an unknown directory. ` + `Pass the worktree path Step B5 created, and re-run from the ` + `repository root.`;
-    log52.warn(TAG48, reason);
+    log53.warn(TAG49, reason);
     return { removed: false, reason };
   }
   if (cwdIsInsideWorktree(args.cwd, args.worktreePath) || cwdIsInsideWorktree(process.cwd(), args.worktreePath)) {
     const reason = `refusing to clean up ${args.worktreePath} from inside it — the branch ` + `delete would run with a deleted cwd and fail silently. Re-run from the ` + `repository root.`;
-    log52.warn(TAG48, reason);
+    log53.warn(TAG49, reason);
     return { removed: false, reason };
   }
   cleanupWorktree6(args.worktreePath, args.branchName ?? undefined);
   return { removed: !existsSync7(args.worktreePath) };
 }
-var TAG48 = "merge-cleanup";
+var TAG49 = "merge-cleanup";
 var init_merge_cleanup = () => {};
 
 // src/merge-command.ts
@@ -17775,7 +18272,7 @@ import { resolve as resolve7 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 import {
   GIT_NO_HOOKS as GIT_NO_HOOKS13,
-  log as log53,
+  log as log54,
   resolvePrHeadBranch as resolvePrHeadBranch3
 } from "@gethmy/harness";
 function buildFindingsBlock(items) {
@@ -17802,7 +18299,7 @@ async function gitRevParse(what, at) {
 async function cwdIsRepositoryTopLevel(cwd) {
   const top = await gitRevParse("--show-toplevel", cwd);
   if (!top || realpathOr(top) !== realpathOr(cwd)) {
-    log53.warn(TAG49, `not reading a local head from ${cwd} — it is not the top level of a git checkout (git answered ${top ?? "nothing"}). Run merge from the repository root, or pass --worktree.`);
+    log54.warn(TAG50, `not reading a local head from ${cwd} — it is not the top level of a git checkout (git answered ${top ?? "nothing"}). Run merge from the repository root, or pass --worktree.`);
     return false;
   }
   const gitDir = await gitRevParse("--git-dir", cwd);
@@ -17814,7 +18311,7 @@ async function cwdIsRepositoryTopLevel(cwd) {
   }
   if (isRegisteredWorktree(cwd, cwd))
     return true;
-  log53.warn(TAG49, `not reading a local head from ${cwd} — git does not list it as a worktree of its own repository.`);
+  log54.warn(TAG50, `not reading a local head from ${cwd} — git does not list it as a worktree of its own repository.`);
   return false;
 }
 function realpathOr(p) {
@@ -17824,28 +18321,72 @@ function realpathOr(p) {
     return p;
   }
 }
-async function readValidatedWorktreeHead(worktreePath, cwd) {
-  if (worktreePath && !isRegisteredWorktree(worktreePath, cwd)) {
-    log53.warn(TAG49, `not reading a local head from ${worktreePath} — git does not list it as a worktree of the repository at ${cwd}. The merge will refuse: an interactive merge is only allowed for a head this run can prove it built.`);
-    return;
+async function checkedOutBranch(at) {
+  try {
+    const { stdout } = await execFileAsync2("git", [...GIT_NO_HOOKS13, "symbolic-ref", "--quiet", "--short", "HEAD"], { cwd: at });
+    const branch = stdout.trim();
+    return branch === "" ? null : branch;
+  } catch {
+    return null;
+  }
+}
+async function readValidatedWorktreeHead(deps) {
+  const { worktreePath, cwd } = deps;
+  if (worktreePath) {
+    const registration = classifyWorktreeRegistration(worktreePath, cwd);
+    if (registration.kind !== "registered") {
+      const detail = registration.kind === "case-mismatch" ? ` The worktree ${worktreePath} is the same directory as the registered ${registration.registered} and differs from it only in case, but git's registration carries the spelling above and this merge matches it exactly. Pass the registered spelling.` : registration.kind === "unanswerable" ? ` The worktree registrations of ${cwd} could not be listed at all, so ${worktreePath} could not be proved to be one of them.` : ` No validated worktree HEAD was available for ${worktreePath} — git does not list it as a worktree of the repository at ${cwd} — so the merge could not be bound to the head this run built and held for a person.`;
+      log54.warn(TAG50, `not reading a local head from ${worktreePath} (${registration.kind}).${detail} The merge will refuse: an interactive merge is only allowed for a head this run can prove it built.`);
+      return { sha: undefined, detail };
+    }
+  }
+  if (!worktreePath && !await cwdIsRepositoryTopLevel(cwd)) {
+    return {
+      sha: undefined,
+      detail: ` No validated local HEAD was available: no --worktree was passed, and ${cwd} is not the top level of a checkout of this repository. The merge could not be bound to the head this run built and held for a person.`
+    };
   }
-  if (!worktreePath && !await cwdIsRepositoryTopLevel(cwd))
-    return;
   const readAt = worktreePath ?? cwd;
-  const sha = await gitRevParse("HEAD", readAt);
-  if (sha && /^[0-9a-f]{40}$/.test(sha))
-    return sha;
-  log53.warn(TAG49, `could not read a HEAD sha from ${readAt} (git answered ${sha ? `"${sha}"` : "nothing"}) — the merge will refuse, since it can only run for a head this run can prove it built`);
-  return;
+  const raw = await gitRevParse("HEAD", readAt);
+  const sha = raw ? sealProvenHead(raw, worktreePath ? "registered-worktree" : "repository-top-level") : undefined;
+  if (!sha) {
+    log54.warn(TAG50, `could not read a HEAD sha from ${readAt} (git answered ${raw ? `"${raw}"` : "nothing"}) — the merge will refuse, since it can only run for a head this run can prove it built`);
+    return {
+      sha: undefined,
+      detail: ` No HEAD sha could be read from ${readAt}, so the merge could not be bound to the head this run built and held for a person.`
+    };
+  }
+  if (worktreePath) {
+    const resolved = await resolvePrHeadBranch3(deps.prUrl, cwd, deps.provider);
+    if (resolved.kind === "skip") {
+      log54.warn(TAG50, `not corroborating ${worktreePath} against the head branch of ${deps.prUrl}: ${resolved.reason}. The anchor stands on the head sha alone.`);
+    } else {
+      const branch = await checkedOutBranch(worktreePath);
+      if (branch === null) {
+        log54.warn(TAG50, `${worktreePath} has no branch checked out (detached HEAD), so it could not be corroborated against ${resolved.branch}. The anchor stands on the head sha alone.`);
+      } else if (branch !== resolved.branch) {
+        const detail = ` The worktree ${worktreePath} is on "${branch}", and ${deps.prUrl} has "${resolved.branch}" as its head branch — so that worktree is not where this pull request was built. --worktree is composed from a model's memory of the Step B5 path, which is why it is checked against the pull request and not only against git.`;
+        log54.warn(TAG50, `refusing the anchor from ${worktreePath}.${detail}`);
+        return { sha: undefined, detail };
+      }
+    }
+  }
+  return { sha, detail: "" };
 }
 async function runMergeCommand(deps) {
   const waitMs = deps.config.review.autoMerge.waitMinutes * 60000;
   const started = deps.now();
   let requestedReview = false;
-  const localHeadSha = await readValidatedWorktreeHead(deps.worktreePath, deps.cwd);
+  const anchor = await readValidatedWorktreeHead({
+    worktreePath: deps.worktreePath,
+    cwd: deps.cwd,
+    prUrl: deps.prUrl,
+    provider: deps.provider
+  });
+  const localHeadSha = anchor.sha;
   let base = null;
   let prHead = null;
-  const anchorDetail = localHeadSha ? "" : deps.worktreePath ? ` No validated worktree HEAD was available for ${deps.worktreePath}, so the merge could not be bound to the head this run built and held for a person.` : ` No validated local HEAD was available: no --worktree was passed, and ${deps.cwd} is not the top level of a checkout of this repository. The merge could not be bound to the head this run built and held for a person.`;
+  const anchorDetail = anchor.detail;
   for (;; ) {
     const findings = [];
     let outcome;
@@ -17875,7 +18416,7 @@ async function runMergeCommand(deps) {
       });
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      log53.warn(TAG49, `merge attempt failed: ${detail}`);
+      log54.warn(TAG50, `merge attempt failed: ${detail}`);
       deps.emit({
         type: "parked",
         reason: `the merge attempt failed: ${detail}`
@@ -17896,7 +18437,7 @@ async function runMergeCommand(deps) {
     if (outcome === "report-findings") {
       const reported = findings[0];
       if (!reported) {
-        log53.warn(TAG49, "the merge reported findings but none arrived through the callback — parking rather than reporting an empty list");
+        log54.warn(TAG50, "the merge reported findings but none arrived through the callback — parking rather than reporting an empty list");
         deps.emit({
           type: "parked",
           reason: "the independent review posted blocking findings, but they could not be reported — the card stays in Review for a person"
@@ -17946,7 +18487,7 @@ async function branchRefGone(branchName, cwd) {
     const stderr = String(failure.stderr ?? "").trim();
     if (failure.code === 1 && !stderr)
       return true;
-    log53.warn(TAG49, `could not determine whether ${branchName} still exists (code=${String(failure.code)}${stderr ? `, ${stderr}` : ""}) — reporting it as possibly present`);
+    log54.warn(TAG50, `could not determine whether ${branchName} still exists (code=${String(failure.code)}${stderr ? `, ${stderr}` : ""}) — reporting it as possibly present`);
     return false;
   }
 }
@@ -17957,7 +18498,7 @@ async function finish(deps) {
       const resolved = await resolvePrHeadBranch3(deps.prUrl, deps.cwd, deps.provider);
       const branch = resolved.kind === "branch" ? resolved.branch : null;
       if (resolved.kind === "skip") {
-        log53.warn(TAG49, `no head branch for ${deps.prUrl}: ${resolved.reason}`);
+        log54.warn(TAG50, `no head branch for ${deps.prUrl}: ${resolved.reason}`);
       }
       const out = cleanupMergedWorktree({
         worktreePath,
@@ -17966,12 +18507,12 @@ async function finish(deps) {
       });
       if (!out.removed) {
         const reason = out.reason ?? "the worktree directory still exists after cleanup";
-        log53.warn(TAG49, `cleanup refused for ${worktreePath}: ${reason}`);
+        log54.warn(TAG50, `cleanup refused for ${worktreePath}: ${reason}`);
         deps.emit({ type: "cleanup_refused", worktree: worktreePath, reason });
       } else {
         const branchGone = branch ? await branchRefGone(branch, deps.cwd) : true;
         if (branch && !branchGone) {
-          log53.warn(TAG49, `local branch ${branch} may still exist after cleanup`);
+          log54.warn(TAG50, `local branch ${branch} may still exist after cleanup`);
         }
         deps.emit({
           type: "cleaned",
@@ -17981,7 +18522,7 @@ async function finish(deps) {
       }
     } catch (err) {
       const detail = err instanceof Error ? err.message : String(err);
-      log53.warn(TAG49, `worktree cleanup failed for ${worktreePath}: ${detail}`);
+      log54.warn(TAG50, `worktree cleanup failed for ${worktreePath}: ${detail}`);
       deps.emit({
         type: "cleanup_refused",
         worktree: worktreePath,
@@ -17999,19 +18540,20 @@ async function finish(deps) {
     });
     if (!out.moved) {
       const reason = out.reason ?? "the card could not be moved out of Review";
-      log53.warn(TAG49, `board not updated after merge: ${reason}`);
+      log54.warn(TAG50, `board not updated after merge: ${reason}`);
       deps.emit({ type: "board_incomplete", reason });
     }
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    log53.warn(TAG49, `board not updated after merge: ${detail}`);
+    log54.warn(TAG50, `board not updated after merge: ${detail}`);
     deps.emit({ type: "board_incomplete", reason: detail });
   }
 }
-var TAG49 = "merge-command", POLL_INTERVAL_MS = 30000, execFileAsync2, KEEP_WAITING, PARK_REASONS;
+var TAG50 = "merge-command", POLL_INTERVAL_MS = 30000, execFileAsync2, KEEP_WAITING, PARK_REASONS;
 var init_merge_command = __esm(() => {
   init_dist();
   init_auto_merge();
+  init_head_anchor();
   init_merge_cleanup();
   init_merge_complete();
   execFileAsync2 = promisify2(execFile2);
@@ -18033,10 +18575,118 @@ var init_merge_command = __esm(() => {
   };
 });
 
+// src/scan-commands.ts
+var exports_scan_commands = {};
+__export(exports_scan_commands, {
+  scanCommandsCommand: () => scanCommandsCommand
+});
+import { existsSync as existsSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename2, join as join9 } from "node:path";
+import {
+  REPO_COMMAND_KEYS,
+  REPO_CONFIG_FILENAMES as REPO_CONFIG_FILENAMES2,
+  renderScanProposal,
+  scanRepoCommands
+} from "@gethmy/harness";
+async function scanCommandsCommand(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const out = opts.out ?? ((line) => process.stdout.write(`${line}
+`));
+  const scan = await scanRepoCommands(cwd);
+  out(renderScanProposal(scan));
+  out("");
+  if (!opts.write) {
+    out(`Nothing was written. Re-run with --write to merge this into ${basename2(existingPinPath(cwd))}.`);
+    return 0;
+  }
+  try {
+    const path = writeProposal(cwd, scan);
+    out(`Wrote the commands block to ${path}.`);
+    out("Commit it: a pin git ignores exists in your working directory and in no worktree the daemon cuts.");
+    return 0;
+  } catch (err) {
+    out(`Could not write ${existingPinPath(cwd)}: ${err instanceof Error ? err.message : err}`);
+    return 1;
+  }
+}
+function writeProposal(cwd, scan) {
+  const path = existingPinPath(cwd);
+  let existing = {};
+  try {
+    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      existing = parsed;
+    }
+  } catch {}
+  const merged = {
+    ...existing,
+    commands: { ...unscannedCommands(existing, scan), ...scan.proposal }
+  };
+  writeFileSync7(path, `${JSON.stringify(merged, null, indentOf(cwd))}
+`);
+  return path;
+}
+function existingPinPath(cwd) {
+  for (const name of REPO_CONFIG_FILENAMES2) {
+    const candidate = join9(cwd, name);
+    if (existsSync8(candidate))
+      return candidate;
+  }
+  return join9(cwd, PIN_FILENAME);
+}
+function unscannedCommands(existing, scan) {
+  const before = existing.commands;
+  if (!before || typeof before !== "object" || Array.isArray(before))
+    return {};
+  const carried = {};
+  for (const key of REPO_COMMAND_KEYS) {
+    if (key in scan.proposal)
+      continue;
+    if (Object.hasOwn(before, key)) {
+      carried[key] = before[key];
+    }
+  }
+  return carried;
+}
+function indentOf(cwd) {
+  for (const name of ["biome.json", "biome.jsonc"]) {
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync10(join9(cwd, name), "utf-8").replace(/^\s*\/\/.*$/gm, "").replace(/,(\s*[}\]])/g, "$1"));
+    } catch {
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object")
+      continue;
+    const formatter = parsed.formatter;
+    if (formatter?.indentStyle === "space") {
+      const width = formatter.indentWidth;
+      return typeof width === "number" && width > 0 ? width : 2;
+    }
+    return "\t";
+  }
+  try {
+    const editorconfig = readFileSync10(join9(cwd, ".editorconfig"), "utf-8");
+    if (/^\s*indent_style\s*=\s*tab\s*$/im.test(editorconfig))
+      return "\t";
+    const size = editorconfig.match(/^\s*indent_size\s*=\s*(\d+)\s*$/im);
+    if (size) {
+      const width = Number(size[1]);
+      if (width > 0)
+        return width;
+    }
+  } catch {}
+  return 2;
+}
+var PIN_FILENAME;
+var init_scan_commands = __esm(() => {
+  [PIN_FILENAME] = REPO_CONFIG_FILENAMES2;
+});
+
 // src/cli.ts
 import { realpathSync as realpathSync4 } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { log as log54 } from "@gethmy/harness";
+import { log as log55 } from "@gethmy/harness";
 var USAGE = `
 Harmony Agent — push-based daemon + ops toolkit.
 
@@ -18058,6 +18708,11 @@ Usage:
                                    to .hmy.json. The old file is KEPT. Exit 1
                                    means the preflight failed OR --fix was
                                    refused; the message says which.
+  harmony-agent scan-commands [--write]
+                                   Propose this repo's .hmy.json commands block
+                                   by RUNNING each candidate. Prints only;
+                                   --write merges it into the pin. A repo with
+                                   no dev server is a clean result, not an error.
   harmony-agent gc                 One-shot worktree garbage collection
   harmony-agent recover            One-shot recovery of stranded Review cards
   harmony-agent merge --card N [--worktree PATH]
@@ -18293,7 +18948,10 @@ async function doctorCommand() {
   const fixCode = process.argv.includes("--fix") ? await fixLocalPinCommand() : 0;
   try {
     const config = loadDaemonConfig2();
-    validateAutoMergeConfig2(config.agent);
+    for (const warning of validateAutoMergeConfig2(config.agent, config.repoAgentPaths, config.repoArmedGates)) {
+      process.stderr.write(`preflight warning: ${warning}
+`);
+    }
     validateBudgetConfig2(config.agent);
     validateSweepConfig2(config.agent);
     validateRankingConfig2(config.agent);
@@ -18311,11 +18969,11 @@ async function doctorCommand() {
   }
 }
 async function openStateStoreForOps() {
-  const { existsSync: existsSync8 } = await import("node:fs");
+  const { existsSync: existsSync9 } = await import("node:fs");
   const { resolveProjectIdForOps: resolveProjectIdForOps2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const { defaultStatePath: defaultStatePath2, StateStore: StateStore2 } = await Promise.resolve().then(() => (init_state_store(), exports_state_store));
   const projectId = resolveProjectIdForOps2();
-  if (projectId && existsSync8(defaultStatePath2(projectId))) {
+  if (projectId && existsSync9(defaultStatePath2(projectId))) {
     return StateStore2.open({ projectId });
   }
   return StateStore2.open();
@@ -18418,6 +19076,10 @@ merge: accepts ${[...MERGE_FLAGS].join(" ")}
   }
   const { loadDaemonConfig: loadDaemonConfig2, createApiClient: createApiClient2 } = await Promise.resolve().then(() => (init_config(), exports_config));
   const config = loadDaemonConfig2();
+  for (const warning of config.configWarnings) {
+    process.stderr.write(`merge: warning: ${warning}
+`);
+  }
   if (!config.agent.review.autoMerge.interactive) {
     process.stdout.write(`${JSON.stringify({ type: "disabled" })}
 `);
@@ -18425,7 +19087,10 @@ merge: accepts ${[...MERGE_FLAGS].join(" ")}
   }
   const { validateAutoMergeConfig: validateAutoMergeConfig2, ConfigValidationError: ConfigValidationError2 } = await Promise.resolve().then(() => (init_config_validation(), exports_config_validation));
   try {
-    validateAutoMergeConfig2(config.agent);
+    for (const warning of validateAutoMergeConfig2(config.agent, config.repoAgentPaths, config.repoArmedGates)) {
+      process.stderr.write(`merge: warning: ${warning}
+`);
+    }
   } catch (err) {
     if (!(err instanceof ConfigValidationError2))
       throw err;
@@ -18601,8 +19266,8 @@ async function runsShowCommand(rest) {
 `);
   let content;
   try {
-    const { readFileSync: readFileSync9 } = await import("node:fs");
-    content = readFileSync9(logFile.path, "utf-8");
+    const { readFileSync: readFileSync11 } = await import("node:fs");
+    content = readFileSync11(logFile.path, "utf-8");
   } catch (err) {
     process.stderr.write(`could not read log: ${err instanceof Error ? err.message : err}
 `);
@@ -18765,6 +19430,10 @@ async function dispatch(argv) {
       return healthCommand();
     case "doctor":
       return doctorCommand();
+    case "scan-commands": {
+      const { scanCommandsCommand: scanCommandsCommand2 } = await Promise.resolve().then(() => (init_scan_commands(), exports_scan_commands));
+      return scanCommandsCommand2({ write: args.includes("--write") });
+    }
     case "gc":
       return gcCommand();
     case "recover":
@@ -18803,7 +19472,7 @@ if (isMainModule()) {
     if (code !== 0)
       process.exit(code);
   }).catch((err) => {
-    log54.error("cli", err instanceof Error ? err.message : String(err));
+    log55.error("cli", err instanceof Error ? err.message : String(err));
     process.exit(1);
   });
 }