@gethmy/agent 1.39.0 → 1.40.0

package/dist/index.js

@@ -851,6 +851,9 @@ function buildGaveUpComment(maxAttempts, failures, pauseEnabled) {
 function mergeAgentConfig(defaults, overrides) {
   return mergeObjects(defaults, overrides);
 }
+function own(source, key) {
+  return Object.hasOwn(source, key) ? source[key] : undefined;
+}
 function isPlainObject(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -863,7 +866,7 @@ function mergeObjects(base, override) {
   for (const key of Object.keys(base)) {
     if (FORBIDDEN_KEYS.has(key))
       continue;
-    result[key] = mergeValue(base[key], override[key]);
+    result[key] = mergeValue(base[key], own(override, key));
   }
   for (const key of Object.keys(override)) {
     if (FORBIDDEN_KEYS.has(key))
@@ -902,7 +905,7 @@ function walk(base, override, path, found) {
     if (FORBIDDEN_KEYS.has(key))
       continue;
     const baseValue = base[key];
-    const overrideValue = override[key];
+    const overrideValue = own(override, key);
     if (overrideValue === undefined)
       continue;
     const here = `${path}.${key}`;
@@ -947,7 +950,11 @@ function copy(value) {
 }
 var FORBIDDEN_KEYS;
 var init_config_merge = __esm(() => {
-  FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+  FORBIDDEN_KEYS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype"
+  ]);
 });
 
 // src/config-validation.ts
@@ -962,8 +969,10 @@ __export(exports_config_validation, {
   validateBudgetConfig: () => validateBudgetConfig,
   validateAutoMergeConfig: () => validateAutoMergeConfig,
   validateAndListColumns: () => validateAndListColumns,
+  repoArmedGatesOf: () => repoArmedGatesOf,
   isLoopbackBindAddr: () => isLoopbackBindAddr,
   findRemovedConfigKeys: () => findRemovedConfigKeys,
+  REPO_ARMABLE_GATES: () => REPO_ARMABLE_GATES,
   REMOVED_CONFIG_KEYS: () => REMOVED_CONFIG_KEYS,
   ConfigValidationError: () => ConfigValidationError
 });
@@ -978,7 +987,7 @@ function findRemovedConfigKeys(rawConfig) {
         cursor = undefined;
         break;
       }
-      cursor = cursor[segment];
+      cursor = own(cursor, segment);
     }
     if (cursor !== undefined) {
       found.push(`${path} is no longer used (#988) — ${note}. Remove it.`);
@@ -1011,9 +1020,49 @@ function validateVerificationConfig(config) {
   - `)}`, issues);
   }
 }
-function validateAutoMergeConfig(config) {
+function repoArmedGatesOf(suppliedPaths, operatorAgent, merged) {
+  const armed = new Set;
+  for (const gate of Object.keys(REPO_ARMABLE_GATES)) {
+    if (!suppliedPaths.has(gate))
+      continue;
+    if (ownValueAt(operatorAgent, gate))
+      continue;
+    if (ownValueAt(merged, gate) !== true)
+      continue;
+    armed.add(gate);
+  }
+  return armed;
+}
+function ownValueAt(root, dotted) {
+  let cursor = root;
+  for (const segment of dotted.split(".")) {
+    if (cursor === null || typeof cursor !== "object" || !Object.hasOwn(cursor, segment)) {
+      return;
+    }
+    cursor = cursor[segment];
+  }
+  return cursor;
+}
+function armedByRepoPin(gate) {
+  if (REPO_ARMABLE_GATES[gate] === "tightening") {
+    return `This repository's .hmy.json sets "${gate}", and your own config had that gate off — so the repository is what makes this rule apply at all. It is a tightening, so the repository may set it without your "allowRepoOverrides", and your own config was legal until you cloned this checkout. Two remedies: drop "${gate}" from this repository's .hmy.json, or give the key this message names a usable value in ~/.hmy/agent/config.json — which keeps the gate armed, as the repository asked, unless the pin supplies that key too (it is the top rung, and any key it supplied is named in the warnings above).`;
+  }
+  return `This repository's .hmy.json sets "${gate}", and your own config had it off — so the repository is what makes this rule apply at all. That is a loosening, accepted only because your ~/.hmy/agent/config.json sets "allowRepoOverrides": true, and your own config was legal until you cloned this checkout. Two remedies: drop "${gate}" from this repository's .hmy.json, or turn "allowRepoOverrides" off in your own config, which drops every repo-supplied loosening at once. To keep what the repository asked for instead, satisfy the rule this message opens with — unless this repository's .hmy.json supplies that key as well, in which case only the two remedies above can help, because the pin is the top rung.`;
+}
+function validateAutoMergeConfig(config, repoSuppliedPaths = NO_REPO_PATHS, repoArmedGates = NO_REPO_PATHS) {
   const autoMerge = config.review.autoMerge;
   const issues = [];
+  const warnings = [];
+  const armedRefusal = (gate, issue) => {
+    issues.push(repoArmedGates.has(gate) ? `${issue}. ${armedByRepoPin(gate)}` : issue);
+  };
+  const inertCombination = (args) => {
+    if (repoSuppliedPaths.has(args.gate)) {
+      warnings.push(`${args.pin} is inert here: this repository's .hmy.json sets ${args.gate}, and ${args.pin} only runs behind it. The repository's tightening wins — your own config is not wrong, and nothing else is switched off.`);
+      return;
+    }
+    armedRefusal(args.pin, args.issue);
+  };
   const valid = ["squash", "merge", "rebase"];
   const s = autoMerge.strategy;
   if (!valid.includes(s)) {
@@ -1022,34 +1071,44 @@ function validateAutoMergeConfig(config) {
   const repair = autoMerge.ciRepair;
   if (repair.enabled) {
     if (!autoMerge.enabled) {
-      issues.push("review.autoMerge.ciRepair.enabled: needs review.autoMerge.enabled — a repair only runs on a card the daemon would merge itself");
+      inertCombination({
+        pin: "review.autoMerge.ciRepair.enabled",
+        gate: "review.autoMerge.enabled",
+        issue: "review.autoMerge.ciRepair.enabled: needs review.autoMerge.enabled — a repair only runs on a card the daemon would merge itself"
+      });
     }
     if (!autoMerge.requireGreenCi) {
-      issues.push("review.autoMerge.ciRepair.enabled: needs review.autoMerge.requireGreenCi — without it a red CI never reaches the repair branch, so the loop can never run");
+      armedRefusal("review.autoMerge.ciRepair.enabled", "review.autoMerge.ciRepair.enabled: needs review.autoMerge.requireGreenCi — without it a red CI never reaches the repair branch, so the loop can never run");
     }
     if (!Number.isInteger(repair.maxAttempts) || repair.maxAttempts < 1) {
-      issues.push(`review.autoMerge.ciRepair.maxAttempts: must be an integer >= 1 (got ${repair.maxAttempts}) — the cap is the safety property and has no opt-out`);
+      armedRefusal("review.autoMerge.ciRepair.enabled", `review.autoMerge.ciRepair.maxAttempts: must be an integer >= 1 (got ${repair.maxAttempts}) — the cap is the safety property and has no opt-out`);
     }
   }
   const patch = repair.patch;
   if (patch?.enabled) {
     if (!repair.enabled) {
-      issues.push("review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.ciRepair.enabled — the repair runs inside the loop that cap, park latch and ownership re-read belong to");
+      inertCombination({
+        pin: "review.autoMerge.ciRepair.patch.enabled",
+        gate: "review.autoMerge.ciRepair.enabled",
+        issue: "review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.ciRepair.enabled — the repair runs inside the loop that cap, park latch and ownership re-read belong to"
+      });
     }
     if (!autoMerge.reReviewOnBranchChange) {
-      issues.push("review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.reReviewOnBranchChange — without it a machine-authored repair could merge with nothing having reviewed its diff");
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", "review.autoMerge.ciRepair.patch.enabled: needs review.autoMerge.reReviewOnBranchChange — without it a machine-authored repair could merge with nothing having reviewed its diff");
     }
-    issues.push(...sandboxConfigIssues({
+    for (const issue of sandboxConfigIssues({
       image: patch.sandboxImage,
       timeoutMs: patch.sandboxTimeoutMs,
       imagePath: "review.autoMerge.ciRepair.patch.sandboxImage",
       timeoutPath: "review.autoMerge.ciRepair.patch.sandboxTimeoutMs"
-    }));
+    })) {
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", issue);
+    }
     if (!Number.isInteger(patch.maxTurns) || patch.maxTurns < 1) {
-      issues.push(`review.autoMerge.ciRepair.patch.maxTurns: must be an integer >= 1 (got ${patch.maxTurns})`);
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", `review.autoMerge.ciRepair.patch.maxTurns: must be an integer >= 1 (got ${patch.maxTurns})`);
     }
     if (!(patch.maxBudgetUsd > 0)) {
-      issues.push(`review.autoMerge.ciRepair.patch.maxBudgetUsd: must be greater than 0 (got ${patch.maxBudgetUsd})`);
+      armedRefusal("review.autoMerge.ciRepair.patch.enabled", `review.autoMerge.ciRepair.patch.maxBudgetUsd: must be greater than 0 (got ${patch.maxBudgetUsd})`);
     }
   }
   const independent = autoMerge.independentReview;
@@ -1058,38 +1117,46 @@ function validateAutoMergeConfig(config) {
   }
   if (independent?.enabled) {
     if (typeof independent.checkName !== "string" || !independent.checkName.trim()) {
-      issues.push("review.autoMerge.independentReview.checkName: must name a non-empty check — an unmatched name reads as no review at all and holds every merge");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.checkName: must name a non-empty check — an unmatched name reads as no review at all and holds every merge");
     }
     if (typeof independent.label !== "string" || !independent.label.trim()) {
-      issues.push("review.autoMerge.independentReview.label: must name the PR label that requests a CI review");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.label: must name the PR label that requests a CI review");
     }
     const verdict = independent.verdict;
     if (typeof verdict?.enabled !== "boolean") {
-      issues.push(`review.autoMerge.independentReview.verdict.enabled: must be true or false (got ${JSON.stringify(verdict?.enabled)}) — an absent value would switch this safety gate off without saying so`);
+      armedRefusal("review.autoMerge.independentReview.enabled", `review.autoMerge.independentReview.verdict.enabled: must be true or false (got ${JSON.stringify(verdict?.enabled)}) — an absent value would switch this safety gate off without saying so`);
     }
     if (typeof verdict?.checkName !== "string" || !verdict.checkName.trim()) {
-      issues.push("review.autoMerge.independentReview.verdict.checkName: must name a non-empty check even when verdict.enabled is false — the name keeps that check out of the collapsed CI verdict, so a blank one turns a review finding into a red build");
+      armedRefusal("review.autoMerge.independentReview.enabled", "review.autoMerge.independentReview.verdict.checkName: must name a non-empty check even when verdict.enabled is false — the name keeps that check out of the collapsed CI verdict, so a blank one turns a review finding into a red build");
     }
     if (typeof independent.checkName === "string" && typeof verdict?.checkName === "string" && independent.checkName.trim().toLowerCase() === verdict.checkName.trim().toLowerCase() && independent.checkName.trim()) {
-      issues.push(`review.autoMerge.independentReview.verdict.checkName: must not be the same check as independentReview.checkName ("${independent.checkName}") — one says a review RAN and the other says what it concluded, and each reader skips the other's check, so naming one check for both holds every merge`);
+      armedRefusal("review.autoMerge.independentReview.enabled", `review.autoMerge.independentReview.verdict.checkName: must not be the same check as independentReview.checkName ("${independent.checkName}") — one says a review RAN and the other says what it concluded, and each reader skips the other's check, so naming one check for both holds every merge`);
     }
   }
   if (typeof autoMerge.interactive !== "boolean") {
     issues.push(`review.autoMerge.interactive: must be true or false (got ${JSON.stringify(autoMerge.interactive)}) — an absent value would switch the interactive merge on or off without saying so`);
   }
+  if (autoMerge.interactive || autoMerge.enabled) {
+    const driver = autoMerge.interactive ? "review.autoMerge.interactive" : "review.autoMerge.enabled";
+    for (const named of REPO_UNSETTABLE_CHECK_NAMES) {
+      if (!repoSuppliedPaths.has(named))
+        continue;
+      issues.push(`${named}: must not come from a repository's .hmy.json while ${driver} is on — the named check IS the independent review on that driver, and it is also excluded from the collapsed CI verdict, so a repository choosing the name chooses both what counts as having read the diff and which red check the merge gate stops seeing. Two remedies: set it in your own ~/.hmy/agent/config.json (an operator naming their own checks is untouched), or drop the key from this repository's .hmy.json. Turning off "allowRepoOverrides" in your own config also drops it, at the cost of every other repo-supplied setting.`);
+    }
+  }
   if (autoMerge.interactive) {
     if (independent?.enabled === false) {
-      issues.push("review.autoMerge.independentReview.enabled: must be true while review.autoMerge.interactive is on — the interactive merge relaxes the Reviewed-SHA rule (no hmy card carries that marker), so the independent review is the only thing left that reads the diff, and nobody else is looking");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.independentReview.enabled: must be true while review.autoMerge.interactive is on — the interactive merge relaxes the Reviewed-SHA rule (no hmy card carries that marker), so the independent review is the only thing left that reads the diff, and nobody else is looking");
     }
     if (!autoMerge.reReviewOnBranchChange) {
-      issues.push("review.autoMerge.reReviewOnBranchChange: must be true while review.autoMerge.interactive is on — with the independent review off it is the only rule left that holds an interactive merge, and the interactive driver reads no Reviewed-SHA of its own");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.reReviewOnBranchChange: must be true while review.autoMerge.interactive is on — with the independent review off it is the only rule left that holds an interactive merge, and the interactive driver reads no Reviewed-SHA of its own");
     }
     if (independent?.enabled && independent.verdict?.enabled === false) {
-      issues.push("review.autoMerge.independentReview.verdict.enabled: must be true while review.autoMerge.interactive is on — the interactive driver reads no Reviewed-SHA of its own, so the verdict is the only remaining signal that a review approved the diff, and a green review check alone means the pass ran, not that it approved (#1018)");
+      armedRefusal("review.autoMerge.interactive", "review.autoMerge.independentReview.verdict.enabled: must be true while review.autoMerge.interactive is on — the interactive driver reads no Reviewed-SHA of its own, so the verdict is the only remaining signal that a review approved the diff, and a green review check alone means the pass ran, not that it approved (#1018)");
     }
     const w = autoMerge.waitMinutes;
     if (!Number.isInteger(w) || w < 1 || w > 55) {
-      issues.push(`review.autoMerge.waitMinutes: must be an integer between 1 and 55 (got ${w}) — an interactive agent session goes stale at about an hour, and a command that outlives its session reports into nothing`);
+      armedRefusal("review.autoMerge.interactive", `review.autoMerge.waitMinutes: must be an integer between 1 and 55 (got ${w}) — an interactive agent session goes stale at about an hour, and a command that outlives its session reports into nothing`);
     }
   }
   if (typeof autoMerge.findingsLoop !== "boolean") {
@@ -1101,16 +1168,21 @@ function validateAutoMergeConfig(config) {
   }
   if (autoMerge.findingsLoop) {
     if (!autoMerge.interactive) {
-      issues.push("review.autoMerge.findingsLoop: needs review.autoMerge.interactive — the loop only runs on the interactive merge path, so armed alone it is inert rather than weaker");
+      inertCombination({
+        pin: "review.autoMerge.findingsLoop",
+        gate: "review.autoMerge.interactive",
+        issue: "review.autoMerge.findingsLoop: needs review.autoMerge.interactive — the loop only runs on the interactive merge path, so armed alone it is inert rather than weaker"
+      });
     }
     const findingAuthors = independent?.findingAuthors;
     if (!Array.isArray(findingAuthors) || findingAuthors.filter((a) => typeof a === "string" && a.trim()).length === 0) {
-      issues.push("review.autoMerge.independentReview.findingAuthors: must name at least one login while review.autoMerge.findingsLoop is on — it is the only thing separating the review's findings from every other commenter's text, and an empty list parks every round");
+      armedRefusal("review.autoMerge.findingsLoop", "review.autoMerge.independentReview.findingAuthors: must name at least one login while review.autoMerge.findingsLoop is on — it is the only thing separating the review's findings from every other commenter's text, and an empty list parks every round");
     }
   }
   if (issues.length > 0) {
     throw new ConfigValidationError(`Invalid agent config — ${issues.join("; ")}`, issues);
   }
+  return warnings;
 }
 function isLoopbackBindAddr(addr) {
   const value = addr.toLowerCase();
@@ -1332,8 +1404,9 @@ async function validateAndListColumns(client, projectId, config) {
   }
   return Array.from(new Set(names.filter(Boolean)));
 }
-var ConfigValidationError, REMOVED_CONFIG_KEYS;
+var ConfigValidationError, REMOVED_CONFIG_KEYS, NO_REPO_PATHS, REPO_UNSETTABLE_CHECK_NAMES, REPO_ARMABLE_GATES;
 var init_config_validation = __esm(() => {
+  init_config_merge();
   ConfigValidationError = class ConfigValidationError extends Error {
     issues;
     constructor(message, issues) {
@@ -1351,6 +1424,18 @@ var init_config_validation = __esm(() => {
       note: "review, auto-fix and deep-review are contained and pin their own sources"
     }
   ];
+  NO_REPO_PATHS = new Set;
+  REPO_UNSETTABLE_CHECK_NAMES = [
+    "review.autoMerge.independentReview.checkName",
+    "review.autoMerge.independentReview.verdict.checkName"
+  ];
+  REPO_ARMABLE_GATES = {
+    "review.autoMerge.independentReview.enabled": "tightening",
+    "review.autoMerge.interactive": "handshake",
+    "review.autoMerge.ciRepair.enabled": "handshake",
+    "review.autoMerge.ciRepair.patch.enabled": "handshake",
+    "review.autoMerge.findingsLoop": "handshake"
+  };
 });
 
 // src/paths.ts
@@ -1497,6 +1582,9 @@ var init_branchRef = __esm(() => {
   PR_LINK_PATTERN = /PR:\s*(https?:\/\/[^\s)]+)/;
 });
 
+// ../harmony-shared/dist/cardLifecycle.js
+var init_cardLifecycle = () => {};
+
 // ../harmony-shared/dist/cardLinks.js
 var init_cardLinks = () => {};
 
@@ -2985,6 +3073,7 @@ function untrustedDataBlock(text, options) {
 var init_dist = __esm(() => {
   init_agentStaleness();
   init_branchRef();
+  init_cardLifecycle();
   init_cardLinks();
   init_cardModelStat();
   init_classification();
@@ -3348,16 +3437,17 @@ var init_types2 = __esm(() => {
     },
     claude: {
       model: "claude-opus-5",
-      escalateModel: "claude-fable-5",
+      escalateModel: "claude-fable-5-1",
       escalateAfterAttempts: 2,
       tiers: {
         simple: "claude-sonnet-5",
         advanced: "claude-opus-5",
-        research: "claude-fable-5"
+        research: "claude-fable-5-1"
       },
       scoreBands: DEFAULT_SCORE_BANDS,
       sizingModel: "",
       reviewModel: "sonnet",
+      deepReviewModel: "sonnet",
       maxTurns: 240,
       reviewMaxTurns: 60,
       additionalArgs: []
@@ -3472,6 +3562,302 @@ var init_types2 = __esm(() => {
   NOTICE_IDENTIFIER = `${DAEMON_IDENTIFIER_BASE}-notice`;
 });
 
+// src/repo-agent-config.ts
+import { readFileSync } from "node:fs";
+import { findLocalConfigPath } from "@gethmy/mcp/src/config.js";
+function isNeverSettable(path) {
+  for (const banned of REPO_NEVER_SETTABLE) {
+    if (path === banned || path.startsWith(`${banned}.`))
+      return true;
+  }
+  return false;
+}
+function renderForWarning(value) {
+  const json = JSON.stringify(clampForRender(value)) ?? String(value);
+  const clean = json.replace(/\p{Cf}/gu, "").replace(/[\p{Cc}\u2028\u2029]/gu, " ");
+  if (clean.length <= MAX_RENDERED_LENGTH)
+    return clean;
+  const head = clean.slice(0, MAX_RENDERED_LENGTH).replace(/\\u[0-9a-fA-F]{0,3}$/, "").replace(/\\+$/, "").replace(/[\uD800-\uDBFF]$/, "");
+  const closer = clean.startsWith('"') ? '"' : "";
+  return `${head}…${closer} (truncated from ${clean.length} characters)`;
+}
+function clampForRender(value, depth = 0) {
+  if (Array.isArray(value)) {
+    if (depth >= MAX_RENDER_DEPTH)
+      return ELISION;
+    const kept = value.slice(0, MAX_RENDER_ENTRIES).map((item) => clampForRender(item, depth + 1));
+    if (value.length > MAX_RENDER_ENTRIES)
+      kept.push(ELISION);
+    return kept;
+  }
+  if (isPlainObject(value)) {
+    if (depth >= MAX_RENDER_DEPTH)
+      return ELISION;
+    const keys = Object.keys(value);
+    const out = Object.create(null);
+    for (const key of keys.slice(0, MAX_RENDER_ENTRIES)) {
+      out[key] = clampForRender(value[key], depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+function describeParent(drop) {
+  return drop.parent ? ` inside ${renderForWarning(`agent.${drop.parent}`)}` : ` inside "agent"`;
+}
+function isOneSegment(key) {
+  return key.length > 0 && !key.includes(".") && !UNPRINTABLE.test(key);
+}
+function refuseValue(value, depth = 0) {
+  if (typeof value === "string") {
+    if (UNPRINTABLE.test(value))
+      return `A repo-supplied value may not hold a control or invisible character, and nothing in ${ALLOWED_PREFIX}* is spelled with one.`;
+    if (value.length > MAX_VALUE_LENGTH)
+      return `A repo-supplied value may be at most ${MAX_VALUE_LENGTH} characters, and this one is ${value.length}.`;
+    return null;
+  }
+  if (depth >= MAX_VALUE_DEPTH)
+    return `A repo-supplied value may not nest more than ${MAX_VALUE_DEPTH} levels deep.`;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const why = refuseValue(item, depth + 1);
+      if (why !== null)
+        return why;
+    }
+    return null;
+  }
+  if (isPlainObject(value)) {
+    for (const [key, item] of Object.entries(value)) {
+      const why = refuseValue(key, depth + 1) ?? refuseValue(item, depth + 1);
+      if (why !== null)
+        return why;
+    }
+    return null;
+  }
+  return null;
+}
+function flatten(value, prefix, out, dropped, depth = 0) {
+  if (!isPlainObject(value)) {
+    out.set(prefix, value);
+    return;
+  }
+  if (depth >= MAX_BLOCK_DEPTH) {
+    dropped.push({
+      path: prefix,
+      key: lastSegment(prefix),
+      parent: parentPath(prefix),
+      why: "depth"
+    });
+    return;
+  }
+  const keys = Object.keys(value);
+  if (keys.length === 0)
+    return;
+  for (const key of keys) {
+    const here = prefix ? `${prefix}.${key}` : key;
+    if (FORBIDDEN_KEYS.has(key)) {
+      dropped.push({ path: here, key, parent: prefix, why: "reserved" });
+      continue;
+    }
+    if (!isOneSegment(key)) {
+      dropped.push({
+        path: here,
+        key,
+        parent: prefix,
+        why: UNPRINTABLE.test(key) ? "unprintable" : "segment"
+      });
+      continue;
+    }
+    flatten(value[key], here, out, dropped, depth + 1);
+  }
+}
+function lastSegment(path) {
+  const at = path.lastIndexOf(".");
+  return at === -1 ? path : path.slice(at + 1);
+}
+function parentPath(path) {
+  const at = path.lastIndexOf(".");
+  return at === -1 ? "" : path.slice(0, at);
+}
+function setPath(target, path, value) {
+  const parts = path.split(".");
+  if (parts.some((part) => FORBIDDEN_KEYS.has(part) || !isOneSegment(part)))
+    return false;
+  let node = target;
+  for (const part of parts.slice(0, -1)) {
+    const existing = own(node, part);
+    if (!isPlainObject(existing))
+      node[part] = {};
+    node = node[part];
+  }
+  node[parts[parts.length - 1]] = value;
+  return true;
+}
+function describeDrop(pinPath, drop) {
+  switch (drop.why) {
+    case "reserved":
+      return `${pinPath}: ${renderForWarning(`agent.${drop.path}`)} uses a reserved JavaScript key name — ignoring it. Nothing in ${ALLOWED_PREFIX}* is spelled that way.`;
+    case "unprintable":
+      return `${pinPath}: ${renderForWarning(drop.key)} is not a setting name${describeParent(drop)} — ignoring it. A name may not hold a control or invisible character, and nothing in ${ALLOWED_PREFIX}* is spelled with one.`;
+    case "depth":
+      return `${pinPath}: ${renderForWarning(`agent.${drop.path}`)} nests more than ${MAX_BLOCK_DEPTH} blocks deep — ignoring it and everything under it. The deepest setting anything reads is ${ALLOWED_PREFIX}ciRepair.patch.enabled, which is 5 levels.`;
+    default:
+      return `${pinPath}: ${renderForWarning(drop.key)} is ONE key${describeParent(drop)}, not the nesting it looks like — ignoring it. Write a setting as real nesting: {"review": {"autoMerge": {"enabled": false}}}. A key must be a name, so it may not be empty and may not contain a ".".`;
+  }
+}
+function describeValue(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "a list";
+  if (isPlainObject(value))
+    return "a block of settings";
+  return `a ${typeof value}`;
+}
+function mismatchedPath(message) {
+  return message.slice(0, message.indexOf(" is "));
+}
+function readRepoAgentConfig(args) {
+  const nothing = {
+    overrides: {},
+    warnings: [],
+    suppliedPaths: new Set
+  };
+  const pinPath = findLocalConfigPath(args.repoRoot);
+  if (pinPath === null)
+    return nothing;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(pinPath, "utf-8"));
+  } catch {
+    return nothing;
+  }
+  if (!isPlainObject(parsed))
+    return nothing;
+  const warnings = [];
+  for (const key of Object.keys(parsed)) {
+    if (KNOWN_PIN_KEYS.includes(key))
+      continue;
+    warnings.push(`${pinPath}: ${renderForWarning(key)} is not a key anything reads — ignoring it. Known keys: ${KNOWN_PIN_KEYS.join(", ")}`);
+  }
+  const block = own(parsed, "agent");
+  if (block !== undefined && !isPlainObject(block)) {
+    warnings.push(`${pinPath}: "agent" is ${describeValue(block)} — it must be a block of ${ALLOWED_PREFIX}* settings. Ignoring it.`);
+  }
+  if (!isPlainObject(block))
+    return { overrides: {}, warnings, suppliedPaths: new Set };
+  const leaves = new Map;
+  const dropped = [];
+  flatten(block, "", leaves, dropped);
+  for (const drop of dropped) {
+    warnings.push(describeDrop(pinPath, drop));
+  }
+  const inScope = [];
+  const candidate = {};
+  for (const [path, value] of leaves) {
+    if (path === ALLOWED_BLOCK) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is ${describeValue(value)} — it must be a block of ${ALLOWED_PREFIX}* settings, so there is no setting here to read. Ignoring it.`);
+      continue;
+    }
+    if (!path.startsWith(ALLOWED_PREFIX)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is global config, not repo config — ignoring it. A repository may set ${ALLOWED_PREFIX}* and nothing else.`);
+      continue;
+    }
+    if (isNeverSettable(path)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} is an EXECUTION parameter, not merge policy — ignoring it. It decides what the daemon RUNS on this machine (the container image a CI repair is verified in, and how long it may run), so it stays with identity, credentials, "pool" and "claude.*" in ${args.globalConfigPath}. "allowRepoOverrides" does not reach it.`);
+      continue;
+    }
+    const badValue = refuseValue(value);
+    if (badValue !== null) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} is not a value a repository may set — ignoring it. ${badValue}`);
+      continue;
+    }
+    if (!setPath(candidate, path, value)) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} contains a reserved JavaScript key name — ignoring it. Nothing in ${ALLOWED_PREFIX}* is spelled that way.`);
+      continue;
+    }
+    inScope.push([path, value]);
+  }
+  const malformed = [];
+  for (const message of findConfigTypeMismatches(DEFAULT_AGENT_CONFIG, candidate)) {
+    warnings.push(`${pinPath}: ${message}`);
+    malformed.push(mismatchedPath(message).replace(/^agent\./, ""));
+  }
+  const kept = {};
+  const suppliedPaths = new Set;
+  for (const [path, value] of inScope) {
+    if (malformed.some((bad) => path === bad || path.startsWith(`${bad}.`)))
+      continue;
+    if (!args.allowRepoOverrides && FREE_VALUE.get(path) !== value) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} would LOOSEN this machine's merge policy — ignoring it. To honour it, set "allowRepoOverrides": true at the TOP LEVEL of ${args.globalConfigPath}, beside "apiKey" — inside the "agent" block it is read by nobody.`);
+      continue;
+    }
+    if (!setPath(kept, path, value))
+      continue;
+    suppliedPaths.add(path);
+    const named = NAMED_REVIEW_PATHS.get(path);
+    if (named !== undefined) {
+      warnings.push(`${pinPath}: ${renderForWarning(`agent.${path}`)} = ${renderForWarning(value)} — ${named.effect} Accepted because "allowRepoOverrides": true is set in ${args.globalConfigPath}.${named.extra ? ` ${named.extra}` : ""}`);
+    }
+  }
+  return {
+    overrides: kept,
+    warnings,
+    suppliedPaths
+  };
+}
+var KNOWN_PIN_KEYS, ALLOWED_PREFIX = "review.autoMerge.", ALLOWED_BLOCK, FREE_VALUE, REPO_NEVER_SETTABLE, MAX_RENDERED_LENGTH = 120, ELISION = "…", MAX_RENDER_DEPTH = 4, MAX_RENDER_ENTRIES = 20, NAMED_REVIEW_PATHS, UNPRINTABLE, MAX_VALUE_LENGTH = 200, MAX_VALUE_DEPTH = 8, MAX_BLOCK_DEPTH = 8;
+var init_repo_agent_config = __esm(() => {
+  init_config_merge();
+  init_types2();
+  KNOWN_PIN_KEYS = [
+    "workspaceId",
+    "projectId",
+    "commands",
+    "agent"
+  ];
+  ALLOWED_BLOCK = ALLOWED_PREFIX.slice(0, -1);
+  FREE_VALUE = new Map([
+    ["review.autoMerge.enabled", false],
+    ["review.autoMerge.interactive", false],
+    ["review.autoMerge.findingsLoop", false],
+    ["review.autoMerge.ciRepair.enabled", false],
+    ["review.autoMerge.ciRepair.patch.enabled", false],
+    ["review.autoMerge.requireGreenCi", true],
+    ["review.autoMerge.reReviewOnBranchChange", true],
+    ["review.autoMerge.independentReview.enabled", true],
+    ["review.autoMerge.independentReview.verdict.enabled", true]
+  ]);
+  REPO_NEVER_SETTABLE = new Set([
+    "review.autoMerge.ciRepair.patch.sandboxImage",
+    "review.autoMerge.ciRepair.patch.sandboxTimeoutMs"
+  ]);
+  NAMED_REVIEW_PATHS = new Map([
+    [
+      "review.autoMerge.independentReview.checkName",
+      {
+        effect: "this repository now decides which CI check stands for the independent review, and a name that resolves to an unrelated green check satisfies the merge gate with nothing having read the diff.",
+        extra: `While ${ALLOWED_PREFIX}interactive or ${ALLOWED_PREFIX}enabled is on, a repo-supplied check name is refused at startup.`
+      }
+    ],
+    [
+      "review.autoMerge.independentReview.verdict.checkName",
+      {
+        effect: "this repository now decides which CI check carries the independent review's VERDICT, and a name that resolves to an unrelated green check satisfies the merge gate with nothing having approved the diff.",
+        extra: `While ${ALLOWED_PREFIX}interactive or ${ALLOWED_PREFIX}enabled is on, a repo-supplied check name is refused at startup.`
+      }
+    ],
+    [
+      "review.autoMerge.independentReview.label",
+      {
+        effect: "this repository now decides which PR label asks CI for the independent review. It names no check and cannot stand in for one: a label CI does not act on means the review never arrives, so the merge gate HOLDS rather than opening.",
+        extra: "Nothing refuses it at startup, for that reason — unlike a repo-supplied check name."
+      }
+    ]
+  ]);
+  UNPRINTABLE = /[\p{Cc}\p{Cf}]/u;
+});
+
 // src/config.ts
 var exports_config = {};
 __export(exports_config, {
@@ -3483,11 +3869,11 @@ __export(exports_config, {
   createApiClient: () => createApiClient
 });
 import { execSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 import { log as log5 } from "@gethmy/harness";
 import { HarmonyApiClient } from "@gethmy/mcp/src/api-client.js";
 import {
-  findLocalConfigPath,
+  findLocalConfigPath as findLocalConfigPath2,
   getActiveProjectId,
   getActiveWorkspaceId,
   getApiKey,
@@ -3499,9 +3885,9 @@ import {
 import { refreshOAuthToken } from "@gethmy/mcp/src/oauth-refresh.js";
 function readConfigFile() {
   try {
-    return readFileSync(configPath(), "utf-8");
+    return readFileSync2(configPath(), "utf-8");
   } catch {
-    const raw = readFileSync(legacyConfigPath(), "utf-8");
+    const raw = readFileSync2(legacyConfigPath(), "utf-8");
     if (!warnedLegacyConfigDir) {
       warnedLegacyConfigDir = true;
       log5.warn(TAG5, `Read the pre-#1082 config at ${legacyConfigPath()}. The current ` + `location is ${configPath()} — the daemon migrates it on its next ` + `\`run\`, and this fallback is temporary.`);
@@ -3555,22 +3941,37 @@ function loadDaemonConfig() {
   let agentName = "Harmony Agent";
   let agentIdentifier2 = "harmony-daemon";
   let agentColor = "#57b8a5";
+  let allowRepoOverrides = false;
   const configWarnings = [...contextWarnings];
   try {
     const raw = readConfigFile();
     const parsed = JSON.parse(raw);
     configWarnings.push(...findRemovedConfigKeys(parsed));
-    if (parsed.agent) {
-      agentOverrides = parsed.agent;
-    }
-    if (typeof parsed.agentName === "string" && parsed.agentName.trim())
-      agentName = parsed.agentName.trim();
-    if (typeof parsed.agentIdentifier === "string" && parsed.agentIdentifier.trim())
-      agentIdentifier2 = parsed.agentIdentifier.trim();
-    if (typeof parsed.agentColor === "string" && parsed.agentColor.trim())
-      agentColor = parsed.agentColor.trim();
+    const block = own(parsed, "agent");
+    if (block) {
+      agentOverrides = block;
+    }
+    const rawName = own(parsed, "agentName");
+    if (typeof rawName === "string" && rawName.trim())
+      agentName = rawName.trim();
+    const rawIdentifier = own(parsed, "agentIdentifier");
+    if (typeof rawIdentifier === "string" && rawIdentifier.trim())
+      agentIdentifier2 = rawIdentifier.trim();
+    const rawColor = own(parsed, "agentColor");
+    if (typeof rawColor === "string" && rawColor.trim())
+      agentColor = rawColor.trim();
+    if (own(parsed, "allowRepoOverrides") === true)
+      allowRepoOverrides = true;
   } catch {}
-  const agent = mergeAgentConfig(DEFAULT_AGENT_CONFIG, agentOverrides);
+  const repo = readRepoAgentConfig({
+    repoRoot,
+    globalConfigPath: contextSource.globalPath,
+    allowRepoOverrides
+  });
+  configWarnings.push(...repo.warnings);
+  const operatorAgent = mergeAgentConfig(DEFAULT_AGENT_CONFIG, agentOverrides);
+  const agent = mergeAgentConfig(operatorAgent, repo.overrides);
+  const repoArmedGates = repoArmedGatesOf(repo.suppliedPaths, operatorAgent, agent);
   configWarnings.push(...findConfigTypeMismatches(DEFAULT_AGENT_CONFIG, agentOverrides));
   if (agent.runner !== "cli" && agent.runner !== "sdk") {
     agent.runner = DEFAULT_AGENT_CONFIG.runner;
@@ -3587,13 +3988,16 @@ function loadDaemonConfig() {
     agentColor,
     agent,
     agentOverrides,
+    repoAgentOverrides: repo.overrides,
+    repoAgentPaths: repo.suppliedPaths,
+    repoArmedGates,
     contextSource,
     configWarnings
   };
 }
 function resolveContextSource(repoRoot) {
   const globalPath = getConfigPath();
-  const localPath = findLocalConfigPath(repoRoot);
+  const localPath = findLocalConfigPath2(repoRoot);
   if (localPath === null) {
     return {
       source: {
@@ -3647,6 +4051,7 @@ var init_config = __esm(() => {
   init_config_merge();
   init_config_validation();
   init_paths();
+  init_repo_agent_config();
   init_types2();
 });
 
@@ -4156,7 +4561,7 @@ import {
   mkdirSync as mkdirSync2,
   mkdtempSync,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   rmSync,
   statSync as statSync2,
   unlinkSync,
@@ -4233,7 +4638,7 @@ function sameBytes(a, b) {
       return false;
     if (sa.size > MAX_FILE_BYTES)
       return false;
-    return readFileSync2(a).equals(readFileSync2(b));
+    return readFileSync3(a).equals(readFileSync3(b));
   } catch {
     return false;
   }
@@ -4257,7 +4662,7 @@ function applyChanges(args) {
   for (const path of [...changes.modified, ...changes.added]) {
     const from = join3(scratch, path);
     const to = safeDestination(clean, path);
-    const bytes = readFileSync2(from);
+    const bytes = readFileSync3(from);
     if (bytes.byteLength > MAX_FILE_BYTES) {
       throw new Error(`the repair wrote ${path} at ${bytes.byteLength} bytes, over the ${MAX_FILE_BYTES} cap`);
     }
@@ -4314,7 +4719,8 @@ import {
   isPrUrlOnOrigin,
   log as log9,
   removeWorktreeHoldingBranch,
-  resolvePrHeadBranch
+  resolvePrHeadBranch,
+  shouldInstall
 } from "@gethmy/harness";
 function gitErrorDetail(err) {
   const e = err;
@@ -4371,6 +4777,8 @@ function checkoutExistingBranch(basePath, branchName, opts = {}) {
   } catch (err) {
     throw new Error(`Failed to create review worktree for ${branchName}: ${gitErrorDetail(err)}`);
   }
+  if (!shouldInstall(worktreeDir, opts.commands))
+    return worktreeDir;
   log9.info(TAG9, "Installing dependencies in review worktree...");
   try {
     execSync2(installCommand(opts.ignoreScripts !== false), {
@@ -4457,7 +4865,7 @@ var init_review_worktree = __esm(() => {
 // src/ci-patch.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join4 } from "node:path";
 import {
   buildCommand,
@@ -4467,6 +4875,7 @@ import {
   GIT_NO_HOOKS as GIT_NO_HOOKS4,
   HARMONY_CREDENTIAL_KEYS,
   log as log10,
+  REPO_CONFIG_FILENAMES,
   runInSandbox,
   SdkAgentRunner,
   sandboxAvailable,
@@ -4558,7 +4967,10 @@ async function verifyInSandbox(worktree, config) {
     return null;
   }
   let ran = null;
-  for (const command of [buildCommand(worktree), testCommand(worktree)]) {
+  for (const command of [
+    buildCommand(worktree, config.commands),
+    testCommand(worktree, config.commands)
+  ]) {
     if (!command)
       continue;
     ran = command;
@@ -4592,7 +5004,7 @@ function commitRepair(worktree, card) {
 }
 function readGitPointer(worktree) {
   try {
-    return readFileSync3(join4(worktree, ".git"), "utf-8");
+    return readFileSync4(join4(worktree, ".git"), "utf-8");
   } catch {
     return null;
   }
@@ -4619,7 +5031,8 @@ async function repairBranch(deps) {
   let trees = null;
   try {
     worktree = checkoutExistingBranch(config.worktree.basePath, branch, {
-      ignoreScripts: true
+      ignoreScripts: true,
+      commands: config.commands
     });
     const baseSha = remoteSha(branch, worktree);
     if (!baseSha) {
@@ -4761,7 +5174,8 @@ var init_ci_patch = __esm(() => {
     /(^|\/)\.yarnrc\.ya?ml$/i,
     /(^|\/)\.tool-versions$/i,
     /(^|\/)\.gitattributes$/i,
-    /(^|\/)\.gitconfig$/i
+    /(^|\/)\.gitconfig$/i,
+    ...REPO_CONFIG_FILENAMES.map((name) => new RegExp(`(^|/)${name.replace(/\./g, "\\.")}$`, "i"))
   ];
 });
 
@@ -6477,7 +6891,7 @@ async function runCompletion(client, card, branchName, worktreePath, config, wor
     revertWarnings: []
   };
   if (config.verification.enabled && config.verification.lint) {
-    await runFormatFix(worktreePath, config.verification.timeout, workerId, verificationSandbox(config));
+    await runFormatFix(worktreePath, config.verification.timeout, workerId, verificationSandbox(config), config.commands);
   }
   commitUncommittedChanges(worktreePath, card);
   const hasCommits = checkHasCommits(worktreePath, config.worktree.baseBranch, runBaselineSha);
@@ -7446,7 +7860,7 @@ var init_prompt = __esm(() => {
 });
 
 // src/review-completion.ts
-import { readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { readFileSync as readFileSync5, statSync as statSync3 } from "node:fs";
 import {
   cleanupWorktree as cleanupWorktree3,
   createPullRequest as createPullRequest2,
@@ -7528,7 +7942,7 @@ function tailRunLog(path, bytes = RUN_LOG_TAIL_BYTES) {
     if (size === 0)
       return null;
     const start = Math.max(0, size - bytes);
-    const buf = readFileSync4(path);
+    const buf = readFileSync5(path);
     return buf.subarray(start).toString("utf-8");
   } catch {
     return null;
@@ -8252,7 +8666,7 @@ __export(exports_state_store, {
 import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   renameSync as renameSync2,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -8389,7 +8803,7 @@ class StateStore {
     if (!existsSync3(this.path))
       return emptyState();
     try {
-      const raw = readFileSync5(this.path, "utf-8");
+      const raw = readFileSync6(this.path, "utf-8");
       const parsed = JSON.parse(raw);
       if (parsed?.version !== SCHEMA_VERSION) {
         log26.warn(TAG23, `state file has version ${parsed?.version}, expected ${SCHEMA_VERSION} — migrating (preserving card budget/attempts, dropping in-flight runs)`);
@@ -9058,6 +9472,7 @@ import {
   buildGateCollectorRegistry,
   cleanupWorktree as cleanupWorktree4,
   collectGateEvidence,
+  DEV_SERVER_READY_TIMEOUT_MS,
   DevServerReadinessError,
   devServerLaunch,
   devServerSkipReason,
@@ -9321,7 +9736,7 @@ class ReviewWorker {
         }
         this.sessionId = reviewSession && typeof reviewSession === "object" && "id" in reviewSession ? reviewSession.id ?? null : null;
         const labelPromise = addLabelByName(this.client, card, "agent", "#8b5cf6");
-        this.worktreePath = checkoutExistingBranch(this.config.worktree.basePath, this.branchName);
+        this.worktreePath = checkoutExistingBranch(this.config.worktree.basePath, this.branchName, { commands: this.config.commands });
         await labelPromise;
       }
       if (this.aborted)
@@ -9844,14 +10259,15 @@ No verdict was produced, so this card has not been reviewed. The run's log is at
     }
   }
   async startDevServer(card, cwd, port) {
-    const declined = devServerSkipReason(cwd);
+    const declined = devServerSkipReason(cwd, this.config.commands);
     if (declined)
       return { previewUrl: null, skipReason: declined };
     log29.info(this.tag, `Starting dev server on port ${port}...`);
     const launch = devServerLaunch({
       worktreePath: cwd,
       port,
-      sandbox: verificationSandbox2(this.config)
+      sandbox: verificationSandbox2(this.config),
+      operator: this.config.commands
     });
     this.devServerContainer = launch.containerName ?? null;
     if (launch.containerName) {
@@ -9877,13 +10293,14 @@ No verdict was produced, so this card has not been reviewed. The run's log is at
       if (devServerSpawnError) {
         throw new DevServerReadinessError(`dev server failed to start (${launch.cmd}): ${devServerSpawnError.message}`);
       }
-      await waitForDevServer(this.devServerProcess, 30000);
+      await waitForDevServer(this.devServerProcess, DEV_SERVER_READY_TIMEOUT_MS);
       await probeDevServer(port);
     } catch (err) {
       this.killDevServer();
+      const failure = sanitizeCiText3(err instanceof Error ? err.message : String(err), REVIEW_FAILURE_REASON_MAX);
       return {
         previewUrl: null,
-        skipReason: sanitizeCiText3(err instanceof Error ? err.message : String(err), REVIEW_FAILURE_REASON_MAX)
+        skipReason: launch.origin ? `${launch.origin}, and ${failure}` : failure
       };
     }
     log29.info(this.tag, `Dev server ready on port ${port}`);
@@ -11256,7 +11673,7 @@ function workspaceConfigToPartial(ws) {
 }
 function resolveEffectiveAgentConfig(cfg, ws) {
   const withWorkspace = ws ? mergeAgentConfig(DEFAULT_AGENT_CONFIG, workspaceConfigToPartial(ws)) : DEFAULT_AGENT_CONFIG;
-  return mergeAgentConfig(withWorkspace, cfg.agentOverrides);
+  return mergeAgentConfig(mergeAgentConfig(withWorkspace, cfg.agentOverrides), cfg.repoAgentOverrides);
 }
 var init_workspace_model_config = __esm(() => {
   init_config_merge();
@@ -11749,7 +12166,8 @@ class Worker {
         }
         this.worktreePath = createWorktree(this.config.worktree.basePath, this.config.worktree.baseBranch, this.branchName, {
           continueExisting: target.continueExisting,
-          branchExistsOnOrigin: target.existsOnOrigin
+          branchExistsOnOrigin: target.existsOnOrigin,
+          commands: this.config.commands
         });
         this.runBaselineSha = readWorktreeHead(this.worktreePath);
       }
@@ -14423,7 +14841,7 @@ __export(exports_port_registry, {
 import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   renameSync as renameSync3,
   writeFileSync as writeFileSync4
 } from "node:fs";
@@ -14436,7 +14854,7 @@ function load(path) {
   if (!existsSync4(path))
     return {};
   try {
-    const raw = readFileSync6(path, "utf-8");
+    const raw = readFileSync7(path, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object")
       return parsed;
@@ -15888,7 +16306,11 @@ function contextSourceLine(config) {
   if (unreadablePin !== null) {
     return `all of it ${globalPath} (global) — ${unreadablePin} is present but UNREADABLE, so its pin was ignored`;
   }
-  return scope === "repo" ? `project+workspace ${path} (repo pin)  ·  all else ${globalPath}` : `all of it ${globalPath} (global; no repo pin found)`;
+  if (scope !== "repo") {
+    return `all of it ${globalPath} (global; no repo pin found)`;
+  }
+  const pinLabel = config.repoAgentPaths.size > 0 ? "repo pin, +auto-merge" : "repo pin";
+  return `project+workspace ${path} (${pinLabel})  ·  rest ${globalPath}`;
 }
 function titleRule(title) {
   const prefix = "─── ";
@@ -15929,7 +16351,7 @@ import {
   copyFileSync,
   existsSync as existsSync5,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   renameSync as renameSync4,
   writeFileSync as writeFileSync5
 } from "node:fs";
@@ -15951,7 +16373,7 @@ function atomicWriteJson(path, value) {
 }
 function readTargetFile(path) {
   try {
-    const parsed = JSON.parse(readFileSync7(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(path, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     return parsed;
@@ -16005,7 +16427,7 @@ function migrateLegacyStateFile(opts) {
     return NO_MIGRATION;
   let legacy;
   try {
-    const parsed = JSON.parse(readFileSync7(legacyPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync8(legacyPath, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       throw new Error("not an object");
     legacy = parsed;
@@ -16534,7 +16956,7 @@ __export(exports_run_stats, {
   computeRunStats: () => computeRunStats,
   buildRunListRows: () => buildRunListRows
 });
-import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync4 } from "node:fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync4 } from "node:fs";
 import { join as join8 } from "node:path";
 function runsDir2(base) {
   return runsDir(base);
@@ -16617,7 +17039,7 @@ function tailText(path, bytes = 4096) {
     const size = statSync4(path).size;
     if (size === 0)
       return "";
-    const buf = readFileSync8(path);
+    const buf = readFileSync9(path);
     const start = Math.max(0, size - bytes);
     let text = buf.subarray(start).toString("utf-8");
     if (start > 0) {
@@ -16639,7 +17061,7 @@ function grepRunLogs(files, pattern, opts = {}) {
       continue;
     let content;
     try {
-      content = readFileSync8(file.path, "utf-8");
+      content = readFileSync9(file.path, "utf-8");
     } catch {
       continue;
     }
@@ -17239,7 +17661,9 @@ async function main() {
     throw err;
   }
   try {
-    validateAutoMergeConfig(config.agent);
+    for (const warning of validateAutoMergeConfig(config.agent, config.repoAgentPaths, config.repoArmedGates)) {
+      banner.warn(warning);
+    }
     validateBudgetConfig(config.agent);
     validateSweepConfig(config.agent);
     validateRankingConfig(config.agent);