@hizliemre/horse-code 0.3.0 → 0.4.0

package/dist/chunk-NBTH2VVI.js

@@ -0,0 +1,1945 @@
+import {
+  checkpointKey,
+  checkpointMtime,
+  isContinuePrompt,
+  readCheckpoint
+} from "./chunk-ZSQ24YDJ.js";
+import {
+  applySkills,
+  buildSkillTool,
+  placedSkills
+} from "./chunk-MZM24M5M.js";
+import {
+  defaultGitRunner,
+  gitVerb
+} from "./chunk-LPQU436C.js";
+import {
+  BATCH_TOOLS_NOTE,
+  contextTools,
+  globTool,
+  grepTool,
+  memoryHints,
+  projectToolsNote,
+  readFileTool,
+  reinforceUsed
+} from "./chunk-BFIZMM4G.js";
+import {
+  ToolRegistry,
+  runStructuredRole
+} from "./chunk-CYLPQWIF.js";
+import {
+  truncateSafe
+} from "./chunk-JLWQCA7B.js";
+import {
+  traceRootRel
+} from "./chunk-ZPJP2VH5.js";
+import {
+  loadGraphSync
+} from "./chunk-4M6LXNG2.js";
+
+// src/worktree/slug.ts
+var MAX_SLUG = 60;
+var MAX_WORDS = 5;
+var LEADING_VERBS = /* @__PURE__ */ new Set([
+  "add",
+  "build",
+  "create",
+  "implement",
+  "make",
+  "write",
+  "develop",
+  "design",
+  "generate",
+  "introduce",
+  "fix",
+  "update",
+  "change",
+  "modify",
+  "refactor",
+  "rewrite",
+  "improve",
+  "enhance",
+  "optimize",
+  "clean",
+  "setup",
+  "configure",
+  "install",
+  "remove",
+  "delete",
+  "drop",
+  "rename",
+  "migrate",
+  "move",
+  "port",
+  "support",
+  "enable",
+  "disable",
+  "finalize",
+  "complete",
+  "finish",
+  "expand",
+  "extend",
+  "set",
+  "apply"
+]);
+var FILLERS = /* @__PURE__ */ new Set(["a", "an", "the"]);
+function dropLeadingAction(words2) {
+  let i = 0;
+  if (words2.length && LEADING_VERBS.has(words2[0])) {
+    i = 1;
+    while (i < words2.length && FILLERS.has(words2[i])) i++;
+  } else {
+    while (i < words2.length && FILLERS.has(words2[i])) i++;
+  }
+  return i < words2.length ? words2.slice(i) : words2;
+}
+function toSlug(name) {
+  const words2 = name.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().split(/\s+/).filter(Boolean);
+  const named = dropLeadingAction(words2).slice(0, MAX_WORDS);
+  const s = named.join("-").slice(0, MAX_SLUG).replace(/-+$/g, "");
+  return s || "job";
+}
+function uniqueSlug(base, taken) {
+  if (!taken(base)) return base;
+  let n = 2;
+  while (taken(`${base}-${n}`)) n++;
+  return `${base}-${n}`;
+}
+
+// src/worktree/manager.ts
+import { mkdir as mkdir2, writeFile, rm as rm2 } from "fs/promises";
+import { existsSync as existsSync2, readdirSync, realpathSync } from "fs";
+import { join as join2, resolve, dirname as dirname2, basename } from "path";
+
+// src/worktree/inherit.ts
+import { cp, mkdir, rm, stat } from "fs/promises";
+import { existsSync } from "fs";
+import { dirname, join, sep } from "path";
+var INHERITED_ASSETS = [
+  join("graphify-out", "graph.json"),
+  // The community names beside it: without them a session's graph tools fall back to numbers, which is the
+  // difference between "this touches Wallet Member & Balance" and "this touches community 47".
+  join("graphify-out", ".graphify_labels.json"),
+  join(".horsecode", "memory.jsonl"),
+  join(".horsecode", "skills"),
+  join(".specify", "memory", "constitution.md"),
+  join(".horsecode", "migrated.json")
+];
+var NEVER = [join(".horsecode", "worktrees")];
+var excluded = (rel) => NEVER.some((n) => rel === n || rel.startsWith(n + sep) || rel.startsWith(n + "/"));
+function nestedCheckout(repoRoot, rel, cache) {
+  const parts = rel.split(/[\\/]/).slice(0, -1);
+  let acc = "";
+  for (const part of parts) {
+    acc = acc ? `${acc}/${part}` : part;
+    let hit = cache.get(acc);
+    if (hit === void 0) {
+      hit = existsSync(join(repoRoot, acc, ".git"));
+      cache.set(acc, hit);
+    }
+    if (hit) return true;
+  }
+  return false;
+}
+var MAX_UNTRACKED = 5e3;
+async function copyPath(from, to) {
+  await mkdir(dirname(to), { recursive: true });
+  await cp(from, to, { recursive: true, dereference: true, force: true });
+}
+async function inheritFromRoot(git, repoRoot, baseWorktree) {
+  const out = { modified: [], untracked: [], assets: [], deleted: [], skipped: 0 };
+  if (repoRoot === baseWorktree) return out;
+  const changed = await git(["diff", "--name-status", "HEAD"], repoRoot);
+  if (changed.code === 0) {
+    for (const line of changed.stdout.split("\n")) {
+      const [status, ...rest] = line.trim().split(/\t/);
+      const rel = rest.join("	");
+      if (!status || !rel || excluded(rel)) continue;
+      try {
+        if (status.startsWith("D")) {
+          await rm(join(baseWorktree, rel), { force: true });
+          out.deleted.push(rel);
+        } else {
+          await copyPath(join(repoRoot, rel), join(baseWorktree, rel));
+          out.modified.push(rel);
+        }
+      } catch {
+      }
+    }
+  }
+  const others = await git(["ls-files", "--others", "--exclude-standard"], repoRoot);
+  if (others.code === 0) {
+    const nested = /* @__PURE__ */ new Map();
+    for (const rel of others.stdout.split("\n").map((l) => l.trim()).filter(Boolean)) {
+      if (excluded(rel) || nestedCheckout(repoRoot, rel, nested)) {
+        out.skipped++;
+        continue;
+      }
+      if (out.untracked.length >= MAX_UNTRACKED) {
+        out.skipped++;
+        continue;
+      }
+      try {
+        await copyPath(join(repoRoot, rel), join(baseWorktree, rel));
+        out.untracked.push(rel);
+      } catch {
+      }
+    }
+  }
+  for (const rel of INHERITED_ASSETS) {
+    const from = assetSource(repoRoot, rel);
+    if (!from) continue;
+    try {
+      await stat(from);
+      await copyPath(from, join(baseWorktree, rel));
+      out.assets.push(rel);
+    } catch {
+    }
+  }
+  return out;
+}
+function assetSource(repoRoot, rel) {
+  const atRoot = join(repoRoot, rel);
+  if (existsSync(atRoot)) return atRoot;
+  const standing = join(repoRoot, ".horsecode", "worktrees", "traces", "base", rel);
+  return existsSync(standing) ? standing : void 0;
+}
+function describeInherited(i) {
+  const parts = [];
+  const n = i.modified.length + i.deleted.length;
+  if (n) parts.push(`${n} uncommitted change(s)`);
+  if (i.untracked.length) parts.push(`${i.untracked.length} untracked file(s)`);
+  if (i.skipped) parts.push(`${i.skipped} left behind (another checkout, or past the ${MAX_UNTRACKED} bound)`);
+  if (i.assets.length) parts.push(i.assets.map((a) => `\`${a}\``).join(", "));
+  return parts.length ? `\u{1F4E5} Carried into this session: ${parts.join(" \xB7 ")}.` : void 0;
+}
+async function topUpInherited(repoRoot, baseWorktree) {
+  const added = [];
+  if (repoRoot === baseWorktree) return added;
+  for (const rel of INHERITED_ASSETS) {
+    const from = join(repoRoot, rel);
+    const to = join(baseWorktree, rel);
+    if (!existsSync(from) || existsSync(to)) continue;
+    try {
+      await copyPath(from, to);
+      added.push(rel);
+    } catch {
+    }
+  }
+  return added;
+}
+function describeTopUp(added) {
+  if (!added.length) return void 0;
+  return `\u{1F4E5} This session was opened before ${added.map((a) => `\`${a}\``).join(", ")} existed \u2014 carried in now.`;
+}
+
+// src/worktree/manager.ts
+var MAX_DIFF_CHARS = 12e4;
+var DOC_SPECS = ["*.md", "*.txt"];
+function excludeOwnState() {
+  const roots = [".horsecode", "graphify-out", traceRootRel()].filter(Boolean);
+  return [...new Set(roots)].map((r) => `:(exclude)${r}/**`);
+}
+async function mainWorktreeRoot(git, cwd) {
+  const abs = await git(["rev-parse", "--path-format=absolute", "--git-common-dir"], cwd);
+  const r = abs.code === 0 ? abs : await git(["rev-parse", "--git-common-dir"], cwd);
+  if (r.code !== 0 || !r.stdout.trim()) return cwd;
+  const common = resolve(cwd, r.stdout.trim());
+  return basename(common) === ".git" ? dirname2(common) : cwd;
+}
+var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+var DAYS = ["SUNDAY", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY"];
+function sessionName(now, taken) {
+  const day = `${String(now.getDate()).padStart(2, "0")}-${MONTHS[now.getMonth()]}-${now.getFullYear()}-${DAYS[now.getDay()]}`;
+  for (let n = 1; n < 1e3; n++) {
+    const name = `${day}_${String(n).padStart(2, "0")}`;
+    if (!taken(name)) return name;
+  }
+  return `${day}_${Date.now()}`;
+}
+var FORBIDDEN_AT_ROOT = /* @__PURE__ */ new Set([
+  "merge",
+  "rebase",
+  "cherry-pick",
+  "revert",
+  "reset",
+  "checkout",
+  "switch",
+  "restore",
+  "commit",
+  "am",
+  "apply",
+  "stash",
+  "pull",
+  "clean"
+]);
+function guardRoot(run, repoRoot) {
+  return async (args, cwd) => {
+    const verb = gitVerb(args);
+    if (cwd === repoRoot && verb !== void 0 && FORBIDDEN_AT_ROOT.has(verb)) {
+      throw new Error(
+        `refusing to run \`git ${verb}\` in the project checkout (${repoRoot}). A session's work stays on its own branch and in its own worktree; bringing it in is the user's decision, taken in their own time.`
+      );
+    }
+    return run(args, cwd);
+  };
+}
+var WorktreeManager = class {
+  repoRoot;
+  /** The project checkout this manager was built for — where per-project settings and the remote live. */
+  get projectRoot() {
+    return this.repoRoot;
+  }
+  /**
+   * Where sessions are kept, which is the REPOSITORY's business and not the caller's checkout.
+   *
+   * Measured from a live run: started inside another tool's worktree, horse-code opened its session at
+   * `…/.claude/worktrees/product-create-wizard/.horsecode/worktrees/…/base` — its own worktree nested inside
+   * someone else's, inside the repository. That works and is a place nobody will look: `/clean-worktrees` at
+   * the repository root cannot see it, and removing the outer checkout takes it with it.
+   *
+   * Distinct from `repoRoot` on purpose. What a session INHERITS — the code graph, the memory, the project
+   * config — is whatever the user is standing in, and that is frequently not the main checkout.
+   */
+  worktreeHome;
+  git;
+  /**
+   * The unguarded runner, for the one case that legitimately needs a forbidden verb: turning a directory
+   * that is not a repository into one.
+   *
+   * `git worktree add` needs a commit to branch from, and an empty repository has none — so a first commit
+   * is not delivery, it is the precondition for ever leaving the root alone again. It runs only when there
+   * is no HEAD, so there is no branch to disturb and no work to overwrite. Named rather than flagged, so
+   * grepping for it finds every use.
+   */
+  rawGit;
+  /** Injectable clock: a session's NAME is the day it opened, so a test has to be able to say which day. */
+  now;
+  constructor(deps) {
+    this.repoRoot = deps.repoRoot;
+    this.worktreeHome = deps.worktreeHome ?? deps.repoRoot;
+    this.rawGit = deps.runGit ?? defaultGitRunner;
+    this.git = guardRoot(this.rawGit, deps.repoRoot);
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /** Runs git; nonzero exit → throws a clear error. Returns output (stdout). */
+  async run(args, cwd) {
+    const r = await this.git(args, cwd);
+    if (r.code !== 0) {
+      throw new Error(`git ${args.join(" ")} failed (${r.code}): ${(r.stderr || r.stdout).trim()}`);
+    }
+    return r.stdout;
+  }
+  /** `git init` the repo if the directory isn't one yet (the user may not have run git init) + ensure an
+   *  identity so the first commit doesn't fail on a machine with no global git config. */
+  async ensureRepo() {
+    const inside = await this.git(["rev-parse", "--is-inside-work-tree"], this.repoRoot);
+    if (inside.code === 0 && inside.stdout.trim() === "true") return;
+    await this.run(["init", "-b", "main"], this.repoRoot);
+    const email = await this.git(["config", "user.email"], this.repoRoot);
+    if (email.code !== 0 || !email.stdout.trim()) {
+      await this.git(["config", "user.email", "horse-code@local"], this.repoRoot);
+      await this.git(["config", "user.name", "horse-code"], this.repoRoot);
+    }
+  }
+  /**
+   * A worktree must branch off a commit. First ensure the directory IS a git repo (auto `git init` if not).
+   * A freshly `git init`-ed repo has an unborn HEAD (no commits), so `git worktree add … <branch>` fails with
+   * "invalid reference". Bootstrap one empty commit so horse-code works in a brand-new / non-git directory.
+   */
+  async ensureBaseCommit() {
+    await this.ensureRepo();
+    const head = await this.git(["rev-parse", "--verify", "--quiet", "HEAD"], this.repoRoot);
+    if (head.code === 0) return;
+    const r = await this.rawGit(["commit", "--allow-empty", "-m", "hc: initial commit"], this.repoRoot);
+    if (r.code !== 0) throw new Error(`git commit --allow-empty failed (${r.code}): ${(r.stderr || r.stdout).trim()}`);
+  }
+  /**
+   * The ref to base the session's worktree on. Uses `fromBranch` when it resolves; otherwise falls back to
+   * HEAD. This covers the common fresh-repo mismatch: horse-code guesses "main" but the repo's actual
+   * (default/unborn) branch is "master", so "main" never resolves even after the bootstrap commit.
+   */
+  async resolveBase(fromBranch) {
+    const ok = await this.git(["rev-parse", "--verify", "--quiet", fromBranch], this.repoRoot);
+    return ok.code === 0 ? fromBranch : "HEAD";
+  }
+  async openSession(fromBranch, jobName) {
+    await this.ensureBaseCommit();
+    const base = await this.resolveBase(fromBranch);
+    const worktreesDir = join2(this.worktreeHome, ".horsecode", "worktrees");
+    await mkdir2(worktreesDir, { recursive: true });
+    await writeFile(join2(worktreesDir, ".gitignore"), "*\n", "utf8");
+    const listed = await this.git(["for-each-ref", "--format=%(refname:short)", "refs/heads/hc/"], this.repoRoot);
+    const branches = new Set(listed.stdout.split("\n").map((s) => s.trim()).filter(Boolean));
+    const jobSlug = sessionName(this.now(), (s) => existsSync2(join2(worktreesDir, s)) || branches.has(`hc/${s}/base`));
+    const root = join2(worktreesDir, jobSlug);
+    const baseWorktree = join2(root, "base");
+    const baseBranch = `hc/${jobSlug}/base`;
+    await mkdir2(join2(root, "tasks"), { recursive: true });
+    await this.run(["worktree", "add", "-b", baseBranch, baseWorktree, base], this.repoRoot);
+    const inherited = await inheritFromRoot((args, cwd) => this.git(args, cwd), this.repoRoot, baseWorktree);
+    return { jobSlug, root, baseWorktree, baseBranch, inherited };
+  }
+  /**
+   * Opens — or re-enters — a worktree with a FIXED name, for the standing work that is not one job.
+   *
+   * `openSession` mints a fresh dated slug every call, which is right for a job: two runs of "add login" are
+   * two pieces of work and must not share a branch. Tracing is the opposite. It is one long-lived artefact
+   * the project keeps, its index is checkpointed so an interrupted run resumes, and a new worktree per
+   * invocation would both lose that resumption and pile up full checkouts — measured on the project this was
+   * written for, a checkout is not small.
+   *
+   * So the slug is the caller's, and running it twice re-enters the same place. Re-entry is decided by git
+   * rather than by the directory existing: a leftover directory git no longer tracks is not a worktree, and
+   * treating one as resumable is how a run ends up writing into a checkout that no longer has a branch.
+   */
+  async openFixed(fromBranch, slug) {
+    await this.ensureBaseCommit();
+    const worktreesDir = join2(this.worktreeHome, ".horsecode", "worktrees");
+    await mkdir2(worktreesDir, { recursive: true });
+    await writeFile(join2(worktreesDir, ".gitignore"), "*\n", "utf8");
+    const root = join2(worktreesDir, slug);
+    const baseWorktree = join2(root, "base");
+    const baseBranch = `hc/${slug}/base`;
+    let real;
+    try {
+      real = realpathSync(baseWorktree);
+    } catch {
+    }
+    if (real && (await this.registeredWorktrees()).has(real)) {
+      return { jobSlug: slug, root, baseWorktree, baseBranch, resumed: true };
+    }
+    const base = await this.resolveBase(fromBranch);
+    await mkdir2(join2(root, "tasks"), { recursive: true });
+    const listed = await this.git(["for-each-ref", "--format=%(refname:short)", `refs/heads/${baseBranch}`], this.repoRoot);
+    const exists = listed.stdout.trim() === baseBranch;
+    await this.run(exists ? ["worktree", "add", baseWorktree, baseBranch] : ["worktree", "add", "-b", baseBranch, baseWorktree, base], this.repoRoot);
+    const inherited = await inheritFromRoot((args, cwd) => this.git(args, cwd), this.repoRoot, baseWorktree);
+    return { jobSlug: slug, root, baseWorktree, baseBranch, inherited };
+  }
+  /** Absolute paths of the worktrees git currently tracks (from `git worktree list --porcelain`). */
+  async registeredWorktrees() {
+    const r = await this.git(["worktree", "list", "--porcelain"], this.repoRoot);
+    const paths = /* @__PURE__ */ new Set();
+    for (const line of r.stdout.split("\n")) {
+      if (line.startsWith("worktree ")) {
+        const p = line.slice("worktree ".length).trim();
+        try {
+          paths.add(realpathSync(p));
+        } catch {
+          paths.add(p);
+        }
+      }
+    }
+    return paths;
+  }
+  /**
+   * Resume support: find a preserved worktree from an earlier interrupted run. Scans every
+   * `.horsecode/worktrees/<slug>/checkpoint.json` and only considers a session whose `base` worktree is still
+   * live in git (a pruned/stale dir can't be safely reused). A bare "continue" request (`isContinuePrompt`)
+   * matches any preserved work — the user needn't retype the original request — and among those, the one with
+   * ACTUAL PROGRESS wins over the merely most recent. Otherwise the prompt must match a checkpoint's stored
+   * `rawPrompt` (case/space-tolerant). Returns null when there is nothing to resume.
+   */
+  async findResumable(rawPrompt) {
+    const worktreesDir = join2(this.worktreeHome, ".horsecode", "worktrees");
+    if (!existsSync2(worktreesDir)) return null;
+    const inside = await this.git(["rev-parse", "--is-inside-work-tree"], this.repoRoot);
+    if (inside.code !== 0) return null;
+    const anyContinue = isContinuePrompt(rawPrompt);
+    const key = checkpointKey(rawPrompt);
+    const registered = await this.registeredWorktrees();
+    const candidates = [];
+    for (const slug of readdirSync(worktreesDir)) {
+      const root = join2(worktreesDir, slug);
+      const cp2 = readCheckpoint(root);
+      if (!cp2) continue;
+      if (!anyContinue && checkpointKey(cp2.rawPrompt) !== key) continue;
+      const baseWorktree = join2(root, "base");
+      let real;
+      try {
+        real = realpathSync(baseWorktree);
+      } catch {
+        continue;
+      }
+      if (!registered.has(real)) continue;
+      candidates.push({
+        session: { jobSlug: slug, root, baseWorktree, baseBranch: `hc/${slug}/base`, resumed: true },
+        mtime: checkpointMtime(root),
+        progress: cp2.done.length
+      });
+    }
+    if (candidates.length === 0) return null;
+    candidates.sort((a, b) => (b.progress > 0 ? 1 : 0) - (a.progress > 0 ? 1 : 0) || b.mtime - a.mtime);
+    const picked = candidates[0].session;
+    const added = await topUpInherited(this.repoRoot, picked.baseWorktree);
+    return added.length ? { ...picked, toppedUp: added } : picked;
+  }
+  /**
+   * The worktree for a task — REUSED when the task already has one.
+   *
+   * It used to mint a fresh slug every time, so a task got `…-1`, `…-2`, `…-9` and each run began from base
+   * with the previous run's work stranded in a directory nobody would open again. Measured live: 321
+   * worktrees on disk, TEN of them for one task, and the newest empty while `…-9` held 8 commits and 7.6 KB
+   * of finished work.
+   *
+   * It also made the pipeline lie. The deadline warning tells the implementer "whatever it wrote is committed
+   * and kept — continue from there rather than starting over", and across runs that was simply false: a task
+   * needing more than one run's worth of work could never accumulate any.
+   *
+   * A fresh slug is still minted when the existing directory is not a usable worktree for this task's branch,
+   * because a broken one must not stop the task.
+   */
+  async deriveTask(session, taskName) {
+    const tasksDir = join2(session.root, "tasks");
+    const slug = toSlug(taskName);
+    const branch = `hc/${session.jobSlug}/t/${slug}`;
+    const existing = join2(tasksDir, slug);
+    if (existsSync2(existing)) {
+      const ok = await this.git(["rev-parse", "--abbrev-ref", "HEAD"], existing);
+      if (ok.code === 0 && ok.stdout.trim() === branch) return { taskSlug: slug, worktree: existing, branch };
+    }
+    const taskSlug = uniqueSlug(slug, (s) => existsSync2(join2(tasksDir, s)));
+    const wt = join2(tasksDir, taskSlug);
+    const br = `hc/${session.jobSlug}/t/${taskSlug}`;
+    await this.run(["worktree", "add", "-b", br, wt, session.baseBranch], this.repoRoot);
+    return { taskSlug, worktree: wt, branch: br };
+  }
+  /**
+   * Retires a task's worktree and branch so the next derive starts from the CURRENT base.
+   *
+   * Reusing a task's worktree between attempts stopped the "start from scratch every run" waste, but it also
+   * FROZE the branch's root. Measured on a real board: the export/import task's branch was rooted two and a
+   * half days back and the base had moved 68 commits past it, while the throwaway worktrees it replaced had
+   * been rooted 29-30 commits back. Its merge then had to reconcile a drift that wide across seven files, and
+   * the resolver ran out of turns every time — twice on a review that had already PASSED.
+   *
+   * Past a few of those, re-implementing on today's base is cheaper than reconciling the drift, and it is the
+   * only move that actually removes the cause.
+   *
+   * The old branch is RENAMED, not deleted. It holds work that passed review; throwing it away to save a
+   * branch name would destroy the only copy of it.
+   */
+  async restartTask(session, task) {
+    let retired = `${task.branch}-stale`;
+    for (let n = 2; (await this.git(["rev-parse", "--verify", "--quiet", retired], this.repoRoot)).code === 0; n++) {
+      retired = `${task.branch}-stale-${n}`;
+    }
+    await this.run(["worktree", "remove", "--force", task.worktree], this.repoRoot);
+    await this.run(["branch", "-m", task.branch, retired], this.repoRoot);
+    return retired;
+  }
+  async mergeTask(session, task) {
+    return this.mergeRef(session, task.branch);
+  }
+  /**
+   * Merges any ref into the session base — a task branch coming home, or the project's main branch coming in.
+   *
+   * A resumed session picks up a branch that was cut days ago, and everything the team merged in the meantime
+   * is missing from it: it continues against code that no longer exists. Bringing main IN is the same
+   * operation as bringing a task in, which is why it is the same method and the same conflict path.
+   */
+  async mergeRef(session, ref) {
+    const r = await this.git(["merge", ref], session.baseWorktree);
+    if (r.code === 0) return { status: "merged" };
+    const diff = await this.git(
+      ["diff", "--name-only", "--diff-filter=U"],
+      session.baseWorktree
+    );
+    const files = diff.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+    if (files.length > 0) return { status: "conflict", files };
+    throw new Error(`git merge ${ref} failed (${r.code}): ${(r.stderr || r.stdout).trim()}`);
+  }
+  /**
+   * Brings one branch up to date from the remote. Best-effort: no remote, no network, no such branch — the
+   * merge then runs against the local copy, which is still better than not syncing at all.
+   *
+   * Returns the ref to merge: `origin/<branch>` when the fetch landed, the plain branch name otherwise.
+   */
+  async fetchBranch(branch) {
+    const r = await this.git(["fetch", "origin", branch], this.repoRoot);
+    if (r.code !== 0) return branch;
+    const remote = await this.git(["rev-parse", "--verify", `origin/${branch}`], this.repoRoot);
+    return remote.code === 0 ? `origin/${branch}` : branch;
+  }
+  /** Whether the session base already contains `ref` — nothing to merge, and nothing to say about it. */
+  async containsRef(session, ref) {
+    const r = await this.git(["merge-base", "--is-ancestor", ref, "HEAD"], session.baseWorktree);
+    return r.code === 0;
+  }
+  /** How many commits `ref` has that the session base does not — what a sync is about to bring in. */
+  async commitsBehind(session, ref) {
+    const r = await this.git(["rev-list", "--count", `HEAD..${ref}`], session.baseWorktree);
+    return r.code === 0 ? Number(r.stdout.trim()) || 0 : 0;
+  }
+  /** Files git marks as unmerged (conflicted) in the base worktree. */
+  async unmergedFiles(session) {
+    const r = await this.git(["diff", "--name-only", "--diff-filter=U"], session.baseWorktree);
+    return r.stdout.split("\n").map((s) => s.trim()).filter(Boolean);
+  }
+  /**
+   * Resolves one conflicted path by taking the BASE's copy, for files that are regenerated rather than merged.
+   *
+   * `--ours` during a merge means the branch being merged INTO — the session base, where the other tasks'
+   * work has already landed. For a lockfile that is the right side: it already carries every dependency the
+   * merged tasks installed, and the incoming branch's own addition is re-derived by running the package
+   * manager, not by choosing lines from a machine-written file.
+   */
+  async resolveWithBase(session, file) {
+    await this.git(["checkout", "--ours", "--", file], session.baseWorktree);
+    await this.git(["add", "--", file], session.baseWorktree);
+  }
+  /**
+   * One side of a conflicted file, as git holds it: stage 2 is the base's, stage 3 is the incoming branch's.
+   *
+   * Needed by the resolutions that COMBINE the two sides rather than choosing one — reading the working-tree
+   * copy would only give the version with the markers in it.
+   */
+  async conflictSide(session, file, side) {
+    const r = await this.git(["show", `:${side === "ours" ? 2 : 3}:${file}`], session.baseWorktree);
+    return r.code === 0 ? r.stdout : void 0;
+  }
+  /** Stages content the caller merged itself, settling that file's conflict. */
+  async resolveWith(session, file, content) {
+    await writeFile(join2(session.baseWorktree, file), content, "utf8");
+    await this.git(["add", "--", file], session.baseWorktree);
+  }
+  /** Unified diff of changes in the base worktree against the base branch (the PR diff). */
+  /**
+   * The code first, then what was written about it.
+   *
+   * Git orders a diff by path, so on a run whose work lives under `toucan/` every specification, plan,
+   * checklist and brainstorm sorts ahead of the source. Measured on PR #765 with horse-code's own state
+   * already excluded: the first 60,000 characters held nine files, all of them markdown, and not one line of
+   * the code the review existed to read. Ordering is the fix — a budget spent on prose is a budget the
+   * source never sees, however large it is.
+   */
+  async diff(session, base) {
+    const range = `${base}...${session.baseBranch}`;
+    const notDocs = DOC_SPECS.map((d) => `:(exclude)${d}`);
+    const code = await this.git(["diff", range, "--", ".", ...excludeOwnState(), ...notDocs], session.baseWorktree);
+    const docs = await this.git(["diff", range, "--", ...DOC_SPECS, ...excludeOwnState()], session.baseWorktree);
+    const out = code.stdout + docs.stdout;
+    if (out.length <= MAX_DIFF_CHARS) return out;
+    return `\u2026 (diff truncated to the first ${MAX_DIFF_CHARS} characters of ${out.length}; use the read tools to inspect anything not shown here)
+${out.slice(0, MAX_DIFF_CHARS)}`;
+  }
+  /**
+   * Rejection path: commit whatever draft the worktree holds to its branch (so the work is NOT lost) and
+   * KEEP both the worktree directory and the branch, so the user can inspect the produced files directly
+   * under .horsecode/worktrees/<slug>/base. Returns the worktree path. (closeSession, by contrast, deletes
+   * the worktree + branch — but nothing currently calls it on the happy path; worktrees are kept for inspection.)
+   */
+  async preserveSession(session, message) {
+    await this.commitMerge(session, message);
+    return session.baseWorktree;
+  }
+  async commitMerge(session, message) {
+    await this.run(["add", "-A"], session.baseWorktree);
+    const staged = await this.git(["diff", "--cached", "--quiet"], session.baseWorktree);
+    if (staged.code === 0) return;
+    await this.run(message ? ["commit", "-m", message] : ["commit", "--no-edit"], session.baseWorktree);
+  }
+  /** Commits all changes in the task worktree to the task branch; no-op if there are no changes. */
+  async commitTask(task, message) {
+    await this.run(["add", "-A"], task.worktree);
+    const staged = await this.git(["diff", "--cached", "--quiet"], task.worktree);
+    if (staged.code === 0) return;
+    await this.run(["commit", "-m", message], task.worktree);
+  }
+  async abortMerge(session) {
+    await this.run(["merge", "--abort"], session.baseWorktree);
+  }
+  async removeTask(session, task) {
+    await this.git(["worktree", "remove", "--force", task.worktree], this.repoRoot);
+    await this.git(["branch", "-D", task.branch], this.repoRoot);
+  }
+  async closeSession(session) {
+    await rm2(session.root, { recursive: true, force: true });
+    await this.git(["worktree", "prune"], this.repoRoot);
+    const prefix = `hc/${session.jobSlug}/`;
+    const list = await this.git(["branch", "--list"], this.repoRoot);
+    const branches = list.stdout.split("\n").map((s) => s.replace(/^[*+ ]+/, "").trim()).filter((b) => b.startsWith(prefix));
+    for (const b of branches) {
+      await this.git(["branch", "-D", b], this.repoRoot);
+    }
+  }
+  /** Whether a remote exists — the difference between a pull request being delivery and being impossible. */
+  async hasRemote(session, remote = "origin") {
+    return (await this.git(["remote", "get-url", remote], session.baseWorktree)).code === 0;
+  }
+  async push(session, remote = "origin") {
+    const check = await this.git(["remote", "get-url", remote], session.baseWorktree);
+    if (check.code !== 0) return;
+    await this.run(["push", remote, session.baseBranch], session.baseWorktree);
+  }
+  async openPR(session, adapter, input) {
+    const res = await adapter.createPR({
+      branch: session.baseBranch,
+      base: input.base,
+      title: input.title,
+      body: input.body
+    });
+    return { url: res.url };
+  }
+};
+
+// src/engine/unfinished.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync, statSync } from "fs";
+import { join as join3 } from "path";
+function boardCounts(dir) {
+  try {
+    const raw = JSON.parse(readFileSync(join3(dir, "board.json"), "utf8"));
+    const cards = Array.isArray(raw.cards) ? raw.cards : Object.values(raw.cards ?? {});
+    const list = cards;
+    return { total: list.length, done: list.filter((c) => c.column === "MERGED" || c.column === "DONE").length };
+  } catch {
+    return { total: 0, done: 0 };
+  }
+}
+function unfinishedSessions(cwd, commitCount = () => 0) {
+  const root = join3(cwd, ".horsecode", "worktrees");
+  if (!existsSync3(root)) return [];
+  const out = [];
+  for (const id of readdirSync2(root)) {
+    const dir = join3(root, id);
+    try {
+      if (!statSync(dir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    if (!existsSync3(join3(dir, "base"))) continue;
+    const checkpoint = readCheckpoint(dir);
+    if (!checkpoint) continue;
+    let updatedAt = 0;
+    try {
+      updatedAt = statSync(join3(dir, "checkpoint.json")).mtimeMs;
+    } catch {
+    }
+    out.push({
+      id,
+      checkpoint,
+      cards: boardCounts(dir),
+      commits: commitCount(`hc/${id}/base`),
+      updatedAt
+    });
+  }
+  return out.sort((a, b) => b.updatedAt - a.updatedAt);
+}
+function describeUnfinished(s) {
+  const asked = s.checkpoint.rawPrompt.trim() || s.checkpoint.title;
+  const bits = [
+    s.checkpoint.done.length ? `${s.checkpoint.done.join(" \u2192 ")} done` : "nothing finished yet",
+    s.cards.total ? `${s.cards.done}/${s.cards.total} tasks` : "",
+    s.commits ? `${s.commits} commit${s.commits === 1 ? "" : "s"}` : ""
+  ].filter(Boolean);
+  return `\u201C${asked.length > 70 ? `${asked.slice(0, 69)}\u2026` : asked}\u201D \u2014 ${bits.join(" \xB7 ")} (\`${s.id}\`; say **continue** to pick it up)`;
+}
+
+// src/tools/git.ts
+import { execFile } from "child_process";
+import { z } from "zod";
+var READ_ONLY = /* @__PURE__ */ new Set([
+  "status",
+  "log",
+  "show",
+  "diff",
+  "blame",
+  "shortlog",
+  "whatchanged",
+  "rev-parse",
+  "rev-list",
+  "merge-base",
+  "name-rev",
+  "describe",
+  "symbolic-ref",
+  "ls-files",
+  "ls-tree",
+  "cat-file",
+  "count-objects",
+  "show-ref",
+  "for-each-ref",
+  "ls-remote",
+  /**
+   * `git grep` searches tracked content and has no writing form at all — the same standing as `log`.
+   *
+   * Left out, it was refused twice in one 36-minute run while agents fell back to `find | xargs grep`
+   * through the shell, which is slower on a repository this size and searches build output and
+   * `node_modules` unless every caller remembers to prune them. git already knows what is tracked.
+   */
+  "grep",
+  /**
+   * `check-ignore` asks whether a path is ignored — it reads `.gitignore` and answers, and changes nothing.
+   *
+   * Left out, it was the one read-only verb agents had to reach for `shell` to run: four calls in one run,
+   * each landing outside the tool that knows this repository's rules. And through `shell` its exit code is
+   * raw, so "no, that path is not ignored" — which git says with 1 — came back as a failed command.
+   */
+  "check-ignore"
+]);
+var READ_ONLY_PAIRS = /* @__PURE__ */ new Set([
+  "worktree list",
+  "tag --list",
+  "tag -l",
+  "stash list",
+  "remote -v",
+  "remote show",
+  "config --get",
+  "config --list",
+  /**
+   * The long forms of what is already allowed, and the queries that only ask.
+   *
+   * `branch -a` was allowed and `branch --all` was not — the same command spelled the way git's own
+   * documentation spells it. Measured in one run: an agent asked for `branch --all` and then `branch
+   * --show-current`, and paid a refused turn for each while `-a` sat in this list. A short flag admitted and
+   * its long twin refused is not a security boundary, it is a typo in one.
+   *
+   * These are the closure of what this set already permits, not new ground: every one of them prints
+   * information about branches or tags and none of them can create, move or delete a ref. The forms that
+   * write — `-d`, `-D`, `-m`, `-M`, `-c`, `-C`, `--delete`, `--move`, `--copy`, `--set-upstream-to`,
+   * `--edit-description` — are still absent, and a first argument that is not a flag never reaches here.
+   */
+  "tag --contains",
+  "tag --no-contains",
+  "tag --merged",
+  "tag --points-at",
+  "tag -n",
+  "remote --verbose",
+  "remote get-url",
+  "stash show"
+]);
+var REFUSED_ARG = /^(--output|-c$|--config-env|--exec-path|-C$|--git-dir|--work-tree|--upload-pack|--receive-pack)/;
+var params = z.object({
+  args: z.array(z.string()).min(1).describe(
+    'Git arguments as a list, without the leading "git" \u2014 e.g. ["status","--porcelain"] or ["log","-5","--oneline"].'
+  )
+});
+var MAX_GIT_OUTPUT = 6e4;
+var GIT_TIMEOUT_MS = 3e4;
+var GIT_PUSH_TIMEOUT_MS = 12e4;
+var ANSWERS_WITH_ONE = /* @__PURE__ */ new Set([
+  "diff",
+  "diff-index",
+  "diff-tree",
+  "diff-files",
+  "merge-base",
+  "check-ignore",
+  /**
+   * `grep` says "no match" with exit 1, exactly as the others say their own no.
+   *
+   * Admitted to the read-only set earlier tonight and left out of this one, so a search that found nothing
+   * came back as `git failed with no output.` — a fault where there was an answer. Measured live within
+   * minutes: `git grep -n -i ExportReportService.cs` twice, both reported as failures, for a file that
+   * simply is not in the repository.
+   */
+  "grep"
+]);
+function answeredWithOne(args, code) {
+  return code === 1 && ANSWERS_WITH_ONE.has(args[0] ?? "");
+}
+function howToNarrow(args) {
+  const verb = gitVerb(args) ?? "";
+  if (verb === "diff" || verb === "show") {
+    return "narrow the range, or put `--stat` directly after the subcommand (git " + verb + " --stat <rest>), which git requires";
+  }
+  if (verb === "log") return "ask for fewer commits (-n 20) or just their subjects (--oneline)";
+  if (verb === "ls-files" || verb === "ls-tree") return "narrow the pathspec to one directory at a time";
+  if (verb === "blame") return "limit it to a range of lines (-L 40,120)";
+  return "ask for a narrower part of it";
+}
+function answerOfOne(args) {
+  const verb = args[0] ?? "";
+  if (verb === "check-ignore") {
+    return "No \u2014 that path is not ignored by this repository's rules. (git exit code 1, which is the answer here.)";
+  }
+  if (verb === "grep") {
+    return "No match \u2014 nothing in the tracked files matches that pattern. (git exit code 1, which is the answer here.)";
+  }
+  if (verb === "merge-base") {
+    return args.includes("--is-ancestor") ? "No \u2014 the first commit is not an ancestor of the second. (git exit code 1, which is the answer here.)" : "No merge base: these commits share no common ancestor. (git exit code 1, which is the answer here.)";
+  }
+  return "There ARE differences \u2014 the comparison is not empty. Nothing failed; `--quiet`/`--exit-code` reports this as exit code 1. Re-run without it to see them.";
+}
+function packedArgument(a) {
+  if (!/\s/.test(a)) return void 0;
+  if (/^--?[\w-]+[=:]/.test(a)) return void 0;
+  const parts = a.trim().split(/\s+/).filter(Boolean);
+  if (parts.length < 2) return void 0;
+  if (parts[0] === "--") return parts;
+  return parts.slice(1).some((p) => p === "--" || p.startsWith("-") || p.includes("/")) ? parts : void 0;
+}
+var GLUED_PATHSPEC = /^--[^\s=]*\/[^\s=]*$/;
+var BRANCH_TAKES_VALUE = /* @__PURE__ */ new Set([
+  "--contains",
+  "--no-contains",
+  "--merged",
+  "--no-merged",
+  "--points-at",
+  "--format",
+  "--sort",
+  "--color",
+  "--abbrev",
+  "-u",
+  "--set-upstream-to",
+  "-t",
+  "--track"
+]);
+var BRANCH_WRITERS = /* @__PURE__ */ new Set([
+  "-d",
+  "-D",
+  "--delete",
+  "-m",
+  "-M",
+  "--move",
+  "-c",
+  "-C",
+  "--copy",
+  "--edit-description",
+  "--set-upstream",
+  "--set-upstream-to",
+  "--unset-upstream",
+  "-u",
+  "-t",
+  "--track",
+  "--no-track",
+  "-f",
+  "--force"
+]);
+function branchWrites(rest) {
+  const listing = rest.some((a) => a === "--list" || a === "-l");
+  for (let i = 0; i < rest.length; i++) {
+    const a = rest[i];
+    if (a === void 0) continue;
+    if (a === "--") return "`git branch` with a pathspec is not a thing this tool needs to run.";
+    if (a.startsWith("--")) {
+      const name = a.split("=")[0];
+      if (BRANCH_WRITERS.has(name)) return `\`git branch ${name}\` changes a branch. Only listing is allowed.`;
+      if (BRANCH_TAKES_VALUE.has(name) && !a.includes("=")) i++;
+      continue;
+    }
+    if (a.startsWith("-")) {
+      const bad = [...a.slice(1)].find((c) => BRANCH_WRITERS.has(`-${c}`));
+      if (bad) return `\`git branch -${bad}\` changes a branch. Only listing is allowed.`;
+      if (BRANCH_TAKES_VALUE.has(a)) i++;
+      continue;
+    }
+    if (listing) continue;
+    if (/[*?\[]/.test(a)) {
+      return `\`git branch ${a}\` would create a branch with that literal name. To search for branches, put the pattern after --list: \`git branch --list ${a}\`.`;
+    }
+    return `\`git branch ${a}\` creates a branch. Only listing is allowed \u2014 git_write owns the rest.`;
+  }
+  return void 0;
+}
+function refuse(args) {
+  const packed = args.find((a) => packedArgument(a) !== void 0 || GLUED_PATHSPEC.test(a));
+  if (packed !== void 0) {
+    const split = packedArgument(packed) ?? ["--", packed.slice(2)];
+    if (split[0] !== "--") {
+      return `each item in the list is ONE argument \u2014 this one holds several: ${JSON.stringify([packed]).slice(0, 90)}. Send ${JSON.stringify(split).slice(0, 130)} instead.`;
+    }
+    const parts = split.slice(1);
+    return `\`--\` is the separator and must be its own element of the list \u2014 it is never part of a path. You sent ${JSON.stringify([packed]).slice(0, 90)}; send ${JSON.stringify(["--", ...parts]).slice(0, 130)} instead (however many paths follow, they are separate elements too).`;
+  }
+  const bad = args.find((a) => REFUSED_ARG.test(a));
+  if (bad) {
+    return `\`${bad}\` is not allowed: it can write a file, run a program through git's configuration, or point git at another repository.`;
+  }
+  const [sub, second] = args;
+  if (!sub || sub.startsWith("-")) return "The first argument must be a git subcommand, e.g. `status`.";
+  if (READ_ONLY.has(sub)) return void 0;
+  if (sub === "branch") return branchWrites(args.slice(1));
+  if (sub === "reflog") {
+    return second === "expire" || second === "delete" ? `\`git reflog ${second}\` rewrites the reflog. Only reading it is allowed.` : void 0;
+  }
+  if (sub === "config") {
+    if (second !== void 0 && !second.startsWith("-") && args.length === 2) return void 0;
+    if (args.length > 2 && !args.some((a) => a.startsWith("--get") || a === "--list")) {
+      return "`git config <key> <value>` writes configuration. Read one with `git config <key>`.";
+    }
+  }
+  if (second && READ_ONLY_PAIRS.has(`${sub} ${second}`)) return void 0;
+  return `\`git ${sub}\` is not available here \u2014 this tool reads history and state, it never changes them. Available: ${[...READ_ONLY].sort().join(", ")}; also ${[...READ_ONLY_PAIRS].sort().join(", ")}.`;
+}
+var gitTool = {
+  name: "git",
+  description: 'Runs a READ-ONLY git command in the working directory and returns its output. Pass arguments as a list without the leading `git`: ["status","--porcelain"], ["log","-10","--oneline"], ["diff","--stat","main...HEAD"], ["show","abc123:path/to/file"]. Use it for what only git knows \u2014 what changed, when, by which commit, how a branch compares to another. Commands that change anything (checkout, commit, reset, clean, branch -D, stash, worktree add) are refused.',
+  permissionLevel: "safe",
+  parameters: params,
+  describe: (args) => {
+    const list = args.args;
+    const text = Array.isArray(list) ? list.join(" ") : "";
+    return { allowKey: "git:read", preview: `git ${text}`.slice(0, 120) };
+  },
+  async run(rawArgs, ctx) {
+    const parsed = params.safeParse(rawArgs);
+    if (!parsed.success) {
+      return { content: `git: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`, isError: true };
+    }
+    const args = parsed.data.args;
+    const why = refuse(args);
+    if (why) return { content: why, isError: true, settled: true };
+    const out = await new Promise((resolve2) => {
+      const child = execFile("git", args, {
+        cwd: ctx.cwd,
+        timeout: GIT_TIMEOUT_MS,
+        maxBuffer: MAX_GIT_OUTPUT * 4,
+        // `--no-pager` would still be needed for some subcommands; killing the pager entirely is simpler and
+        // leaves nothing waiting for a terminal that does not exist.
+        env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" }
+      }, (err, stdout, stderr) => {
+        const text = `${stdout}${stderr}`.trim();
+        resolve2({ code: err?.code ?? (err ? 1 : 0), text });
+      });
+      ctx.signal?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
+    });
+    const failed = out.code !== 0 && !answeredWithOne(args, out.code);
+    if (!out.text) {
+      if (!failed && out.code === 1) return { content: answerOfOne(args), isError: false };
+      return { content: out.code === 0 ? "(no output)" : "git failed with no output.", isError: failed };
+    }
+    const clipped = out.text.length > MAX_GIT_OUTPUT ? `${truncateSafe(out.text, MAX_GIT_OUTPUT)}
+\u2026[truncated \u2014 ${howToNarrow(args)}]` : out.text;
+    return { content: clipped, isError: failed };
+  }
+};
+var WRITE = /* @__PURE__ */ new Set(["add", "commit", "push", "fetch"]);
+var REFSPEC = /:/;
+var REFUSED_PUSH = /^(-f|--force|--force-with-lease|--delete|--mirror|--prune)/;
+function refuseWrite(args) {
+  const bad = args.find((a) => REFUSED_ARG.test(a));
+  if (bad) {
+    return `\`${bad}\` is not allowed: it can write a file, run a program through git's configuration, or point git at another repository.`;
+  }
+  const [sub] = args;
+  if (!sub || !WRITE.has(sub)) {
+    return `\`git ${sub ?? ""}\` is not available here \u2014 this tool records work (${[...WRITE].join(", ")}). Use the \`git\` tool to read history and state.`;
+  }
+  if (sub === "fetch") {
+    const spec = args.slice(1).find((a) => REFSPEC.test(a) && !a.startsWith("-"));
+    if (spec) {
+      return `\`${spec}\` is not allowed: a refspec can move LOCAL branches, including the one this session is standing on. Fetch without one \u2014 it updates the remote-tracking refs, which is what tells you whether the remote has moved.`;
+    }
+    const pruned = args.find((a) => /^(--prune|-p)$/.test(a));
+    if (pruned) {
+      return `\`${pruned}\` is not allowed: it deletes remote-tracking refs, and something else may be relying on one. Fetch without it.`;
+    }
+  }
+  const forced = sub === "push" && args.find((a) => REFUSED_PUSH.test(a));
+  if (forced) {
+    return `\`${forced}\` is not allowed: it rewrites or removes history on the remote, which no one can undo from here. Push the branch as it stands, or ask the user to do the rewrite themselves.`;
+  }
+  return void 0;
+}
+var gitWriteTool = {
+  name: "git_write",
+  description: 'Changes git state: `add`, `commit`, `push` and `fetch`, nothing else. `fetch` updates the remote-tracking refs so you can see whether the remote has moved \u2014 it touches no local branch and no file; refspecs and `--prune` are refused. To merge what you fetched, ask the user. Pass arguments as a list without the leading `git`: ["add","docs/architecture"], ["commit","-m","docs: refresh traces"], ["push"]. Use it ONLY when the user has asked for the work to be recorded \u2014 committing on your own initiative puts a change in their history that they did not ask for. Every call goes through the permission prompt, so do the job in as few calls as it takes, and say what you are about to commit BEFORE you call it. Read the state first with the `git` tool \u2014 which branch you are on, what is staged, what changed \u2014 and never commit what you have not looked at. Force pushes and history rewrites are refused.',
+  permissionLevel: "exec",
+  parameters: params,
+  describe: (args) => {
+    const list = args.args;
+    const text = Array.isArray(list) ? list.join(" ") : "";
+    const sub = Array.isArray(list) && typeof list[0] === "string" ? list[0] : "";
+    return { allowKey: `git ${sub}`, preview: `git ${text}`.slice(0, 200) };
+  },
+  async run(rawArgs, ctx) {
+    const parsed = params.safeParse(rawArgs);
+    if (!parsed.success) {
+      return { content: `git_write: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`, isError: true };
+    }
+    const args = parsed.data.args;
+    const why = refuseWrite(args);
+    if (why) return { content: why, isError: true, settled: true };
+    const out = await new Promise((resolve2) => {
+      const child = execFile("git", args, {
+        cwd: ctx.cwd,
+        // A push talks to a server: the read tool's 30s is a reasonable ceiling for a local query and a
+        // pessimistic one for a repository with anything in it.
+        timeout: args[0] === "push" ? GIT_PUSH_TIMEOUT_MS : GIT_TIMEOUT_MS,
+        maxBuffer: MAX_GIT_OUTPUT * 4,
+        // GIT_TERMINAL_PROMPT=0: a push that needs credentials fails with a message instead of blocking on a
+        // prompt no one can see — the TUI owns the terminal, so the agent would simply hang.
+        env: { ...process.env, GIT_PAGER: "cat", PAGER: "cat", GIT_TERMINAL_PROMPT: "0" }
+      }, (err, stdout, stderr) => {
+        resolve2({ code: err ? 1 : 0, text: `${stdout}${stderr}`.trim() });
+      });
+      ctx.signal?.addEventListener("abort", () => child.kill("SIGKILL"), { once: true });
+    });
+    if (!out.text) return { content: out.code === 0 ? "(done)" : "git failed with no output.", isError: out.code !== 0 };
+    const clipped = out.text.length > MAX_GIT_OUTPUT ? `${truncateSafe(out.text, MAX_GIT_OUTPUT)}
+\u2026[truncated]` : out.text;
+    return { content: clipped, isError: out.code !== 0 };
+  }
+};
+
+// src/tools/remember.ts
+import { z as z2 } from "zod";
+var params2 = z2.object({
+  fact: z2.string().describe(
+    "One short sentence, durable and project-specific: where something lives, which command builds it, a convention this codebase follows, a schema detail that cost you a search. Not what you did, not what is true of the language in general \u2014 something the next agent would otherwise have to rediscover."
+  )
+});
+function buildRememberTool(sink) {
+  return {
+    name: "remember_fact",
+    description: "Save a short, durable fact worth recalling in future sessions \u2014 a project convention, where something lives, a schema detail, a command that works. It is written straight away, so a session that stops early still leaves it behind. Use it the moment you learn something you would not want to work out twice; skip anything transient or specific to the task in hand.",
+    permissionLevel: "safe",
+    parameters: params2,
+    async run(rawArgs, ctx) {
+      const parsed = params2.safeParse(rawArgs);
+      if (!parsed.success) return { content: "remember_fact: invalid args (expected { fact })", isError: true };
+      const fact = parsed.data.fact.trim();
+      if (!fact) return { content: "remember_fact: empty fact", isError: true };
+      const write = sink ?? ctx.remember;
+      if (!write) return { content: "remember_fact: memory is not available in this context", isError: true };
+      write(fact);
+      return { content: `Remembered: ${fact}`, isError: false };
+    }
+  };
+}
+var rememberFactTool = buildRememberTool();
+
+// src/speckit/layout.ts
+import { existsSync as existsSync4, mkdirSync, readdirSync as readdirSync3 } from "fs";
+import { join as join4 } from "path";
+function specsDir(workdir) {
+  return join4(workdir, "specs");
+}
+function constitutionPath(workdir) {
+  return join4(workdir, ".specify", "memory", "constitution.md");
+}
+function featurePaths(workdir, slug) {
+  const dir = join4(specsDir(workdir), slug);
+  return { dir, brainstorm: join4(dir, "brainstorm.md"), spec: join4(dir, "spec.md"), plan: join4(dir, "plan.md"), tasks: join4(dir, "tasks.md") };
+}
+function verifyPaths(workdir, slug) {
+  const dir = join4(specsDir(workdir), slug);
+  return { dir, plan: join4(dir, "test-plan.md"), report: join4(dir, "test-report.md") };
+}
+var ACTIVITY_WORDS = /* @__PURE__ */ new Set([
+  "test",
+  "tests",
+  "testing",
+  "smoke",
+  "e2e",
+  "verify",
+  "verification",
+  "verifying",
+  "check",
+  "checking",
+  "run",
+  "running",
+  "continue",
+  "continuing",
+  "report",
+  "session",
+  "the",
+  "for",
+  "of",
+  "a",
+  "an",
+  "and"
+]);
+var subjectWords = (slug) => new Set(slug.split("-").filter((w) => w.length > 2 && !ACTIVITY_WORDS.has(w)));
+function featureSlugFor(workdir, title) {
+  const want = toSlug(title);
+  const dir = specsDir(workdir);
+  if (existsSync4(dir)) {
+    const names = readdirSync3(dir);
+    for (const name of names) {
+      if (name.replace(/^\d+-/, "") === want) return name;
+    }
+    const wanted = subjectWords(want);
+    let best;
+    for (const name of names) {
+      const shared = [...subjectWords(name.replace(/^\d+-/, ""))].filter((w) => wanted.has(w)).length;
+      if (shared >= 2 && (!best || shared > best.shared)) best = { name, shared };
+    }
+    if (best) return best.name;
+  }
+  return nextFeatureSlug(workdir, title);
+}
+function nextFeatureSlug(workdir, title) {
+  const dir = specsDir(workdir);
+  let max = 0;
+  if (existsSync4(dir)) {
+    for (const name of readdirSync3(dir)) {
+      const m = name.match(/^(\d+)-/);
+      if (m) max = Math.max(max, Number(m[1]));
+    }
+  }
+  return `${String(max + 1).padStart(3, "0")}-${toSlug(title)}`;
+}
+function scaffoldFeature(workdir, slug) {
+  const paths = featurePaths(workdir, slug);
+  mkdirSync(paths.dir, { recursive: true });
+  mkdirSync(join4(workdir, ".specify", "memory"), { recursive: true });
+  return paths;
+}
+
+// src/engine/constitution-store.ts
+import { createHash } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join5 } from "path";
+import { z as z3 } from "zod";
+
+// src/engine/constitution.ts
+var SCOPES = ["always", "backend", "frontend", "data", "infra", "docs", "review", "spec", "test", "govern"];
+var RATIONALE = /^\s*\*(?:Gerekçe|Rationale):\*/i;
+function sectionOf(heading) {
+  const m = /^([IVXLC]+)\.\s/.exec(heading);
+  return m ? m[1] : heading;
+}
+function parseConstitution(text) {
+  const out = [];
+  let heading = "";
+  let buf = [];
+  const flush = () => {
+    const block = buf.join("\n").trim();
+    buf = [];
+    if (!block || !heading || RATIONALE.test(block)) return;
+    out.push({ section: sectionOf(heading), heading, text: block });
+  };
+  for (const line of text.split("\n")) {
+    const h = /^#{2,3}\s+(.*)$/.exec(line);
+    if (h) {
+      flush();
+      heading = /^core principles$/i.test(h[1].trim()) ? "" : h[1].trim();
+      continue;
+    }
+    if (!line.trim()) {
+      flush();
+      continue;
+    }
+    buf.push(line);
+  }
+  flush();
+  return out;
+}
+var BY_EXT = [
+  [/\.(cs|java|kt|go|py|rb|php|scala|rs)$/i, "backend"],
+  [/\.(ts|tsx|js|jsx|html|css|scss|sass|less|vue|svelte)$/i, "frontend"],
+  [/\.(sql)$|(^|\/)migrations?\//i, "data"],
+  [/\.(tf|tfvars)$|(^|\/)(k8s|helm|charts|deploy|infra)\//i, "infra"],
+  [/\.(md|mdx|adoc)$/i, "docs"]
+];
+var BY_ROLE = {
+  "code-reviewer": ["review"],
+  "principal-coder": ["review"],
+  "senior-coder": ["review"],
+  analyst: ["spec"],
+  planner: ["spec"],
+  brainstormer: ["spec"],
+  tester: ["test"]
+};
+function scopesForWork(opts) {
+  const out = /* @__PURE__ */ new Set(["always"]);
+  for (const s of BY_ROLE[opts.role ?? ""] ?? []) out.add(s);
+  for (const f of opts.files ?? []) for (const [re, scope] of BY_EXT) if (re.test(f)) out.add(scope);
+  return out;
+}
+var MAX_CONSTITUTION_CHARS = 2e4;
+function selectRules(rules, scopes, max = MAX_CONSTITUTION_CHARS) {
+  const applies = (r) => r.scopes.some((s) => scopes.has(s));
+  const always = rules.filter((r) => r.scopes.includes("always"));
+  const scoped = rules.filter((r) => !r.scopes.includes("always") && applies(r));
+  const used = [...always];
+  const dropped = [];
+  let size = used.reduce((n, r) => n + r.text.length, 0);
+  for (const r of scoped) {
+    if (size + r.text.length > max) {
+      dropped.push(r);
+      continue;
+    }
+    used.push(r);
+    size += r.text.length;
+  }
+  return { text: render(used, dropped), used, dropped };
+}
+function render(used, dropped) {
+  if (!used.length) return "";
+  const byHeading = /* @__PURE__ */ new Map();
+  for (const r of used) byHeading.set(r.heading, [...byHeading.get(r.heading) ?? [], r.text]);
+  const body = [...byHeading].map(([h, texts]) => `## ${h}
+${texts.join("\n\n")}`).join("\n\n");
+  const cut = dropped.length ? `
+
+(${dropped.length} further section(s) of the constitution apply to this work but did not fit: ${[...new Set(dropped.map((d) => d.section))].join(", ")}. Read them in the constitution if this change goes near them.)` : "";
+  return `
+
+# Project constitution \u2014 the rules that bind THIS work
+
+These are binding, and they are the project's own words. Where they and anything else disagree, they win. The full document is at \`.specify/memory/constitution.md\`.
+
+${body}${cut}`;
+}
+var CLASSIFY_PROMPT = `You are labelling the rules of a software project's constitution so each one can be handed to the agents it actually binds.
+
+For each rule, answer with the scopes it is ABOUT, from exactly this list: ${SCOPES.join(", ")}.
+
+- \`backend\`, \`frontend\`, \`data\`, \`infra\`: it names code, files or tooling of that kind \u2014 a language, a framework, a database, a deployment target.
+- \`spec\`: it constrains what a specification or plan may say (the stack, the boundaries, the vocabulary).
+- \`review\`: it is a gate a reviewer applies \u2014 what blocks a merge, how findings are reported.
+- \`test\`: it is about verification and evidence.
+- \`govern\`: it is about amending the constitution itself, and binds nobody else.
+- \`always\`: it names NO particular kind of code. It is about how to work, how to talk to the user, or what may never be done \u2014 so it binds every role on every task.
+
+A rule may carry several scopes. \`always\` is a real answer, not a safe one: use it when the rule genuinely mentions no kind of code, and NOT because you are unsure. If a rule is about backend code, say \`backend\` \u2014 labelling it \`always\` sends it to everyone writing CSS.
+
+Answer for EVERY index you are given, and for no others. Do not translate, summarise or rewrite anything \u2014 you are only labelling.
+
+Return {labels: [{index, scopes}]} via submit, one entry per rule, in the order given.`;
+var CLASSIFY_BATCH = 20;
+var CLASSIFY_RETRIES = 2;
+function classifyMessage(rules, offset = 0) {
+  return rules.map((r, i) => `--- ${i + offset} --- (${r.heading})
+${r.text}`).join("\n\n");
+}
+function applyLabels(rules, labels) {
+  const known = new Set(SCOPES);
+  const byIndex = new Map(labels.map((l) => [l.index, l.scopes.filter((s) => known.has(s))]));
+  const unlabelled = [];
+  const scoped = rules.map((r, i) => {
+    const scopes = byIndex.get(i) ?? [];
+    if (!scopes.length) unlabelled.push(i);
+    return { ...r, scopes: scopes.length ? scopes : ["always"] };
+  });
+  return { scoped, unlabelled };
+}
+var MAX_ALWAYS_SHARE = 0.35;
+function labellingLooksWrong(scoped) {
+  if (!scoped.length) return void 0;
+  const always = scoped.filter((r) => r.scopes.includes("always")).length;
+  if (always > scoped.length * MAX_ALWAYS_SHARE) {
+    return `${always} of ${scoped.length} rules came back as \`always\``;
+  }
+  return void 0;
+}
+
+// src/engine/constitution-store.ts
+var LabelsSchema = z3.object({
+  labels: z3.array(z3.object({
+    index: z3.number().int().describe("The rule's number, exactly as given to you."),
+    scopes: z3.array(z3.enum(SCOPES)).describe(
+      `Which kinds of work this rule actually binds. Only the ones it really governs: a rule that reaches everyone is carried into every agent's prompt, so a scope added "to be safe" is paid for on every call that will never use it.`
+    )
+  }))
+});
+var CLASSIFY_MAX_TURNS = 3;
+function cachePath(home, text) {
+  const hash = createHash("sha256").update(text).digest("hex").slice(0, 16);
+  return join5(home, ".horsecode", "constitution", `${hash}.json`);
+}
+var memo = /* @__PURE__ */ new Map();
+async function scopedConstitution(deps, cwd) {
+  const path = constitutionPath(cwd);
+  if (!existsSync5(path)) return [];
+  let text;
+  try {
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return [];
+  }
+  const cache = cachePath(deps.home, text);
+  const hit = memo.get(cache);
+  if (hit) return hit;
+  if (existsSync5(cache)) {
+    try {
+      const saved = JSON.parse(readFileSync2(cache, "utf8"));
+      memo.set(cache, saved);
+      return saved;
+    } catch {
+    }
+  }
+  const rules = parseConstitution(text);
+  if (!rules.length) return [];
+  deps.note?.(`\u{1F4DC} Reading the project constitution \u2014 ${rules.length} rules, labelled once so each reaches the work it binds.`);
+  const labels = [];
+  const resolved = deps.roleRegistry.resolve("judge");
+  let failed = 0;
+  for (let start = 0; start < rules.length; start += CLASSIFY_BATCH) {
+    const batch = rules.slice(start, start + CLASSIFY_BATCH);
+    for (let attempt = 0; attempt <= CLASSIFY_RETRIES; attempt++) {
+      try {
+        const out = await runStructuredRole({
+          provider: deps.provider,
+          ...resolved,
+          systemPrompt: CLASSIFY_PROMPT,
+          tools: new ToolRegistry(),
+          messages: [{ role: "user", content: classifyMessage(batch, start) }],
+          permission: deps.permission,
+          approve: deps.approve,
+          cwd,
+          signal: deps.signal,
+          maxTurns: CLASSIFY_MAX_TURNS
+        }, LabelsSchema);
+        labels.push(...out.labels);
+        break;
+      } catch {
+        if (attempt === CLASSIFY_RETRIES) failed++;
+      }
+    }
+  }
+  const { scoped, unlabelled } = applyLabels(rules, labels);
+  if (unlabelled.length) {
+    deps.note?.(`\u26A0\uFE0F ${unlabelled.length} of ${rules.length} constitution rules could not be labelled \u2014 those go to every role. A rule sent too widely is noise; one sent nowhere is not a rule.`);
+  }
+  const wrong = labellingLooksWrong(scoped);
+  if (failed || wrong) {
+    deps.note?.(`\u26A0\uFE0F The constitution labelling is not trustworthy \u2014 ${failed ? `${failed} batch(es) failed` : wrong}. Not caching it, so the next session tries again rather than inheriting it.`);
+  } else {
+    try {
+      mkdirSync2(join5(deps.home, ".horsecode", "constitution"), { recursive: true });
+      writeFileSync(cache, JSON.stringify(scoped), "utf8");
+    } catch {
+    }
+  }
+  memo.set(cache, scoped);
+  return scoped;
+}
+async function constitutionNote(deps, cwd, work) {
+  const scoped = await scopedConstitution(deps, cwd);
+  if (!scoped.length) return "";
+  const sel = selectRules(scoped, scopesForWork(work));
+  if (sel.dropped.length) {
+    deps.note?.(`\u{1F4DC} ${sel.dropped.length} constitution section(s) that apply here did not fit the prompt: ${[...new Set(sel.dropped.map((d) => d.section))].join(", ")}.`);
+  }
+  return sel.text;
+}
+
+// src/engine/reviewer.ts
+import { z as z7 } from "zod";
+
+// src/tools/find-tool.ts
+import { z as z4 } from "zod";
+var params3 = z4.object({
+  query: z4.string().describe(
+    'What you need a tool for, in a few words \u2014 e.g. "pull request comments", "list angular projects". Or an exact tool name to fetch just that one.'
+  )
+});
+var MAX_FOUND = 5;
+var NOISE = /* @__PURE__ */ new Set([
+  "the",
+  "a",
+  "an",
+  "of",
+  "for",
+  "in",
+  "on",
+  "to",
+  "and",
+  "or",
+  "with",
+  "by",
+  "from",
+  "get",
+  "list",
+  "tool",
+  "project",
+  "use",
+  "this",
+  "that",
+  "it",
+  "is",
+  "are",
+  "be",
+  "mcp"
+]);
+var words = (s) => s.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 1 && !NOISE.has(w));
+function scoreTool(t, query) {
+  const q = words(query);
+  if (!q.length) return 0;
+  const name = t.name.toLowerCase();
+  const desc = t.description.toLowerCase();
+  let score = 0;
+  for (const w of q) {
+    if (name.includes(w)) score += 3;
+    else if (desc.includes(w)) score += 1;
+  }
+  if (name === query.toLowerCase().trim()) score += 100;
+  return score;
+}
+function buildFindToolTool(registry) {
+  return {
+    name: "find_tool",
+    description: 'Fetches the full definition of a project tool so you can call it. The system prompt lists the tools this project connects, by name and one line each; their parameters are not loaded until you ask. Pass what you need \u2014 "pull request threads", "run a build pipeline" \u2014 or an exact tool name. The matches become callable from your NEXT message, so call this first, then call the tool itself. If a search returns nothing useful, do the job with the tools you already have rather than searching again with different words.',
+    permissionLevel: "safe",
+    parameters: params3,
+    run: async (rawArgs) => {
+      const parsed = params3.safeParse(rawArgs);
+      if (!parsed.success) {
+        return { content: `find_tool: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`, isError: true };
+      }
+      const { query } = parsed.data;
+      const pool = registry.deferredTools().filter((t) => t.broken === void 0);
+      if (!pool.length) {
+        return {
+          content: "Every tool this project connects is already loaded \u2014 there is nothing further to fetch. Use the ones you have.",
+          isError: false
+        };
+      }
+      const scored = pool.map((t) => ({ t, s: scoreTool(t, query) })).filter((x) => x.s > 0).sort((a, b) => b.s - a.s);
+      const exact = scored.find((x) => x.t.name.toLowerCase() === query.toLowerCase().trim());
+      const hits = exact ? [exact] : scored.slice(0, MAX_FOUND);
+      if (!hits.length) {
+        return {
+          content: `No project tool matches "${query}". Available to fetch: ${pool.map((t) => t.name).join(", ")}.`,
+          isError: false
+        };
+      }
+      registry.surface(hits.map((x) => x.t.name));
+      const rows = hits.map((x) => `- \`${x.t.name}\` \u2014 ${x.t.description.replace(/^\[MCP:[^\]]*\]\s*/, "").split(/\n/)[0].trim()}`);
+      return {
+        content: `Loaded ${hits.length} tool(s) \u2014 you can call them from your next message:
+${rows.join("\n")}`,
+        isError: false
+      };
+    }
+  };
+}
+
+// src/tools/unfinished-tool.ts
+import { execFileSync } from "child_process";
+import { join as join6 } from "path";
+import { z as z5 } from "zod";
+var params4 = z5.object({});
+function commitsAhead(cwd, branch) {
+  try {
+    const out = execFileSync(
+      "git",
+      ["rev-list", "--count", `HEAD..${branch}`],
+      { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+    );
+    return Number(out.trim()) || 0;
+  } catch {
+    return 0;
+  }
+}
+var findUnfinishedTool = {
+  name: "find_unfinished",
+  description: `Lists work a previous run left behind in this project, newest first: what the user originally asked, which pipeline phases finished, how many board tasks are done, how many commits sit on the session's branch, and the absolute path of its worktree. Call it whenever the user refers to earlier work \u2014 "continue", "where were we", "what was I doing" \u2014 before answering from the repository, because a session's work is NOT in the checkout you are standing in: it is on its own branch in its own worktree. Read files under the worktree path to see the spec, plan or board it produced.`,
+  permissionLevel: "safe",
+  parameters: params4,
+  describe: () => ({ allowKey: "find_unfinished", preview: "find unfinished work" }),
+  run: async (_args, ctx) => {
+    const found = unfinishedSessions(ctx.cwd, (b) => commitsAhead(ctx.cwd, b));
+    if (!found.length) {
+      return {
+        content: "No unfinished session in this project: every worktree has either been cleaned up or never recorded a checkpoint. Anything earlier is in the repository's own history.",
+        isError: false
+      };
+    }
+    const rows = found.map((s) => {
+      const c = s.checkpoint;
+      return [
+        `## ${s.id}`,
+        `- The user asked: "${c.rawPrompt.trim() || c.title}"`,
+        `- Understood as: ${c.refinedPrompt}`,
+        `- Phases finished: ${c.done.length ? c.done.join(" \u2192 ") : "none"}${c.lane ? ` (lane: ${c.lane})` : ""}`,
+        s.cards.total ? `- Tasks: ${s.cards.done} of ${s.cards.total} finished` : "- No task board yet",
+        `- Branch \`hc/${s.id}/base\` has ${s.commits} commit(s) the base does not`,
+        `- Worktree: ${join6(ctx.cwd, ".horsecode", "worktrees", s.id, "base")}`
+      ].join("\n");
+    });
+    return {
+      content: `${rows.join("\n\n")}
+
+To continue one of these, the user says **continue** \u2014 that reopens the session and its lane. You can read anything under the worktree path above to answer questions about it now.`,
+      isError: false
+    };
+  }
+};
+
+// src/tools/propose-memory.ts
+import { z as z6 } from "zod";
+var params5 = z6.object({
+  text: z6.string(),
+  kind: z6.enum(["fact", "lesson"]).optional().describe(
+    "`fact`: something true about this project that a later run would otherwise have to rediscover (where something lives, which command builds it). `lesson`: something learned the hard way \u2014 an approach that failed and what to do instead."
+  )
+});
+var proposeMemoryTool = {
+  name: "propose_memory",
+  description: "Propose something you learned about THIS PROJECT for long-term memory. It is NOT stored directly \u2014 a curator reviews, rewrites and may discard it. Propose ONLY durable, project-specific knowledge that would still be true and useful months from now in an unrelated task: a convention, a constraint, a non-obvious gotcha, the root cause of a recurring problem. NEVER propose your findings about the work you are reviewing right now, anything about this specific task or run, or general programming advice. Most reviews should propose nothing at all. Use it at most once, and only when you are sure.",
+  permissionLevel: "safe",
+  parameters: params5,
+  async run(rawArgs, ctx) {
+    const parsed = params5.safeParse(rawArgs);
+    if (!parsed.success) return { content: "propose_memory: invalid args (expected { text, kind? })", isError: true };
+    const text = parsed.data.text.trim();
+    if (!text) return { content: "propose_memory: empty proposal", isError: true };
+    if (!ctx.proposeMemory) return { content: "propose_memory: memory is not available in this context", isError: true };
+    const accepted = ctx.proposeMemory(text, parsed.data.kind ?? "fact");
+    return {
+      content: accepted ? "Proposal queued for the memory curator. It may be rewritten or discarded; do not propose it again." : "Already proposed (or the queue is full) \u2014 no action needed.",
+      isError: false
+    };
+  }
+};
+
+// src/skills/route.ts
+var STOP = /* @__PURE__ */ new Set([
+  "use",
+  "when",
+  "the",
+  "user",
+  "wants",
+  "and",
+  "for",
+  "with",
+  "that",
+  "this",
+  "from",
+  "into",
+  "also",
+  "not",
+  "other",
+  "otherwise",
+  "improve",
+  "covers",
+  "handles",
+  "should",
+  "become",
+  "than",
+  "over",
+  "onto",
+  "your",
+  "you",
+  "are",
+  "any",
+  "all",
+  "its",
+  "their",
+  "them",
+  "they",
+  "have",
+  "has",
+  "was",
+  "were",
+  "will",
+  "would",
+  "can",
+  "may",
+  "must",
+  "such",
+  "more",
+  "most",
+  "less",
+  "very",
+  "just",
+  "only",
+  "some",
+  "each",
+  "every",
+  "make",
+  "made",
+  "making",
+  "need",
+  "needs",
+  "needed",
+  "want",
+  "wanted",
+  "work",
+  "works",
+  "working",
+  "task",
+  "tasks",
+  "using",
+  "used",
+  "uses",
+  "via",
+  "per",
+  "out",
+  "off",
+  "about",
+  "after",
+  "before",
+  "then",
+  "there",
+  "where",
+  "which",
+  "while",
+  "what",
+  "who",
+  "how",
+  "why",
+  "does",
+  "did",
+  "done",
+  "get",
+  "got",
+  "let",
+  "lets"
+]);
+var MIN_TERM = 3;
+var SHORT_TERMS = /* @__PURE__ */ new Set(["ui", "ux", "db", "js", "ts", "qa"]);
+function splitIdentifiers(text) {
+  return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[_./-]+/g, " ");
+}
+function terms(text) {
+  return (splitIdentifiers(text).toLowerCase().match(/[a-z][a-z0-9]+/g) ?? []).filter((t) => (t.length >= MIN_TERM || SHORT_TERMS.has(t)) && !STOP.has(t));
+}
+var MIN_SHARED = 4;
+function sameWord(a, b) {
+  if (a === b) return true;
+  const fold = (w) => w.endsWith("e") ? w.slice(0, -1) : w;
+  const [x, y] = [fold(a), fold(b)];
+  const [short, long] = x.length <= y.length ? [x, y] : [y, x];
+  return short.length >= MIN_SHARED && long.startsWith(short);
+}
+function exclusions(description) {
+  const m = /\bnot\s+for\s+([^.]+)/i.exec(description);
+  return m ? terms(m[1]) : [];
+}
+function isExplicitOnly(description) {
+  return /\bonly\s+(runs?|use[sd]?|invoke[sd]?)\b[^.]*\bexplicit/i.test(description) || /\bdoes\s+not\s+trigger\s+on\s+its\s+own\b/i.test(description) || /\bonly\s+when\s+explicitly\s+(invoked|asked|requested)\b/i.test(description);
+}
+function isNonImplementing(description) {
+  return /\bread[- ]only\b/i.test(description) || /\bdoes\s+not\s+(implement|apply|execute|write)\b/i.test(description);
+}
+var MATCH_BAR = 3;
+var MIN_DENSITY = 0.1;
+var MAX_ROUTED = 3;
+var MAX_ROUTED_CHARS = 24e3;
+function scoreSkill(task, description) {
+  const taskTerms = new Set(terms(task));
+  if (!taskTerms.size) return { score: 0, hits: [], density: 0 };
+  const task_ = [...taskTerms];
+  const excluded2 = exclusions(description);
+  if (excluded2.some((e) => task_.some((t) => sameWord(t, e)))) return { score: 0, hits: [], density: 0 };
+  const body = description.replace(/\bnot\s+for\s+[^.]+/i, "");
+  const vocab = [...new Set(terms(body))];
+  const hits = vocab.filter((d) => task_.some((t) => sameWord(t, d)));
+  return { score: hits.length, hits, density: vocab.length ? hits.length / vocab.length : 0 };
+}
+function routeSkills(task, registry, already = [], opts = {}) {
+  const bar = opts.bar ?? MATCH_BAR;
+  let spent = 0;
+  const have = new Set(already);
+  const placed = new Set(opts.placed ?? []);
+  const paths = (opts.files ?? []).join(" ");
+  const base = [opts.role ?? "", routingSubject(task), paths].filter(Boolean).join(" ");
+  const subject = [base, expandExtensions(opts.files ?? []), expandAbbreviations(base)].filter(Boolean).join(" ");
+  return registry.list().filter((s) => !have.has(s.name)).filter((s) => !placed.has(s.name)).filter((s) => !isExplicitOnly(s.description)).filter((s) => !(opts.implementing && isNonImplementing(s.description))).map((s) => ({ name: s.name, ...scoreSkill(subject, s.description) })).filter((m) => m.score >= bar).sort((a, b) => b.score - a.score || b.density - a.density || a.name.localeCompare(b.name)).filter((m, i) => i === 0 || m.density >= MIN_DENSITY).slice(0, opts.max ?? MAX_ROUTED).filter((m) => {
+    const len = registry.get(m.name)?.content.length ?? 0;
+    if (spent + len > MAX_ROUTED_CHARS) return false;
+    spent += len;
+    return true;
+  });
+}
+function routingSubject(task) {
+  return task.replace(/\S*[\\/]\.horsecode[\\/]pastes[\\/]\S+/g, " ").replace(/\s{2,}/g, " ").trim();
+}
+var EXT_WORDS = {
+  tsx: "frontend interface component web",
+  jsx: "frontend interface component web",
+  vue: "frontend interface component web",
+  svelte: "frontend interface component web",
+  css: "frontend interface styling web",
+  scss: "frontend interface styling web",
+  html: "frontend interface web",
+  sql: "database migration",
+  proto: "protocol schema"
+};
+var ABBREVIATIONS = {
+  a11y: "accessibility",
+  i18n: "internationalization localization",
+  l10n: "localization",
+  auth: "authentication",
+  ui: "interface",
+  ux: "interface experience"
+};
+function expandAbbreviations(text) {
+  const out = [];
+  for (const t of terms(text)) if (ABBREVIATIONS[t]) out.push(ABBREVIATIONS[t]);
+  return out.join(" ");
+}
+function expandExtensions(files) {
+  const words2 = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    const ext = f.split(".").pop()?.toLowerCase();
+    if (ext && EXT_WORDS[ext]) for (const w of EXT_WORDS[ext].split(" ")) words2.add(w);
+  }
+  return [...words2].join(" ");
+}
+var CONFIDENT_MARGIN = 4;
+function partitionByConfidence(matches, bar = MATCH_BAR, margin = CONFIDENT_MARGIN) {
+  const confident = [];
+  const borderline = [];
+  for (const m of matches) (m.score >= bar + margin ? confident : borderline).push(m);
+  return { confident, borderline };
+}
+
+// src/engine/task-diff.ts
+var MAX_DIFF_CHARS2 = 6e4;
+async function taskDiff(cwd, baseRef, git = defaultGitRunner) {
+  const out = await git(["diff", `${baseRef}...HEAD`, "--", ".", ...excludeOwnState()], cwd);
+  if (out.code !== 0) return "";
+  const diff = out.stdout;
+  if (diff.length <= MAX_DIFF_CHARS2) return diff;
+  return `${diff.slice(0, MAX_DIFF_CHARS2)}
+\u2026diff truncated at ${MAX_DIFF_CHARS2} characters \u2014 read the remaining files directly.`;
+}
+function describeDiff(diff) {
+  if (!diff.trim()) {
+    return "The diff for this task could not be produced. Inspect the worktree with read_file/grep instead.";
+  }
+  return `The complete diff of this task's changes follows. It is the subject of the review \u2014 read it first, and open a file only when the diff alone cannot answer a question.
+
+\`\`\`diff
+${diff}
+\`\`\``;
+}
+async function workingTreeDiff(cwd, git = defaultGitRunner) {
+  const out = await git(["diff", "HEAD", "--", ".", ...excludeOwnState()], cwd);
+  if (out.code !== 0) return "";
+  const diff = out.stdout;
+  if (diff.length <= MAX_DIFF_CHARS2) return diff;
+  return `${diff.slice(0, MAX_DIFF_CHARS2)}
+\u2026diff truncated at ${MAX_DIFF_CHARS2} characters \u2014 read the remaining files directly.`;
+}
+async function diffSince(cwd, sinceRef, git = defaultGitRunner) {
+  const out = await git(["diff", sinceRef, "--", ".", ...excludeOwnState()], cwd);
+  if (out.code !== 0) return "";
+  const diff = out.stdout;
+  if (diff.length <= MAX_DIFF_CHARS2) return diff;
+  return `${diff.slice(0, MAX_DIFF_CHARS2)}
+\u2026diff truncated at ${MAX_DIFF_CHARS2} characters \u2014 read the remaining files directly.`;
+}
+
+// src/engine/reviewer.ts
+var CODE_REVIEW_MAX_TURNS = 25;
+var CODE_REVIEW_TIMEOUT_MS = 10 * 60 * 1e3;
+var VerdictSchema = z7.object({
+  verdict: z7.enum(["pass", "fail"]).describe(
+    "`fail` only if the code does not do what the task required, or does it wrongly. Style you would have written differently is a note on a `pass` \u2014 a fail sends the task back around the whole cycle."
+  ),
+  notes: z7.array(z7.string())
+});
+function readOnlyRegistry(deps, opts = {}) {
+  const r = new ToolRegistry();
+  r.register(readFileTool);
+  r.register(grepTool);
+  r.register(globTool);
+  r.register(gitTool);
+  r.register(buildSkillTool(deps.skillRegistry));
+  for (const t of contextTools(deps)) r.register(t);
+  if (opts.remember) r.register(buildRememberTool(deps.rememberFact));
+  if (opts.gitWrite) {
+    r.register(gitWriteTool);
+    r.register(findUnfinishedTool);
+  }
+  if (opts.propose) r.register(proposeMemoryTool);
+  if (opts.mcp) deferMcp(r, deps.mcpTools?.() ?? []);
+  return r;
+}
+function deferMcp(r, tools) {
+  for (const t of tools) r.registerDeferred(t);
+  if (tools.length) r.register(buildFindToolTool(r));
+}
+async function runReviewer(deps, task, cwd) {
+  const resolved = deps.roleRegistry.resolve("code-reviewer");
+  const hints = memoryHints(deps, task.title, { role: "code-reviewer" });
+  const reviewerTools = readOnlyRegistry(deps, { propose: true });
+  const routed = routeSkills(task.title, deps.skillRegistry, deps.roleRegistry.skillsFor("code-reviewer"), {
+    // The card's own files, never a guess: see the implementer for the measurement that settled it.
+    role: "code-reviewer",
+    files: task.files,
+    placed: placedSkills()
+  });
+  if (routed.length) deps.note?.(`\u{1F4CE} \`code-reviewer\` \xB7 ${routed.map((m) => `**${m.name}**`).join(", ")}`);
+  const diff = deps.baseRef ? await taskDiff(cwd, deps.baseRef) : "";
+  const ask = { role: "user", content: `Review the CODE that implements task "${task.title}" \u2014 correctness, tests, and implementation quality.
+The subject of this review is ALWAYS the code. Do NOT review, re-open, or comment on the upstream planning documents (specs/**, .specify/**, plan.md, tasks.md) \u2014 they were already reviewed and approved before coding began; treat them as fixed context, not as something to critique.
+Give a verdict (pass/fail + notes).
+
+${describeDiff(diff)}` };
+  const law = deps.home ? await constitutionNote(
+    { ...deps, home: deps.home, note: deps.note },
+    cwd,
+    { role: "code-reviewer", files: task.files, title: task.title }
+  ) : "";
+  const opts = {
+    provider: deps.provider,
+    ...resolved,
+    // The reviewer gets the SAME rules the implementer was given: a gate that does not know what was
+    // required cannot tell whether it was met, and that is where a constitution stops being one.
+    systemPrompt: (routed.length ? applySkills(resolved.systemPrompt, routed.map((m) => m.name), deps.skillRegistry) : resolved.systemPrompt) + law + projectToolsNote(reviewerTools.list(), !!loadGraphSync(cwd)) + BATCH_TOOLS_NOTE,
+    tools: reviewerTools,
+    proposeMemory: (t, k) => deps.proposeMemory?.(t, k, "code-reviewer") ?? false,
+    messages: hints.message ? [{ role: "user", content: hints.message }, ask] : [ask],
+    permission: deps.permission,
+    approve: deps.approve,
+    cwd,
+    signal: AbortSignal.any([deps.signal, AbortSignal.timeout(CODE_REVIEW_TIMEOUT_MS)]),
+    maxTurns: CODE_REVIEW_MAX_TURNS
+  };
+  const verdict = await runStructuredRole(opts, VerdictSchema);
+  reinforceUsed(deps, hints.ids, verdict.notes.join(" "), "code-reviewer");
+  return verdict;
+}
+
+// src/tools/web.ts
+import { z as z8 } from "zod";
+var params6 = z8.object({ url: z8.string().url() });
+var MAX_CHARS = 1e5;
+function createWebFetchTool(fetchFn = globalThis.fetch) {
+  return {
+    name: "web_fetch",
+    description: "Fetches the content (text) of a URL.",
+    permissionLevel: "safe",
+    parameters: params6,
+    async run(rawArgs, ctx) {
+      const parsed = params6.safeParse(rawArgs);
+      if (!parsed.success) {
+        return {
+          content: `web_fetch: invalid args: ${parsed.error.issues.map((i) => i.message).join("; ")}`,
+          isError: true
+        };
+      }
+      const a = parsed.data;
+      try {
+        const res = await fetchFn(a.url, { signal: ctx.signal });
+        const text = await res.text();
+        const capped = text.length > MAX_CHARS ? text.slice(0, MAX_CHARS) + "\n\u2026 (truncated)" : text;
+        return { content: capped, isError: !res.ok };
+      } catch (e) {
+        return {
+          content: `web_fetch error: ${e instanceof Error ? e.message : String(e)}`,
+          isError: true
+        };
+      }
+    }
+  };
+}
+
+export {
+  describeInherited,
+  describeTopUp,
+  toSlug,
+  mainWorktreeRoot,
+  WorktreeManager,
+  unfinishedSessions,
+  describeUnfinished,
+  gitTool,
+  buildRememberTool,
+  routeSkills,
+  partitionByConfidence,
+  specsDir,
+  constitutionPath,
+  verifyPaths,
+  featureSlugFor,
+  nextFeatureSlug,
+  scaffoldFeature,
+  constitutionNote,
+  taskDiff,
+  describeDiff,
+  workingTreeDiff,
+  diffSince,
+  CODE_REVIEW_MAX_TURNS,
+  CODE_REVIEW_TIMEOUT_MS,
+  readOnlyRegistry,
+  deferMcp,
+  runReviewer,
+  createWebFetchTool
+};