@joshuafolkken/kit 1.1128.0 → 1.1166.0

package/dist/hooks/{chunk-7HVB7SZG.js → chunk-ENA7P5FB.js}

@@ -1,12 +1,12 @@
 import {
   investigation_reads
-} from "./chunk-NXYMNPUQ.js";
+} from "./chunk-A6P7PN7P.js";
 import {
   lane_guard_policy
-} from "./chunk-QVLT52OV.js";
+} from "./chunk-GYNGP7HI.js";
 import {
   hook_decision
-} from "./chunk-MKVGBQPA.js";
+} from "./chunk-5KTCMCOT.js";
 
 // scripts/delegation/investigation-guard.ts
 import { text } from "node:stream/consumers";
@@ -25,7 +25,7 @@ function should_notify(tail, call, notified_at_ms, run) {
   if (investigation_mode() !== "notice") return false;
   return investigation_reads.should_block(tail, call, notified_at_ms, run);
 }
-var NOTICE = `\u{1F4A1} investigation: files read and not edited since the last delegated unit reached the threshold, so the reading from here should go to a unit of its own. This is a notice, not a refusal \u2014 the read proceeds, because a dispatched lane child ends its turn on a denial. Ask \`pnpm josh delegate investigation\`, then brief a unit with what the main line has already concluded and what is left to find out; it returns the conclusion plus its \`file:line\` citations, never the file text. Keep a read in the main line only where this run will edit that file. This recurs on the next accumulation.`;
+var NOTICE = `\u{1F4A1} investigation: files read and not edited, or search turns, since the last delegated unit reached the threshold, so the reading from here should go to a unit of its own. This is a notice, not a refusal \u2014 the read proceeds, because a dispatched lane child ends its turn on a denial. Ask \`pnpm josh delegate investigation\`, then dispatch the \`${investigation_reads.INVESTIGATOR_AGENT}\` agent (\`kit:${investigation_reads.INVESTIGATOR_AGENT}\` in a consumer) with a brief of what the main line has already concluded and what is left to find out; it returns the conclusion plus its \`file:line\` citations, never the file text. Keep a read in the main line only where this run will edit that file. This recurs on the next accumulation.`;
 function notice_text(_call, tail) {
   const pending = investigation_reads.tally_of(tail).pending.map((absolute) => investigation_reads.repository_relative(absolute));
   return pending.length === 0 ? NOTICE : `${NOTICE} Read and not edited so far: ${pending.join(" ")}.`;

package/dist/hooks/{chunk-M7QKEKWO.js → chunk-GU5MATVE.js}

@@ -7,7 +7,6 @@ import {
   PORCELAIN_FLAG,
   RECENT_REQUEST_WINDOW,
   agent_role_profile,
-  agent_session_environment,
   bash_triggers,
   cli_flags,
   error_text,
@@ -24,42 +23,43 @@ import {
   lane_park,
   lane_registry,
   open_issue_schema,
+  own_session,
   parse_json_object_safe,
   read_json_listing,
   repo_origin,
   repo_party,
   run_carry,
   run_cut,
+  run_cut_handoff,
   run_headless,
   run_hold,
   run_tail,
   shell_segments,
   tail_commands
-} from "./chunk-AIOIOMPX.js";
+} from "./chunk-ZDZ555YH.js";
 import {
   find_local_bin_upwards
 } from "./chunk-3V37IID6.js";
 import {
   batch_outcome
-} from "./chunk-XYUIQOW3.js";
+} from "./chunk-V2BTOZHT.js";
 import {
   investigation_refusal
-} from "./chunk-7HVB7SZG.js";
+} from "./chunk-ENA7P5FB.js";
 import {
   duplicate_read_outcome
-} from "./chunk-5SD2YM7Z.js";
+} from "./chunk-URJA6XY4.js";
 import {
   investigation_reads
-} from "./chunk-NXYMNPUQ.js";
+} from "./chunk-A6P7PN7P.js";
 import {
-  lane_guard_policy,
-  time_batch_guard
-} from "./chunk-QVLT52OV.js";
+  lane_guard_policy
+} from "./chunk-GYNGP7HI.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-MKVGBQPA.js";
+} from "./chunk-5KTCMCOT.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -70,8 +70,9 @@ import {
   json_value,
   lane_paths,
   stamp_file,
+  time_batch_guard,
   time_shell
-} from "./chunk-4JZDP5X5.js";
+} from "./chunk-DYAVAM6S.js";
 
 // scripts/rules/direct-filing.ts
 var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api \u2026/issues` or `gh issue create`. The command runs every filing step in order \u2014 the duplicate scout, the body lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing into another repository, and `epic:bundle` after the create \u2014 so none of them is a step to remember. When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,\u2026>` for the ones that are separate deliverables. Reference: `docs/josh-commands-automation.md` \u2192 "`josh issue:file`". **This rule fires on every occurrence, not once per run.**';
@@ -466,15 +467,28 @@ var early_heartbeat = {
 
 // scripts/rules/file-body.ts
 import { existsSync } from "node:fs";
-var HEREDOC = /<<-?\s*['"]?\w+/u;
+var HEREDOC = /(?<!<)<<(?!<)-?\s*['"]?([A-Z_a-z]\w*)/u;
 var LINE_BREAK = "\n";
-function first_line(command) {
-  const [line] = command.split(LINE_BREAK);
-  return line ?? "";
-}
 function has_heredoc(command) {
   return HEREDOC.test(command);
 }
+function with_body_line(lines, line) {
+  const opener = lines.at(-1);
+  if (opener === void 0) return [...lines];
+  return [...lines.slice(0, -1), { ...opener, body: `${opener.body}${line}${LINE_BREAK}` }];
+}
+function scan_line(scan, line) {
+  if (scan.delimiter === void 0) {
+    return { lines: [...scan.lines, { text: line, body: "" }], delimiter: HEREDOC.exec(line)?.[1] };
+  }
+  if (line.trim() === scan.delimiter) return { ...scan, delimiter: void 0 };
+  return { ...scan, lines: with_body_line(scan.lines, line) };
+}
+function command_lines(command) {
+  let scan = { lines: [], delimiter: void 0 };
+  for (const line of command.split(LINE_BREAK)) scan = scan_line(scan, line);
+  return scan.lines;
+}
 var FILE_REDIRECT = /(?:^|\s)>>?\s*(?!&)("[^"]+"|'[^']+'|\S+)/u;
 var TEE_TARGET = /\btee\s+(?:-a\s+)?(?!-)("[^"]+"|'[^']+'|\S+)/u;
 var QUOTES = /^['"]|['"]$/gu;
@@ -482,22 +496,32 @@ function redirect_target(line) {
   const target = FILE_REDIRECT.exec(line)?.[1] ?? TEE_TARGET.exec(line)?.[1];
   return target === void 0 ? void 0 : target.replaceAll(QUOTES, "");
 }
-function writes_existing_file(command, has_file) {
-  if (!has_heredoc(command)) return false;
-  const target = redirect_target(first_line(command));
-  return target !== void 0 && has_file(target);
-}
-var BODY_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3", "ruby", "perl", "php"]);
+var BODY_INTERPRETERS = /* @__PURE__ */ new Set([
+  "python",
+  "python3",
+  "ruby",
+  "perl",
+  "php",
+  "node"
+]);
 var NODE = "node";
 var NODE_EVAL = /(?:^|\s)(?:-e|--eval)\b/u;
-var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines)?\s*\(/u;
+var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines|_text|_bytes)?\s*\(/u;
 var WRITE_MODE = /open\s*\([^)]*['"][rbt+]*[wax]|os\.replace|shutil\.(?:copy|move)/u;
-function body_writes(command) {
-  return WRITE_CALL.test(command) || WRITE_MODE.test(command);
+function body_writes(body) {
+  return WRITE_CALL.test(body) || WRITE_MODE.test(body);
 }
-function is_interpreter_write(segment, command) {
+var SCRIPT_FILE = /\.(?:py|rb|pl|php|js|mjs|cjs)$/u;
+function is_heredoc_write(line, has_file) {
+  const target = has_heredoc(line.text) ? redirect_target(line.text) : void 0;
+  if (target === void 0) return false;
+  if (has_file(target)) return true;
+  return SCRIPT_FILE.test(target) && body_writes(line.body);
+}
+function is_interpreter_write(segment, body) {
   const leading = time_shell.leading_word(segment);
-  if (BODY_INTERPRETERS.has(leading)) return has_heredoc(command) && body_writes(command);
+  if (!BODY_INTERPRETERS.has(leading)) return false;
+  if (has_heredoc(segment)) return body_writes(body);
   return leading === NODE && NODE_EVAL.test(segment) && body_writes(segment);
 }
 var PERL = "perl";
@@ -507,13 +531,15 @@ function is_in_place_perl(segment) {
   if (time_shell.leading_word(segment) !== PERL) return false;
   return segment.split(WHITESPACE).some((word) => PERL_IN_PLACE.test(word));
 }
-function has_body_interpreter(command) {
-  return shell_segments.segments_of(first_line(command)).some((segment) => is_interpreter_write(segment, command) || is_in_place_perl(segment));
+function has_body_interpreter(line) {
+  return shell_segments.segments_of(line.text).some((segment) => is_interpreter_write(segment, line.body) || is_in_place_perl(segment));
 }
 function carries_a_file_body(command, has_file = existsSync) {
-  return writes_existing_file(command, has_file) || has_body_interpreter(command);
+  return command_lines(command).some(
+    (line) => is_heredoc_write(line, has_file) || has_body_interpreter(line)
+  );
 }
-var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline \u2014 a heredoc rewriting an existing file, an interpreter (`python3 - <<`, `node -e`) whose body writes, or an in-place `perl -0pi -e`. `CLAUDE.md` forbids it because the command body is re-read on every later request of the run, so an editing script written early is billed for the rest of it (`file-edits.md` measured one run at ~2m45s spent retyping existing lines). Edit a region with the Edit tool (old / new), or pass a body by path (`--field body=@<path>`, `--body-file <path>`). A new-file creation (`cat > <new-file> <<EOF`), a read-only heredoc (`cat <<EOF`), and a short `sed -i` stay allowed. **This rule fires on every occurrence, not once per run.**";
+var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline \u2014 a heredoc rewriting an existing file, an interpreter (`python3 - <<`, `node -e`) whose body writes, a script file (`cat > edit.py <<EOF`) whose body writes, or an in-place `perl -0pi -e`. `CLAUDE.md` forbids it because the command body is re-read on every later request of the run, so an editing script written early is billed for the rest of it (`file-edits.md` measured one run at ~2m45s spent retyping existing lines). Edit a region with the Edit tool (old / new); a change scattered so widely that the partial edits would carry more than the file is rewritten whole with the Write tool, never a heredoc. Pass a body by path (`--field body=@<path>`, `--body-file <path>`). A new-file creation (`cat > <new-file> <<EOF`), a read-only heredoc (`cat <<EOF`), and a short `sed -i` stay allowed. **This rule fires on every occurrence, not once per run.**";
 var ROW2 = {
   id: "file-body",
   is_trigger: bash_triggers.on_bash_command((command) => carries_a_file_body(command)),
@@ -535,6 +561,7 @@ var READ_METHOD = "GET";
 var REPO_PATH = /repos\/([^/\s'"?]+)\/([^/\s'"?]+)/u;
 var OWNER_GROUP = 1;
 var REPO_GROUP = 2;
+var OWNER_PLACEHOLDERS = /* @__PURE__ */ new Set(["{owner}", ":owner"]);
 function is_gh_api(segment) {
   return GH_API_COMMAND.test(segment);
 }
@@ -554,7 +581,18 @@ function repo_target(segment) {
   if (match === null) return void 0;
   return { owner: match[OWNER_GROUP] ?? "", repo: match[REPO_GROUP] ?? "" };
 }
-var gh_api = { GH_FLAGS, is_gh_api, is_read, is_write, method_of, repo_target };
+function is_owner_placeholder(owner) {
+  return OWNER_PLACEHOLDERS.has(owner);
+}
+var gh_api = {
+  GH_FLAGS,
+  is_gh_api,
+  is_owner_placeholder,
+  is_read,
+  is_write,
+  method_of,
+  repo_target
+};
 
 // scripts/rules/git-argv.ts
 var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u;
@@ -893,25 +931,6 @@ var cost_verdict = {
   report_over
 };
 
-// scripts/cost-runtime/own-session.ts
-var NOT_FOUND = -1;
-function session_id_of(environment) {
-  const value = environment[agent_session_environment.SESSION_ID_KEY];
-  return value === void 0 || value === "" ? void 0 : value;
-}
-function select_own_session(files, environment) {
-  const session_id = session_id_of(environment);
-  if (session_id === void 0) {
-    return { kind: "own", index: cost_transcript.latest_own_index(files) };
-  }
-  const index = files.findIndex((file) => file.session_id === session_id);
-  return index === NOT_FOUND ? { kind: "absent", session_id } : { kind: "own", index };
-}
-var own_session = {
-  session_id_of,
-  select_own_session
-};
-
 // scripts/cost-runtime/transcript-cwd.ts
 import path3 from "node:path";
 function resolve(target, cwd) {
@@ -1163,7 +1182,7 @@ function is_over_threshold_edit(call, state = current_state()) {
   return warrants_the_cut(state);
 }
 var THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`;
-var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
+var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch, as ${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
 var REISSUE_WINDOW_MS = 9e4;
 function is_reissued_refusal(now_ms, delivered_at_ms) {
   return now_ms - delivered_at_ms < REISSUE_WINDOW_MS;
@@ -1455,13 +1474,13 @@ var RUN_ENTRY_ORACLE = {
   decision: "Where a run on an issue starts, and whether the typed command has already been reached",
   args: "<N> [--to kickoff|halfrun|prrun|fullrun]",
   vocabulary: run_stage.START_TOKENS,
-  single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72k"
+  single_source: "docs/how-to/run-issues.md"
 };
 
 // scripts/rules/decision-oracle.ts
 var CHAIN_RULE_MD = ".claude/skills/workflow-commands/chain-rule.md";
 var BACKLOGRUN_PROGRESS_MD = ".claude/skills/workflow-commands/backlogrun-progress.md";
-var SKILL_2E = ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72e";
+var SKILL_2E = ".claude/skills/workflow-commands/issue-scout.md";
 var SPLIT_ASSESSMENT_QUESTION = ".claude/skills/workflow-commands/split-assessment.md \u2192 The question";
 var PRE_GATE_CUT_MD = ".claude/skills/workflow-commands/pre-gate-cut.md";
 var BACKLOGRUN_MD = ".claude/skills/workflow-commands/backlogrun.md";
@@ -1494,7 +1513,7 @@ var DECISION_ORACLES = [
     decision: "Whether a run step may be delegated to a cheaper execution tier",
     args: "<step>",
     vocabulary: ["delegate", "keep"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72b"
+    single_source: ".claude/skills/workflow-commands/delegation.md"
   },
   {
     name: "review:level",
@@ -1537,7 +1556,7 @@ var DECISION_ORACLES = [
     decision: "Whether this working tree is free for a run to claim",
     args: `[${ISSUE_N_ARG}]`,
     vocabulary: ["hold", BUSY, UNKNOWN],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72f"
+    single_source: ".claude/skills/workflow-commands/working-tree-hold.md"
   },
   {
     name: "cost:cut",
@@ -1552,7 +1571,7 @@ var DECISION_ORACLES = [
     decision: "Whether a release is owed after this merge",
     args: "",
     vocabulary: [REQUIRED, SKIP, UNKNOWN],
-    single_source: ".claude/skills/workflow-commands/followup-reference.md"
+    single_source: ".claude/skills/workflow-commands/followup.md"
   },
   {
     name: "epic:bundle",
@@ -1601,7 +1620,7 @@ var DECISION_ORACLES = [
     decision: "An issue's state, labels, and human-review flag",
     args: ISSUE_N_ARG,
     vocabulary: ["human_review: yes", "human_review: no"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72z"
+    single_source: ".claude/skills/workflow-commands/needs-human-review.md"
   },
   {
     name: "run:cut:resume",
@@ -1638,7 +1657,7 @@ var DECISION_ORACLES = [
     decision: "Whether a named stash entry exists and can be applied",
     args: "<message>",
     vocabulary: ["popped", "conflicted", "no-match", "ambiguous"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72d"
+    single_source: ".claude/skills/workflow-commands/prerequisite.md"
   },
   {
     name: "backlog:next",
@@ -1908,6 +1927,67 @@ var ROW10 = {
 };
 var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW10, is_destructive_command };
 
+// scripts/rules/direct-pr-create.ts
+var GH_COMMAND2 = "gh";
+var PR_GROUP2 = "pr";
+var PR_CREATE_ACTIONS = /* @__PURE__ */ new Set(["create", "new"]);
+var FLAG_PREFIX3 = "-";
+var VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set(["-R", "--repo"]);
+var API_VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set([
+  ...VALUE_TAKING_FLAGS,
+  "-X",
+  "--method",
+  "-f",
+  "--raw-field",
+  "-F",
+  "--field",
+  "-H",
+  "--header",
+  "--input",
+  "-q",
+  "--jq",
+  "-t",
+  "--template",
+  "--hostname",
+  "-p",
+  "--preview",
+  "--cache"
+]);
+var API_SUBCOMMAND = "api";
+var PULLS_PATH = /^['"]?(?:https:\/\/api\.github\.com)?\/?repos\/[^/\s'"]+\/[^/\s'"]+\/pulls\/?['"]?$/u;
+function positional_words(args, value_taking_flags) {
+  return args.filter((argument, index) => {
+    if (argument.startsWith(FLAG_PREFIX3)) return false;
+    return !value_taking_flags.has(args[index - 1] ?? "");
+  });
+}
+function is_pr_create_api_call(args) {
+  const call = [GH_COMMAND2, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || !gh_api.is_write(call)) return false;
+  const [subcommand, endpoint = ""] = positional_words(args, API_VALUE_TAKING_FLAGS);
+  return subcommand === API_SUBCOMMAND && PULLS_PATH.test(endpoint);
+}
+function is_pr_create_cli_call(args) {
+  const [group, action = ""] = positional_words(args, VALUE_TAKING_FLAGS);
+  return group === PR_GROUP2 && PR_CREATE_ACTIONS.has(action);
+}
+function is_pr_create_segment(segment) {
+  const args = git_argv.arguments_of(segment, GH_COMMAND2);
+  if (args === void 0) return false;
+  return is_pr_create_cli_call(args) || is_pr_create_api_call(args);
+}
+function is_direct_pr_create(command) {
+  return shell_segments.segments_of(command).some((segment) => is_pr_create_segment(segment));
+}
+var DIRECT_PR_CREATE_REASON = "\u26D4 direct PR creation: `gh pr create` (or a `gh api` POST to `repos/<o>/<r>/pulls`) bypasses `build_body`, which writes the `closes #N` line \u2014 the Issue would stay open after the merge (`CLAUDE.md` \u2192 Git Rules). Open the PR with `pnpm josh pr` instead; after a failed push, fix, push, then run `pnpm josh pr`. **This rule fires on every occurrence, not once per run.**";
+var ROW11 = {
+  id: "direct-pr-create",
+  is_trigger: bash_triggers.on_bash_command(is_direct_pr_create),
+  reason: DIRECT_PR_CREATE_REASON,
+  decide: () => true
+};
+var direct_pr_create = { DIRECT_PR_CREATE_REASON, ROW: ROW11, is_direct_pr_create };
+
 // scripts/rules/worktree-guard.ts
 var CHECKOUT_SUBCOMMAND = "checkout";
 var RESTORE_SUBCOMMAND = "restore";
@@ -1968,14 +2048,14 @@ function is_unauthorized_worktree_change(command) {
   return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
 }
 var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced `git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
-var ROW11 = {
+var ROW12 = {
   id: "worktree-mutation",
   is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
   reason: WORKTREE_MUTATION_REASON,
   decide: () => true
 };
 var worktree_guard = {
-  ROW: ROW11,
+  ROW: ROW12,
   WORKTREE_MUTATION_REASON,
   is_unauthorized_worktree_change,
   touches_worktree
@@ -2004,13 +2084,13 @@ function is_index_mutation(command) {
   return shell_segments.segments_of(command).some((segment) => is_index_segment(segment));
 }
 var INDEX_MUTATION_REASON = '\u26D4 git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore --staged` overwrite the user\'s staged snapshot, which `CLAUDE.md` \u2192 Git Rules forbids on your own judgement (`prompts/collaboration-workflow/operating-rules.md` \u2192 "git index \u3092\u52DD\u624B\u306B\u5909\u66F4\u3057\u306A\u3044"). The `.claude/settings.json` deny list matches prefix globs, so it misses `git -C . commit`, `git -c k=v commit` and `env git commit`; this row reads the argv instead, so the spelling does not matter. A commit goes through `pnpm josh git -y`; any other staging needs explicit current-turn user instruction, run by the user in their own terminal. **This rule fires on every occurrence, not once per run.**';
-var ROW12 = {
+var ROW13 = {
   id: "index-mutation",
   is_trigger: bash_triggers.on_bash_command(is_index_mutation),
   reason: INDEX_MUTATION_REASON,
   decide: () => true
 };
-var index_guard = { INDEX_MUTATION_REASON, ROW: ROW12, is_index_mutation };
+var index_guard = { INDEX_MUTATION_REASON, ROW: ROW13, is_index_mutation };
 
 // scripts/rules/protected-files.ts
 import path5 from "node:path";
@@ -2159,16 +2239,21 @@ function is_protected_file_call(call, is_kit_consumer2 = doctor_consumer.is_kit_
   return is_environment_read(call) || is_consumer_settings_edit(call, is_kit_consumer2);
 }
 var PROTECTED_FILE_REASON = '\u26D4 protected file: `.env` holds the Telegram bot token, so reading it puts a secret in the transcript \u2014 the scripts that need it load it in their own process. `.claude/settings.json` in a consumer repository is the deny list and the hooks every other rule rests on, so a run must not rewrite it; `josh sync` owns it, and a change belongs upstream in kit (`CLAUDE.md` \u2192 "Route distributed-doc / config changes upstream to kit"). Leave both files alone, or ask the user. **This rule fires on every occurrence, not once per run.**';
-var ROW13 = {
+var ROW14 = {
   id: "protected-file",
   is_trigger: is_protected_file_call,
   reason: PROTECTED_FILE_REASON,
   decide: () => true
 };
-var protected_files = { ROW: ROW13, is_protected_file_call };
+var protected_files = { ROW: ROW14, is_protected_file_call };
 
 // scripts/rules/permission-guards.ts
-var ROWS2 = [index_guard.ROW, destructive_command.ROW, protected_files.ROW];
+var ROWS2 = [
+  index_guard.ROW,
+  destructive_command.ROW,
+  protected_files.ROW,
+  direct_pr_create.ROW
+];
 var permission_guards = { ROWS: ROWS2 };
 
 // scripts/rules/piped-verification.ts
@@ -2239,7 +2324,7 @@ function is_poll_loop(command) {
   return LOOP_KEYWORD2.test(plain) && SLEEP_COMMAND.test(plain);
 }
 var POLL_LOOP_REASON = '\u26D4 output poll loop: this hand-writes a `while`/`until` wait loop over a command\'s output, a marker file or a process \u2014 with a `sleep` or, worse, without one \u2014 and the loop does not know when the command finished. A regex that never matches waits to the harness block limit; one that matches a mid-run line exits too early \u2014 either way the command exit is not what ends the wait, and each pass spends a full-context round trip (joshuafolkken/kit#2371 measured about 45 minutes, 13% of six lanes, lost to exactly this). Do not poll the output file. A command known to take minutes \u2014 `pnpm josh gate`, `pnpm josh followup`, `pnpm josh format` \u2014 is started detached from the first with `run_in_background` set, and the harness re-invokes you when it exits: its completion notification is what ends the wait, on the task exit rather than a regex or the block limit. So issue the long command in the background and end the turn \u2014 do not arm a loop; the wake-up brings you back. To glance at interim output, `Read` the output file once, never in a sleep loop. If you are waiting on CI, `pnpm josh followup` waits on it for you. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every occurrence, not once per run.**';
-var ROW14 = {
+var ROW15 = {
   id: "poll-loop",
   is_trigger: bash_triggers.on_bash_command(is_poll_loop),
   reason: POLL_LOOP_REASON,
@@ -2247,7 +2332,7 @@ var ROW14 = {
 };
 var poll_loop = {
   POLL_LOOP_REASON,
-  ROW: ROW14,
+  ROW: ROW15,
   is_poll_loop
 };
 
@@ -2367,13 +2452,13 @@ function posts_at_path_literally(command) {
   return RAW_FIELD_BODY_AT.test(command);
 }
 var RAW_FIELD_BODY_REASON = "\u26D4 literal @path body: this passes `body=@<path>` to `gh api` with a raw field flag (`-f` / `--raw-field`), which sends the value verbatim \u2014 the string `@<path>` is posted as the comment, not the file it points at. `-F` / `--field` is the flag that reads the file, and the two spellings differ by one character while `gh` exits 0 and returns a comment URL either way, so the break is invisible until a person reads the issue (joshuafolkken/kit#2304 lost two park comments this way). Post an issue or PR comment with `pnpm josh issue:comment <N> --body-file <path>` \u2014 the one spelling, which cannot take the wrong flag. The rule and the safe forms are in `prompts/collaboration-workflow/shell-body.md`. This rule fires on every occurrence, not once per run.";
-var ROW15 = {
+var ROW16 = {
   id: "raw-field-body",
   is_trigger: bash_triggers.on_bash_command(posts_at_path_literally),
   reason: RAW_FIELD_BODY_REASON,
   decide: () => true
 };
-var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW15, posts_at_path_literally };
+var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW16, posts_at_path_literally };
 
 // scripts/rules/rule-body-guard.ts
 var EDIT_TOOL = "Edit";
@@ -2444,7 +2529,7 @@ function runs_placement_oracle(command) {
     (names) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
   );
 }
-var ROW16 = {
+var ROW17 = {
   id: "rule-body",
   is_trigger: writes_rule_prose,
   reason: RULE_BODY_REASON,
@@ -2453,7 +2538,7 @@ var ROW16 = {
 };
 var rule_body_guard = {
   RULE_BODY_REASON,
-  ROW: ROW16,
+  ROW: ROW17,
   answered_placement,
   is_rule_document,
   writes_rule_prose
@@ -2888,31 +2973,53 @@ function is_untested_commit(call) {
   return test_declared_changed.current_verdict() === "required";
 }
 var REASON = '\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads the working tree as `required` (a changed file that is neither a test \u2014 `*.test.ts` / `*.e2e.ts` \u2014 nor a mechanically-exempt non-runtime path). `CLAUDE.md` \u2192 Code Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an E2E. Add the declared test and reissue this commit. **If the change genuinely touches no executable runtime path** it is the pre-approved non-runtime exception \u2014 declare it in your Step 0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` \u2192 "\u914D\u9001\u3055\u308C\u3066\u3044\u308B\u898F\u5247". This fires once per run, so reissuing will not repeat on the call in hand.';
-var ROW17 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
-var test_declared_commit = { REASON, ROW: ROW17 };
+var ROW18 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
+var test_declared_commit = { REASON, ROW: ROW18 };
 
 // scripts/rules/third-party-write.ts
-function is_third_party_write_segment(segment, session_owner) {
+function is_third_party_write_segment(segment, session_owner, resolve_placeholder_owners) {
   if (!gh_api.is_gh_api(segment) || !gh_api.is_write(segment)) return false;
   const target = gh_api.repo_target(segment);
   if (target === void 0) return false;
-  return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+  if (!gh_api.is_owner_placeholder(target.owner)) {
+    return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+  }
+  return resolve_placeholder_owners().some(
+    (owner) => owner === void 0 || repo_party.classify(session_owner, owner) === repo_party.THIRD_PARTY
+  );
 }
-function writes_third_party(command, resolve_owner = repo_party.current_owner) {
-  const targets = shell_segments.segments_of(command).filter((segment) => gh_api.is_gh_api(segment) && gh_api.is_write(segment));
-  if (targets.length === 0) return false;
+var GH_CONTEXT_CHANGE = /(?:^|\s)(?:cd|pushd)(?:\s|$)|(?:^|\s)(?:export\s+)?GH_REPO=/u;
+function unreadable_candidates() {
+  return [void 0];
+}
+function candidates_at(segments, index, resolve_placeholder_owners) {
+  const has_moved = segments.slice(0, index).some((segment) => GH_CONTEXT_CHANGE.test(segment));
+  return has_moved ? unreadable_candidates : resolve_placeholder_owners;
+}
+function writes_third_party(command, resolve_owner = repo_party.current_owner, resolve_placeholder_owners = repo_party.placeholder_owners) {
+  const segments = shell_segments.segments_of(command);
+  const has_write = segments.some(
+    (segment) => gh_api.is_gh_api(segment) && gh_api.is_write(segment)
+  );
+  if (!has_write) return false;
   const session_owner = resolve_owner();
-  return targets.some((segment) => is_third_party_write_segment(segment, session_owner));
+  return segments.some(
+    (segment, index) => is_third_party_write_segment(
+      segment,
+      session_owner,
+      candidates_at(segments, index, resolve_placeholder_owners)
+    )
+  );
 }
 var THIRD_PARTY_WRITE_REASON = '\u26D4 third-party write: this `gh api` call writes to a repository whose owner is not this session \u2014 a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, is not that instruction (`CLAUDE.md` \u2192 "Third-party repositories are Tier C", `prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with `pnpm josh repo:party <owner/repo>` \u2014 owner equality, computed not judged. A read (`-X GET`, or no field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or `-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact for a person to post \u2014 do not publish it yourself. **This rule fires on every occurrence, not once per run.**';
-var ROW18 = {
+var ROW19 = {
   id: "third-party-write",
   is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
   reason: THIRD_PARTY_WRITE_REASON,
   decide: () => true
 };
 var third_party_write = {
-  ROW: ROW18,
+  ROW: ROW19,
   THIRD_PARTY_WRITE_REASON,
   writes_third_party
 };
@@ -2922,7 +3029,7 @@ var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
 var STAMP_PREFIX = "josh-rule-guard-";
 var { is_issue_filing, on_bash_command } = bash_triggers;
 var WIP_CAP = 30;
-var WIP_CAP_REASON = `\u26D4 backlog WIP cap: count the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by, and an interrupt, decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. The count command and both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call once you have counted \u2014 it fires once per run and cannot repeat on the call in hand.`;
+var WIP_CAP_REASON = `\u26D4 backlog WIP cap: \`pnpm josh issue:file\` counts the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file \u2014 the command holds such a filing. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by (\`--over-cap\`, or the \`tier-a\` / \`split\` route), and an interrupt (\`--route interrupt\`), decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. Both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call and let the command count \u2014 it fires once per run and cannot repeat on the call in hand.`;
 var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
 var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
 var FETCHES_COMMENTS = /--comments\b|--json\s[\w,]*\bcomments\b|\/comments\b/u;
@@ -2947,7 +3054,7 @@ function is_body_only_issue_read(command) {
   if (segments.some((segment) => fetches_issue_comments(segment))) return false;
   return segments.some((segment) => is_body_read_segment(segment));
 }
-var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/SKILL.md` \u2192 \"An Issue's comments are part of the Issue\". Every body-only read is refused until the comments are read.";
+var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/issue-comments.md`. Every body-only read is refused until the comments are read.";
 var { SHELL_BODY_REASON: SHELL_BODY_REASON2, carries_a_body: carries_a_body2, is_shell_evaluated_body: is_shell_evaluated_body2, keeps_body_safe: keeps_body_safe2 } = shell_body_trigger;
 var ISSUE_LISTING = /^gh\s+(?:-{1,2}[\w-]+(?:[= ]\S+)?\s+)*issue\s+list\b/u;
 var ISSUES_QUERY = /repos\/[^\s'"]*\/issues\?[^\s'"]*state=open/u;
@@ -4316,7 +4423,29 @@ async function pretool_outcome_async(raw_payload) {
   if (reason !== void 0) return { reason, notice: void 0, fault: void 0 };
   return with_step_zero_notice(base, raw_payload);
 }
-var pretool_guard = { combine_outcomes, pretool_outcome };
+function guarded_call(raw_payload) {
+  try {
+    const payload = hook_decision.parse_hook_payload(raw_payload);
+    return payload === void 0 ? void 0 : { name: payload.tool_name, input: payload.tool_input };
+  } catch {
+    return void 0;
+  }
+}
+function foreground_rewrite(outcome, raw_payload, is_lane_child) {
+  if (outcome.reason !== void 0) return void 0;
+  const call = guarded_call(raw_payload);
+  const input = call === void 0 ? void 0 : lane_background.foreground_input(call, is_lane_child);
+  if (input === void 0) return void 0;
+  const context = [lane_background.FOREGROUND_NOTE, outcome.notice ?? outcome.fault];
+  return hook_decision.rewrite_envelope(input, context.filter(Boolean).join("\n\n"));
+}
+function emit(raw_payload, outcome) {
+  const rewrite = foreground_rewrite(outcome, raw_payload);
+  if (rewrite === void 0) hook_decision.emit_outcome(outcome);
+  else process.stdout.write(`${rewrite}
+`);
+}
+var pretool_guard = { combine_outcomes, emit, foreground_rewrite, pretool_outcome };
 
 export {
   pretool_outcome_async,