@joshuafolkken/kit 1.1136.0 → 1.1166.0

package/dist/hooks/{chunk-RFWWUI5F.js → chunk-ENA7P5FB.js}

@@ -1,12 +1,12 @@
 import {
   investigation_reads
-} from "./chunk-LJBLGHEH.js";
+} from "./chunk-A6P7PN7P.js";
 import {
   lane_guard_policy
-} from "./chunk-HANSKHES.js";
+} from "./chunk-GYNGP7HI.js";
 import {
   hook_decision
-} from "./chunk-NFZGFGOR.js";
+} from "./chunk-5KTCMCOT.js";
 
 // scripts/delegation/investigation-guard.ts
 import { text } from "node:stream/consumers";

package/dist/hooks/{chunk-KBXZLMRH.js → chunk-GU5MATVE.js}

@@ -30,36 +30,36 @@ import {
   repo_party,
   run_carry,
   run_cut,
+  run_cut_handoff,
   run_headless,
   run_hold,
   run_tail,
   shell_segments,
   tail_commands
-} from "./chunk-JKKTVDAG.js";
+} from "./chunk-ZDZ555YH.js";
 import {
   find_local_bin_upwards
 } from "./chunk-3V37IID6.js";
 import {
   batch_outcome
-} from "./chunk-KOKOAV6D.js";
+} from "./chunk-V2BTOZHT.js";
 import {
   investigation_refusal
-} from "./chunk-RFWWUI5F.js";
+} from "./chunk-ENA7P5FB.js";
 import {
   duplicate_read_outcome
-} from "./chunk-HBKZLITF.js";
+} from "./chunk-URJA6XY4.js";
 import {
   investigation_reads
-} from "./chunk-LJBLGHEH.js";
+} from "./chunk-A6P7PN7P.js";
 import {
-  lane_guard_policy,
-  time_batch_guard
-} from "./chunk-HANSKHES.js";
+  lane_guard_policy
+} from "./chunk-GYNGP7HI.js";
 import {
   hook_decision,
   lane_child_marker,
   run_issue_number
-} from "./chunk-NFZGFGOR.js";
+} from "./chunk-5KTCMCOT.js";
 import {
   PLATFORM_TEMP_ROOT,
   cost_attribute,
@@ -70,8 +70,9 @@ import {
   json_value,
   lane_paths,
   stamp_file,
+  time_batch_guard,
   time_shell
-} from "./chunk-GDU26K3J.js";
+} from "./chunk-DYAVAM6S.js";
 
 // scripts/rules/direct-filing.ts
 var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path> --depth <0|1|2> [--route <route>] [--label <name>] [--repo <owner/repo>]`, never with `gh api \u2026/issues` or `gh issue create`. The command runs every filing step in order \u2014 the duplicate scout, the body lint and its classification labels, the depth and `route:` labels, the `## Origin` check when filing into another repository, and `epic:bundle` after the create \u2014 so none of them is a step to remember. When the scout prints candidates it holds the filing: read each, then reissue with `--distinct <N,\u2026>` for the ones that are separate deliverables. Reference: `docs/josh-commands-automation.md` \u2192 "`josh issue:file`". **This rule fires on every occurrence, not once per run.**';
@@ -466,15 +467,28 @@ var early_heartbeat = {
 
 // scripts/rules/file-body.ts
 import { existsSync } from "node:fs";
-var HEREDOC = /<<-?\s*['"]?\w+/u;
+var HEREDOC = /(?<!<)<<(?!<)-?\s*['"]?([A-Z_a-z]\w*)/u;
 var LINE_BREAK = "\n";
-function first_line(command) {
-  const [line] = command.split(LINE_BREAK);
-  return line ?? "";
-}
 function has_heredoc(command) {
   return HEREDOC.test(command);
 }
+function with_body_line(lines, line) {
+  const opener = lines.at(-1);
+  if (opener === void 0) return [...lines];
+  return [...lines.slice(0, -1), { ...opener, body: `${opener.body}${line}${LINE_BREAK}` }];
+}
+function scan_line(scan, line) {
+  if (scan.delimiter === void 0) {
+    return { lines: [...scan.lines, { text: line, body: "" }], delimiter: HEREDOC.exec(line)?.[1] };
+  }
+  if (line.trim() === scan.delimiter) return { ...scan, delimiter: void 0 };
+  return { ...scan, lines: with_body_line(scan.lines, line) };
+}
+function command_lines(command) {
+  let scan = { lines: [], delimiter: void 0 };
+  for (const line of command.split(LINE_BREAK)) scan = scan_line(scan, line);
+  return scan.lines;
+}
 var FILE_REDIRECT = /(?:^|\s)>>?\s*(?!&)("[^"]+"|'[^']+'|\S+)/u;
 var TEE_TARGET = /\btee\s+(?:-a\s+)?(?!-)("[^"]+"|'[^']+'|\S+)/u;
 var QUOTES = /^['"]|['"]$/gu;
@@ -482,22 +496,32 @@ function redirect_target(line) {
   const target = FILE_REDIRECT.exec(line)?.[1] ?? TEE_TARGET.exec(line)?.[1];
   return target === void 0 ? void 0 : target.replaceAll(QUOTES, "");
 }
-function writes_existing_file(command, has_file) {
-  if (!has_heredoc(command)) return false;
-  const target = redirect_target(first_line(command));
-  return target !== void 0 && has_file(target);
-}
-var BODY_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3", "ruby", "perl", "php"]);
+var BODY_INTERPRETERS = /* @__PURE__ */ new Set([
+  "python",
+  "python3",
+  "ruby",
+  "perl",
+  "php",
+  "node"
+]);
 var NODE = "node";
 var NODE_EVAL = /(?:^|\s)(?:-e|--eval)\b/u;
-var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines)?\s*\(/u;
+var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines|_text|_bytes)?\s*\(/u;
 var WRITE_MODE = /open\s*\([^)]*['"][rbt+]*[wax]|os\.replace|shutil\.(?:copy|move)/u;
-function body_writes(command) {
-  return WRITE_CALL.test(command) || WRITE_MODE.test(command);
+function body_writes(body) {
+  return WRITE_CALL.test(body) || WRITE_MODE.test(body);
 }
-function is_interpreter_write(segment, command) {
+var SCRIPT_FILE = /\.(?:py|rb|pl|php|js|mjs|cjs)$/u;
+function is_heredoc_write(line, has_file) {
+  const target = has_heredoc(line.text) ? redirect_target(line.text) : void 0;
+  if (target === void 0) return false;
+  if (has_file(target)) return true;
+  return SCRIPT_FILE.test(target) && body_writes(line.body);
+}
+function is_interpreter_write(segment, body) {
   const leading = time_shell.leading_word(segment);
-  if (BODY_INTERPRETERS.has(leading)) return has_heredoc(command) && body_writes(command);
+  if (!BODY_INTERPRETERS.has(leading)) return false;
+  if (has_heredoc(segment)) return body_writes(body);
   return leading === NODE && NODE_EVAL.test(segment) && body_writes(segment);
 }
 var PERL = "perl";
@@ -507,13 +531,15 @@ function is_in_place_perl(segment) {
   if (time_shell.leading_word(segment) !== PERL) return false;
   return segment.split(WHITESPACE).some((word) => PERL_IN_PLACE.test(word));
 }
-function has_body_interpreter(command) {
-  return shell_segments.segments_of(first_line(command)).some((segment) => is_interpreter_write(segment, command) || is_in_place_perl(segment));
+function has_body_interpreter(line) {
+  return shell_segments.segments_of(line.text).some((segment) => is_interpreter_write(segment, line.body) || is_in_place_perl(segment));
 }
 function carries_a_file_body(command, has_file = existsSync) {
-  return writes_existing_file(command, has_file) || has_body_interpreter(command);
+  return command_lines(command).some(
+    (line) => is_heredoc_write(line, has_file) || has_body_interpreter(line)
+  );
 }
-var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline \u2014 a heredoc rewriting an existing file, an interpreter (`python3 - <<`, `node -e`) whose body writes, or an in-place `perl -0pi -e`. `CLAUDE.md` forbids it because the command body is re-read on every later request of the run, so an editing script written early is billed for the rest of it (`file-edits.md` measured one run at ~2m45s spent retyping existing lines). Edit a region with the Edit tool (old / new), or pass a body by path (`--field body=@<path>`, `--body-file <path>`). A new-file creation (`cat > <new-file> <<EOF`), a read-only heredoc (`cat <<EOF`), and a short `sed -i` stay allowed. **This rule fires on every occurrence, not once per run.**";
+var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline \u2014 a heredoc rewriting an existing file, an interpreter (`python3 - <<`, `node -e`) whose body writes, a script file (`cat > edit.py <<EOF`) whose body writes, or an in-place `perl -0pi -e`. `CLAUDE.md` forbids it because the command body is re-read on every later request of the run, so an editing script written early is billed for the rest of it (`file-edits.md` measured one run at ~2m45s spent retyping existing lines). Edit a region with the Edit tool (old / new); a change scattered so widely that the partial edits would carry more than the file is rewritten whole with the Write tool, never a heredoc. Pass a body by path (`--field body=@<path>`, `--body-file <path>`). A new-file creation (`cat > <new-file> <<EOF`), a read-only heredoc (`cat <<EOF`), and a short `sed -i` stay allowed. **This rule fires on every occurrence, not once per run.**";
 var ROW2 = {
   id: "file-body",
   is_trigger: bash_triggers.on_bash_command((command) => carries_a_file_body(command)),
@@ -535,6 +561,7 @@ var READ_METHOD = "GET";
 var REPO_PATH = /repos\/([^/\s'"?]+)\/([^/\s'"?]+)/u;
 var OWNER_GROUP = 1;
 var REPO_GROUP = 2;
+var OWNER_PLACEHOLDERS = /* @__PURE__ */ new Set(["{owner}", ":owner"]);
 function is_gh_api(segment) {
   return GH_API_COMMAND.test(segment);
 }
@@ -554,7 +581,18 @@ function repo_target(segment) {
   if (match === null) return void 0;
   return { owner: match[OWNER_GROUP] ?? "", repo: match[REPO_GROUP] ?? "" };
 }
-var gh_api = { GH_FLAGS, is_gh_api, is_read, is_write, method_of, repo_target };
+function is_owner_placeholder(owner) {
+  return OWNER_PLACEHOLDERS.has(owner);
+}
+var gh_api = {
+  GH_FLAGS,
+  is_gh_api,
+  is_owner_placeholder,
+  is_read,
+  is_write,
+  method_of,
+  repo_target
+};
 
 // scripts/rules/git-argv.ts
 var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u;
@@ -1144,7 +1182,7 @@ function is_over_threshold_edit(call, state = current_state()) {
   return warrants_the_cut(state);
 }
 var THRESHOLD_TEXT = `${cost_format.format_tokens(CONTEXT_CUT_THRESHOLD)}-token`;
-var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
+var IMPLEMENTATION_CUT_REASON = `\u26D4 implementation-phase cut: this checkout is a lane dispatched for this issue, or a run holds it for this issue (joshuafolkken/kit#2760), and its recent-context cost has crossed the shared ${THRESHOLD_TEXT} threshold mid-implementation, so the thinking accumulated so far is now re-read on every later request. Take the cut before this edit. First write a handoff file with the Write tool \u2014 the user\u2019s instruction verbatim, what you have completed, what remains, and what you deliberately did not touch, as ${run_cut_handoff.HANDOFF_FORMAT} (Markdown is refused) \u2014 and pass it as \`--handoff <path>\`, so the fresh process resumes on the original instruction rather than the working tree alone (joshuafolkken/kit#2354); a resume that finds no instruction is refused \`incomplete\` rather than continuing blind. \`pnpm josh run:cut --impl <N> --handoff <path>\` ends this process and relaunches a fresh one that resumes back into implementation (\`resume-impl\`), dropping the accumulated context rather than carrying it \u2014 joshuafolkken/kit#1933 built the boundary and joshuafolkken/kit#2310 measured it firing 0 times because the verdict was only ever read at session entry, where the context has not yet grown. The verdict is \`pnpm josh cost --cut\`'s exactly \u2014 the same per-request billed-input statistic against the same threshold, never a second measurement. Issue \`pnpm josh run:cut --impl <N> --handoff <path>\` now and read the verdict: on \`cut\`, **end the turn immediately** \u2014 in a lane the fresh process owns the run and continues implementing, so it must not be waited for; outside a lane nothing is relaunched, so first send the \`confirmation\` Telegram naming the resume command \`fullrun #<N>\` and keep the hold; on \`not-a-lane\`, \`unready\`, \`busy\`, \`failed\` or \`unknown\`, this process carries the run on and the edit is simply the next call. Never relaunch a second process after \`busy\`. This fired because the dispatch mark names this lane or the run hold names this issue; a person working here carries no mark and holds no run, so sees no refusal, so there is no human-or-child judgement left to make. The procedure is \`.claude/skills/workflow-commands/pre-gate-cut.md\`. Reissue this edit once the cut has answered \u2014 an edit reissued right after this refusal passes, so \`busy\` / \`failed\` cannot wedge the run edit after edit; this fires again on the next threshold crossing rather than once per run.`;
 var REISSUE_WINDOW_MS = 9e4;
 function is_reissued_refusal(now_ms, delivered_at_ms) {
   return now_ms - delivered_at_ms < REISSUE_WINDOW_MS;
@@ -1436,13 +1474,13 @@ var RUN_ENTRY_ORACLE = {
   decision: "Where a run on an issue starts, and whether the typed command has already been reached",
   args: "<N> [--to kickoff|halfrun|prrun|fullrun]",
   vocabulary: run_stage.START_TOKENS,
-  single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72k"
+  single_source: "docs/how-to/run-issues.md"
 };
 
 // scripts/rules/decision-oracle.ts
 var CHAIN_RULE_MD = ".claude/skills/workflow-commands/chain-rule.md";
 var BACKLOGRUN_PROGRESS_MD = ".claude/skills/workflow-commands/backlogrun-progress.md";
-var SKILL_2E = ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72e";
+var SKILL_2E = ".claude/skills/workflow-commands/issue-scout.md";
 var SPLIT_ASSESSMENT_QUESTION = ".claude/skills/workflow-commands/split-assessment.md \u2192 The question";
 var PRE_GATE_CUT_MD = ".claude/skills/workflow-commands/pre-gate-cut.md";
 var BACKLOGRUN_MD = ".claude/skills/workflow-commands/backlogrun.md";
@@ -1475,7 +1513,7 @@ var DECISION_ORACLES = [
     decision: "Whether a run step may be delegated to a cheaper execution tier",
     args: "<step>",
     vocabulary: ["delegate", "keep"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72b"
+    single_source: ".claude/skills/workflow-commands/delegation.md"
   },
   {
     name: "review:level",
@@ -1518,7 +1556,7 @@ var DECISION_ORACLES = [
     decision: "Whether this working tree is free for a run to claim",
     args: `[${ISSUE_N_ARG}]`,
     vocabulary: ["hold", BUSY, UNKNOWN],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72f"
+    single_source: ".claude/skills/workflow-commands/working-tree-hold.md"
   },
   {
     name: "cost:cut",
@@ -1533,7 +1571,7 @@ var DECISION_ORACLES = [
     decision: "Whether a release is owed after this merge",
     args: "",
     vocabulary: [REQUIRED, SKIP, UNKNOWN],
-    single_source: ".claude/skills/workflow-commands/followup-reference.md"
+    single_source: ".claude/skills/workflow-commands/followup.md"
   },
   {
     name: "epic:bundle",
@@ -1582,7 +1620,7 @@ var DECISION_ORACLES = [
     decision: "An issue's state, labels, and human-review flag",
     args: ISSUE_N_ARG,
     vocabulary: ["human_review: yes", "human_review: no"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72z"
+    single_source: ".claude/skills/workflow-commands/needs-human-review.md"
   },
   {
     name: "run:cut:resume",
@@ -1619,7 +1657,7 @@ var DECISION_ORACLES = [
     decision: "Whether a named stash entry exists and can be applied",
     args: "<message>",
     vocabulary: ["popped", "conflicted", "no-match", "ambiguous"],
-    single_source: ".claude/skills/workflow-commands/SKILL.md \u2192 \xA72d"
+    single_source: ".claude/skills/workflow-commands/prerequisite.md"
   },
   {
     name: "backlog:next",
@@ -1889,6 +1927,67 @@ var ROW10 = {
 };
 var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW10, is_destructive_command };
 
+// scripts/rules/direct-pr-create.ts
+var GH_COMMAND2 = "gh";
+var PR_GROUP2 = "pr";
+var PR_CREATE_ACTIONS = /* @__PURE__ */ new Set(["create", "new"]);
+var FLAG_PREFIX3 = "-";
+var VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set(["-R", "--repo"]);
+var API_VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set([
+  ...VALUE_TAKING_FLAGS,
+  "-X",
+  "--method",
+  "-f",
+  "--raw-field",
+  "-F",
+  "--field",
+  "-H",
+  "--header",
+  "--input",
+  "-q",
+  "--jq",
+  "-t",
+  "--template",
+  "--hostname",
+  "-p",
+  "--preview",
+  "--cache"
+]);
+var API_SUBCOMMAND = "api";
+var PULLS_PATH = /^['"]?(?:https:\/\/api\.github\.com)?\/?repos\/[^/\s'"]+\/[^/\s'"]+\/pulls\/?['"]?$/u;
+function positional_words(args, value_taking_flags) {
+  return args.filter((argument, index) => {
+    if (argument.startsWith(FLAG_PREFIX3)) return false;
+    return !value_taking_flags.has(args[index - 1] ?? "");
+  });
+}
+function is_pr_create_api_call(args) {
+  const call = [GH_COMMAND2, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || !gh_api.is_write(call)) return false;
+  const [subcommand, endpoint = ""] = positional_words(args, API_VALUE_TAKING_FLAGS);
+  return subcommand === API_SUBCOMMAND && PULLS_PATH.test(endpoint);
+}
+function is_pr_create_cli_call(args) {
+  const [group, action = ""] = positional_words(args, VALUE_TAKING_FLAGS);
+  return group === PR_GROUP2 && PR_CREATE_ACTIONS.has(action);
+}
+function is_pr_create_segment(segment) {
+  const args = git_argv.arguments_of(segment, GH_COMMAND2);
+  if (args === void 0) return false;
+  return is_pr_create_cli_call(args) || is_pr_create_api_call(args);
+}
+function is_direct_pr_create(command) {
+  return shell_segments.segments_of(command).some((segment) => is_pr_create_segment(segment));
+}
+var DIRECT_PR_CREATE_REASON = "\u26D4 direct PR creation: `gh pr create` (or a `gh api` POST to `repos/<o>/<r>/pulls`) bypasses `build_body`, which writes the `closes #N` line \u2014 the Issue would stay open after the merge (`CLAUDE.md` \u2192 Git Rules). Open the PR with `pnpm josh pr` instead; after a failed push, fix, push, then run `pnpm josh pr`. **This rule fires on every occurrence, not once per run.**";
+var ROW11 = {
+  id: "direct-pr-create",
+  is_trigger: bash_triggers.on_bash_command(is_direct_pr_create),
+  reason: DIRECT_PR_CREATE_REASON,
+  decide: () => true
+};
+var direct_pr_create = { DIRECT_PR_CREATE_REASON, ROW: ROW11, is_direct_pr_create };
+
 // scripts/rules/worktree-guard.ts
 var CHECKOUT_SUBCOMMAND = "checkout";
 var RESTORE_SUBCOMMAND = "restore";
@@ -1949,14 +2048,14 @@ function is_unauthorized_worktree_change(command) {
   return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
 }
 var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>`, a forced `git clean` and an unauthorized `git stash` discard work or mutate the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
-var ROW11 = {
+var ROW12 = {
   id: "worktree-mutation",
   is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
   reason: WORKTREE_MUTATION_REASON,
   decide: () => true
 };
 var worktree_guard = {
-  ROW: ROW11,
+  ROW: ROW12,
   WORKTREE_MUTATION_REASON,
   is_unauthorized_worktree_change,
   touches_worktree
@@ -1985,13 +2084,13 @@ function is_index_mutation(command) {
   return shell_segments.segments_of(command).some((segment) => is_index_segment(segment));
 }
 var INDEX_MUTATION_REASON = '\u26D4 git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore --staged` overwrite the user\'s staged snapshot, which `CLAUDE.md` \u2192 Git Rules forbids on your own judgement (`prompts/collaboration-workflow/operating-rules.md` \u2192 "git index \u3092\u52DD\u624B\u306B\u5909\u66F4\u3057\u306A\u3044"). The `.claude/settings.json` deny list matches prefix globs, so it misses `git -C . commit`, `git -c k=v commit` and `env git commit`; this row reads the argv instead, so the spelling does not matter. A commit goes through `pnpm josh git -y`; any other staging needs explicit current-turn user instruction, run by the user in their own terminal. **This rule fires on every occurrence, not once per run.**';
-var ROW12 = {
+var ROW13 = {
   id: "index-mutation",
   is_trigger: bash_triggers.on_bash_command(is_index_mutation),
   reason: INDEX_MUTATION_REASON,
   decide: () => true
 };
-var index_guard = { INDEX_MUTATION_REASON, ROW: ROW12, is_index_mutation };
+var index_guard = { INDEX_MUTATION_REASON, ROW: ROW13, is_index_mutation };
 
 // scripts/rules/protected-files.ts
 import path5 from "node:path";
@@ -2140,16 +2239,21 @@ function is_protected_file_call(call, is_kit_consumer2 = doctor_consumer.is_kit_
   return is_environment_read(call) || is_consumer_settings_edit(call, is_kit_consumer2);
 }
 var PROTECTED_FILE_REASON = '\u26D4 protected file: `.env` holds the Telegram bot token, so reading it puts a secret in the transcript \u2014 the scripts that need it load it in their own process. `.claude/settings.json` in a consumer repository is the deny list and the hooks every other rule rests on, so a run must not rewrite it; `josh sync` owns it, and a change belongs upstream in kit (`CLAUDE.md` \u2192 "Route distributed-doc / config changes upstream to kit"). Leave both files alone, or ask the user. **This rule fires on every occurrence, not once per run.**';
-var ROW13 = {
+var ROW14 = {
   id: "protected-file",
   is_trigger: is_protected_file_call,
   reason: PROTECTED_FILE_REASON,
   decide: () => true
 };
-var protected_files = { ROW: ROW13, is_protected_file_call };
+var protected_files = { ROW: ROW14, is_protected_file_call };
 
 // scripts/rules/permission-guards.ts
-var ROWS2 = [index_guard.ROW, destructive_command.ROW, protected_files.ROW];
+var ROWS2 = [
+  index_guard.ROW,
+  destructive_command.ROW,
+  protected_files.ROW,
+  direct_pr_create.ROW
+];
 var permission_guards = { ROWS: ROWS2 };
 
 // scripts/rules/piped-verification.ts
@@ -2220,7 +2324,7 @@ function is_poll_loop(command) {
   return LOOP_KEYWORD2.test(plain) && SLEEP_COMMAND.test(plain);
 }
 var POLL_LOOP_REASON = '\u26D4 output poll loop: this hand-writes a `while`/`until` wait loop over a command\'s output, a marker file or a process \u2014 with a `sleep` or, worse, without one \u2014 and the loop does not know when the command finished. A regex that never matches waits to the harness block limit; one that matches a mid-run line exits too early \u2014 either way the command exit is not what ends the wait, and each pass spends a full-context round trip (joshuafolkken/kit#2371 measured about 45 minutes, 13% of six lanes, lost to exactly this). Do not poll the output file. A command known to take minutes \u2014 `pnpm josh gate`, `pnpm josh followup`, `pnpm josh format` \u2014 is started detached from the first with `run_in_background` set, and the harness re-invokes you when it exits: its completion notification is what ends the wait, on the task exit rather than a regex or the block limit. So issue the long command in the background and end the turn \u2014 do not arm a loop; the wake-up brings you back. To glance at interim output, `Read` the output file once, never in a sleep loop. If you are waiting on CI, `pnpm josh followup` waits on it for you. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every occurrence, not once per run.**';
-var ROW14 = {
+var ROW15 = {
   id: "poll-loop",
   is_trigger: bash_triggers.on_bash_command(is_poll_loop),
   reason: POLL_LOOP_REASON,
@@ -2228,7 +2332,7 @@ var ROW14 = {
 };
 var poll_loop = {
   POLL_LOOP_REASON,
-  ROW: ROW14,
+  ROW: ROW15,
   is_poll_loop
 };
 
@@ -2348,13 +2452,13 @@ function posts_at_path_literally(command) {
   return RAW_FIELD_BODY_AT.test(command);
 }
 var RAW_FIELD_BODY_REASON = "\u26D4 literal @path body: this passes `body=@<path>` to `gh api` with a raw field flag (`-f` / `--raw-field`), which sends the value verbatim \u2014 the string `@<path>` is posted as the comment, not the file it points at. `-F` / `--field` is the flag that reads the file, and the two spellings differ by one character while `gh` exits 0 and returns a comment URL either way, so the break is invisible until a person reads the issue (joshuafolkken/kit#2304 lost two park comments this way). Post an issue or PR comment with `pnpm josh issue:comment <N> --body-file <path>` \u2014 the one spelling, which cannot take the wrong flag. The rule and the safe forms are in `prompts/collaboration-workflow/shell-body.md`. This rule fires on every occurrence, not once per run.";
-var ROW15 = {
+var ROW16 = {
   id: "raw-field-body",
   is_trigger: bash_triggers.on_bash_command(posts_at_path_literally),
   reason: RAW_FIELD_BODY_REASON,
   decide: () => true
 };
-var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW15, posts_at_path_literally };
+var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW16, posts_at_path_literally };
 
 // scripts/rules/rule-body-guard.ts
 var EDIT_TOOL = "Edit";
@@ -2425,7 +2529,7 @@ function runs_placement_oracle(command) {
     (names) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
   );
 }
-var ROW16 = {
+var ROW17 = {
   id: "rule-body",
   is_trigger: writes_rule_prose,
   reason: RULE_BODY_REASON,
@@ -2434,7 +2538,7 @@ var ROW16 = {
 };
 var rule_body_guard = {
   RULE_BODY_REASON,
-  ROW: ROW16,
+  ROW: ROW17,
   answered_placement,
   is_rule_document,
   writes_rule_prose
@@ -2869,31 +2973,53 @@ function is_untested_commit(call) {
   return test_declared_changed.current_verdict() === "required";
 }
 var REASON = '\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads the working tree as `required` (a changed file that is neither a test \u2014 `*.test.ts` / `*.e2e.ts` \u2014 nor a mechanically-exempt non-runtime path). `CLAUDE.md` \u2192 Code Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an E2E. Add the declared test and reissue this commit. **If the change genuinely touches no executable runtime path** it is the pre-approved non-runtime exception \u2014 declare it in your Step 0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` \u2192 "\u914D\u9001\u3055\u308C\u3066\u3044\u308B\u898F\u5247". This fires once per run, so reissuing will not repeat on the call in hand.';
-var ROW17 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
-var test_declared_commit = { REASON, ROW: ROW17 };
+var ROW18 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
+var test_declared_commit = { REASON, ROW: ROW18 };
 
 // scripts/rules/third-party-write.ts
-function is_third_party_write_segment(segment, session_owner) {
+function is_third_party_write_segment(segment, session_owner, resolve_placeholder_owners) {
   if (!gh_api.is_gh_api(segment) || !gh_api.is_write(segment)) return false;
   const target = gh_api.repo_target(segment);
   if (target === void 0) return false;
-  return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+  if (!gh_api.is_owner_placeholder(target.owner)) {
+    return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+  }
+  return resolve_placeholder_owners().some(
+    (owner) => owner === void 0 || repo_party.classify(session_owner, owner) === repo_party.THIRD_PARTY
+  );
+}
+var GH_CONTEXT_CHANGE = /(?:^|\s)(?:cd|pushd)(?:\s|$)|(?:^|\s)(?:export\s+)?GH_REPO=/u;
+function unreadable_candidates() {
+  return [void 0];
 }
-function writes_third_party(command, resolve_owner = repo_party.current_owner) {
-  const targets = shell_segments.segments_of(command).filter((segment) => gh_api.is_gh_api(segment) && gh_api.is_write(segment));
-  if (targets.length === 0) return false;
+function candidates_at(segments, index, resolve_placeholder_owners) {
+  const has_moved = segments.slice(0, index).some((segment) => GH_CONTEXT_CHANGE.test(segment));
+  return has_moved ? unreadable_candidates : resolve_placeholder_owners;
+}
+function writes_third_party(command, resolve_owner = repo_party.current_owner, resolve_placeholder_owners = repo_party.placeholder_owners) {
+  const segments = shell_segments.segments_of(command);
+  const has_write = segments.some(
+    (segment) => gh_api.is_gh_api(segment) && gh_api.is_write(segment)
+  );
+  if (!has_write) return false;
   const session_owner = resolve_owner();
-  return targets.some((segment) => is_third_party_write_segment(segment, session_owner));
+  return segments.some(
+    (segment, index) => is_third_party_write_segment(
+      segment,
+      session_owner,
+      candidates_at(segments, index, resolve_placeholder_owners)
+    )
+  );
 }
 var THIRD_PARTY_WRITE_REASON = '\u26D4 third-party write: this `gh api` call writes to a repository whose owner is not this session \u2014 a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, is not that instruction (`CLAUDE.md` \u2192 "Third-party repositories are Tier C", `prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with `pnpm josh repo:party <owner/repo>` \u2014 owner equality, computed not judged. A read (`-X GET`, or no field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or `-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact for a person to post \u2014 do not publish it yourself. **This rule fires on every occurrence, not once per run.**';
-var ROW18 = {
+var ROW19 = {
   id: "third-party-write",
   is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
   reason: THIRD_PARTY_WRITE_REASON,
   decide: () => true
 };
 var third_party_write = {
-  ROW: ROW18,
+  ROW: ROW19,
   THIRD_PARTY_WRITE_REASON,
   writes_third_party
 };
@@ -2903,7 +3029,7 @@ var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
 var STAMP_PREFIX = "josh-rule-guard-";
 var { is_issue_filing, on_bash_command } = bash_triggers;
 var WIP_CAP = 30;
-var WIP_CAP_REASON = `\u26D4 backlog WIP cap: count the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by, and an interrupt, decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. The count command and both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call once you have counted \u2014 it fires once per run and cannot repeat on the call in hand.`;
+var WIP_CAP_REASON = `\u26D4 backlog WIP cap: \`pnpm josh issue:file\` counts the target repository's open Issues before filing. With more than ${String(WIP_CAP)} open, close one first; nothing honestly closable means do not file \u2014 the command holds such a filing. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by (\`--over-cap\`, or the \`tier-a\` / \`split\` route), and an interrupt (\`--route interrupt\`), decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. Both procedures are in \`prompts/collaboration-workflow/wip-cap.md\`. Reissue this call and let the command count \u2014 it fires once per run and cannot repeat on the call in hand.`;
 var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
 var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
 var FETCHES_COMMENTS = /--comments\b|--json\s[\w,]*\bcomments\b|\/comments\b/u;
@@ -2928,7 +3054,7 @@ function is_body_only_issue_read(command) {
   if (segments.some((segment) => fetches_issue_comments(segment))) return false;
   return segments.some((segment) => is_body_read_segment(segment));
 }
-var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/SKILL.md` \u2192 \"An Issue's comments are part of the Issue\". Every body-only read is refused until the comments are read.";
+var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/issue-comments.md`. Every body-only read is refused until the comments are read.";
 var { SHELL_BODY_REASON: SHELL_BODY_REASON2, carries_a_body: carries_a_body2, is_shell_evaluated_body: is_shell_evaluated_body2, keeps_body_safe: keeps_body_safe2 } = shell_body_trigger;
 var ISSUE_LISTING = /^gh\s+(?:-{1,2}[\w-]+(?:[= ]\S+)?\s+)*issue\s+list\b/u;
 var ISSUES_QUERY = /repos\/[^\s'"]*\/issues\?[^\s'"]*state=open/u;
@@ -4297,7 +4423,29 @@ async function pretool_outcome_async(raw_payload) {
   if (reason !== void 0) return { reason, notice: void 0, fault: void 0 };
   return with_step_zero_notice(base, raw_payload);
 }
-var pretool_guard = { combine_outcomes, pretool_outcome };
+function guarded_call(raw_payload) {
+  try {
+    const payload = hook_decision.parse_hook_payload(raw_payload);
+    return payload === void 0 ? void 0 : { name: payload.tool_name, input: payload.tool_input };
+  } catch {
+    return void 0;
+  }
+}
+function foreground_rewrite(outcome, raw_payload, is_lane_child) {
+  if (outcome.reason !== void 0) return void 0;
+  const call = guarded_call(raw_payload);
+  const input = call === void 0 ? void 0 : lane_background.foreground_input(call, is_lane_child);
+  if (input === void 0) return void 0;
+  const context = [lane_background.FOREGROUND_NOTE, outcome.notice ?? outcome.fault];
+  return hook_decision.rewrite_envelope(input, context.filter(Boolean).join("\n\n"));
+}
+function emit(raw_payload, outcome) {
+  const rewrite = foreground_rewrite(outcome, raw_payload);
+  if (rewrite === void 0) hook_decision.emit_outcome(outcome);
+  else process.stdout.write(`${rewrite}
+`);
+}
+var pretool_guard = { combine_outcomes, emit, foreground_rewrite, pretool_outcome };
 
 export {
   pretool_outcome_async,

package/dist/hooks/chunk-GYNGP7HI.js

@@ -0,0 +1,56 @@
+import {
+  lane_child_marker
+} from "./chunk-5KTCMCOT.js";
+
+// scripts/lane/lane-guard-policy.ts
+var DEFAULT_MODE = "refuse";
+var OFF_MODE = "off";
+var LANE_GUARD_POLICY = [
+  {
+    id: "investigation",
+    mode_in_lane_child: "notice",
+    because: 'a refusal ends a child turn so it cannot fire as one (kit#2138), which is why it was `off` from #2138 to #2382. The exemption reason \u2014 "the child is itself the delegated unit, so it cannot dispatch a sub-unit to read its own edit targets" \u2014 did not hold in measurement: kit#2382 re-measured the six lane children after #2347 (#2366 #2370 #2371 #2372 #2374 #2375) and every one dispatched sub-agents (10 launches, 2 of them investigation fan-outs) and read 4\u201317 files it never edited, all six over the threshold of 3. So the reading the guard exists to send out was there to send. It takes `notice`, not `off`: the child is nudged to delegate rather than killed, on the `additionalContext` path batching and duplicate-read already use, and the notice names the concrete unedited files this run read (the #2276 precedent) rather than the generic "delegate" #2164 \u2192 #2178 measured not to move the number. The density is a genuine experiment \u2014 re-measured on the next backlogrun, and a notice that still does not move it is redesigned rather than kept'
+  },
+  {
+    id: "batching",
+    mode_in_lane_child: "off",
+    because: "a refusal ends a child turn so it cannot fire as one (kit#2138); kit#2164 replaced it with a notice, kit#2178 took that notice off after it did not move the density, and kit#2276 restored it \u2014 naming the concrete recent calls and recurring every single-call turn \u2014 as a genuine experiment to be redesigned rather than kept if the next backlogrun still missed 1.40. kit#2405 is that re-measurement, and it cuts the notice off (`off`). `josh time:density` read 1.13 calls per round trip over the ten most recent lanes (1.04 in the Issue\u2019s per-message frame), short of the 1.40 target as every advisory attempt before it was (kit#1304/#1329/#1337/#1390/#2164/#2276). The cause is structural rather than wording: a `PreToolUse` hook cannot see the turn it is in \u2014 a turn\u2019s later `tool_use` lines arrive 1.4\u201315s after its first \u2014 so it judges only closed turns, and a notice at turn close still asks for the parallel `tool_use` blocks the model resists. The one lever measured to move the density is a composite command the model emits in a single call (`read:files`/`edit:files`, kit#2202/#2311), which needs no notice. So per the issue\u2019s instruction to discontinue advisory means when the target is missed, the notice is cut off rather than rewritten a seventh time; the density stays readable through `josh time:density`"
+  },
+  {
+    id: "duplicate-read",
+    mode_in_lane_child: "notice",
+    because: "a refusal ends a child turn so it cannot fire as one (kit#2138), and the unchanged re-reads the guard catches are measured in lane children above all (kit#2298 baseline: 8.0 per lane run) \u2014 so silencing it there (`off`) would neuter it exactly where the count lives. It takes `notice` instead: the child is nudged to scroll up to the earlier read rather than killed. The mode is a genuine experiment, as the batching notice is \u2014 a notice that does not reduce the duplicate reads on the next backlogrun is redesigned rather than kept"
+  },
+  {
+    id: "rule",
+    mode_in_lane_child: "refuse",
+    because: "it carries the lane-only rules a child depends on (`pre-gate-cut`, `implementation-cut`, `lane-park`) and the safety rules a child must still obey (`shell-body`, `piped-verification`); a blanket suppression would disarm exactly the guards written for the child. `implementation-cut` (joshuafolkken/kit#2310) needs `refuse` for the same reason the pre-gate cut does \u2014 kit#1864 and kit#2310 both measured a cut carried as prose firing 0 times, so a notice, being prose in front of the run, would drop enforcement without a procedural replacement. The pre-gate-cut refusal does collateral a sibling call batched in the same turn \u2014 a `PreToolUse` deny cancels the turn's other parallel calls, which is the harness behavior kit#2177 measured on #2160 (gate refused, its batched `review:brief` cancelled) \u2014 and that collateral is not avoidable at the guard level. `notice` was considered for the pre-gate-cut point and rejected: kit#1864 measured the cut taken 0 times while it was carried as prose, and a notice is prose in front of the run (kit#2178 measured a lane-child notice not moving the number), so a notice would drop enforcement without a procedural replacement. kit#2177 supplies that replacement in the procedure instead \u2014 the chain orders the cut before the gate, so the cut is issued on its own (its `cut` verdict ends the turn, batching with nothing) and the gate runs in the fresh process where the carried cut keeps this guard silent; the refusal therefore stays `refuse` as insurance and the collateral is gone from the default path rather than from the guard"
+  }
+];
+var KNOWN_GUARD_IDS = LANE_GUARD_POLICY.map((entry) => entry.id);
+function entry_for(id) {
+  return LANE_GUARD_POLICY.find((entry) => entry.id === id.trim());
+}
+function mode_in_lane_child(id) {
+  return entry_for(id)?.mode_in_lane_child ?? DEFAULT_MODE;
+}
+function mode_here(id, directory = process.cwd(), source = process.env) {
+  const lane_mode = mode_in_lane_child(id);
+  if (lane_mode === DEFAULT_MODE) return DEFAULT_MODE;
+  return lane_child_marker.is_child_of(directory, source) ? lane_mode : DEFAULT_MODE;
+}
+function is_suppressed_here(id, directory = process.cwd(), source = process.env) {
+  return mode_here(id, directory, source) === OFF_MODE;
+}
+var lane_guard_policy = {
+  LANE_GUARD_POLICY,
+  KNOWN_GUARD_IDS,
+  entry_for,
+  mode_in_lane_child,
+  mode_here,
+  is_suppressed_here
+};
+
+export {
+  lane_guard_policy
+};