@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/rules/gh-api.ts

@@ -1,3 +1,5 @@
+import { git_argv } from './git-argv'
+
 // The one reading of a `gh api` segment shared by the rows of `delivered-rules.ts` that judge such a
 // call by its spelling: the issue-body-read guard classifies read vs write,
 // and the third-party-write guard needs the same classification plus the target `owner/repo`. Two
@@ -17,10 +19,39 @@ const GH_API_COMMAND = new RegExp(String.raw`^gh\s+${GH_FLAGS}api\s`, 'u')
 // The method override, and the field flags that turn a bare `gh api` into a POST. **All four field
 // spellings**, `-F` included — it is `--field`'s short form and reads as a different flag to a
 // pattern that only knows `-f`. A body passed with `--input <file>` counts as a write too: it carries
-// the fields inside the file.
-const API_METHOD = /(?:^|\s)(?:--method|-X)[= ]([A-Za-z]+)/u
-const API_FIELD = /(?:^|\s)(?:--raw-field|--field|--input|-F|-f)(?:[= ]|$)/u
+// the fields inside the file. A short flag also takes its value attached (`-XPUT`, `-fname=x`), as
+// `gh` accepts.
+//
+// **Read off the argv at flag positions, not the joined line**: a flag spelled inside a field value
+// (`-f 'note=a -X GET'`) is that field's value, and reading it as the method would class a POST a
+// read (joshuafolkken/kit#4650).
+const GH_COMMAND = 'gh'
+const METHOD_FLAGS: ReadonlySet<string> = new Set(['-X', '--method'])
+const ATTACHED_METHOD = /^(?:-X=?|--method=)([A-Za-z]+)$/u
+const FIELD_FLAGS: ReadonlySet<string> = new Set(['-f', '-F', '--field', '--raw-field', '--input'])
+const ATTACHED_FIELD = /^(?:-[fF].|--(?:raw-field|field|input)=)/u
+const QUOTES = /['"]/gu
+const FLAG_PREFIX = '-'
+const NEXT = 1
 const READ_METHOD = 'GET'
+// `gh api`'s flags that take a value as the next word, beside the repository selector — skipped so
+// `-X POST` or `-f body=…` is not read as the endpoint, and a value is not read as a flag.
+const API_VALUE_TAKING_FLAGS: ReadonlySet<string> = new Set([
+	'-R',
+	'--repo',
+	...METHOD_FLAGS,
+	...FIELD_FLAGS,
+	'-H',
+	'--header',
+	'-q',
+	'--jq',
+	'-t',
+	'--template',
+	'--hostname',
+	'-p',
+	'--preview',
+	'--cache',
+])
 
 // `repos/<owner>/<repo>` from an api path, with both halves captured. The path may carry a leading
 // slash, a query string, or further segments (`…/issues/5/comments`), so the owner and repo are taken
@@ -44,24 +75,111 @@ function is_gh_api(segment: string): boolean {
 	return GH_API_COMMAND.test(segment)
 }
 
+// Each flag of the call with the word after it — a word that is a value-taking flag's value is not
+// a flag itself.
+function flags_of(segment: string): Array<[string, string]> {
+	const words = git_argv.arguments_of(segment, GH_COMMAND) ?? []
+
+	return words
+		.map((word, index): [string, string] => [word, words[index + NEXT] ?? ''])
+		.filter(([word], index) => {
+			if (!word.startsWith(FLAG_PREFIX)) return false
+
+			return !API_VALUE_TAKING_FLAGS.has(words[index - NEXT] ?? '')
+		})
+}
+
+function method_value(flag: string, next: string): string | undefined {
+	if (METHOD_FLAGS.has(flag)) return next.replaceAll(QUOTES, '')
+
+	return ATTACHED_METHOD.exec(flag)?.[1]
+}
+
 // A read is a `GET` — explicit via a method flag, or implicit when no field flag makes it a POST.
-// The explicit `-X` / `--method` value, upper-cased, or `undefined` when the call names none.
+// The explicit `-X` / `--method` value, upper-cased, or `undefined` when the call names none; the
+// last one wins, as it does in `gh`.
 function method_of(segment: string): string | undefined {
-	return API_METHOD.exec(segment)?.[1]?.toUpperCase()
+	const methods = flags_of(segment).map(([flag, next]) => method_value(flag, next))
+
+	return methods.findLast((method) => method !== undefined)?.toUpperCase()
+}
+
+function is_field_flag(flag: string): boolean {
+	return FIELD_FLAGS.has(flag) || ATTACHED_FIELD.test(flag)
 }
 
 function is_read(segment: string): boolean {
 	const method = method_of(segment)
 
-	if (method !== undefined) return method.toUpperCase() === READ_METHOD
+	if (method !== undefined) return method === READ_METHOD
 
-	return !API_FIELD.test(segment)
+	return flags_of(segment).every(([flag]) => !is_field_flag(flag))
 }
 
 function is_write(segment: string): boolean {
 	return !is_read(segment)
 }
 
+// What one field flag sends: the value itself, or the file `gh` reads it from — `-F key=@<path>` and
+// `--input <path>`, standard input (`-`) excepted. `-f` / `--raw-field` sends `@<path>` as text.
+interface FieldSource {
+	kind: 'text' | 'file'
+	value: string
+}
+
+const INPUT_FLAG = '--input'
+const READS_FILE_FLAGS: ReadonlySet<string> = new Set(['-F', '--field'])
+const ATTACHED_PARTS = /^(-[fF]|--(?:raw-field|field|input))=?(.+)$/u
+const ATTACHED_FLAG_GROUP = 1
+const ATTACHED_VALUE_GROUP = 2
+const FILE_PREFIX = '@'
+const STANDARD_INPUT = '-'
+const FIELD_KEY_END = '='
+
+// The flag and its value, attached (`-fname=x`, `--input=path`) or as the next word.
+function field_parts(flag: string, next: string): [string, string] | undefined {
+	if (FIELD_FLAGS.has(flag)) return [flag, next]
+
+	const match = ATTACHED_PARTS.exec(flag)
+
+	if (match === null) return undefined
+
+	return [String(match[ATTACHED_FLAG_GROUP]), String(match[ATTACHED_VALUE_GROUP])]
+}
+
+function field_value(value: string): string {
+	return value.slice(value.indexOf(FIELD_KEY_END) + NEXT)
+}
+
+// The path a field flag has `gh` read, or `undefined` when it sends its value as text.
+function file_path(flag: string, value: string): string | undefined {
+	if (flag === INPUT_FLAG) return value
+
+	const sent = field_value(value)
+
+	if (!READS_FILE_FLAGS.has(flag) || !sent.startsWith(FILE_PREFIX)) return undefined
+
+	return sent.slice(FILE_PREFIX.length)
+}
+
+function field_source(flag: string, raw: string): FieldSource | undefined {
+	const value = raw.replaceAll(QUOTES, '')
+	const path = file_path(flag, value)
+
+	if (path === undefined) return { kind: 'text', value: field_value(value) }
+
+	return path === STANDARD_INPUT ? undefined : { kind: 'file', value: path }
+}
+
+function field_sources(segment: string): Array<FieldSource> {
+	return flags_of(segment).flatMap(([flag, next]) => {
+		const parts = field_parts(flag, next)
+		const source = parts === undefined ? undefined : field_source(...parts)
+
+		return source === undefined ? [] : [source]
+	})
+}
+
 function repo_target(segment: string): RepoTarget | undefined {
 	const match = REPO_PATH.exec(segment)
 
@@ -75,7 +193,9 @@ function is_owner_placeholder(owner: string): boolean {
 }
 
 const gh_api = {
+	API_VALUE_TAKING_FLAGS,
 	GH_FLAGS,
+	field_sources,
 	is_gh_api,
 	is_owner_placeholder,
 	is_read,
@@ -84,4 +204,5 @@ const gh_api = {
 	repo_target,
 }
 
+export type { FieldSource }
 export { gh_api }

package/scripts/rules/gh-repo-selector.ts

@@ -0,0 +1,84 @@
+import { direct_pr_create } from './direct-pr-create'
+import { git_argv } from './git-argv'
+
+// The `gh <group> <action> -R <owner>/<repo>` reading the third-party-write guard needs
+// (joshuafolkken/kit#4659). `gh pr create -R other/x` and `gh issue comment -R other/x` write to the
+// repository the selector names, so a guard that judged only `gh api`'s `repos/<owner>/` path let
+// every such write through.
+//
+// **A write unless it is a known read.** The read actions are few and stable; the write actions are
+// many and grow with `gh`. Listing the reads makes a new write subcommand refused by default instead
+// of passed by default.
+
+const GH_COMMAND = 'gh'
+const API_GROUP = 'api'
+const SELECTOR_FLAGS: ReadonlySet<string> = new Set(['-R', '--repo'])
+const ATTACHED_SELECTOR = /^(?:-R=?|--repo=)(.+)$/u
+const QUOTES = /['"]/gu
+const NEXT = 1
+// Groups that never write with a selector, whatever follows them.
+const READ_GROUPS: ReadonlySet<string> = new Set(['browse', 'search', 'status'])
+const READ_ACTIONS: ReadonlySet<string> = new Set([
+	'check',
+	'checkout',
+	'checks',
+	'clone',
+	'diff',
+	'download',
+	'get',
+	'list',
+	'status',
+	'verify',
+	'verify-asset',
+	'view',
+	'watch',
+])
+// `GH_REPO=<selector>` — inline before `gh`, or exported earlier in the line — selects the repository
+// exactly as `-R` does.
+const GH_REPO_ASSIGNMENT = /(?:^|\s)GH_REPO=(\S+)/gu
+const SELECTOR_GROUP = 1
+
+function selector_value(word: string, next: string | undefined): string | undefined {
+	if (SELECTOR_FLAGS.has(word)) return next
+
+	return ATTACHED_SELECTOR.exec(word)?.[1]
+}
+
+// Every `-R` / `--repo` value the call carries, quotes stripped. Each is a repository `gh` may send
+// the write to, so the caller judges all of them rather than guessing which one `gh` keeps.
+function selectors_of(args: ReadonlyArray<string>): Array<string> {
+	return args
+		.map((word, index) => selector_value(word, args[index + NEXT]))
+		.filter((value) => value !== undefined)
+		.map((value) => value.replaceAll(QUOTES, ''))
+}
+
+function is_write_call(args: ReadonlyArray<string>): boolean {
+	const [group = '', action = ''] = direct_pr_create.positional_words(args, SELECTOR_FLAGS)
+
+	if (group === API_GROUP || READ_GROUPS.has(group)) return false
+
+	return !READ_ACTIONS.has(action)
+}
+
+// Every `GH_REPO` value assigned in `segments` — the write's own segment and those before it.
+function assigned_selectors(segments: ReadonlyArray<string>): Array<string> {
+	return segments
+		.flatMap((segment) => [...segment.matchAll(GH_REPO_ASSIGNMENT)])
+		.map((match) => (match[SELECTOR_GROUP] ?? '').replaceAll(QUOTES, ''))
+}
+
+// The repository selectors of the `gh` write at `index` — its `-R` / `--repo` values and every
+// `GH_REPO` assigned up to it — or none when the segment is not `gh`, is a `gh api` call (judged by
+// its path), is a read, or names no selector.
+function write_selectors(segments: ReadonlyArray<string>, index: number): Array<string> {
+	const args = git_argv.arguments_of(segments[index] ?? '', GH_COMMAND)
+
+	if (args === undefined || !is_write_call(args)) return []
+
+	return [...selectors_of(args), ...assigned_selectors(segments.slice(0, index + NEXT))]
+}
+
+const gh_repo_selector = { write_selectors }
+
+export { gh_repo_selector }

package/scripts/rules/git-argv.ts

@@ -13,8 +13,9 @@
 
 // The wrapper words that may stand in front of `git`, the same ones `run-tail-rule.ts` skips in front of
 // `josh`: environment assignments, the package-manager launchers, `sudo`, `env`, and an opening
-// subshell parenthesis. Left in, `sudo git push --force`, `env git commit` and `(git push -f)` are
-// silently not a git command.
+// subshell parenthesis — plus `time` with its flags, read here only. Left in, `sudo git push --force`,
+// `env git commit` and `(git push -f)` are silently not a git command, and
+// `/usr/bin/time -p pnpm exec eslint .` is not an `eslint` run (joshuafolkken/kit#4356).
 const ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u
 const WRAPPER_WORDS: ReadonlySet<string> = new Set([
 	'pnpm',
@@ -24,7 +25,13 @@ const WRAPPER_WORDS: ReadonlySet<string> = new Set([
 	'sudo',
 	'command',
 	'env',
+	'time',
 ])
+// The wrappers whose own flags stand between them and the program (`time -p`), skipped with them.
+const FLAGGED_WRAPPERS: ReadonlySet<string> = new Set(['time'])
+// Their flags that consume a separate following value (`time -o <file>`, `time -f <format>`), so the
+// value is not read as the program.
+const WRAPPER_VALUE_FLAGS: ReadonlySet<string> = new Set(['-o', '-f', '--output', '--format'])
 const SUBSHELL_OPEN = '('
 
 // The git global options that consume a **separate** following token as their value, so the parser
@@ -50,18 +57,50 @@ interface GitCall {
 	args: ReadonlyArray<string>
 }
 
-// Split on whitespace alone. A refspec such as `:branch` and a short cluster such as `-uf` are single
-// tokens with no inner spaces, and neither force detection nor stash detection needs to look inside a
-// quoted argument — the one place a quote matters (a commit message) belongs to a subcommand neither
-// caller judges.
-const WHITESPACE = /\s+/u
+// Split on whitespace outside quotes, keeping each quote in its word. A quoted span is one word, so
+// `c='x; gh pr create'` is one environment assignment rather than an assignment followed by a `gh`
+// call (joshuafolkken/kit#4091); a backslash-escaped character outside quotes opens no span, and a
+// quote left unclosed is read as a plain character.
+const WORD = /(?:\\.|'[^']*'|"(?:\\.|[^"\\])*"|\S)+/gsu
 
 function words_of(segment: string): Array<string> {
-	return segment.split(WHITESPACE).filter((word) => word !== '')
+	return segment.match(WORD) ?? []
+}
+
+const PATH_SEPARATOR = '/'
+
+// The program a word launches, read off the path's last component, so `/usr/bin/git` is `git`.
+function program_name(word: string): string {
+	return word.slice(word.lastIndexOf(PATH_SEPARATOR) + NEXT)
 }
 
 function is_wrapper_token(word: string): boolean {
-	return word === SUBSHELL_OPEN || ENV_ASSIGNMENT.test(word) || WRAPPER_WORDS.has(word)
+	return (
+		word === SUBSHELL_OPEN || ENV_ASSIGNMENT.test(word) || WRAPPER_WORDS.has(program_name(word))
+	)
+}
+
+// The words a flagged wrapper's flag spans, its value included; 0 when the word is not a flag.
+function wrapper_flag_width(word = ''): number {
+	if (!word.startsWith(FLAG_PREFIX)) return 0
+
+	return WRAPPER_VALUE_FLAGS.has(word) ? AFTER_VALUE : NEXT
+}
+
+// The index after the wrapper word at `index`, past its own flags when it is a flagged wrapper.
+function after_wrapper_word(words: ReadonlyArray<string>, index: number): number {
+	let next = index + NEXT
+
+	if (!FLAGGED_WRAPPERS.has(program_name(words[index] ?? ''))) return next
+
+	let width = wrapper_flag_width(words[next])
+
+	while (width > 0) {
+		next += width
+		width = wrapper_flag_width(words[next])
+	}
+
+	return next
 }
 
 // Skip the wrapper: environment assignments, a launcher word, and a leading subshell parenthesis. The
@@ -69,7 +108,9 @@ function is_wrapper_token(word: string): boolean {
 function after_wrapper(words: ReadonlyArray<string>): number {
 	let index = 0
 
-	while (index < words.length && is_wrapper_token(words[index] ?? '')) index += NEXT
+	while (index < words.length && is_wrapper_token(words[index] ?? '')) {
+		index = after_wrapper_word(words, index)
+	}
 
 	return index
 }
@@ -94,14 +135,30 @@ function after_globals(words: ReadonlyArray<string>, start: number): number {
 	return index
 }
 
+interface ProgramCall {
+	name: string
+	args: Array<string>
+}
+
+// The program the segment launches once the wrapper is skipped, with the words after it, or
+// `undefined` for a segment with no program word.
+function program_of(segment: string): ProgramCall | undefined {
+	const words = words_of(segment)
+	const command_index = after_wrapper(words)
+	const word = words[command_index]
+
+	if (word === undefined) return undefined
+
+	return { name: program_name(word), args: words.slice(command_index + NEXT) }
+}
+
 // The words after `command` once the wrapper is skipped, or `undefined` when the segment does not
 // invoke it. `gh` and `rm` are judged by the same wrapper cut as `git`, so
 // `env gh pr close` and `sudo rm -rf` are read as the calls they are.
 function arguments_of(segment: string, command: string): Array<string> | undefined {
-	const words = words_of(segment)
-	const command_index = after_wrapper(words)
+	const call = program_of(segment)
 
-	return words[command_index] === command ? words.slice(command_index + NEXT) : undefined
+	return call?.name === command ? call.args : undefined
 }
 
 // The subcommand and the arguments after it, or `undefined` when the segment is not a git invocation.
@@ -135,6 +192,7 @@ function short_cluster_has(token: string, letters: string): boolean {
 	return false
 }
 
-const git_argv = { arguments_of, parse, short_cluster_has }
+const git_argv = { arguments_of, parse, program_of, short_cluster_has }
 
 export { git_argv }
+export type { ProgramCall }

package/scripts/rules/git-force.ts

@@ -15,7 +15,7 @@ import { shell_segments } from './shell-segments'
 //
 // **It fires on every occurrence, not once per run.** A force push is destructive every time it is
 // issued, so refused-once-and-free-after would put the second one back on the run's self-restraint —
-// the disposition `run-tail-rule.ts` and `filing-cap.ts` take for the same reason.
+// the disposition `run-tail-rule.ts` takes for the same reason.
 
 // A force push. The long forms all open with `--force` (`--force`, `--force-with-lease[=ref]`,
 // `--force-if-includes`); `-f` and any cluster carrying `f` are the short forms; a bare `--delete` and
@@ -24,6 +24,9 @@ import { shell_segments } from './shell-segments'
 // deletes (`:branch`). Both open the refspec with a character the deny list cannot match as a literal.
 const FORCE_LONG_PREFIX = '--force'
 const DELETE_LONG = '--delete'
+// `--mirror` force-updates every remote ref to the local set and deletes the rest; `--prune` deletes
+// every remote branch with no local counterpart. Both are a delete with no refspec to read.
+const DESTRUCTIVE_PUSH_LONG: ReadonlySet<string> = new Set([DELETE_LONG, '--mirror', '--prune'])
 const PUSH_SHORT_LETTERS = 'fd'
 const FORCE_OR_DELETE_REFSPEC = /^[+:]/u
 
@@ -31,7 +34,7 @@ function is_force_or_delete_push(args: ReadonlyArray<string>): boolean {
 	return args.some(
 		(argument) =>
 			argument.startsWith(FORCE_LONG_PREFIX) ||
-			argument === DELETE_LONG ||
+			DESTRUCTIVE_PUSH_LONG.has(argument) ||
 			git_argv.short_cluster_has(argument, PUSH_SHORT_LETTERS) ||
 			FORCE_OR_DELETE_REFSPEC.test(argument),
 	)
@@ -66,7 +69,7 @@ function is_destructive_segment(segment: string): boolean {
 // quoted inside another command's argument is read as the write it is not, exactly as every other
 // trigger in this directory reads its own.
 function is_force_or_delete(command: string): boolean {
-	return shell_segments.segments_of(command).some((segment) => is_destructive_segment(segment))
+	return shell_segments.commands_of(command).some((segment) => is_destructive_segment(segment))
 }
 
 // The instruction in the shape a refusal can carry: what the command does and the one route left. The
@@ -81,12 +84,19 @@ const GIT_FORCE_REASON =
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `decide` returns true so it refuses every
 // occurrence; it declares no `keeps` — not force-pushing is the absence of a call, not a call, so the
-// row is reported unmeasured rather than scored on an act that does not exist (`filing-cap.ts`).
+// row is reported unmeasured rather than scored on an act that does not exist.
 const ROW = {
 	id: 'git-force',
 	is_trigger: bash_triggers.on_bash_command(is_force_or_delete),
 	reason: GIT_FORCE_REASON,
 	decide: (): boolean => true,
+	about: {
+		title: 'Force push / branch delete',
+		topic: '`operating-rules.md`',
+		fires:
+			'a `git push` / `git branch` read as force (`--force` / `-f` / `-uf` …) or delete (`--delete` / `-d` / `-D` / `:branch`) in any spelling. Every occurrence',
+		quiet: 'a plain `git push` / `git branch`',
+	},
 }
 
 const git_force = {

package/scripts/rules/guard-remedy.ts

@@ -28,9 +28,8 @@ const NO_RUN = "the call must not run at all, or only on a person's word — ref
 // The `Stop` rows that already run their step: each blocks only on the case the hook cannot finish.
 const STOP_NOTIFY = 'the hook sends the notify itself; it blocks only when the send fails'
 const HOLD_RELEASE = 'the hook releases the hold itself; it blocks only when that release fails'
-const ISSUE_CITATION =
-	'the hook prints the citation lines itself; it blocks only on a number it cannot cite'
 const FILING_OFFER = 'the filing needs a title and a body only the model can write'
+const CONCISE_REPLY = 'the shorter reply is prose only the model can write'
 
 function rewrite(): GuardRemedy {
 	return { remedy: 'rewrite', why: REWRITTEN }
@@ -45,26 +44,40 @@ const GUARD_REMEDIES: Readonly<Record<string, GuardRemedy>> = {
 	'piped-verification': rewrite(), // wrapped in `(set -o pipefail; …)`
 	'issue-comments': rewrite(), // the same Issue's comments read on the same line
 	'lane-background': rewrite(), // a lane child's `ship` run in the foreground (`pretool-guard.ts`)
+	'reviewer-foreground': rewrite(), // a lane child's `reviewer` given `run_in_background: false`
 	'file-body': judgment(ANOTHER_TOOL), // Edit or Write
+	'file-rewrite': judgment(ANOTHER_TOOL), // Edit
+	'sed-in-place': judgment(ANOTHER_TOOL), // Edit
 	'shell-body': judgment(
 		"which part of the body the shell was meant to expand is the author's, not the hook's",
 	),
 	'raw-field-body': judgment('the body moves to a file the call does not name'),
+	'credential-body': judgment(
+		'which text is the credential, and what replaces it, is the author’s',
+	),
 	'rule-body': judgment('a trigger-plus-pointer line is written, not derived'),
 	'direct-filing': judgment(ANOTHER_COMMAND),
+	'direct-issue-comment': judgment(ANOTHER_COMMAND),
+	'direct-issue-read': judgment(ANOTHER_COMMAND),
 	'direct-pr-create': judgment(ANOTHER_COMMAND),
+	'pr-merge': judgment(ANOTHER_COMMAND),
 	'josh-git-bare': judgment(ANOTHER_COMMAND),
 	'run-tail': judgment(ANOTHER_COMMAND),
 	'pre-gate-cut': judgment(ANOTHER_COMMAND),
 	'implementation-cut': judgment(ANOTHER_COMMAND),
+	'round-one-check-related': judgment(ANOTHER_COMMAND),
 	'early-heartbeat': judgment(ANOTHER_COMMAND),
 	'poll-loop': judgment(ANOTHER_COMMAND),
 	'lane-park': judgment(ANOTHER_COMMAND),
 	'lane-split-park': judgment(ANOTHER_COMMAND),
 	'lane-interactive-ask': judgment(ANOTHER_COMMAND),
 	'agent-model': judgment("which model fits the unit is the author's call"),
+	'investigator-foreground': judgment('which reads go beside the dispatch is the author’s call'),
 	'lane-carry-conflict': judgment(ANOTHER_COMMAND),
 	'lane-switch-main': judgment(ANOTHER_COMMAND),
+	'lane-direct-tool': rewrite(), // a one-command line behind `pnpm josh reserved-run <weight> --`
+	'lane-spilled-read': judgment(ANOTHER_COMMAND),
+	'timed-rerun': judgment(ANOTHER_COMMAND),
 	'oracle-consulted': judgment(ANOTHER_COMMAND),
 	'test-declared': judgment(ANOTHER_COMMAND),
 	batching: judgment(ANOTHER_COMMAND),
@@ -74,17 +87,17 @@ const GUARD_REMEDIES: Readonly<Record<string, GuardRemedy>> = {
 	'parent-cut': judgment(ANOTHER_COMMAND),
 	'issue-watch': judgment(ANOTHER_COMMAND),
 	'third-party-write': judgment(NO_RUN),
-	'filing-cap': judgment(NO_RUN),
 	'git-force': judgment(NO_RUN),
 	'worktree-mutation': judgment(NO_RUN),
 	'index-mutation': judgment(NO_RUN),
 	'destructive-command': judgment(NO_RUN),
+	'repo-admin': judgment(NO_RUN),
 	'protected-file': judgment(NO_RUN),
 	// The `Stop` rows: the hook judges a finished reply, so it has no call to rewrite.
 	'stop-notify': judgment(STOP_NOTIFY),
-	'issue-citation': judgment(ISSUE_CITATION),
 	'filing-offer': judgment(FILING_OFFER),
 	'hold-release': judgment(HOLD_RELEASE),
+	'concise-reply': judgment(CONCISE_REPLY),
 }
 
 // A row family shares one class: `oracle-consulted:pkg:scout` is an `oracle-consulted` row.

package/scripts/rules/implementation-cut-verdict.ts

@@ -11,7 +11,7 @@ import { z } from 'zod'
 // threshold crossing rather than once per run, that read can no longer be paid on every edit, so the
 // verdict is cached beside the instant it was read and a burst of edits shares one read.
 //
-// **An in-memory memo cannot span two edits.** `pnpm josh rule:guard` runs as a fresh process on each
+// **An in-memory memo cannot span two edits.** `pnpm josh pretool:guard` runs as a fresh process on each
 // `PreToolUse`, so the cache is a per-checkout stamp rather than a module variable — the same handoff
 // shape the refusal stamp itself uses.
 //