@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/dist/hooks/pretool-guard.js

@@ -1,35 +1,18 @@
 #!/usr/bin/env tsx
 import {
   pretool_guard
-} from "./chunk-RT27QRJW.js";
-import "./chunk-PF2NZL2A.js";
-import "./chunk-SYOTDYCI.js";
-import "./chunk-EFXE6C37.js";
-import "./chunk-M4HGZV7U.js";
-import "./chunk-WK6SMBIC.js";
-import "./chunk-GP4IEC4O.js";
-import "./chunk-CDY4NFQG.js";
-import "./chunk-A65Y4YOR.js";
-import "./chunk-7DSBJVFH.js";
-import "./chunk-PTICX4OL.js";
-import "./chunk-UPUZF3AN.js";
-import "./chunk-JP45SOCJ.js";
+} from "./chunk-CQD4LJE6.js";
 import {
   hook_decision
-} from "./chunk-6TS2JD6D.js";
-import "./chunk-TNUMY6NL.js";
-import "./chunk-LAOV7NLM.js";
-import "./chunk-APUO6U4J.js";
-import "./chunk-DGT54IH5.js";
+} from "./chunk-5PM2JRGV.js";
+import "./chunk-Z6DQJKH3.js";
+import "./chunk-3GKE653K.js";
+import "./chunk-7SIUNQXK.js";
+import "./chunk-VVNYJWEI.js";
+import "./chunk-45CJJOO7.js";
 
 // scripts/hooks/pretool-guard-cli.ts
-import { text } from "node:stream/consumers";
 import { fileURLToPath } from "node:url";
 if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  if (process.stdin.isTTY) hook_decision.report_no_payload("pretool:guard");
-  else {
-    const raw_payload = await text(process.stdin);
-    hook_decision.load_environment_file();
-    await pretool_guard.respond(raw_payload);
-  }
+  await hook_decision.respond_from_stdin("pretool:guard", pretool_guard.respond);
 }

package/dist/hooks/session-lang.js

@@ -1,43 +1,32 @@
 #!/usr/bin/env tsx
 import {
-  distributed_paths
-} from "./chunk-M4HGZV7U.js";
-import {
-  OBSERVATION_LEDGER_DIRECTORY
-} from "./chunk-4KKD2UTK.js";
-import {
+  OBSERVATION_LEDGER_DIRECTORY,
+  agent_role_profile,
   detached_launch,
-  git_common_directory,
-  issue_cite,
-  run_event_stream,
-  run_event_stream_emit,
+  distributed_paths,
+  document_section,
+  find_package_directory,
+  josh_environment_file,
   run_headless,
   session_language
-} from "./chunk-WK6SMBIC.js";
-import {
-  ancestor_directories
-} from "./chunk-GP4IEC4O.js";
-import {
-  error_text
-} from "./chunk-CDY4NFQG.js";
-import {
-  agent_role_profile
-} from "./chunk-UPUZF3AN.js";
-import {
-  josh_environment_file
-} from "./chunk-LAOV7NLM.js";
+} from "./chunk-3GKE653K.js";
 import {
   agent_session_environment,
-  file_reader,
+  durable_state,
+  issue_cite,
   json_value,
   process_identity,
-  run_carry
-} from "./chunk-APUO6U4J.js";
+  run_carry,
+  run_event_stream,
+  run_event_stream_emit
+} from "./chunk-7SIUNQXK.js";
 import {
+  error_text,
+  git_common_directory,
   stamp_file
-} from "./chunk-DGT54IH5.js";
+} from "./chunk-45CJJOO7.js";
 
-// scripts/josh/session-language-cli.ts
+// scripts/josh/session-language-main.ts
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // scripts/backlog/backlogrun-launch.ts
@@ -111,11 +100,11 @@ function check(profile, ports = default_ports) {
 var agent_diagnostics = { check };
 
 // scripts/agent/claude-agent-argv.ts
-import { existsSync as existsSync2 } from "node:fs";
-import path3 from "node:path";
+import { existsSync } from "node:fs";
+import path2 from "node:path";
 
 // scripts/agent/lane-instructions.ts
-import path2 from "node:path";
+import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 // scripts/cost-runtime/cost-tokens.ts
@@ -145,219 +134,6 @@ var cost_tokens = {
   ascii_bytes_to_tokens
 };
 
-// scripts/document/document-scan.ts
-var COMMAND_PATTERN = /`(?:pnpm )?josh ([a-z][a-z0-9:-]+)/gu;
-var LABEL_PATTERN = /(?:labels\[\]=|\/labels\/|labels -f name=)([a-z][a-z0-9:_-]*)/gu;
-var SECTION_PATTERN = /(?<![\w./:`-])(?<tick>`?)(?<file>[\w./-]+\.md)\k<tick>\s*→\s*(?:§\w+,\s*)?["「](?<heading>[^"」]+)["」]/gu;
-var ADJACENT_PATTERN = /["「](?<heading>[^"「」]+)["」]\s+(?:above|below)\b/gu;
-var BARE_ARROW_PATTERN = /→\s*(?:§\w+,\s*)?["「](?<heading>[^"「」]+)["」]/gu;
-var LINK_TARGET_PATTERN = /\]\([^)\s]*\)/gu;
-var LINK_PATTERN = /\]\(([\w./-]+\.(?:md|png|jpe?g|gif|svg|webp))(?:#[\w-]+)?\)/gu;
-var PLACEHOLDER_FILES = /* @__PURE__ */ new Set(["x.md", "foo.md", "file.md", "path.md"]);
-function matches(text, pattern) {
-  return [...text.matchAll(pattern)];
-}
-function command_references(text) {
-  return matches(text, COMMAND_PATTERN).map((match) => match[1] ?? "").filter((name) => !name.endsWith(":"));
-}
-function is_real_label(token) {
-  return token.length > 0 && !token.endsWith(":") && !token.includes("<");
-}
-function label_references(text) {
-  return matches(text, LABEL_PATTERN).map((match) => match[1] ?? "").filter((token) => is_real_label(token));
-}
-function base_name(path5) {
-  return path5.split("/").at(-1) ?? path5;
-}
-function is_placeholder_file(name) {
-  return name.includes("<") || PLACEHOLDER_FILES.has(base_name(name).toLowerCase());
-}
-function section_references(text) {
-  return matches(text.replaceAll(LINK_TARGET_PATTERN, ""), SECTION_PATTERN).map(({ groups }) => ({ file: groups?.["file"] ?? "", heading: groups?.["heading"] ?? "" })).filter((reference) => !is_placeholder_file(reference.file));
-}
-function headings_matching(text, pattern) {
-  return matches(text, pattern).map(({ groups }) => groups?.["heading"] ?? "");
-}
-function adjacent_references(text) {
-  return headings_matching(text, ADJACENT_PATTERN);
-}
-function bare_arrow_references(text) {
-  const unfiled = text.replaceAll(LINK_TARGET_PATTERN, "").replaceAll(SECTION_PATTERN, "");
-  return headings_matching(unfiled, BARE_ARROW_PATTERN);
-}
-function link_targets(text) {
-  return matches(text, LINK_PATTERN).map((match) => match[1] ?? "").filter((file) => !is_placeholder_file(file));
-}
-function normalize_reference(heading) {
-  return heading.replaceAll("`", "").split(/\s+/u).filter((word) => word !== ">").join(" ");
-}
-function reference_forms(title) {
-  const normalized = normalize_reference(title);
-  return [normalized, normalized.replace(/^\d+[a-z]?\. /u, "")];
-}
-var document_scan = {
-  adjacent_references,
-  bare_arrow_references,
-  command_references,
-  label_references,
-  link_targets,
-  normalize_reference,
-  reference_forms,
-  section_references
-};
-
-// scripts/document/document-section.ts
-var HEADING_PATTERN = /^(?<hashes>#{1,6}) (?<title>.*)$/u;
-var FENCE = "```";
-var SINGLE_MATCH = 1;
-var BOLD_LABEL_PATTERN = /\*\*([^*]+?)\*\*/gu;
-var BOLD_DELIMITER = "**";
-var CODE_SPAN_PATTERN = /``[^\n]*?``|`[^`\n]*`/gu;
-var LABEL_LEVEL = 7;
-var LIST_ITEM_PATTERN = /^(?<indent>\s*)(?:[-*]|\d+\.) /u;
-function to_heading(line, index) {
-  const groups = HEADING_PATTERN.exec(line)?.groups;
-  if (groups === void 0) return void 0;
-  const { hashes = "", title = "" } = groups;
-  return { level: hashes.length, title: title.trim(), line: index };
-}
-function push_heading(found, line, index) {
-  const heading = to_heading(line, index);
-  if (heading !== void 0) found.push(heading);
-}
-function fenced_flags(lines) {
-  let is_inside_fence = false;
-  return lines.map(function is_fenced(line) {
-    if (!line.startsWith(FENCE)) return is_inside_fence;
-    is_inside_fence = !is_inside_fence;
-    return true;
-  });
-}
-function headings(markdown) {
-  const lines = markdown.split("\n");
-  const fenced = fenced_flags(lines);
-  const found = [];
-  for (const [index, line] of lines.entries()) {
-    if (fenced[index] !== true) push_heading(found, line, index);
-  }
-  return found;
-}
-function titles(markdown) {
-  return headings(markdown).map((heading) => heading.title);
-}
-function line_starts(markdown) {
-  return [...markdown.matchAll(/\n/gu)].map((match) => match.index + SINGLE_MATCH);
-}
-function line_of(starts, offset) {
-  return starts.filter((start2) => start2 <= offset).length;
-}
-function unfenced_text(markdown) {
-  const lines = markdown.split("\n");
-  const fenced = fenced_flags(lines);
-  return lines.map((line, index) => fenced[index] === true ? "" : line).join("\n");
-}
-function code_masked(text) {
-  return text.replaceAll(CODE_SPAN_PATTERN, (span) => span.replaceAll("*", " "));
-}
-function labels(markdown) {
-  const text = unfenced_text(markdown);
-  const starts = line_starts(text);
-  return [...code_masked(text).matchAll(BOLD_LABEL_PATTERN)].map((match) => ({
-    level: LABEL_LEVEL,
-    title: text.slice(
-      match.index + BOLD_DELIMITER.length,
-      match.index + match[0].length - BOLD_DELIMITER.length
-    ),
-    line: line_of(starts, match.index)
-  }));
-}
-function is_match(heading, wanted) {
-  return document_scan.reference_forms(heading.title).some((form) => form.startsWith(wanted));
-}
-function prefixed(found, wanted) {
-  const normalized = document_scan.normalize_reference(wanted);
-  return found.filter((heading) => is_match(heading, normalized));
-}
-function is_exact(heading, wanted) {
-  return document_scan.reference_forms(heading.title).includes(wanted);
-}
-function select(found, wanted) {
-  const normalized = document_scan.normalize_reference(wanted);
-  const exact = found.find((heading) => is_exact(heading, normalized));
-  if (exact !== void 0) return exact;
-  const near = prefixed(found, wanted);
-  return near.length === SINGLE_MATCH ? near[0] : void 0;
-}
-function last_line_of(found, chosen, total_lines) {
-  const next = found.find((heading) => heading.line > chosen.line && heading.level <= chosen.level);
-  return (next === void 0 ? total_lines : next.line) - SINGLE_MATCH;
-}
-function indent_of(line) {
-  return line.length - line.trimStart().length;
-}
-function is_sibling_item(line, depth) {
-  const { indent } = LIST_ITEM_PATTERN.exec(line)?.groups ?? {};
-  return indent !== void 0 && indent.length <= depth;
-}
-function ends_block(line, depth) {
-  if (line.trim() === "" || HEADING_PATTERN.test(line)) return true;
-  return is_sibling_item(line, depth);
-}
-function label_last_line(lines, label) {
-  const depth = indent_of(lines[label.line] ?? "");
-  const end = lines.findIndex((line, index) => index > label.line && ends_block(line, depth));
-  return (end === -1 ? lines.length : end) - SINGLE_MATCH;
-}
-function choose(markdown, wanted) {
-  const found = headings(markdown);
-  if (prefixed(found, wanted).length > 0) return select(found, wanted);
-  return select(labels(markdown), wanted);
-}
-function extent_of(markdown, chosen) {
-  const lines = markdown.split("\n");
-  if (chosen.level === LABEL_LEVEL) return label_last_line(lines, chosen);
-  return last_line_of(headings(markdown), chosen, lines.length);
-}
-function section(markdown, wanted) {
-  const chosen = choose(markdown, wanted);
-  if (chosen === void 0) return void 0;
-  const last_line = extent_of(markdown, chosen);
-  const lines = markdown.split("\n").slice(chosen.line, last_line + SINGLE_MATCH);
-  return {
-    title: chosen.title,
-    level: chosen.level,
-    first_line: chosen.line,
-    last_line,
-    text: lines.join("\n")
-  };
-}
-function candidates(markdown, wanted) {
-  const near = prefixed(headings(markdown), wanted);
-  const listed = near.length > 0 ? near : prefixed(labels(markdown), wanted);
-  return listed.map((heading) => heading.title);
-}
-function read_optional(file_path) {
-  return file_reader.read_if_readable(file_path);
-}
-var document_section = {
-  candidates,
-  headings,
-  read_optional,
-  section,
-  titles
-};
-
-// scripts/josh/package-directory.ts
-import { existsSync } from "node:fs";
-import path from "node:path";
-var PACKAGE_JSON = "package.json";
-function find_package_directory(start_directory) {
-  return ancestor_directories.nearest(
-    start_directory,
-    (directory) => existsSync(path.join(directory, PACKAGE_JSON))
-  ) ?? start_directory;
-}
-
 // scripts/agent/lane-instructions.ts
 var LANE_DOCUMENT = "prompts/collaboration-workflow/lane-instructions.md";
 var RULES_FILE = "CLAUDE.md";
@@ -367,7 +143,7 @@ var PROMPT_FILE_FLAG = "--append-system-prompt-file";
 var SETTINGS_FLAG = "--settings";
 var PROMPT_FILE_PREFIX = "josh-lane-instructions-";
 var PROMPT_FILE_SUFFIX = ".md";
-var PACKAGE_DIRECTORY = find_package_directory(path2.dirname(fileURLToPath(import.meta.url)));
+var PACKAGE_DIRECTORY = find_package_directory(path.dirname(fileURLToPath(import.meta.url)));
 function expand_line(line, rules) {
   const wanted = INCLUDE_PATTERN.exec(line)?.groups?.["wanted"];
   if (wanted === void 0) return line;
@@ -380,14 +156,14 @@ function compose(lane_markdown, rules) {
 }
 function rules_sources(cwd) {
   const imported = distributed_paths.CLAUDE_MD_IMPORT_LINE.replace(/^@/u, "");
-  return [path2.join(cwd, RULES_FILE), path2.join(cwd, imported)];
+  return [path.join(cwd, RULES_FILE), path.join(cwd, imported)];
 }
 function composed_from(lane_markdown, rules_path) {
   const rules = document_section.read_optional(rules_path);
   return rules === void 0 ? void 0 : compose(lane_markdown, rules);
 }
 function composed_set(cwd, package_directory) {
-  const lane_markdown = document_section.read_optional(path2.join(package_directory, LANE_DOCUMENT));
+  const lane_markdown = document_section.read_optional(path.join(package_directory, LANE_DOCUMENT));
   if (lane_markdown === void 0) return void 0;
   for (const rules_path of rules_sources(cwd)) {
     const text = composed_from(lane_markdown, rules_path);
@@ -408,7 +184,7 @@ function written(text) {
   }
 }
 function excluded_settings(rules_path, cwd) {
-  return JSON.stringify({ claudeMdExcludes: [rules_path, path2.join(cwd, POINTER_FILE)] });
+  return JSON.stringify({ claudeMdExcludes: [rules_path, path.join(cwd, POINTER_FILE)] });
 }
 function flags(cwd = process.cwd()) {
   const set = composed_set(cwd, PACKAGE_DIRECTORY);
@@ -424,7 +200,7 @@ function rules_tokens(rules_path) {
 }
 function resident_line(cwd = process.cwd()) {
   const set = composed_set(cwd, PACKAGE_DIRECTORY);
-  const rules = rules_tokens(set?.rules_path ?? path2.join(cwd, RULES_FILE));
+  const rules = rules_tokens(set?.rules_path ?? path.join(cwd, RULES_FILE));
   const lane_tokens = set === void 0 ? "not composed" : `${tokens_of(set.text)} tok`;
   return `  resident: lane instructions ${lane_tokens} in place of ${RULES_FILE} ${rules} tok`;
 }
@@ -462,10 +238,9 @@ var LAUNCHED_TOOLS = [
   "SendMessage",
   "TaskStop",
   "Monitor",
-  "TodoWrite",
-  "WebSearch",
-  "WebFetch"
+  "TodoWrite"
 ];
+var NESTING_TOOLS = /* @__PURE__ */ new Set(["Agent", "Skill"]);
 var TOOLS_FLAG = "--tools";
 var STRICT_MCP_FLAG = "--strict-mcp-config";
 var MCP_CONFIG_FLAG = "--mcp-config";
@@ -473,10 +248,14 @@ var PROJECT_MCP_FILE = ".mcp.json";
 function session_id_flags(session_id) {
   return session_id === void 0 ? [] : [SESSION_ID_FLAG, session_id];
 }
-function tool_flags(cwd = process.cwd()) {
-  const mcp_config = path3.join(cwd, PROJECT_MCP_FILE);
-  const mcp_flags = existsSync2(mcp_config) ? [STRICT_MCP_FLAG, MCP_CONFIG_FLAG, mcp_config] : [STRICT_MCP_FLAG];
-  return [TOOLS_FLAG, LAUNCHED_TOOLS.join(","), ...mcp_flags];
+function launched_tools(role) {
+  if (role !== agent_role_profile.REVIEWER) return LAUNCHED_TOOLS;
+  return LAUNCHED_TOOLS.filter((tool) => !NESTING_TOOLS.has(tool));
+}
+function tool_flags(role, cwd = process.cwd()) {
+  const mcp_config = path2.join(cwd, PROJECT_MCP_FILE);
+  const mcp_flags = existsSync(mcp_config) ? [STRICT_MCP_FLAG, MCP_CONFIG_FLAG, mcp_config] : [STRICT_MCP_FLAG];
+  return [TOOLS_FLAG, launched_tools(role).join(","), ...mcp_flags];
 }
 function instruction_flags(profile, cwd) {
   if (profile.role === agent_role_profile.SCHEDULER) return [];
@@ -487,7 +266,7 @@ function build(invocation, profile, session_id, cwd) {
     command: AGENT_COMMAND,
     args: [
       ...AGENT_FLAGS,
-      ...tool_flags(cwd),
+      ...tool_flags(profile.role, cwd),
       ...instruction_flags(profile, cwd),
       ...session_id_flags(session_id),
       MODEL_FLAG,
@@ -504,7 +283,7 @@ function build_resume(invocation, profile, session_id, cwd) {
     command: AGENT_COMMAND,
     args: [
       ...AGENT_FLAGS,
-      ...tool_flags(cwd),
+      ...tool_flags(profile.role, cwd),
       ...instruction_flags(profile, cwd),
       RESUME_FLAG,
       session_id,
@@ -535,54 +314,107 @@ var claude_agent_argv = {
 };
 
 // scripts/agent/codex-agent-argv.ts
-import { lstatSync, mkdirSync } from "node:fs";
-import path4 from "node:path";
+import { existsSync as existsSync2, lstatSync, mkdirSync, readdirSync, realpathSync } from "node:fs";
+import path3 from "node:path";
 var AGENT_COMMAND2 = "codex";
-var AGENT_FLAGS2 = ["exec", "--sandbox", "workspace-write"];
+var AGENT_FLAGS2 = ["exec"];
 var MODEL_FLAG2 = "--model";
 var CONFIG_FLAG = "-c";
 var JSON_FLAG = "--json";
-var NETWORK_CONFIG = "sandbox_workspace_write.network_access=true";
 var SQLITE_CACHE_PATH = ["node_modules", ".cache", "josh", "openai"];
 var EPHEMERAL_FLAG = "--ephemeral";
-var ADD_DIRECTORY_FLAG = "--add-dir";
 var GIT_DIRECTORY = ".git";
-var LEDGER_DIRECTORY = path4.dirname(OBSERVATION_LEDGER_DIRECTORY);
+var LEDGER_DIRECTORY = path3.dirname(OBSERVATION_LEDGER_DIRECTORY);
+var WORKTREE_REGISTRY = "worktrees";
+var READ = "read";
+var WRITE = "write";
+var PERMISSION_PROFILE = "josh_lane";
+var PROFILE_CONFIG = `default_permissions="${PERMISSION_PROFILE}"`;
+var NETWORK_CONFIG = `permissions.${PERMISSION_PROFILE}.network.enabled=true`;
+var FILESYSTEM_KEY = `permissions.${PERMISSION_PROFILE}.filesystem`;
+var BASE_GRANTS = [
+  [":root", READ],
+  [":workspace_roots", WRITE],
+  [":slash_tmp", WRITE],
+  [":tmpdir", WRITE]
+];
+var PINNED_WORKTREE_ENTRIES = ["commondir", "config.worktree"];
+var PINNED_ENTRIES = ["hooks", "config", ...PINNED_WORKTREE_ENTRIES];
 function effort_config(profile) {
   return `model_reasoning_effort="${profile.effort}"`;
 }
 function sqlite_config(cwd) {
-  return `sqlite_home=${JSON.stringify(path4.resolve(cwd, ...SQLITE_CACHE_PATH))}`;
+  return `sqlite_home=${JSON.stringify(path3.resolve(cwd, ...SQLITE_CACHE_PATH))}`;
 }
 function persistence_arguments(profile) {
   return profile.role === agent_role_profile.WORKER ? [] : [EPHEMERAL_FLAG];
 }
-function ensure_ledger_directory(directory) {
+function ensure_writable_directory(directory, mode) {
   const current = lstatSync(directory, { throwIfNoEntry: false });
-  if (current === void 0) mkdirSync(directory, { recursive: true });
+  if (current === void 0) mkdirSync(directory, { recursive: true, mode });
   else if (!current.isDirectory() || current.isSymbolicLink()) {
-    throw new Error(`Ledger directory must be a real directory: ${directory}`);
+    throw new Error(`Writable root must be a real directory: ${directory}`);
   }
 }
-function ledger_arguments(common_directory, profile) {
-  if (common_directory === void 0 || profile.role !== agent_role_profile.WORKER || path4.basename(common_directory) !== GIT_DIRECTORY) {
+function pinned(directory, entries) {
+  return entries.map((entry) => [path3.join(directory, entry), READ]);
+}
+function registered_worktrees(common_directory) {
+  const registry = path3.join(common_directory, WORKTREE_REGISTRY);
+  if (!existsSync2(registry)) return [];
+  return readdirSync(registry, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path3.join(registry, entry.name));
+}
+function git_grants(common_directory) {
+  if (common_directory === void 0) return [];
+  const root = realpathSync(common_directory);
+  return [
+    [root, WRITE],
+    ...pinned(root, PINNED_ENTRIES),
+    ...registered_worktrees(root).flatMap((worktree) => pinned(worktree, PINNED_WORKTREE_ENTRIES))
+  ];
+}
+function ledger_grants(common_directory, profile) {
+  if (common_directory === void 0 || profile.role !== agent_role_profile.WORKER || path3.basename(common_directory) !== GIT_DIRECTORY) {
     return [];
   }
-  const directory = path4.join(path4.dirname(common_directory), LEDGER_DIRECTORY);
-  ensure_ledger_directory(directory);
-  return [ADD_DIRECTORY_FLAG, directory];
+  const ledger = path3.join(path3.dirname(common_directory), LEDGER_DIRECTORY);
+  ensure_writable_directory(ledger);
+  return [[realpathSync(ledger), WRITE]];
 }
-function lane_arguments(cwd, profile) {
+function filesystem_config(grants) {
+  const pairs = grants.map(
+    ([target, access]) => `${JSON.stringify(target)}=${JSON.stringify(access)}`
+  );
+  return `${FILESYSTEM_KEY}={${pairs.join(",")}}`;
+}
+function state_grants(cwd) {
+  const repository = git_common_directory.repository(cwd);
+  if (repository === void 0) return [];
+  const state = durable_state.root_for(repository);
+  ensure_writable_directory(state, durable_state.STATE_DIRECTORY_MODE);
+  return [[realpathSync(state), WRITE]];
+}
+function lane_grants(cwd, profile) {
+  if (cwd === void 0) return [];
   const common_directory = git_common_directory.resolve(cwd);
-  const additional_directory = common_directory === void 0 ? [] : [ADD_DIRECTORY_FLAG, common_directory];
+  if (common_directory === void 0) return state_grants(cwd);
+  return [...git_grants(common_directory), ...ledger_grants(common_directory, profile)];
+}
+function permission_arguments(cwd, profile) {
+  const grants = [...BASE_GRANTS, ...lane_grants(cwd, profile)];
   return [
     CONFIG_FLAG,
-    sqlite_config(cwd),
-    ...persistence_arguments(profile),
-    ...additional_directory,
-    ...ledger_arguments(common_directory, profile)
+    PROFILE_CONFIG,
+    CONFIG_FLAG,
+    filesystem_config(grants),
+    CONFIG_FLAG,
+    NETWORK_CONFIG
   ];
 }
+function lane_arguments(cwd, profile) {
+  if (cwd === void 0) return [];
+  return [CONFIG_FLAG, sqlite_config(cwd), ...persistence_arguments(profile)];
+}
 function build2(invocation, profile, cwd) {
   return {
     command: AGENT_COMMAND2,
@@ -592,9 +424,8 @@ function build2(invocation, profile, cwd) {
       profile.model,
       CONFIG_FLAG,
       effort_config(profile),
-      CONFIG_FLAG,
-      NETWORK_CONFIG,
-      ...cwd === void 0 ? [] : lane_arguments(cwd, profile),
+      ...permission_arguments(cwd, profile),
+      ...lane_arguments(cwd, profile),
       JSON_FLAG,
       invocation
     ],
@@ -629,16 +460,13 @@ function resolve2(invocation, role, environment = process.env) {
   const resolved = agent_role_profile.resolve(role, environment);
   return resolved.kind === "rejected" ? resolved : with_profile2(invocation, resolved.profile);
 }
-function resume_argv(invocation, profile, phase, cwd) {
-  if (profile !== void 0) {
-    return with_profile_in(invocation, agent_role_profile.with_phase_effort(profile, phase), cwd);
-  }
-  const resolved = agent_role_profile.resolve(agent_role_profile.WORKER, process.env, phase);
-  return resolved.kind === "rejected" ? resolved : with_profile_in(invocation, resolved.profile, cwd);
-}
 function profiled_in(invocation, resolved, cwd) {
   return resolved.kind === "rejected" ? resolved : with_profile_in(invocation, resolved.profile, cwd);
 }
+function resume_argv(invocation, profile, phase, cwd) {
+  const resolved = profile === void 0 ? agent_role_profile.resolve(agent_role_profile.WORKER, process.env, phase) : agent_role_profile.with_phase(profile, phase);
+  return profiled_in(invocation, resolved, cwd);
+}
 function resolve_in(invocation, role, cwd, environment = process.env) {
   return profiled_in(invocation, agent_role_profile.resolve(role, environment), cwd);
 }
@@ -716,8 +544,8 @@ var run_event_setup = {
 
 // scripts/backlog/backlogrun-launch.ts
 import { z } from "zod";
-var LAUNCH_PREFIX = "josh-backlogrun-launch-";
-var LOG_PREFIX = "josh-backlogrun-log-";
+var LAUNCH_PREFIX = durable_state.PREFIX.BACKLOGRUN_LAUNCH;
+var LOG_PREFIX = durable_state.PREFIX.BACKLOGRUN_LOG;
 var LOG_SUFFIX = ".log";
 var launch_schema = z.object({
   pid: z.number(),
@@ -729,10 +557,10 @@ var launch_schema = z.object({
   started_at: z.string().optional()
 });
 function launch_path(git_directory) {
-  return stamp_file.stamp_path(LAUNCH_PREFIX, git_directory);
+  return durable_state.path(LAUNCH_PREFIX, git_directory);
 }
 function log_path(git_directory) {
-  return stamp_file.stamp_path(LOG_PREFIX, git_directory, LOG_SUFFIX);
+  return durable_state.path(LOG_PREFIX, git_directory, LOG_SUFFIX);
 }
 function read_launch(target) {
   return json_value.parse_with(stamp_file.read_stamp_text(target) ?? "", launch_schema);
@@ -797,6 +625,9 @@ function signal_parent(pid) {
     note_to_stderr(`process ${String(pid)} could not be signalled; its launch record is removed.`);
   }
 }
+function running_parent(git_directory) {
+  return live_launch(git_directory)?.pid;
+}
 function stop_parent(git_directory) {
   const record = live_launch(git_directory);
   stamp_file.remove_stamp(launch_path(git_directory));
@@ -836,7 +667,10 @@ var backlogrun_launch = {
   argv_of,
   chosen_environment,
   is_running,
+  launch_path,
+  log_path,
   pending_launch,
+  running_parent,
   start,
   started_for,
   stop_parent
@@ -864,8 +698,7 @@ async function is_run_live(ports = LIVE_PORTS) {
 function prompt_lines(resolution, is_live) {
   return [format_line(resolution), is_live ? BOARD_LINE : ""].filter((line) => line !== "");
 }
-async function main() {
-  josh_environment_file.load_environment_file();
+async function print_prompt_lines() {
   const lines = prompt_lines(resolve_session_lang(), await is_run_live());
   for (const line of lines) console.info(line);
 }
@@ -875,10 +708,13 @@ var session_language_cli = {
   ENV_KEY,
   format_line,
   is_run_live,
+  print_prompt_lines,
   prompt_lines,
   resolve_session_lang
 };
-if (process.argv[1] === fileURLToPath2(import.meta.url)) await main();
-export {
-  session_language_cli
-};
+
+// scripts/josh/session-language-main.ts
+if (process.argv[1] === fileURLToPath2(import.meta.url)) {
+  josh_environment_file.load_environment_file();
+  await session_language_cli.print_prompt_lines();
+}