@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/scripts/review/review-round2-skip-comment.ts

@@ -0,0 +1,55 @@
+import { git_gh_issue_read } from '#scripts/gh/git-gh-issue-read'
+import { git_gh_issue_write } from '#scripts/gh/git-gh-issue-write'
+import { issue_read, type IssueComment } from '#scripts/issue/issue-read'
+import { review_round2, type RoundTwoAnswer } from './review-round2'
+
+// `josh review:round2 --record <N>` — the `## Round 2 skipped` comment `prompts/review.md` asks for,
+// written by the command rather than assembled by the run (joshuafolkken/kit#5286). It names the arm
+// that fired and quotes the reason line verbatim, so a defect found later can be traced to the delta
+// that went unreviewed. **A re-run writes nothing twice**: a trusted comment already carrying the same
+// heading and reason line is the record.
+
+const HEADING = '## Round 2 skipped'
+const ARMS: Readonly<Record<string, string>> = {
+	[review_round2.CODE.EMPTY]: 'A — the fix delta is empty',
+	[review_round2.CODE.INERT]: 'B — every fixed path leaves what executes unchanged',
+}
+
+type SkipRecord = 'posted' | 'present' | 'unreadable' | 'failed' | 'not-skipped'
+
+function body_of(answer: RoundTwoAnswer): string {
+	return [
+		HEADING,
+		'',
+		`- arm: ${ARMS[answer.code] ?? answer.code}`,
+		`- reason: ${answer.reason}`,
+	].join('\n')
+}
+
+function is_recorded(comment: IssueComment, body: string): boolean {
+	return comment.is_trusted === true && comment.body.trimStart().startsWith(body)
+}
+
+async function read_comments(issue: number): Promise<ReadonlyArray<IssueComment> | undefined> {
+	return await issue_read.parse_comments(await git_gh_issue_read.issue_list_comments(String(issue)))
+}
+
+// `not-skipped` for a `required` answer: only a skip is recorded. An unreadable listing posts nothing
+// rather than risk the duplicate the record exists to avoid.
+async function record(issue: number, answer: RoundTwoAnswer): Promise<SkipRecord> {
+	if (answer.verdict !== review_round2.SKIPPED_VERDICT) return 'not-skipped'
+
+	const body = body_of(answer)
+	const comments = await read_comments(issue)
+
+	if (comments === undefined) return 'unreadable'
+
+	if (comments.some((comment) => is_recorded(comment, body))) return 'present'
+
+	return (await git_gh_issue_write.issue_try_comment(String(issue), body)) ? 'posted' : 'failed'
+}
+
+const review_round2_skip_comment = { body_of, HEADING, record }
+
+export type { SkipRecord }
+export { review_round2_skip_comment }

package/scripts/review/review-round2.ts

@@ -1,6 +1,7 @@
 import { file_map_stamp, type FileMapStamp } from '#scripts/josh/file-map-stamp'
 import { path_decision } from '#scripts/josh/path-decision'
 import { json_value } from '#scripts/lib/json-value'
+import { release_approval_prune } from '#scripts/release/release-approval-prune'
 import { z } from 'zod'
 import { review_level } from './review-level'
 
@@ -13,7 +14,8 @@ import { review_level } from './review-level'
 // because round 1's *fix code* is unreviewed, and that is structural. Arm A applies where there is no fix code — the findings closed without an edit — so
 // the premise is absent rather than overridden. Arm B applies where the fix leaves what executes
 // unchanged: `review-level.ts`'s inert set, documentation under `docs/` and the root `README.md`,
-// `prompts/`, and source files whose only change is in comments (`review-code-tree.ts`).
+// `prompts/`, `josh metrics` approvals, and source files whose only change is in comments
+// (`review-code-tree.ts`).
 //
 // **Arm B is wider than the review level's inert set, on purpose** (joshuafolkken/kit#3787). Round 1
 // still reviews a documentation or prompt change in full, and the fix to its findings is still made;
@@ -51,13 +53,13 @@ const json_schema = z.object({
 // on a missing record would be the cheapest possible run and the most dangerous — the direction
 // `review-brief.ts` already takes when it widens a round-2 target it cannot name.
 const OPEN_FINDING_REASON =
-	'the caller did not assert that every round-1 High/Medium finding closed, so the pass that verifies them is due'
+	'the ledger does not show every round-1 High/Medium finding closed, so the pass that verifies them is due'
 const NO_SNAPSHOT_REASON =
 	'no round-1 snapshot was recorded, so the fix delta cannot be named — the round runs rather than assuming it is empty'
 const EMPTY_DELTA_REASON_PREFIX =
 	'the fix delta is empty: round 1 wrote no fix code, so there is no unreviewed fix for a verification pass to read'
 const INERT_DELTA_REASON_PREFIX =
-	'every path round 1 fixed leaves what executes unchanged — inert, documentation, a prompt, or a comment-only edit'
+	'every path round 1 fixed leaves what executes unchanged — inert, documentation, a prompt, a metrics approval, or a comment-only edit'
 const README_PATH = 'README.md'
 const DOCUMENTATION_PREFIX = 'docs/'
 const MARKDOWN_EXTENSION = '.md'
@@ -73,10 +75,11 @@ interface RoundTwoInput {
 	// a `skip`, which is worse than a mistargeted read — nothing gets read at all.
 	// `undefined` where it could not be resolved to a commit, which is refused exactly like a mismatch.
 	base: string | undefined
-	// Asserted by the caller from round 1's own output, because no command can read a review's
-	// findings. It is a report of a fact already written down, not a judgement made under cost
-	// pressure — and its absence is the safe answer, so a caller that forgets it pays a round.
+	// Read from the issue's ledger, where `review:record` keeps each finding's disposition
+	// (`review-round-one-closure.ts`), not asserted by the caller (joshuafolkken/kit#5286).
 	is_round_one_closed: boolean
+	// Why round 1 is open, quoted into the `required` answer. Absent falls back to the generic reason.
+	open_reason?: string
 	snapshot: FileMapStamp | undefined
 	tree: Record<string, string>
 	// The paths whose code round 1's fixes left as it was (`review_code_tree.comment_only`). Absent is
@@ -130,8 +133,17 @@ function is_documentation(relative: string): boolean {
 	return relative.startsWith(DOCUMENTATION_PREFIX) && relative.endsWith(MARKDOWN_EXTENSION)
 }
 
+// **A `josh metrics` approval is data, not code** (joshuafolkken/kit#4842): the ship's pre-detach
+// re-record rewrites it after round 1, and the gate's own metrics step checks it — the same reason
+// `review-reviewed-tree.ts` reads it as no move.
 function is_unexecuted(relative: string, comment_only: ReadonlyArray<string>): boolean {
-	if (review_level.is_inert(relative) || is_documentation(relative)) return true
+	if (
+		review_level.is_inert(relative) ||
+		is_documentation(relative) ||
+		release_approval_prune.is_approval(relative)
+	) {
+		return true
+	}
 
 	return comment_only.includes(relative)
 }
@@ -172,7 +184,10 @@ function fix_delta(
 }
 
 function decide(input: RoundTwoInput): RoundTwoDecision {
-	if (!input.is_round_one_closed) return required(CODE.OPEN_FINDING, OPEN_FINDING_REASON)
+	if (!input.is_round_one_closed) {
+		return required(CODE.OPEN_FINDING, input.open_reason ?? OPEN_FINDING_REASON)
+	}
+
 	if (input.snapshot === undefined) return required(CODE.NO_SNAPSHOT, NO_SNAPSHOT_REASON)
 
 	const delta = fix_delta(input, input.snapshot)
@@ -204,6 +219,7 @@ const review_round2 = {
 	empty_reason,
 	INERT_DELTA_REASON_PREFIX,
 	inert_reason,
+	is_unexecuted,
 	JSON_KEY,
 	live_reason,
 	NO_SNAPSHOT_REASON,

package/scripts/review/review-stamps.ts

@@ -1,4 +1,4 @@
-import { gate_plan } from '#scripts/gate/gate-plan'
+import { gate_labels } from '#scripts/gate/gate-labels'
 import { verification_inputs } from '#scripts/gate/verification-inputs'
 import { PROJECT_ROOT } from '#scripts/init/init-paths'
 import { file_map_stamp, type FileMapStampAccess } from '#scripts/josh/file-map-stamp'
@@ -19,6 +19,7 @@ const IN_FLIGHT_PREFIX = 'josh-gate-running-'
 const ROUND_ONE_PREFIX = 'josh-review-round1-'
 const ROUND_ONE_CODE_PREFIX = 'josh-review-round1-code-'
 const BRIEFED_PREFIX = 'josh-review-briefed-'
+const REVIEWED_PREFIX = 'josh-review-recorded-'
 
 // The records that vouch for a check carry the fingerprint of its declared inputs
 // (`verification-inputs.ts`): the gate's every declared check, a scoped record its own.
@@ -40,15 +41,17 @@ const round_one_code_stamp: FileMapStampAccess = file_map_stamp.create(
 )
 // Retaken on every brief: the round-1 snapshot is not the tree a later review read.
 const briefed_stamp: FileMapStampAccess = file_map_stamp.create(BRIEFED_PREFIX, PROJECT_ROOT)
+// Retaken on every recorded round: the tree that round's verdict stands for, its fixes included.
+const reviewed_stamp: FileMapStampAccess = file_map_stamp.create(REVIEWED_PREFIX, PROJECT_ROOT)
 const lint_related_stamp: FileMapStampAccess = file_map_stamp.create(
 	LINT_RELATED_PREFIX,
 	PROJECT_ROOT,
-	inputs_of([gate_plan.LINT_LABEL]),
+	inputs_of([gate_labels.LINT_LABEL]),
 )
 const test_related_stamp: FileMapStampAccess = file_map_stamp.create(
 	TEST_RELATED_PREFIX,
 	PROJECT_ROOT,
-	inputs_of([gate_plan.UNIT_LABEL]),
+	inputs_of([gate_labels.UNIT_LABEL]),
 )
 const e2e_stamp: FileMapStampAccess = file_map_stamp.create(E2E_PREFIX, PROJECT_ROOT)
 
@@ -88,6 +91,7 @@ const review_stamps = {
 	round_one_code_stamp,
 	ROUND_ONE_PREFIX,
 	round_one_stamp,
+	reviewed_stamp,
 	test_related_stamp,
 }
 

package/scripts/review/review-stop-log.ts

@@ -2,14 +2,16 @@ import { mkdirSync } from 'node:fs'
 import path from 'node:path'
 import { git_common_directory } from '#scripts/git/git-common-directory'
 import { stamp_file } from '#scripts/josh/stamp-file'
-import { lane_ledger } from '#scripts/lane/lane-ledger'
+import { lane_ledger_write } from '#scripts/lane/lane-ledger-write'
 import { json_value } from '#scripts/lib/json-value'
 import type { StopFinding } from '#scripts/run/ship/run-ship-review'
 import { z } from 'zod'
 
 // The durable record of every review finding that stopped a `josh ship` — one JSON line per finding,
 // with its kind, the `<file>[:<line>]` it cites and its first sentence, read back by
-// `josh review:stops` (joshuafolkken/kit#4519). The lane ledger's stop line keeps only the kinds, and
+// `josh review:stops` (joshuafolkken/kit#4519). The findings a round did not stop on — a ship round's
+// fixes made in place, and a `review:record` round's findings written with a reason
+// (joshuafolkken/kit#4817) — are in it too, marked fixed, which `review:stops` leaves out. The lane ledger's stop line keeps only the kinds, and
 // the finding's text was only in the ship log in the temp root, which a reboot clears.
 //
 // **It lives in the git common directory**, beside the test-read map: every lane worktree of one clone
@@ -19,7 +21,6 @@ import { z } from 'zod'
 // **A test run writes nothing** unless it passes its own path, the lane ledger's rule: the writer sits on
 // the ship's stop path, which many suites exercise.
 
-const LOG_DIRECTORY = 'josh'
 const LOG_FILE = 'review-stops.jsonl'
 const LINE_SEPARATOR = '\n'
 
@@ -30,15 +31,19 @@ const stop_line_schema = z.object({
 	kind: z.string(),
 	location: z.string(),
 	sentence: z.string(),
+	fixed: z.boolean().optional(),
 })
 
 type StopLine = z.infer<typeof stop_line_schema>
 
-// One stopped review: the issue, the stage that stopped and the findings that decided it.
+// One stopped review: the issue, the stage that stopped and the findings that decided it. A round that
+// passed on fixes made in place is recorded too, marked `is_fixed`, so the lane's next review still sees
+// the constraint each fix met (joshuafolkken/kit#4780); `review:stops` leaves those lines out.
 interface ReviewStop {
 	issue: number
 	stage: string
 	findings: ReadonlyArray<StopFinding>
+	is_fixed?: boolean
 }
 
 function target(): string | undefined {
@@ -46,16 +51,25 @@ function target(): string | undefined {
 
 	const common = git_common_directory.repository()
 
-	return common === undefined ? undefined : path.join(common, LOG_DIRECTORY, LOG_FILE)
+	return common === undefined
+		? undefined
+		: path.join(common, git_common_directory.STATE_DIRECTORY, LOG_FILE)
 }
 
 function write(destination: string, stop: ReviewStop): void {
 	const at = new Date().toISOString()
+	const mark = stop.is_fixed === true ? { fixed: true } : {}
 
 	mkdirSync(path.dirname(destination), { recursive: true })
 
 	for (const finding of stop.findings) {
-		lane_ledger.append(destination, { at, issue: stop.issue, stage: stop.stage, ...finding })
+		lane_ledger_write.append(destination, {
+			at,
+			issue: stop.issue,
+			stage: stop.stage,
+			...finding,
+			...mark,
+		})
 	}
 }
 

package/scripts/review/review-stops-cli.ts

@@ -67,7 +67,8 @@ function run(argv: ReadonlyArray<string>, context: StopsContext = {}): number {
 	}
 
 	const window = lane_stats.window_of(period_days, context.now_ms ?? Date.now())
-	const stops = lane_stats.in_window(review_stop_log.read(context.log_path), window)
+	const stopped = review_stop_log.read(context.log_path).filter((line) => line.fixed !== true)
+	const stops = lane_stats.in_window(stopped, window)
 
 	console.info(format_report(stops, period_days))
 

package/scripts/review/review-submit-cli.ts

@@ -0,0 +1,101 @@
+#!/usr/bin/env tsx
+import { text } from 'node:stream/consumers'
+import { fileURLToPath } from 'node:url'
+import { PROJECT_ROOT } from '#scripts/init/init-paths'
+import { stamp_file } from '#scripts/josh/stamp-file'
+import { lane_session_broker } from '#scripts/lane/lane-session-broker'
+import { run_ship_review } from '#scripts/run/ship/run-ship-review'
+import { review_attest, type ReviewSlot } from './review-attest'
+
+// `josh review:submit` — the one write path for a ship reviewer's findings (joshuafolkken/kit#4799).
+// The reviewer pipes its findings here on stdin, and this command writes them to the slot's findings
+// file under the same key the supervisor reads it by (`run-ship-reviewer.ts`), so no path is ever
+// copied out of a prompt. A line outside the `review:record` grammar is refused before anything is
+// written, while the reviewer can still fix it.
+//
+// **A clean review is said with `--none`, never with empty stdin**: a reviewer that forgot the pipe,
+// or ran on a terminal, sends nothing, and reading that as clean would lose every finding it had.
+
+const ARGV_OFFSET = 2
+const INTERACTION_FLAG = '--interaction'
+const NONE_FLAG = '--none'
+const FLAGS: ReadonlySet<string> = new Set([INTERACTION_FLAG, NONE_FLAG])
+const USAGE =
+	'Usage: josh review:submit [--interaction] < findings | josh review:submit [--interaction] --none'
+const EMPTY_NOTE = `nothing written — no findings on stdin; a review with none passes ${NONE_FLAG}`
+const NONE_WITH_FINDINGS_NOTE = `nothing written — ${NONE_FLAG} was passed with findings on stdin`
+const SUCCESS_EXIT_CODE = 0
+const FAILURE_EXIT_CODE = 1
+
+interface Submission {
+	slot: ReviewSlot
+	is_none: boolean
+}
+
+function submission_of(argv: ReadonlyArray<string>): Submission | undefined {
+	const is_valid = argv.every((flag) => FLAGS.has(flag)) && new Set(argv).size === argv.length
+
+	if (!is_valid) return undefined
+
+	const { CODE, INTERACTION } = review_attest.REVIEW_SLOT
+
+	return {
+		slot: argv.includes(INTERACTION_FLAG) ? INTERACTION : CODE,
+		is_none: argv.includes(NONE_FLAG),
+	}
+}
+
+function grammar_refusal(findings: string): string | undefined {
+	const verdict = run_ship_review.read_verdict(findings)
+
+	return verdict.kind === run_ship_review.VERDICT.INVALID
+		? `nothing written — ${verdict.note}`
+		: undefined
+}
+
+// The refusal for stdin that does not match the flags, or for a line outside the grammar.
+function refusal_of(submission: Submission, findings: string): string | undefined {
+	const is_empty = findings.trim() === ''
+
+	if (submission.is_none) return is_empty ? undefined : NONE_WITH_FINDINGS_NOTE
+
+	return is_empty ? EMPTY_NOTE : grammar_refusal(findings)
+}
+
+function write(submission: Submission, findings: string): string {
+	const { slot, is_none } = submission
+	const target = lane_session_broker.review_paths(PROJECT_ROOT, slot).findings
+
+	stamp_file.write_text_stamp(target, is_none ? '' : findings)
+
+	return is_none
+		? `the ${slot} review is submitted with no findings.`
+		: `the ${slot} review's findings are submitted.`
+}
+
+function run(argv: ReadonlyArray<string>, findings: string): number {
+	const submission = submission_of(argv)
+	const refusal = submission === undefined ? USAGE : refusal_of(submission, findings)
+
+	if (submission === undefined || refusal !== undefined) {
+		console.error(refusal)
+
+		return FAILURE_EXIT_CODE
+	}
+
+	console.info(write(submission, findings))
+
+	return SUCCESS_EXIT_CODE
+}
+
+async function main(): Promise<void> {
+	const findings = process.stdin.isTTY ? '' : await text(process.stdin)
+
+	process.exitCode = run(process.argv.slice(ARGV_OFFSET), findings)
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main()
+
+const review_submit_cli = { EMPTY_NOTE, USAGE, run }
+
+export { review_submit_cli }

package/scripts/rules/agent-model.ts

@@ -62,6 +62,6 @@ const ROW = {
 	},
 }
 
-const agent_model = { AGENT_MODEL_REASON, ROW, is_unnamed_model }
+const agent_model = { AGENT_MODEL_REASON, ROW, SUBAGENT_TOOLS, is_unnamed_model }
 
 export { agent_model }

package/scripts/rules/bash-triggers.ts

@@ -6,8 +6,8 @@ import { shell_segments } from './shell-segments'
 
 // The trigger helpers the enumeration in `delivered-rules.ts` is built from, held here so a rule
 // that lives in its own module can build its own row without importing the enumeration back.
-// `is_issue_filing` is the one three rows share — the WIP cap, the per-run
-// filing cap and the fold — so it could not stay a private function of the file that spreads their rows.
+// `is_issue_filing` is shared by the readers of a run's filings off the transcript (`turn-filings.ts`,
+// `stop-guard.ts`), so it could not stay a private function of one of them.
 
 // **Only `Bash`, and the omission is deliberate**: Claude Code denies one
 // call of a turn and runs the rest, so a refused `Edit` would leave its siblings applied and itself
@@ -85,7 +85,7 @@ function is_direct_filing(command: string): boolean {
 }
 
 // `pnpm josh issue:file`, in either spelling — **the** filing act once a direct one is refused, so the
-// run-level filing rows (the WIP cap, the per-run cap, the fold) trigger on it. Segment-wise, so a
+// turn's filing count reads it. Segment-wise, so a
 // spelling quoted inside another command's body is not read as a filing.
 const FILING_NAMES: ReadonlySet<string> = new Set(['issue:file'])
 

package/scripts/rules/concise-reply.ts

@@ -0,0 +1,88 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { document_section } from '#scripts/document/document-section'
+import { find_package_directory } from '#scripts/josh/package-directory'
+import type { MeasuredRule } from './delivered-rules'
+import { reply_prose } from './reply-prose'
+import { stop_decision } from './stop-decision'
+
+// A chat reply leads with its conclusion and keeps its narrative short: the procedure is
+// `prompts/collaboration-workflow/principles.md` → "concise-reply"; the limit is this file's.
+
+// Letters and digits of narrative — prose outside code, tables and lists. Counted, not characters, so
+// markdown markers and punctuation weigh nothing in any language.
+const PROSE_LIMIT = 400
+// A person who asked for the detail is answered with it.
+const EXEMPT_WORDS: ReadonlyArray<string> = ['詳しく', '具体的に', '詳細']
+const COUNTED_PATTERN = /[\p{L}\p{N}]/gu
+
+const PRINCIPLES_FILE = 'prompts/collaboration-workflow/principles.md'
+const SECTION = 'concise-reply'
+const PACKAGE_DIRECTORY = find_package_directory(path.dirname(fileURLToPath(import.meta.url)))
+
+// The constant opening `rule-value.ts` credits a Stop refusal to this row by.
+const REASON_OPENING = `⛔ concise reply: your reply's prose outside code, tables and lists is over the limit of \`${PRINCIPLES_FILE}\` → "${SECTION}"`
+
+const KEEP_DECISION = ' Keep its `Recommended:` / `Alternative:` lines as they are.'
+
+function prose_length(message: string): number {
+	return reply_prose.narrative_of(message).match(COUNTED_PATTERN)?.length ?? 0
+}
+
+function is_exempt(prompt: string): boolean {
+	return EXEMPT_WORDS.some((word) => prompt.includes(word))
+}
+
+// `prompt` is the person's last prompt — `undefined` when it could not be read, and then whether they
+// asked for the detail is unknown, so nothing is refused.
+function is_over(message: string, prompt: string | undefined): boolean {
+	if (prompt === undefined || is_exempt(prompt)) return false
+
+	return prose_length(message) > PROSE_LIMIT
+}
+
+function section_text(root: string): string | undefined {
+	const markdown = document_section.read_optional(path.join(root, PRINCIPLES_FILE))
+
+	return markdown === undefined ? undefined : document_section.section(markdown, SECTION)?.text
+}
+
+// A held run's notify reads the decision off the rewrite, which the loop-breaker lets stop unchecked.
+function decision_note(message: string): string {
+	return stop_decision.decision_of(message) === undefined ? '' : KEEP_DECISION
+}
+
+// The refusal carries the section itself, so the rewrite needs no read.
+function build_reason(message: string, root: string = PACKAGE_DIRECTORY): string {
+	const head =
+		`${REASON_OPENING} (${String(prose_length(message))} of ${String(PROSE_LIMIT)}). Rewrite it ` +
+		`shorter as that section says — do not repeat your previous reply.${decision_note(message)}`
+	const body = section_text(root)
+
+	return body === undefined ? head : `${head}\n\n${body}`
+}
+
+const ROW: MeasuredRule = {
+	id: SECTION,
+	reason: REASON_OPENING,
+	about: {
+		title: 'Concise reply',
+		topic: `\`principles.md\` → "${SECTION}"`,
+		entry: 'pnpm josh stop:guard',
+		fires: `a reply whose narrative outside code, tables and lists is over ${String(PROSE_LIMIT)} letters. Blocks the stop`,
+		quiet:
+			'a reply under the limit, a prompt asking for the detail (`詳しく` / `具体的に` / `詳細`), a fixed output in a code block, no prompt of the person’s on the transcript tail, or a headless session',
+	},
+}
+
+const concise_reply = {
+	EXEMPT_WORDS,
+	PROSE_LIMIT,
+	REASON_OPENING,
+	ROW,
+	build_reason,
+	is_over,
+	prose_length,
+}
+
+export { concise_reply }

package/scripts/rules/credential-body.ts

@@ -0,0 +1,77 @@
+import { file_reader } from '#scripts/lib/read-file'
+import { token_shape } from '#scripts/lib/token-shape'
+import { bash_triggers } from './bash-triggers'
+import { direct_pr_create } from './direct-pr-create'
+import { gh_api, type FieldSource } from './gh-api'
+import { git_argv } from './git-argv'
+
+// The `credential-body` row of `delivered-rules.ts`. A body kit sends is refused when it holds a
+// token-shaped string (`git-gh-exec.ts`, joshuafolkken/kit#4658), but a `gh api` call a run types on
+// the shell never passes through kit's code, so the same scan runs here before the call does
+// (joshuafolkken/kit#4682). The shapes are `token-shape.ts`'s, read by `token_shape.holds` — the test
+// `token_shape.refuse` throws on — so no second copy of a pattern exists.
+//
+// **The text `gh` would send, not the command line alone**: each field value, and the file a
+// `-F key=@<path>` or `--input <path>` names, read as the hook sees it — a path relative to a
+// directory a `cd` earlier on the line moved to is not found and reads as empty. A JSON body is scanned
+// decoded, as the in-process send does.
+//
+// **It fires on every occurrence**, for the reason `git-force.ts` does.
+
+// `gh` sends a typed `\n` as the two characters, so a token after it follows the letter `n` and the
+// shapes' "no letter before it" guard would pass it. So the text is scanned twice — as sent, and with
+// each escape read as a space — since a backslash may also sit right before the token (`\ghp_…`),
+// where the second reading loses its first letter. A non-JSON file is read the same way.
+const TYPED_ESCAPE = /\\./gu
+
+function sent_text(source: FieldSource): string {
+	if (source.kind === 'text') return source.value
+
+	return token_shape.decoded(file_reader.read_if_readable(source.value) ?? '')
+}
+
+function holds_token(text: string): boolean {
+	return [text, text.replaceAll(TYPED_ESCAPE, () => ' ')].some((reading) =>
+		token_shape.holds(reading),
+	)
+}
+
+function is_credential_segment(segment: string): boolean {
+	const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND)
+
+	if (args === undefined) return false
+
+	const call = [direct_pr_create.GH_COMMAND, ...args].join(' ')
+
+	if (!gh_api.is_gh_api(call)) return false
+
+	return gh_api.field_sources(call).some((source) => holds_token(sent_text(source)))
+}
+
+function sends_credential(command: string): boolean {
+	return direct_pr_create.has_run_segment(command, is_credential_segment)
+}
+
+const CREDENTIAL_BODY_REASON =
+	'⛔ credential in a gh api body: a field value, or the file `-F key=@<path>` / `--input <path>` ' +
+	'names, holds a token-shaped string (`scripts/lib/token-shape.ts`), and the call would publish it. ' +
+	'Remove the credential from the body and send it again. ' +
+	'**This rule fires on every occurrence, not once per run.**'
+
+const ROW = {
+	id: 'credential-body',
+	is_trigger: bash_triggers.on_bash_command(sends_credential),
+	reason: CREDENTIAL_BODY_REASON,
+	decide: (): boolean => true,
+	about: {
+		title: 'Credential in a body',
+		topic: '`shell-body.md`',
+		fires:
+			'a `gh api` call whose field value, or the file `-F key=@<path>` / `--input <path>` names, holds a token-shaped string (`token-shape.ts`). Every occurrence',
+		quiet: 'a body with no credential, or a body sent through kit, which runs the same scan',
+	},
+}
+
+const credential_body = { CREDENTIAL_BODY_REASON, ROW, sends_credential }
+
+export { credential_body }

package/scripts/rules/decision-oracle.ts

@@ -66,7 +66,7 @@ const DECISION_ORACLES: ReadonlyArray<DecisionOracle> = [
 	{
 		name: 'review:round2',
 		decision: 'Whether the second /code-review round is due',
-		args: '[--round-1-closed]',
+		args: '[--record <N>]',
 		vocabulary: [REQUIRED, SKIP],
 		single_source: CHAIN_RULE_MD,
 	},