@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/scripts/rules/delivered-rules.ts

@@ -1,16 +1,19 @@
 import { investigation_reads } from '#scripts/delegation/investigation-reads'
+import { will_refuse as will_batch_refuse } from '#scripts/hooks/batch-guard'
 import { hook_decision, type GuardRun, type TranscriptGuardSpec } from '#scripts/josh/hook-decision'
-import { lane_guard_policy } from '#scripts/lane/lane-guard-policy'
 import { time_batch_guard, type GuardedCall } from '#scripts/time-runtime/time-batch-guard'
 import { agent_model } from './agent-model'
 import { bash_triggers } from './bash-triggers'
+import { concise_reply } from './concise-reply'
+import { credential_body } from './credential-body'
 import { direct_filing } from './direct-filing'
 import { direct_issue_comment } from './direct-issue-comment'
+import { direct_issue_read } from './direct-issue-read'
 import { early_heartbeat } from './early-heartbeat'
-import { file_body } from './file-body'
-import { filing_cap } from './filing-cap'
+import { file_edit_rows } from './file-edit-rows'
 import { git_force } from './git-force'
 import { implementation_cut } from './implementation-cut'
+import { investigator_foreground } from './investigator-foreground'
 import { issue_comments } from './issue-comments'
 import { josh_git_bare } from './josh-git-bare'
 import { lane_background } from './lane-background'
@@ -18,6 +21,7 @@ import { lane_carry_conflict } from './lane-carry-conflict'
 import { lane_direct_tool } from './lane-direct-tool'
 import { lane_interactive_ask } from './lane-interactive-ask'
 import { lane_park } from './lane-park'
+import { lane_spilled_read } from './lane-spilled-read'
 import { lane_split_park } from './lane-split-park'
 import { lane_switch_main } from './lane-switch-main'
 import { oracle_consulted } from './oracle-consulted'
@@ -26,6 +30,8 @@ import { piped_verification } from './piped-verification'
 import { poll_loop } from './poll-loop'
 import { pre_gate_cut } from './pre-gate-cut'
 import { raw_field_body } from './raw-field-body'
+import { reviewer_foreground } from './reviewer-foreground'
+import { round_one_check_related } from './round-one-check-related'
 import { rule_body_guard } from './rule-body-guard'
 import { run_tail_rule } from './run-tail-rule'
 import { shell_body_trigger } from './shell-body-trigger'
@@ -77,8 +83,8 @@ interface DeliveredRule {
 	reason: string
 	about: RuleAbout
 	// A stand-down when an earlier act on the tail already satisfied the rule; checked first, so a
-	// satisfied call spends no record.
-	already_satisfied?: (tail: string, call: GuardedCall) => boolean
+	// satisfied call spends no record. `run` names the session, for a stand-down that outlives the tail.
+	already_satisfied?: (tail: string, call: GuardedCall, run: GuardRun) => boolean
 	// For a rule that binds on every occurrence instead of once per run. `at_ms` is this row's own last
 	// refusal, so an immediate reissue can be let through.
 	decide?: (call: GuardedCall, run: GuardRun, can_record: boolean, at_ms: number) => boolean
@@ -96,6 +102,9 @@ interface DeliveredRule {
 	// Openings the reason had before it was reworded, so `rule-value.ts` still credits a refusal
 	// delivered with the old text while those transcripts remain in its window.
 	former_reasons?: ReadonlyArray<string>
+	// The reasons a Stop hook sends a turn back with on this row's behalf, so `rule-value.ts` counts
+	// that block as this row's refusal.
+	stop_reasons?: ReadonlyArray<string>
 }
 
 // Scored but possibly delivered by its own guard inside `pretool-guard.ts` (batching, investigation) — joining `DELIVERED_RULES`
@@ -115,13 +124,17 @@ const { SHELL_BODY_REASON, carries_a_body, is_shell_evaluated_body, keeps_body_s
 const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	// First: a third-party write is stopped before the first-party filing rows count anything.
 	third_party_write.ROW,
-	// The direct call only; `filing-cap` below triggers on `issue:file`. The WIP cap and the fold
-	// question are `issue:file`'s own steps, so no row gates them.
+	// Before every first-party row: a credential is refused whatever the call's other faults, and the
+	// commands those rows point at run the same scan in-process.
+	credential_body.ROW,
+	// The direct call only. The filing cap, the WIP cap and the fold question are `issue:file`'s own
+	// steps, so no row gates them.
 	direct_filing.ROW,
 	// Before the body rows: a comment posted by hand is refused whatever its body, and the command it
 	// points at takes the body by path, so the body rows have nothing left to say.
 	direct_issue_comment.ROW,
-	filing_cap.ROW,
+	// Before `issue-comments`, whose rewrite would add the unfiltered comments to the same read.
+	direct_issue_read.ROW,
 	issue_comments.ROW,
 	{
 		id: 'shell-body',
@@ -138,6 +151,8 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 		},
 	},
 	raw_field_body.ROW,
+	// Before `piped-verification`, whose rewrite would run under `pipefail` a check that must not run.
+	round_one_check_related.ROW,
 	{
 		id: 'piped-verification',
 		is_trigger: on_bash_command(piped_verification.is_masked_verification),
@@ -151,7 +166,7 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 			title: 'Piped verification',
 			topic: '`output-bounds.md`',
 			fires:
-				'a pass/fail josh check (`gate` / `check` / `lint*` / `cspell*` / `test*` / `eval` / `overrides` / `ranges`) in front of a pipe — rewritten under `set -o pipefail` when every filter is `tail` or a full-reading `grep`, refused otherwise',
+				'a pass/fail josh check (`gate` / `check*` / `lint*` / `cspell*` / `test*` / `eval` / `overrides` / `ranges`) in front of a pipe — rewritten under `set -o pipefail` when every filter reads to the end (`tail`, a full-reading `grep`, `cut`, `sort`, `uniq`, `wc`, `tee`, an `awk` / `sed` that cannot exit early and carries no `<` / `>` / `&`), refused otherwise',
 			quiet: 'the exit code reaches the caller — a failure reads as a failure',
 		},
 	},
@@ -214,24 +229,30 @@ const DELIVERED_RULES: ReadonlyArray<DeliveredRule> = [
 	lane_park.ROW,
 	lane_interactive_ask.ROW,
 	agent_model.ROW,
+	investigator_foreground.ROW,
+	reviewer_foreground.ROW,
 	lane_carry_conflict.ROW,
 	lane_switch_main.ROW,
 	// Before `lane-direct-tool`, its one overlap (a timed tool in a lane): the record is the right first
 	// act, and `lane-direct-tool` delivers on the reissue of a `time`-prefixed tool.
 	timed_rerun.ROW,
 	lane_direct_tool.ROW,
+	lane_spilled_read.ROW,
 	// Disjoint from `run-tail` by the `-y` flag.
 	josh_git_bare.ROW,
 	// The Bash-string gaps the deny glob cannot express, read by argv; `delivered-rules-bash.test.ts`
 	// pins that no two rows claim one command.
 	git_force.ROW,
 	worktree_guard.ROW,
-	file_body.ROW,
+	...file_edit_rows.SHELL_ROWS,
 	...permission_guards.ROWS,
 	poll_loop.ROW,
 	// Before `rule-body`, its one overlap: the cut is the right first act, and `rule-body` delivers on
 	// the reissue in the fresh process.
 	implementation_cut.ROW,
+	// Before `rule-body`, its one overlap (a whole-file `Write` of a rule document): the right tool is
+	// chosen before the placement questions are asked of its text.
+	file_edit_rows.REWRITE_ROW,
 	rule_body_guard.ROW,
 	...oracle_consulted.ROWS,
 ]
@@ -277,6 +298,8 @@ const MEASURED_RULES: ReadonlyArray<MeasuredRule> = [
 	...DELIVERED_RULES,
 	BATCHING_RULE,
 	INVESTIGATION_RULE,
+	// Delivered by `stop:guard`; listed here so `rule:value` counts its refusals.
+	concise_reply.ROW,
 ]
 
 // Once per run, so a run that obeyed is never wedged. A call the batching guard may refuse is stepped
@@ -290,14 +313,11 @@ const BATCH_REFUSAL_WINDOW_MS = 10_000
 
 // Asked with its real record, not `NEVER_MS`: that guard never refuses one sequence twice.
 function will_batch_guard_refuse(tail: string, call: GuardedCall, run: GuardRun): boolean {
-	// In a lane child the batching guard only notices, so there is nothing to stand aside for.
-	if (lane_guard_policy.mode_here('batching') !== 'refuse') return false
-
 	const refused_at_ms = BATCH_STAMP.last_ms(BATCH_STAMP.path(run.transcript))
 
 	if (run.now_ms - refused_at_ms < BATCH_REFUSAL_WINDOW_MS) return true
 
-	return time_batch_guard.should_block(tail, call, refused_at_ms)
+	return will_batch_refuse(tail, call, run)
 }
 
 function is_first_delivery(
@@ -323,7 +343,7 @@ function delivery_decision(rule: DeliveredRule): TranscriptGuardSpec['should_blo
 		delivered_at_ms: number,
 		run: GuardRun,
 	): boolean {
-		if (already_satisfied?.(tail, call) === true) return false
+		if (already_satisfied?.(tail, call, run) === true) return false
 		if (decide === undefined) return true
 
 		return decide(call, run, !will_batch_guard_refuse(tail, call, run), delivered_at_ms)
@@ -366,9 +386,8 @@ function is_enabled(): boolean {
 const delivered_rules = {
 	DELIVERED_RULES,
 	EARLY_HEARTBEAT_REASON: early_heartbeat.EARLY_HEARTBEAT_REASON,
-	FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+	FILE_BODY_REASON: file_edit_rows.FILE_BODY_REASON,
 	DIRECT_FILING_REASON: direct_filing.DIRECT_FILING_REASON,
-	FILING_CAP_REASON: filing_cap.FILING_CAP_REASON,
 	GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
 	ISSUE_COMMENTS_REASON: issue_comments.ISSUE_COMMENTS_REASON,
 	LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,

package/scripts/rules/destructive-command.ts

@@ -39,24 +39,16 @@ function is_recursive_forced_rm(segment: string): boolean {
 const GH_COMMAND = 'gh'
 const REPO_GROUP = 'repo'
 const REPO_REMOVALS: ReadonlySet<string> = new Set(['delete', 'archive'])
-const REPO_EDIT = 'edit'
-const VISIBILITY_FLAG = '--visibility'
 const PR_GROUP = 'pr'
 const PR_CLOSE = 'close'
 
-// `gh repo delete` / `archive`, and `gh repo edit --visibility …`.
-function is_destructive_repo_action(action: string, args: ReadonlyArray<string>): boolean {
-	if (REPO_REMOVALS.has(action)) return true
-
-	return action === REPO_EDIT && args.some((argument) => argument.startsWith(VISIBILITY_FLAG))
-}
-
+// `gh repo delete` / `archive`; a `gh repo edit` (`--visibility` included) is `repo-admin.ts`'s.
 function is_destructive_gh_command(args: ReadonlyArray<string>): boolean {
 	const [group, action = ''] = args
 
 	if (group === PR_GROUP) return action === PR_CLOSE
 
-	return group === REPO_GROUP && is_destructive_repo_action(action, args)
+	return group === REPO_GROUP && REPO_REMOVALS.has(action)
 }
 
 const DELETE_METHOD = 'DELETE'
@@ -97,7 +89,7 @@ function is_destructive_command(command: string): boolean {
 }
 
 const DESTRUCTIVE_COMMAND_REASON =
-	'⛔ destructive command: a recursive forced `rm`, a `gh repo delete` / `archive` / visibility edit, ' +
+	'⛔ destructive command: a recursive forced `rm`, a `gh repo delete` / `archive`, ' +
 	'`gh pr close` or a `gh api -X DELETE` cannot be undone, which is Tier C. Remove one path at a ' +
 	'time without `-f`, or ask the user to run it. It fires on every occurrence ' +
 	'(`prompts/collaboration-workflow/operating-rules.md`).'

package/scripts/rules/direct-issue-comment.ts

@@ -1,3 +1,5 @@
+import type { RepoIdentity } from '#scripts/discovery/repo-origin'
+import { repo_party } from '#scripts/discovery/repo-party'
 import { bash_triggers } from './bash-triggers'
 import { direct_pr_create } from './direct-pr-create'
 import { gh_api } from './gh-api'
@@ -12,8 +14,11 @@ import { shell_segments } from './shell-segments'
 // `direct-pr-create.ts`'s cut, so a quoted mention is not a call and `bash -c '…'` still is.
 //
 // **Only the checkout's own repository**: `issue:comment` posts there and nowhere else, so the row
-// claims the spellings that target it — the `{owner}` placeholder, and `gh issue comment` with no
-// repository selector. A comment to another repository named outright is left to `third-party-write`.
+// claims the spellings that target it — the `{owner}` placeholder, the checkout's own `owner/repo`
+// spelled out (the one repository the placeholders can expand to, `repo_party.current_repository`, the
+// candidate set `third-party-write` reads; joshuafolkken/kit#4737), and `gh issue comment` with no
+// repository selector. A comment to another repository named outright is left to `third-party-write`,
+// and so is every spelled-out one where the placeholders could expand to more than one repository.
 //
 // **It fires on every occurrence**, for the reason `git-force.ts` does.
 
@@ -43,13 +48,24 @@ function is_comment_cli_call(args: ReadonlyArray<string>): boolean {
 	return group === ISSUE_GROUP && action === COMMENT_ACTION
 }
 
-function is_own_comments_endpoint(endpoint: string): boolean {
-	const owner = gh_api.repo_target(endpoint)?.owner ?? ''
+type ResolveOwnRepository = () => RepoIdentity | undefined
 
-	return gh_api.is_owner_placeholder(owner) && COMMENTS_PATH.test(endpoint)
+// The checkout's own repository is read only for an owner spelled out, so a placeholder write and
+// every other command pay nothing for the config read.
+function is_own_comments_endpoint(endpoint: string, resolve_own: ResolveOwnRepository): boolean {
+	const target = gh_api.repo_target(endpoint)
+
+	if (target === undefined || !COMMENTS_PATH.test(endpoint)) return false
+
+	return (
+		gh_api.is_owner_placeholder(target.owner) || repo_party.is_own_repository(target, resolve_own())
+	)
 }
 
-function is_comment_api_call(args: ReadonlyArray<string>): boolean {
+function is_comment_api_call(
+	args: ReadonlyArray<string>,
+	resolve_own: ResolveOwnRepository,
+): boolean {
 	const call = [direct_pr_create.GH_COMMAND, ...args].join(' ')
 
 	if (!gh_api.is_gh_api(call) || !gh_api.is_write(call)) return false
@@ -59,19 +75,25 @@ function is_comment_api_call(args: ReadonlyArray<string>): boolean {
 		direct_pr_create.API_VALUE_TAKING_FLAGS,
 	)
 
-	return subcommand === API_SUBCOMMAND && is_own_comments_endpoint(endpoint)
+	return subcommand === API_SUBCOMMAND && is_own_comments_endpoint(endpoint, resolve_own)
 }
 
-function is_comment_segment(segment: string): boolean {
+function is_comment_segment(segment: string, resolve_own: ResolveOwnRepository): boolean {
 	const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND)
 
 	if (args === undefined || direct_pr_create.is_help_call(args)) return false
 
-	return is_comment_cli_call(args) || is_comment_api_call(args)
+	return is_comment_cli_call(args) || is_comment_api_call(args, resolve_own)
 }
 
-function is_direct_issue_comment(command: string): boolean {
-	return direct_pr_create.has_run_segment(command, is_comment_segment)
+// `resolve_own` is injected so the suite fixes the checkout's repository without reading the real one.
+function is_direct_issue_comment(
+	command: string,
+	resolve_own: ResolveOwnRepository = repo_party.current_repository,
+): boolean {
+	return direct_pr_create.has_run_segment(command, (segment) =>
+		is_comment_segment(segment, resolve_own),
+	)
 }
 
 // `pnpm josh issue:comment` — the act that keeps the rule, segment-wise so a spelling quoted inside
@@ -106,7 +128,7 @@ const ROW = {
 		title: 'Direct issue comment',
 		topic: '`shell-body.md`',
 		fires:
-			"a comment to the checkout's own repository outside `josh issue:comment` (`gh issue comment` with no `--repo`, or a `gh api` write to `repos/{owner}/<r>/issues/<N>/comments`); it points at `pnpm josh issue:comment`. Every occurrence",
+			"a comment to the checkout's own repository outside `josh issue:comment` (`gh issue comment` with no `--repo`, or a `gh api` write to `repos/<owner>/<r>/issues/<N>/comments` whose owner is the `{owner}` placeholder or the checkout's own `owner/repo` spelled out); it points at `pnpm josh issue:comment`. Every occurrence",
 		quiet:
 			'`pnpm josh issue:comment`, or reading the comments — the path that writes the run marker',
 	},

package/scripts/rules/direct-issue-read.ts

@@ -0,0 +1,191 @@
+import { session_cite } from '#scripts/issue/session-cite'
+import { bash_triggers } from './bash-triggers'
+import { direct_pr_create } from './direct-pr-create'
+import { gh_api } from './gh-api'
+import { git_argv } from './git-argv'
+import { issue_comments } from './issue-comments'
+import { shell_segments } from './shell-segments'
+
+// The `direct-issue-read` row of `delivered-rules.ts` (joshuafolkken/kit#4663). `pnpm josh issue:read`
+// is the one read that withholds a comment from an author without write access and marks an untrusted
+// body as a report; a `gh api` GET of `…/issues/<N>`, its comments or its timeline, and a
+// `gh issue view <N>` that prints the body or the comments, print both whole, so a third party's text
+// reaches the run as if it were an instruction. The read is refused and pointed there. It reads the
+// argv through `direct-pr-create.ts`'s cut, so a quoted mention is not a call.
+//
+// **Only the checkout's own repository**: `issue:read` reads there and nowhere else, and a
+// cross-repository read stays the `gh api` pair `issue-read-cli.ts` leaves it (`issue-comments` still
+// rewrites it to carry the comments). Own is the `{owner}` placeholder, or the origin spelled out
+// (#4703) — read from the git config in-process (`session_cite.session_repo`), so the hook path
+// spawns nothing.
+//
+// **A projection that never names the body is not a read of it** — `--jq '.state'` is a state check —
+// the same exemption `issue-comments` makes, shared from there. A `gh issue view --json` projection
+// naming the comments is still a read of them.
+//
+// **It fires on every occurrence**, and before `issue-comments`, whose rewrite would otherwise add the
+// unfiltered comments to the same call.
+
+const API_SUBCOMMAND = 'api'
+const ISSUE_GROUP = 'issue'
+const VIEW_ACTION = 'view'
+// `gh issue view --web` opens a browser and prints nothing the run reads.
+const WEB_FLAGS: ReadonlySet<string> = new Set(['-w', '--web'])
+// `gh issue view`'s flags that take a value as the next word, so `--json title,comments <url>` reads
+// the URL as the issue, not the projection.
+const VIEW_VALUE_TAKING_FLAGS: ReadonlySet<string> = new Set([
+	...direct_pr_create.VALUE_TAKING_FLAGS,
+	'--json',
+	'-q',
+	'--jq',
+	'-t',
+	'--template',
+])
+const REPO_EQUALS = '--repo='
+const ISSUE_URL = /^https?:\/\/[^/\s]+\/(?<named>[^/\s]+\/[^/\s]+)\/issues\/\d+/u
+const OWNER_REPO_PARTS = 2
+const QUOTE = `['"]?`
+const API_ORIGIN = String.raw`(?:https://api\.github\.com)?/?`
+const SEGMENT = String.raw`[^/\s'"?]+`
+// One issue's body, its comment listing or its timeline (which carries the comment bodies), the
+// number a literal or a shell variable. Anchored on the whole endpoint argument, so
+// `…/issues/comments/<id>`, `…/issues/<N>/labels` and the listing are not it.
+const NUMBER = String.raw`(?:\d+|\$\{?\w+\}?)`
+const ISSUE_READ_PATH = new RegExp(
+	String.raw`^${QUOTE}${API_ORIGIN}repos/${SEGMENT}/${SEGMENT}/issues/${NUMBER}(?:/comments|/timeline)?/?(?:\?[^\s'"]*)?${QUOTE}$`,
+	'u',
+)
+
+function is_own_repository(owner: string, repo: string): boolean {
+	if (gh_api.is_owner_placeholder(owner)) return true
+
+	return `${owner}/${repo}`.toLowerCase() === session_cite.session_repo()?.toLowerCase()
+}
+
+function is_own_issue_endpoint(endpoint: string): boolean {
+	const target = gh_api.repo_target(endpoint)
+
+	if (target === undefined) return false
+
+	return is_own_repository(target.owner, target.repo) && ISSUE_READ_PATH.test(endpoint)
+}
+
+function is_body_api_read(call: string): boolean {
+	return gh_api.is_gh_api(call) && gh_api.is_read(call) && !issue_comments.projects_away_body(call)
+}
+
+function is_api_issue_read(args: ReadonlyArray<string>, call: string): boolean {
+	if (!is_body_api_read(call)) return false
+
+	const [subcommand, endpoint = ''] = direct_pr_create.positional_words(
+		args,
+		direct_pr_create.API_VALUE_TAKING_FLAGS,
+	)
+
+	return subcommand === API_SUBCOMMAND && is_own_issue_endpoint(endpoint)
+}
+
+// The `-R` / `--repo` a `gh issue view` names, or `undefined` for the checkout's own.
+function repo_flag(args: ReadonlyArray<string>): string | undefined {
+	const index = args.findIndex((argument) => direct_pr_create.VALUE_TAKING_FLAGS.has(argument))
+
+	if (index !== -1) return args[index + 1]
+
+	return args.find((argument) => argument.startsWith(REPO_EQUALS))?.slice(REPO_EQUALS.length)
+}
+
+// The repository a `gh issue view` names — an issue given as its URL names its own, ahead of any
+// `-R` / `--repo` — or `undefined` for the checkout's own.
+function named_repository(args: ReadonlyArray<string>, issue: string): string | undefined {
+	return ISSUE_URL.exec(issue)?.groups?.['named'] ?? repo_flag(args)
+}
+
+function is_own_view_target(args: ReadonlyArray<string>, issue: string): boolean {
+	const named = named_repository(args, issue)
+
+	if (named === undefined) return true
+
+	// `gh` takes `[HOST/]OWNER/REPO`, so the pair is the last two parts, never the host.
+	const [owner = '', repo = ''] = named.split('/').slice(-OWNER_REPO_PARTS)
+
+	return is_own_repository(owner, repo)
+}
+
+function prints_body_or_comments(call: string): boolean {
+	if (issue_comments.fetches_issue_comments(call)) return true
+
+	return !issue_comments.projects_away_body(call)
+}
+
+// A `gh issue view` of the checkout's own issue that prints its body or comments to the run.
+function is_printed_view(args: ReadonlyArray<string>, issue: string, call: string): boolean {
+	if (args.some((argument) => WEB_FLAGS.has(argument))) return false
+
+	return is_own_view_target(args, issue) && prints_body_or_comments(call)
+}
+
+function is_issue_view_read(args: ReadonlyArray<string>, call: string): boolean {
+	const [group, action, issue = ''] = direct_pr_create.positional_words(
+		args,
+		VIEW_VALUE_TAKING_FLAGS,
+	)
+
+	const is_view = group === ISSUE_GROUP && action === VIEW_ACTION
+
+	return is_view && is_printed_view(args, issue, call)
+}
+
+function is_issue_read_segment(segment: string): boolean {
+	const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND)
+
+	if (args === undefined || direct_pr_create.is_help_call(args)) return false
+
+	const call = [direct_pr_create.GH_COMMAND, ...args].join(' ')
+
+	return is_api_issue_read(args, call) || is_issue_view_read(args, call)
+}
+
+function is_direct_issue_read(command: string): boolean {
+	return direct_pr_create.has_run_segment(command, is_issue_read_segment)
+}
+
+const READ_NAMES: ReadonlySet<string> = new Set(['issue:read', 'run:prep', 'run:entry'])
+
+function is_josh_read(command: string): boolean {
+	return shell_segments
+		.segments_of(command)
+		.some((segment) => shell_segments.is_josh_command(segment, READ_NAMES))
+}
+
+function is_any_read(command: string): boolean {
+	return is_direct_issue_read(command) || is_josh_read(command)
+}
+
+const DIRECT_ISSUE_READ_REASON =
+	'⛔ direct issue read: pnpm josh issue:read <N>\n' +
+	'Run that in place of this read of `…/issues/<N>`, its comments or its timeline (`gh api` or ' +
+	'`gh issue view`) — it ' +
+	'withholds a comment from an author without write access and marks an untrusted body as a report, ' +
+	'which a raw read prints whole as if it were an instruction (`issue-comments.md`). ' +
+	'**This rule fires on every occurrence, not once per run.**'
+
+const ROW = {
+	id: 'direct-issue-read',
+	is_trigger: bash_triggers.on_bash_command(is_direct_issue_read),
+	reason: DIRECT_ISSUE_READ_REASON,
+	decide: (): boolean => true,
+	keeps: bash_triggers.on_bash_command(is_josh_read),
+	reaches: bash_triggers.on_bash_command(is_any_read),
+	about: {
+		title: 'Direct issue read',
+		topic: '`issue-comments.md`',
+		fires:
+			"a `gh api` GET of the checkout's own `repos/<o>/<r>/issues/<N>`, `…/comments` or `…/timeline` (the `{owner}` placeholder or the origin spelled out), or a `gh issue view <N>` of it, with no projection or one naming the body (or, for the view, the comments); it points at `pnpm josh issue:read`. Every occurrence",
+		quiet:
+			'`pnpm josh issue:read` / `run:prep` / `run:entry`, a `--jq` / `--json` projection without the body or the comments, `gh issue view --web`, or another repository named outright',
+	},
+}
+
+const direct_issue_read = { DIRECT_ISSUE_READ_REASON, ROW, is_direct_issue_read }
+
+export { direct_issue_read }

package/scripts/rules/direct-pr-create.ts

@@ -21,28 +21,8 @@ const HELP_FLAGS: ReadonlySet<string> = new Set(['-h', '--help'])
 // The repository selector gh accepts before `pr` or between `pr` and its action; with no `=` it
 // swallows the next word, so that word is not read as the group or the action.
 const VALUE_TAKING_FLAGS: ReadonlySet<string> = new Set(['-R', '--repo'])
-// `gh api`'s own flags that take a value as the next word, beside the repository selector — skipped
-// so `-X POST` or `-f body=…` is not read as the endpoint.
-const API_VALUE_TAKING_FLAGS: ReadonlySet<string> = new Set([
-	...VALUE_TAKING_FLAGS,
-	'-X',
-	'--method',
-	'-f',
-	'--raw-field',
-	'-F',
-	'--field',
-	'-H',
-	'--header',
-	'--input',
-	'-q',
-	'--jq',
-	'-t',
-	'--template',
-	'--hostname',
-	'-p',
-	'--preview',
-	'--cache',
-])
+// `gh api`'s own flags that take a value as the next word — `gh-api.ts` owns the list.
+const { API_VALUE_TAKING_FLAGS } = gh_api
 const API_SUBCOMMAND = 'api'
 // The pull-request collection itself — a write there opens a PR. Anchored on the whole endpoint
 // argument, so `…/pulls/5/comments` is not read as the collection. A full API URL names the same
@@ -144,7 +124,7 @@ function is_direct_pr_create(command: string): boolean {
 const DIRECT_PR_CREATE_REASON =
 	'⛔ direct PR creation: `gh pr create` (or a `gh api` POST to `repos/<o>/<r>/pulls`) bypasses ' +
 	'`build_body`, which writes the `closes #N` line — the Issue would stay open after the merge ' +
-	'(`CLAUDE.md` → Git Rules). Open the PR with `pnpm josh pr` instead; after a failed push, fix, push, ' +
+	'(`operating-rules.md` → "git-rules"). Open the PR with `pnpm josh pr` instead; after a failed push, fix, push, ' +
 	'then run `pnpm josh pr`. **This rule fires on every occurrence, not once per run.**'
 
 const ROW = {
@@ -154,7 +134,7 @@ const ROW = {
 	decide: (): boolean => true,
 	about: {
 		title: 'Direct PR creation',
-		topic: '`CLAUDE.md` → Git Rules',
+		topic: '`operating-rules.md` → "git-rules"',
 		fires:
 			'`gh pr create`, or a `gh api` write to `repos/<o>/<r>/pulls`; it points at `pnpm josh pr`. Every occurrence',
 		quiet: '`pnpm josh pr`, or reading a PR — the path that writes `closes #N`',

package/scripts/rules/early-heartbeat.ts

@@ -220,7 +220,9 @@ const early_heartbeat = {
 	EARLY_HEARTBEAT_REASON,
 	decide,
 	is_progress_watch,
+	is_wait_or_inert,
 	is_wait_timer,
+	sleep_seconds,
 	wait_duration_ms,
 	waits_for_progress,
 }

package/scripts/rules/edit-tool.ts

@@ -0,0 +1,27 @@
+// The file-editing tools a `PreToolUse` row reads by name — the one place the guards share, so the
+// rows that look at `Edit` / `Write` never carry their own copy of the set (joshuafolkken/kit#5284).
+const EDIT = 'Edit'
+const WRITE = 'Write'
+
+const EDIT_TOOLS: ReadonlySet<string> = new Set([EDIT, WRITE])
+
+function is_edit_tool(name: string): boolean {
+	return EDIT_TOOLS.has(name)
+}
+
+// A string field of an edit tool's input (`file_path`, `content`, `old_string`, `new_string`); `''`
+// when it is absent or not a string.
+function string_field(input: Record<string, unknown>, key: string): string {
+	const value = input[key]
+
+	return typeof value === 'string' ? value : ''
+}
+
+const edit_tool = {
+	EDIT,
+	WRITE,
+	is_edit_tool,
+	string_field,
+}
+
+export { edit_tool }

package/scripts/rules/file-edit-rows.ts

@@ -0,0 +1,17 @@
+import { file_body } from './file-body'
+import { file_rewrite } from './file-rewrite'
+import { sed_in_place } from './sed-in-place'
+
+// The rows that enforce `prompts/collaboration-workflow/file-edits.md`, gathered so
+// `delivered-rules.ts` places them in two entries. The shell rows — a file body carried inline, and a
+// `sed -i` its countable conditions do not clear — claim disjoint commands; the `Write` row sits apart
+// because its place in the order is set by the edit-tool rows it overlaps.
+const SHELL_ROWS = [file_body.ROW, sed_in_place.ROW] as const
+
+const file_edit_rows = {
+	FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+	REWRITE_ROW: file_rewrite.ROW,
+	SHELL_ROWS,
+}
+
+export { file_edit_rows }