@joshuafolkken/kit 1.3000.0 → 1.3044.0

package/dist/hooks/daemon.js

@@ -2261,7 +2261,7 @@ import {
   writeSync as writeSync4
 } from "node:fs";
 import { Socket } from "node:net";
-import path76 from "node:path";
+import path77 from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 
@@ -3630,10 +3630,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema2) {
   return mergeDefs(schema2._zod.def);
 }
-function getElementAtPath(obj, path77) {
-  if (!path77)
+function getElementAtPath(obj, path78) {
+  if (!path78)
     return obj;
-  return path77.reduce((acc, key3) => acc?.[key3], obj);
+  return path78.reduce((acc, key3) => acc?.[key3], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -3973,11 +3973,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path77, issues) {
+function prefixIssues(path78, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path77);
+    iss.path.unshift(path78);
     return iss;
   });
 }
@@ -4439,16 +4439,16 @@ function flattenError(error62, mapper = (issue3) => issue3.message) {
 }
 function formatError(error62, mapper = (issue3) => issue3.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path77 = []) => {
+  const processError = (error63, path78 = []) => {
     for (const issue3 of error63.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
-        issue3.errors.map((issues) => processError({ issues }, [...path77, ...issue3.path]));
+        issue3.errors.map((issues) => processError({ issues }, [...path78, ...issue3.path]));
       } else if (issue3.code === "invalid_key") {
-        processError({ issues: issue3.issues }, [...path77, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path78, ...issue3.path]);
       } else if (issue3.code === "invalid_element") {
-        processError({ issues: issue3.issues }, [...path77, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path78, ...issue3.path]);
       } else {
-        const fullpath = [...path77, ...issue3.path];
+        const fullpath = [...path78, ...issue3.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue3));
         } else {
@@ -4487,17 +4487,17 @@ function formatError(error62, mapper = (issue3) => issue3.message) {
 }
 function treeifyError(error62, mapper = (issue3) => issue3.message) {
   const result = { errors: [] };
-  const processError = (error63, path77 = []) => {
+  const processError = (error63, path78 = []) => {
     var _a3;
     for (const issue3 of error63.issues) {
       if (issue3.code === "invalid_union" && issue3.errors.length) {
-        issue3.errors.map((issues) => processError({ issues }, [...path77, ...issue3.path]));
+        issue3.errors.map((issues) => processError({ issues }, [...path78, ...issue3.path]));
       } else if (issue3.code === "invalid_key") {
-        processError({ issues: issue3.issues }, [...path77, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path78, ...issue3.path]);
       } else if (issue3.code === "invalid_element") {
-        processError({ issues: issue3.issues }, [...path77, ...issue3.path]);
+        processError({ issues: issue3.issues }, [...path78, ...issue3.path]);
       } else {
-        const fullpath = [...path77, ...issue3.path];
+        const fullpath = [...path78, ...issue3.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue3));
           continue;
@@ -4536,8 +4536,8 @@ function treeifyError(error62, mapper = (issue3) => issue3.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path77 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path77) {
+  const path78 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path78) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -5614,23 +5614,23 @@ function canParseURL(input2) {
     return false;
   }
 }
-function validateURL(trimmed3, def) {
+function validateURL(trimmed5, def) {
   if (!("normalize" in def) && !("hostname" in def) && !("protocol" in def)) {
-    return canParseURL(trimmed3) || URL_UNPARSEABLE;
+    return canParseURL(trimmed5) || URL_UNPARSEABLE;
   }
-  return parseURLObject(trimmed3, def);
+  return parseURLObject(trimmed5, def);
 }
-function parseURLObject(trimmed3, def) {
-  if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed3)) {
+function parseURLObject(trimmed5, def) {
+  if (!def.normalize && def.protocol?.source === httpProtocol.source && !/^https?:\/\//i.test(trimmed5)) {
     return URL_BAD_FORMAT;
   }
   try {
     if (typeof URL !== "undefined") {
       const URLStatic = URL;
       if (typeof URLStatic.parse === "function")
-        return URLStatic.parse(trimmed3) ?? URL_UNPARSEABLE;
+        return URLStatic.parse(trimmed5) ?? URL_UNPARSEABLE;
     }
-    return new URL(trimmed3);
+    return new URL(trimmed5);
   } catch {
     return URL_UNPARSEABLE;
   }
@@ -5651,8 +5651,8 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
   $ZodStringFormat.init(inst, def);
   inst._zod.check = (payload) => {
     try {
-      const trimmed3 = payload.value.trim();
-      const url2 = validateURL(trimmed3, def);
+      const trimmed5 = payload.value.trim();
+      const url2 = validateURL(trimmed5, def);
       if (url2 === URL_BAD_FORMAT) {
         payload.issues.push({
           code: "invalid_format",
@@ -5675,7 +5675,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
         return;
       }
       if (url2 === true) {
-        payload.value = stripTabAndNewline(trimmed3);
+        payload.value = stripTabAndNewline(trimmed5);
         return;
       }
       if (def.hostname && !urlHostnameOk(url2, def.hostname)) {
@@ -5700,7 +5700,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
           continue: !def.abort
         });
       }
-      payload.value = def.normalize ? url2.href : stripTabAndNewline(trimmed3);
+      payload.value = def.normalize ? url2.href : stripTabAndNewline(trimmed5);
       return;
     } catch (_) {
       payload.issues.push({
@@ -21675,13 +21675,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path77 = ref.slice(1).split("/").filter(Boolean);
-  if (path77.length === 0) {
+  const path78 = ref.slice(1).split("/").filter(Boolean);
+  if (path78.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path77[0] === defsKey) {
-    const key3 = path77[1] === void 0 ? void 0 : decodeJSONPointerSegment(path77[1]);
+  if (path78[0] === defsKey) {
+    const key3 = path78[1] === void 0 ? void 0 : decodeJSONPointerSegment(path78[1]);
     if (!key3 || !ctx.defs[key3]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27769,17 +27769,17 @@ var writeToFiles = (chunks, stdioItems, outputFiles) => {
   const writtenPaths = /* @__PURE__ */ new Set();
   for (const stdioItem of fileItems) {
     const { type, append: append6 } = stdioItem;
-    const path77 = type === "fileNumber" ? stdioItem.path : getFileTarget(stdioItem);
-    if (writtenPaths.has(path77)) {
+    const path78 = type === "fileNumber" ? stdioItem.path : getFileTarget(stdioItem);
+    if (writtenPaths.has(path78)) {
       continue;
     }
-    writtenPaths.add(path77);
-    if (append6 || outputFiles.has(path77)) {
-      appendFileSync(path77, contents);
+    writtenPaths.add(path78);
+    if (append6 || outputFiles.has(path78)) {
+      appendFileSync(path78, contents);
     } else {
-      writeFileSync3(path77, contents);
+      writeFileSync3(path78, contents);
     }
-    outputFiles.add(path77);
+    outputFiles.add(path78);
   }
 };
 
@@ -30739,9 +30739,9 @@ var NAME_ONLY_FLAG = "--name-only";
 var DEFAULT_BRANCH_FALLBACK = "main";
 var DEFAULT_BRANCH_ARGUMENTS = ["symbolic-ref", "refs/remotes/origin/HEAD"];
 function default_branch_of(output2) {
-  const trimmed3 = output2?.trim() ?? "";
-  if (!trimmed3.startsWith(REFS_REMOTES_ORIGIN_PREFIX)) return DEFAULT_BRANCH_FALLBACK;
-  return trimmed3.slice(REFS_REMOTES_ORIGIN_PREFIX.length);
+  const trimmed5 = output2?.trim() ?? "";
+  if (!trimmed5.startsWith(REFS_REMOTES_ORIGIN_PREFIX)) return DEFAULT_BRANCH_FALLBACK;
+  return trimmed5.slice(REFS_REMOTES_ORIGIN_PREFIX.length);
 }
 async function get_default_branch() {
   try {
@@ -31909,9 +31909,9 @@ function answer_help_or_unknown(argv, known_flags, command3) {
     console.info(usage_line(known_flags, command3));
     return 0;
   }
-  const refusal4 = refuse_unknown_flags(argv, known_flags, command3);
-  if (refusal4 === void 0) return void 0;
-  console.error(refusal4);
+  const refusal6 = refuse_unknown_flags(argv, known_flags, command3);
+  if (refusal6 === void 0) return void 0;
+  console.error(refusal6);
   return 1;
 }
 function parse_or_undefined2(config2) {
@@ -31977,11 +31977,11 @@ function to_positive(raw) {
   return to_integer(raw, POSITIVE_PATTERN);
 }
 function read_positive_setting(raw, name, fallback) {
-  const trimmed3 = raw?.trim() ?? "";
-  if (trimmed3 === "") return { kind: "limit", limit: fallback };
-  const limit = to_positive(trimmed3);
+  const trimmed5 = raw?.trim() ?? "";
+  if (trimmed5 === "") return { kind: "limit", limit: fallback };
+  const limit = to_positive(trimmed5);
   if (limit !== void 0) return { kind: "limit", limit };
-  return { kind: "problem", problem: `${name} must be a positive integer, not "${trimmed3}"` };
+  return { kind: "problem", problem: `${name} must be a positive integer, not "${trimmed5}"` };
 }
 var cli_flags = {
   to_count,
@@ -32307,20 +32307,20 @@ var ABSENT_CODE = "ENOENT";
 function is_absent(error62) {
   return error62 instanceof Error && "code" in error62 && error62.code === ABSENT_CODE;
 }
-function read_optional(path77) {
+function read_optional(path78) {
   try {
-    return readFileSync7(path77, "utf8");
+    return readFileSync7(path78, "utf8");
   } catch (error62) {
     if (is_absent(error62)) return void 0;
     throw error62;
   }
 }
-function read_file_or_empty(path77) {
-  return read_optional(path77) ?? "";
+function read_file_or_empty(path78) {
+  return read_optional(path78) ?? "";
 }
-function read_if_readable(path77) {
+function read_if_readable(path78) {
   try {
-    return readFileSync7(path77, "utf8");
+    return readFileSync7(path78, "utf8");
   } catch {
     return void 0;
   }
@@ -33024,10 +33024,10 @@ async function target() {
     return void 0;
   }
 }
-function append(path77, entry) {
-  const descriptor = openSync2(path77, APPEND_FLAGS, LEDGER_FILE_MODE);
+function append(path78, entry) {
+  const descriptor = openSync2(path78, APPEND_FLAGS, LEDGER_FILE_MODE);
   try {
-    if (!stamp_file.is_own_regular_file(path77)) {
+    if (!stamp_file.is_own_regular_file(path78)) {
       throw new Error("Ledger is not an owned regular file");
     }
     writeSync(descriptor, `${JSON.stringify(entry)}${LINE_SEPARATOR}`);
@@ -33035,9 +33035,9 @@ function append(path77, entry) {
     closeSync2(descriptor);
   }
 }
-async function record2(entry, path77) {
+async function record2(entry, path78) {
   try {
-    const destination = path77 ?? await target();
+    const destination = path78 ?? await target();
     if (destination !== void 0) append(destination, entry);
   } catch {
   }
@@ -33045,84 +33045,84 @@ async function record2(entry, path77) {
 function now_iso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
-async function record_gate(path77, gate) {
-  await record2({ kind: KIND2.GATE, at: now_iso(), ...gate }, path77);
+async function record_gate(path78, gate) {
+  await record2({ kind: KIND2.GATE, at: now_iso(), ...gate }, path78);
 }
 async function record_merge(issue3, at = /* @__PURE__ */ new Date()) {
   await record2({ kind: KIND2.MERGE, at: at.toISOString(), issue: issue3 });
 }
-async function record_dispatch(issue3, path77) {
-  await record2({ kind: KIND2.DISPATCH, at: now_iso(), issue: issue3 }, path77);
+async function record_dispatch(issue3, path78) {
+  await record2({ kind: KIND2.DISPATCH, at: now_iso(), issue: issue3 }, path78);
 }
-async function record_stage(stage, path77) {
-  await record2({ kind: KIND2.STAGE, at: now_iso(), ...stage }, path77);
+async function record_stage(stage, path78) {
+  await record2({ kind: KIND2.STAGE, at: now_iso(), ...stage }, path78);
 }
-async function record_stop(stop, path77) {
-  await record2({ kind: KIND2.STOP, at: now_iso(), ...stop }, path77);
+async function record_stop(stop, path78) {
+  await record2({ kind: KIND2.STOP, at: now_iso(), ...stop }, path78);
 }
-async function record_chain(chain, path77) {
-  await record2({ kind: KIND2.CHAIN, at: now_iso(), ...chain }, path77);
+async function record_chain(chain, path78) {
+  await record2({ kind: KIND2.CHAIN, at: now_iso(), ...chain }, path78);
 }
-async function record_overlap(overlap, path77) {
-  await record2({ kind: KIND2.OVERLAP, at: now_iso(), ...overlap }, path77);
+async function record_overlap(overlap, path78) {
+  await record2({ kind: KIND2.OVERLAP, at: now_iso(), ...overlap }, path78);
 }
-async function record_held(held, path77) {
+async function record_held(held, path78) {
   const waiting = held.waiting ?? [];
   const named = waiting.length > 0 ? { waiting: [...waiting] } : {};
-  await record2({ kind: KIND2.HELD, at: now_iso(), reason: held.reason, ...named }, path77);
+  await record2({ kind: KIND2.HELD, at: now_iso(), reason: held.reason, ...named }, path78);
 }
-async function record_released(path77) {
-  await record2({ kind: KIND2.RELEASED, at: now_iso() }, path77);
+async function record_released(path78) {
+  await record2({ kind: KIND2.RELEASED, at: now_iso() }, path78);
 }
-async function record_lane_state(change, path77) {
-  await record2({ kind: KIND2.LANE_STATE, at: now_iso(), ...change }, path77);
+async function record_lane_state(change, path78) {
+  await record2({ kind: KIND2.LANE_STATE, at: now_iso(), ...change }, path78);
 }
-async function record_offerable(is_offerable, path77) {
-  await record2({ kind: KIND2.OFFERABLE, at: now_iso(), is_offerable }, path77);
+async function record_offerable(is_offerable, path78) {
+  await record2({ kind: KIND2.OFFERABLE, at: now_iso(), is_offerable }, path78);
 }
-async function record_offer(offer, path77) {
-  await record2({ kind: KIND2.OFFER, at: now_iso(), ...offer }, path77);
+async function record_offer(offer, path78) {
+  await record2({ kind: KIND2.OFFER, at: now_iso(), ...offer }, path78);
 }
-async function record_round_one(round_one, path77) {
-  await record2({ kind: KIND2.ROUND_ONE, at: now_iso(), ...round_one }, path77);
+async function record_round_one(round_one, path78) {
+  await record2({ kind: KIND2.ROUND_ONE, at: now_iso(), ...round_one }, path78);
 }
-async function record_round_two(round_two, path77) {
-  await record2({ kind: KIND2.ROUND_TWO, at: now_iso(), ...round_two }, path77);
+async function record_round_two(round_two, path78) {
+  await record2({ kind: KIND2.ROUND_TWO, at: now_iso(), ...round_two }, path78);
 }
-async function record_core_wait(wait, path77) {
-  await record2({ kind: KIND2.CORE_WAIT, at: now_iso(), ...wait }, path77);
+async function record_core_wait(wait, path78) {
+  await record2({ kind: KIND2.CORE_WAIT, at: now_iso(), ...wait }, path78);
 }
-async function record_unit_files(files2, path77) {
-  await record2({ kind: KIND2.UNIT_FILES, at: now_iso(), files: [...files2] }, path77);
+async function record_unit_files(files2, path78) {
+  await record2({ kind: KIND2.UNIT_FILES, at: now_iso(), files: [...files2] }, path78);
 }
-async function record_test_related(run4, path77) {
-  await record2({ kind: KIND2.TEST_RELATED, at: now_iso(), ...run4 }, path77);
+async function record_test_related(run4, path78) {
+  await record2({ kind: KIND2.TEST_RELATED, at: now_iso(), ...run4 }, path78);
 }
-async function record_test_pinned(run4, path77) {
-  await record2({ kind: KIND2.TEST_PINNED, at: now_iso(), ...run4 }, path77);
+async function record_test_pinned(run4, path78) {
+  await record2({ kind: KIND2.TEST_PINNED, at: now_iso(), ...run4 }, path78);
 }
-async function record_split_notice(notice3, path77) {
-  await record2({ kind: KIND2.SPLIT_NOTICE, at: now_iso(), ...notice3 }, path77);
+async function record_split_notice(notice3, path78) {
+  await record2({ kind: KIND2.SPLIT_NOTICE, at: now_iso(), ...notice3 }, path78);
 }
-async function record_split_filed(filed, path77) {
-  const destination = path77 ?? await target();
+async function record_split_filed(filed, path78) {
+  const destination = path78 ?? await target();
   if (destination === void 0) throw new Error("Could not resolve the split-child ledger");
   append(destination, { kind: KIND2.SPLIT_FILED, at: now_iso(), ...filed });
 }
-async function record_push_miss(miss, path77) {
-  await record2({ kind: KIND2.PUSH_MISS, at: now_iso(), ...miss }, path77);
+async function record_push_miss(miss, path78) {
+  await record2({ kind: KIND2.PUSH_MISS, at: now_iso(), ...miss }, path78);
 }
-async function record_early_push(push4, path77) {
-  await record2({ kind: KIND2.EARLY_PUSH, at: now_iso(), ...push4 }, path77);
+async function record_early_push(push4, path78) {
+  await record2({ kind: KIND2.EARLY_PUSH, at: now_iso(), ...push4 }, path78);
 }
-async function record_ship_lap(lap2, path77) {
-  await record2({ kind: KIND2.SHIP_LAP, at: now_iso(), ...lap2 }, path77);
+async function record_ship_lap(lap2, path78) {
+  await record2({ kind: KIND2.SHIP_LAP, at: now_iso(), ...lap2 }, path78);
 }
-async function record_size(size, path77) {
-  await record2({ kind: KIND2.SIZE, at: now_iso(), ...size }, path77);
+async function record_size(size, path78) {
+  await record2({ kind: KIND2.SIZE, at: now_iso(), ...size }, path78);
 }
-async function record_unplanned_notice(notice3, path77) {
-  await record2({ kind: KIND2.UNPLANNED_NOTICE, at: now_iso(), ...notice3 }, path77);
+async function record_unplanned_notice(notice3, path78) {
+  await record2({ kind: KIND2.UNPLANNED_NOTICE, at: now_iso(), ...notice3 }, path78);
 }
 var lane_ledger_write = {
   CI_WAIT_STAGE,
@@ -33306,9 +33306,9 @@ async function keep_full_output(issue3, output2) {
   }
 }
 async function omitted_range(issue3, lines) {
-  const path77 = await keep_full_output(issue3, lines.join(LINE_BREAK));
+  const path78 = await keep_full_output(issue3, lines.join(LINE_BREAK));
   const last_line = lines.length - EXCERPT_LINE_LIMIT;
-  return path77 === void 0 ? { last_line } : { path: path77, last_line };
+  return path78 === void 0 ? { last_line } : { path: path78, last_line };
 }
 function clipped(lines) {
   return lines.map((line2) => line2.slice(0, EXCERPT_LINE_WIDTH));
@@ -33756,11 +33756,11 @@ function read_trimmed(environment3, key3) {
   return raw === void 0 ? "" : raw.trim();
 }
 function resolve_bounded(environment3, key3, max) {
-  const trimmed3 = read_trimmed(environment3, key3);
-  if (trimmed3.length === 0) return MIN_SEED;
-  if (!INTEGER_PATTERN.test(trimmed3)) fail_invalid(key3, trimmed3, max);
-  const value2 = Number(trimmed3);
-  if (value2 > max) fail_invalid(key3, trimmed3, max);
+  const trimmed5 = read_trimmed(environment3, key3);
+  if (trimmed5.length === 0) return MIN_SEED;
+  if (!INTEGER_PATTERN.test(trimmed5)) fail_invalid(key3, trimmed5, max);
+  const value2 = Number(trimmed5);
+  if (value2 > max) fail_invalid(key3, trimmed5, max);
   return value2;
 }
 function resolve_seed(environment3 = process.env) {
@@ -33956,10 +33956,10 @@ function record_refusal(target3, now_ms) {
   }
 }
 function create_refusal_stamp(prefix2) {
-  function path77(transcript_path) {
+  function path78(transcript_path) {
     return stamp_file.stamp_path(prefix2, transcript_path);
   }
-  return { path: path77, last_ms: last_refusal_ms, record: record_refusal };
+  return { path: path78, last_ms: last_refusal_ms, record: record_refusal };
 }
 var { load_environment_file: load_environment_file3 } = josh_environment_file;
 var NO_OUTCOME = { reason: void 0, notice: void 0, fault: void 0 };
@@ -34029,10 +34029,10 @@ function create_transcript_guard(spec) {
       return { reason: void 0, notice: void 0, fault: fault_notice(spec.switch_key, error62) };
     }
   }
-  function refusal4(...call) {
+  function refusal6(...call) {
     return outcome(...call).reason;
   }
-  return { is_enabled: is_enabled6, outcome, refusal: refusal4, refusal_path: stamp2.path };
+  return { is_enabled: is_enabled6, outcome, refusal: refusal6, refusal_path: stamp2.path };
 }
 function emit_outcome(outcome) {
   const { reason: reason4, notice: notice3, fault } = outcome;
@@ -34710,9 +34710,9 @@ var KEY_CONTEXT = "context";
 var KEY_DESCRIPTION = "description";
 function read_string(value2) {
   if (typeof value2 !== "string") return void 0;
-  const trimmed3 = value2.trim();
-  if (trimmed3.length === 0) return void 0;
-  return trimmed3;
+  const trimmed5 = value2.trim();
+  if (trimmed5.length === 0) return void 0;
+  return trimmed5;
 }
 var PENDING_STATUS_STATES = /* @__PURE__ */ new Set(["pending", "expected"]);
 function parse_status_context(item) {
@@ -35054,37 +35054,37 @@ var time_format = {
 function new_path() {
   return { pending: /* @__PURE__ */ new Set(), settled: /* @__PURE__ */ new Set(), check_ms: {} };
 }
-function settle2(path77, name, elapsed_ms) {
-  if (path77.pending.delete(name)) path77.check_ms[name] = elapsed_ms;
-  path77.settled.add(name);
+function settle2(path78, name, elapsed_ms) {
+  if (path78.pending.delete(name)) path78.check_ms[name] = elapsed_ms;
+  path78.settled.add(name);
 }
-function hold(path77, name) {
-  if (path77.settled.has(name)) path77.has_rerun = true;
-  path77.pending.add(name);
+function hold(path78, name) {
+  if (path78.settled.has(name)) path78.has_rerun = true;
+  path78.pending.add(name);
 }
-function observe(path77, snapshot4, now_ms) {
-  path77.start_ms ??= now_ms;
-  const elapsed_ms = now_ms - path77.start_ms;
+function observe(path78, snapshot4, now_ms) {
+  path78.start_ms ??= now_ms;
+  const elapsed_ms = now_ms - path78.start_ms;
   const checks = snapshot4.rollup.filter((check6) => !is_coderabbit_check(check6.name));
   const pending = new Set(
     checks.filter((check6) => check6.status === CHECK_STATUS_PENDING).map((check6) => check6.name)
   );
-  for (const name of pending) hold(path77, name);
-  for (const check6 of checks) if (!pending.has(check6.name)) settle2(path77, check6.name, elapsed_ms);
+  for (const name of pending) hold(path78, name);
+  for (const check6 of checks) if (!pending.has(check6.name)) settle2(path78, check6.name, elapsed_ms);
 }
-function observer_of(path77) {
-  const is_first_wait = path77.start_ms === void 0;
+function observer_of(path78) {
+  const is_first_wait = path78.start_ms === void 0;
   return async function time_checks(snapshot4) {
-    if (is_first_wait) observe(path77, snapshot4, performance.now());
+    if (is_first_wait) observe(path78, snapshot4, performance.now());
   };
 }
-function record_of(path77) {
-  const [last] = Object.entries(path77.check_ms).toSorted((left, right) => right[1] - left[1]);
+function record_of(path78) {
+  const [last] = Object.entries(path78.check_ms).toSorted((left, right) => right[1] - left[1]);
   if (last === void 0) return {};
   return {
     last_check: last[0],
-    check_ms: { ...path77.check_ms },
-    ...path77.has_rerun && { has_rerun: path77.has_rerun }
+    check_ms: { ...path78.check_ms },
+    ...path78.has_rerun && { has_rerun: path78.has_rerun }
   };
 }
 var followup_ci_path = { new_path, observe, observer_of, record_of };
@@ -35754,9 +35754,9 @@ function parse_url_like(url2) {
   }
 }
 function parse_origin_url(url2) {
-  const trimmed3 = url2.trim();
-  if (trimmed3 === "") return void 0;
-  return parse_url_like(trimmed3) ?? parse_scp_like(trimmed3);
+  const trimmed5 = url2.trim();
+  if (trimmed5 === "") return void 0;
+  return parse_url_like(trimmed5) ?? parse_scp_like(trimmed5);
 }
 function is_section_header(line2) {
   return line2.startsWith(SECTION_PREFIX);
@@ -35972,12 +35972,22 @@ function line_references(line2) {
 function collect_line_references(line2, found) {
   for (const reference2 of line_references(line2)) found.push(`${reference2.prefix}${reference2.text}`);
 }
+function closes_fence(line2, marker, fence) {
+  return marker.startsWith(fence) && line2.trim() === marker;
+}
+function fence_after(line2, fence) {
+  const match = FENCE_MARKER.exec(line2);
+  if (match === null) return fence;
+  const marker = match[0].trimStart();
+  if (fence === "") return marker;
+  return closes_fence(line2, marker, fence) ? "" : fence;
+}
 function lines_outside_fences(message) {
   const lines = [];
-  let is_in_fence = false;
+  let fence = "";
   for (const line2 of message.split("\n")) {
-    if (FENCE_MARKER.test(line2)) is_in_fence = !is_in_fence;
-    else if (!is_in_fence) lines.push(line2);
+    fence = fence_after(line2, fence);
+    if (fence === "" && !FENCE_MARKER.test(line2)) lines.push(line2);
   }
   return lines;
 }
@@ -36013,10 +36023,10 @@ function rewrite_line(line2, slug, is_in_fence) {
 }
 function linkify(message, slug) {
   const out = [];
-  let is_in_fence = false;
+  let fence = "";
   for (const line2 of message.split("\n")) {
-    if (FENCE_MARKER.test(line2)) is_in_fence = !is_in_fence;
-    out.push(rewrite_line(line2, slug, is_in_fence));
+    fence = fence_after(line2, fence);
+    out.push(rewrite_line(line2, slug, fence !== ""));
   }
   return out.join("\n");
 }
@@ -36765,9 +36775,9 @@ var SECONDS_SUFFIX = " s";
 var DIGIT_OR_POINT = /[\d.]/u;
 var NO_STAGES = [];
 function stage_body(line2) {
-  const trimmed3 = line2.trimStart();
-  if (!trimmed3.startsWith(git_followup_stages.STAGE_LINE_PREFIX)) return void 0;
-  return trimmed3.slice(git_followup_stages.STAGE_LINE_PREFIX.length);
+  const trimmed5 = line2.trimStart();
+  if (!trimmed5.startsWith(git_followup_stages.STAGE_LINE_PREFIX)) return void 0;
+  return trimmed5.slice(git_followup_stages.STAGE_LINE_PREFIX.length);
 }
 function digits_start(head) {
   let index = head.length;
@@ -36930,14 +36940,14 @@ function format_gate_failed(failed_labels, total) {
 var GATE_OPENING_PREFIX = "plan: ";
 var GATE_OPENING_MARK = " checks at once";
 function is_gate_opening(line2) {
-  const trimmed3 = line2.trimStart();
-  return trimmed3.startsWith(GATE_OPENING_PREFIX) && trimmed3.includes(GATE_OPENING_MARK);
+  const trimmed5 = line2.trimStart();
+  return trimmed5.startsWith(GATE_OPENING_PREFIX) && trimmed5.includes(GATE_OPENING_MARK);
 }
 function read_verdict(line2) {
-  const trimmed3 = line2.trimStart();
-  if (trimmed3.startsWith(GATE_FAILED_PREFIX)) return FAILED_VERDICT;
-  if (trimmed3.startsWith(GATE_PASSED_PREFIX)) return PASSED_VERDICT;
-  if (trimmed3.startsWith(GATE_UNVERIFIED_PREFIX)) return UNVERIFIED_VERDICT;
+  const trimmed5 = line2.trimStart();
+  if (trimmed5.startsWith(GATE_FAILED_PREFIX)) return FAILED_VERDICT;
+  if (trimmed5.startsWith(GATE_PASSED_PREFIX)) return PASSED_VERDICT;
+  if (trimmed5.startsWith(GATE_UNVERIFIED_PREFIX)) return UNVERIFIED_VERDICT;
   return void 0;
 }
 var josh_verdict = {
@@ -37513,9 +37523,9 @@ function refusal_body(text3) {
   return text3.trimStart().replace(HOOK_ERROR_LABEL, "");
 }
 function guard_from_refusal(text3) {
-  const trimmed3 = refusal_body(text3);
-  if (!trimmed3.startsWith(REFUSAL_MARKER)) return "";
-  const headline = trimmed3.slice(REFUSAL_MARKER.length).split("\n", 1)[0]?.trimStart() ?? "";
+  const trimmed5 = refusal_body(text3);
+  if (!trimmed5.startsWith(REFUSAL_MARKER)) return "";
+  const headline = trimmed5.slice(REFUSAL_MARKER.length).split("\n", 1)[0]?.trimStart() ?? "";
   const colon = headline.indexOf(":");
   return (colon === -1 ? headline : headline.slice(0, colon)).trim();
 }
@@ -38430,7 +38440,7 @@ function describe_span(span) {
 }
 var FOLD_MINIMUM = 2;
 function read_targets(sequence) {
-  const paths2 = sequence.filter((span) => span.is_bundleable && !span.is_writing).map((span) => span.targets[0] ?? "").filter((path77) => path77 !== "" && time_bundle_call.has_extension(path77));
+  const paths2 = sequence.filter((span) => span.is_bundleable && !span.is_writing).map((span) => span.targets[0] ?? "").filter((path78) => path78 !== "" && time_bundle_call.has_extension(path78));
   return [...new Set(paths2)];
 }
 function read_fold_directive(sequence) {
@@ -38439,7 +38449,7 @@ function read_fold_directive(sequence) {
   return ` Fold them into one call: \`pnpm josh read:files ${paths2.join(" ")}\`.`;
 }
 function write_targets(sequence) {
-  const paths2 = sequence.filter((span) => span.label === EDIT_TOOL).map((span) => span.targets[0] ?? "").filter((path77) => path77 !== "" && time_bundle_call.has_extension(path77));
+  const paths2 = sequence.filter((span) => span.label === EDIT_TOOL).map((span) => span.targets[0] ?? "").filter((path78) => path78 !== "" && time_bundle_call.has_extension(path78));
   return [...new Set(paths2)];
 }
 function write_fold_directive(sequence) {
@@ -39533,9 +39543,9 @@ function file_path(flag, value2) {
 }
 function field_source(flag, raw) {
   const value2 = raw.replaceAll(QUOTES, "");
-  const path77 = file_path(flag, value2);
-  if (path77 === void 0) return { kind: "text", value: field_value(value2) };
-  return path77 === STANDARD_INPUT ? void 0 : { kind: "file", value: path77 };
+  const path78 = file_path(flag, value2);
+  if (path78 === void 0) return { kind: "text", value: field_value(value2) };
+  return path78 === STANDARD_INPUT ? void 0 : { kind: "file", value: path78 };
 }
 function field_sources(segment) {
   return flags_of(segment).flatMap(([flag, next]) => {
@@ -39590,16 +39600,16 @@ function placeholder_of(segment, previous = "") {
   if (NUMBER.test(segment)) return "{n}";
   return SHA.test(segment) ? "{sha}" : segment;
 }
-function normalized(path77) {
-  const [bare = ""] = path77.replace(/^\//u, "").split("?", 1);
+function normalized(path78) {
+  const [bare = ""] = path78.replace(/^\//u, "").split("?", 1);
   const segments = bare.split("/");
   const is_repo = segments[0] === OWNER_REPO2[0];
   return segments.map(
     (segment, index) => is_repo && index < OWNER_REPO2.length ? OWNER_REPO2[index] : placeholder_of(segment, segments[index - 1])
   ).join("/");
 }
-function of_api(path77, method = DEFAULT_METHOD) {
-  const bare = normalized(path77);
+function of_api(path78, method = DEFAULT_METHOD) {
+  const bare = normalized(path78);
   return bare === GRAPHQL ? GRAPHQL : `${method.toUpperCase()} ${bare}`;
 }
 function path_of(arguments_) {
@@ -40038,25 +40048,25 @@ function parse_status_line(output2) {
 function status_of_failure(error62) {
   return has_stdout_field(error62) ? parse_status_line(error62.stdout) : void 0;
 }
-async function spawn_gh_api_status(path77, timeout_ms) {
+async function spawn_gh_api_status(path78, timeout_ms) {
   const options = to_spawn_options(timeout_ms);
   try {
     await check_gh_installed();
-    gh_request_tally.count_call(gh_call_kind.of_api(path77));
-    const { stdout } = await execa("gh", ["api", "--include", "--silent", path77], options);
+    gh_request_tally.count_call(gh_call_kind.of_api(path78));
+    const { stdout } = await execa("gh", ["api", "--include", "--silent", path78], options);
     return parse_status_line(stdout);
   } catch (error62) {
     return status_of_failure(error62);
   }
 }
-async function exec_gh_api_status(path77, timeout_ms) {
-  return await gh_slots.run(async () => await spawn_gh_api_status(path77, timeout_ms));
+async function exec_gh_api_status(path78, timeout_ms) {
+  return await gh_slots.run(async () => await spawn_gh_api_status(path78, timeout_ms));
 }
-function exec_gh_api_status_sync(path77, timeout_ms) {
+function exec_gh_api_status_sync(path78, timeout_ms) {
   const options = to_spawn_options(timeout_ms);
-  gh_request_tally.count_call(gh_call_kind.of_api(path77));
+  gh_request_tally.count_call(gh_call_kind.of_api(path78));
   try {
-    const { stdout } = execaSync("gh", ["api", "--include", "--silent", path77], options);
+    const { stdout } = execaSync("gh", ["api", "--include", "--silent", path78], options);
     return parse_status_line(stdout);
   } catch (error62) {
     return status_of_failure(error62);
@@ -40161,9 +40171,9 @@ var HEADER_BODY_SEPARATOR = /\r?\n\r?\n/u;
 var ETAG_HEADER = /^etag: *(?<etag>[^\r\n]+)/imu;
 var UNCHANGED = { kind: "unchanged" };
 var UNREADABLE = { kind: "unreadable" };
-function to_args(path77, etag) {
+function to_args(path78, etag) {
   const header = etag === void 0 ? [] : [HEADER_FLAG, `${IF_NONE_MATCH}${etag}`];
-  return ["api", INCLUDE_FLAG, ...header, path77];
+  return ["api", INCLUDE_FLAG, ...header, path78];
 }
 function to_changed(output2) {
   const [headers = "", ...rest] = output2.split(HEADER_BODY_SEPARATOR);
@@ -40177,27 +40187,27 @@ function failure_status(error62) {
   const cause = error62 instanceof Error ? error62.cause : void 0;
   return has_stdout_field(cause) ? git_gh_exec.parse_status_line(cause.stdout) : void 0;
 }
-function not_modified(path77) {
-  gh_request_tally.count_not_modified(gh_call_kind.of_api(path77));
+function not_modified(path78) {
+  gh_request_tally.count_not_modified(gh_call_kind.of_api(path78));
   return UNCHANGED;
 }
-function rethrow_failure(error62, path77) {
+function rethrow_failure(error62, path78) {
   const status2 = failure_status(error62);
-  if (status2 === NOT_MODIFIED_STATUS) return not_modified(path77);
+  if (status2 === NOT_MODIFIED_STATUS) return not_modified(path78);
   if (status2 !== void 0 && error62 instanceof Error) gh_failure.attach(error62, { status: status2 });
   throw error62;
 }
-async function request_conditional(path77, etag, timeout_ms) {
+async function request_conditional(path78, etag, timeout_ms) {
   try {
-    return to_read(await git_gh_exec.exec_gh_command(to_args(path77, etag), timeout_ms));
+    return to_read(await git_gh_exec.exec_gh_command(to_args(path78, etag), timeout_ms));
   } catch (error62) {
-    return rethrow_failure(error62, path77);
+    return rethrow_failure(error62, path78);
   }
 }
-async function read_conditional(path77, etag, timeout_ms) {
+async function read_conditional(path78, etag, timeout_ms) {
   const retry = timeout_ms === void 0 ? gh_retry.with_read_retry : gh_retry.with_retry;
   try {
-    return await retry(async () => await request_conditional(path77, etag, timeout_ms));
+    return await retry(async () => await request_conditional(path78, etag, timeout_ms));
   } catch (error62) {
     return { kind: "unreadable", cause: error62 };
   }
@@ -40217,32 +40227,32 @@ function settle3(previous, answer2) {
   if (answer2.etag === void 0) return { body: answer2.body };
   return { body: answer2.body, kept: { etag: answer2.etag, body: answer2.body } };
 }
-function slot_of(path77) {
-  const name = stamp_file.digest(path77).slice(0, PATH_DIGEST_LENGTH);
+function slot_of(path78) {
+  const name = stamp_file.digest(path78).slice(0, PATH_DIGEST_LENGTH);
   return { prefix: `${SLOT_PREFIX}${name}-`, ttl_ms: HOURS_KEPT * MS_PER_HOUR };
 }
-function unreadable(path77, answer2) {
+function unreadable(path78, answer2) {
   const cause = answer2.kind === "unreadable" ? answer2.cause : void 0;
-  return cause ?? new Error(`${UNREADABLE_MESSAGE}: ${path77}`);
+  return cause ?? new Error(`${UNREADABLE_MESSAGE}: ${path78}`);
 }
-async function read_detail(path77, timeout_ms) {
-  const slot = slot_of(path77);
-  const previous = shared_cache.read(slot, path77, kept_schema, Date.now());
-  const answer2 = await git_gh_conditional.read_conditional(path77, previous?.etag, timeout_ms);
+async function read_detail(path78, timeout_ms) {
+  const slot = slot_of(path78);
+  const previous = shared_cache.read(slot, path78, kept_schema, Date.now());
+  const answer2 = await git_gh_conditional.read_conditional(path78, previous?.etag, timeout_ms);
   const settled2 = settle3(previous, answer2);
-  if (settled2 === void 0) throw unreadable(path77, answer2);
-  if (settled2.kept !== void 0) shared_cache.write(slot, path77, settled2.kept, Date.now());
+  if (settled2 === void 0) throw unreadable(path78, answer2);
+  if (settled2.kept !== void 0) shared_cache.write(slot, path78, settled2.kept, Date.now());
   return { body: settled2.body, is_unchanged: answer2.kind === "unchanged" };
 }
-async function read6(path77, timeout_ms) {
-  const { body } = await read_detail(path77, timeout_ms);
+async function read6(path78, timeout_ms) {
+  const { body } = await read_detail(path78, timeout_ms);
   return body;
 }
-async function read_listing(path77, per_page, read_page = read6) {
-  const first = await read_page(path77);
+async function read_listing(path78, per_page, read_page = read6) {
+  const first = await read_page(path78);
   const rows = parse_json_array_or_undefined(first, external_exports.unknown());
   if (rows === void 0 || rows.length < per_page) return first;
-  return await git_gh_exec.exec_gh_api({ path: path77, should_paginate: true });
+  return await git_gh_exec.exec_gh_api({ path: path78, should_paginate: true });
 }
 var git_gh_etag_read = { read: read6, read_detail, read_listing, settle: settle3, slot_of };
 
@@ -40268,8 +40278,8 @@ function has_write_role(raw) {
 }
 async function read_permission(asked) {
   try {
-    const path77 = permission_path(asked.login, asked.repo);
-    const raw = await git_gh_etag_read.read(path77, asked.timeout_ms);
+    const path78 = permission_path(asked.login, asked.repo);
+    const raw = await git_gh_etag_read.read(path78, asked.timeout_ms);
     return has_write_role(raw);
   } catch {
     return void 0;
@@ -40319,8 +40329,8 @@ var gh_author_association = {
 
 // scripts/gh/git-gh-helpers.ts
 function parse_pr_state_string(result) {
-  const trimmed3 = result.trim();
-  return trimmed3.length > 0 ? trimmed3 : void 0;
+  const trimmed5 = result.trim();
+  return trimmed5.length > 0 ? trimmed5 : void 0;
 }
 function is_pr_already_exists_message(error_message) {
   return error_message.toLowerCase().includes("already exists");
@@ -40739,18 +40749,18 @@ var git_gh_issue_graphql = {
 // scripts/gh/git-gh-issue-memo.ts
 var FRESH_MS = 1e4;
 var read_by_path = /* @__PURE__ */ new Map();
-function fresh_entry(path77, now_ms) {
-  const entry = read_by_path.get(path77);
+function fresh_entry(path78, now_ms) {
+  const entry = read_by_path.get(path78);
   return entry !== void 0 && now_ms - entry.at_ms < FRESH_MS ? entry : void 0;
 }
-async function read7(path77) {
+async function read7(path78) {
   const now_ms = Date.now();
-  const entry = fresh_entry(path77, now_ms) ?? { read: git_gh_etag_read.read(path77), at_ms: now_ms };
-  read_by_path.set(path77, entry);
+  const entry = fresh_entry(path78, now_ms) ?? { read: git_gh_etag_read.read(path78), at_ms: now_ms };
+  read_by_path.set(path78, entry);
   try {
     return await entry.read;
   } catch (error62) {
-    if (read_by_path.get(path77) === entry) read_by_path.delete(path77);
+    if (read_by_path.get(path78) === entry) read_by_path.delete(path78);
     throw error62;
   }
 }
@@ -40990,9 +41000,9 @@ async function issue_get_labels_and_body(issue_number) {
   return await issue_view_json(issue_number, "number,state,labels,body");
 }
 async function issue_list_comments(issue_number, timeout_ms, repo, read_path) {
-  const path77 = `${git_gh_api_path.issue_comments_api_path(issue_number, repo)}${git_gh_api_path.FULL_PAGE_QUERY}`;
+  const path78 = `${git_gh_api_path.issue_comments_api_path(issue_number, repo)}${git_gh_api_path.FULL_PAGE_QUERY}`;
   try {
-    return await (read_path?.(path77) ?? git_gh_exec.exec_gh_api({ path: path77, should_paginate: true, timeout_ms }));
+    return await (read_path?.(path78) ?? git_gh_exec.exec_gh_api({ path: path78, should_paginate: true, timeout_ms }));
   } catch {
     return void 0;
   }
@@ -41013,8 +41023,8 @@ async function issue_read_with_comments(issue_number, fields, repo) {
     comments_json: graphql.comments_json
   };
 }
-async function read_comments_conditionally(path77) {
-  return await git_gh_etag_read.read_listing(path77, git_gh_api_path.FULL_PAGE_SIZE);
+async function read_comments_conditionally(path78) {
+  return await git_gh_etag_read.read_listing(path78, git_gh_api_path.FULL_PAGE_SIZE);
 }
 async function has_no_relations_endpoint(issue_number, repo) {
   const status2 = await git_gh_exec.exec_gh_api_status(
@@ -41166,6 +41176,7 @@ var issue_watch_diff = {
   RUN_MARKER,
   WITHHELD_BODY_EDIT,
   baseline_of,
+  is_automated,
   landed_times,
   parse_comments,
   unread_diff,
@@ -41561,8 +41572,8 @@ async function review_refusal_here() {
   return await review_refusal(await git_command.repository_root());
 }
 async function assert_read_here() {
-  const refusal4 = await unread_refusal(await git_command.repository_root());
-  if (refusal4 !== void 0) throw new Error(refusal4);
+  const refusal6 = await unread_refusal(await git_command.repository_root());
+  if (refusal6 !== void 0) throw new Error(refusal6);
 }
 var issue_watch_gate = {
   assert_read_here,
@@ -41799,40 +41810,134 @@ function shell_script_index(call) {
 }
 var interpreter_options = { SHELLS, is_inline_execution, shell_script_index, syntax_word };
 
+// scripts/rules/shell-tokens.ts
+var OPERATOR = String.raw`;;&?|;&|&&|\|\||(?<!>)\|&?|;|\n|(?<![<>])&(?!>)`;
+var WORD2 = String.raw`(?:[^\s;&|]|(?<=[<>])&|&(?=>)|(?<=>)\|)+`;
+var TOKEN_PATTERN = new RegExp(`(?<operator>${OPERATOR})|${WORD2}`, "gu");
+var SEPARATOR2 = /[;&|]/gu;
+var HELD = "_";
+var BLANK = " ";
+function tokens_of2(reading) {
+  return [...reading.matchAll(TOKEN_PATTERN)].map((match) => ({
+    begin: match.index,
+    end: match.index + match[0].length,
+    kind: match.groups?.["operator"] === void 0 ? "word" : "operator",
+    text: match[0]
+  }));
+}
+function quote_held(line2) {
+  const plain2 = time_shell.blanked(line2);
+  if (plain2 === void 0) return line2;
+  return line2.replaceAll(
+    SEPARATOR2,
+    (character, offset) => plain2[offset] === BLANK ? HELD : character
+  );
+}
+function words_of4(line2) {
+  return tokens_of2(quote_held(line2)).filter((token) => token.kind === "word").map((token) => ({ ...token, text: line2.slice(token.begin, token.end) }));
+}
+var shell_tokens = { tokens_of: tokens_of2, words_of: words_of4 };
+
 // scripts/rules/shell-segments.ts
-var SEGMENT_SEPARATOR = /&&|\|\||;|\n/u;
-var SEGMENT_PARTS = new RegExp(`(${SEGMENT_SEPARATOR.source})`, "u");
-var COMMAND_SEPARATOR2 = /&&|\|\||;|\n|(?<!>)\|&?|(?<![<>])&(?!>)/u;
+var SEGMENT_OPERATORS = /* @__PURE__ */ new Set(["&&", "||", ";", ";;", ";;&", ";&", "\n"]);
+var COMMAND_OPERATORS = /* @__PURE__ */ new Set([...SEGMENT_OPERATORS, "|", "|&", "&"]);
+var CASE_ARM_ENDS = /* @__PURE__ */ new Set([";;", ";;&", ";&"]);
+var GROUP_OPENER = "{";
+var FUNCTION_HEAD_END = "()";
+var FUNCTION_KEYWORD = "function";
+var FUNCTION_NAME_OFFSET = 2;
+var PATTERN_END = ")";
+var NEWLINE = "\n";
+var PATTERN_LINK = "|";
+var ARM_START = "in";
+var QUOTING2 = /['"]|\\[\s\S]?/gu;
+function is_function_head(tokens, index) {
+  const previous = tokens[index - 1];
+  if (previous?.text.endsWith(FUNCTION_HEAD_END) === true) return true;
+  return tokens[index - FUNCTION_NAME_OFFSET]?.text === FUNCTION_KEYWORD;
+}
+function is_group_opener(tokens, index) {
+  if (tokens[index]?.text !== GROUP_OPENER) return false;
+  const previous = tokens[index - 1];
+  return previous?.kind !== "word" || is_function_head(tokens, index);
+}
+function follows_case_head(tokens, index) {
+  return tokens.slice(0, index).some((token) => token.text === "case");
+}
+function quoting_end(text3) {
+  const quoting = [...text3.matchAll(QUOTING2)].at(-1);
+  return quoting === void 0 ? 0 : quoting.index + quoting[0].length;
+}
+function close_end(text3) {
+  const close2 = text3.indexOf(PATTERN_END, quoting_end(text3));
+  return close2 === -1 ? close2 : close2 + 1;
+}
+function is_pattern_part(token) {
+  if (token.kind === "operator") return token.text === PATTERN_LINK;
+  return token.text !== ARM_START && close_end(token.text) < 0;
+}
+function lead_index(tokens, index) {
+  const start2 = tokens.slice(0, index).findLastIndex((token) => !is_pattern_part(token)) + 1;
+  return tokens.slice(0, start2).findLastIndex((token) => token.text !== NEWLINE);
+}
+function is_arm_lead(tokens, lead_at) {
+  const lead = tokens[lead_at];
+  if (lead === void 0) return false;
+  if (CASE_ARM_ENDS.has(lead.text)) return true;
+  return lead.text === ARM_START && follows_case_head(tokens, lead_at);
+}
+function pattern_cut(tokens, index, token) {
+  const close2 = close_end(token.text);
+  if (close2 < 0 || !is_arm_lead(tokens, lead_index(tokens, index))) return void 0;
+  return { begin: token.begin, end: token.begin + close2 };
+}
+function word_cut(tokens, index, token) {
+  return is_group_opener(tokens, index) ? token : pattern_cut(tokens, index, token);
+}
+function cut_of(tokens, index, operators) {
+  const token = tokens[index];
+  if (token === void 0) return void 0;
+  if (token.kind === "word") return word_cut(tokens, index, token);
+  return operators.has(token.text) ? token : void 0;
+}
+function cuts_of(reading, operators) {
+  const tokens = shell_tokens.tokens_of(reading);
+  return tokens.flatMap((_token, index) => cut_of(tokens, index, operators) ?? []);
+}
+function pieces_of(command3, cuts) {
+  const starts = [0, ...cuts.map((cut) => cut.end)];
+  return starts.map((start2, index) => command3.slice(start2, cuts[index]?.begin ?? command3.length));
+}
+function trimmed2(pieces) {
+  return pieces.map((piece) => piece.trim());
+}
 function segments_of(command3) {
-  return command3.split(SEGMENT_SEPARATOR).map((segment) => segment.trim());
+  return trimmed2(pieces_of(command3, cuts_of(command3, SEGMENT_OPERATORS)));
 }
 function commands_of(command3) {
-  return command3.split(COMMAND_SEPARATOR2).map((segment) => segment.trim());
+  return trimmed2(pieces_of(command3, cuts_of(command3, COMMAND_OPERATORS)));
 }
-var COMMAND_SEPARATORS = new RegExp(COMMAND_SEPARATOR2.source, "gu");
 function quote_aware_commands_of(command3) {
   const plain2 = time_shell.blanked(command3);
   if (plain2 === void 0) return commands_of(command3);
-  const cuts = [...plain2.matchAll(COMMAND_SEPARATORS)].map((match) => ({
-    begin: match.index,
-    end: match.index + match[0].length
-  }));
-  const starts = [0, ...cuts.map((cut) => cut.end)];
-  const stops = cuts.map((cut) => cut.begin);
-  return starts.map((start2, index) => command3.slice(start2, stops[index] ?? command3.length).trim());
+  return trimmed2(pieces_of(command3, cuts_of(plain2, COMMAND_OPERATORS)));
 }
 var LINE_CONTINUATION = /\\\n/gu;
 function joined_continuations(command3) {
   return command3.replaceAll(LINE_CONTINUATION, " ");
 }
 function parts_of(command3) {
-  return command3.split(SEGMENT_PARTS);
+  const cuts = cuts_of(command3, SEGMENT_OPERATORS);
+  return pieces_of(command3, cuts).flatMap((piece, index) => {
+    const cut = cuts[index];
+    return cut === void 0 ? piece : [piece, command3.slice(cut.begin, cut.end)];
+  });
 }
 function first_of(command3) {
   const plain2 = time_shell.blanked(command3);
   if (plain2 === void 0) return void 0;
-  const cut = plain2.search(SEGMENT_SEPARATOR);
-  return (cut === -1 ? command3 : command3.slice(0, cut)).trim();
+  const [cut] = cuts_of(plain2, SEGMENT_OPERATORS);
+  return command3.slice(0, cut?.begin ?? command3.length).trim();
 }
 function is_josh_command(segment, names) {
   const named = time_josh_names.josh_command_of(segment);
@@ -41902,6 +42007,10 @@ import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // scripts/document/document-scan.ts
 var COMMAND_PATTERN = /`(?:pnpm )?josh ([a-z][a-z0-9:-]+)/gu;
+var CODE_SPAN_PATTERN = /`([^`\n]+)`/gu;
+var COMMAND_SEPARATOR_PATTERN = /&&|\|\||[|;]/u;
+var INVOCATION_PATTERN = /\bjosh ([a-z][a-z0-9:-]+)/u;
+var FLAG_PATTERN = /(?<![\w-])--[a-z][a-z0-9-]*/gu;
 var LABEL_PATTERN = /(?:labels\[\]=|\/labels\/|labels -f name=)([a-z][a-z0-9:_-]*)/gu;
 var SECTION_PATTERN = /(?<![\w./:`-])(?<tick>`?)(?<file>[\w./-]+\.md)\k<tick>\s*→\s*(?:§\w+,\s*)?["「](?<heading>[^"」]+)["」]/gu;
 var ADJACENT_PATTERN = /["「](?<heading>[^"「」]+)["」]\s+(?:above|below)\b/gu;
@@ -41915,14 +42024,27 @@ function matches(text3, pattern) {
 function command_references(text3) {
   return matches(text3, COMMAND_PATTERN).map((match) => match[1] ?? "").filter((name) => !name.endsWith(":"));
 }
+function flag_names(text3) {
+  return text3.match(FLAG_PATTERN) ?? [];
+}
+function invocation_flags(segment) {
+  const match = INVOCATION_PATTERN.exec(segment);
+  if (match === null) return [];
+  const [invocation, command3 = ""] = match;
+  const rest = segment.slice(match.index + invocation.length);
+  return flag_names(rest).map((flag) => ({ command: command3, flag }));
+}
+function command_flag_references(text3) {
+  return matches(text3, CODE_SPAN_PATTERN).flatMap((span) => (span[1] ?? "").split(COMMAND_SEPARATOR_PATTERN)).flatMap((segment) => invocation_flags(segment));
+}
 function is_real_label(token) {
   return token.length > 0 && !token.endsWith(":") && !token.includes("<");
 }
 function label_references(text3) {
   return matches(text3, LABEL_PATTERN).map((match) => match[1] ?? "").filter((token) => is_real_label(token));
 }
-function base_name(path77) {
-  return path77.split("/").at(-1) ?? path77;
+function base_name(path78) {
+  return path78.split("/").at(-1) ?? path78;
 }
 function is_placeholder_file(name) {
   return name.includes("<") || PLACEHOLDER_FILES.has(base_name(name).toLowerCase());
@@ -41953,7 +42075,9 @@ function reference_forms(title) {
 var document_scan = {
   adjacent_references,
   bare_arrow_references,
+  command_flag_references,
   command_references,
+  flag_names,
   label_references,
   link_targets,
   normalize_reference,
@@ -41967,7 +42091,7 @@ var FENCE = "```";
 var SINGLE_MATCH = 1;
 var BOLD_LABEL_PATTERN = /\*\*([^*]+?)\*\*/gu;
 var BOLD_DELIMITER = "**";
-var CODE_SPAN_PATTERN = /``[^\n]*?``|`[^`\n]*`/gu;
+var CODE_SPAN_PATTERN2 = /``[^\n]*?``|`[^`\n]*`/gu;
 var LABEL_LEVEL = 7;
 var LIST_ITEM_PATTERN = /^(?<indent>\s*)(?:[-*]|\d+\.) /u;
 function to_heading(line2, index) {
@@ -42012,7 +42136,7 @@ function unfenced_text(markdown) {
   return lines.map((line2, index) => fenced[index] === true ? "" : line2).join("\n");
 }
 function code_masked(text3) {
-  return text3.replaceAll(CODE_SPAN_PATTERN, (span) => span.replaceAll("*", " "));
+  return text3.replaceAll(CODE_SPAN_PATTERN2, (span) => span.replaceAll("*", " "));
 }
 function labels(markdown) {
   const text3 = unfenced_text(markdown);
@@ -42140,6 +42264,22 @@ var GATE_STEPS_SCHEMA = external_exports.array(GATE_STEP_SCHEMA).refine((steps)
   message: "step names must be unique"
 });
 var GATE_SCHEMA = external_exports.object({ steps: GATE_STEPS_SCHEMA.optional() });
+var WORKER_PROFILE_SCHEMA = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  model: external_exports.string().min(1),
+  effort: external_exports.string().min(1),
+  when: external_exports.string().min(1)
+});
+var WORKER_PROFILES_SCHEMA = external_exports.array(WORKER_PROFILE_SCHEMA).min(1).refine((profiles) => new Set(profiles.map((profile) => profile.name)).size === profiles.length, {
+  message: "profile names must be unique"
+});
+var WORKER_SCHEMA = external_exports.strictObject({
+  default: external_exports.string().min(1),
+  escalate: external_exports.boolean().default(false),
+  profiles: WORKER_PROFILES_SCHEMA
+}).refine((worker) => worker.profiles.some((profile) => profile.name === worker.default), {
+  message: "default must name one of the profiles"
+});
 var josh_schemas = {
   format: external_exports.object({ josh: external_exports.object({ format: FORMAT_SCHEMA.optional() }).optional() }),
   gate_steps: external_exports.object({ josh: external_exports.object({ gate: GATE_SCHEMA.optional() }).optional() }),
@@ -42147,7 +42287,8 @@ var josh_schemas = {
   progress_interval_minutes: external_exports.object({
     josh: external_exports.object({ progress_interval_minutes: external_exports.number().positive() }).optional()
   }),
-  review_gate: external_exports.object({ josh: external_exports.object({ review_gate: REVIEW_GATE_SCHEMA }).optional() })
+  review_gate: external_exports.object({ josh: external_exports.object({ review_gate: REVIEW_GATE_SCHEMA }).optional() }),
+  worker: external_exports.object({ josh: external_exports.object({ worker: WORKER_SCHEMA.optional() }).optional() })
 };
 function manifest_path(directory) {
   return path35.join(directory, PACKAGE_JSON);
@@ -42381,28 +42522,63 @@ var consultation_handoff = {
   is_handoff_call
 };
 
+// scripts/agent/agent-phase-profile.ts
+var { OPENAI_PROVIDER: OPENAI_PROVIDER3, trimmed: trimmed3 } = agent_provider;
+var { PHASE_SCHEMA: PHASE_SCHEMA2, PRE_GATE_PHASE: PRE_GATE_PHASE2 } = agent_profile_schema;
+var SONNET_MODEL = "claude-sonnet-5-5";
+var SHIP_EFFORT = "low";
+var PHASE_EFFORT = {
+  worker: { [PRE_GATE_PHASE2]: SHIP_EFFORT }
+};
+var PHASE_MODELS = {
+  worker: { [PRE_GATE_PHASE2]: { key: "JOSH_WORKER_SHIP_MODEL", value: SONNET_MODEL } }
+};
+function phase_model_keys() {
+  return Object.values(PHASE_MODELS).flatMap(
+    (phases) => Object.values(phases).map(({ key: key3 }) => key3)
+  );
+}
+function phase_entry(table, role, phase) {
+  const parsed = PHASE_SCHEMA2.safeParse(phase);
+  return parsed.success ? table[role]?.[parsed.data] : void 0;
+}
+function phase_model(role, provider, phase, environment3) {
+  const entry = provider === OPENAI_PROVIDER3 ? void 0 : phase_entry(PHASE_MODELS, role, phase);
+  if (entry === void 0) return void 0;
+  return { key: entry.key, value: trimmed3(environment3[entry.key]) ?? entry.value };
+}
+function phase_effort(role, phase, fallback) {
+  return phase_entry(PHASE_EFFORT, role, phase) ?? fallback;
+}
+var agent_phase_profile = {
+  SONNET_MODEL,
+  phase_effort,
+  phase_model,
+  phase_model_keys
+};
+
 // scripts/agent/agent-role-profile.ts
 var {
   CODEX_SESSION_KEY: CODEX_SESSION_KEY2,
   HANDED_PROVIDER_KEY: HANDED_PROVIDER_KEY2,
-  OPENAI_PROVIDER: OPENAI_PROVIDER3,
+  OPENAI_PROVIDER: OPENAI_PROVIDER4,
   default_notice: default_notice2,
   handoff_environment: handoff_environment2,
   has_completion_callback: has_completion_callback2,
   rejection: rejection2,
   resolve_provider: resolve_provider2,
-  trimmed: trimmed2,
+  trimmed: trimmed4,
   warn_of_default: warn_of_default2
 } = agent_provider;
 var { consultation_provider: consultation_provider2 } = agent_consultation_model;
+var { SONNET_MODEL: SONNET_MODEL2, phase_effort: phase_effort2, phase_model: phase_model2, phase_model_keys: phase_model_keys2 } = agent_phase_profile;
 var {
   DEFAULT_PROFILES: DEFAULT_PROFILES2,
   EFFORT_SCHEMA: EFFORT_SCHEMA2,
   IMPLEMENTATION_PHASE: IMPLEMENTATION_PHASE2,
   OPENAI_MODEL: OPENAI_MODEL2,
   OPENAI_PROFILES: OPENAI_PROFILES2,
-  PHASE_SCHEMA: PHASE_SCHEMA2,
-  PRE_GATE_PHASE: PRE_GATE_PHASE2,
+  PRE_GATE_PHASE: PRE_GATE_PHASE3,
   REVIEWER: REVIEWER2,
   SCHEDULER: SCHEDULER2,
   WORKER: WORKER2,
@@ -42412,13 +42588,12 @@ var {
 var VERIFICATION_EFFORT = "high";
 var PROVIDER_PROFILES = { anthropic: DEFAULT_PROFILES2, openai: OPENAI_PROFILES2 };
 var FIRST_REVIEW_ROUND = 1;
-var SONNET_MODEL = "claude-sonnet-5-5";
 var VERIFICATION_PROFILES = {
   anthropic: {
     ...DEFAULT_PROFILES2.reviewer,
     // Sonnet holds the verification pass by the eval criterion: on every `verification-fix-*`
     // scenario its pass/fail equals Opus's (100% agreement), and Opus passes all 4.
-    model: SONNET_MODEL,
+    model: SONNET_MODEL2,
     effort: VERIFICATION_EFFORT
   },
   openai: { ...OPENAI_PROFILES2.reviewer, effort: VERIFICATION_EFFORT }
@@ -42428,33 +42603,21 @@ var VERIFICATION_KEYS = {
   effort: "JOSH_REVIEWER_VERIFICATION_EFFORT"
 };
 var INVESTIGATION_MODELS = {
-  anthropic: SONNET_MODEL,
+  anthropic: SONNET_MODEL2,
   openai: OPENAI_MODEL2
 };
 var INVESTIGATION_MODEL_KEY = "JOSH_INVESTIGATION_MODEL";
-var SHIP_EFFORT = "low";
-var PHASE_EFFORT = {
-  worker: { [PRE_GATE_PHASE2]: SHIP_EFFORT }
-};
-var PHASE_MODELS = {
-  worker: { [PRE_GATE_PHASE2]: { key: "JOSH_WORKER_SHIP_MODEL", value: SONNET_MODEL } }
-};
 var ENV_KEYS = {
   scheduler: { model: "JOSH_SCHEDULER_MODEL", effort: "JOSH_SCHEDULER_EFFORT" },
   worker: { model: "JOSH_WORKER_MODEL", effort: "JOSH_WORKER_EFFORT" },
   reviewer: { model: "JOSH_REVIEWER_MODEL", effort: "JOSH_REVIEWER_EFFORT" }
 };
 var LEGACY_WORKER_KEYS = { model: "JOSH_LANE_MODEL", effort: "JOSH_LANE_EFFORT" };
-function phase_model_keys() {
-  return Object.values(PHASE_MODELS).flatMap(
-    (phases) => Object.values(phases).map(({ key: key3 }) => key3)
-  );
-}
 var PROFILE_KEYS = [
   ...Object.values(ENV_KEYS).flatMap((keys) => [keys.model, keys.effort]),
   ...Object.values(LEGACY_WORKER_KEYS),
   ...Object.values(VERIFICATION_KEYS),
-  ...phase_model_keys(),
+  ...phase_model_keys2(),
   INVESTIGATION_MODEL_KEY
 ];
 var { MAX_VALUE_LENGTH: MAX_VALUE_LENGTH2, is_safe_prompt: is_safe_prompt2, is_safe_value: is_safe_value3 } = agent_safe_text;
@@ -42468,22 +42631,13 @@ function override_keys(role, field2, round) {
 }
 function override_value(role, field2, environment3, round) {
   const keys = override_keys(role, field2, round);
-  const key3 = keys.find((candidate) => trimmed2(environment3[candidate]) !== void 0);
-  return key3 === void 0 ? { key: keys[0], value: void 0 } : { key: key3, value: trimmed2(environment3[key3]) };
-}
-function phase_entry(table, role, phase) {
-  const parsed = PHASE_SCHEMA2.safeParse(phase);
-  return parsed.success ? table[role]?.[parsed.data] : void 0;
-}
-function phase_model(role, provider, phase, environment3) {
-  const entry = provider === OPENAI_PROVIDER3 ? void 0 : phase_entry(PHASE_MODELS, role, phase);
-  if (entry === void 0) return void 0;
-  return { key: entry.key, value: trimmed2(environment3[entry.key]) ?? entry.value };
+  const key3 = keys.find((candidate) => trimmed4(environment3[candidate]) !== void 0);
+  return key3 === void 0 ? { key: keys[0], value: void 0 } : { key: key3, value: trimmed4(environment3[key3]) };
 }
 function model_override(role, environment3, provider, stage) {
-  const phased = phase_model(role, provider, stage.phase, environment3);
+  const phased = phase_model2(role, provider, stage.phase, environment3);
   if (phased !== void 0) return phased;
-  return provider === OPENAI_PROVIDER3 ? { key: ENV_KEYS[role].model, value: void 0 } : override_value(role, "model", environment3, stage.round);
+  return provider === OPENAI_PROVIDER4 ? { key: ENV_KEYS[role].model, value: void 0 } : override_value(role, "model", environment3, stage.round);
 }
 function resolved_effort(override, fallback) {
   const parsed = EFFORT_SCHEMA2.safeParse(override.value ?? fallback);
@@ -42498,16 +42652,13 @@ function validate2(profile, model_key) {
   }
   return { kind: "profile", profile };
 }
-function phase_effort(role, phase, fallback) {
-  return phase_entry(PHASE_EFFORT, role, phase) ?? fallback;
-}
 function overridden_effort(profile, phase, environment3) {
   const parsed = EFFORT_SCHEMA2.safeParse(override_value(profile.role, "effort", environment3).value);
-  return parsed.success ? parsed.data : phase_effort(profile.role, phase, profile.effort);
+  return parsed.success ? parsed.data : phase_effort2(profile.role, phase, profile.effort);
 }
 function with_phase(profile, phase, environment3 = process.env) {
   const effort = overridden_effort(profile, phase, environment3);
-  const model = phase_model(profile.role, profile.provider, phase, environment3);
+  const model = phase_model2(profile.role, profile.provider, phase, environment3);
   if (model === void 0) return { kind: "profile", profile: { ...profile, effort } };
   return validate2({ ...profile, model: model.value, effort }, model.key);
 }
@@ -42520,7 +42671,7 @@ function resolve_stage(role, environment3, stage) {
   const defaults = stage_defaults(selected.provider, role, stage.round);
   const model = model_override(role, environment3, selected.provider, stage);
   const effort = override_value(role, "effort", environment3, stage.round);
-  const resolved4 = resolved_effort(effort, phase_effort(role, stage.phase, defaults.effort));
+  const resolved4 = resolved_effort(effort, phase_effort2(role, stage.phase, defaults.effort));
   if (resolved4.kind === "rejected") return resolved4;
   const profile = {
     provider: selected.provider,
@@ -42536,15 +42687,15 @@ function resolve2(role, environment3 = process.env, phase) {
 function reduced_review(result, environment3) {
   if (result.kind === "rejected") return result;
   const { profile } = result;
-  if (profile.provider !== "anthropic" || trimmed2(environment3["JOSH_REVIEWER_MODEL"])) return result;
-  return { kind: "profile", profile: { ...profile, model: SONNET_MODEL } };
+  if (profile.provider !== "anthropic" || trimmed4(environment3["JOSH_REVIEWER_MODEL"])) return result;
+  return { kind: "profile", profile: { ...profile, model: SONNET_MODEL2 } };
 }
 function resolve_review(round, environment3 = process.env, is_reduced = false) {
   const result = resolve_stage(REVIEWER2, environment3, { round });
   return is_reduced && round === FIRST_REVIEW_ROUND ? reduced_review(result, environment3) : result;
 }
 function investigation_model(provider, environment3 = process.env) {
-  const override = provider === OPENAI_PROVIDER3 ? void 0 : trimmed2(environment3[INVESTIGATION_MODEL_KEY]);
+  const override = provider === OPENAI_PROVIDER4 ? void 0 : trimmed4(environment3[INVESTIGATION_MODEL_KEY]);
   return override ?? INVESTIGATION_MODELS[provider];
 }
 var agent_role_profile = {
@@ -42555,7 +42706,7 @@ var agent_role_profile = {
   INVESTIGATION_MODEL_KEY,
   MAX_VALUE_LENGTH: MAX_VALUE_LENGTH2,
   OPENAI_PROFILES: OPENAI_PROFILES2,
-  PRE_GATE_PHASE: PRE_GATE_PHASE2,
+  PRE_GATE_PHASE: PRE_GATE_PHASE3,
   PROFILE_KEYS,
   REVIEWER: REVIEWER2,
   SCHEDULER: SCHEDULER2,
@@ -42572,6 +42723,7 @@ var agent_role_profile = {
   resolve: resolve2,
   resolve_provider: resolve_provider2,
   resolve_review,
+  validate: validate2,
   warn_of_default: warn_of_default2,
   with_phase
 };
@@ -42595,7 +42747,6 @@ var LINE_COUNT_PREFIXES = ["--lines=", "-n", "-"];
 var DIGITS = /^\d+$/u;
 var FROM_LINE = /^\+\d+$/u;
 var QUOTES2 = /^['"]|['"]$/gu;
-var WHITESPACE2 = /\s+/u;
 var ASSIGNMENT = /^\w+=/u;
 var ALWAYS_BROAD = /* @__PURE__ */ new Set(["find", "for", "node", "python", "python3"]);
 var ANALYSIS_PREFIX = "josh cost:";
@@ -42667,8 +42818,8 @@ var COMMAND_TESTS = /* @__PURE__ */ new Map([
   ["tail", ends_past_cap],
   ["cat", cat_reads_past_cap]
 ]);
-function words_of4(segment) {
-  const words = segment.split(WHITESPACE2).map((word2) => word2.replaceAll(QUOTES2, ""));
+function words_of5(segment) {
+  const words = shell_tokens.words_of(segment).map((word2) => word2.text.replaceAll(QUOTES2, ""));
   const start2 = words.findIndex((word2) => !ASSIGNMENT.test(word2));
   return start2 === -1 ? [] : words.slice(start2);
 }
@@ -42681,7 +42832,7 @@ function reads_past_cap(segment, name, rest, is_piped) {
 }
 function is_broad_segment(segment, is_piped) {
   if (time_josh_names.josh_command_of(segment).startsWith(ANALYSIS_PREFIX)) return true;
-  const [name = "", ...rest] = words_of4(segment);
+  const [name = "", ...rest] = words_of5(segment);
   return ALWAYS_BROAD.has(name) || reads_past_cap(segment, name, rest, is_piped);
 }
 function is_broad_pipeline(pipeline) {
@@ -42762,7 +42913,7 @@ function is_broad_investigation(call) {
 var broad_investigation = { READ_LINE_CAP: READ_LINE_CAP2, is_broad_investigation, is_delegated_investigation };
 
 // scripts/rules/consultation-investigation.ts
-var { ANTHROPIC_PROVIDER: ANTHROPIC_PROVIDER4, OPENAI_PROVIDER: OPENAI_PROVIDER4 } = agent_provider;
+var { ANTHROPIC_PROVIDER: ANTHROPIC_PROVIDER4, OPENAI_PROVIDER: OPENAI_PROVIDER5 } = agent_provider;
 var { READ_LINE_CAP: READ_LINE_CAP3, is_broad_investigation: is_broad_investigation2, is_delegated_investigation: is_delegated_investigation2 } = broad_investigation;
 var DELEGATION = ".claude/skills/workflow-commands/delegation.md";
 var TOPIC = `\`${DELEGATION}\` \u2192 "A consultation main line hands its investigation to a unit"`;
@@ -42805,7 +42956,7 @@ var ROW4 = row("consultation-investigation", ANTHROPIC_PROVIDER4, "an `investiga
   fires: "a broad investigation call \u2014 `Glob`, `WebFetch`, a `Read` past the line cap, a tree `Grep` or shell search, an investigation dispatch inheriting the model \u2014 on the consultation main line on Opus or Fable. Every occurrence",
   quiet: QUIET
 });
-var CODEX_ROW = row("consultation-investigation-codex", OPENAI_PROVIDER4, "a Codex subagent", {
+var CODEX_ROW = row("consultation-investigation-codex", OPENAI_PROVIDER5, "a Codex subagent", {
   title: "Consultation main line delegates investigation (Codex)",
   topic: TOPIC,
   fires: "a broad shell investigation on the consultation main line on Codex Astra. Every occurrence",
@@ -43113,7 +43264,7 @@ var core_weights = { CORE_WEIGHTS, ESLINT_HEAP_MIB, MEASURED, MEMORY_MB, TOOL_ME
 // scripts/gate/command-memory.ts
 var JOSH_PROGRAM = "josh";
 var RESERVED_RUN = "reserved-run";
-var COMMAND_SEPARATOR3 = "--";
+var COMMAND_SEPARATOR2 = "--";
 var ESLINT = "eslint";
 var VITEST = "vitest";
 var AUTO_WORKERS = "auto";
@@ -43128,7 +43279,7 @@ var WORKER_FLAGS = {
 };
 function wrapped_command_of(call) {
   if (call.name !== JOSH_PROGRAM || call.args[0] !== RESERVED_RUN) return void 0;
-  const separator = call.args.indexOf(COMMAND_SEPARATOR3);
+  const separator = call.args.indexOf(COMMAND_SEPARATOR2);
   return separator === -1 ? void 0 : call.args.slice(separator + 1).join(" ");
 }
 function reading_of(segment, is_reserved) {
@@ -43254,6 +43405,36 @@ var ROW8 = {
 };
 var direct_git_status = { DIRECT_GIT_STATUS_REASON, ROW: ROW8, is_covered_status };
 
+// scripts/rules/direct-issue-comment.ts
+import path39 from "node:path";
+
+// scripts/rules/standalone-gh-call.ts
+var WORD_SEPARATOR3 = " ";
+var PLAIN_WORD = /^[\w./=-]+$/u;
+function line_of2(words) {
+  return words.join(WORD_SEPARATOR3);
+}
+function is_plain_word(word2) {
+  return PLAIN_WORD.test(word2);
+}
+function split_issue(rest) {
+  const issues = rest.filter((word2) => issue_number_shape.is_issue_number(word2));
+  const [issue3] = issues;
+  const flags = line_of2(rest.filter((word2) => !issue_number_shape.is_issue_number(word2)));
+  return issue3 !== void 0 && issues.length === 1 ? { issue: issue3, flags } : void 0;
+}
+function call_of(line2, lead) {
+  const words = line2.trim().split(WORD_SEPARATOR3);
+  const is_lead = line_of2(words.slice(0, lead.length)) === line_of2(lead);
+  return is_lead && words.every((word2) => is_plain_word(word2)) ? split_issue(words.slice(lead.length)) : void 0;
+}
+function input_of(call, command_of3) {
+  if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return void 0;
+  const command3 = command_of3(time_shell.bash_command(call.input));
+  return command3 === void 0 ? void 0 : { ...call.input, command: command3 };
+}
+var standalone_gh_call = { call_of, input_of, is_plain_word, line_of: line_of2 };
+
 // scripts/rules/direct-issue-comment.ts
 var ISSUE_GROUP = "issue";
 var COMMENT_ACTION = "comment";
@@ -43313,6 +43494,28 @@ function is_any_comment(command3) {
   return is_direct_issue_comment(command3) || is_josh_comment(command3);
 }
 var DIRECT_ISSUE_COMMENT_REASON = "\u26D4 direct issue comment: `gh issue comment` (or a `gh api` write to `\u2026/issues/<N>/comments`) posts without the run marker, so the run reads its own comment as a person updating the issue \u2014 the review goes stale and `pnpm josh followup` refuses the merge. Post with `pnpm josh issue:comment <N> --body-file <path>` instead (`shell-body.md`). **This rule fires on every occurrence, not once per run.**";
+var COMMENT_WORDS = ["gh", ISSUE_GROUP, COMMENT_ACTION];
+var BODY_FILE_SPELLING = /^(?:(?:-F|--body-file) |--body-file=)(?<file>[\w./-]+)$/u;
+var STDIN_PATH = "-";
+var ISSUE_COMMENT_COMMAND = "pnpm josh issue:comment";
+var BODY_FILE_FLAG = "--body-file";
+function body_file_of(flags, cwd) {
+  const file2 = BODY_FILE_SPELLING.exec(flags)?.groups?.["file"];
+  return file2 === void 0 || file2 === STDIN_PATH ? void 0 : path39.resolve(cwd, file2);
+}
+function issue_comment_of(comment, cwd) {
+  const resolved4 = body_file_of(comment.flags, cwd);
+  return resolved4 !== void 0 && standalone_gh_call.is_plain_word(resolved4) ? standalone_gh_call.line_of([ISSUE_COMMENT_COMMAND, comment.issue, BODY_FILE_FLAG, resolved4]) : void 0;
+}
+function issue_comment_command(command3, context) {
+  const comment = standalone_gh_call.call_of(command3, COMMENT_WORDS);
+  const post = comment === void 0 ? void 0 : issue_comment_of(comment, context.cwd);
+  return post !== void 0 && is_direct_issue_comment_in(command3.trim(), context) ? post : void 0;
+}
+function issue_comment_input(call, _tail, context) {
+  return standalone_gh_call.input_of(call, (command3) => issue_comment_command(command3, context));
+}
+var ISSUE_COMMENT_NOTE = "\u21BB direct issue comment: this `gh issue comment <N> --body-file <path>` ran as `pnpm josh issue:comment <N> --body-file <path>`, which posts the run marker (`shell-body.md`).";
 var ROW9 = {
   id: "direct-issue-comment",
   is_trigger: bash_triggers.on_bash_command(is_direct_issue_comment_in),
@@ -43320,14 +43523,22 @@ var ROW9 = {
   decide: () => true,
   keeps: bash_triggers.on_bash_command(is_josh_comment),
   reaches: bash_triggers.on_bash_command(is_any_comment),
+  rewrite: issue_comment_input,
+  rewrite_note: ISSUE_COMMENT_NOTE,
   about: {
     title: "Direct issue comment",
     topic: "`shell-body.md`",
-    fires: "a comment to the checkout's own repository outside `josh issue:comment` (`gh issue comment` with no `--repo`, or a `gh api` write to `repos/<owner>/<r>/issues/<N>/comments` whose owner is the `{owner}` placeholder or the checkout's own `owner/repo` spelled out); it points at `pnpm josh issue:comment`. Every occurrence",
+    fires: "a comment to the checkout's own repository outside `josh issue:comment` (`gh issue comment` with no `--repo`, or a `gh api` write to `repos/<owner>/<r>/issues/<N>/comments` whose owner is the `{owner}` placeholder or the checkout's own `owner/repo` spelled out); it points at `pnpm josh issue:comment`. A line that is only `gh issue comment <N>` with one `--body-file` / `-F <path>` is rewritten to `pnpm josh issue:comment <N> --body-file <path>`; every other form is refused, every occurrence",
     quiet: "`pnpm josh issue:comment`, or reading the comments \u2014 the path that writes the run marker"
   }
 };
-var direct_issue_comment = { DIRECT_ISSUE_COMMENT_REASON, ROW: ROW9, is_direct_issue_comment };
+var direct_issue_comment = {
+  DIRECT_ISSUE_COMMENT_REASON,
+  ISSUE_COMMENT_NOTE,
+  ROW: ROW9,
+  is_direct_issue_comment,
+  issue_comment_command
+};
 
 // scripts/rules/tail-commands.ts
 function is_bash_use(block) {
@@ -43441,9 +43652,9 @@ function rewritable_path(command3) {
 }
 function comments_command(command3) {
   if (!is_body_only_issue_read(command3)) return void 0;
-  const path77 = rewritable_path(command3);
-  if (path77 === void 0) return void 0;
-  return `gh api --paginate ${path77}/comments --jq ${COMMENTS_JQ}
+  const path78 = rewritable_path(command3);
+  if (path78 === void 0) return void 0;
+  return `gh api --paginate ${path78}/comments --jq ${COMMENTS_JQ}
 ${command3}`;
 }
 function comments_input(call, tail) {
@@ -43571,6 +43782,28 @@ function is_josh_read(command3) {
 function is_any_read(command3) {
   return is_direct_issue_read(command3) || is_josh_read(command3);
 }
+var VIEW_WORDS = ["gh", ISSUE_GROUP2, VIEW_ACTION];
+var REPO_SPELLING = /^(?:(?:-R|--repo) |--repo=)(?<repo>[\w.-]+\/[\w.-]+)$/u;
+var ISSUE_READ_COMMAND2 = "pnpm josh issue:read";
+var REPO_FLAG = "--repo";
+function carried_repo(flags) {
+  if (flags === "") return [];
+  const repo = REPO_SPELLING.exec(flags)?.groups?.["repo"];
+  return repo === void 0 ? void 0 : [REPO_FLAG, repo];
+}
+function issue_read_of(view2) {
+  const repo = carried_repo(view2.flags);
+  return repo === void 0 ? void 0 : standalone_gh_call.line_of([ISSUE_READ_COMMAND2, view2.issue, ...repo]);
+}
+function issue_read_command(command3) {
+  const view2 = standalone_gh_call.call_of(command3, VIEW_WORDS);
+  const read14 = view2 === void 0 ? void 0 : issue_read_of(view2);
+  return read14 !== void 0 && is_direct_issue_read(command3.trim()) ? read14 : void 0;
+}
+function issue_read_input(call) {
+  return standalone_gh_call.input_of(call, issue_read_command);
+}
+var ISSUE_READ_NOTE = "\u21BB direct issue read: this `gh issue view <N>` ran as `pnpm josh issue:read <N>`, which withholds a comment from an author without write access (`issue-comments.md`).";
 var DIRECT_ISSUE_READ_REASON = "\u26D4 direct issue read: pnpm josh issue:read <N>\nRun that in place of this read of `\u2026/issues/<N>`, its comments or its timeline (`gh api` or `gh issue view`) \u2014 it withholds a comment from an author without write access and marks an untrusted body as a report, which a raw read prints whole as if it were an instruction (`issue-comments.md`). **This rule fires on every occurrence, not once per run.**";
 var ROW11 = {
   id: "direct-issue-read",
@@ -43579,14 +43812,22 @@ var ROW11 = {
   decide: () => true,
   keeps: bash_triggers.on_bash_command(is_josh_read),
   reaches: bash_triggers.on_bash_command(is_any_read),
+  rewrite: issue_read_input,
+  rewrite_note: ISSUE_READ_NOTE,
   about: {
     title: "Direct issue read",
     topic: "`issue-comments.md`",
-    fires: "a `gh api` GET of the checkout's own `repos/<o>/<r>/issues/<N>`, `\u2026/comments` or `\u2026/timeline` (the `{owner}` placeholder or the origin spelled out), or a `gh issue view <N>` of it, with no projection or one naming the body (or, for the view, the comments); it points at `pnpm josh issue:read`. Every occurrence",
+    fires: "a `gh api` GET of the checkout's own `repos/<o>/<r>/issues/<N>`, `\u2026/comments` or `\u2026/timeline` (the `{owner}` placeholder or the origin spelled out), or a `gh issue view <N>` of it, with no projection or one naming the body (or, for the view, the comments); it points at `pnpm josh issue:read`. A line that is only `gh issue view <N>`, with at most `-R` / `--repo <owner>/<repo>`, is rewritten to `pnpm josh issue:read <N>`; every other form is refused, every occurrence",
     quiet: "`pnpm josh issue:read` / `run:prep` / `run:entry`, a `--jq` / `--json` projection without the body or the comments, `gh issue view --web`, or another repository named outright"
   }
 };
-var direct_issue_read = { DIRECT_ISSUE_READ_REASON, ROW: ROW11, is_direct_issue_read };
+var direct_issue_read = {
+  DIRECT_ISSUE_READ_REASON,
+  ISSUE_READ_NOTE,
+  ROW: ROW11,
+  is_direct_issue_read,
+  issue_read_command
+};
 
 // scripts/rules/direct-vitest-run.ts
 var VITEST_PROGRAM = "vitest";
@@ -43920,7 +44161,7 @@ var run_progress_config = {
 
 // scripts/rules/early-heartbeat.ts
 var ARM_PREFIX = "josh-heartbeat-arm-";
-var SEGMENT_SEPARATOR2 = /&&|\|\||;|&|\n/u;
+var SEGMENT_SEPARATOR = /&&|\|\||;|&|\n/u;
 var SLEEP_SEGMENT = /^sleep\s+(\d+(?:\.\d+)?)([smhd]?)$/u;
 var INERT_SEGMENT = /^(?::|true|(?:echo|printf|date)\b.*)$/u;
 var LOOP_KEYWORD = /\b(?:while|until|for|do|done)\b/u;
@@ -43931,7 +44172,7 @@ var UNIT_GROUP = 2;
 var NO_SECONDS = 0;
 var ARM_RECORD = hook_decision.create_refusal_stamp(ARM_PREFIX);
 function segments_of2(command3) {
-  return command3.split(SEGMENT_SEPARATOR2).map((segment) => segment.trim()).filter((segment) => segment !== "");
+  return command3.split(SEGMENT_SEPARATOR).map((segment) => segment.trim()).filter((segment) => segment !== "");
 }
 function sleep_seconds(segment) {
   const matched = SLEEP_SEGMENT.exec(segment);
@@ -44062,10 +44303,10 @@ function is_interpreter_write(segment, body) {
 }
 var PERL = "perl";
 var PERL_IN_PLACE = /^-[A-Za-z0-9]*i/u;
-var WHITESPACE3 = /\s+/u;
+var WHITESPACE2 = /\s+/u;
 function is_in_place_perl(segment) {
   if (time_shell.leading_word(segment) !== PERL) return false;
-  return segment.split(WHITESPACE3).some((word2) => PERL_IN_PLACE.test(word2));
+  return segment.split(WHITESPACE2).some((word2) => PERL_IN_PLACE.test(word2));
 }
 function has_body_interpreter(line2) {
   return shell_segments.segments_of(line2.text).some((segment) => is_interpreter_write(segment, line2.body) || is_in_place_perl(segment));
@@ -44463,11 +44704,11 @@ var git_force = {
 };
 
 // scripts/rules/implementation-cut.ts
-import path42 from "node:path";
+import path43 from "node:path";
 
 // scripts/cost-runtime/codex-usage.ts
 import { globSync, readFileSync as readFileSync16 } from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 var THREAD_ID_PATTERN = /^[A-Za-z0-9-]+$/u;
 var SESSION_META_SCHEMA = external_exports.looseObject({
   type: external_exports.literal("session_meta"),
@@ -44509,7 +44750,7 @@ function measurement_from(content, target3, thread_id) {
 function rollout_files(home, thread_id) {
   if (!THREAD_ID_PATTERN.test(thread_id)) return [];
   return globSync(`sessions/**/*${thread_id}.jsonl`, { cwd: home }).map(
-    (file2) => path39.join(home, file2)
+    (file2) => path40.join(home, file2)
   );
 }
 function read_measurement(file2, target3, thread_id) {
@@ -44529,7 +44770,7 @@ function latest_measurement(files2, target3, thread_id) {
 function measurement(target3, default_home, environment3 = process.env) {
   const thread_id = environment3["CODEX_THREAD_ID"];
   if (thread_id === void 0) return void 0;
-  const home = environment3["CODEX_HOME"] ?? path39.join(default_home, ".codex");
+  const home = environment3["CODEX_HOME"] ?? path40.join(default_home, ".codex");
   return latest_measurement(rollout_files(home, thread_id), target3, thread_id);
 }
 var codex_usage = { measurement };
@@ -44827,9 +45068,9 @@ var cost_verdict = {
 };
 
 // scripts/cost-runtime/transcript-cwd.ts
-import path40 from "node:path";
+import path41 from "node:path";
 function resolve3(target3, cwd) {
-  return target3 === void 0 ? cwd : path40.resolve(target3);
+  return target3 === void 0 ? cwd : path41.resolve(target3);
 }
 var transcript_cwd = { resolve: resolve3 };
 
@@ -44855,8 +45096,8 @@ function limit_of(limit, measurement2) {
 function threshold_option(over) {
   return over === void 0 ? {} : { over };
 }
-function path_option(path77) {
-  return path77 === void 0 ? {} : { path: path77 };
+function path_option(path78) {
+  return path78 === void 0 ? {} : { path: path78 };
 }
 function cut_options(values) {
   return values.over === void 0 ? { over: CUT_LIMIT, ...path_option(values.path) } : void 0;
@@ -45327,7 +45568,7 @@ function release2(target3, cut, issue3) {
 var run_cut_adoption = { can_replace, release: release2, session };
 
 // scripts/run/cut/run-cut-digest.ts
-import path41 from "node:path";
+import path42 from "node:path";
 var session_digest_schema = external_exports.object({
   read: external_exports.array(external_exports.string()),
   decisions: external_exports.array(external_exports.string())
@@ -45342,7 +45583,7 @@ var ASSISTANT = "assistant";
 var READ_LABEL = "Already read before the cut \u2014 re-read only the lines you need";
 var DECISIONS_LABEL = "Decided before the cut \u2014 do not reopen";
 function shown_path(target3, cwd) {
-  const relative = path41.relative(cwd, path41.resolve(cwd, target3));
+  const relative = path42.relative(cwd, path42.resolve(cwd, target3));
   return relative.startsWith("..") ? target3 : relative;
 }
 function newest_unique(entries, limit) {
@@ -45405,7 +45646,7 @@ var run_cut_digest = {
 
 // scripts/run/cut/run-cut.ts
 var CUT_PREFIX = "josh-run-cut-";
-var { PRE_GATE_PHASE: PRE_GATE_PHASE3, IMPLEMENTATION_PHASE: IMPLEMENTATION_PHASE3 } = agent_profile_schema;
+var { PRE_GATE_PHASE: PRE_GATE_PHASE4, IMPLEMENTATION_PHASE: IMPLEMENTATION_PHASE3 } = agent_profile_schema;
 var CUT_MAX_AGE_MS = backlog_budget.DEFAULT_IDLE_MS;
 var CUT_MAX_AGE_HOURS = backlog_budget.IDLE_WAIT_HOURS;
 var END_COMMAND2 = "pnpm josh run:cut --end";
@@ -45588,7 +45829,7 @@ var run_cut = {
   END_COMMAND: END_COMMAND2,
   IMPLEMENTATION_PHASE: IMPLEMENTATION_PHASE3,
   MAX_HANDOFF_BYTES,
-  PRE_GATE_PHASE: PRE_GATE_PHASE3,
+  PRE_GATE_PHASE: PRE_GATE_PHASE4,
   adopt_cut,
   begin_cut,
   busy_message: busy_message2,
@@ -45747,7 +45988,7 @@ function environment_for3(transcript, source) {
   }
   return {
     ...source,
-    [agent_session_environment.SESSION_ID_KEY]: path42.basename(transcript, ".jsonl")
+    [agent_session_environment.SESSION_ID_KEY]: path43.basename(transcript, ".jsonl")
   };
 }
 function session_verdict2(transcript, directory, source) {
@@ -45794,8 +46035,8 @@ function file_path_of(call) {
   return typeof value2 === "string" ? value2 : "";
 }
 function is_handoff_write(call, directory, issue3) {
-  const handoff2 = path42.resolve(directory, run_cut_handoff.handoff_path_of(issue3));
-  return path42.resolve(directory, file_path_of(call)) === handoff2;
+  const handoff2 = path43.resolve(directory, run_cut_handoff.handoff_path_of(issue3));
+  return path43.resolve(directory, file_path_of(call)) === handoff2;
 }
 function refusable_issue(call, state) {
   const issue3 = uncut_run_issue(state);
@@ -46596,8 +46837,8 @@ function fallback_reason(action) {
   return action.kind === "notify" ? STOP_NOTIFY_REASON : HOLD_RELEASE_REASON;
 }
 function block_envelope(reason4, lang, notice3) {
-  const refusal4 = { decision: BLOCK_DECISION, reason: `${reason4} ${language_note(lang)}` };
-  return JSON.stringify(notice3 === void 0 ? refusal4 : { ...refusal4, systemMessage: notice3 });
+  const refusal6 = { decision: BLOCK_DECISION, reason: `${reason4} ${language_note(lang)}` };
+  return JSON.stringify(notice3 === void 0 ? refusal6 : { ...refusal6, systemMessage: notice3 });
 }
 function notice_envelope3(notice3) {
   return JSON.stringify({ systemMessage: notice3 });
@@ -46856,7 +47097,7 @@ function is_headless(source = process.env) {
 var agent_headless = { KEY: KEY4, environment, is_headless };
 
 // scripts/agent/agent-launch-environment.ts
-var OPENAI_PROVIDER5 = "openai";
+var OPENAI_PROVIDER6 = "openai";
 function build2(profile, environment3 = {}) {
   if (profile === void 0) return { ...environment3, [agent_session_role.KEY]: void 0 };
   const marked = {
@@ -46864,7 +47105,7 @@ function build2(profile, environment3 = {}) {
     ...environment3,
     ...agent_session_role.env_for(profile.role)
   };
-  return profile.provider === OPENAI_PROVIDER5 ? { TMPDIR: PLATFORM_TEMP_ROOT, ...marked } : marked;
+  return profile.provider === OPENAI_PROVIDER6 ? { TMPDIR: PLATFORM_TEMP_ROOT, ...marked } : marked;
 }
 var agent_launch_environment = { build: build2 };
 
@@ -48335,17 +48576,17 @@ function word_before(segment, call) {
   const words = git_argv.words_of(segment);
   return words[words.length - call.args.length - BEFORE_PROGRAM] ?? "";
 }
-function call_of(segment) {
+function call_of2(segment) {
   const call = git_argv.program_of(segment);
   if (call === void 0) return void 0;
   const is_lookup = LOOKUP_FLAGS.has(call.name) && plain_name(word_before(segment, call)) === LOOKUP_WRAPPER;
   return { name: is_lookup ? LOOKUP_WRAPPER : plain_name(call.name), args: call.args };
 }
 function resolved_call(segment) {
-  let call = call_of(segment);
+  let call = call_of2(segment);
   let inner = inner_words_of(call);
   while (inner !== void 0) {
-    call = call_of(inner.join(" "));
+    call = call_of2(inner.join(" "));
     inner = inner_words_of(call);
   }
   return call;
@@ -48668,15 +48909,15 @@ var PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([
   "-o",
   "--push-option"
 ]);
-var QUOTING2 = /["'\\]/gu;
+var QUOTING3 = /["'\\]/gu;
 var PUSH_CONFIG = /^(?:remote\.|url\.|core\.(?:sshCommand|gitProxy))/iu;
 var CONFIG_ENVIRONMENT = /^GIT_CONFIG(?:_[A-Z0-9_]+)?=/u;
 function has_push_config(line2) {
-  return git_argv.config_arguments_of(line2).some((word2) => PUSH_CONFIG.test(word2.replaceAll(QUOTING2, "")));
+  return git_argv.config_arguments_of(line2).some((word2) => PUSH_CONFIG.test(word2.replaceAll(QUOTING3, "")));
 }
 function has_config_environment(segment, call) {
   const prefix2 = git_argv.words_of(segment).slice(0, -(call.args.length + 1));
-  return prefix2.some((word2) => CONFIG_ENVIRONMENT.test(word2.replaceAll(QUOTING2, "")));
+  return prefix2.some((word2) => CONFIG_ENVIRONMENT.test(word2.replaceAll(QUOTING3, "")));
 }
 function has_push_override(segment, call, args) {
   const line2 = [call.name, ...call.args].join(" ");
@@ -48697,7 +48938,7 @@ function is_foreign_push(segment, call) {
   if (parsed?.subcommand !== PUSH) return false;
   if (has_push_override(segment, call, parsed.args)) return true;
   const remote = parsed.args.find((word2) => !word2.startsWith(FLAG_PREFIX13));
-  return remote?.replaceAll(QUOTING2, "") !== ORIGIN;
+  return remote?.replaceAll(QUOTING3, "") !== ORIGIN;
 }
 function is_restricted(segment, call) {
   const plain2 = {
@@ -49022,22 +49263,22 @@ var ROW36 = {
 var index_guard = { INDEX_MUTATION_REASON, ROW: ROW36, is_index_mutation };
 
 // scripts/rules/protected-files.ts
-import path45 from "node:path";
+import path46 from "node:path";
 
 // scripts/doctor/doctor-consumer.ts
 import { existsSync as existsSync8 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 
 // scripts/version/kit-descriptor.ts
 var KIT_PACKAGE_NAME = "@joshuafolkken/kit";
 
 // scripts/doctor/doctor-consumer.ts
 var NODE_MODULES = "node_modules";
-var SETTINGS_PATH = path43.join(".claude", "settings.json");
+var SETTINGS_PATH = path44.join(".claude", "settings.json");
 var CLAUDE_MD = "CLAUDE.md";
 var PLUGIN_ID = "kit@kit";
 var CLAUDE_MD_POINTER = `@${NODE_MODULES}/${KIT_PACKAGE_NAME}/dist/${CLAUDE_MD}`;
-var SECRETLINT_BIN = path43.join(NODE_MODULES, ".bin", "secretlint");
+var SECRETLINT_BIN = path44.join(NODE_MODULES, ".bin", "secretlint");
 var manifest_schema = external_exports.object({
   name: external_exports.string().optional(),
   dependencies: external_exports.record(external_exports.string(), external_exports.string()).optional(),
@@ -49059,10 +49300,10 @@ function lists_kit_dependency(manifest) {
 function is_kit_consumer(root2) {
   const manifest = parse_manifest(root2);
   if (manifest?.name === KIT_PACKAGE_NAME) return false;
-  return lists_kit_dependency(manifest) || existsSync8(path43.join(root2, NODE_MODULES, KIT_PACKAGE_NAME));
+  return lists_kit_dependency(manifest) || existsSync8(path44.join(root2, NODE_MODULES, KIT_PACKAGE_NAME));
 }
 function is_plugin_declared(root2) {
-  const content = file_reader.read_if_readable(path43.join(root2, SETTINGS_PATH));
+  const content = file_reader.read_if_readable(path44.join(root2, SETTINGS_PATH));
   if (content === void 0) return false;
   const parsed = settings_schema.safeParse(json_value.parse_or_undefined(content));
   return parsed.success && parsed.data.enabledPlugins?.[PLUGIN_ID] === true;
@@ -49074,13 +49315,13 @@ function configured_hooks_path(root2) {
   return value2 === "" ? void 0 : value2;
 }
 function claude_md_state(root2) {
-  const content = file_reader.read_if_readable(path43.join(root2, CLAUDE_MD));
+  const content = file_reader.read_if_readable(path44.join(root2, CLAUDE_MD));
   if (content === void 0) return STATE_MISSING;
   if (!content.includes(CLAUDE_MD_POINTER)) return STATE_OK;
-  return existsSync8(path43.join(root2, NODE_MODULES, KIT_PACKAGE_NAME, "dist", CLAUDE_MD)) ? STATE_OK : STATE_TARGET_MISSING;
+  return existsSync8(path44.join(root2, NODE_MODULES, KIT_PACKAGE_NAME, "dist", CLAUDE_MD)) ? STATE_OK : STATE_TARGET_MISSING;
 }
 function is_secretlint_runnable(root2) {
-  return existsSync8(path43.join(root2, SECRETLINT_BIN));
+  return existsSync8(path44.join(root2, SECRETLINT_BIN));
 }
 function status_line(is_ok, ok_text, warn_text) {
   return is_ok ? `  \u2713 ${ok_text}` : `  \u26A0 ${warn_text}`;
@@ -49142,7 +49383,7 @@ var doctor_consumer = {
 
 // scripts/rules/secret-paths.ts
 import os3 from "node:os";
-import path44 from "node:path";
+import path45 from "node:path";
 var TOKEN_QUOTES = /["']/gu;
 var BRACED_VARIABLE = /\$\{(\w+)\}/gu;
 var BACKSLASH = /\\/gu;
@@ -49159,7 +49400,7 @@ var HOME_PREFIXES = ["~/", "$HOME/"];
 var HOME_SECRET_FILES = /* @__PURE__ */ new Set([".netrc", ".curlrc", ".npmrc"]);
 var HOME_SECRET_DIRECTORIES = [".ssh", ".config/gh"];
 function is_environment_file(token) {
-  const name = path44.basename(token);
+  const name = path45.basename(token);
   if (TRACKED_VARIANTS.has(name)) return false;
   return SECRET_FILES.has(name) || name.startsWith(ENVIRONMENT_VARIANT_PREFIX);
 }
@@ -49184,7 +49425,7 @@ function is_secret_token(token) {
 function spellings_of(word2) {
   const token = word2.replaceAll(TOKEN_QUOTES, "").replaceAll(BRACED_VARIABLE, "$$$1");
   return [token.replaceAll(BACKSLASH, ""), token.replaceAll(BACKSLASH, "/")].map(
-    (spelling) => path44.posix.normalize(spelling)
+    (spelling) => path45.posix.normalize(spelling)
   );
 }
 function is_secret_path(word2) {
@@ -49197,7 +49438,7 @@ var READ_MARK = "
read";
 var WRITE_MARK = "
write";
 var READ_OPERATOR = "<";
 var REDIRECT = />\||[<>]/gu;
-var WHITESPACE4 = /\s+/u;
+var PIECE_END = "\0";
 var NEXT8 = 1;
 var ANY_MARK = /* @__PURE__ */ new Set([READ_MARK, WRITE_MARK]);
 var { SHELLS: SHELLS3 } = nested_commands;
@@ -49208,13 +49449,16 @@ function redirect_marks_of(segment, program) {
 function mark_of(operator) {
   return operator === READ_OPERATOR ? READ_MARK : WRITE_MARK;
 }
-function marked_words(segment, program) {
-  const marks = redirect_marks_of(segment, program);
-  const spaced = segment.replaceAll(
+function marked_pieces(word2, marks) {
+  const pieced = word2.text.replaceAll(
     REDIRECT,
-    (operator, offset) => marks.startsWith(operator, offset) ? ` ${mark_of(operator)} ` : operator
+    (operator, offset) => marks.startsWith(operator, word2.begin + offset) ? `${PIECE_END}${mark_of(operator)}${PIECE_END}` : operator
   );
-  return spaced.split(WHITESPACE4).filter((word2) => word2 !== "");
+  return pieced.split(PIECE_END).filter((piece) => piece !== "");
+}
+function marked_words(segment, program) {
+  const marks = redirect_marks_of(segment, program);
+  return shell_tokens.words_of(segment).flatMap((word2) => marked_pieces(word2, marks));
 }
 function targets_of(segment, program) {
   const words = marked_words(segment, program);
@@ -49228,7 +49472,7 @@ var GREP_TOOL = "Grep";
 var FILE_TOOLS = /* @__PURE__ */ new Set([READ_TOOL3, GREP_TOOL]);
 var { is_edit_tool: is_edit_tool4 } = edit_tool;
 var { is_secret_path: is_secret_path2 } = secret_paths;
-var SETTINGS_FILE = path45.join(".claude", "settings.json");
+var SETTINGS_FILE = path46.join(".claude", "settings.json");
 var SHELL_PROGRAMS = /* @__PURE__ */ new Set([
   "cp",
   "install",
@@ -49293,9 +49537,9 @@ function is_secret_access(call) {
 }
 function is_consumer_settings_edit(call, is_kit_consumer2) {
   if (!is_edit_tool4(call.name)) return false;
-  const file_path3 = path45.resolve(file_path_of2(call));
-  if (!file_path3.endsWith(`${path45.sep}${SETTINGS_FILE}`)) return false;
-  return is_kit_consumer2(path45.dirname(path45.dirname(file_path3)));
+  const file_path3 = path46.resolve(file_path_of2(call));
+  if (!file_path3.endsWith(`${path46.sep}${SETTINGS_FILE}`)) return false;
+  return is_kit_consumer2(path46.dirname(path46.dirname(file_path3)));
 }
 function is_protected_file_call(call, is_kit_consumer2 = doctor_consumer.is_kit_consumer) {
   return is_secret_access(call) || is_consumer_settings_edit(call, is_kit_consumer2);
@@ -49935,12 +50179,12 @@ var shell_body_trigger = {
 
 // scripts/gate/project-checks.ts
 import { existsSync as existsSync21, globSync as globSync2 } from "node:fs";
-import path64 from "node:path";
+import path65 from "node:path";
 
 // scripts/build/local-bin.ts
 import { existsSync as existsSync9, readFileSync as readFileSync17 } from "node:fs";
 import { createRequire } from "node:module";
-import path46 from "node:path";
+import path47 from "node:path";
 
 // scripts/lib/pnpm-reach.ts
 var PREREQUISITES_URL = "https://github.com/joshuafolkken/kit/blob/main/docs/setup/prerequisites.md#2-install-pnpm-and-nodejs";
@@ -49988,7 +50232,7 @@ var WINDOWS_PLATFORM3 = "win32";
 var WINDOWS_SHIM_SUFFIX = ".cmd";
 function resolve_local_bin(project_root2, bin_name) {
   const shim = process.platform === WINDOWS_PLATFORM3 ? `${bin_name}${WINDOWS_SHIM_SUFFIX}` : bin_name;
-  return path46.join(project_root2, NODE_MODULES2, BIN_DIR, shim);
+  return path47.join(project_root2, NODE_MODULES2, BIN_DIR, shim);
 }
 function find_local_bin_upwards(start_directory, bin_name) {
   return ancestor_directories.list(start_directory).map((directory) => resolve_local_bin(directory, bin_name)).find((candidate) => existsSync9(candidate));
@@ -49996,7 +50240,7 @@ function find_local_bin_upwards(start_directory, bin_name) {
 
 // scripts/init/own-formatter.ts
 import { existsSync as existsSync10 } from "node:fs";
-import path47 from "node:path";
+import path48 from "node:path";
 var OWN_FORMATTER_CONFIGS = [
   "biome.json",
   "biome.jsonc",
@@ -50006,22 +50250,22 @@ var OWN_FORMATTER_CONFIGS = [
   ".dprint.jsonc"
 ];
 function find_config(root2) {
-  return OWN_FORMATTER_CONFIGS.find((name) => existsSync10(path47.join(root2, name)));
+  return OWN_FORMATTER_CONFIGS.find((name) => existsSync10(path48.join(root2, name)));
 }
 var own_formatter = { find_config };
 
 // scripts/init/project-profile.ts
 import { existsSync as existsSync20, readdirSync as readdirSync10 } from "node:fs";
-import path63 from "node:path";
+import path64 from "node:path";
 
 // scripts/safe-chain/pack-hook.ts
 import { existsSync as existsSync11, readFileSync as readFileSync19, rmSync as rmSync6 } from "node:fs";
-import path49 from "node:path";
+import path50 from "node:path";
 
 // scripts/sync/file-content.ts
 import { lstatSync as lstatSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync18, readlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
-import path48 from "node:path";
-var PATH_SEPARATORS = path48.sep === "\\" ? /[/\\]/u : /\//u;
+import path49 from "node:path";
+var PATH_SEPARATORS = path49.sep === "\\" ? /[/\\]/u : /\//u;
 
 // scripts/safe-chain/pack-hook.ts
 var PACK_HOOK_FILE = ".pnpmfile.mjs";
@@ -50036,7 +50280,7 @@ var MESSAGES = {
 
 // scripts/safe-chain/project-config.ts
 import { existsSync as existsSync12, readFileSync as readFileSync21 } from "node:fs";
-import path52 from "node:path";
+import path53 from "node:path";
 
 // node_modules/.pnpm/js-yaml@5.5.0/node_modules/js-yaml/dist/js-yaml.mjs
 var NOT_RESOLVED = /* @__PURE__ */ Symbol("NOT_RESOLVED");
@@ -53227,11 +53471,11 @@ function parse_yaml_documents(content) {
 var yaml_document = { is_mapping_document, parse_yaml, parse_yaml_documents };
 
 // scripts/version/release-window.ts
-import path51 from "node:path";
+import path52 from "node:path";
 
 // scripts/version/release-age.ts
 import { readFileSync as readFileSync20 } from "node:fs";
-import path50 from "node:path";
+import path51 from "node:path";
 var import_semver = __toESM(require_semver2(), 1);
 var NO_QUARANTINE_MINUTES = 0;
 var WORKSPACE_PATH = "pnpm-workspace.yaml";
@@ -53277,14 +53521,14 @@ function read_minimum_release_age(workspace_path = WORKSPACE_PATH) {
   return read_declared_minimum_release_age(workspace_path) ?? NO_QUARANTINE_MINUTES;
 }
 function find_declared_minimum_release_age(start2, boundary) {
-  const declared = read_declared_minimum_release_age(path50.join(start2, WORKSPACE_PATH));
+  const declared = read_declared_minimum_release_age(path51.join(start2, WORKSPACE_PATH));
   if (declared !== void 0) return declared;
   if (start2 === boundary) return void 0;
-  const parent = path50.dirname(start2);
+  const parent = path51.dirname(start2);
   return parent === start2 ? void 0 : find_declared_minimum_release_age(parent, boundary);
 }
 function read_nearest_minimum_release_age(start2, boundary) {
-  return find_declared_minimum_release_age(path50.resolve(start2), boundary) ?? NO_QUARANTINE_MINUTES;
+  return find_declared_minimum_release_age(path51.resolve(start2), boundary) ?? NO_QUARANTINE_MINUTES;
 }
 var release_age = {
   release_times_schema,
@@ -53763,10 +54007,10 @@ function set_json_key(content, key3, value2) {
   const indented = fit_value(content, value_text, line_indent(content, existing.offset));
   return with_trailing_newline(replace_range(content, existing, indented));
 }
-function resolve_parent(content, path77) {
+function resolve_parent(content, path78) {
   const root2 = parse_root(content);
   if (root2 === void 0) return void 0;
-  const parent = path77.length > 1 ? findNodeAtLocation(root2, path77.slice(0, -1)) : root2;
+  const parent = path78.length > 1 ? findNodeAtLocation(root2, path78.slice(0, -1)) : root2;
   return parent?.type === "object" ? parent : void 0;
 }
 function cut_ranges(content, parent, ranges) {
@@ -53777,24 +54021,24 @@ function cut_ranges(content, parent, ranges) {
   }
   return next;
 }
-function rebalance_new_last(content, path77) {
-  const parent = resolve_parent(content, path77);
+function rebalance_new_last(content, path78) {
+  const parent = resolve_parent(content, path78);
   const last = parent?.children?.at(-1);
   if (parent === void 0 || last === void 0) return content;
   return rebalance(content, last, has_separator_after(content, parent.offset, parent.offset));
 }
-function cut_property(content, parent, path77) {
-  const index = property_index(parent, path77.at(-1) ?? "");
+function cut_property(content, parent, path78) {
+  const index = property_index(parent, path78.at(-1) ?? "");
   const ranges = removal_ranges(content, parent, index);
   if (ranges.length === 0) return content;
   const cut = cut_ranges(content, parent, ranges);
   const did_end_object = index === (parent.children ?? []).length - 1;
-  return did_end_object ? rebalance_new_last(cut, path77) : cut;
+  return did_end_object ? rebalance_new_last(cut, path78) : cut;
 }
-function remove_json_path(content, path77) {
-  const parent = resolve_parent(content, path77);
+function remove_json_path(content, path78) {
+  const parent = resolve_parent(content, path78);
   if (parent === void 0) return content;
-  const next = cut_property(content, parent, path77);
+  const next = cut_property(content, parent, path78);
   return next === content ? content : with_trailing_newline(next);
 }
 function remove_json_key(content, key3) {
@@ -53960,13 +54204,13 @@ var kit_base_preset = {
 
 // scripts/init/tsconfig-preset-migration.ts
 import { existsSync as existsSync13 } from "node:fs";
-import path53 from "node:path";
+import path54 from "node:path";
 var LEGACY_PRESET_ENTRY = /@joshuafolkken\/[^/]+\/tsconfig\/[^/]+\.jsonc$/u;
 var LEGACY_SUFFIX = ".jsonc";
 var CURRENT_SUFFIX = ".json";
 var EXTENDS_FIELD = "extends";
 function is_migration_target_present(base_directory, entry) {
-  return existsSync13(path53.resolve(base_directory, entry));
+  return existsSync13(path54.resolve(base_directory, entry));
 }
 function migrate_entry(base_directory, entry) {
   if (!LEGACY_PRESET_ENTRY.test(entry)) return entry;
@@ -54379,7 +54623,7 @@ var init_logic_sonar = {
 
 // scripts/init/init-logic-templates.ts
 import { existsSync as existsSync14, readFileSync as readFileSync22 } from "node:fs";
-import path54 from "node:path";
+import path55 from "node:path";
 var ESLINT_VANILLA = `import { create_vanilla_config } from '@joshuafolkken/kit/eslint/vanilla'
 
 export default create_vanilla_config({
@@ -54464,7 +54708,7 @@ function merge_eslint_config(existing) {
   return apply_rules_template(rules_blocks.join(",\n"));
 }
 function detect_tailwind_stylesheet(project_root2) {
-  return existsSync14(path54.join(project_root2, DEFAULT_TAILWIND_STYLESHEET)) ? DEFAULT_TAILWIND_STYLESHEET : void 0;
+  return existsSync14(path55.join(project_root2, DEFAULT_TAILWIND_STYLESHEET)) ? DEFAULT_TAILWIND_STYLESHEET : void 0;
 }
 function generate_prettier_config(stylesheet) {
   const stylesheet_line = stylesheet === void 0 ? "" : `	tailwindStylesheet: '${stylesheet}',
@@ -54478,7 +54722,7 @@ ${stylesheet_line}}
 }
 function existing_stylesheet(existing, project_root2) {
   const named = TAILWIND_STYLESHEET_PATTERN.exec(existing)?.[1];
-  return named !== void 0 && existsSync14(path54.resolve(project_root2, named)) ? named : void 0;
+  return named !== void 0 && existsSync14(path55.resolve(project_root2, named)) ? named : void 0;
 }
 function merge_prettier_config(existing, project_root2) {
   const stylesheet = existing_stylesheet(existing, project_root2) ?? detect_tailwind_stylesheet(project_root2);
@@ -54850,8 +55094,8 @@ function merge_npmrc(content) {
   return kept2.length === lines.length ? content : kept2.join("\n");
 }
 function is_gitignore_pattern(line2) {
-  const trimmed3 = line2.trim();
-  return trimmed3.length > 0 && !trimmed3.startsWith("#");
+  const trimmed5 = line2.trim();
+  return trimmed5.length > 0 && !trimmed5.startsWith("#");
 }
 function merge_gitignore(existing, template) {
   const existing_lines = new Set(existing.split("\n"));
@@ -55121,26 +55365,26 @@ var SYNCED_PATHS_LIST = "SYNCED_PATHS";
 var PLUGIN_SKILL_DIRECTORIES_LIST = "PLUGIN_SKILL_DIRECTORIES";
 var NPM_PUBLISH_FILES_LIST = "NPM_PUBLISH_FILES";
 var PATH_SEPARATOR7 = "/";
-function is_inside(path77, directory) {
-  return path77 === directory || path77.startsWith(`${directory}${PATH_SEPARATOR7}`);
+function is_inside(path78, directory) {
+  return path78 === directory || path78.startsWith(`${directory}${PATH_SEPARATOR7}`);
 }
-function matches_file(path77) {
-  return init_logic.get_ai_copy_files().includes(path77);
+function matches_file(path78) {
+  return init_logic.get_ai_copy_files().includes(path78);
 }
-function matches_mapping(path77) {
-  return init_logic.get_ai_copy_file_mappings().some((mapping) => mapping.src === path77 || mapping.dest === path77);
+function matches_mapping(path78) {
+  return init_logic.get_ai_copy_file_mappings().some((mapping) => mapping.src === path78 || mapping.dest === path78);
 }
-function matches_directory(path77) {
-  return init_logic.get_ai_copy_directories().some((directory) => is_inside(path77, directory));
+function matches_directory(path78) {
+  return init_logic.get_ai_copy_directories().some((directory) => is_inside(path78, directory));
 }
-function matches_plugin_skill(path77) {
-  return PLUGIN_SKILL_DIRECTORIES.some((directory) => is_inside(path77, directory));
+function matches_plugin_skill(path78) {
+  return PLUGIN_SKILL_DIRECTORIES.some((directory) => is_inside(path78, directory));
 }
-function matches_synced_path(path77) {
-  return synced_paths.get_synced_paths().includes(path77);
+function matches_synced_path(path78) {
+  return synced_paths.get_synced_paths().includes(path78);
 }
-function matches_npm_publish_file(path77) {
-  return path77 === npm_publish_files.PUBLISH_WORKFLOW;
+function matches_npm_publish_file(path78) {
+  return path78 === npm_publish_files.PUBLISH_WORKFLOW;
 }
 var MATCHERS = [
   { list: AI_COPY_FILES_LIST, matches: matches_file },
@@ -55150,18 +55394,18 @@ var MATCHERS = [
   { list: SYNCED_PATHS_LIST, matches: matches_synced_path },
   { list: NPM_PUBLISH_FILES_LIST, matches: matches_npm_publish_file }
 ];
-function find_list(path77) {
-  return MATCHERS.find((matcher) => matcher.matches(path77))?.list;
+function find_list(path78) {
+  return MATCHERS.find((matcher) => matcher.matches(path78))?.list;
 }
-function to_hit(path77) {
-  const list3 = find_list(path77);
-  return list3 === void 0 ? void 0 : { path: path77, list: list3 };
+function to_hit(path78) {
+  const list3 = find_list(path78);
+  return list3 === void 0 ? void 0 : { path: path78, list: list3 };
 }
 function find_managed_paths(paths2) {
-  return paths2.flatMap((path77) => to_hit(path77) ?? []);
+  return paths2.flatMap((path78) => to_hit(path78) ?? []);
 }
 function has_managed_path(paths2) {
-  return paths2.some((path77) => find_list(path77) !== void 0);
+  return paths2.some((path78) => find_list(path78) !== void 0);
 }
 function format_hit(hit) {
   return `${hit.path} (${hit.list})`;
@@ -55178,11 +55422,11 @@ var managed_config_scope = {
 
 // scripts/init/init-actions.ts
 import { readFileSync as readFileSync24 } from "node:fs";
-import path56 from "node:path";
+import path57 from "node:path";
 
 // scripts/init/session-language-environment.ts
 import { existsSync as existsSync15, readFileSync as readFileSync23 } from "node:fs";
-import path55 from "node:path";
+import path56 from "node:path";
 
 // scripts/josh/session-language.ts
 var ENV_KEY = "JOSH_SESSION_LANG";
@@ -55198,7 +55442,7 @@ function is_japanese(lang) {
 var session_language = { DEFAULT_SESSION_LANG, ENV_KEY, resolve_session_lang, is_japanese };
 
 // scripts/init/session-language-environment.ts
-var CLAUDE_SETTINGS_PATH = path55.join(".claude", "settings.json");
+var CLAUDE_SETTINGS_PATH = path56.join(".claude", "settings.json");
 var KEY_LINE_PATTERN = new RegExp(
   String.raw`^\s*(?:export\s+)?${session_language.ENV_KEY}\s*=`,
   "mu"
@@ -55215,7 +55459,7 @@ var BASIC_PRETTIER_CONFIG = "prettier.config.mjs";
 
 // scripts/init/init-ai-copy.ts
 import { existsSync as existsSync19, readFileSync as readFileSync28 } from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 
 // scripts/managed-marker/managed-marker-logic.ts
 var MARKER_TOKEN = "josh-managed-workflow:";
@@ -55223,21 +55467,21 @@ var MARKER_PREFIX = `# ${MARKER_TOKEN}`;
 
 // scripts/sync/directory-copy-guard.ts
 import { cpSync, lstatSync as lstatSync6, readdirSync as readdirSync9, readFileSync as readFileSync26 } from "node:fs";
-import path60 from "node:path";
+import path61 from "node:path";
 
 // scripts/sync/workflow-pin-logic.ts
 import { readdirSync as readdirSync8, readFileSync as readFileSync25 } from "node:fs";
-import path57 from "node:path";
+import path58 from "node:path";
 
 // scripts/ci/composite-actions.ts
 import { existsSync as existsSync16, readdirSync as readdirSync7 } from "node:fs";
 
 // scripts/init/claude-plugin-config.ts
-import path58 from "node:path";
+import path59 from "node:path";
 var MARKETPLACE_NAME = "kit";
 var PLUGIN_ID2 = "kit@kit";
 var MARKETPLACE_PATH = "./node_modules/@joshuafolkken/kit";
-var CLAUDE_SETTINGS_DESTINATION = path58.join(".claude", "settings.json");
+var CLAUDE_SETTINGS_DESTINATION = path59.join(".claude", "settings.json");
 var PLUGIN_SETTINGS = {
   extraKnownMarketplaces: {
     [MARKETPLACE_NAME]: { source: { source: "directory", path: MARKETPLACE_PATH } }
@@ -55326,7 +55570,7 @@ var KIT_COMMAND_MARKERS = [
 ];
 
 // scripts/init/security-policy.ts
-import path59 from "node:path";
+import path60 from "node:path";
 var SECURITY_MD = "SECURITY.md";
 var SECURITY_TEMPLATE = "templates/SECURITY.md";
 var REPOSITORY_PLACEHOLDER = "{{REPOSITORY}}";
@@ -55342,15 +55586,15 @@ function apply_repository(content, repository2) {
   return content.replaceAll(REPOSITORY_PLACEHOLDER, () => repository2);
 }
 function apply_repository_for_destination(destination_path, content) {
-  if (path59.basename(destination_path) !== SECURITY_MD) return content;
-  const repository2 = repository_at(path59.dirname(destination_path));
+  if (path60.basename(destination_path) !== SECURITY_MD) return content;
+  const repository2 = repository_at(path60.dirname(destination_path));
   if (repository2 === void 0) {
     throw new Error(`${SECURITY_MD} needs a GitHub origin to name the repository it reports to`);
   }
   return apply_repository(content, repository2);
 }
 function does_report_to_kit(root2) {
-  const existing = file_reader.read_if_readable(path59.join(root2, SECURITY_MD)) ?? "";
+  const existing = file_reader.read_if_readable(path60.join(root2, SECURITY_MD)) ?? "";
   return new Set(existing.split(LINK_DELIMITER)).has(KIT_ADVISORY_URL);
 }
 function unresolved_warning(root2) {
@@ -55374,7 +55618,7 @@ var security_policy = {
 
 // scripts/init/init-sonar.ts
 import { existsSync as existsSync18 } from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 
 // scripts/security/sonar-file.ts
 import { existsSync as existsSync17, readFileSync as readFileSync27 } from "node:fs";
@@ -55518,12 +55762,12 @@ function should_visit(entry) {
 function scan_directory(directory, pending) {
   const entries = readdirSync10(directory, { withFileTypes: true });
   pending.push(
-    ...entries.filter((entry) => should_visit(entry)).map((entry) => path63.join(directory, entry.name))
+    ...entries.filter((entry) => should_visit(entry)).map((entry) => path64.join(directory, entry.name))
   );
-  return entries.filter((entry) => entry.isFile()).map((entry) => path63.join(directory, entry.name));
+  return entries.filter((entry) => entry.isFile()).map((entry) => path64.join(directory, entry.name));
 }
 function is_project_file(root2, file2) {
-  const relative_path = path63.relative(root2, file2).split(path63.sep).join(path63.posix.sep);
+  const relative_path = path64.relative(root2, file2).split(path64.sep).join(path64.posix.sep);
   return !kit_written_paths.is_kit_written(relative_path);
 }
 function list_files(root2) {
@@ -55535,7 +55779,7 @@ function list_files(root2) {
   return files2;
 }
 function file_extensions(root2) {
-  return list_files(root2).filter((file2) => is_project_file(root2, file2)).map((file2) => path63.extname(file2));
+  return list_files(root2).filter((file2) => is_project_file(root2, file2)).map((file2) => path64.extname(file2));
 }
 function scan_files(root2) {
   const extensions = file_extensions(root2);
@@ -55549,7 +55793,7 @@ function has_github_remote(root2) {
   return url2 !== void 0 && repo_origin.parse_origin_url(url2) !== void 0;
 }
 function has_git(root2) {
-  return existsSync20(path63.join(root2, ".git"));
+  return existsSync20(path64.join(root2, ".git"));
 }
 function has_workflow(root2) {
   return workflow_mark.is_requested() || workflow_mark.is_recorded(read_manifest2(root2));
@@ -55634,7 +55878,7 @@ function has_files(directory, pattern) {
   return globSync2(pattern, { cwd: project_root(directory), exclude: is_ignored }).length > 0;
 }
 function has_config(directory, names) {
-  return names.some((name) => existsSync21(path64.join(project_root(directory), name)));
+  return names.some((name) => existsSync21(path65.join(project_root(directory), name)));
 }
 function has_bin(directory, bin_name) {
   return find_local_bin_upwards(directory, bin_name) !== void 0;
@@ -55692,7 +55936,7 @@ function format_scope(directory) {
   return manifest?.josh?.format ?? DEFAULT_FORMAT_SCOPE;
 }
 function is_web_file(file_path3) {
-  return WEB_EXTENSIONS2.includes(path64.extname(file_path3).slice(1));
+  return WEB_EXTENSIONS2.includes(path65.extname(file_path3).slice(1));
 }
 function prettier_targets(directory, targets) {
   if (!is_basic(directory) || format_scope(directory) === "all") return targets;
@@ -55749,40 +55993,40 @@ var BASIC_REQUIRED_SUFFIXES = [
   ".toml"
 ];
 function normalize2(paths2) {
-  return paths2.map((path77) => path77.trim()).filter((path77) => path77 !== "");
+  return paths2.map((path78) => path78.trim()).filter((path78) => path78 !== "");
 }
-function is_test_file(path77) {
-  return TEST_SUFFIXES.some((suffix) => path77.endsWith(suffix));
+function is_test_file(path78) {
+  return TEST_SUFFIXES.some((suffix) => path78.endsWith(suffix));
 }
-function is_basic_manual(path77, is_basic2) {
-  const lower2 = path77.toLowerCase();
+function is_basic_manual(path78, is_basic2) {
+  const lower2 = path78.toLowerCase();
   return is_basic2 && BASIC_REQUIRED_SUFFIXES.every((suffix) => !lower2.endsWith(suffix));
 }
-function is_basic_visual(path77) {
-  const lower2 = path77.toLowerCase();
+function is_basic_visual(path78) {
+  const lower2 = path78.toLowerCase();
   return BASIC_VISUAL_SUFFIXES.some((suffix) => lower2.endsWith(suffix));
 }
-function is_exempt2(path77, is_basic2 = false) {
-  if (EXEMPT_PATHS.includes(path77) || is_basic_manual(path77, is_basic2)) return true;
-  return EXEMPT_SUFFIXES.some((suffix) => path77.endsWith(suffix)) || EXEMPT_PREFIXES.some((prefix2) => path77.startsWith(prefix2));
+function is_exempt2(path78, is_basic2 = false) {
+  if (EXEMPT_PATHS.includes(path78) || is_basic_manual(path78, is_basic2)) return true;
+  return EXEMPT_SUFFIXES.some((suffix) => path78.endsWith(suffix)) || EXEMPT_PREFIXES.some((prefix2) => path78.startsWith(prefix2));
 }
-function is_runtime(path77, is_basic2 = false) {
-  return !is_test_file(path77) && !is_exempt2(path77, is_basic2);
+function is_runtime(path78, is_basic2 = false) {
+  return !is_test_file(path78) && !is_exempt2(path78, is_basic2);
 }
 function verdict_for3(paths2, is_basic2 = false) {
   const changed = normalize2(paths2);
-  if (changed.some((path77) => is_test_file(path77))) return "satisfied";
-  if (changed.some((path77) => is_runtime(path77, is_basic2))) return "required";
+  if (changed.some((path78) => is_test_file(path78))) return "satisfied";
+  if (changed.some((path78) => is_runtime(path78, is_basic2))) return "required";
   return "exempt";
 }
 function runtime_files(paths2, is_basic2 = false) {
-  return normalize2(paths2).filter((path77) => is_runtime(path77, is_basic2));
+  return normalize2(paths2).filter((path78) => is_runtime(path78, is_basic2));
 }
 function exempt_files(paths2, is_basic2 = false) {
-  return normalize2(paths2).filter((path77) => is_exempt2(path77, is_basic2));
+  return normalize2(paths2).filter((path78) => is_exempt2(path78, is_basic2));
 }
 function manual_check_files(paths2, is_basic2) {
-  return normalize2(paths2).filter((path77) => is_exempt2(path77, is_basic2) && !is_exempt2(path77));
+  return normalize2(paths2).filter((path78) => is_exempt2(path78, is_basic2) && !is_exempt2(path78));
 }
 var test_declared_logic = {
   EXEMPT_PATHS,
@@ -55857,7 +56101,7 @@ var test_declared_commit = { REASON: REASON6, ROW: ROW44 };
 
 // scripts/lane/lane-registry.ts
 import { chmodSync as chmodSync2, existsSync as existsSync22, statSync as statSync10, writeFileSync as writeFileSync7 } from "node:fs";
-import path66 from "node:path";
+import path67 from "node:path";
 
 // scripts/git/git-ls-remote.ts
 var LS_REMOTE_COMMAND = "ls-remote";
@@ -55942,8 +56186,8 @@ var MIN_QUOTED_LENGTH = 2;
 var FIRST_CHARACTER_END = 1;
 var LAST_CHARACTER_START = -1;
 function strip_export(line2) {
-  const trimmed3 = line2.trimStart();
-  return trimmed3.startsWith(EXPORT_PREFIX) ? trimmed3.slice(EXPORT_PREFIX.length).trimStart() : trimmed3;
+  const trimmed5 = line2.trimStart();
+  return trimmed5.startsWith(EXPORT_PREFIX) ? trimmed5.slice(EXPORT_PREFIX.length).trimStart() : trimmed5;
 }
 function is_key_line(line2, key3) {
   const body = strip_export(line2);
@@ -55957,8 +56201,8 @@ function is_output_line(line2) {
   return is_key_line(line2, LANE_OUTPUT_KEY);
 }
 function split_lines(content) {
-  const trimmed3 = content.trimEnd();
-  return trimmed3.length === 0 ? [] : trimmed3.split("\n");
+  const trimmed5 = content.trimEnd();
+  return trimmed5.length === 0 ? [] : trimmed5.split("\n");
 }
 function is_quoted(raw) {
   const first = raw.slice(0, FIRST_CHARACTER_END);
@@ -56045,7 +56289,7 @@ var lane_environment = {
 // scripts/run/run-liveness.ts
 import { readFileSync as readFileSync29, realpathSync, statSync as statSync9 } from "node:fs";
 import { homedir as homedir2, tmpdir as tmpdir3 } from "node:os";
-import path65 from "node:path";
+import path66 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
 
 // scripts/agent/claude-result-event.ts
@@ -56362,12 +56606,12 @@ var ALLOWED_ROOTS = [
   )
 ];
 function is_within3(candidate, root2) {
-  const relative = path65.relative(root2, candidate);
-  return relative !== "" && !relative.startsWith("..") && !path65.isAbsolute(relative);
+  const relative = path66.relative(root2, candidate);
+  return relative !== "" && !relative.startsWith("..") && !path66.isAbsolute(relative);
 }
 function to_safe_path(output_path) {
-  const normalized3 = path65.normalize(output_path);
-  if (!path65.isAbsolute(normalized3)) return void 0;
+  const normalized3 = path66.normalize(output_path);
+  if (!path66.isAbsolute(normalized3)) return void 0;
   return ALLOWED_ROOTS.some((root2) => is_within3(normalized3, root2)) ? normalized3 : void 0;
 }
 function sample_output(output_path) {
@@ -56675,15 +56919,15 @@ function held_seat(content) {
   return seat_from_content(content) ?? EMPTY_SEAT;
 }
 function read_environment(directory) {
-  return file_reader.read_if_readable(path66.join(directory, ENV_FILE_NAME));
+  return file_reader.read_if_readable(path67.join(directory, ENV_FILE_NAME));
 }
 function write_environment(directory, content) {
-  const file2 = path66.join(directory, ENV_FILE_NAME);
+  const file2 = path67.join(directory, ENV_FILE_NAME);
   writeFileSync7(file2, content, { mode: OWNER_ONLY_MODE });
   chmodSync2(file2, OWNER_ONLY_MODE);
 }
 function dispatched_at(directory) {
-  return statSync10(path66.join(directory, ENV_FILE_NAME), { throwIfNoEntry: false })?.mtimeMs;
+  return statSync10(path67.join(directory, ENV_FILE_NAME), { throwIfNoEntry: false })?.mtimeMs;
 }
 function branch_issue(branch2) {
   if (!branch2?.endsWith(lane_paths.LANE_BRANCH_SUFFIX)) return void 0;
@@ -56888,6 +57132,50 @@ var run_headless = {
   must_keep_waiting
 };
 
+// scripts/rules/codex-prompt.ts
+var content_schema = external_exports.array(
+  external_exports.object({
+    type: external_exports.string(),
+    text: external_exports.string().optional()
+  })
+);
+var provenance_schema = external_exports.object({ provenance: external_exports.object({ type: external_exports.string() }) });
+var metadata_schema = external_exports.object({ content_item_metadata: external_exports.array(provenance_schema) });
+var payload_schema2 = external_exports.object({
+  type: external_exports.literal("message"),
+  role: external_exports.enum(["user", "assistant"]),
+  content: content_schema,
+  internal_chat_message_metadata_passthrough: metadata_schema.optional()
+});
+var record_schema4 = external_exports.object({
+  type: external_exports.literal("response_item"),
+  timestamp: external_exports.string(),
+  payload: payload_schema2
+});
+function content_text(block) {
+  if (block.type !== "input_text" && block.type !== "output_text") return "";
+  return block.text ?? "";
+}
+function person_content(payload) {
+  const metadata = payload.internal_chat_message_metadata_passthrough?.content_item_metadata;
+  if (metadata?.length !== payload.content.length) return void 0;
+  const authored = payload.content.filter((_block, index) => metadata[index]?.provenance.type === "user").map((block) => content_text(block));
+  return authored.length === 0 ? void 0 : authored.join("\n");
+}
+function normalize3(line2) {
+  const record11 = json_value.parse_with(line2, record_schema4);
+  if (record11 === void 0) return line2;
+  const { payload, timestamp } = record11;
+  const content = payload.role === "user" ? person_content(payload) : payload.content.map((block) => content_text(block)).join("\n");
+  return JSON.stringify({
+    type: payload.role,
+    timestamp,
+    ...content === void 0 && { origin: { kind: "harness" } },
+    message: { content: content ?? "" }
+  });
+}
+var codex_prompt = { normalize: normalize3 };
+
 // scripts/rules/turn-filings.ts
 function is_filing_use(block) {
   if (!tail_commands.is_bash_use(block)) return false;
@@ -56946,7 +57234,9 @@ function is_person(line2) {
   return line2.origin === null || line2.origin === void 0 || line2.origin.kind === HUMAN_ORIGIN;
 }
 function person_line(line2) {
-  const parsed = PROMPT_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(line2));
+  const normalized3 = codex_prompt.normalize(line2);
+  if (!turn_filings.is_prompt_line(normalized3)) return void 0;
+  const parsed = PROMPT_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(normalized3));
   return parsed.success && is_person(parsed.data) ? parsed.data : void 0;
 }
 function person_text(line2) {
@@ -56955,15 +57245,15 @@ function person_text(line2) {
   return time_reported_failure.result_text(person.message.content);
 }
 function turn_prompt(tail) {
-  const opener = tail.split("\n").findLast((line2) => turn_filings.is_prompt_line(line2));
+  const opener = tail.split("\n").map((line2) => codex_prompt.normalize(line2)).findLast((line2) => turn_filings.is_prompt_line(line2));
   if (opener === void 0) return NO_PROMPT;
   return person_text(opener) ?? NO_PROMPT;
 }
 function person_prompt(tail) {
-  return tail.split("\n").filter((line2) => turn_filings.is_prompt_line(line2)).map((line2) => person_text(line2)).findLast((text3) => text3 !== void 0);
+  return tail.split("\n").map((line2) => person_text(line2)).findLast((text3) => text3 !== void 0);
 }
 function prompt_time(tail) {
-  return tail.split("\n").filter((line2) => turn_filings.is_prompt_line(line2)).map((line2) => person_line(line2)?.timestamp ?? void 0).findLast((time3) => time3 !== void 0);
+  return tail.split("\n").map((line2) => person_line(line2)?.timestamp ?? void 0).findLast((time3) => time3 !== void 0);
 }
 function tail_time(tail) {
   return tail.split("\n").map((line2) => TIMED_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(line2)).data?.timestamp).find((time3) => time3 !== void 0);
@@ -56997,15 +57287,17 @@ var CHECK_FLAG = /\s--check\b/u;
 var QUOTED = /"[^"]*"|'[^']*'/gu;
 var UNASKED_FILING_REASON = "\u26D4 unasked filing: this interactive session files an Issue only on the person\u2019s explicit instruction (\u300C\u8D77\u7968\u300D, \u201Cfile an issue\u201D, or a command whose procedure files, such as `kickoff new`). Propose the Issue in the reply and file it once they confirm. It fires on every occurrence (`.claude/skills/workflow-commands/observation-filing.md`).";
 function is_instructed(prompt) {
-  const trimmed3 = prompt.trim();
-  return FILING_WORDS.some((pattern) => pattern.test(trimmed3));
+  const trimmed5 = issue_citation.prose_lines(prompt).join("\n").replaceAll(/(?<!`)(`+)(?!`)[\s\S]*?(?<!`)\1(?!`)/gu, "").replaceAll(/「[^「」\n]*」|『[^『』\n]*』|"[^"\n]*"|'[^'\n]*'/gu, "").trim();
+  return FILING_WORDS.some((pattern) => pattern.test(trimmed5));
 }
 function reply_text(line2) {
-  const parsed = ASSISTANT_LINE_SCHEMA.safeParse(json_value.parse_or_undefined(line2));
+  const parsed = ASSISTANT_LINE_SCHEMA.safeParse(
+    json_value.parse_or_undefined(codex_prompt.normalize(line2))
+  );
   return parsed.success ? time_reported_failure.result_text(parsed.data.message.content) : "";
 }
 function is_person_line(line2) {
-  return turn_filings.is_prompt_line(line2) && last_prompt.person_prompt(line2) !== void 0;
+  return last_prompt.person_prompt(line2) !== void 0;
 }
 function reply_before_prompt(tail) {
   const lines = tail.split("\n");
@@ -57014,8 +57306,8 @@ function reply_before_prompt(tail) {
   return replies.findLast((text3) => text3 !== "") ?? "";
 }
 function is_confirmed(prompt, tail) {
-  const trimmed3 = prompt.trim();
-  if (trimmed3.length > SHORT_REPLY || !AFFIRMATIVE.test(trimmed3)) return false;
+  const trimmed5 = prompt.trim();
+  if (trimmed5.length > SHORT_REPLY || !AFFIRMATIVE.test(trimmed5)) return false;
   const reply2 = reply_before_prompt(tail);
   return PROPOSALS.some((pattern) => pattern.test(reply2));
 }
@@ -57282,6 +57574,7 @@ var HOLD_RELEASE = "the hook releases the hold itself; it blocks only when that
 var FILING_OFFER = "the filing needs a title and a body only the model can write";
 var CONCISE_REPLY = "the shorter reply is prose only the model can write";
 var NARROW_ENOUGH = "which reading is narrow enough to keep is the author\u2019s call";
+var BODY_TO_FILE = "the body moves to a file the call does not name";
 function rewrite() {
   return { remedy: "rewrite", why: REWRITTEN };
 }
@@ -57307,16 +57600,21 @@ var GUARD_REMEDIES = {
   "shell-body": judgment(
     "which part of the body the shell was meant to expand is the author's, not the hook's"
   ),
-  "raw-field-body": judgment("the body moves to a file the call does not name"),
+  "raw-field-body": judgment(BODY_TO_FILE),
   "credential-body": judgment(
     "which text is the credential, and what replaces it, is the author\u2019s"
   ),
   "rule-body": judgment("a trigger-plus-pointer line is written, not derived"),
   "direct-filing": judgment(ANOTHER_COMMAND),
   "unasked-filing": judgment(NO_RUN),
-  "direct-issue-comment": judgment(ANOTHER_COMMAND),
-  "direct-issue-read": judgment(ANOTHER_COMMAND),
-  "direct-git-status": judgment(ANOTHER_COMMAND),
+  // A standalone `gh issue comment <N> --body-file <path>` run as `pnpm josh issue:comment`; an inline
+  // `--body` is refused, since `issue:comment` trims it and expands `\n` (joshuafolkken/kit#7330).
+  "direct-issue-comment": rewrite(),
+  "direct-issue-read": rewrite(),
+  // a standalone `gh issue view <N>` run as `pnpm josh issue:read <N>`
+  "direct-git-status": judgment(
+    "the refusal is spent once per run and its reissue passes, so a rewrite saves at most one round trip while trading the long-format listing the call asked for for porcelain"
+  ),
   "direct-vitest-run": judgment(ANOTHER_COMMAND),
   "direct-pr-create": judgment(ANOTHER_COMMAND),
   "pr-merge": judgment(ANOTHER_COMMAND),
@@ -57913,8 +58211,8 @@ async function issue_list_by_label_summary(label3, limit, options) {
   });
 }
 async function issue_list_label_first_page(label3) {
-  const path77 = git_gh_issue_list.listing_path({ label: label3 }, FIRST_PAGE);
-  return await git_gh_etag_read.read_detail(path77);
+  const path78 = git_gh_issue_list.listing_path({ label: label3 }, FIRST_PAGE);
+  return await git_gh_etag_read.read_detail(path78);
 }
 async function issue_list_by_label_in_repo(label3, limit, repo) {
   return await issue_list2({ json_fields: SUMMARY_FIELDS, limit, label: label3, repo });
@@ -57968,7 +58266,10 @@ var KEYS = {
   measure_absent: { ja: "\u8A08\u6E2C\u5BA3\u8A00\u306A\u3057", en: "No measure declaration" },
   sample_gate: { ja: "\u5B9F\u65BD\u53EF\u80FD\u6761\u4EF6", en: "Sample gate" },
   not_before: { ja: "\u5B9F\u65BD\u53EF\u80FD\u65E5", en: "Not before" },
-  source: { ja: "\u51FA\u3069\u3053\u308D", en: "Source" }
+  source: { ja: "\u51FA\u3069\u3053\u308D", en: "Source" },
+  constraint_source: { ja: "\u51FA\u6240", en: "Constraint source" },
+  constraint_reference: { ja: "\u53C2\u7167", en: "Constraint reference" },
+  constraint_instruction: { ja: "\u6307\u793A", en: "Constraint instruction" }
 };
 var VALUES = {
   bug: { ja: "\u4E0D\u5177\u5408", en: "defect" },
@@ -57996,7 +58297,8 @@ var HEADINGS = {
   trigger: { ja: "\u767A\u706B\u70B9", en: "Trigger" },
   baseline: { ja: "\u30D9\u30FC\u30B9\u30E9\u30A4\u30F3", en: "Baseline" },
   reproduction: { ja: "\u518D\u73FE", en: "Reproduction" },
-  expected_effect: { ja: "\u671F\u5F85\u52B9\u679C", en: "Expected effect" }
+  expected_effect: { ja: "\u671F\u5F85\u52B9\u679C", en: "Expected effect" },
+  auto_execution_constraint: { ja: "\u81EA\u52D5\u5B9F\u884C\u306E\u5236\u7D04", en: "Automatic execution constraint" }
 };
 var SIZE_VALUES = {
   ja: "\u7D04 <files> \u30D5\u30A1\u30A4\u30EB / <lines> \u884C\uFF08\u30C6\u30B9\u30C8\u9664\u304F\uFF09",
@@ -58052,12 +58354,12 @@ function indent_of2(raw) {
   return raw.slice(0, raw.length - raw.trimStart().length);
 }
 function canonical_value(rest) {
-  const trimmed3 = rest.trimStart();
+  const trimmed5 = rest.trimStart();
   const found = VALUE_TEXTS.find(
-    ({ text: text3 }) => trimmed3.startsWith(text3) && VALUE_END.test(trimmed3.slice(text3.length))
+    ({ text: text3 }) => trimmed5.startsWith(text3) && VALUE_END.test(trimmed5.slice(text3.length))
   );
   if (found === void 0) return rest;
-  return `${indent_of2(rest)}${text_of2(found.row)}${trimmed3.slice(found.text.length)}`;
+  return `${indent_of2(rest)}${text_of2(found.row)}${trimmed5.slice(found.text.length)}`;
 }
 function canonical_declaration(raw) {
   const text3 = raw.trimStart();
@@ -58190,7 +58492,7 @@ var DECLARATION_LINE = new RegExp(
 );
 var BACKGROUND_HEADING = issue_body_keys.heading("background");
 var BULLET3 = "- ";
-var NEWLINE = "\n";
+var NEWLINE2 = "\n";
 var DECLARE_COMMAND = "pnpm josh issue:release-class <issue> <label>";
 var DECIDING_LABELS = [ENHANCEMENT_LABEL, BUG_LABEL, BREAKING_CHANGE_LABEL].join(", ");
 var LEGACY_LABELS = /* @__PURE__ */ new Set(["semver-major", "semver-minor"]);
@@ -58222,8 +58524,8 @@ function block_end(lines) {
   return run4 === -1 ? lines.length : first + run4;
 }
 function append_line2(before, line2) {
-  const separator = before === "" || before.endsWith(NEWLINE) ? "" : NEWLINE;
-  return `${before}${separator}${line2}${NEWLINE}`;
+  const separator = before === "" || before.endsWith(NEWLINE2) ? "" : NEWLINE2;
+  return `${before}${separator}${line2}${NEWLINE2}`;
 }
 function insert_line(section2, line2) {
   const lines = section2.split(/(?<=\n)/u);
@@ -58236,7 +58538,7 @@ function with_declaration(body, label3) {
     return append_line2(stripped, declaration(label3));
   }
   return markdown_section.map_section(
-    stripped.endsWith(NEWLINE) ? stripped : `${stripped}${NEWLINE}`,
+    stripped.endsWith(NEWLINE2) ? stripped : `${stripped}${NEWLINE2}`,
     (line2) => line2.trim() === BACKGROUND_HEADING,
     (section2) => insert_line(section2, declaration(label3))
   );
@@ -58251,7 +58553,7 @@ function release_candidates(candidates2) {
 function issue_candidates(labels2, body) {
   const names = labels2.map((label3) => label3.toLowerCase());
   const declared = [
-    ...markdown_section.canonical_lines(body).join(NEWLINE).matchAll(DECLARATION)
+    ...markdown_section.canonical_lines(body).join(NEWLINE2).matchAll(DECLARATION)
   ].map((match) => match[1] ?? "");
   const candidates2 = [...release_candidates([...names, ...declared].filter(is_classification))];
   const unknown2 = declared.filter((value2) => !is_classification(value2));
@@ -58283,10 +58585,10 @@ function select_issue_classification(issue_json) {
   );
 }
 function fetch_current_labels(repository2, pull_number) {
-  const path77 = git_gh_api_path.issue_labels_api_path(String(pull_number), repository2);
+  const path78 = git_gh_api_path.issue_labels_api_path(String(pull_number), repository2);
   try {
     const names = git_gh_exec.exec_gh_api_sync({
-      path: path77,
+      path: path78,
       should_paginate: true,
       jq_filter: LABEL_NAMES_FILTER2
     });
@@ -58564,9 +58866,9 @@ async function read_comments2(branch_name, to_path, to_json) {
     note_unreadable_comments(branch_name, unresolved_reason(read14));
     return void 0;
   }
-  const path77 = `${to_path(String(read14.pr_number))}${COMMENTS_QUERY}`;
+  const path78 = `${to_path(String(read14.pr_number))}${COMMENTS_QUERY}`;
   try {
-    return to_json(await git_gh_exec.exec_gh_api({ path: path77, should_paginate: true }));
+    return to_json(await git_gh_exec.exec_gh_api({ path: path78, should_paginate: true }));
   } catch (error62) {
     note_unreadable_comments(branch_name, error_text.message_of(error62));
     return void 0;
@@ -58637,36 +58939,36 @@ var UNREADABLE_POLL_MESSAGE = "gh api could not read a merge-gate poll";
 var PAGE_SIZE = 100;
 var kept_by_path = /* @__PURE__ */ new Map();
 var page_schema = external_exports.object({ total_count: external_exports.number() });
-function unreadable2(path77, answer2) {
+function unreadable2(path78, answer2) {
   const cause = answer2.kind === "unreadable" ? answer2.cause : void 0;
   const reason4 = cause === void 0 ? "" : `: ${error_text.message_of(cause)}`;
-  return new Error(`${UNREADABLE_POLL_MESSAGE}: ${path77}${reason4}`, { cause });
+  return new Error(`${UNREADABLE_POLL_MESSAGE}: ${path78}${reason4}`, { cause });
 }
-function settle_kept(path77, answer2) {
-  const settled2 = git_gh_etag_read.settle(kept_by_path.get(path77), answer2);
-  if (settled2?.kept !== void 0) kept_by_path.set(path77, settled2.kept);
+function settle_kept(path78, answer2) {
+  const settled2 = git_gh_etag_read.settle(kept_by_path.get(path78), answer2);
+  if (settled2?.kept !== void 0) kept_by_path.set(path78, settled2.kept);
   return settled2?.body;
 }
-async function read_answer(path77) {
-  return await git_gh_conditional.read_conditional(path77, kept_by_path.get(path77)?.etag);
+async function read_answer(path78) {
+  return await git_gh_conditional.read_conditional(path78, kept_by_path.get(path78)?.etag);
 }
-async function read10(path77) {
-  const answer2 = await read_answer(path77);
-  const body = settle_kept(path77, answer2);
-  if (body === void 0) throw unreadable2(path77, answer2);
+async function read10(path78) {
+  const answer2 = await read_answer(path78);
+  const body = settle_kept(path78, answer2);
+  if (body === void 0) throw unreadable2(path78, answer2);
   return body;
 }
-async function read_detail2(path77) {
-  const answer2 = await read_answer(path77);
-  const body = settle_kept(path77, answer2);
+async function read_detail2(path78) {
+  const answer2 = await read_answer(path78);
+  const body = settle_kept(path78, answer2);
   return body === void 0 ? void 0 : { body, is_unchanged: answer2.kind === "unchanged" };
 }
 function is_whole_listing(page) {
   const total = json_value.parse_with(page, page_schema)?.total_count;
   return total !== void 0 && total <= PAGE_SIZE;
 }
-async function read_object_pages(path77) {
-  const full_path = `${path77}${FULL_PAGE_QUERY}`;
+async function read_object_pages(path78) {
+  const full_path = `${path78}${FULL_PAGE_QUERY}`;
   const page = await read10(full_path);
   if (is_whole_listing(page)) return `[${page}]`;
   return await git_gh_exec.exec_gh_api({
@@ -58675,8 +58977,8 @@ async function read_object_pages(path77) {
     should_slurp: true
   });
 }
-async function read_array_pages(path77) {
-  return await git_gh_etag_read.read_listing(`${path77}${FULL_PAGE_QUERY}`, PAGE_SIZE, read10);
+async function read_array_pages(path78) {
+  return await git_gh_etag_read.read_listing(`${path78}${FULL_PAGE_QUERY}`, PAGE_SIZE, read10);
 }
 function forget_poll_reads() {
   kept_by_path.clear();
@@ -59073,8 +59375,8 @@ async function read_status_check_rollup(commit_sha) {
   return git_gh_pr_rollup.to_status_check_rollup({ check_runs_json, status_json });
 }
 async function read_rest_review_decision(pr_number) {
-  const path77 = git_gh_api_path.pull_reviews_api_path(String(pr_number));
-  return git_gh_pr_review.to_review_decision(await git_gh_poll_read.read_array_pages(path77));
+  const path78 = git_gh_api_path.pull_reviews_api_path(String(pr_number));
+  return git_gh_pr_review.to_review_decision(await git_gh_poll_read.read_array_pages(path78));
 }
 async function pr_get_review_decision(pr_number) {
   const graphql_decision = await git_gh_pr_graphql_snapshot.read_review_decision(pr_number);
@@ -59388,14 +59690,14 @@ function next_etag(read14, previous) {
 }
 async function probe_head(branch_name, etags) {
   const reads = await Promise.all(
-    probe_paths(branch_name).map(async (path77) => ({
-      path: path77,
-      read: await git_gh_conditional.read_conditional(path77, etags.get(path77))
+    probe_paths(branch_name).map(async (path78) => ({
+      path: path78,
+      read: await git_gh_conditional.read_conditional(path78, etags.get(path78))
     }))
   );
   return {
     is_unchanged: reads.every(({ read: read14 }) => read14.kind === "unchanged"),
-    etags: new Map(reads.map(({ path: path77, read: read14 }) => [path77, next_etag(read14, etags.get(path77))]))
+    etags: new Map(reads.map(({ path: path78, read: read14 }) => [path78, next_etag(read14, etags.get(path78))]))
   };
 }
 function is_merge_state_known(snapshot4) {
@@ -60280,9 +60582,9 @@ var run_watcher_guard = {
 // scripts/run/run-watcher-hook.ts
 var SWITCH_ENV_KEY8 = "JOSH_WATCHER_GUARD";
 var STAMP_PREFIX6 = "josh-watcher-guard-";
-var payload_schema2 = external_exports.object({ transcript_path: external_exports.string().min(1) });
+var payload_schema3 = external_exports.object({ transcript_path: external_exports.string().min(1) });
 function transcript_of3(raw_payload) {
-  return json_value.parse_with(raw_payload, payload_schema2)?.transcript_path;
+  return json_value.parse_with(raw_payload, payload_schema3)?.transcript_path;
 }
 function fires_once(transcript, now_ms) {
   const stamp2 = hook_decision.create_refusal_stamp(STAMP_PREFIX6);
@@ -60453,11 +60755,11 @@ var run_poll_hook = {
 
 // scripts/hooks/bash-revert.ts
 import { copyFileSync as copyFileSync2, existsSync as existsSync23, mkdirSync as mkdirSync6, readFileSync as readFileSync31, rmSync as rmSync7 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 
 // scripts/hooks/step-zero-notice.ts
 import { tmpdir as tmpdir4 } from "node:os";
-import path67 from "node:path";
+import path68 from "node:path";
 var STAMP_PREFIX8 = "josh-step-zero-notice-";
 var EDIT_TOOLS3 = /* @__PURE__ */ new Set(["Edit", "Write"]);
 var PARENT_PREFIX = "..";
@@ -60472,22 +60774,22 @@ function edited_paths(tool_input) {
   );
 }
 function is_external(relative) {
-  return relative.startsWith(PARENT_PREFIX) || path67.isAbsolute(relative);
+  return relative.startsWith(PARENT_PREFIX) || path68.isAbsolute(relative);
 }
-function is_scratch_record(file_path3) {
-  const relative = path67.relative(tmpdir4(), file_path3);
+function is_scratch_record(file_path3, scratch_root = tmpdir4()) {
+  const relative = path68.relative(scratch_root, file_path3);
   const is_scratch = !is_external(relative);
-  return is_scratch && [".md", ".json", ".txt"].includes(path67.extname(file_path3));
+  return is_scratch && [".md", ".json", ".txt"].includes(path68.extname(file_path3));
 }
 function should_skip_external(relative, file_path3, should_include_external) {
   return is_external(relative) && (!should_include_external || is_scratch_record(file_path3));
 }
 function is_runtime_file(file_path3, root2, should_include_external = false) {
-  const relative = path67.relative(root2, path67.resolve(root2, file_path3));
-  if (should_skip_external(relative, path67.resolve(root2, file_path3), should_include_external)) {
+  const relative = path68.relative(root2, path68.resolve(root2, file_path3));
+  if (is_scratch_record(path68.resolve(root2, file_path3), path68.join(root2, ".josh/tmp")) || should_skip_external(relative, path68.resolve(root2, file_path3), should_include_external)) {
     return false;
   }
-  return !test_declared_logic.is_exempt(relative.split(path67.sep).join("/"));
+  return !test_declared_logic.is_exempt(relative.split(path68.sep).join("/"));
 }
 function is_runtime_edit(raw_payload, root2 = process.cwd(), should_include_external = false) {
   const payload = hook_tool_payload.parse(raw_payload);
@@ -60547,7 +60849,7 @@ function is_guarded_file(file2, root2) {
 }
 function snapshot3(root2, entries = dirty_entries(root2)) {
   const runtime = entries.map((entry) => entry.slice(STATUS_WIDTH)).filter((file2) => is_guarded_file(file2, root2));
-  return Object.fromEntries(runtime.map((file2) => [file2, content_hash(path68.join(root2, file2))]));
+  return Object.fromEntries(runtime.map((file2) => [file2, content_hash(path69.join(root2, file2))]));
 }
 function guarded_transcript(raw_payload) {
   if (agent_session_role.can_implement()) return void 0;
@@ -60555,17 +60857,17 @@ function guarded_transcript(raw_payload) {
   return payload?.tool_name === "Bash" ? payload.transcript_path : void 0;
 }
 function copy_into(source, destination) {
-  mkdirSync6(path68.dirname(destination), { recursive: true });
+  mkdirSync6(path69.dirname(destination), { recursive: true });
   copyFileSync2(source, destination);
 }
 function saved_directory(transcript, root2) {
-  const key3 = path68.basename(stamp_file.stamp_path(STAMP_PREFIX9, transcript), STAMP_EXTENSION);
-  return path68.join(root2, BACKUP_DIRECTORY, BEFORE_CALL_DIRECTORY, key3);
+  const key3 = path69.basename(stamp_file.stamp_path(STAMP_PREFIX9, transcript), STAMP_EXTENSION);
+  return path69.join(root2, BACKUP_DIRECTORY, BEFORE_CALL_DIRECTORY, key3);
 }
 function save_dirty(before, root2, saved) {
   rmSync7(saved, { recursive: true, force: true });
   for (const [file2, hash2] of Object.entries(before)) {
-    if (hash2 !== ABSENT) copy_into(path68.join(root2, file2), path68.join(saved, file2));
+    if (hash2 !== ABSENT) copy_into(path69.join(root2, file2), path69.join(saved, file2));
   }
 }
 function stamp(raw_payload, root2 = process.cwd()) {
@@ -60593,9 +60895,9 @@ function moved_entries(transcript, root2) {
   const after = snapshot3(root2, entries);
   const saved = saved_directory(transcript, root2);
   const dirty = Object.keys(before).filter(
-    (file2) => content_hash(path68.join(root2, file2)) !== before[file2]
+    (file2) => content_hash(path69.join(root2, file2)) !== before[file2]
   );
-  const intact = dirty.filter((file2) => content_hash(path68.join(saved, file2)) === before[file2]);
+  const intact = dirty.filter((file2) => content_hash(path69.join(saved, file2)) === before[file2]);
   return {
     revert: entries.filter((entry) => {
       const file2 = entry_file(entry);
@@ -60610,20 +60912,20 @@ function restore2(file2, root2) {
   if (restored.exit_code !== 0) git_spawn_sync.run(["rm", "-q", "-f", "--", file2], { cwd: root2 });
 }
 function back_up(file2, root2, backup) {
-  const source = path68.join(root2, file2);
-  if (existsSync23(source)) copy_into(source, path68.join(backup, file2));
+  const source = path69.join(root2, file2);
+  if (existsSync23(source)) copy_into(source, path69.join(backup, file2));
 }
 function revert_file(entry, root2, backup) {
   const file2 = entry_file(entry);
   back_up(file2, root2, backup);
-  if (entry.startsWith(UNTRACKED)) rmSync7(path68.join(root2, file2), { force: true });
+  if (entry.startsWith(UNTRACKED)) rmSync7(path69.join(root2, file2), { force: true });
   else restore2(file2, root2);
 }
 function restore_saved(file2, root2, backup, saved) {
-  const copy = path68.join(saved, file2);
+  const copy = path69.join(saved, file2);
   back_up(file2, root2, backup);
-  if (existsSync23(copy)) copy_into(copy, path68.join(root2, file2));
-  else rmSync7(path68.join(root2, file2), { force: true });
+  if (existsSync23(copy)) copy_into(copy, path69.join(root2, file2));
+  else rmSync7(path69.join(root2, file2), { force: true });
 }
 function put_back(moved, root2, backup, saved) {
   for (const entry of moved.revert) revert_file(entry, root2, backup);
@@ -60650,8 +60952,8 @@ function revert(raw_payload, root2 = process.cwd()) {
   if (transcript === void 0) return void 0;
   const moved = moved_entries(transcript, root2);
   if (moved.revert.length + moved.restore.length + moved.keep.length === 0) return void 0;
-  const backup = path68.join(BACKUP_DIRECTORY, (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-"));
-  put_back(moved, root2, path68.join(root2, backup), saved_directory(transcript, root2));
+  const backup = path69.join(BACKUP_DIRECTORY, (/* @__PURE__ */ new Date()).toISOString().replaceAll(":", "-"));
+  put_back(moved, root2, path69.join(root2, backup), saved_directory(transcript, root2));
   return JSON.stringify({ decision: "block", reason: block_reason2(moved, backup) });
 }
 function is_shell2(raw_payload) {
@@ -60758,11 +61060,11 @@ var direct_gh_usage = { record: record8 };
 // scripts/hooks/hook-demoted.ts
 import { readFileSync as readFileSync33 } from "node:fs";
 import { mkdir as mkdir3, writeFile as writeFile2 } from "node:fs/promises";
-import path72 from "node:path";
+import path73 from "node:path";
 
 // scripts/hooks/hook-ledger.ts
 import { appendFile as appendFile2, mkdir as mkdir2 } from "node:fs/promises";
-import path71 from "node:path";
+import path72 from "node:path";
 
 // scripts/lib/git-animation.ts
 import ora from "ora";
@@ -60950,7 +61252,7 @@ var git_branch = {
 
 // scripts/observations/observation-ledger-home.ts
 import { appendFile, mkdir, readdir, readFile as readFile2 } from "node:fs/promises";
-import path70 from "node:path";
+import path71 from "node:path";
 
 // scripts/observations/observation-ledger-migrate.ts
 import {
@@ -60962,7 +61264,7 @@ import {
   rmdirSync,
   rmSync as rmSync8
 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 
 // scripts/observations/observation-ledger-line.ts
 var KEY_PREFIX = "- k:";
@@ -61024,7 +61326,7 @@ var observation_ledger_line = {
 };
 
 // scripts/observations/observation-ledger-migrate.ts
-var NEWLINE2 = "\n";
+var NEWLINE3 = "\n";
 function claim_path(legacy) {
   return `${legacy}.${String(process.pid)}${MIGRATION_CLAIM_SUFFIX}`;
 }
@@ -61043,24 +61345,24 @@ function is_stale_claim(name, legacy_name) {
   return Number.isSafeInteger(pid) && !process_identity.is_present_pid(pid);
 }
 function stale_claims(legacy) {
-  const directory = path69.dirname(legacy);
+  const directory = path70.dirname(legacy);
   try {
-    return readdirSync11(directory).filter((name) => is_stale_claim(name, path69.basename(legacy))).map((name) => path69.join(directory, name));
+    return readdirSync11(directory).filter((name) => is_stale_claim(name, path70.basename(legacy))).map((name) => path70.join(directory, name));
   } catch {
     return [];
   }
 }
 function terminated(content) {
-  return content.length === 0 || content.endsWith(NEWLINE2) ? content : `${content}${NEWLINE2}`;
+  return content.length === 0 || content.endsWith(NEWLINE3) ? content : `${content}${NEWLINE3}`;
 }
 function carried(content, ledger) {
   if (ledger === void 0) return terminated(content);
-  const lines = content.split(NEWLINE2).filter((line2) => line2.length > 0);
+  const lines = content.split(NEWLINE3).filter((line2) => line2.length > 0);
   const missing = observation_ledger_line.missing_lines(lines, ledger);
-  return missing.length === 0 ? "" : `${missing.join(NEWLINE2)}${NEWLINE2}`;
+  return missing.length === 0 ? "" : `${missing.join(NEWLINE3)}${NEWLINE3}`;
 }
 function absorb(claimed, target3) {
-  mkdirSync7(path69.dirname(target3), { recursive: true });
+  mkdirSync7(path70.dirname(target3), { recursive: true });
   appendFileSync2(
     target3,
     carried(readFileSync32(claimed, "utf8"), file_reader.read_if_readable(target3)),
@@ -61098,11 +61400,11 @@ function legacy_directory_names(directory) {
   }
 }
 function migrate_directory(root2) {
-  const legacy_directory = path69.join(root2, LEGACY_OBSERVATION_LEDGER_DIRECTORY);
+  const legacy_directory = path70.join(root2, LEGACY_OBSERVATION_LEDGER_DIRECTORY);
   const did_move = legacy_directory_names(legacy_directory).map(
     (name) => migrate_one(
-      path69.join(legacy_directory, name),
-      path69.join(root2, OBSERVATION_LEDGER_DIRECTORY, name)
+      path70.join(legacy_directory, name),
+      path70.join(root2, OBSERVATION_LEDGER_DIRECTORY, name)
     )
   ).some(Boolean);
   try {
@@ -61112,9 +61414,9 @@ function migrate_directory(root2) {
   return did_move;
 }
 function migrate(root2) {
-  const target3 = path69.join(root2, OBSERVATION_LEDGER_DIRECTORY, LEGACY_LEDGER_FILE);
+  const target3 = path70.join(root2, OBSERVATION_LEDGER_DIRECTORY, LEGACY_LEDGER_FILE);
   const moved_files = LEGACY_OBSERVATION_LEDGER_PATHS.map(
-    (legacy) => migrate_one(path69.join(root2, legacy), target3)
+    (legacy) => migrate_one(path70.join(root2, legacy), target3)
   );
   return [...moved_files, migrate_directory(root2)].some(Boolean);
 }
@@ -61128,11 +61430,11 @@ function ledger_root(cwd = process.cwd()) {
 function ledger_directory(cwd = process.cwd()) {
   const root2 = ledger_root(cwd);
   observation_ledger_migrate.migrate(root2);
-  return path70.join(root2, OBSERVATION_LEDGER_DIRECTORY);
+  return path71.join(root2, OBSERVATION_LEDGER_DIRECTORY);
 }
 function file_path2(name, cwd) {
   ledger_directory(cwd);
-  return path70.join(ledger_root(cwd), observation_ledger.ledger_file(name));
+  return path71.join(ledger_root(cwd), observation_ledger.ledger_file(name));
 }
 function issue_path(issue3, cwd = process.cwd()) {
   return file_path2(issue3, cwd);
@@ -61175,13 +61477,13 @@ async function read11(cwd = process.cwd(), is_strict = false) {
   const files2 = await ledger_files(directory, is_strict);
   if (files2 === void 0) return void 0;
   const contents = await Promise.all(
-    files2.map(async (name) => await read_file(path70.join(directory, name), is_strict))
+    files2.map(async (name) => await read_file(path71.join(directory, name), is_strict))
   );
   return contents.join("");
 }
 async function append4(target3, lines) {
   if (lines.length === 0) return;
-  await mkdir(path70.dirname(target3), { recursive: true });
+  await mkdir(path71.dirname(target3), { recursive: true });
   await appendFile(target3, `${lines.join("\n")}
 `, "utf8");
 }
@@ -61192,6 +61494,7 @@ var observation_ledger_home = {
   ledger_date,
   ledger_root,
   read: read11,
+  read_file,
   writer_path
 };
 
@@ -61203,12 +61506,12 @@ var RULE_HEAD = 48;
 var STOP_TOOL = "Stop";
 var COMMAND_FIELDS = ["command", "file_path", "pattern", "url", "prompt"];
 var input_schema = external_exports.record(external_exports.string(), external_exports.unknown());
-var payload_schema3 = external_exports.object({
+var payload_schema4 = external_exports.object({
   tool_name: external_exports.string().catch(STOP_TOOL),
   tool_input: external_exports.unknown().optional(),
   transcript_path: external_exports.string().catch("")
 });
-var EMPTY_PAYLOAD = payload_schema3.parse({});
+var EMPTY_PAYLOAD = payload_schema4.parse({});
 var block_schema = external_exports.object({ decision: external_exports.literal("block"), reason: external_exports.string() });
 function rule_of(reason4) {
   const guard = time_transcript_line.guard_from_refusal(reason4);
@@ -61219,12 +61522,12 @@ function command_of2(input2) {
   const value2 = COMMAND_FIELDS.map((key3) => fields[key3]).find((field2) => typeof field2 === "string");
   return typeof value2 === "string" ? value2.slice(0, COMMAND_HEAD) : "";
 }
-function entry_of2(refusal4, branch2, now, environment3) {
-  const payload = json_value.parse_with(refusal4.raw_payload, payload_schema3) ?? EMPTY_PAYLOAD;
+function entry_of2(refusal6, branch2, now, environment3) {
+  const payload = json_value.parse_with(refusal6.raw_payload, payload_schema4) ?? EMPTY_PAYLOAD;
   return {
     at: now.toISOString(),
-    hook: refusal4.hook,
-    rule: rule_of(refusal4.reason),
+    hook: refusal6.hook,
+    rule: rule_of(refusal6.reason),
     tool: payload.tool_name,
     role: environment3[agent_session_role.KEY] ?? "",
     issue: git_branch.issue_from_branch(branch2),
@@ -61235,19 +61538,19 @@ function entry_of2(refusal4, branch2, now, environment3) {
 function ledger_directory2(context = hook_context.from_process()) {
   if (context.env["VITEST"] !== void 0) return void 0;
   const common2 = git_common_directory.repository(context.cwd);
-  return common2 === void 0 ? void 0 : path71.join(common2, git_common_directory.STATE_DIRECTORY, LEDGER_DIRECTORY);
+  return common2 === void 0 ? void 0 : path72.join(common2, git_common_directory.STATE_DIRECTORY, LEDGER_DIRECTORY);
 }
 async function append5(entry, directory) {
   const day = observation_ledger_home.ledger_date(new Date(entry.at));
   await mkdir2(directory, { recursive: true });
-  await appendFile2(path71.join(directory, `${day}${LEDGER_EXTENSION}`), `${JSON.stringify(entry)}
+  await appendFile2(path72.join(directory, `${day}${LEDGER_EXTENSION}`), `${JSON.stringify(entry)}
 `);
 }
-async function record9(refusal4, directory = ledger_directory2(), context = hook_context.from_process()) {
+async function record9(refusal6, directory = ledger_directory2(), context = hook_context.from_process()) {
   if (directory === void 0) return;
   try {
     const branch2 = await git_spawn.read(["-C", context.cwd, "rev-parse", "--abbrev-ref", "HEAD"]);
-    await append5(entry_of2(refusal4, branch2, /* @__PURE__ */ new Date(), context.env), directory);
+    await append5(entry_of2(refusal6, branch2, /* @__PURE__ */ new Date(), context.env), directory);
   } catch {
   }
 }
@@ -61286,7 +61589,7 @@ function rules(environment3 = process.env) {
 async function write_rules(demoted, file2 = DEMOTED_FILE) {
   const sorted = [...demoted].toSorted((left, right) => left.localeCompare(right));
   const body = JSON.stringify({ rules: sorted }, void 0, INDENT);
-  await mkdir3(path72.dirname(file2), { recursive: true });
+  await mkdir3(path73.dirname(file2), { recursive: true });
   await writeFile2(file2, `${body}
 `);
 }
@@ -61315,7 +61618,7 @@ var hook_demoted = {
 };
 
 // scripts/hooks/implementation-shell.ts
-import path75 from "node:path";
+import path76 from "node:path";
 
 // scripts/josh/josh-commands-backlog.ts
 var EXCLUDE = "--exclude <N>";
@@ -62003,7 +62306,7 @@ var ISSUE_WRITE_COMMANDS = {
         },
         {
           names: ["--label <name>"],
-          description: "an extra label (for example `epic`). Repeatable."
+          description: "an extra label (e.g. `epic`). Repeatable. With `josh.worker`, `worker:<name>` names a printed profile."
         },
         {
           names: ["--defect / --verification / --every-run <yes|no|unknown>"],
@@ -62027,7 +62330,7 @@ var ISSUE_WRITE_COMMANDS = {
         },
         {
           names: ["--no-auto-ok"],
-          description: "needs a person's judgement (Tier B / C); no `auto-ok`."
+          description: "needs human judgement or a verified user prohibition; no `auto-ok`."
         },
         {
           names: ["--release"],
@@ -62102,7 +62405,7 @@ var ISSUE_WRITE_COMMANDS = {
 // scripts/josh/josh-commands-issue.ts
 var REPO3 = "--repo <owner/repo>";
 var CONCURRENT = "several numbers, read concurrently";
-var REPO_FLAG = {
+var REPO_FLAG2 = {
   names: [REPO3],
   description: "read an issue in another repository; applies to every number."
 };
@@ -62147,7 +62450,7 @@ var ISSUE_COMMANDS = {
         { arguments: "1715 1567 1605", note: CONCURRENT },
         { arguments: "42 --repo joshuafolkken/app-kit", note: "an issue in another repo" }
       ],
-      flags: [REPO_FLAG]
+      flags: [REPO_FLAG2]
     }
   },
   "issue:state": {
@@ -62161,7 +62464,7 @@ var ISSUE_COMMANDS = {
         { arguments: "42 43 44", note: "each block headed by `issue:`" },
         { arguments: "42 43 --repo joshuafolkken/app-kit", note: "a child in another repo" }
       ],
-      flags: [REPO_FLAG]
+      flags: [REPO_FLAG2]
     }
   },
   "issue:scout": {
@@ -62777,7 +63080,7 @@ var PROGRESS_COMMANDS = {
 // scripts/josh/josh-commands-run.ts
 var OWNER2 = "--owner <pid>";
 var OUTPUT = "--output <path>";
-var REPO_FLAG2 = { names: ["--repo <owner/name>"], description: "a child in another repository." };
+var REPO_FLAG3 = { names: ["--repo <owner/name>"], description: "a child in another repository." };
 var ISSUE = { arguments: "<N>" };
 var RUN_HOLD_SCRIPT = "scripts/run/hold/run-hold-main.ts";
 var RUN_COMMANDS = {
@@ -62940,17 +63243,25 @@ var RUN_COMMANDS = {
   },
   "run:park": {
     script: "scripts/run/park/run-park-cli.ts",
-    description: "Park a lane child for a decision, or clear the park",
+    description: "Park a lane child for a decision or an escalation, or clear the park",
     category: "AI tools",
     tsx_arguments: OPTIONAL_ENV_FILE_FLAGS,
-    reference: ["<issue> --body-file <path> | <issue> --clear", "automation", ["files", "network"]],
+    reference: [
+      "<issue> --body-file <path> | <issue> --clear | <issue> --escalate <reason>",
+      "automation",
+      ["files", "network"]
+    ],
     usage: {
       examples: [
         {
           arguments: "1839 --body-file .josh/tmp/park-1839.md",
           note: "options, tiers and a recommendation; then needs-decision, the record, run:release"
         },
-        { arguments: "1839 --clear", note: "remove needs-decision and the record" }
+        { arguments: "1839 --clear", note: "remove needs-decision and the record" },
+        {
+          arguments: '1839 --escalate "needs a stronger model"',
+          note: "josh.worker.escalate only: run:stalled with the reason, resumed one profile up"
+        }
       ]
     }
   },
@@ -62978,7 +63289,7 @@ var RUN_COMMANDS = {
           description: "silent window the file must be frozen for (default 30)."
         },
         { names: ["--gap <sec>"], description: "spacing between samples (default 5)." },
-        REPO_FLAG2
+        REPO_FLAG3
       ]
     }
   },
@@ -62997,7 +63308,7 @@ var RUN_COMMANDS = {
           names: [OUTPUT],
           description: "the child's transcript, absolute and under the home or temp directory (validated the same way `run:liveness --output` is)."
         },
-        REPO_FLAG2
+        REPO_FLAG3
       ]
     }
   },
@@ -63736,7 +64047,7 @@ var AI_COMMANDS = {
     description: "Record a lane child's planned files; yield its lane, naming file and holder, when an earlier-planned running lane declares or plans one; `--size-approval` bounds lines/files",
     category: "AI tools",
     reference: [
-      "<issue> <path>... [--probe] [--single] [--size-approval <json-file>] [--imports <path>...]",
+      "<issue> <path>... [--probe] [--single] [--estimate <json-file>] [--size-approval <json-file>] [--imports <path>...]",
       "automation",
       ["files", "network"]
     ],
@@ -63799,7 +64110,7 @@ var AI_COMMANDS = {
   },
   "lane:stats": {
     ...MEASURE_ARGUMENTS,
-    description: "Print period lane throughput, stage, stop, check and machine-load statistics; --sinks shows stage totals, --over lane chains, --why cause groups above a net-minute threshold, and --pairs scoped pair runs",
+    description: "Print period lane throughput, stage, stop (by failed CI check, longest first), check and machine-load statistics; --sinks shows stage totals, --over lane chains, --why cause groups above a net-minute threshold, and --pairs scoped pair runs",
     category: "AI tools",
     reference: [
       "(--period <days> | --since <instant>) [--limit <lane-limit> | --sinks [<minutes>] | --over <minutes> | --why <minutes> | --pairs]",
@@ -63967,16 +64278,16 @@ import { availableParallelism } from "node:os";
 
 // scripts/test/unit-lane-count.ts
 import { readdirSync as readdirSync12 } from "node:fs";
-import path73 from "node:path";
+import path74 from "node:path";
 function is_idle_lane(lanes_root, issue3, environment3) {
-  const common2 = git_directory.resolve_git_directory(path73.join(lanes_root, issue3));
+  const common2 = git_directory.resolve_git_directory(path74.join(lanes_root, issue3));
   if (common2 === void 0) return false;
   const override = environment3[platform_temporary.TEMP_ROOT_KEY];
   const state_root3 = durable_state_root.state_root(override, () => common2);
   return lane_state_record.is_idle(state_root3, common2, issue3);
 }
 function own_lane(checkout2, environment3) {
-  return lane_paths.lane_issue_of(lane_paths.checkout_of(path73.resolve(checkout2)), environment3);
+  return lane_paths.lane_issue_of(lane_paths.checkout_of(path74.resolve(checkout2)), environment3);
 }
 function live_lane_count(checkout2 = process.cwd(), environment3 = process.env) {
   try {
@@ -63994,7 +64305,7 @@ var unit_lane_count = { live_lane_count };
 
 // scripts/test/unit-run-marker.ts
 import { readdirSync as readdirSync13 } from "node:fs";
-import path74 from "node:path";
+import path75 from "node:path";
 var RUN_PREFIX = "josh-unit-running-";
 var MIN_WORKERS = 1;
 var SOLO_RUNS = 1;
@@ -64031,7 +64342,7 @@ function is_marker_live(source) {
   return false;
 }
 function live_run_count(directory = PLATFORM_TEMP_ROOT) {
-  return marker_files(directory).filter((name) => is_marker_live(path74.join(directory, name))).length;
+  return marker_files(directory).filter((name) => is_marker_live(path75.join(directory, name))).length;
 }
 var NESTED_KEY = "JOSH_UNIT_RUN_MARKED";
 var NESTED_VALUE = "1";
@@ -64567,6 +64878,7 @@ var TEST_CHECK_COMMANDS = {
 
 // scripts/josh/josh-commands-development.ts
 var NARROWED = { arguments: "scripts/thing.ts", note: "narrow by the given files instead" };
+var FORWARDED_TO_VITEST = "flags are forwarded to vitest";
 var UNSEEDED = {};
 var FILE_ARGUMENTS = "[files...]";
 var REQUIRED_FILE_ARGUMENTS = "<files...>";
@@ -64608,13 +64920,14 @@ var DEV_COMMANDS = {
     script: "scripts/lint/lint-parallel-main.ts",
     description: "Check code with prettier and eslint (skips a tool a basic project lacks)",
     category: "Development",
-    reference: ["[--changed]", "developer", ["processes"]],
+    reference: ["[--changed] [--shard=<n>]", "developer", ["processes"]],
     core_weight: core_weights.CORE_WEIGHTS.lint,
     memory_mb: core_weights.MEMORY_MB.lint,
     usage: {
       examples: [
         { arguments: "" },
-        { arguments: "--changed", note: "the branch's changed files \u2014 the gate's form" }
+        { arguments: "--changed", note: "the branch's changed files \u2014 the gate's form" },
+        { arguments: "--shard=1", note: "one of two fixed halves of the tree (1 or 2) \u2014 a CI leg" }
       ]
     }
   },
@@ -64682,7 +64995,11 @@ var DEV_COMMANDS = {
     script: "scripts/rules/rule-value-cli.ts",
     description: "Print each delivered rule's unaided compliance \u2014 runs reached, kept rate, refusals",
     category: "AI tools",
-    reference: ["[--fresh | --refresh | --prose]", "developer", ["files"]],
+    reference: [
+      "[--fresh | --refresh | --period <days> | --weekly <rule-id>... | --prose]",
+      "developer",
+      ["files"]
+    ],
     usage: {
       examples: [
         { arguments: "", note: "a reading cached under 15 minutes ago, else measure" },
@@ -64691,6 +65008,14 @@ var DEV_COMMANDS = {
           arguments: "--refresh",
           note: "write the reading to the loop-head cache instead of stdout"
         },
+        {
+          arguments: "--period 7",
+          note: "measure only the transcripts written in the last 7 days, cache untouched"
+        },
+        {
+          arguments: "--weekly <rule-id>...",
+          note: "reached / refused / rephrased of the named rules, one line per week"
+        },
         { arguments: "--prose", note: "class each prose rule: enforced, measured or prose only" }
       ]
     }
@@ -64775,7 +65100,9 @@ var DEV_COMMANDS = {
     category: "Development",
     reference: [FILTER_ARGUMENTS, "developer", ["processes"]],
     ...gate_plan.DIRECT_UNIT_CLAIM,
-    usage: { examples: [{ arguments: "" }] }
+    usage: {
+      examples: [{ arguments: "" }, { arguments: "--shard=1/3", note: FORWARDED_TO_VITEST }]
+    }
   },
   "test:related": {
     script: "scripts/test/test-related-main.ts",
@@ -64786,8 +65113,8 @@ var DEV_COMMANDS = {
       examples: [
         { arguments: "" },
         NARROWED,
-        { arguments: "--touched", note: "only the diff's tests and its modules' same-named ones" },
-        { arguments: "--silent", note: "flags are forwarded to vitest" }
+        { arguments: "--touched", note: "diff tests, same-named tests and direct test importers" },
+        { arguments: "--silent", note: FORWARDED_TO_VITEST }
       ]
     }
   },
@@ -64995,7 +65322,7 @@ var LINT_COMMANDS = {
     script: "scripts/plan/plan-scaffold-cli.ts",
     description: "Print a work summary's inputs in one call: the run:prep skeleton, planned files near the line limit, the test:declared verdict, the owed cases and the plan:consumers draft",
     category: "AI tools",
-    reference: ["<issue> [<path>...]", "automation", ["network"]],
+    reference: ["<issue> [<path>...] [--estimate <json-file>]", "automation", ["network"]],
     usage: {
       examples: [
         { arguments: "123", note: "planned files from the issue body" },
@@ -65365,8 +65692,13 @@ var PROJECT_COMMANDS = {
     script: "scripts/sync/sync-main.ts",
     description: "Sync config files",
     category: "Project",
-    reference: ["", "developer", ["files"]],
-    usage: { examples: [{ arguments: "", note: "overwrite managed files" }] }
+    reference: ["[--force]", "developer", ["files"]],
+    usage: {
+      examples: [
+        { arguments: "", note: "overwrite managed files" },
+        { arguments: "--force", note: "also replace a file you added to, dropping your additions" }
+      ]
+    }
   },
   uninstall: {
     script: "scripts/uninstall/uninstall.ts",
@@ -65621,6 +65953,10 @@ var WORKFLOW_COMMANDS = {
         {
           names: [SKIP_COMMIT, SKIP_PUSH],
           description: "recover/open a PR without a new commit or push."
+        },
+        {
+          names: ["--body-file <path>"],
+          description: "extra PR body text after `closes #N`, from a file (`-` = stdin); use it when the text holds a backtick or `$`."
         }
       ]
     }
@@ -65923,7 +66259,17 @@ function refusal(args) {
 }
 var josh_read_only = { ALL_FLAG, entry_of: entry_of3, is_help_request, refusal };
 
-// scripts/hooks/implementation-shell-deny.ts
+// scripts/hooks/implementation-shell-deny-expansion.ts
+var DYNAMIC = /[$`]/u;
+function is_dynamic(word2) {
+  return DYNAMIC.test(word2);
+}
+function refusal2(program, word2) {
+  return `\`${program} ${word2}\`, an expansion that may spell a write`;
+}
+var implementation_shell_deny_expansion = { is_dynamic, refusal: refusal2 };
+
+// scripts/hooks/implementation-shell-deny-git.ts
 var GIT_WRITES = /* @__PURE__ */ new Set([
   "add",
   "am",
@@ -65971,11 +66317,7 @@ var LIST_MODE = /^(?:-l$|--list$|-n\d*$|--contains|--no-contains|--points-at|--m
 var LIST_VALUE_FLAGS = /* @__PURE__ */ new Set(["--sort", "--format"]);
 var REFLOG_WRITES = /* @__PURE__ */ new Set(["expire", "delete"]);
 var GIT_WRITE_FLAGS = /^-c$|^--(?:config-env|exec-path|output|ext-diff|textconv)/u;
-var DYNAMIC = /[$`]/u;
 var QUOTES6 = /['"\\]/gu;
-function is_dynamic(word2) {
-  return DYNAMIC.test(word2);
-}
 function is_branch_change(argument) {
   return BRANCH_CHANGE.test(argument) || git_argv.short_cluster_has(argument, BRANCH_CHANGE_LETTERS);
 }
@@ -65997,6 +66339,32 @@ var GIT_READ_FORMS = /* @__PURE__ */ new Map([
   ["tag", is_listing],
   ["reflog", (args) => !REFLOG_WRITES.has(args[0] ?? "")]
 ]);
+function is_git_write(subcommand, args) {
+  if (GIT_WRITES.has(subcommand)) return true;
+  const read_form = GIT_READ_FORMS.get(subcommand);
+  if (read_form === void 0) return false;
+  return args.some((argument) => implementation_shell_deny_expansion.is_dynamic(argument)) || !read_form(args);
+}
+function parsed_git(segment) {
+  return git_argv.parse(segment) ?? git_argv.parse(segment.replaceAll(QUOTES6, ""));
+}
+function subcommand_refusal(segment) {
+  const call = parsed_git(segment);
+  if (call?.subcommand === void 0) return void 0;
+  if (implementation_shell_deny_expansion.is_dynamic(call.subcommand)) return implementation_shell_deny_expansion.refusal("git", call.subcommand);
+  const subcommand = call.subcommand.replaceAll(QUOTES6, "");
+  const args = call.args.map((argument) => argument.replaceAll(QUOTES6, ""));
+  return is_git_write(subcommand, args) ? `\`git ${subcommand}\`, a git write` : void 0;
+}
+function refusal3(segment, args) {
+  if (args.some((argument) => GIT_WRITE_FLAGS.test(argument))) {
+    return "a git option that rewrites its configuration, runs a program or writes a file";
+  }
+  return subcommand_refusal(segment);
+}
+var implementation_shell_deny_git = { refusal: refusal3 };
+
+// scripts/hooks/implementation-shell-deny.ts
 var GH_READS = /* @__PURE__ */ new Set([
   "checks",
   "code",
@@ -66106,48 +66474,22 @@ var JOSH_SHARED_WRITES = /* @__PURE__ */ new Set([
   "sync",
   "uninstall"
 ]);
-function expansion_refusal(program, word2) {
-  return `\`${program} ${word2}\`, an expansion that may spell a write`;
-}
-function is_git_write(subcommand, args) {
-  if (GIT_WRITES.has(subcommand)) return true;
-  const read_form = GIT_READ_FORMS.get(subcommand);
-  if (read_form === void 0) return false;
-  return args.some((argument) => is_dynamic(argument)) || !read_form(args);
-}
-function parsed_git(segment) {
-  return git_argv.parse(segment) ?? git_argv.parse(segment.replaceAll(QUOTES6, ""));
-}
-function subcommand_refusal(segment) {
-  const call = parsed_git(segment);
-  if (call?.subcommand === void 0) return void 0;
-  if (is_dynamic(call.subcommand)) return expansion_refusal("git", call.subcommand);
-  const subcommand = call.subcommand.replaceAll(QUOTES6, "");
-  const args = call.args.map((argument) => argument.replaceAll(QUOTES6, ""));
-  return is_git_write(subcommand, args) ? `\`git ${subcommand}\`, a git write` : void 0;
-}
-function git_refusal(segment, args) {
-  if (args.some((argument) => GIT_WRITE_FLAGS.test(argument))) {
-    return "a git option that rewrites its configuration, runs a program or writes a file";
-  }
-  return subcommand_refusal(segment);
-}
 function is_gh_api_write(args) {
   if (args.includes("graphql")) return args.some((argument) => GRAPHQL_MUTATION2.test(argument));
   return gh_api.is_write(["gh", ...args].join(" "));
 }
 function is_gh_verb(argument) {
-  return GH_WRITES.has(argument) || GH_READS.has(argument) || is_dynamic(argument);
+  return GH_WRITES.has(argument) || GH_READS.has(argument) || implementation_shell_deny_expansion.is_dynamic(argument);
 }
 function verb_refusal(group, args) {
   const verb = args.slice(1).find((argument) => is_gh_verb(argument));
   if (verb === void 0 || GH_READS.has(verb)) return void 0;
-  return is_dynamic(verb) ? expansion_refusal(`gh ${group}`, verb) : `\`gh ${group} ${verb}\`, a GitHub write`;
+  return implementation_shell_deny_expansion.is_dynamic(verb) ? implementation_shell_deny_expansion.refusal(`gh ${group}`, verb) : `\`gh ${group} ${verb}\`, a GitHub write`;
 }
 function gh_refusal(args) {
   const group = args[0] ?? "";
   if (group === "api") return is_gh_api_write(args) ? "a `gh api` call other than GET" : void 0;
-  return is_dynamic(group) ? expansion_refusal("gh", group) : verb_refusal(group, args);
+  return implementation_shell_deny_expansion.is_dynamic(group) ? implementation_shell_deny_expansion.refusal("gh", group) : verb_refusal(group, args);
 }
 function is_flag(argument) {
   return argument.startsWith("-");
@@ -66164,7 +66506,7 @@ function package_actions(call) {
   return end === -1 && call.name === "yarn" ? [...actions, "install"] : actions;
 }
 function action_refusal(manager, action) {
-  if (is_dynamic(action)) return expansion_refusal(manager, action);
+  if (implementation_shell_deny_expansion.is_dynamic(action)) return implementation_shell_deny_expansion.refusal(manager, action);
   return PACKAGE_WRITES.has(action) ? `\`${action}\`, a dependency change` : void 0;
 }
 function package_refusal(call) {
@@ -66172,19 +66514,19 @@ function package_refusal(call) {
 }
 function josh_refusal(args) {
   const command3 = canonical_command(args[0] ?? "");
-  if (is_dynamic(command3)) return expansion_refusal("josh", command3);
+  if (implementation_shell_deny_expansion.is_dynamic(command3)) return implementation_shell_deny_expansion.refusal("josh", command3);
   if (!JOSH_SHARED_WRITES.has(command3)) return void 0;
   const rule = josh_read_only.refusal(args);
   return rule === void 0 ? void 0 : `\`josh ${command3}\`, a shared-state write: ${rule}`;
 }
-function refusal2(segment, call) {
-  if (is_dynamic(call.name)) return `\`${call.name}\`, a program an expansion names`;
-  if (call.name === "git") return git_refusal(segment, call.args);
+function refusal4(segment, call) {
+  if (implementation_shell_deny_expansion.is_dynamic(call.name)) return `\`${call.name}\`, a program an expansion names`;
+  if (call.name === "git") return implementation_shell_deny_git.refusal(segment, call.args);
   if (call.name === "gh") return gh_refusal(call.args);
   if (call.name === "josh") return josh_refusal(call.args);
   return package_refusal(call);
 }
-var implementation_shell_deny = { refusal: refusal2 };
+var implementation_shell_deny = { refusal: refusal4 };
 
 // scripts/hooks/implementation-shell-nested.ts
 var SUBSTITUTION3 = /\$\(([^()]*)\)|`([^`]*)`|[<>]\(([^()]*)\)/u;
@@ -66306,8 +66648,21 @@ var QUOTES7 = /^['"]|['"]$/gu;
 var DYNAMIC_PATH = /[$`*?{}\\]/u;
 var COMPOUND_HEAD = /^\s*(?:[({!]\s*|(?:if|then|else|elif|while|until|do)\s+)+/u;
 var COMPOUND_CLOSERS = /* @__PURE__ */ new Set([")", "}", " ", "	", "\n"]);
-var KEYWORDS = /* @__PURE__ */ new Set(["for", "do", "done", "then", "else", "fi", "esac"]);
-var UNREAD_BODY = /^(?:case|select|function)\s|^[\w.:-]+\s*\(\s*\)/u;
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "for",
+  "do",
+  "done",
+  "then",
+  "else",
+  "fi",
+  "case",
+  "select",
+  "function",
+  "esac"
+]);
+var FUNCTION_START = /^(?:function\s|[\w.:-]+\s*\(\s*\))/u;
+var FUNCTION_HEAD = /^(?:function\s+)?[\w.:-]+(?:\s*\()?$/u;
+var UNREAD_ARMS = [/^case\s[\s\S]*\)/u, /^[^\s$`]*\)/u];
 var ARGUMENT_QUOTES = /['"\\]/gu;
 var TIME_PROGRAM = /(?:^|\/)time$/u;
 var TIME_WRITE = /^-(?:[A-Za-z]*o|-o)/u;
@@ -66355,8 +66710,8 @@ function written_args(call) {
   return written.map((argument) => argument.slice(argument.indexOf("=") + 1));
 }
 function is_outside(target3, root2) {
-  const relative = path75.relative(root2, path75.resolve(root2, target3.replaceAll(QUOTES7, "")));
-  return relative.startsWith("..") || path75.isAbsolute(relative);
+  const relative = path76.relative(root2, path76.resolve(root2, target3.replaceAll(QUOTES7, "")));
+  return relative.startsWith("..") || path76.isAbsolute(relative);
 }
 function file_write_refusal(call, root2) {
   return write_args_are_unsafe(call.args, root2) ? `\`${call.name}\` to a runtime path` : void 0;
@@ -66386,26 +66741,30 @@ function body_of2(segment) {
   while (end > 0 && COMPOUND_CLOSERS.has(body.charAt(end - 1))) end -= 1;
   return body.slice(0, end);
 }
-function call_of2(segment) {
+function call_of3(segment) {
   const body = body_of2(segment);
   if (KEYWORDS.has(git_argv.words_of(body)[0] ?? "")) return void 0;
   return git_argv.program_of(body);
 }
 function command_refusal(segment, root2) {
-  const call = call_of2(segment);
+  const call = call_of3(segment);
   return call === void 0 ? void 0 : call_refusal(body_of2(segment), call, root2);
 }
+function is_unread_body(body) {
+  if (FUNCTION_START.test(body)) return !FUNCTION_HEAD.test(body);
+  return UNREAD_ARMS.some((pattern) => pattern.test(body));
+}
 function segment_refusal(segment, root2) {
   if (wrapper_writes(segment)) return "a time output file";
-  if (UNREAD_BODY.test(body_of2(segment))) return "a `case` arm or function body";
+  if (is_unread_body(body_of2(segment))) return "a `case` arm or function body";
   const target3 = redirected_paths(segment).find((redirected) => unsafe_path(redirected, root2));
   return target3 === void 0 ? command_refusal(segment, root2) : `redirect to \`${target3}\``;
 }
 function is_cd(segment) {
-  return call_of2(segment)?.name === "cd";
+  return call_of3(segment)?.name === "cd";
 }
 function is_write2(segment) {
-  const call = call_of2(segment);
+  const call = call_of3(segment);
   if (call !== void 0 && (FILE_PROGRAMS.has(call.name) || writes_elsewhere(call))) return true;
   return redirected_paths(segment).some((redirected) => redirected !== "/dev/null");
 }
@@ -66416,7 +66775,7 @@ function segments_refusal(segments, root2) {
 }
 function nested_lines(line2, segments) {
   const launched2 = segments.flatMap((segment) => {
-    const call = call_of2(segment);
+    const call = call_of3(segment);
     return call === void 0 ? [] : implementation_shell_nested.call_commands(call);
   });
   return [...implementation_shell_nested.substitution_bodies(line2), ...launched2];
@@ -66437,13 +66796,13 @@ function input_refusal(command3) {
   if (command3.trim() === "") return "an empty command";
   return time_shell.has_heredoc(command3) ? "a heredoc" : void 0;
 }
-function refusal3(command3, root2 = process.cwd()) {
+function refusal5(command3, root2 = process.cwd()) {
   return input_refusal(command3) ?? segments_refusal(segments_of3(command3), root2);
 }
 function is_unsafe(command3, root2 = process.cwd()) {
-  return refusal3(command3, root2) !== void 0;
+  return refusal5(command3, root2) !== void 0;
 }
-var implementation_shell = { is_unsafe, refusal: refusal3 };
+var implementation_shell = { is_unsafe, refusal: refusal5 };
 
 // scripts/hooks/implementation-authority.ts
 var HANDOFF3 = " Implementation refused before execution. Record the plan with issue:plan or issue:comment and hand it to lane:dispatch; repeating the request does not grant authority.";
@@ -66480,27 +66839,27 @@ var FILE_EXTENSION2 = /\.[a-z]\w*$/iu;
 var ROOT_FILE_EXTENSION = /\.(?:[cm]?[jt]sx?|svelte|jsonc?|md|ya?ml|css|html|sh|toml|txt|properties)$/u;
 var GLOB = "*";
 var ISSUE_MARK = "#";
-var SEPARATOR2 = "/";
+var SEPARATOR3 = "/";
 var MIN_DIRECTORY_DEPTH = 2;
 var DOCS_DIRECTORY = "docs/";
 var MARKDOWN = ".md";
-function without_glob(path77) {
-  const glob = path77.indexOf(GLOB);
-  return glob === -1 ? path77 : path77.slice(0, path77.lastIndexOf(SEPARATOR2, glob) + 1);
+function without_glob(path78) {
+  const glob = path78.indexOf(GLOB);
+  return glob === -1 ? path78 : path78.slice(0, path78.lastIndexOf(SEPARATOR3, glob) + 1);
 }
 function is_narrow(directory) {
-  return directory.split(SEPARATOR2).filter(Boolean).length >= MIN_DIRECTORY_DEPTH;
+  return directory.split(SEPARATOR3).filter(Boolean).length >= MIN_DIRECTORY_DEPTH;
 }
-function is_file3(path77) {
-  return (path77.includes(SEPARATOR2) ? FILE_EXTENSION2 : ROOT_FILE_EXTENSION).test(path77);
+function is_file3(path78) {
+  return (path78.includes(SEPARATOR3) ? FILE_EXTENSION2 : ROOT_FILE_EXTENSION).test(path78);
 }
-function claim_of(path77) {
-  if (path77.endsWith(SEPARATOR2)) return is_narrow(path77) ? path77 : void 0;
-  return is_file3(path77) ? path77 : void 0;
+function claim_of(path78) {
+  if (path78.endsWith(SEPARATOR3)) return is_narrow(path78) ? path78 : void 0;
+  return is_file3(path78) ? path78 : void 0;
 }
 function path_claims(tokens) {
   const paths2 = tokens.filter((token) => !token.includes(ISSUE_MARK)).map((token) => claim_of(without_glob(token.replace(LINE_SUFFIX2, ""))));
-  return new Set(paths2.filter((path77) => path77 !== void 0));
+  return new Set(paths2.filter((path78) => path78 !== void 0));
 }
 function declared_paths(body) {
   return path_claims([...body.matchAll(CODE_SPAN)].map((match) => match[1] ?? ""));
@@ -66509,10 +66868,10 @@ function declared_of(issues) {
   return new Map(issues.map((issue3) => [issue3.number, declared_paths(issue3.body ?? "")]));
 }
 function contains(outer, inner) {
-  return outer.endsWith(SEPARATOR2) ? inner.startsWith(outer) : outer === inner;
+  return outer.endsWith(SEPARATOR3) ? inner.startsWith(outer) : outer === inner;
 }
-function is_shared_document(path77) {
-  return path77.startsWith(DOCS_DIRECTORY) && (path77.endsWith(SEPARATOR2) || path77.endsWith(MARKDOWN));
+function is_shared_document(path78) {
+  return path78.startsWith(DOCS_DIRECTORY) && (path78.endsWith(SEPARATOR3) || path78.endsWith(MARKDOWN));
 }
 function overlaps(left, right) {
   if (is_shared_document(left) || is_shared_document(right)) return false;
@@ -66520,7 +66879,7 @@ function overlaps(left, right) {
 }
 function claims_of(declared, holders) {
   const pairs = holders.flatMap(
-    (number4) => [...declared.get(number4) ?? []].map((path77) => [path77, number4])
+    (number4) => [...declared.get(number4) ?? []].map((path78) => [path78, number4])
   );
   return new Map(pairs);
 }
@@ -66536,7 +66895,7 @@ function paths_of(child, declared, repo) {
 }
 function clash_of(claims, paths2) {
   const clashes = [...paths2].flatMap(
-    (path77) => [...claims].filter(([claimed]) => overlaps(claimed, path77)).map(([claimed, holder]) => ({ path: path77, claimed, holder }))
+    (path78) => [...claims].filter(([claimed]) => overlaps(claimed, path78)).map(([claimed, holder]) => ({ path: path78, claimed, holder }))
   );
   return clashes[0];
 }
@@ -66562,7 +66921,7 @@ function visit3(walk, child, paths2) {
   const clash = clash_of(walk.claims, paths2);
   if (clash === void 0) {
     walk.offered.push(child);
-    for (const path77 of paths2) walk.claims.set(path77, child.number);
+    for (const path78 of paths2) walk.claims.set(path78, child.number);
     return;
   }
   walk.withheld.push(child);
@@ -66629,7 +66988,7 @@ var issue_fields_schema2 = external_exports.looseObject({
 });
 var comment_schema2 = external_exports.looseObject({
   html_url: external_exports.string().optional(),
-  user: external_exports.looseObject({ login: external_exports.string() }).optional(),
+  user: external_exports.looseObject({ login: external_exports.string(), type: external_exports.string().optional() }).optional(),
   created_at: external_exports.string().optional(),
   body: external_exports.string().optional(),
   author_association: external_exports.string().nullish()
@@ -66658,16 +67017,18 @@ async function parse_issue_fields(json2, repo) {
 }
 async function to_comment2(raw, repo) {
   const login = raw.user?.login;
+  const is_trusted2 = await gh_author_association.trust_of({
+    login,
+    association: raw.author_association,
+    repo
+  });
   return {
     html_url: raw.html_url,
     author: login ?? UNKNOWN_AUTHOR2,
     created_at: raw.created_at ?? UNKNOWN_TIME2,
     body: raw.body ?? "",
-    is_trusted: await gh_author_association.trust_of({
-      login,
-      association: raw.author_association,
-      repo
-    })
+    is_trusted: is_trusted2,
+    is_automated: issue_watch_diff.is_automated(raw, is_trusted2)
   };
 }
 async function parse_comments2(json2, repo) {
@@ -66681,7 +67042,8 @@ function trusted_bodies(comments) {
 }
 function format_comment(comment) {
   const trust = gh_comment_input.trust_of(comment.author, comment.is_trusted);
-  const heading2 = `${COMMENT_HEADING2}${comment.author}${AT2}${comment.created_at} [${trust}]`;
+  const source = comment.is_automated === true ? " [automated]" : "";
+  const heading2 = `${COMMENT_HEADING2}${comment.author}${AT2}${comment.created_at} [${trust}]${source}`;
   return `${heading2}
 ${comment.is_trusted === true ? comment.body : UNTRUSTED_COMMENT}`;
 }
@@ -66791,6 +67153,7 @@ var lane_plan_schema = external_exports.object({
   issue: external_exports.number(),
   paths: external_exports.array(external_exports.string()),
   planned_at: external_exports.string(),
+  estimated_size: external_exports.object({ files: external_exports.number(), lines: external_exports.number() }).optional(),
   size_approval: lane_plan_approval.approval_schema.optional(),
   // `--single`: the plan is one deliverable with no separately-mergeable part, so a files-axis overrun
   // is noted for the pre-gate `run:cut` to verify rather than refused (joshuafolkken/kit#6647).
@@ -67049,8 +67412,8 @@ function emit2(raw_payload, outcome, rewrite3, context = hook_context.from_proce
 `);
 }
 async function record_refusal2(judged_payload, outcome, context = hook_context.from_process(), demoted = hook_demoted.rules(context.env)) {
-  const refusal4 = outcome.reason ?? hook_demoted.refusal_of(outcome.notice, demoted);
-  await hook_ledger.record_reason(HOOK_NAME2, refusal4, judged_payload, context);
+  const refusal6 = outcome.reason ?? hook_demoted.refusal_of(outcome.notice, demoted);
+  await hook_ledger.record_reason(HOOK_NAME2, refusal6, judged_payload, context);
   if (outcome.reason === void 0) await direct_gh_usage.record(judged_payload, context);
 }
 async function respond2(raw_payload, context = hook_context.from_process()) {
@@ -67142,8 +67505,8 @@ var hook_daemon_call = { answer, is_answerable, parse_environment, LAUNCH_DIRECT
 
 // tools/hooks/hook-daemon.ts
 var DAEMON_SCRIPT = fileURLToPath7(import.meta.url);
-var PACKAGE_DIR2 = path76.join(path76.dirname(DAEMON_SCRIPT), "..", "..");
-var OUT_DIR = path76.join(PACKAGE_DIR2, "dist", "hooks");
+var PACKAGE_DIR2 = path77.join(path77.dirname(DAEMON_SCRIPT), "..", "..");
+var OUT_DIR = path77.join(PACKAGE_DIR2, "dist", "hooks");
 var DETACH_FLAG2 = "--detach";
 var REQUESTS_NAME = "requests";
 var PID_NAME = "pid";
@@ -67157,11 +67520,11 @@ var REPLY_FLAGS = constants8.O_WRONLY + constants8.O_NONBLOCK;
 var REQUESTS_FLAGS = constants8.O_RDWR + constants8.O_NONBLOCK;
 var ARGUMENTS_START = 2;
 function stamp_text2(out_directory) {
-  const stamp_path2 = path76.join(out_directory, hook_bundle_stamp.STAMP_NAME);
+  const stamp_path2 = path77.join(out_directory, hook_bundle_stamp.STAMP_NAME);
   return existsSync24(stamp_path2) ? readFileSync34(stamp_path2, "utf8") : "";
 }
 function is_installed(package_directory) {
-  return package_directory.split(path76.sep).includes("node_modules");
+  return package_directory.split(path77.sep).includes("node_modules");
 }
 function bundle_currency(out_directory, package_directory) {
   const loaded = stamp_text2(out_directory);
@@ -67176,7 +67539,7 @@ function own_answer() {
 }
 function reply(request2, text3) {
   try {
-    const descriptor = openSync5(path76.join(request2, "reply"), REPLY_FLAGS);
+    const descriptor = openSync5(path77.join(request2, "reply"), REPLY_FLAGS);
     writeSync4(descriptor, `${text3}
 `);
     closeSync5(descriptor);
@@ -67185,7 +67548,7 @@ function reply(request2, text3) {
   }
 }
 function is_own_directory(directory) {
-  const pid_path = path76.join(directory, PID_NAME);
+  const pid_path = path77.join(directory, PID_NAME);
   return existsSync24(pid_path) && readFileSync34(pid_path, "utf8").trim() === String(process.pid);
 }
 function close(daemon) {
@@ -67210,25 +67573,25 @@ function is_refused_stale(daemon, request2) {
   return true;
 }
 function write_answer(request2, answer2) {
-  writeFileSync8(path76.join(request2, "out"), answer2.stdout);
-  writeFileSync8(path76.join(request2, "err"), answer2.stderr);
+  writeFileSync8(path77.join(request2, "out"), answer2.stdout);
+  writeFileSync8(path77.join(request2, "err"), answer2.stderr);
   reply(request2, String(answer2.status));
 }
-function call_of3(request2) {
-  const environment_path = path76.join(request2, ENVIRONMENT_NAME);
+function call_of4(request2) {
+  const environment_path = path77.join(request2, ENVIRONMENT_NAME);
   if (!existsSync24(environment_path)) return void 0;
   const environment3 = hook_daemon_call.parse_environment(readFileSync34(environment_path, "utf8"));
   rmSync9(environment_path, { force: true });
   return {
-    raw_payload: readFileSync34(path76.join(request2, "payload"), "utf8"),
-    launch_directory: readFileSync34(path76.join(request2, "cwd"), "utf8"),
-    launcher_pid: Number(readFileSync34(path76.join(request2, LAUNCHER_NAME), "utf8")),
+    raw_payload: readFileSync34(path77.join(request2, "payload"), "utf8"),
+    launch_directory: readFileSync34(path77.join(request2, "cwd"), "utf8"),
+    launcher_pid: Number(readFileSync34(path77.join(request2, LAUNCHER_NAME), "utf8")),
     environment: environment3
   };
 }
 async function serve_call(daemon, request2) {
   if (is_refused_stale(daemon, request2)) return;
-  const call = call_of3(request2);
+  const call = call_of4(request2);
   if (call === void 0 || !hook_daemon_call.is_answerable(call)) reply(request2, STALE_REPLY);
   else write_answer(request2, await daemon.answer(call));
   arm_idle(daemon);
@@ -67246,8 +67609,8 @@ async function serve(daemon) {
 function claim4(directory) {
   const staging = `${directory}.${String(process.pid)}`;
   mkdirSync8(staging, { recursive: true });
-  execFileSync4("mkfifo", [path76.join(staging, REQUESTS_NAME)]);
-  writeFileSync8(path76.join(staging, PID_NAME), `${String(process.pid)}
+  execFileSync4("mkfifo", [path77.join(staging, REQUESTS_NAME)]);
+  writeFileSync8(path77.join(staging, PID_NAME), `${String(process.pid)}
 `);
   try {
     renameSync4(staging, directory);
@@ -67258,7 +67621,7 @@ function claim4(directory) {
   }
 }
 function daemon_of(directory, options) {
-  const descriptor = openSync5(path76.join(directory, REQUESTS_NAME), REQUESTS_FLAGS);
+  const descriptor = openSync5(path77.join(directory, REQUESTS_NAME), REQUESTS_FLAGS);
   const input2 = new Socket({ fd: descriptor, readable: true, writable: false });
   return {
     directory,