@joshuafolkken/kit 1.3041.0 → 1.3092.0

package/dist/commands/chunk-FJMXUDEY.js

@@ -0,0 +1,3985 @@
+import {
+  decision_oracle,
+  oracle_firing
+} from "./chunk-VJS2MCLA.js";
+import {
+  run_progress_config
+} from "./chunk-SXJM4DZ5.js";
+import {
+  edit_tool,
+  implementation_cut
+} from "./chunk-ZEH2B3DF.js";
+import {
+  run_progress
+} from "./chunk-RGDFWJPZ.js";
+import {
+  run_progress_clock
+} from "./chunk-3YT3RCSI.js";
+import {
+  test_declared_changed
+} from "./chunk-RESNXNDG.js";
+import {
+  command_memory
+} from "./chunk-QKTTKAXM.js";
+import {
+  codex_prompt,
+  concise_reply,
+  lane_background,
+  last_prompt,
+  pre_gate_cut,
+  run_tail_rule,
+  stop_rules
+} from "./chunk-ZIIUBGON.js";
+import {
+  tail_commands
+} from "./chunk-77LEKVEE.js";
+import {
+  lane_park
+} from "./chunk-5FUI2MLY.js";
+import {
+  direct_pr_create
+} from "./chunk-R2THGPI3.js";
+import {
+  doctor_consumer
+} from "./chunk-S4OZJIXD.js";
+import {
+  consultation_handoff,
+  main_model_reader
+} from "./chunk-KDCHY7XO.js";
+import {
+  run_headless
+} from "./chunk-Q4ULMZAS.js";
+import {
+  bash_triggers,
+  interpreter_options
+} from "./chunk-2BC33QPY.js";
+import {
+  shell_segments,
+  shell_tokens
+} from "./chunk-CVJHQOI3.js";
+import {
+  agent_consultation_model,
+  agent_role_profile
+} from "./chunk-O5JGV7NA.js";
+import {
+  investigation_reads,
+  lane_guard_policy,
+  run_cut_handoff
+} from "./chunk-TFDVTU6O.js";
+import {
+  delegation_policy
+} from "./chunk-6I2JM5UX.js";
+import {
+  time_batch_guard
+} from "./chunk-YOA25SII.js";
+import {
+  time_markers
+} from "./chunk-R5AABJZJ.js";
+import {
+  time_reported_failure,
+  time_transcript_line
+} from "./chunk-YSLGWRQN.js";
+import {
+  cost_blocks,
+  time_josh_names,
+  time_shell
+} from "./chunk-LHKXJD6L.js";
+import {
+  hook_decision
+} from "./chunk-GB2BRQVL.js";
+import {
+  hook_context
+} from "./chunk-CUWT6UQO.js";
+import {
+  transcript_tail
+} from "./chunk-2OMIHPPE.js";
+import {
+  interactive_ask
+} from "./chunk-TBNQIFWL.js";
+import {
+  agent_headless
+} from "./chunk-HDVSZ6CZ.js";
+import {
+  repo_party
+} from "./chunk-DKDWOE3C.js";
+import {
+  agent_session_role
+} from "./chunk-DURHGVRC.js";
+import {
+  issue_citation,
+  session_cite
+} from "./chunk-22DVQCP6.js";
+import {
+  token_shape
+} from "./chunk-AQ3PMSXK.js";
+import {
+  gh_api
+} from "./chunk-QVOFWFWC.js";
+import {
+  git_argv
+} from "./chunk-G6BXCWPH.js";
+import {
+  run_carry
+} from "./chunk-DS53UUDH.js";
+import {
+  agent_provider
+} from "./chunk-DDZVMXZD.js";
+import {
+  lane_child_marker
+} from "./chunk-XXPDFJRI.js";
+import {
+  issue_number_shape,
+  lane_paths
+} from "./chunk-G75GWNNY.js";
+import {
+  git_common_directory
+} from "./chunk-JPMAW2VZ.js";
+import {
+  platform_temporary
+} from "./chunk-VLN6TSPJ.js";
+import {
+  find_package_directory
+} from "./chunk-LR22UK5W.js";
+import {
+  core_weights
+} from "./chunk-ENFPR7J2.js";
+import {
+  MS_PER_SECOND
+} from "./chunk-WPAQUMHC.js";
+import {
+  file_reader
+} from "./chunk-ZNX2LJCQ.js";
+import {
+  json_value
+} from "./chunk-HIU2WXB6.js";
+
+// scripts/rules/agent-model.ts
+var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
+var GENERAL_PURPOSE = "general-purpose";
+function is_general_purpose(call) {
+  if (!SUBAGENT_TOOLS.has(call.name) || !json_value.is_record(call.input)) return false;
+  const type = call.input["subagent_type"];
+  return type === void 0 || type === GENERAL_PURPOSE;
+}
+function names_model(call) {
+  const model = json_value.is_record(call.input) ? call.input["model"] : void 0;
+  return typeof model === "string" && model.length > 0;
+}
+function is_unnamed_model(call) {
+  return is_general_purpose(call) && !names_model(call);
+}
+function keeps_model(call) {
+  return is_general_purpose(call) && names_model(call);
+}
+var AGENT_MODEL_REASON = "\u26D4 agent model: a `general-purpose` subagent with no `model` inherits the parent model. Reissue the call with `model` set \u2014 `sonnet` for routine work, `opus` for judgment such as a review. It fires on every occurrence (`.claude/skills/workflow-commands/delegation.md`).";
+var ROW = {
+  id: "agent-model",
+  is_trigger: is_unnamed_model,
+  reason: AGENT_MODEL_REASON,
+  decide: () => true,
+  keeps: keeps_model,
+  reaches: is_general_purpose,
+  about: {
+    title: "Subagent model named",
+    topic: '`.claude/skills/workflow-commands/delegation.md` \u2192 "A `general-purpose` subagent names its model"',
+    fires: "an `Agent` / `Task` call of the `general-purpose` type with no `model`. Every occurrence",
+    quiet: "a named agent type, or a `model` set"
+  }
+};
+var agent_model = { AGENT_MODEL_REASON, ROW, SUBAGENT_TOOLS, is_unnamed_model };
+
+// scripts/rules/broad-investigation.ts
+import { dirname as __josh_dirname } from "node:path";
+import { fileURLToPath as __josh_file_path } from "node:url";
+import { readFileSync as readFileSync2 } from "node:fs";
+import path2 from "node:path";
+import { fileURLToPath } from "node:url";
+
+// scripts/rules/broad-investigation-shell.ts
+import { readFileSync, statSync } from "node:fs";
+import path from "node:path";
+var READ_LINE_CAP = 200;
+var DEFAULT_HEAD_LINES = 10;
+var SHORT_FLAGS = /^-[a-zA-Z]+$/u;
+var RECURSIVE_LETTERS = /[rR]/u;
+var LONG_RECURSIVE = /* @__PURE__ */ new Set(["--recursive", "--dereference-recursive"]);
+var SED_RANGE = /^(?<first>\d+),(?<last>\d+)p$/u;
+var SED_TO_END = /^\d+,\$p$/u;
+var LINE_COUNT_PREFIXES = ["--lines=", "-n", "-"];
+var DIGITS = /^\d+$/u;
+var FROM_LINE = /^\+\d+$/u;
+var QUOTES = /^['"]|['"]$/gu;
+var ASSIGNMENT = /^\w+=/u;
+var ALWAYS_BROAD = /* @__PURE__ */ new Set(["find", "for", "node", "python", "python3"]);
+var ANALYSIS_PREFIX = "josh cost:";
+var FLAG_PREFIX = "-";
+var HEREDOC = "<<";
+function resolved(file) {
+  return path.resolve(process.env["JOSH_HOOK_CWD"] ?? process.cwd(), file);
+}
+function is_file(file) {
+  return statSync(resolved(file), { throwIfNoEntry: false })?.isFile() === true;
+}
+function is_directory(file) {
+  return statSync(resolved(file), { throwIfNoEntry: false })?.isDirectory() === true;
+}
+function line_count(file) {
+  if (!is_file(file)) return 0;
+  const text = readFileSync(resolved(file), "utf8");
+  return text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+}
+function is_recursive_flag(flag) {
+  return LONG_RECURSIVE.has(flag) || SHORT_FLAGS.test(flag) && RECURSIVE_LETTERS.test(flag);
+}
+function searches_tree(operands, flags) {
+  if (flags.some((flag) => is_recursive_flag(flag))) return true;
+  return operands.slice(1).some((operand) => is_directory(operand));
+}
+function rg_searches_tree(operands, _flags, is_piped) {
+  const paths = operands.slice(1);
+  if (paths.length === 0) return !is_piped;
+  return paths.some((operand) => !is_file(operand));
+}
+function sed_span(script) {
+  const groups = SED_RANGE.exec(script)?.groups;
+  return groups === void 0 ? 0 : Number(groups["last"]) - Number(groups["first"]) + 1;
+}
+function sed_reads_past_cap(operands, flags) {
+  if (!flags.includes("-n")) return false;
+  const [script = ""] = operands;
+  return SED_TO_END.test(script) || sed_span(script) > READ_LINE_CAP;
+}
+function number_of(word = "") {
+  return DIGITS.test(word) ? Number(word) : void 0;
+}
+function count_of(word) {
+  const prefix = LINE_COUNT_PREFIXES.find((candidate) => word.startsWith(candidate));
+  const rest = prefix === void 0 ? "" : word.slice(prefix.length);
+  return number_of(rest);
+}
+function counted_lines(operands, flags) {
+  const inline = flags.map((flag) => count_of(flag)).find((count) => count !== void 0);
+  const separate = flags.includes("-n") ? number_of(operands[0]) : void 0;
+  return inline ?? separate ?? DEFAULT_HEAD_LINES;
+}
+function ends_past_cap(operands, flags) {
+  if (operands.some((word) => FROM_LINE.test(word))) return true;
+  return counted_lines(operands, flags) > READ_LINE_CAP;
+}
+function is_past_cap(file) {
+  return line_count(file) > READ_LINE_CAP;
+}
+function cat_reads_past_cap(operands) {
+  return operands.some((operand) => is_past_cap(operand));
+}
+var COMMAND_TESTS = /* @__PURE__ */ new Map([
+  ["grep", searches_tree],
+  ["rg", rg_searches_tree],
+  ["sed", sed_reads_past_cap],
+  ["head", ends_past_cap],
+  ["tail", ends_past_cap],
+  ["cat", cat_reads_past_cap]
+]);
+function words_of(segment) {
+  const words = shell_tokens.words_of(segment).map((word) => word.text.replaceAll(QUOTES, ""));
+  const start = words.findIndex((word) => !ASSIGNMENT.test(word));
+  return start === -1 ? [] : words.slice(start);
+}
+function reads_past_cap(segment, name, rest, is_piped) {
+  const test = COMMAND_TESTS.get(name);
+  if (test === void 0 || segment.includes(HEREDOC)) return false;
+  const flags = rest.filter((word) => word.startsWith(FLAG_PREFIX));
+  const operands = rest.filter((word) => !word.startsWith(FLAG_PREFIX));
+  return test(operands, flags, is_piped);
+}
+function is_broad_segment(segment, is_piped) {
+  if (time_josh_names.josh_command_of(segment).startsWith(ANALYSIS_PREFIX)) return true;
+  const [name = "", ...rest] = words_of(segment);
+  return ALWAYS_BROAD.has(name) || reads_past_cap(segment, name, rest, is_piped);
+}
+function is_broad_pipeline(pipeline) {
+  return shell_segments.quote_aware_commands_of(pipeline).some((stage, index) => is_broad_segment(stage, index > 0));
+}
+function is_broad_command(command) {
+  return shell_segments.segments_of(command).some((pipeline) => is_broad_pipeline(pipeline));
+}
+var broad_investigation_shell = { READ_LINE_CAP, is_broad_command, is_file, is_past_cap };
+
+// scripts/rules/broad-investigation.ts
+var __josh_meta = import.meta;
+var __josh_source_url = new URL("../../scripts/rules/broad-investigation.ts", __josh_meta.url).href;
+var __josh_source_filename = __josh_file_path(__josh_source_url);
+var __josh_source_dirname = __josh_dirname(__josh_source_filename);
+var { READ_LINE_CAP: READ_LINE_CAP2, is_broad_command: is_broad_command2, is_file: is_file2, is_past_cap: is_past_cap2 } = broad_investigation_shell;
+var ALWAYS_BROAD2 = /* @__PURE__ */ new Set(["Glob", "WebFetch"]);
+var GENERAL_PURPOSE2 = "general-purpose";
+var INVESTIGATION_AGENTS = /* @__PURE__ */ new Set([
+  "investigator",
+  "Explore",
+  GENERAL_PURPOSE2
+]);
+var FRONTMATTER_MODEL = /^model:\s*(?<model>\S+)\s*$/mu;
+var PACKAGE_DIRECTORY = find_package_directory(path2.dirname(fileURLToPath(__josh_source_url)));
+function field(call, key) {
+  return json_value.is_record(call.input) ? call.input[key] : void 0;
+}
+function is_broad_read(call) {
+  const limit = field(call, "limit");
+  if (typeof limit === "number") return limit > READ_LINE_CAP2;
+  const file = field(call, "file_path");
+  return typeof file !== "string" || is_past_cap2(file);
+}
+function is_broad_grep(call) {
+  const target = field(call, "path");
+  return typeof target !== "string" || !is_file2(target);
+}
+function definition_model(name) {
+  const file = path2.join(PACKAGE_DIRECTORY, ".claude", "agents", `${name}.md`);
+  const body = is_file2(file) ? readFileSync2(file, "utf8") : "";
+  return FRONTMATTER_MODEL.exec(body)?.groups?.["model"];
+}
+function agent_name(call) {
+  const type = field(call, "subagent_type");
+  if (typeof type !== "string") return GENERAL_PURPOSE2;
+  return type.split(":").at(-1) ?? type;
+}
+function effective_model(call, name) {
+  const named = field(call, "model");
+  return typeof named === "string" && named.length > 0 ? named : definition_model(name);
+}
+function dispatched_model(call) {
+  return effective_model(call, agent_name(call));
+}
+function is_investigation_dispatch(call) {
+  return agent_model.SUBAGENT_TOOLS.has(call.name) && INVESTIGATION_AGENTS.has(agent_name(call));
+}
+function is_consultation(model) {
+  return model === void 0 || agent_consultation_model.consultation_provider(model) !== void 0;
+}
+function inherits_consultation(call) {
+  if (!INVESTIGATION_AGENTS.has(agent_name(call))) return false;
+  return is_consultation(dispatched_model(call));
+}
+function is_delegated_investigation(call) {
+  return is_investigation_dispatch(call) && !is_consultation(dispatched_model(call));
+}
+var TOOL_TESTS = new Map([
+  ["Read", is_broad_read],
+  ["Grep", is_broad_grep],
+  ["Bash", (call) => is_broad_command2(time_shell.bash_command(call.input))],
+  ...[...agent_model.SUBAGENT_TOOLS].map((name) => [
+    name,
+    inherits_consultation
+  ])
+]);
+function is_broad_investigation(call) {
+  if (ALWAYS_BROAD2.has(call.name)) return true;
+  return TOOL_TESTS.get(call.name)?.(call) === true;
+}
+var broad_investigation = { READ_LINE_CAP: READ_LINE_CAP2, is_broad_investigation, is_delegated_investigation };
+
+// scripts/rules/consultation-investigation.ts
+var { ANTHROPIC_PROVIDER, OPENAI_PROVIDER } = agent_provider;
+var { READ_LINE_CAP: READ_LINE_CAP3, is_broad_investigation: is_broad_investigation2, is_delegated_investigation: is_delegated_investigation2 } = broad_investigation;
+var DELEGATION = ".claude/skills/workflow-commands/delegation.md";
+var TOPIC = `\`${DELEGATION}\` \u2192 "A consultation main line hands its investigation to a unit"`;
+var NARROW_EXAMPLE = `\`Read\` of a file or an \`offset\` / \`limit\` range <= ${String(READ_LINE_CAP3)} lines, \`grep -n <pattern> <one file>\``;
+var QUIET = `a launched session (lane, reviewer, scheduler), a delegated unit, a main line at or below the investigation rate (Sonnet, Haiku, Sol), on another provider's or an unnamed model, or a narrow check (${NARROW_EXAMPLE})`;
+function reason(provider, dispatch) {
+  const model = agent_role_profile.investigation_model(provider);
+  return (
+    // The dispatch opens the reason, so the Claude and Codex rows keep distinct signatures.
+    `\u26D4 consultation investigation \u2192 ${dispatch} on \`${model}\`: the consultation main line hands broad investigation to it, and it returns \`file:line\` citations. Keep only a narrow check here \u2014 ${NARROW_EXAMPLE}. It fires on every occurrence (\`${DELEGATION}\`).`
+  );
+}
+function is_handed_on(provider, model) {
+  return model !== void 0 && agent_consultation_model.rated_provider(model) === provider;
+}
+function not_consulted_on(provider) {
+  return function not_consulted(tail, _call, run) {
+    if (run.is_unit === true || agent_session_role.is_launched(run.context.env)) return true;
+    return !is_handed_on(provider, main_model_reader.main_model(tail, run.model));
+  };
+}
+function row(id, provider, dispatch, about) {
+  return {
+    id,
+    is_trigger: is_broad_investigation2,
+    // Read at delivery, not import: the hook loads `.env`, which may name the investigation model,
+    // only after the rows are imported.
+    get reason() {
+      return reason(provider, dispatch);
+    },
+    already_satisfied: not_consulted_on(provider),
+    decide: () => true,
+    keeps: is_delegated_investigation2,
+    about
+  };
+}
+var ROW2 = row("consultation-investigation", ANTHROPIC_PROVIDER, "an `investigator`", {
+  title: "Consultation main line delegates investigation (Claude)",
+  topic: TOPIC,
+  fires: "a broad investigation call \u2014 `Glob`, `WebFetch`, a `Read` past the line cap, a tree `Grep` or shell search, an investigation dispatch inheriting the model \u2014 on the consultation main line on Opus or Fable. Every occurrence",
+  quiet: QUIET
+});
+var CODEX_ROW = row("consultation-investigation-codex", OPENAI_PROVIDER, "a Codex subagent", {
+  title: "Consultation main line delegates investigation (Codex)",
+  topic: TOPIC,
+  fires: "a broad shell investigation on the consultation main line on Codex Astra. Every occurrence",
+  quiet: QUIET
+});
+var consultation_investigation = { CODEX_ROW, ROW: ROW2 };
+
+// scripts/rules/credential-body.ts
+var TYPED_ESCAPE = /\\./gu;
+function sent_text(source) {
+  if (source.kind === "text") return source.value;
+  return token_shape.decoded(file_reader.read_if_readable(source.value) ?? "");
+}
+function holds_token(text) {
+  return [text, text.replaceAll(TYPED_ESCAPE, () => " ")].some(
+    (reading) => token_shape.holds(reading)
+  );
+}
+function is_credential_segment(segment) {
+  const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND);
+  if (args === void 0) return false;
+  const call = [direct_pr_create.GH_COMMAND, ...args].join(" ");
+  if (!gh_api.is_gh_api(call)) return false;
+  return gh_api.field_sources(call).some((source) => holds_token(sent_text(source)));
+}
+function sends_credential(command) {
+  return direct_pr_create.has_run_segment(command, is_credential_segment);
+}
+var CREDENTIAL_BODY_REASON = "\u26D4 credential in a gh api body: a field value, or the file `-F key=@<path>` / `--input <path>` names, holds a token-shaped string (`scripts/lib/token-shape.ts`), and the call would publish it. Remove the credential from the body and send it again. **This rule fires on every occurrence, not once per run.**";
+var ROW3 = {
+  id: "credential-body",
+  is_trigger: bash_triggers.on_bash_command(sends_credential),
+  reason: CREDENTIAL_BODY_REASON,
+  decide: () => true,
+  about: {
+    title: "Credential in a body",
+    topic: "`shell-body.md`",
+    fires: "a `gh api` call whose field value, or the file `-F key=@<path>` / `--input <path>` names, holds a token-shaped string (`token-shape.ts`). Every occurrence",
+    quiet: "a body with no credential, or a body sent through kit, which runs the same scan"
+  }
+};
+var credential_body = { CREDENTIAL_BODY_REASON, ROW: ROW3, sends_credential };
+
+// scripts/delegation/investigation-guard.ts
+var SWITCH_ENV_KEY = "JOSH_INVESTIGATION_GUARD";
+var STAMP_PREFIX = "josh-investigation-guard-";
+function should_block(tail, call, refused_at_ms2, run) {
+  const { cwd, env } = run.context;
+  if (agent_session_role.is_reviewer(env) || lane_guard_policy.mode_here("investigation", cwd, env) !== "refuse") {
+    return false;
+  }
+  return investigation_reads.should_block(tail, call, refused_at_ms2, run);
+}
+function is_candidate(call, context) {
+  return investigation_reads.is_refusable_call(call, context.cwd);
+}
+var GUARD = hook_decision.create_transcript_guard({
+  prefix: STAMP_PREFIX,
+  switch_key: SWITCH_ENV_KEY,
+  is_candidate,
+  should_block,
+  reason: investigation_reads.REASON
+});
+var investigation_refusal = GUARD.refusal;
+var investigation_outcome = GUARD.outcome;
+var { is_enabled, refusal_path } = GUARD;
+var { deny_envelope, load_environment_file, DISABLED_VALUES } = hook_decision;
+var STAMP = hook_decision.create_refusal_stamp(STAMP_PREFIX);
+function will_refuse(tail, call, run) {
+  if (!is_enabled(run.context.env) || !is_candidate(call, run.context)) return false;
+  return should_block(tail, call, STAMP.last_ms(STAMP.path(run.transcript)), run);
+}
+
+// scripts/hooks/batch-guard.ts
+var SWITCH_ENV_KEY2 = "JOSH_BATCH_GUARD";
+function is_batch_candidate(call) {
+  return time_batch_guard.is_guarded_call(call) || time_batch_guard.is_notice_call(call);
+}
+function batching_mode(context) {
+  return lane_guard_policy.mode_here("batching", context.cwd, context.env);
+}
+function is_search_refused_here(context) {
+  return lane_guard_policy.mode_here("search-batching", context.cwd, context.env) === "refuse";
+}
+function is_candidate2(call, context) {
+  if (batching_mode(context) !== "off") return is_batch_candidate(call);
+  return is_search_refused_here(context) && time_batch_guard.is_search_chain_call(call);
+}
+function should_block_here(tail, call, refused_at_ms2, run) {
+  if (batching_mode(run.context) === "refuse") {
+    return time_batch_guard.should_block(tail, call, refused_at_ms2);
+  }
+  if (!is_search_refused_here(run.context) || will_refuse(tail, call, run)) {
+    return false;
+  }
+  return time_batch_guard.should_block_search_chain(tail, call, refused_at_ms2);
+}
+function should_notify_here(tail, call, notified_at_ms, run) {
+  if (time_batch_guard.should_notify(tail, call, notified_at_ms)) return true;
+  if (batching_mode(run.context) !== "notice") return false;
+  return time_batch_guard.should_block(
+    tail,
+    call,
+    notified_at_ms,
+    time_batch_guard.NOTICE_REFIRE_EVERY
+  );
+}
+function notice_text(call, tail) {
+  const base = time_batch_guard.is_notice_call(call) ? time_batch_guard.NOTICE : time_batch_guard.LANE_NOTICE;
+  return `${base}${time_batch_guard.recent_candidates(tail)}`;
+}
+var GUARD2 = hook_decision.create_transcript_guard({
+  prefix: time_batch_guard.STAMP_PREFIX,
+  switch_key: SWITCH_ENV_KEY2,
+  is_candidate: is_candidate2,
+  should_block: should_block_here,
+  reason: time_batch_guard.REASON,
+  // The whole-file write is notified rather than refused, on a record of its own so it never spends
+  // the refusal's stamp; the refusable-call notice fires only under a `notice`-mode batching row.
+  notify: {
+    prefix: time_batch_guard.NOTICE_STAMP_PREFIX,
+    should_notify: should_notify_here,
+    text: notice_text
+  }
+});
+var batch_refusal = GUARD2.refusal;
+var batch_outcome = GUARD2.outcome;
+var { is_enabled: is_enabled2, refusal_path: refusal_path2 } = GUARD2;
+var notice_refusal_path = hook_decision.create_refusal_stamp(
+  time_batch_guard.NOTICE_STAMP_PREFIX
+).path;
+var { deny_envelope: deny_envelope2, load_environment_file: load_environment_file2, DISABLED_VALUES: DISABLED_VALUES2 } = hook_decision;
+var STAMP2 = hook_decision.create_refusal_stamp(time_batch_guard.STAMP_PREFIX);
+function will_refuse2(tail, call, run) {
+  if (!is_enabled2(run.context.env) || !is_candidate2(call, run.context)) return false;
+  return should_block_here(tail, call, STAMP2.last_ms(STAMP2.path(run.transcript)), run);
+}
+
+// scripts/rules/delivered-rules-guard.ts
+var SWITCH_ENV_KEY3 = "JOSH_RULE_GUARD";
+var STAMP_PREFIX2 = "josh-rule-guard-";
+var BATCH_STAMP = hook_decision.create_refusal_stamp(time_batch_guard.STAMP_PREFIX);
+var BATCH_REFUSAL_WINDOW_MS = 1e4;
+function will_batch_guard_refuse(tail, call, run) {
+  const refused_at_ms2 = BATCH_STAMP.last_ms(BATCH_STAMP.path(run.transcript));
+  if (run.now_ms - refused_at_ms2 < BATCH_REFUSAL_WINDOW_MS) return true;
+  return will_refuse2(tail, call, run);
+}
+function is_first_delivery(tail, call, delivered_at_ms, run) {
+  return delivered_at_ms === hook_decision.NEVER_MS && !will_batch_guard_refuse(tail, call, run);
+}
+function delivery_decision(rule) {
+  const { decide: decide5, already_satisfied } = rule;
+  if (decide5 === void 0 && already_satisfied === void 0) return is_first_delivery;
+  return function should_block2(tail, call, delivered_at_ms, run) {
+    if (already_satisfied?.(tail, call, run) === true) return false;
+    if (decide5 === void 0) return true;
+    return decide5(call, run, !will_batch_guard_refuse(tail, call, run), delivered_at_ms);
+  };
+}
+function call_only(row2) {
+  return { ...row2, is_trigger: (call) => row2.is_trigger(call) };
+}
+function prefix_of(rule_id) {
+  return `${STAMP_PREFIX2}${rule_id}-`;
+}
+function guard_of(rule) {
+  return hook_decision.create_transcript_guard({
+    prefix: prefix_of(rule.id),
+    switch_key: SWITCH_ENV_KEY3,
+    is_candidate: (call, context) => rule.is_trigger(call, context),
+    should_block: delivery_decision(rule),
+    reason: rule.reason
+  });
+}
+var delivered_rules_guard = { SWITCH_ENV_KEY: SWITCH_ENV_KEY3, call_only, guard_of, prefix_of };
+
+// scripts/rules/direct-filing.ts
+var DIRECT_FILING_REASON = '\u26D4 direct filing: an Issue is filed with `pnpm josh issue:file "<title>" --body-file <path>`, never with `gh api \u2026/issues` or `gh issue create` \u2014 it runs the scout, the lint, the labels and `epic:bundle` itself. It fires on every occurrence (`docs/josh-commands-backlog.md` \u2192 "`josh issue:file`").';
+function is_any_filing(command) {
+  return bash_triggers.is_direct_filing(command) || bash_triggers.is_issue_filing(command);
+}
+var ROW4 = {
+  id: "direct-filing",
+  is_trigger: bash_triggers.on_bash_command(bash_triggers.is_direct_filing),
+  reason: DIRECT_FILING_REASON,
+  decide: () => true,
+  keeps: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
+  reaches: bash_triggers.on_bash_command(is_any_filing),
+  about: {
+    title: "Direct filing",
+    topic: "`docs/josh-commands-backlog.md` \u2192 `josh issue:file`",
+    fires: "a `Bash` that creates an Issue outside `josh issue:file` (`gh issue create`, or a POST with `title` to `\u2026/issues`); the refusal hands over the `pnpm josh issue:file` form. Every occurrence",
+    quiet: "filing through `pnpm josh issue:file` \u2014 the duplicate scan, the body check and `epic:bundle` all run"
+  }
+};
+var direct_filing = { DIRECT_FILING_REASON, ROW: ROW4 };
+
+// scripts/rules/direct-git-status.ts
+var GIT_PROGRAM = "git";
+var STATUS_SUBCOMMAND = "status";
+var COVERED_FLAGS = /* @__PURE__ */ new Set([
+  "-s",
+  "--short",
+  "-b",
+  "--branch",
+  "--porcelain"
+]);
+var SHORT_BRANCH_CLUSTER = /^-[sb]+$/u;
+function is_covered_flag(argument) {
+  return COVERED_FLAGS.has(argument) || SHORT_BRANCH_CLUSTER.test(argument);
+}
+function is_covered_call(call) {
+  const [subcommand, ...flags] = call.args;
+  const is_status = call.name === GIT_PROGRAM && subcommand === STATUS_SUBCOMMAND;
+  return is_status && flags.every((flag) => is_covered_flag(flag));
+}
+function is_covered_status(command) {
+  return command_memory.tool_calls_of(command).some((call) => is_covered_call(call));
+}
+var TREE_STATUS = /* @__PURE__ */ new Set(["tree:status"]);
+function is_tree_status(command) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, TREE_STATUS));
+}
+function is_any_status(command) {
+  return is_covered_status(command) || is_tree_status(command);
+}
+var DIRECT_GIT_STATUS_REASON = '\u26D4 direct git status: pnpm josh tree:status\nRun that in place of this `git status` \u2014 it prints `git status --porcelain --branch` with the stash list and the run hold beside it (`docs/josh-commands-backlog.md` \u2192 "`josh tree:status`"). A `git -C <dir> status` or one narrowed by a pathspec or another flag passes. Once per run: the reissue passes.';
+var ROW5 = {
+  id: "direct-git-status",
+  is_trigger: bash_triggers.on_bash_command(is_covered_status),
+  reason: DIRECT_GIT_STATUS_REASON,
+  keeps: bash_triggers.on_bash_command(is_tree_status),
+  reaches: bash_triggers.on_bash_command(is_any_status),
+  about: {
+    title: "Direct git status",
+    topic: '`docs/josh-commands-backlog.md` \u2192 "`josh tree:status`"',
+    fires: "a `git status` with no flag or only `-s` / `--short` / `-b` / `--branch` / `--porcelain` (bare, wrapped or inside `sh -c`); it points at `pnpm josh tree:status`. Once per run",
+    quiet: "`pnpm josh tree:status`, a global flag before the subcommand (`git -C <dir> status`), or a pathspec or any other flag"
+  }
+};
+var direct_git_status = { DIRECT_GIT_STATUS_REASON, ROW: ROW5, is_covered_status };
+
+// scripts/rules/direct-issue-comment.ts
+import path3 from "node:path";
+
+// scripts/rules/standalone-gh-call.ts
+var WORD_SEPARATOR = " ";
+var PLAIN_WORD = /^[\w./=-]+$/u;
+function line_of(words) {
+  return words.join(WORD_SEPARATOR);
+}
+function is_plain_word(word) {
+  return PLAIN_WORD.test(word);
+}
+function split_issue(rest) {
+  const issues = rest.filter((word) => issue_number_shape.is_issue_number(word));
+  const [issue] = issues;
+  const flags = line_of(rest.filter((word) => !issue_number_shape.is_issue_number(word)));
+  return issue !== void 0 && issues.length === 1 ? { issue, flags } : void 0;
+}
+function call_of(line, lead) {
+  const words = line.trim().split(WORD_SEPARATOR);
+  const is_lead = line_of(words.slice(0, lead.length)) === line_of(lead);
+  return is_lead && words.every((word) => is_plain_word(word)) ? split_issue(words.slice(lead.length)) : void 0;
+}
+function input_of(call, command_of) {
+  if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return void 0;
+  const command = command_of(time_shell.bash_command(call.input));
+  return command === void 0 ? void 0 : { ...call.input, command };
+}
+var standalone_gh_call = { call_of, input_of, is_plain_word, line_of };
+
+// scripts/rules/direct-issue-comment.ts
+var ISSUE_GROUP = "issue";
+var COMMENT_ACTION = "comment";
+var API_SUBCOMMAND = "api";
+var REPO_SELECTOR = /^(?:-R|--repo)(?:=|$)/u;
+var SEGMENT = String.raw`[^/\s'"]+`;
+var QUOTE = `['"]?`;
+var API_ORIGIN = String.raw`(?:https://api\.github\.com)?/?`;
+var COMMENTS_PATH = new RegExp(
+  `^${QUOTE}${API_ORIGIN}repos/${SEGMENT}/${SEGMENT}/issues/${SEGMENT}/comments/?${QUOTE}$`,
+  "u"
+);
+function is_comment_cli_call(args) {
+  if (args.some((argument) => REPO_SELECTOR.test(argument))) return false;
+  const [group, action] = direct_pr_create.positional_words(
+    args,
+    direct_pr_create.VALUE_TAKING_FLAGS
+  );
+  return group === ISSUE_GROUP && action === COMMENT_ACTION;
+}
+function is_own_comments_endpoint(endpoint, resolve_own) {
+  const target = gh_api.repo_target(endpoint);
+  if (target === void 0 || !COMMENTS_PATH.test(endpoint)) return false;
+  return gh_api.is_owner_placeholder(target.owner) || repo_party.is_own_repository(target, resolve_own());
+}
+function is_comment_api_call(args, resolve_own) {
+  const call = [direct_pr_create.GH_COMMAND, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || !gh_api.is_write(call)) return false;
+  const [subcommand, endpoint = ""] = direct_pr_create.positional_words(
+    args,
+    direct_pr_create.API_VALUE_TAKING_FLAGS
+  );
+  return subcommand === API_SUBCOMMAND && is_own_comments_endpoint(endpoint, resolve_own);
+}
+function is_comment_segment(segment, resolve_own) {
+  const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND);
+  if (args === void 0 || direct_pr_create.is_help_call(args)) return false;
+  return is_comment_cli_call(args) || is_comment_api_call(args, resolve_own);
+}
+function is_direct_issue_comment(command, resolve_own = repo_party.current_repository) {
+  return direct_pr_create.has_run_segment(
+    command,
+    (segment) => is_comment_segment(segment, resolve_own)
+  );
+}
+function is_direct_issue_comment_in(command, context) {
+  return is_direct_issue_comment(
+    command,
+    () => repo_party.current_repository(context.cwd, context.env)
+  );
+}
+var COMMENT_NAMES = /* @__PURE__ */ new Set(["issue:comment"]);
+function is_josh_comment(command) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, COMMENT_NAMES));
+}
+function is_any_comment(command) {
+  return is_direct_issue_comment(command) || is_josh_comment(command);
+}
+var DIRECT_ISSUE_COMMENT_REASON = "\u26D4 direct issue comment: `gh issue comment` (or a `gh api` write to `\u2026/issues/<N>/comments`) posts without the run marker, so the run reads its own comment as a person updating the issue \u2014 the review goes stale and `pnpm josh followup` refuses the merge. Post with `pnpm josh issue:comment <N> --body-file <path>` instead (`shell-body.md`). **This rule fires on every occurrence, not once per run.**";
+var COMMENT_WORDS = ["gh", ISSUE_GROUP, COMMENT_ACTION];
+var BODY_FILE_SPELLING = /^(?:(?:-F|--body-file) |--body-file=)(?<file>[\w./-]+)$/u;
+var STDIN_PATH = "-";
+var ISSUE_COMMENT_COMMAND = "pnpm josh issue:comment";
+var BODY_FILE_FLAG = "--body-file";
+function body_file_of(flags, cwd) {
+  const file = BODY_FILE_SPELLING.exec(flags)?.groups?.["file"];
+  return file === void 0 || file === STDIN_PATH ? void 0 : path3.resolve(cwd, file);
+}
+function issue_comment_of(comment, cwd) {
+  const resolved2 = body_file_of(comment.flags, cwd);
+  return resolved2 !== void 0 && standalone_gh_call.is_plain_word(resolved2) ? standalone_gh_call.line_of([ISSUE_COMMENT_COMMAND, comment.issue, BODY_FILE_FLAG, resolved2]) : void 0;
+}
+function issue_comment_command(command, context) {
+  const comment = standalone_gh_call.call_of(command, COMMENT_WORDS);
+  const post = comment === void 0 ? void 0 : issue_comment_of(comment, context.cwd);
+  return post !== void 0 && is_direct_issue_comment_in(command.trim(), context) ? post : void 0;
+}
+function issue_comment_input(call, _tail, context) {
+  return standalone_gh_call.input_of(call, (command) => issue_comment_command(command, context));
+}
+var ISSUE_COMMENT_NOTE = "\u21BB direct issue comment: this `gh issue comment <N> --body-file <path>` ran as `pnpm josh issue:comment <N> --body-file <path>`, which posts the run marker (`shell-body.md`).";
+var ROW6 = {
+  id: "direct-issue-comment",
+  is_trigger: bash_triggers.on_bash_command(is_direct_issue_comment_in),
+  reason: DIRECT_ISSUE_COMMENT_REASON,
+  decide: () => true,
+  keeps: bash_triggers.on_bash_command(is_josh_comment),
+  reaches: bash_triggers.on_bash_command(is_any_comment),
+  rewrite: issue_comment_input,
+  rewrite_note: ISSUE_COMMENT_NOTE,
+  about: {
+    title: "Direct issue comment",
+    topic: "`shell-body.md`",
+    fires: "a comment to the checkout's own repository outside `josh issue:comment` (`gh issue comment` with no `--repo`, or a `gh api` write to `repos/<owner>/<r>/issues/<N>/comments` whose owner is the `{owner}` placeholder or the checkout's own `owner/repo` spelled out); it points at `pnpm josh issue:comment`. A line that is only `gh issue comment <N>` with one `--body-file` / `-F <path>` is rewritten to `pnpm josh issue:comment <N> --body-file <path>`; every other form is refused, every occurrence",
+    quiet: "`pnpm josh issue:comment`, or reading the comments \u2014 the path that writes the run marker"
+  }
+};
+var direct_issue_comment = {
+  DIRECT_ISSUE_COMMENT_REASON,
+  ISSUE_COMMENT_NOTE,
+  ROW: ROW6,
+  is_direct_issue_comment,
+  issue_comment_command
+};
+
+// scripts/rules/prior-comment-read.ts
+var ISSUE_PATH_NUMBER = /issues\/(\d+)/gu;
+var ISSUE_VIEW_NUMBER = /\bissue\s+view\s+(?:-{1,2}\S+\s+)*(\d+)/u;
+var ISSUE_READ_ARGUMENTS = /\b(?:issue:read|run:entry|run:prep)\b([\s\d]*)/u;
+var COMMENTS_ENDPOINT = /issues\/\d+\/comments\b/u;
+var VIEW_WITH_COMMENTS = /\bissue\s+view\b[^\n]*--comments\b/u;
+var ISSUE_READ_COMMAND = /\b(?:issue:read|run:entry|run:prep)\b/u;
+function add_issue_read_numbers(command, numbers) {
+  const match = ISSUE_READ_ARGUMENTS.exec(command);
+  if (match === null) return;
+  const tokens = (match[1] ?? "").split(/\s+/u);
+  for (const token of tokens) {
+    if (issue_number_shape.ISSUE_NUMBER_PATTERN.test(token)) numbers.add(Number(token));
+  }
+}
+function issue_numbers_of(command) {
+  const numbers = /* @__PURE__ */ new Set();
+  for (const match of command.matchAll(ISSUE_PATH_NUMBER)) numbers.add(Number(match[1]));
+  const view = ISSUE_VIEW_NUMBER.exec(command);
+  if (view !== null) numbers.add(Number(view[1]));
+  add_issue_read_numbers(command, numbers);
+  return numbers;
+}
+function fetches_comments(command) {
+  return COMMENTS_ENDPOINT.test(command) || VIEW_WITH_COMMENTS.test(command) || ISSUE_READ_COMMAND.test(command);
+}
+function reads_target_comments(command, target) {
+  if (!fetches_comments(command)) return false;
+  for (const number of issue_numbers_of(command)) {
+    if (target.has(number)) return true;
+  }
+  return false;
+}
+function already_read_comments_for(tail, command) {
+  const target = issue_numbers_of(command);
+  if (target.size === 0) return false;
+  return tail_commands.prior_bash_commands(tail).some((prior) => reads_target_comments(prior, target));
+}
+function already_read_for_call(tail, call) {
+  if (call.name !== cost_blocks.BASH_TOOL) return false;
+  return already_read_comments_for(tail, time_shell.bash_command(call.input));
+}
+var prior_comment_read = {
+  already_read_comments_for,
+  already_read_for_call,
+  fetches_comments,
+  issue_numbers_of
+};
+
+// scripts/rules/issue-comments.ts
+var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
+var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
+var FETCHES_COMMENTS = /--comments\b|--json[=\s]['"]?[\w,]*\bcomments\b|\/comments\b/u;
+var ISSUES_PATH = /repos\/[^\s'"]*\/issues\//u;
+var FIELD_PROJECTION = /(?:--jq|--json)[= ]\s*('[^']*'|"[^"]*"|\S+)/u;
+var NAMES_THE_BODY = /\bbody\b/u;
+var NAMES_A_FIELD = /(?:^|[.{,\s'"])[A-Za-z_]/u;
+function projects_away_body(segment) {
+  const value = FIELD_PROJECTION.exec(segment)?.[1];
+  return value !== void 0 && NAMES_A_FIELD.test(value) && !NAMES_THE_BODY.test(value);
+}
+function is_body_read_segment(segment) {
+  if (projects_away_body(segment)) return false;
+  if (ISSUE_VIEW_COMMAND.test(segment)) return true;
+  return gh_api.is_gh_api(segment) && ISSUE_BODY_PATH.test(segment) && gh_api.is_read(segment);
+}
+function fetches_issue_comments(segment) {
+  if (!FETCHES_COMMENTS.test(segment)) return false;
+  return ISSUE_VIEW_COMMAND.test(segment) || gh_api.is_gh_api(segment) && ISSUES_PATH.test(segment);
+}
+function is_body_only_issue_read(command) {
+  const segments = shell_segments.segments_of(command);
+  if (segments.some((segment) => fetches_issue_comments(segment))) return false;
+  return segments.some((segment) => is_body_read_segment(segment));
+}
+function reads_issue_comments(command) {
+  return shell_segments.segments_of(command).some((segment) => fetches_issue_comments(segment));
+}
+var RULE_DOC = "`.claude/skills/workflow-commands/issue-comments.md`";
+var COMMENTS_FALLBACK = "gh api repos/<owner>/<repo>/issues/<N>/comments";
+var ISSUE_COMMENTS_REASON = `\u26D4 issue comments: pnpm josh issue:read <N>
+Run that in place of this read \u2014 an Issue's comments are part of it, and a later comment supersedes the body it contradicts; refused until that command is on the transcript. Without josh, read \`${COMMENTS_FALLBACK}\` beside the body (${RULE_DOC}).`;
+var COMMENTS_JQ = String.raw`'.[] | "— \(.user.login) \(.created_at)\n\(.body)\n"'`;
+var COMMENTS_NOTE = `\u21BB issue comments: this read returned only the Issue's body, so the Issue's comments were fetched on the same line \u2014 a later comment supersedes the body it contradicts (${RULE_DOC}).`;
+function rewritable_path(command) {
+  const read = shell_segments.first_of(command);
+  if (read === void 0 || ISSUE_VIEW_COMMAND.test(read)) return void 0;
+  return is_body_read_segment(read) ? ISSUE_BODY_PATH.exec(read)?.[0] : void 0;
+}
+function comments_command(command) {
+  if (!is_body_only_issue_read(command)) return void 0;
+  const path6 = rewritable_path(command);
+  if (path6 === void 0) return void 0;
+  return `gh api --paginate ${path6}/comments --jq ${COMMENTS_JQ}
+${command}`;
+}
+function comments_input(call, tail) {
+  if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return void 0;
+  const command = comments_command(time_shell.bash_command(call.input));
+  if (command === void 0 || prior_comment_read.already_read_for_call(tail(), call)) {
+    return void 0;
+  }
+  return { ...call.input, command };
+}
+var ROW7 = {
+  id: "issue-comments",
+  is_trigger: bash_triggers.on_bash_command(is_body_only_issue_read),
+  reason: ISSUE_COMMENTS_REASON,
+  already_satisfied: prior_comment_read.already_read_for_call,
+  keeps: bash_triggers.on_bash_command(reads_issue_comments),
+  rewrite: comments_input,
+  rewrite_note: COMMENTS_NOTE,
+  // The opening the reason carried before it led with the command.
+  former_reasons: ["\u26D4 an Issue's comments are part of the Issue: read them before implementing"],
+  about: {
+    title: "Reading Issue comments",
+    topic: "`issue-comments.md`",
+    fires: "a `Bash` that reads only the Issue body (`gh issue view <N>`, or a GET ending in `\u2026/issues/<N>`). Refused until it is re-read with the comments",
+    quiet: "no Issue read, or a read with `--comments` / `--json comments` / `\u2026/comments` from the start"
+  }
+};
+var issue_comments = {
+  COMMENTS_NOTE,
+  ISSUE_COMMENTS_REASON,
+  ROW: ROW7,
+  comments_input,
+  fetches_issue_comments,
+  is_body_only_issue_read,
+  projects_away_body
+};
+
+// scripts/rules/direct-issue-read.ts
+var API_SUBCOMMAND2 = "api";
+var ISSUE_GROUP2 = "issue";
+var VIEW_ACTION = "view";
+var WEB_FLAGS = /* @__PURE__ */ new Set(["-w", "--web"]);
+var VIEW_VALUE_TAKING_FLAGS = /* @__PURE__ */ new Set([
+  ...direct_pr_create.VALUE_TAKING_FLAGS,
+  "--json",
+  "-q",
+  "--jq",
+  "-t",
+  "--template"
+]);
+var REPO_EQUALS = "--repo=";
+var ISSUE_URL = /^https?:\/\/[^/\s]+\/(?<named>[^/\s]+\/[^/\s]+)\/issues\/\d+/u;
+var OWNER_REPO_PARTS = 2;
+var QUOTE2 = `['"]?`;
+var API_ORIGIN2 = String.raw`(?:https://api\.github\.com)?/?`;
+var SEGMENT2 = String.raw`[^/\s'"?]+`;
+var NUMBER = String.raw`(?:\d+|\$\{?\w+\}?)`;
+var ISSUE_READ_PATH = new RegExp(
+  String.raw`^${QUOTE2}${API_ORIGIN2}repos/${SEGMENT2}/${SEGMENT2}/issues/${NUMBER}(?:/comments|/timeline)?/?(?:\?[^\s'"]*)?${QUOTE2}$`,
+  "u"
+);
+function is_own_repository(owner, repo) {
+  if (gh_api.is_owner_placeholder(owner)) return true;
+  return `${owner}/${repo}`.toLowerCase() === session_cite.session_repo()?.toLowerCase();
+}
+function is_own_issue_endpoint(endpoint) {
+  const target = gh_api.repo_target(endpoint);
+  if (target === void 0) return false;
+  return is_own_repository(target.owner, target.repo) && ISSUE_READ_PATH.test(endpoint);
+}
+function is_body_api_read(call) {
+  return gh_api.is_gh_api(call) && gh_api.is_read(call) && !issue_comments.projects_away_body(call);
+}
+function is_api_issue_read(args, call) {
+  if (!is_body_api_read(call)) return false;
+  const [subcommand, endpoint = ""] = direct_pr_create.positional_words(
+    args,
+    direct_pr_create.API_VALUE_TAKING_FLAGS
+  );
+  return subcommand === API_SUBCOMMAND2 && is_own_issue_endpoint(endpoint);
+}
+function repo_flag(args) {
+  const index = args.findIndex((argument) => direct_pr_create.VALUE_TAKING_FLAGS.has(argument));
+  if (index !== -1) return args[index + 1];
+  return args.find((argument) => argument.startsWith(REPO_EQUALS))?.slice(REPO_EQUALS.length);
+}
+function named_repository(args, issue) {
+  return ISSUE_URL.exec(issue)?.groups?.["named"] ?? repo_flag(args);
+}
+function is_own_view_target(args, issue) {
+  const named = named_repository(args, issue);
+  if (named === void 0) return true;
+  const [owner = "", repo = ""] = named.split("/").slice(-OWNER_REPO_PARTS);
+  return is_own_repository(owner, repo);
+}
+function prints_body_or_comments(call) {
+  if (issue_comments.fetches_issue_comments(call)) return true;
+  return !issue_comments.projects_away_body(call);
+}
+function is_printed_view(args, issue, call) {
+  if (args.some((argument) => WEB_FLAGS.has(argument))) return false;
+  return is_own_view_target(args, issue) && prints_body_or_comments(call);
+}
+function is_issue_view_read(args, call) {
+  const [group, action, issue = ""] = direct_pr_create.positional_words(
+    args,
+    VIEW_VALUE_TAKING_FLAGS
+  );
+  const is_view = group === ISSUE_GROUP2 && action === VIEW_ACTION;
+  return is_view && is_printed_view(args, issue, call);
+}
+function is_issue_read_segment(segment) {
+  const args = git_argv.arguments_of(segment, direct_pr_create.GH_COMMAND);
+  if (args === void 0 || direct_pr_create.is_help_call(args)) return false;
+  const call = [direct_pr_create.GH_COMMAND, ...args].join(" ");
+  return is_api_issue_read(args, call) || is_issue_view_read(args, call);
+}
+function is_direct_issue_read(command) {
+  return direct_pr_create.has_run_segment(command, is_issue_read_segment);
+}
+var READ_NAMES = /* @__PURE__ */ new Set(["issue:read", "run:prep", "run:entry"]);
+function is_josh_read(command) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, READ_NAMES));
+}
+function is_any_read(command) {
+  return is_direct_issue_read(command) || is_josh_read(command);
+}
+var VIEW_WORDS = ["gh", ISSUE_GROUP2, VIEW_ACTION];
+var REPO_SPELLING = /^(?:(?:-R|--repo) |--repo=)(?<repo>[\w.-]+\/[\w.-]+)$/u;
+var ISSUE_READ_COMMAND2 = "pnpm josh issue:read";
+var REPO_FLAG = "--repo";
+function carried_repo(flags) {
+  if (flags === "") return [];
+  const repo = REPO_SPELLING.exec(flags)?.groups?.["repo"];
+  return repo === void 0 ? void 0 : [REPO_FLAG, repo];
+}
+function issue_read_of(view) {
+  const repo = carried_repo(view.flags);
+  return repo === void 0 ? void 0 : standalone_gh_call.line_of([ISSUE_READ_COMMAND2, view.issue, ...repo]);
+}
+function issue_read_command(command) {
+  const view = standalone_gh_call.call_of(command, VIEW_WORDS);
+  const read = view === void 0 ? void 0 : issue_read_of(view);
+  return read !== void 0 && is_direct_issue_read(command.trim()) ? read : void 0;
+}
+function issue_read_input(call) {
+  return standalone_gh_call.input_of(call, issue_read_command);
+}
+var ISSUE_READ_NOTE = "\u21BB direct issue read: this `gh issue view <N>` ran as `pnpm josh issue:read <N>`, which withholds a comment from an author without write access (`issue-comments.md`).";
+var DIRECT_ISSUE_READ_REASON = "\u26D4 direct issue read: pnpm josh issue:read <N>\nRun that in place of this read of `\u2026/issues/<N>`, its comments or its timeline (`gh api` or `gh issue view`) \u2014 it withholds a comment from an author without write access and marks an untrusted body as a report, which a raw read prints whole as if it were an instruction (`issue-comments.md`). **This rule fires on every occurrence, not once per run.**";
+var ROW8 = {
+  id: "direct-issue-read",
+  is_trigger: bash_triggers.on_bash_command(is_direct_issue_read),
+  reason: DIRECT_ISSUE_READ_REASON,
+  decide: () => true,
+  keeps: bash_triggers.on_bash_command(is_josh_read),
+  reaches: bash_triggers.on_bash_command(is_any_read),
+  rewrite: issue_read_input,
+  rewrite_note: ISSUE_READ_NOTE,
+  about: {
+    title: "Direct issue read",
+    topic: "`issue-comments.md`",
+    fires: "a `gh api` GET of the checkout's own `repos/<o>/<r>/issues/<N>`, `\u2026/comments` or `\u2026/timeline` (the `{owner}` placeholder or the origin spelled out), or a `gh issue view <N>` of it, with no projection or one naming the body (or, for the view, the comments); it points at `pnpm josh issue:read`. A line that is only `gh issue view <N>`, with at most `-R` / `--repo <owner>/<repo>`, is rewritten to `pnpm josh issue:read <N>`; every other form is refused, every occurrence",
+    quiet: "`pnpm josh issue:read` / `run:prep` / `run:entry`, a `--jq` / `--json` projection without the body or the comments, `gh issue view --web`, or another repository named outright"
+  }
+};
+var direct_issue_read = {
+  DIRECT_ISSUE_READ_REASON,
+  ISSUE_READ_NOTE,
+  ROW: ROW8,
+  is_direct_issue_read,
+  issue_read_command
+};
+
+// scripts/rules/direct-vitest-run.ts
+var VITEST_PROGRAM = "vitest";
+var OTHER_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "bench",
+  "list",
+  "init",
+  "typecheck",
+  "related",
+  "watch",
+  "dev"
+]);
+var EXEMPT_FLAGS = /* @__PURE__ */ new Set([
+  "--project",
+  "--config",
+  "-c",
+  "--help",
+  "-h",
+  "--version",
+  "-v"
+]);
+var FLAG_VALUE_SEPARATOR = "=";
+function is_exempt_flag(argument) {
+  return EXEMPT_FLAGS.has(argument.split(FLAG_VALUE_SEPARATOR, 1)[0] ?? argument);
+}
+function is_carried_arguments(args) {
+  if (OTHER_SUBCOMMANDS.has(args[0] ?? "")) return false;
+  return args.every((argument) => !is_exempt_flag(argument));
+}
+function is_carried_run(call) {
+  if (call.name !== VITEST_PROGRAM || call.is_reserved) return false;
+  return is_carried_arguments(call.args);
+}
+function is_direct_vitest_run(command) {
+  return command_memory.tool_calls_of(command).some((call) => is_carried_run(call));
+}
+var TEST_RELATED = /* @__PURE__ */ new Set(["test:related"]);
+function is_test_related(command) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, TEST_RELATED));
+}
+function is_any_test_run(command) {
+  return is_direct_vitest_run(command) || is_test_related(command);
+}
+var DIRECT_VITEST_RUN_REASON = '\u26D4 direct vitest run: pnpm josh test:related [<file>\u2026]\nRun that in place of this `vitest run` \u2014 it hands the files and `--flag=value` flags on to vitest and leaves the record the gate reuses (`docs/josh-commands.md` \u2192 "`josh test:related`"). `--project` / `--config` and `vitest bench` / `list` pass. **This rule fires on every occurrence.**';
+var ROW9 = {
+  id: "direct-vitest-run",
+  is_trigger: bash_triggers.on_bash_command(is_direct_vitest_run),
+  reason: DIRECT_VITEST_RUN_REASON,
+  decide: () => true,
+  keeps: bash_triggers.on_bash_command(is_test_related),
+  reaches: bash_triggers.on_bash_command(is_any_test_run),
+  about: {
+    title: "Direct vitest run",
+    topic: '`docs/josh-commands.md` \u2192 "`josh test:related`"',
+    fires: "`vitest run` or bare `vitest` (directly, through `pnpm` / `npx` / `pnpm exec`, or inside `sh -c`); it points at `pnpm josh test:related`. Every occurrence",
+    quiet: "`pnpm josh test:related`, `--project` / `--config` / `-c`, another subcommand (`bench`, `list`, \u2026), `--help` / `--version`, or a run inside `pnpm josh reserved-run`"
+  }
+};
+var direct_vitest_run = { DIRECT_VITEST_RUN_REASON, ROW: ROW9, is_direct_vitest_run };
+
+// scripts/rules/early-heartbeat.ts
+var ARM_PREFIX = "josh-heartbeat-arm-";
+var SEGMENT_SEPARATOR = /&&|\|\||;|&|\n/u;
+var SLEEP_SEGMENT = /^sleep\s+(\d+(?:\.\d+)?)([smhd]?)$/u;
+var INERT_SEGMENT = /^(?::|true|(?:echo|printf|date)\b.*)$/u;
+var LOOP_KEYWORD = /\b(?:while|until|for|do|done)\b/u;
+var SECONDS_PER_UNIT = { d: 86400, h: 3600, m: 60, s: 1 };
+var BARE_NUMBER_SECONDS = 1;
+var AMOUNT_GROUP = 1;
+var UNIT_GROUP = 2;
+var NO_SECONDS = 0;
+var ARM_RECORD = hook_decision.create_refusal_stamp(ARM_PREFIX);
+function segments_of(command) {
+  return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim()).filter((segment) => segment !== "");
+}
+function sleep_seconds(segment) {
+  const matched = SLEEP_SEGMENT.exec(segment);
+  if (matched === null) return void 0;
+  const unit = matched[UNIT_GROUP] ?? "";
+  return Number(matched[AMOUNT_GROUP]) * (SECONDS_PER_UNIT[unit] ?? BARE_NUMBER_SECONDS);
+}
+function is_wait_or_inert(segment) {
+  return sleep_seconds(segment) !== void 0 || INERT_SEGMENT.test(segment);
+}
+function is_wait_timer(command) {
+  if (LOOP_KEYWORD.test(command)) return false;
+  const segments = segments_of(command);
+  if (segments.every((segment) => sleep_seconds(segment) === void 0)) return false;
+  return segments.every((segment) => is_wait_or_inert(segment));
+}
+function wait_duration_ms(command) {
+  const seconds = segments_of(command).reduce(
+    (total, segment) => total + (sleep_seconds(segment) ?? NO_SECONDS),
+    NO_SECONDS
+  );
+  return seconds * MS_PER_SECOND;
+}
+function is_armed(target, now_ms) {
+  return now_ms < ARM_RECORD.last_ms(target);
+}
+function landing_ms(command, now_ms, last_report_ms) {
+  const interval_ms = run_progress_config.configured_interval_ms();
+  const duration_ms = wait_duration_ms(command);
+  if (duration_ms > interval_ms) return void 0;
+  const lands_ms = now_ms + duration_ms;
+  return run_progress.is_due(last_report_ms, lands_ms, interval_ms) ? lands_ms : void 0;
+}
+function decide(call, run, can_record) {
+  const last_report_ms = run_progress_clock.read_last_report_sync();
+  if (last_report_ms === void 0) return false;
+  const target = ARM_RECORD.path(run.transcript);
+  if (is_armed(target, run.now_ms)) return true;
+  const lands_ms = landing_ms(time_shell.bash_command(call.input), run.now_ms, last_report_ms);
+  if (lands_ms === void 0) return true;
+  if (can_record) ARM_RECORD.record(target, lands_ms);
+  return false;
+}
+var EARLY_HEARTBEAT_REASON = "\u26D4 early heartbeat: this call arms a wait timer of its own. Start `pnpm josh run:progress --wait` once in the background: it reports to the run's event stream on its own \u2014 relay nothing. When asked, `pnpm josh run:progress --once` \u2014 under `backlogrun`, `pnpm josh run:board --chat`; for CI, `pnpm josh followup`. It fires on every occurrence (`.claude/skills/workflow-commands/progress-watcher.md`).";
+var PROGRESS_NAMES = /* @__PURE__ */ new Set(["run:progress"]);
+var WATCH_FLAG = /(?:^|\s)--(?:wait|once)(?=\s|$)/u;
+function is_progress_watch_segment(segment) {
+  return shell_segments.is_josh_command(segment, PROGRESS_NAMES) && WATCH_FLAG.test(segment);
+}
+function is_progress_watch(command) {
+  return segments_of(time_shell.unquoted(command)).some(
+    (segment) => is_progress_watch_segment(segment)
+  );
+}
+function waits_for_progress(command) {
+  return is_wait_timer(command) || is_progress_watch(command);
+}
+var early_heartbeat = {
+  ARM_PREFIX,
+  EARLY_HEARTBEAT_REASON,
+  decide,
+  is_progress_watch,
+  is_wait_or_inert,
+  is_wait_timer,
+  sleep_seconds,
+  wait_duration_ms,
+  waits_for_progress
+};
+
+// scripts/rules/file-body.ts
+import { existsSync } from "node:fs";
+var HEREDOC2 = /(?<!<)<<(?!<)-?\s*['"]?([A-Z_a-z]\w*)/u;
+var LINE_BREAK = "\n";
+function has_heredoc(command) {
+  return HEREDOC2.test(command);
+}
+function with_body_line(lines, line) {
+  const opener = lines.at(-1);
+  if (opener === void 0) return [...lines];
+  return [...lines.slice(0, -1), { ...opener, body: `${opener.body}${line}${LINE_BREAK}` }];
+}
+function scan_line(scan, line) {
+  if (scan.delimiter === void 0) {
+    return { lines: [...scan.lines, { text: line, body: "" }], delimiter: HEREDOC2.exec(line)?.[1] };
+  }
+  if (line.trim() === scan.delimiter) return { ...scan, delimiter: void 0 };
+  return { ...scan, lines: with_body_line(scan.lines, line) };
+}
+function command_lines(command) {
+  let scan = { lines: [], delimiter: void 0 };
+  for (const line of command.split(LINE_BREAK)) scan = scan_line(scan, line);
+  return scan.lines;
+}
+var FILE_REDIRECT = /(?:^|\s)>>?\s*(?!&)("[^"]+"|'[^']+'|\S+)/u;
+var TEE_TARGET = /\btee\s+(?:-a\s+)?(?!-)("[^"]+"|'[^']+'|\S+)/u;
+var QUOTES2 = /^['"]|['"]$/gu;
+function redirect_target(line) {
+  const target = FILE_REDIRECT.exec(line)?.[1] ?? TEE_TARGET.exec(line)?.[1];
+  return target === void 0 ? void 0 : target.replaceAll(QUOTES2, "");
+}
+var BODY_INTERPRETERS = /* @__PURE__ */ new Set([
+  "python",
+  "python3",
+  "ruby",
+  "perl",
+  "php",
+  "node"
+]);
+var NODE = "node";
+var NODE_EVAL = /(?:^|\s)(?:-e|--eval)\b/u;
+var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines|_text|_bytes)?\s*\(/u;
+var WRITE_MODE = /open\s*\([^)]*['"][rbt+]*[wax]|os\.replace|shutil\.(?:copy|move)/u;
+function body_writes(body) {
+  return WRITE_CALL.test(body) || WRITE_MODE.test(body);
+}
+var SCRIPT_FILE = /\.(?:py|rb|pl|php|js|mjs|cjs)$/u;
+function is_heredoc_write(line, has_file) {
+  const target = has_heredoc(line.text) ? redirect_target(line.text) : void 0;
+  if (target === void 0) return false;
+  if (has_file(target)) return true;
+  return SCRIPT_FILE.test(target) && body_writes(line.body);
+}
+function is_interpreter_write(segment, body) {
+  const leading = time_shell.leading_word(segment);
+  if (!BODY_INTERPRETERS.has(leading)) return false;
+  if (has_heredoc(segment)) return body_writes(body);
+  return leading === NODE && NODE_EVAL.test(segment) && body_writes(segment);
+}
+var PERL = "perl";
+var PERL_IN_PLACE = /^-[A-Za-z0-9]*i/u;
+var WHITESPACE = /\s+/u;
+function is_in_place_perl(segment) {
+  if (time_shell.leading_word(segment) !== PERL) return false;
+  return segment.split(WHITESPACE).some((word) => PERL_IN_PLACE.test(word));
+}
+function has_body_interpreter(line) {
+  return shell_segments.segments_of(line.text).some((segment) => is_interpreter_write(segment, line.body) || is_in_place_perl(segment));
+}
+function carries_a_file_body(command, has_file = existsSync) {
+  return command_lines(command).some(
+    (line) => is_heredoc_write(line, has_file) || has_body_interpreter(line)
+  );
+}
+var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline, which is re-read on every later request. Edit a region with the Edit tool, rewrite a whole file with the Write tool, and pass a body by path (`--body-file <path>`); a new-file `cat > <new-file> <<EOF` stays allowed. This rule fires on every occurrence (`prompts/collaboration-workflow/file-edits.md`).";
+var ROW10 = {
+  id: "file-body",
+  is_trigger: bash_triggers.on_bash_command((command) => carries_a_file_body(command)),
+  reason: FILE_BODY_REASON,
+  decide: () => true,
+  about: {
+    title: "No file body on the shell",
+    topic: "`file-edits.md`",
+    fires: "a heredoc write to an existing file, a writing `node -e` / interpreter heredoc, or `perl -0pi -e`. Every occurrence",
+    quiet: "a new file, a read-only heredoc, or a short `sed -i`"
+  }
+};
+var file_body = {
+  FILE_BODY_REASON,
+  ROW: ROW10,
+  carries_a_file_body
+};
+
+// scripts/rules/file-rewrite.ts
+var { WRITE, EDIT, is_edit_tool, string_field } = edit_tool;
+var MAX_SHARED_RATIO = 0.5;
+var PERCENT = 100;
+var LINE_BREAK2 = "\n";
+var ISSUE_PLACEHOLDER = "<N>";
+var REGEX_SPECIALS = /[.*+?^${}()|[\]\\]/gu;
+var ISSUE_DIGITS = String.raw`\d+`;
+var HANDOFF_PATTERN = run_cut_handoff.HANDOFF_PATH.replaceAll(
+  REGEX_SPECIALS,
+  (special) => `\\${special}`
+).replace(ISSUE_PLACEHOLDER, () => ISSUE_DIGITS);
+var HANDOFF = new RegExp(`(?:^|/)${HANDOFF_PATTERN}$`, "u");
+function body_lines(text) {
+  return text.split(LINE_BREAK2).map((line) => line.trim()).filter((line) => line !== "");
+}
+function count_lines(lines) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const line of lines) counts.set(line, (counts.get(line) ?? 0) + 1);
+  return counts;
+}
+function take_line(counts, line) {
+  const left = counts.get(line) ?? 0;
+  if (left === 0) return false;
+  counts.set(line, left - 1);
+  return true;
+}
+function shared_ratio(old_text, new_text) {
+  const new_lines = body_lines(new_text);
+  if (new_lines.length === 0) return 0;
+  const old_counts = count_lines(body_lines(old_text));
+  const shared = new_lines.filter((line) => take_line(old_counts, line)).length;
+  return shared / new_lines.length;
+}
+function write_input(call) {
+  if (call.name !== WRITE || !json_value.is_record(call.input)) return void 0;
+  return HANDOFF.test(string_field(call.input, "file_path")) ? void 0 : call.input;
+}
+function rewrite_ratio(call, read) {
+  const input = write_input(call);
+  const old_text = input === void 0 ? void 0 : read(string_field(input, "file_path"));
+  if (input === void 0 || old_text === void 0) return void 0;
+  return shared_ratio(old_text, string_field(input, "content"));
+}
+function rewrites_kept_body(call, read = file_reader.read_optional) {
+  return (rewrite_ratio(call, read) ?? 0) > MAX_SHARED_RATIO;
+}
+function reaches_file_change(call) {
+  return is_edit_tool(call.name);
+}
+function keeps_region_edit(call) {
+  return call.name === EDIT;
+}
+var FILE_REWRITE_REASON = `\u26D4 whole-file Write of an existing file: the new body keeps more than ${String(MAX_SHARED_RATIO * PERCENT)}% of the old lines, so it is a region edit carried as a whole file and its diff cannot be read. Change the region with the Edit tool; a Write stays for a new file or a rebuild sharing almost nothing. This rule fires on every occurrence (\`prompts/collaboration-workflow/file-edits.md\`).`;
+var ROW11 = {
+  id: "file-rewrite",
+  is_trigger: (call) => rewrites_kept_body(call),
+  reason: FILE_REWRITE_REASON,
+  decide: () => true,
+  keeps: keeps_region_edit,
+  reaches: reaches_file_change,
+  about: {
+    title: "No whole-file Write that keeps most of the old body",
+    topic: "`file-edits.md`",
+    fires: "a `Write` over an existing file whose new body shares more than half its non-blank lines with the old one. Every occurrence",
+    quiet: "a new file, the run's handoff, a rebuild sharing half or less, or an `Edit`"
+  }
+};
+var file_rewrite = {
+  FILE_REWRITE_REASON,
+  MAX_SHARED_RATIO,
+  ROW: ROW11,
+  rewrites_kept_body,
+  shared_ratio
+};
+
+// scripts/rules/sed-in-place.ts
+var SED = "sed";
+var IN_PLACE_SHORT = /^-[A-Za-z]*i/u;
+var IN_PLACE_LONG = /^--in-place(?:=|$)/u;
+var IN_PLACE_CLUSTER = /^-[A-Za-z]*i$/u;
+var EXTENDED_SHORT = /^-[A-Za-z]*[Er]/u;
+var EXTENDED_LONG = "--regexp-extended";
+var PLAIN_FLAGS = /* @__PURE__ */ new Set(["", "g"]);
+var SCRIPT_FLAG = "-e";
+var FLAG_PREFIX2 = "-";
+var SURROUNDING_QUOTES = /^(['"])(.*)\1$/su;
+var QUOTED_BODY = 2;
+var META_CHARACTER = /[/&\\.*[\]^$]/u;
+var SUBSTITUTE = "s";
+var SUBSTITUTE_PARTS = 3;
+var ONE_MATCH = 1;
+function unquoted(word) {
+  return SURROUNDING_QUOTES.exec(word)?.[QUOTED_BODY] ?? word;
+}
+function is_in_place_flag(word) {
+  return IN_PLACE_LONG.test(word) || IN_PLACE_SHORT.test(word);
+}
+function without_suffix(words) {
+  const index = words.findIndex((word) => IN_PLACE_CLUSTER.test(word));
+  if (index === -1 || words[index + 1] !== "") return [...words];
+  return words.toSpliced(index + 1, 1);
+}
+function sed_words(segment) {
+  const words = git_argv.arguments_of(segment, SED)?.map((word) => unquoted(word));
+  return words?.some((word) => is_in_place_flag(word)) === true ? without_suffix(words) : void 0;
+}
+function is_script_value(words, index) {
+  return words[index - 1] === SCRIPT_FLAG;
+}
+function sed_call(words) {
+  const scripts = words.filter((_word, index) => is_script_value(words, index));
+  const operands = words.filter(
+    (word, index) => !word.startsWith(FLAG_PREFIX2) && !is_script_value(words, index)
+  );
+  if (scripts.length > 0) return { scripts, files: operands };
+  const [script, ...files] = operands;
+  return { scripts: script === void 0 ? [] : [script], files };
+}
+function substitute_parts(script) {
+  if (!script.startsWith(SUBSTITUTE)) return void 0;
+  const parts = script.slice(SUBSTITUTE.length + 1).split(script.charAt(SUBSTITUTE.length));
+  return parts.length === SUBSTITUTE_PARTS ? parts : void 0;
+}
+function has_plain_flags(parts) {
+  return PLAIN_FLAGS.has(parts.at(-1) ?? "");
+}
+function is_plain(parts) {
+  const [pattern = "", replacement = ""] = parts;
+  return pattern !== "" && has_plain_flags(parts) && !META_CHARACTER.test(pattern + replacement);
+}
+function is_extended(words) {
+  return words.some((word) => word === EXTENDED_LONG || EXTENDED_SHORT.test(word));
+}
+function single_script(words) {
+  if (is_extended(words)) return void 0;
+  const { scripts } = sed_call(words);
+  return scripts.length === 1 ? scripts[0] : void 0;
+}
+function plain_pattern(words) {
+  const script = single_script(words);
+  const parts = script === void 0 ? void 0 : substitute_parts(script);
+  return parts !== void 0 && is_plain(parts) ? parts[0] : void 0;
+}
+function match_count(text, pattern) {
+  return text.split(pattern).length - 1;
+}
+function is_unsafe_segment(segment, read) {
+  const words = sed_words(segment);
+  if (words === void 0) return false;
+  const { files } = sed_call(words);
+  const pattern = plain_pattern(words);
+  if (pattern === void 0 || files.length === 0) return true;
+  return files.some((file) => match_count(read(file), pattern) !== ONE_MATCH);
+}
+function is_unsafe_sed(command, read = file_reader.read_file_or_empty) {
+  return shell_segments.segments_of(command).some((segment) => is_unsafe_segment(segment, read));
+}
+function is_in_place_sed(command) {
+  return shell_segments.segments_of(command).some((segment) => sed_words(segment) !== void 0);
+}
+function keeps_plain_sed(command) {
+  return shell_segments.segments_of(command).some((segment) => {
+    const words = sed_words(segment);
+    return words !== void 0 && plain_pattern(words) !== void 0;
+  });
+}
+var SED_IN_PLACE_REASON = "\u26D4 unsafe `sed -i`: its pattern or replacement carries a meta character (`/ & \\ . * [ ] ^ $`), it is not one plain `s` command (a flag other than `g`, or `-E`), or it does not match exactly once in each target file, so it can rewrite a line you did not mean to. Change the region with the Edit tool. This rule fires on every occurrence (`prompts/collaboration-workflow/file-edits.md`).";
+var ROW12 = {
+  id: "sed-in-place",
+  is_trigger: bash_triggers.on_bash_command((command) => is_unsafe_sed(command)),
+  reason: SED_IN_PLACE_REASON,
+  decide: () => true,
+  keeps: bash_triggers.on_bash_command(keeps_plain_sed),
+  reaches: bash_triggers.on_bash_command(is_in_place_sed),
+  about: {
+    title: "No `sed -i` its countable conditions do not clear",
+    topic: "`file-edits.md`",
+    fires: "a `sed -i` whose script is not one `s` command, whose pattern or replacement has a meta character, or which does not match exactly once in a target file. Every occurrence",
+    quiet: "not in place, or one plain `s` command matching once in each file"
+  }
+};
+var sed_in_place = {
+  ROW: ROW12,
+  is_in_place_sed,
+  is_unsafe_sed,
+  keeps_plain_sed
+};
+
+// scripts/rules/file-edit-rows.ts
+var SHELL_ROWS = [file_body.ROW, sed_in_place.ROW];
+var file_edit_rows = {
+  FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+  REWRITE_ROW: file_rewrite.ROW,
+  SHELL_ROWS
+};
+
+// scripts/rules/git-force.ts
+var FORCE_LONG_PREFIX = "--force";
+var DELETE_LONG = "--delete";
+var DESTRUCTIVE_PUSH_LONG = /* @__PURE__ */ new Set([DELETE_LONG, "--mirror", "--prune"]);
+var PUSH_SHORT_LETTERS = "fd";
+var FORCE_OR_DELETE_REFSPEC = /^[+:]/u;
+function is_force_or_delete_push(args) {
+  return args.some(
+    (argument) => argument.startsWith(FORCE_LONG_PREFIX) || DESTRUCTIVE_PUSH_LONG.has(argument) || git_argv.short_cluster_has(argument, PUSH_SHORT_LETTERS) || FORCE_OR_DELETE_REFSPEC.test(argument)
+  );
+}
+var BRANCH_DELETE_LETTERS = "dD";
+function is_branch_delete(args) {
+  return args.some(
+    (argument) => argument === DELETE_LONG || git_argv.short_cluster_has(argument, BRANCH_DELETE_LETTERS)
+  );
+}
+var PUSH_SUBCOMMAND = "push";
+var BRANCH_SUBCOMMAND = "branch";
+function is_destructive_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  if (call.subcommand === PUSH_SUBCOMMAND) return is_force_or_delete_push(call.args);
+  return call.subcommand === BRANCH_SUBCOMMAND && is_branch_delete(call.args);
+}
+function is_force_or_delete(command) {
+  return shell_segments.commands_of(command).some((segment) => is_destructive_segment(segment));
+}
+var GIT_FORCE_REASON = "\u26D4 force push or branch delete: this rewrites or removes shared history, which is Tier C and needs explicit current-turn user instruction. Push with `pnpm josh git`; leave a force push or branch delete to the user's own terminal. This rule fires on every occurrence (`prompts/collaboration-workflow/operating-rules.md`).";
+var ROW13 = {
+  id: "git-force",
+  is_trigger: bash_triggers.on_bash_command(is_force_or_delete),
+  reason: GIT_FORCE_REASON,
+  decide: () => true,
+  about: {
+    title: "Force push / branch delete",
+    topic: "`operating-rules.md`",
+    fires: "a `git push` / `git branch` read as force (`--force` / `-f` / `-uf` \u2026) or delete (`--delete` / `-d` / `-D` / `:branch`) in any spelling. Every occurrence",
+    quiet: "a plain `git push` / `git branch`"
+  }
+};
+var git_force = {
+  GIT_FORCE_REASON,
+  ROW: ROW13,
+  is_force_or_delete
+};
+
+// scripts/rules/investigator-foreground.ts
+var INVESTIGATOR_FOREGROUND_REASON = "\u26D4 investigator foreground: a background `investigator` leaves its result queued until a later turn. Reissue the call with `run_in_background: false`, and put the reads of files this run will edit in the same message. It fires on every occurrence (`.claude/skills/workflow-commands/delegation.md`).";
+var BACKGROUND_FIELD = "run_in_background";
+var BODY_FIELDS = ["description", "prompt"];
+var GUARD_LABEL = time_transcript_line.guard_from_refusal(INVESTIGATOR_FOREGROUND_REASON);
+var NO_FIELD_STAMP = hook_decision.create_refusal_stamp("josh-investigator-no-field-");
+function is_investigator(call) {
+  if (!agent_model.SUBAGENT_TOOLS.has(call.name) || !json_value.is_record(call.input)) return false;
+  const type = call.input["subagent_type"];
+  return typeof type === "string" && type.split(":").at(-1) === delegation_policy.INVESTIGATOR_AGENT;
+}
+function field_of(input, key) {
+  return json_value.is_record(input) ? input[key] : void 0;
+}
+function is_foreground(call) {
+  return field_of(call.input, BACKGROUND_FIELD) === false;
+}
+function is_background_investigator(call) {
+  return is_investigator(call) && !is_foreground(call);
+}
+function keeps_foreground(call) {
+  return is_investigator(call) && is_foreground(call);
+}
+function is_untyped_field(name, input) {
+  if (!agent_model.SUBAGENT_TOOLS.has(name) || !json_value.is_record(input)) return false;
+  return typeof input[BACKGROUND_FIELD] === "string";
+}
+function placed_of(lines) {
+  return lines.flatMap(
+    (line) => line.blocks.map((block) => ({ block, message_id: line.message_id, at_ms: line.timestamp_ms }))
+  );
+}
+function results_of(placed) {
+  const results = placed.filter(({ block }) => block.result_id !== "");
+  const refused = results.filter(({ block }) => block.refusal_guard === GUARD_LABEL);
+  return {
+    answered: new Set(results.map(({ block }) => block.result_id)),
+    refused: new Map(refused.map(({ block, at_ms }) => [block.result_id, at_ms]))
+  };
+}
+function writes_foreground(block) {
+  return String(field_of(block.input, BACKGROUND_FIELD)) === "false";
+}
+function has_same_body(block, call) {
+  return BODY_FIELDS.every((key) => field_of(block.input, key) === field_of(call.input, key));
+}
+function is_pending_foreground(block, results) {
+  return !results.answered.has(block.id) && writes_foreground(block);
+}
+function is_same_dispatch(block, call, results) {
+  if (!is_investigator(block) || !has_same_body(block, call)) return false;
+  return results.refused.has(block.id) || is_pending_foreground(block, results);
+}
+function is_dropped_foreground(block, results) {
+  return results.refused.has(block.id) && is_investigator(block) && writes_foreground(block);
+}
+function refused_at_ms(dispatch, results) {
+  return results.refused.get(dispatch?.block.id ?? "") ?? hook_decision.NEVER_MS;
+}
+function is_alone(dispatch, dispatches) {
+  return dispatches.filter(({ message_id }) => message_id === dispatch.message_id).length === 1;
+}
+function is_reissue(placed, results, now_ms) {
+  const dispatches = placed.filter(({ block }) => is_investigator(block));
+  const last = dispatches.findLast(({ block }) => results.answered.has(block.id));
+  const at_ms = refused_at_ms(last, results);
+  if (last === void 0 || at_ms === hook_decision.NEVER_MS) return false;
+  return is_alone(last, dispatches) && now_ms - at_ms < implementation_cut.REISSUE_WINDOW_MS;
+}
+function tail_shows_no_field(tail, call, now_ms) {
+  const placed = placed_of(time_transcript_line.parse_text(tail));
+  const results = results_of(placed);
+  const has_block_tell = placed.some(
+    ({ block }) => is_untyped_field(block.name, block.input) || is_same_dispatch(block, call, results) || is_dropped_foreground(block, results)
+  );
+  return has_block_tell || is_reissue(placed, results, now_ms);
+}
+function remember_no_field(run) {
+  NO_FIELD_STAMP.record(NO_FIELD_STAMP.path(run.transcript), run.now_ms);
+  return true;
+}
+function is_known_no_field(run) {
+  return run.context.env["CLAUDE_CODE_ENTRYPOINT"] === "claude-vscode" || NO_FIELD_STAMP.last_ms(NO_FIELD_STAMP.path(run.transcript)) !== hook_decision.NEVER_MS;
+}
+function lacks_background_field(tail, call, run) {
+  if (field_of(call.input, BACKGROUND_FIELD) === true) return false;
+  if (is_known_no_field(run)) return true;
+  const has_tell = is_untyped_field(call.name, call.input) || tail_shows_no_field(tail, call, run.now_ms);
+  return has_tell && remember_no_field(run);
+}
+var ROW14 = {
+  id: "investigator-foreground",
+  is_trigger: is_background_investigator,
+  reason: INVESTIGATOR_FOREGROUND_REASON,
+  already_satisfied: lacks_background_field,
+  decide: () => true,
+  keeps: keeps_foreground,
+  reaches: is_investigator,
+  about: {
+    title: "Investigator dispatched in the foreground",
+    topic: '`.claude/skills/workflow-commands/delegation.md` \u2192 "The pre-implementation reading \u2014 what goes to a unit, and from which file"',
+    fires: "an `Agent` / `Task` call of the `investigator` type without `run_in_background: false`. Every occurrence",
+    quiet: "another agent type, `run_in_background: false` set, VS Code identified by `CLAUDE_CODE_ENTRYPOINT=claude-vscode`, or a session whose subagent tool declares no `run_in_background` (the field written as a string, the tail holding the same description and prompt, a refused dispatch that wrote it `false`, or a reissue still without the field just after this row refused a lone dispatch) \u2014 remembered for the session"
+  }
+};
+var investigator_foreground = {
+  INVESTIGATOR_FOREGROUND_REASON,
+  ROW: ROW14,
+  is_background_investigator,
+  lacks_background_field
+};
+
+// scripts/rules/josh-git-bare.ts
+var GIT_COMMAND = /* @__PURE__ */ new Set(["git"]);
+var CONFIRM_FLAGS = /* @__PURE__ */ new Set(["-y", "--yes"]);
+function has_confirm_flag(args) {
+  return args.some((argument) => CONFIRM_FLAGS.has(argument));
+}
+function is_bare_segment(segment) {
+  if (!shell_segments.is_josh_command(segment, GIT_COMMAND)) return false;
+  return !has_confirm_flag(time_shell.josh_arguments(segment));
+}
+function is_bare_josh_git(command) {
+  return shell_segments.segments_of(command).some((segment) => is_bare_segment(segment));
+}
+var JOSH_GIT_BARE_REASON = '\u26D4 bare `pnpm josh git`: this prompts to confirm the staging, and with no TTY the prompt falls to its cancel branch. Run `pnpm josh git -y "<title> #<N>"`, or `pnpm josh git -y --skip-commit --skip-push` to open the PR for a push that already landed. It fires on every occurrence.';
+var ROW15 = {
+  id: "josh-git-bare",
+  is_trigger: bash_triggers.on_bash_command(is_bare_josh_git),
+  reason: JOSH_GIT_BARE_REASON,
+  decide: () => true,
+  about: {
+    title: "Bare `pnpm josh git`",
+    topic: '`operating-rules.md` \u2192 "git-rules"',
+    fires: "`pnpm josh git` without `-y`, whose staging prompt cancels with no TTY. Every occurrence",
+    quiet: "`pnpm josh git -y`"
+  }
+};
+var josh_git_bare = {
+  JOSH_GIT_BARE_REASON,
+  ROW: ROW15,
+  is_bare_josh_git
+};
+
+// scripts/rules/lane-carry-conflict.ts
+var MERGE_COMMAND = "run:merge";
+var HANDOFF_COMMAND = "run:handoff-lanes";
+var RUN_BUDGET_COMMANDS = /* @__PURE__ */ new Set([
+  MERGE_COMMAND,
+  "run:carry",
+  HANDOFF_COMMAND
+]);
+var LEADING_ASSIGNMENT = String.raw`[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\$\((?:[^()]|\([^()]*\))*\)|[^\s"'])*\s+`;
+var REDIRECTED_PREFIX = new RegExp(
+  String.raw`^(?:${LEADING_ASSIGNMENT})*${platform_temporary.TEMP_ROOT_KEY}=(?!""|''|\s|$|"?\$\{?[A-Za-z_])`,
+  "u"
+);
+var SHARED_STATE_COMMANDS = /* @__PURE__ */ new Set([MERGE_COMMAND, HANDOFF_COMMAND]);
+var LEADING_ASSIGNMENTS = new RegExp(`^(?:${LEADING_ASSIGNMENT})*`, "u");
+function is_budget_segment(segment) {
+  const commands = REDIRECTED_PREFIX.test(segment) ? SHARED_STATE_COMMANDS : RUN_BUDGET_COMMANDS;
+  return shell_segments.is_josh_command(segment.replace(LEADING_ASSIGNMENTS, ""), commands);
+}
+function invokes_budget_command(command) {
+  return shell_segments.segments_of(command).some((segment) => is_budget_segment(segment));
+}
+function is_carry_conflict(command, context) {
+  if (!invokes_budget_command(command)) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+var LANE_CARRY_CONFLICT_REASON = "\u26D4 lane child carry conflict: this session is a dispatched lane child, and `run:merge` / `run:carry` are the parent budget commands; the live record belongs to the parent, not to a competing run. Continue implementing this Issue: no `needs-decision`, no Telegram. Live `run:carry` evidence takes a fresh `JOSH_TEMP_ROOT`; `run:merge` is refused under any root, on every occurrence.";
+var ROW16 = {
+  id: "lane-carry-conflict",
+  is_trigger: bash_triggers.on_bash_command(is_carry_conflict),
+  reason: LANE_CARRY_CONFLICT_REASON,
+  decide: () => true,
+  about: {
+    title: "Lane child carry commands",
+    topic: "`.claude/skills/workflow-commands/backlogrun-lanes.md`",
+    fires: "a dispatched lane child running `pnpm josh run:merge` / `run:carry` / `run:handoff-lanes`. Every occurrence",
+    quiet: "not a lane child \u2014 the parent owns the run budget"
+  }
+};
+var lane_carry_conflict = {
+  LANE_CARRY_CONFLICT_REASON,
+  ROW: ROW16,
+  invokes_budget_command,
+  is_carry_conflict
+};
+
+// scripts/rules/lane-direct-tool.ts
+import os from "node:os";
+
+// scripts/rules/timed-rerun.ts
+var TIMED_SEGMENT = /^\s*(?:[A-Za-z_]\w*=\S*\s+)*(?:\S*\/)?(?:time|hyperfine)\s/u;
+function is_timed_run(command) {
+  return shell_segments.quote_aware_commands_of(command).some((segment) => TIMED_SEGMENT.test(segment));
+}
+var RECORD_READ = /\bgh\s+api\b.*\/actions\/runs\b|\bjosh\s+(?:lane:stats|lst)\b/u;
+function reads_the_record(command) {
+  return RECORD_READ.test(command);
+}
+function measures_duration(command) {
+  return reads_the_record(command) || is_timed_run(command);
+}
+var TIMED_RERUN_REASON = "\u26D4 timed re-run: a CI or gate duration is already on record \u2014 read the Actions jobs with `gh api \u2026/actions/runs/<run_id>/jobs` or the gate timings with `pnpm josh lane:stats`. Re-run only when the record cannot answer: reissue the same command once, and post the result on the Issue (`prompts/collaboration-workflow/measurement.md`).";
+var ROW17 = {
+  id: "timed-rerun",
+  is_trigger: bash_triggers.on_bash_command(is_timed_run),
+  reason: TIMED_RERUN_REASON,
+  keeps: bash_triggers.on_bash_command(reads_the_record),
+  reaches: bash_triggers.on_bash_command(measures_duration),
+  about: {
+    title: "Timed re-run",
+    topic: "`measurement.md`",
+    fires: "a command timed with `time` / `/usr/bin/time` / `hyperfine`",
+    quiet: "the duration is read from the Actions jobs or `pnpm josh lane:stats`"
+  }
+};
+var timed_rerun = {
+  ROW: ROW17,
+  TIMED_RERUN_REASON,
+  is_timed_run,
+  reads_the_record
+};
+
+// scripts/rules/lane-direct-tool.ts
+var ESLINT = "eslint";
+var VITEST = "vitest";
+var HEAVY_TOOLS = /* @__PURE__ */ new Set([ESLINT, VITEST, "cspell", "tsc"]);
+var TOOL_WEIGHTS = {
+  [ESLINT]: core_weights.CORE_WEIGHTS.lint,
+  tsc: core_weights.CORE_WEIGHTS.type_check,
+  cspell: core_weights.CORE_WEIGHTS.spell_check
+};
+var SINGLE_CORE = 1;
+var RESERVED_RUN = "pnpm josh reserved-run";
+var MULTI_COMMAND_SYNTAX = /[;|&<>()`#\n]|\$\(/u;
+var KEPT_REDIRECT = /2>&1/gu;
+var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u;
+var RESERVED_NOTE = "\u21BB lane direct tool: a lane child ran a heavy tool directly, so the line was wrapped in `pnpm josh reserved-run <weight> --` to claim its cores beside the other lanes. Prefer `pnpm josh lint:related` / `test:related` / `cspell:dot` \u2014 `docs/josh-commands-automation.md`.";
+function direct_calls(command) {
+  return command_memory.tool_calls_of(command).filter((call) => !call.is_reserved && HEAVY_TOOLS.has(call.name));
+}
+function runs_heavy_tool(command) {
+  return direct_calls(command).length > 0;
+}
+function weight_of(call, cores) {
+  if (call.name === VITEST) return command_memory.workers_of(call, cores);
+  return TOOL_WEIGHTS[call.name] ?? SINGLE_CORE;
+}
+function is_one_command(command) {
+  const judged = time_shell.blanked(command);
+  if (judged === void 0) return false;
+  return !MULTI_COMMAND_SYNTAX.test(judged.replaceAll(KEPT_REDIRECT, " ")) && !ENV_ASSIGNMENT.test(judged);
+}
+function can_wrap(line, cores) {
+  if (!is_one_command(line) || timed_rerun.is_timed_run(line)) return false;
+  return !command_memory.runs_multi_worker_eslint(line, cores);
+}
+function reserved_command(command, cores = os.availableParallelism()) {
+  const line = command.trim();
+  const calls = direct_calls(line);
+  if (!can_wrap(line, cores) || calls.length === 0) return void 0;
+  const weight = Math.max(...calls.map((call) => weight_of(call, cores)));
+  return `${RESERVED_RUN} ${String(weight)} -- ${line}`;
+}
+function is_lane_bash(call, context) {
+  if (call.name !== cost_blocks.BASH_TOOL) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+function reserved_input(call, _tail, context) {
+  if (!is_lane_bash(call, context) || !json_value.is_record(call.input)) return void 0;
+  const command = reserved_command(time_shell.bash_command(call.input));
+  return command === void 0 ? void 0 : { ...call.input, command };
+}
+function is_lane_direct_tool(command, is_lane_child) {
+  if (!is_lane_child) return false;
+  return runs_heavy_tool(command) || command_memory.runs_multi_worker_eslint(command);
+}
+function is_lane_direct_tool_in(command, context) {
+  return is_lane_direct_tool(command, lane_child_marker.is_child_of(context.cwd, context.env));
+}
+var LANE_DIRECT_TOOL_REASON = "\u26D4 lane child running `eslint` / `vitest` / `cspell` / `tsc` directly, or multi-worker eslint: it overlaps the other lanes. Run `pnpm josh lint:related`, `pnpm josh test:related`, `pnpm josh cspell:dot` or `pnpm josh reserved-run <weight> -- <command>`, eslint at `--concurrency off`. Only a one-command line is wrapped for you. Refused on every occurrence.";
+var ROW18 = {
+  id: "lane-direct-tool",
+  is_trigger: bash_triggers.on_bash_command(is_lane_direct_tool_in),
+  reason: LANE_DIRECT_TOOL_REASON,
+  decide: () => true,
+  rewrite: reserved_input,
+  rewrite_note: RESERVED_NOTE,
+  about: {
+    title: "Lane child running a heavy tool directly",
+    topic: "`docs/josh-commands-automation.md` \u2192 `josh reserved-run`",
+    fires: "a dispatched lane child launching `eslint` / `vitest` / `cspell` / `tsc` (bare, `pnpm exec`, `npx`, inside `sh -c`), or eslint with `--concurrency` other than `off` / `1` by any path, `reserved-run` included. A one-command line is rewritten behind `pnpm josh reserved-run <weight> --` at the gate's weight; a chained, piped, redirected or env-prefixed line and a multi-worker eslint are refused, every occurrence",
+    quiet: "not a lane child, or the run goes through `pnpm josh` with single-worker eslint"
+  }
+};
+var lane_direct_tool = {
+  LANE_DIRECT_TOOL_REASON,
+  RESERVED_NOTE,
+  ROW: ROW18,
+  is_lane_direct_tool,
+  reserved_command,
+  reserved_input,
+  runs_heavy_tool
+};
+
+// scripts/rules/lane-interactive-ask.ts
+function is_interactive_ask(call, context) {
+  if (!interactive_ask.is_interactive_tool(call.name)) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+var LANE_INTERACTIVE_ASK_REASON = "\u26D4 lane child interactive ask: this session is a dispatched lane child and cannot ask a person, so park instead: `pnpm josh run:park <N> --body-file <path>` (it applies `needs-decision`), the `confirmation` Telegram, stop. It fires on every occurrence (`.claude/skills/workflow-commands/pre-gate-cut.md`, `backlogrun-park.md`).";
+var ROW19 = {
+  id: "lane-interactive-ask",
+  is_trigger: is_interactive_ask,
+  reason: LANE_INTERACTIVE_ASK_REASON,
+  decide: () => true,
+  // A reply asking a person for the git index is the same ask, delivered by the Stop hook.
+  stop_reasons: [stop_rules.LANE_INDEX_REASON],
+  about: {
+    title: "Lane child interactive ask",
+    topic: '`.claude/skills/workflow-commands/pre-gate-cut.md` \u2192 "The interactive ask is refused one call earlier"',
+    fires: "a dispatched lane child's `AskUserQuestion`; it hands over the park procedure; the Stop hook also blocks a reply asking a person for the git index. Every occurrence",
+    quiet: "not a lane child, or not an interactive tool"
+  }
+};
+var lane_interactive_ask = { LANE_INTERACTIVE_ASK_REASON, ROW: ROW19, is_interactive_ask };
+
+// scripts/rules/lane-spilled-read.ts
+var SPILLED_RESULT = /\/tool-results\/[^/]+\.txt$/u;
+function read_input(call) {
+  if (call.name !== "Read" || !json_value.is_record(call.input)) return void 0;
+  return call.input;
+}
+function reads_spilled_result(input) {
+  const { file_path } = input;
+  return typeof file_path === "string" && SPILLED_RESULT.test(file_path);
+}
+function is_paginated(input) {
+  return input["offset"] !== void 0 || input["limit"] !== void 0;
+}
+function reaches_spilled_result(call) {
+  const input = read_input(call);
+  return input !== void 0 && reads_spilled_result(input);
+}
+function keeps_narrowed_read(call) {
+  const input = read_input(call);
+  return input !== void 0 && reads_spilled_result(input) && is_paginated(input);
+}
+function is_whole_spilled_read(call, context) {
+  if (!reaches_spilled_result(call) || keeps_narrowed_read(call)) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+var LANE_SPILLED_READ_REASON = "\u26D4 lane child reading a spilled Bash result whole: `tool-results/<id>.txt` is the output that overflowed the cap, and reading it back whole fills the context the cut is measured on. Read only the lines you need: `grep -n <pattern> <path>` or `sed -n <from>,<to>p <path>`. Refused on every occurrence.";
+var ROW20 = {
+  id: "lane-spilled-read",
+  is_trigger: is_whole_spilled_read,
+  reason: LANE_SPILLED_READ_REASON,
+  decide: () => true,
+  keeps: keeps_narrowed_read,
+  reaches: reaches_spilled_result,
+  about: {
+    title: "Lane child reading a spilled Bash result whole",
+    topic: "`prompts/collaboration-workflow/output-bounds.md`",
+    fires: "a dispatched lane child's `Read` of a `tool-results/<id>.txt` file with no `offset` or `limit`. Every occurrence",
+    quiet: "not a lane child, another file, or a paginated `Read`"
+  }
+};
+var lane_spilled_read = {
+  LANE_SPILLED_READ_REASON,
+  ROW: ROW20,
+  is_whole_spilled_read,
+  keeps_narrowed_read,
+  reaches_spilled_result
+};
+
+// scripts/rules/lane-split-park.ts
+var EPIC_COMMANDS = /* @__PURE__ */ new Set(["epic"]);
+var PROMOTED_ISSUE = /--promote[=\s]+["']?(?<issue>\d+)\b/u;
+var LABEL_TARGETS = [
+  /\/issues\/(?<issue>\d+)\/labels\b/u,
+  /\bissue\s+edit\s+["']?(?<issue>\d+)\b/u,
+  /\brun:park\s+["']?(?<issue>\d+)\b/u
+];
+var ISSUE_URL2 = /--issue-url[=\s]+["']?([^\s"']+)/u;
+var URL_ISSUE = /\/issues\/(\d+)\b/u;
+function promoted_in(segment) {
+  if (!shell_segments.is_josh_command(segment, EPIC_COMMANDS)) return void 0;
+  return PROMOTED_ISSUE.exec(segment)?.groups?.["issue"];
+}
+function promoted_issues(commands) {
+  const segments = commands.flatMap((command) => shell_segments.segments_of(command));
+  const issues = segments.map((segment) => promoted_in(segment));
+  return new Set(issues.filter((issue) => issue !== void 0));
+}
+function label_target(command) {
+  for (const pattern of LABEL_TARGETS) {
+    const issue = pattern.exec(command)?.groups?.["issue"];
+    if (issue !== void 0) return issue;
+  }
+  return void 0;
+}
+function is_park_of(command, issue) {
+  return lane_park.records_the_park(command) && label_target(command) === issue;
+}
+function notified_issue(command) {
+  const [, url = ""] = ISSUE_URL2.exec(command) ?? [];
+  const [, issue] = URL_ISSUE.exec(url) ?? [];
+  return issue;
+}
+function is_notify_of(command, issue) {
+  return lane_park.is_confirmation_notify(command) && notified_issue(command) === issue;
+}
+function is_candidate3(command, context) {
+  const issue = lane_child_marker.marked_issue(context.env);
+  if (issue === void 0) return false;
+  if (!is_park_of(command, issue) && !is_notify_of(command, issue)) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+function decide2(_call, run) {
+  const issue = lane_child_marker.marked_issue(run.context.env);
+  const commands = tail_commands.prior_bash_commands(transcript_tail.read_tail(run.transcript));
+  return issue !== void 0 && promoted_issues(commands).has(issue);
+}
+var LANE_SPLIT_PARK_REASON = '\u26D4 lane split park: this session is a dispatched lane child that promoted its own Issue to an epic this run, and a split is not a park: no `needs-decision` on the epic, no `confirmation` Telegram, on every occurrence. Park a child issue if the rest needs a person, else end the turn (`.claude/skills/workflow-commands/backlogrun-park.md` \u2192 "Splitting a child mid-run").';
+var ROW21 = {
+  id: "lane-split-park",
+  is_trigger: bash_triggers.on_bash_command(is_candidate3),
+  reason: LANE_SPLIT_PARK_REASON,
+  decide: decide2,
+  about: {
+    title: "A split is not a park",
+    topic: '`.claude/skills/workflow-commands/backlogrun-park.md` \u2192 "Splitting a child mid-run"',
+    fires: "a lane child that promoted its Issue to an epic this run parking it (`needs-decision`, `confirmation` notify). Every occurrence",
+    quiet: "no promotion this run"
+  }
+};
+var lane_split_park = {
+  LANE_SPLIT_PARK_REASON,
+  ROW: ROW21,
+  promoted_issues
+};
+
+// scripts/rules/lane-switch-main.ts
+var SWITCH_SUBCOMMAND = "switch";
+var NON_COLLIDING_FLAGS = /* @__PURE__ */ new Set([
+  "-c",
+  "-C",
+  "--create",
+  "--force-create",
+  "-d",
+  "--detach"
+]);
+var FLAG_PREFIX3 = "-";
+function switch_target(segment) {
+  const call = git_argv.parse(segment);
+  if (call?.subcommand !== SWITCH_SUBCOMMAND || call.args.some((argument) => NON_COLLIDING_FLAGS.has(argument))) {
+    return void 0;
+  }
+  return call.args.find((argument) => !argument.startsWith(FLAG_PREFIX3));
+}
+function switch_targets(command) {
+  return shell_segments.segments_of(command).map((segment) => switch_target(segment)).filter((target) => target !== void 0);
+}
+function own_lane_branch(directory) {
+  const issue = lane_paths.lane_issue_of(directory);
+  return issue === void 0 ? void 0 : lane_paths.lane_branch(issue);
+}
+function is_switch_away_from_lane(command, is_lane_child, own_branch) {
+  if (!is_lane_child || own_branch === void 0) return false;
+  return switch_targets(command).some((target) => target !== own_branch);
+}
+function is_switch_away_in(command, context) {
+  const is_lane_child = lane_child_marker.is_child_of(context.cwd, context.env);
+  return is_switch_away_from_lane(command, is_lane_child, own_lane_branch(context.cwd));
+}
+var LANE_SWITCH_MAIN_REASON = "\u26D4 lane child on `git switch main`: this session is a dispatched lane child, and switching to the default branch here always fails (`already used by worktree`: the primary checkout holds it). Skip this step and keep implementing on the current branch; `pnpm josh ship`'s sync brings the default in before its gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).";
+var ROW22 = {
+  id: "lane-switch-main",
+  is_trigger: bash_triggers.on_bash_command(is_switch_away_in),
+  reason: LANE_SWITCH_MAIN_REASON,
+  decide: () => true,
+  about: {
+    title: "Lane child on `git switch main`",
+    topic: "`.claude/skills/workflow-commands/backlogrun-lanes.md`",
+    fires: "a dispatched lane child switching to the default branch or running `josh main:sync`. Every occurrence",
+    quiet: "not a lane child \u2014 `pnpm josh main:merge` brings the default in at the gate"
+  }
+};
+var lane_switch_main = {
+  LANE_SWITCH_MAIN_REASON,
+  ROW: ROW22,
+  is_switch_away_from_lane,
+  switch_target,
+  switch_targets
+};
+
+// scripts/rules/oracle-consulted.ts
+function command_names(oracle) {
+  return /* @__PURE__ */ new Set([decision_oracle.get_command(oracle)]);
+}
+function runs_the_oracle(command, names) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names));
+}
+function command_line(oracle) {
+  const command = decision_oracle.get_command(oracle);
+  return oracle.args ? `pnpm josh ${command} ${oracle.args}` : `pnpm josh ${command}`;
+}
+function reason_for(oracle, firing_point) {
+  return `\u26D4 decision oracle not consulted: this is ${firing_point.describes}. Run \`${command_line(oracle)}\` first \u2014 it decides ${oracle.decision.toLowerCase()} and answers ${oracle.vocabulary.join(" | ")} (${oracle.single_source}). Every such call is refused until that command is on the transcript.`;
+}
+var ABOUT = {
+  title: "An act its oracle was not asked about",
+  topic: "`decision-oracle.ts`",
+  fires: "a `Bash` governed by an oracle that declared a firing point (`pkg:scout` governs `pnpm add`), issued without that `pnpm josh <command>`. Refused until it ran",
+  quiet: "no governed act, or the oracle already ran"
+};
+function row_for(oracle, firing_point) {
+  const names = command_names(oracle);
+  return {
+    id: `oracle-consulted:${oracle.name}`,
+    is_trigger: bash_triggers.on_bash_command(firing_point.governs),
+    reason: reason_for(oracle, firing_point),
+    already_satisfied: (tail, _call) => tail_commands.prior_bash_commands(tail).some((command) => runs_the_oracle(command, names)),
+    keeps: bash_triggers.on_bash_command((command) => runs_the_oracle(command, names)),
+    about: ABOUT
+  };
+}
+var ROWS = oracle_firing.firing_oracles().map(({ oracle, firing_point }) => row_for(oracle, firing_point));
+var oracle_consulted = { ROWS, reason_for };
+
+// scripts/rules/destructive-command.ts
+var RM_COMMAND = "rm";
+var RECURSIVE_LONG = "--recursive";
+var RECURSIVE_LETTERS2 = "rR";
+var FORCE_LONG = "--force";
+var FORCE_LETTER = "f";
+function has_flag(args, long, letters) {
+  return args.some((argument) => argument === long || git_argv.short_cluster_has(argument, letters));
+}
+function is_recursive_forced_rm(segment) {
+  const args = git_argv.arguments_of(segment, RM_COMMAND);
+  if (args === void 0) return false;
+  return has_flag(args, RECURSIVE_LONG, RECURSIVE_LETTERS2) && has_flag(args, FORCE_LONG, FORCE_LETTER);
+}
+var GH_COMMAND = "gh";
+var REPO_GROUP = "repo";
+var REPO_REMOVALS = /* @__PURE__ */ new Set(["delete", "archive"]);
+var PR_GROUP = "pr";
+var PR_CLOSE = "close";
+function is_destructive_gh_command(args) {
+  const [group, action = ""] = args;
+  if (group === PR_GROUP) return action === PR_CLOSE;
+  return group === REPO_GROUP && REPO_REMOVALS.has(action);
+}
+var DELETE_METHOD = "DELETE";
+var REPOSITORY_PATH = "repos/";
+var ISSUE_LABEL_PATH = /^['"]?\/?repos\/[^/\s'"]+\/[^/\s'"]+\/issues\/\d+\/labels\/[^/\s'"]+['"]?$/u;
+function is_destructive_api_call(args) {
+  const call = [GH_COMMAND, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || gh_api.method_of(call) !== DELETE_METHOD) return false;
+  return args.some(
+    (argument) => argument.includes(REPOSITORY_PATH) && !ISSUE_LABEL_PATH.test(argument)
+  );
+}
+function is_destructive_gh(segment) {
+  const args = git_argv.arguments_of(segment, GH_COMMAND);
+  if (args === void 0) return false;
+  return is_destructive_gh_command(args) || is_destructive_api_call(args);
+}
+function is_destructive_segment2(segment) {
+  return is_recursive_forced_rm(segment) || is_destructive_gh(segment);
+}
+function is_destructive_command(command) {
+  return shell_segments.commands_of(command).some((segment) => is_destructive_segment2(segment));
+}
+var DESTRUCTIVE_COMMAND_REASON = "\u26D4 destructive command: a recursive forced `rm`, a `gh repo delete` / `archive`, `gh pr close` or a `gh api -X DELETE` cannot be undone, which is Tier C. Remove one path at a time without `-f`, or ask the user to run it. A blocked-by removal: `pnpm josh backlog:triage --apply <N> --unblock <M> --reason <text>`. It fires on every occurrence (`prompts/collaboration-workflow/operating-rules.md`).";
+var ROW23 = {
+  id: "destructive-command",
+  is_trigger: bash_triggers.on_bash_command(is_destructive_command),
+  reason: DESTRUCTIVE_COMMAND_REASON,
+  decide: () => true,
+  // The opening the reason carried before it was cut to the action and the next command.
+  former_reasons: ["\u26D4 destructive command: a recursive forced `rm` (`rm -rf`"],
+  about: {
+    title: "Destructive command",
+    topic: "`operating-rules.md`",
+    fires: "`rm -rf` (any spelling), `gh repo delete` / `archive`, `gh pr close`, `gh api -X DELETE`. Every occurrence",
+    quiet: "`gh issue close` or removing an Issue label \u2014 the workflow's own steps"
+  }
+};
+var destructive_command = { DESTRUCTIVE_COMMAND_REASON, ROW: ROW23, is_destructive_command };
+
+// scripts/rules/keychain-read.ts
+var SECURITY_COMMAND = "security";
+var FLAG_PREFIX4 = "-";
+var PROMPT_FLAG = "p";
+var STEP = 1;
+var VALUE_STEP = 2;
+var INTERACTIVE_FLAG = "i";
+var SECRET_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "dump-keychain",
+  "export",
+  "export-identities",
+  "find-generic-password",
+  "find-internet-password"
+]);
+function cluster_of(word) {
+  const letters = word.slice(FLAG_PREFIX4.length);
+  const prompt_at = letters.indexOf(PROMPT_FLAG);
+  if (prompt_at === -1) return { flags: letters, step: STEP };
+  const step = prompt_at === letters.length - 1 ? VALUE_STEP : STEP;
+  return { flags: letters.slice(0, prompt_at), step };
+}
+function global_options(args) {
+  const [word = ""] = args;
+  if (!word.startsWith(FLAG_PREFIX4)) return { is_interactive: false, subcommand: 0 };
+  const { flags, step } = cluster_of(word);
+  const rest = global_options(args.slice(step));
+  return {
+    is_interactive: flags.includes(INTERACTIVE_FLAG) || rest.is_interactive,
+    subcommand: step + rest.subcommand
+  };
+}
+function is_keychain_read(_segment, call) {
+  if (call.name !== SECURITY_COMMAND) return false;
+  const { is_interactive, subcommand } = global_options(call.args);
+  return is_interactive || SECRET_SUBCOMMANDS.has(call.args[subcommand] ?? "");
+}
+var keychain_read = { is_keychain_read };
+
+// scripts/rules/launched-call.ts
+var FLAG_PREFIX5 = "-";
+var NEXT = 1;
+var BEFORE_PROGRAM = 2;
+var ENV_VALUE_FLAGS = /* @__PURE__ */ new Set(["-u", "--unset", "-C", "--chdir"]);
+var NAME_NOISE = /["'\\]/gu;
+var LOOKUP_WRAPPER = "command";
+var LOOKUP_FLAGS = /* @__PURE__ */ new Set(["-v", "-V"]);
+function launcher(value_flags, operands = 0) {
+  return { value_flags: new Set(value_flags), operands };
+}
+var LAUNCHERS = /* @__PURE__ */ new Map([
+  ["busybox", launcher([])],
+  ["nice", launcher(["-n", "--adjustment"])],
+  ["nohup", launcher([])],
+  ["stdbuf", launcher(["-i", "-o", "-e", "--input", "--output", "--error"])],
+  ["timeout", launcher(["-s", "--signal", "-k", "--kill-after"], 1)],
+  ["xcrun", launcher(["--sdk", "-sdk", "--toolchain", "-toolchain"])],
+  [
+    "xargs",
+    launcher(["-a", "--arg-file", "-d", "--delimiter", "-E", "-I", "-L", "-n", "-P", "-s"])
+  ]
+]);
+function plain_name(word) {
+  return word.replaceAll(NAME_NOISE, "").split("/").at(-1) ?? "";
+}
+function is_environment_operand(words, index) {
+  const word = words[index] ?? "";
+  return !word.startsWith(FLAG_PREFIX5) && !word.includes("=") && !ENV_VALUE_FLAGS.has(words[index - NEXT] ?? "");
+}
+function past_environment_flags(words) {
+  const index = words.findIndex((_word, position) => is_environment_operand(words, position));
+  return index === -1 ? [] : words.slice(index);
+}
+function is_launcher_operand(args, index, value_flags) {
+  return !(args[index] ?? "").startsWith(FLAG_PREFIX5) && !value_flags.has(args[index - NEXT] ?? "");
+}
+function launched_index(args, spec) {
+  const operands = args.map((_word, index) => index).filter((index) => is_launcher_operand(args, index, spec.value_flags));
+  return operands[spec.operands] ?? -1;
+}
+function past_launcher(call) {
+  const spec = LAUNCHERS.get(call.name);
+  if (spec === void 0) return void 0;
+  const index = launched_index(call.args, spec);
+  return index === -1 ? void 0 : call.args.slice(index);
+}
+function inner_words_of(call) {
+  if (call === void 0) return void 0;
+  if (call.name.startsWith(FLAG_PREFIX5)) return past_environment_flags([call.name, ...call.args]);
+  return past_launcher(call);
+}
+function word_before(segment, call) {
+  const words = git_argv.words_of(segment);
+  return words[words.length - call.args.length - BEFORE_PROGRAM] ?? "";
+}
+function call_of2(segment) {
+  const call = git_argv.program_of(segment);
+  if (call === void 0) return void 0;
+  const is_lookup = LOOKUP_FLAGS.has(call.name) && plain_name(word_before(segment, call)) === LOOKUP_WRAPPER;
+  return { name: is_lookup ? LOOKUP_WRAPPER : plain_name(call.name), args: call.args };
+}
+function resolved_call(segment) {
+  let call = call_of2(segment);
+  let inner = inner_words_of(call);
+  while (inner !== void 0) {
+    call = call_of2(inner.join(" "));
+    inner = inner_words_of(call);
+  }
+  return call;
+}
+var launched_call = { plain_name, resolved_call };
+
+// scripts/rules/nested-commands.ts
+var { SHELLS } = interpreter_options;
+var EVAL = "eval";
+var SUBSTITUTION = /[$<>]\((?<paren>[^()]*)\)|`(?<backtick>[^`]*)`/gu;
+var OUTER_QUOTES = /^["']|["']$/gu;
+var NEXT2 = 1;
+function is_shell(segment) {
+  const program = git_argv.program_of(segment)?.name;
+  return program !== void 0 && SHELLS.has(program);
+}
+function quoted_script_of(args, name) {
+  if (name === EVAL) return args.join(" ");
+  const flag_index = interpreter_options.shell_script_index({ name, args: [...args] });
+  return flag_index === -1 ? "" : args[flag_index + NEXT2] ?? "";
+}
+function script_of(segment) {
+  const call = git_argv.program_of(segment);
+  if (call === void 0) return "";
+  return quoted_script_of(call.args, call.name).replaceAll(OUTER_QUOTES, "");
+}
+function bodies_of(segment) {
+  const substituted = [...segment.matchAll(SUBSTITUTION)].map(
+    (match) => match.groups?.["paren"] ?? match.groups?.["backtick"] ?? ""
+  );
+  const script = is_shell(segment) ? [script_of(segment)] : [];
+  return [...script, ...substituted].filter((body) => body !== "");
+}
+function commands_of(command) {
+  const found = [];
+  let pending = [command];
+  while (pending.length > 0) {
+    const segments = pending.flatMap((line) => shell_segments.quote_aware_commands_of(line));
+    found.push(...segments);
+    pending = segments.flatMap((segment) => bodies_of(segment));
+  }
+  return found;
+}
+var nested_commands = { SHELLS, commands_of };
+
+// scripts/rules/gh-repo-selector.ts
+var GH_COMMAND2 = "gh";
+var API_GROUP = "api";
+var SELECTOR_FLAGS = /* @__PURE__ */ new Set(["-R", "--repo"]);
+var ATTACHED_SELECTOR = /^(?:-R=?|--repo=)(.+)$/u;
+var QUOTES3 = /['"]/gu;
+var NEXT3 = 1;
+var READ_GROUPS = /* @__PURE__ */ new Set(["browse", "search", "status"]);
+var READ_ACTIONS = /* @__PURE__ */ new Set([
+  "check",
+  "checkout",
+  "checks",
+  "clone",
+  "diff",
+  "download",
+  "get",
+  "list",
+  "status",
+  "verify",
+  "verify-asset",
+  "view",
+  "watch"
+]);
+var GH_REPO_ASSIGNMENT = /(?:^|\s)GH_REPO=(\S+)/gu;
+var SELECTOR_GROUP = 1;
+function selector_value(word, next) {
+  if (SELECTOR_FLAGS.has(word)) return next;
+  return ATTACHED_SELECTOR.exec(word)?.[1];
+}
+function selectors_of(args) {
+  return args.map((word, index) => selector_value(word, args[index + NEXT3])).filter((value) => value !== void 0).map((value) => value.replaceAll(QUOTES3, ""));
+}
+function is_write_call(args) {
+  const [group = "", action = ""] = direct_pr_create.positional_words(args, SELECTOR_FLAGS);
+  if (group === API_GROUP || READ_GROUPS.has(group)) return false;
+  return !READ_ACTIONS.has(action);
+}
+function assigned_selectors(segments) {
+  return segments.flatMap((segment) => [...segment.matchAll(GH_REPO_ASSIGNMENT)]).map((match) => (match[SELECTOR_GROUP] ?? "").replaceAll(QUOTES3, ""));
+}
+function write_selectors(segments, index) {
+  const args = git_argv.arguments_of(segments[index] ?? "", GH_COMMAND2);
+  if (args === void 0 || !is_write_call(args)) return [];
+  return [...selectors_of(args), ...assigned_selectors(segments.slice(0, index + NEXT3))];
+}
+var gh_repo_selector = { is_write_call, write_selectors };
+
+// scripts/rules/pr-merge.ts
+var GH_COMMAND3 = "gh";
+var CURL_COMMAND = "curl";
+var PR_GROUP2 = "pr";
+var MERGE_ACTION = "merge";
+var API_SUBCOMMAND3 = "api";
+var GRAPHQL_ENDPOINT = "graphql";
+var MERGE_PATH = /pulls\/[^/\s'"]+\/merge(?![\w-])/u;
+var MERGE_MUTATIONS = /\b(?:mergePullRequest|enablePullRequestAutoMerge)\b/u;
+var GRAPHQL_URL = /\/graphql\b/u;
+var FILE_BODY_VALUE = /^(?:-[A-Za-z]|[^=\s]*=)?['"]?@/u;
+var FILE_BODY_FLAGS = /* @__PURE__ */ new Set(["--input", "-T", "--upload-file"]);
+var SUBSTITUTED_BODY = /\$\(|`/u;
+function positional_words(args) {
+  return direct_pr_create.positional_words(args, direct_pr_create.API_VALUE_TAKING_FLAGS);
+}
+function is_pr_merge_cli_call(args) {
+  const [group, action] = positional_words(args);
+  return group === PR_GROUP2 && action === MERGE_ACTION;
+}
+function is_github_api_call(name, args) {
+  if (name === CURL_COMMAND) return true;
+  return name === GH_COMMAND3 && positional_words(args)[0] === API_SUBCOMMAND3;
+}
+function is_graphql_call(name, args) {
+  if (args.some((argument) => GRAPHQL_URL.test(argument))) return true;
+  return name === GH_COMMAND3 && positional_words(args)[1] === GRAPHQL_ENDPOINT;
+}
+function is_unreadable_body(argument) {
+  if (FILE_BODY_FLAGS.has(argument)) return true;
+  return FILE_BODY_VALUE.test(argument) || SUBSTITUTED_BODY.test(argument);
+}
+function is_graphql_merge(command, name, args) {
+  if (!is_graphql_call(name, args)) return false;
+  return MERGE_MUTATIONS.test(command) || args.some((argument) => is_unreadable_body(argument));
+}
+function is_api_merge(command, segment, call) {
+  if (MERGE_PATH.test(segment) || MERGE_MUTATIONS.test(segment)) return true;
+  return is_graphql_merge(command, call.name, call.args);
+}
+function is_pr_merge_segment(command, segment) {
+  const call = git_argv.program_of(segment);
+  if (call === void 0) return false;
+  if (call.name === GH_COMMAND3 && is_pr_merge_cli_call(call.args)) return true;
+  return is_github_api_call(call.name, call.args) && is_api_merge(command, segment, call);
+}
+function is_pr_merge(command) {
+  return shell_segments.commands_of(command).some((segment) => is_pr_merge_segment(command, segment));
+}
+var PR_MERGE_REASON = "\u26D4 direct PR merge: `gh pr merge`, a `gh api` / `curl` call to `\u2026/pulls/<N>/merge`, a `mergePullRequest` / `enablePullRequestAutoMerge` mutation, or a GraphQL body read from a file merges outside the verified route, and a merge is Tier C. Merge with `pnpm josh followup` if the run authorizes it; otherwise leave it to the user (`operating-rules.md` \u2192 git-rules). This rule fires on every occurrence.";
+var ROW24 = {
+  id: "pr-merge",
+  is_trigger: bash_triggers.on_bash_command(is_pr_merge),
+  reason: PR_MERGE_REASON,
+  decide: () => true,
+  about: {
+    title: "Direct PR merge",
+    topic: '`operating-rules.md` \u2192 "git-rules"',
+    fires: "`gh pr merge`, a `gh api` / `curl` call to `\u2026/pulls/<N>/merge`, a `mergePullRequest` / `enablePullRequestAutoMerge` mutation, or a GraphQL body read from a file. Every occurrence",
+    quiet: "`pnpm josh followup` and `pnpm josh observations:flush`, which merge in their own process"
+  }
+};
+var pr_merge = { PR_MERGE_REASON, ROW: ROW24, is_graphql_call, is_pr_merge };
+
+// scripts/rules/repo-admin.ts
+var GH_COMMAND4 = "gh";
+var DELETE_METHOD2 = "DELETE";
+var PATCH_METHOD = "PATCH";
+var REPOSITORY_PREFIX = String.raw`^['"]?(?:https?:\/\/[^/\s'"]+)?\/?repos\/[^/\s'"]+\/[^/\s'"]+`;
+var ADMIN_PATH = new RegExp(
+  REPOSITORY_PREFIX + String.raw`\/(?:rulesets|branches\/[^\s'"]+\/protection|collaborators|invitations|hooks|keys|` + String.raw`transfer|actions\/permissions|environments|` + String.raw`(?:actions|dependabot|codespaces)\/(?:secrets|variables))(?:[/?'"]|$)`,
+  "u"
+);
+var REPOSITORY_BODY = new RegExp(String.raw`${REPOSITORY_PREFIX}\/?['"]?$`, "u");
+var ADMIN_MUTATIONS = /\b(?:updateRepository|archiveRepository|(?:create|update|delete)(?:BranchProtectionRule|RepositoryRuleset|Environment))\b/u;
+function is_admin_target(argument, method) {
+  return ADMIN_PATH.test(argument) || method === PATCH_METHOD && REPOSITORY_BODY.test(argument);
+}
+function is_admin_graphql_call(command, args) {
+  return pr_merge.is_graphql_call(GH_COMMAND4, args) && ADMIN_MUTATIONS.test(command);
+}
+function is_admin_api_call(command, args) {
+  const call = [GH_COMMAND4, ...args].join(" ");
+  if (!gh_api.is_gh_api(call) || !gh_api.is_write(call)) return false;
+  if (is_admin_graphql_call(command, args)) return true;
+  const method = gh_api.method_of(call);
+  if (method === DELETE_METHOD2) return false;
+  return args.some((argument) => is_admin_target(argument, method));
+}
+var READ_ACTIONS2 = /* @__PURE__ */ new Set(["list", "ls", "get", "view"]);
+var ACTION_POSITION = 1;
+var SUB_ACTION_POSITION = 2;
+var VERB_POSITIONS = /* @__PURE__ */ new Map([
+  ["secret", ACTION_POSITION],
+  ["variable", ACTION_POSITION],
+  ["repo edit", ACTION_POSITION],
+  ["repo deploy-key", SUB_ACTION_POSITION]
+]);
+function admin_verb(args) {
+  const words = direct_pr_create.positional_words(args, direct_pr_create.API_VALUE_TAKING_FLAGS);
+  const position = VERB_POSITIONS.get(words[0] ?? "") ?? VERB_POSITIONS.get(words.slice(0, SUB_ACTION_POSITION).join(" "));
+  if (position === void 0) return void 0;
+  return words[position] ?? "";
+}
+function is_admin_cli_call(args) {
+  const verb = admin_verb(args);
+  return verb !== void 0 && !READ_ACTIONS2.has(verb);
+}
+function is_admin_segment(command, segment) {
+  const args = git_argv.arguments_of(segment, GH_COMMAND4);
+  if (args === void 0) return false;
+  return is_admin_cli_call(args) || is_admin_api_call(command, args);
+}
+function is_repo_admin_write(command) {
+  return shell_segments.commands_of(command).some((segment) => is_admin_segment(command, segment));
+}
+var REPO_ADMIN_REASON = "\u26D4 repository administration: a write to the rulesets, branch protection, collaborators, invitations, secrets, variables, webhooks, deploy keys or repository settings moves the boundary an unattended run relies on, which is Tier C. Ask the user to run it. It fires on every occurrence (`prompts/collaboration-workflow/operating-rules.md`).";
+var ROW25 = {
+  id: "repo-admin",
+  is_trigger: bash_triggers.on_bash_command(is_repo_admin_write),
+  reason: REPO_ADMIN_REASON,
+  decide: () => true,
+  about: {
+    title: "Repository administration",
+    topic: "`operating-rules.md`",
+    fires: "a `gh api` POST / PUT / PATCH (path or URL) to the rulesets, branch protection, collaborators, invitations, secrets, variables, hooks, keys, environments, actions permissions or transfer, a `PATCH` of the repository, the matching GraphQL mutations, `gh secret` / `gh variable` writes, `gh repo edit` / `deploy-key` writes. Every occurrence",
+    quiet: "`gh secret list`, `gh variable get`, a `gh api` read \u2014 a `DELETE` is `destructive-command`"
+  }
+};
+var repo_admin = { REPO_ADMIN_REASON, ROW: ROW25, is_repo_admin_write };
+
+// scripts/rules/third-party-write.ts
+function is_third_party_write_segment(segment, session_owner, resolve_placeholder_owners) {
+  if (!gh_api.is_gh_api(segment) || !gh_api.is_write(segment)) return false;
+  const target = gh_api.repo_target(segment);
+  if (target === void 0) return false;
+  if (!gh_api.is_owner_placeholder(target.owner)) {
+    return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+  }
+  return resolve_placeholder_owners().some(
+    (owner) => owner === void 0 || repo_party.classify(session_owner, owner) === repo_party.THIRD_PARTY
+  );
+}
+var GH_CONTEXT_CHANGE = /(?:^|\s)(?:cd|pushd)(?:\s|$)|(?:^|\s)(?:export\s+)?GH_REPO=/u;
+function unreadable_candidates() {
+  return [void 0];
+}
+function candidates_at(segments, index, resolve_placeholder_owners) {
+  const has_moved = segments.slice(0, index).some((segment) => GH_CONTEXT_CHANGE.test(segment));
+  return has_moved ? unreadable_candidates : resolve_placeholder_owners;
+}
+function is_claimed_by_narrower_row(command) {
+  return pr_merge.is_pr_merge(command) || repo_admin.is_repo_admin_write(command);
+}
+var GRAPHQL_MUTATION = /\bmutation\b/u;
+var EXPANDED_QUERY = /^(?:-[fF])?"?query=(?!')[\s\S]*\$/u;
+function is_hidden_or_mutation(command, args) {
+  return GRAPHQL_MUTATION.test(command) || args.some((argument) => EXPANDED_QUERY.test(argument));
+}
+function graphql_args(segment) {
+  const call = git_argv.program_of(segment);
+  if (call === void 0 || !gh_api.is_gh_api(segment)) return void 0;
+  return pr_merge.is_graphql_call(call.name, call.args) ? call.args : void 0;
+}
+function is_graphql_mutation(command, segment) {
+  const args = graphql_args(segment);
+  if (args === void 0) return false;
+  return is_hidden_or_mutation(command, args) && !is_claimed_by_narrower_row(command);
+}
+function is_third_party_selector_write(command, segments, index, session_owner) {
+  const selectors = gh_repo_selector.write_selectors(segments, index);
+  const is_third_party = selectors.some((selector) => {
+    const owner = repo_party.selector_owner(selector);
+    return owner === void 0 || repo_party.classify(session_owner, owner) === repo_party.THIRD_PARTY;
+  });
+  return is_third_party && !is_claimed_by_narrower_row(command);
+}
+function is_owner_dependent_write(segments, index) {
+  const segment = segments[index] ?? "";
+  if (gh_api.is_gh_api(segment)) return gh_api.is_write(segment);
+  return gh_repo_selector.write_selectors(segments, index).length > 0;
+}
+function writes_to_third_party_owner(command, segments, resolve_owner, resolve_placeholder_owners) {
+  if (segments.every((_segment, index) => !is_owner_dependent_write(segments, index))) return false;
+  const session_owner = resolve_owner();
+  return segments.some(
+    (segment, index) => is_third_party_selector_write(command, segments, index, session_owner) || is_third_party_write_segment(
+      segment,
+      session_owner,
+      candidates_at(segments, index, resolve_placeholder_owners)
+    )
+  );
+}
+function writes_third_party(command, resolve_owner = repo_party.current_owner, resolve_placeholder_owners = repo_party.placeholder_owners) {
+  const segments = shell_segments.quote_aware_commands_of(
+    shell_segments.joined_continuations(command)
+  );
+  if (segments.some((segment) => is_graphql_mutation(command, segment))) return true;
+  return writes_to_third_party_owner(command, segments, resolve_owner, resolve_placeholder_owners);
+}
+var THIRD_PARTY_WRITE_REASON = "\u26D4 third-party write: this `gh` call writes to another owner's repository, or one it cannot read (a GraphQL mutation, an unreadable `-R`) \u2014 Tier C. Check `pnpm josh repo:party <owner/repo>`; first-party, use a REST `repos/<owner>/<repo>` path. Else record it on our Issue and draft it for a person to post. Fires on every occurrence (`upstream-interrupt.md`).";
+var ROW26 = {
+  id: "third-party-write",
+  is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
+  reason: THIRD_PARTY_WRITE_REASON,
+  decide: () => true,
+  about: {
+    title: "Third-party write",
+    topic: "`upstream-interrupt.md`",
+    fires: "a `gh api` write (field flag or a write method) or a `gh <group> <action>` write selected by `-R` / `GH_REPO` to a repository whose owner is not this session, or a `gh api graphql` call whose line names `mutation` or whose query the shell expands, outside the merge and administration rows. Every occurrence",
+    quiet: "a read, a GraphQL query, or a first-party owner (pinned at session start, `pnpm josh repo:party`)"
+  }
+};
+var third_party_write = {
+  ROW: ROW26,
+  THIRD_PARTY_WRITE_REASON,
+  writes_third_party
+};
+
+// scripts/rules/shell-permissions.ts
+var FLAG_PREFIX6 = "-";
+var ORIGIN = "origin";
+var PUSH = "push";
+var PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--repo",
+  "--receive-pack",
+  "--exec",
+  "-o",
+  "--push-option"
+]);
+var QUOTING = /["'\\]/gu;
+var PUSH_CONFIG = /^(?:remote\.|url\.|core\.(?:sshCommand|gitProxy))/iu;
+var CONFIG_ENVIRONMENT = /^GIT_CONFIG(?:_[A-Z0-9_]+)?=/u;
+function has_push_config(line) {
+  return git_argv.config_arguments_of(line).some((word) => PUSH_CONFIG.test(word.replaceAll(QUOTING, "")));
+}
+function has_config_environment(segment, call) {
+  const prefix = git_argv.words_of(segment).slice(0, -(call.args.length + 1));
+  return prefix.some((word) => CONFIG_ENVIRONMENT.test(word.replaceAll(QUOTING, "")));
+}
+function has_push_override(segment, call, args) {
+  const line = [call.name, ...call.args].join(" ");
+  return has_config_environment(segment, call) || has_push_config(line) || args.some((word) => PUSH_VALUE_FLAGS.has(word.split("=", 1)[0] ?? ""));
+}
+function is_gh_write(call) {
+  if (call.name !== "gh") return false;
+  const line = [call.name, ...call.args].join(" ");
+  if (pr_merge.is_graphql_call(call.name, call.args)) {
+    return [pr_merge.is_pr_merge, third_party_write.writes_third_party].some((test) => test(line));
+  }
+  if (gh_api.is_gh_api(line)) return gh_api.is_write(line);
+  return !/^gh (?:--help|--version|-h)$/u.test(line) && gh_repo_selector.is_write_call(call.args);
+}
+function is_foreign_push(segment, call) {
+  const line = [call.name, ...call.args].join(" ");
+  const parsed = git_argv.parse(line);
+  if (parsed?.subcommand !== PUSH) return false;
+  if (has_push_override(segment, call, parsed.args)) return true;
+  const remote = parsed.args.find((word) => !word.startsWith(FLAG_PREFIX6));
+  return remote?.replaceAll(QUOTING, "") !== ORIGIN;
+}
+function is_restricted(segment, call) {
+  const plain = {
+    name: call.name,
+    args: call.args.map((word) => interpreter_options.syntax_word(word))
+  };
+  return interpreter_options.is_inline_execution(plain) || is_gh_write(plain) || is_foreign_push(segment, plain);
+}
+var shell_permissions = { is_restricted };
+
+// scripts/rules/egress-guard.ts
+var GH_COMMAND5 = "gh";
+var ENV_COMMAND = "env";
+var FLAG_PREFIX7 = "-";
+var NEXT4 = 1;
+var NETWORK_PROGRAMS = /* @__PURE__ */ new Set([
+  "curl",
+  "ncat",
+  "nc",
+  "scp",
+  "sftp",
+  "socat",
+  "ssh",
+  "telnet",
+  "wget"
+]);
+var LOCAL_URL = /^['"]?(?:https?:\/\/)?(?:localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(?:[/?#]\S*)?['"]?$/u;
+var LOCAL_FETCHERS = /* @__PURE__ */ new Map([
+  [
+    "curl",
+    {
+      value_flags: /* @__PURE__ */ new Set([
+        "-H",
+        "--header",
+        "-X",
+        "--request",
+        "-m",
+        "--max-time",
+        "-o",
+        "--output",
+        "-w",
+        "--write-out"
+      ]),
+      bare_prefix: /^[fiIkLsSv]*/u
+    }
+  ],
+  [
+    "wget",
+    {
+      value_flags: /* @__PURE__ */ new Set([
+        "--header",
+        "-O",
+        "--output-document",
+        "-o",
+        "--output-file",
+        "-T",
+        "--timeout"
+      ]),
+      bare_prefix: /^[qSv]*/u
+    }
+  ]
+]);
+var GLUED_LONG = /^(?<flag>--[^=]+)=/u;
+var SHORT_CLUSTER = /^-(?<letters>[^-].+)$/u;
+var REDIRECT_WORD = /^[\d&]?[<>]/u;
+var RSYNC_COMMAND = "rsync";
+var REMOTE_OPERAND = /^['"]?(?:[\w.-]+@)?[\w.-]+:|^['"]?rsync:\/\//u;
+var GITHUB_HOSTS = /* @__PURE__ */ new Set(["github.com", "api.github.com"]);
+var HOSTNAME_FLAG = "--hostname";
+var HOSTNAME_VALUE = /^--hostname=(?<host>.*)$/u;
+var AUTH_GROUP = "auth";
+var TOKEN_ACTION = "token";
+var STATUS_ACTION = "status";
+var HOST_ASSIGNMENT = "GH_HOST=";
+var URL_SCHEME = /^['"]?https?:\/\//u;
+var QUOTES4 = /["']/gu;
+var SHOW_TOKEN_FLAGS = /* @__PURE__ */ new Set(["--show-token", "-t"]);
+var SECRET_NAME = /TOKEN|SECRET|KEY/u;
+var SECRET_REFERENCE = /\$\{?\w*(?:TOKEN|SECRET|KEY)/u;
+function is_flag_word(word) {
+  return word.startsWith(FLAG_PREFIX7) || REDIRECT_WORD.test(word);
+}
+function is_destination_word(args, index, value_flags) {
+  if (is_flag_word(args[index] ?? "")) return false;
+  const previous = args[index - NEXT4] ?? "";
+  return !value_flags.has(previous) && !REDIRECT_WORD.test(previous);
+}
+function host_of(word) {
+  if (!URL_SCHEME.test(word)) return void 0;
+  const url = word.replaceAll(QUOTES4, "");
+  return URL.canParse(url) ? new URL(url).hostname : "";
+}
+function is_allowed_destination(word) {
+  return LOCAL_URL.test(word) || GITHUB_HOSTS.has(host_of(word) ?? "");
+}
+function is_known_cluster(letters, fetcher) {
+  const stop = fetcher.bare_prefix.exec(letters)?.[0].length ?? 0;
+  if (stop === letters.length) return true;
+  return stop < letters.length - 1 && fetcher.value_flags.has(FLAG_PREFIX7 + letters.charAt(stop));
+}
+function group_of(pattern, word, name) {
+  return pattern.exec(word)?.groups?.[name];
+}
+function is_known_flag(word, fetcher) {
+  const long = group_of(GLUED_LONG, word, "flag");
+  if (long !== void 0) return fetcher.value_flags.has(long);
+  const letters = group_of(SHORT_CLUSTER, word, "letters");
+  return letters === void 0 || is_known_cluster(letters, fetcher);
+}
+function has_known_flags(args, fetcher) {
+  return args.every((word) => !word.startsWith(FLAG_PREFIX7) || is_known_flag(word, fetcher));
+}
+function is_local_fetch(call) {
+  const fetcher = LOCAL_FETCHERS.get(call.name);
+  if (fetcher === void 0 || !has_known_flags(call.args, fetcher)) return false;
+  const destinations = call.args.filter(
+    (_word, index) => is_destination_word(call.args, index, fetcher.value_flags)
+  );
+  return destinations.length > 0 && destinations.every((word) => is_allowed_destination(word));
+}
+function is_network_send(_segment, call) {
+  if (call.name === RSYNC_COMMAND) {
+    return call.args.some((word) => !word.startsWith(FLAG_PREFIX7) && REMOTE_OPERAND.test(word));
+  }
+  return NETWORK_PROGRAMS.has(call.name) && !is_local_fetch(call);
+}
+function flagged_hosts(args) {
+  return args.map(
+    (word, index) => word === HOSTNAME_FLAG ? args[index + NEXT4] : HOSTNAME_VALUE.exec(word)?.groups?.["host"]
+  ).filter((host) => host !== void 0);
+}
+function named_hosts(segment, args) {
+  const assigned = git_argv.words_of(segment).filter((word) => word.startsWith(HOST_ASSIGNMENT)).map((word) => word.slice(HOST_ASSIGNMENT.length));
+  const urls = args.map((word) => host_of(word)).filter((host) => host !== void 0);
+  return [...flagged_hosts(args), ...assigned, ...urls].map((host) => host.replaceAll(QUOTES4, ""));
+}
+function is_auth_print(args) {
+  const [group, action] = direct_pr_create.positional_words(
+    args,
+    direct_pr_create.API_VALUE_TAKING_FLAGS
+  );
+  if (group !== AUTH_GROUP) return false;
+  return action === TOKEN_ACTION || action === STATUS_ACTION && args.some((word) => SHOW_TOKEN_FLAGS.has(word));
+}
+function is_gh_credential(segment, call) {
+  if (call.name !== GH_COMMAND5) return false;
+  if (is_auth_print(call.args)) return true;
+  return named_hosts(segment, call.args).some((host) => !GITHUB_HOSTS.has(host));
+}
+function names_secret(args) {
+  return args.some((word) => SECRET_REFERENCE.test(word));
+}
+function is_printenv_dump(args) {
+  return args.length === 0 || args.some((word) => SECRET_NAME.test(word));
+}
+function is_bare(args) {
+  return args.length === 0;
+}
+function is_export_listing(args) {
+  return args.length === 0 || args.includes("-p");
+}
+var DUMP_CHECKS = /* @__PURE__ */ new Map([
+  ["printenv", is_printenv_dump],
+  ["set", is_bare],
+  ["export", is_export_listing],
+  ["echo", names_secret],
+  ["printf", names_secret]
+]);
+function is_environment_dump(_segment, call) {
+  return DUMP_CHECKS.get(call.name)?.(call.args) ?? false;
+}
+var PROGRAM_CHECKS = [
+  is_network_send,
+  shell_permissions.is_restricted,
+  is_gh_credential,
+  is_environment_dump,
+  keychain_read.is_keychain_read
+];
+function is_egress_segment(segment) {
+  const call = launched_call.resolved_call(segment);
+  if (call === void 0) {
+    return git_argv.words_of(segment).some((word) => launched_call.plain_name(word) === ENV_COMMAND);
+  }
+  return PROGRAM_CHECKS.some((check) => check(segment, call));
+}
+function is_egress(command) {
+  return nested_commands.commands_of(command).some((segment) => is_egress_segment(segment));
+}
+var EGRESS_REASON = '\u26D4 egress: no external network send, inline interpreter execution, direct `gh` write, push without explicit `origin`, or credential/environment print. Use named scripts and `pnpm josh` write routes; otherwise ask the user to run it (`SECURITY.md` \u2192 "Secrets"). This rule fires on every occurrence.';
+var ROW27 = {
+  id: "egress",
+  is_trigger: bash_triggers.on_bash_command(is_egress),
+  reason: EGRESS_REASON,
+  decide: () => true,
+  about: {
+    title: "Network egress or credential print",
+    topic: '`SECURITY.md` \u2192 "Secrets"',
+    fires: "network sends, inline interpreter execution, direct `gh` writes, `git push` without explicit `origin`, credential, keychain or environment prints \u2014 in each shell segment and nested command. Every occurrence",
+    quiet: "ordinary reads, `gh` reads against github.com, `git fetch`, `git push origin`, named scripts and `pnpm josh` routes. A plain `curl` / `wget` is still refused by the deny list; the hook allows local or GitHub destinations with known flags"
+  }
+};
+var egress_guard = { EGRESS_REASON, ROW: ROW27, is_egress };
+
+// scripts/rules/worktree-guard.ts
+var CHECKOUT_SUBCOMMAND = "checkout";
+var RESTORE_SUBCOMMAND = "restore";
+var STASH_SUBCOMMAND = "stash";
+var PATHSPEC_SEPARATOR = "--";
+function is_worktree_checkout(args) {
+  return args.includes(PATHSPEC_SEPARATOR);
+}
+var STAGED_LONG = "--staged";
+var STAGED_LETTER = "S";
+var WORKTREE_LONG = "--worktree";
+var WORKTREE_LETTER = "W";
+function touches_worktree(args) {
+  const is_staged = args.some(
+    (argument) => argument === STAGED_LONG || git_argv.short_cluster_has(argument, STAGED_LETTER)
+  );
+  const is_worktree = args.some(
+    (argument) => argument === WORKTREE_LONG || git_argv.short_cluster_has(argument, WORKTREE_LETTER)
+  );
+  return !is_staged || is_worktree;
+}
+var PUSH_STASH = "push";
+var MESSAGE_LONG = "--message";
+var MESSAGE_SHORT_LETTER = "m";
+var READ_ONLY_STASH = /* @__PURE__ */ new Set(["list", "show"]);
+function has_message(args) {
+  return args.some(
+    (argument) => argument === MESSAGE_LONG || argument.startsWith(`${MESSAGE_LONG}=`) || git_argv.short_cluster_has(argument, MESSAGE_SHORT_LETTER)
+  );
+}
+function is_unauthorized_stash(args) {
+  const [stash_subcommand, ...rest] = args;
+  if (stash_subcommand === void 0) return true;
+  if (READ_ONLY_STASH.has(stash_subcommand)) return false;
+  if (stash_subcommand === PUSH_STASH) return !has_message(rest);
+  return true;
+}
+var CLEAN_SUBCOMMAND = "clean";
+var FORCE_LONG2 = "--force";
+var FORCE_LETTER2 = "f";
+function is_forced_clean(args) {
+  return args.some(
+    (argument) => argument === FORCE_LONG2 || git_argv.short_cluster_has(argument, FORCE_LETTER2)
+  );
+}
+var JUDGED_SUBCOMMANDS = /* @__PURE__ */ new Map([
+  [CHECKOUT_SUBCOMMAND, is_worktree_checkout],
+  [RESTORE_SUBCOMMAND, touches_worktree],
+  [CLEAN_SUBCOMMAND, is_forced_clean],
+  [STASH_SUBCOMMAND, is_unauthorized_stash]
+]);
+function is_unauthorized_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  return JUDGED_SUBCOMMANDS.get(call.subcommand ?? "")?.(call.args) === true;
+}
+function is_unauthorized_worktree_change(command) {
+  return shell_segments.commands_of(command).some((segment) => is_unauthorized_segment(segment));
+}
+var SINGLE_FILE_RESTORE = "git diff -- <path> | git apply -R";
+var WORKTREE_MUTATION_REASON = `\u26D4 unauthorized working-tree change: undo only this run's edit: \`${SINGLE_FILE_RESTORE}\`. A documented flow stashes with \`pnpm josh stash:push "<message>"\`; a handed-over stash is \`pnpm josh stash:pop "<message>"\`; record the substitution on the Issue (Tier A) unless the plan says why the owner keeps the stash: then stop and confirm. It fires on every occurrence (\`operating-rules.md\`).`;
+var FORMER_OPENING = "\u26D4 unauthorized working-tree change: `git checkout --`, `git restore`";
+var ROW28 = {
+  id: "worktree-mutation",
+  is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
+  reason: WORKTREE_MUTATION_REASON,
+  former_reasons: [FORMER_OPENING],
+  decide: () => true,
+  about: {
+    title: "Unauthorized work-tree mutation",
+    topic: "`operating-rules.md`",
+    fires: "`git checkout -- <path>` / `git restore <path>` / forced `git clean -f` / an unauthorized `git stash` (bare, push without a message, positional pop). Every occurrence",
+    quiet: `\`git stash push -m\`, \`git stash list\`, \`pnpm josh git\`, \`pnpm josh stash:push\`, \`pnpm josh stash:pop\`, \`${SINGLE_FILE_RESTORE}\``
+  }
+};
+var worktree_guard = {
+  ROW: ROW28,
+  SINGLE_FILE_RESTORE,
+  WORKTREE_MUTATION_REASON,
+  is_unauthorized_worktree_change,
+  touches_worktree
+};
+
+// scripts/rules/index-guard.ts
+var INDEX_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "add",
+  "commit",
+  "mv",
+  "reset",
+  "rm",
+  "stage"
+]);
+var RESTORE_SUBCOMMAND2 = "restore";
+function is_index_restore(args) {
+  return !worktree_guard.touches_worktree(args);
+}
+function is_index_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  if (INDEX_SUBCOMMANDS.has(call.subcommand ?? "")) return true;
+  return call.subcommand === RESTORE_SUBCOMMAND2 && is_index_restore(call.args);
+}
+function is_index_mutation(command) {
+  return shell_segments.commands_of(command).some((segment) => is_index_segment(segment));
+}
+var INDEX_MUTATION_REASON = "\u26D4 git index mutation: `git add` / `stage` / `commit` / `reset` / `rm` / `mv` and `git restore --staged` overwrite the user's staged snapshot. Commit with `pnpm josh git -y`; any other staging is the user's, on explicit instruction. It fires on every occurrence (`prompts/collaboration-workflow/operating-rules.md` \u2192 \"no-self-staging\").";
+var ROW29 = {
+  id: "index-mutation",
+  is_trigger: bash_triggers.on_bash_command(is_index_mutation),
+  reason: INDEX_MUTATION_REASON,
+  decide: () => true,
+  about: {
+    title: "Index mutation",
+    topic: "`operating-rules.md`",
+    fires: "`git add` / `commit` / `reset` / `rm` / `mv` / `restore --staged` in any spelling. Every occurrence",
+    quiet: "`pnpm josh git` \u2014 the approved commit flow"
+  }
+};
+var index_guard = { INDEX_MUTATION_REASON, ROW: ROW29, is_index_mutation };
+
+// scripts/rules/protected-files.ts
+import path5 from "node:path";
+
+// scripts/rules/secret-paths.ts
+import os2 from "node:os";
+import path4 from "node:path";
+var TOKEN_QUOTES = /["']/gu;
+var BRACED_VARIABLE = /\$\{(\w+)\}/gu;
+var BACKSLASH = /\\/gu;
+var SECRET_FILES = /* @__PURE__ */ new Set([".env", ".dev.vars"]);
+var ENVIRONMENT_VARIANT_PREFIX = ".env.";
+var TRACKED_VARIANTS = /* @__PURE__ */ new Set([".env.example", ".env.test"]);
+var SECRET_SUFFIXES = [
+  "gh/hosts.yml",
+  ".codex/auth.json",
+  "reviewer-home/auth.json",
+  "$CODEX_HOME/auth.json"
+];
+var HOME_PREFIXES = ["~/", "$HOME/"];
+var HOME_SECRET_FILES = /* @__PURE__ */ new Set([".netrc", ".curlrc", ".npmrc"]);
+var HOME_SECRET_DIRECTORIES = [".ssh", ".config/gh"];
+function is_environment_file(token) {
+  const name = path4.basename(token);
+  if (TRACKED_VARIANTS.has(name)) return false;
+  return SECRET_FILES.has(name) || name.startsWith(ENVIRONMENT_VARIANT_PREFIX);
+}
+function is_under(relative, directory) {
+  return relative === directory || relative.startsWith(`${directory}/`);
+}
+function ends_with_path(token, suffix) {
+  return token === suffix || token.endsWith(`/${suffix}`);
+}
+function home_relative(token) {
+  const prefix = [...HOME_PREFIXES, `${os2.homedir()}/`].find((home) => token.startsWith(home));
+  return prefix === void 0 ? void 0 : token.slice(prefix.length);
+}
+function is_home_secret(token) {
+  const relative = home_relative(token);
+  if (relative === void 0) return false;
+  return HOME_SECRET_FILES.has(relative) || HOME_SECRET_DIRECTORIES.some((directory) => is_under(relative, directory));
+}
+function is_secret_token(token) {
+  return is_environment_file(token) || SECRET_SUFFIXES.some((suffix) => ends_with_path(token, suffix)) || is_home_secret(token);
+}
+function spellings_of(word) {
+  const token = word.replaceAll(TOKEN_QUOTES, "").replaceAll(BRACED_VARIABLE, "$$$1");
+  return [token.replaceAll(BACKSLASH, ""), token.replaceAll(BACKSLASH, "/")].map(
+    (spelling) => path4.posix.normalize(spelling)
+  );
+}
+function is_secret_path(word) {
+  return spellings_of(word).some((token) => is_secret_token(token));
+}
+var secret_paths = { is_secret_path };
+
+// scripts/rules/shell-redirects.ts
+var READ_MARK = "
read";
+var WRITE_MARK = "
write";
+var READ_OPERATOR = "<";
+var REDIRECT = />\||[<>]/gu;
+var PIECE_END = "\0";
+var NEXT5 = 1;
+var ANY_MARK = /* @__PURE__ */ new Set([READ_MARK, WRITE_MARK]);
+var { SHELLS: SHELLS2 } = nested_commands;
+function redirect_marks_of(segment, program) {
+  if (program !== void 0 && SHELLS2.has(program)) return segment;
+  return time_shell.blanked(segment) ?? segment;
+}
+function mark_of(operator) {
+  return operator === READ_OPERATOR ? READ_MARK : WRITE_MARK;
+}
+function marked_pieces(word, marks) {
+  const pieced = word.text.replaceAll(
+    REDIRECT,
+    (operator, offset) => marks.startsWith(operator, word.begin + offset) ? `${PIECE_END}${mark_of(operator)}${PIECE_END}` : operator
+  );
+  return pieced.split(PIECE_END).filter((piece) => piece !== "");
+}
+function marked_words(segment, program) {
+  const marks = redirect_marks_of(segment, program);
+  return shell_tokens.words_of(segment).flatMap((word) => marked_pieces(word, marks));
+}
+function targets_of(segment, program) {
+  const words = marked_words(segment, program);
+  return words.map((word, index) => ANY_MARK.has(word) ? words[index + NEXT5] : void 0).filter((target) => target !== void 0 && !ANY_MARK.has(target));
+}
+var shell_redirects = { targets_of };
+
+// scripts/rules/protected-files.ts
+var READ_TOOL = "Read";
+var GREP_TOOL = "Grep";
+var FILE_TOOLS = /* @__PURE__ */ new Set([READ_TOOL, GREP_TOOL]);
+var { is_edit_tool: is_edit_tool2 } = edit_tool;
+var { is_secret_path: is_secret_path2 } = secret_paths;
+var SETTINGS_FILE = path5.join(".claude", "settings.json");
+var SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+  "cp",
+  "install",
+  "ln",
+  "mv",
+  "tee",
+  ".",
+  "awk",
+  "base64",
+  "bat",
+  "cat",
+  "cmp",
+  "column",
+  "comm",
+  "cut",
+  "diff",
+  "fold",
+  "grep",
+  "head",
+  "hexdump",
+  "jq",
+  "less",
+  "more",
+  "nl",
+  "od",
+  "paste",
+  "perl",
+  "python",
+  "python3",
+  "rev",
+  "rg",
+  "ruby",
+  "sed",
+  "sort",
+  "source",
+  "strings",
+  "tac",
+  "tail",
+  "uniq",
+  "xxd",
+  "yq"
+]);
+function file_path_of(call) {
+  if (!json_value.is_record(call.input)) return "";
+  const value = call.input[call.name === GREP_TOOL ? "path" : "file_path"];
+  return typeof value === "string" ? value : "";
+}
+function is_secret_shell_segment(segment) {
+  const call = git_argv.program_of(segment);
+  const is_redirected = shell_redirects.targets_of(segment, call?.name).some((target) => is_secret_path2(target));
+  if (is_redirected || call === void 0) return is_redirected;
+  return SHELL_PROGRAMS.has(call.name) && call.args.some((word) => is_secret_path2(word));
+}
+function is_secret_shell_access(command) {
+  return nested_commands.commands_of(command).some((segment) => is_secret_shell_segment(segment));
+}
+function is_secret_access(call) {
+  if (FILE_TOOLS.has(call.name) || is_edit_tool2(call.name)) {
+    return is_secret_path2(file_path_of(call));
+  }
+  return bash_triggers.on_bash_command(is_secret_shell_access)(call);
+}
+function is_consumer_settings_edit(call, is_kit_consumer) {
+  if (!is_edit_tool2(call.name)) return false;
+  const file_path = path5.resolve(file_path_of(call));
+  if (!file_path.endsWith(`${path5.sep}${SETTINGS_FILE}`)) return false;
+  return is_kit_consumer(path5.dirname(path5.dirname(file_path)));
+}
+function is_protected_file_call(call, is_kit_consumer = doctor_consumer.is_kit_consumer) {
+  return is_secret_access(call) || is_consumer_settings_edit(call, is_kit_consumer);
+}
+var PROTECTED_FILE_REASON = "\u26D4 protected file: `.env`, a `.env.*` variant, `.dev.vars` and the credential files (gh `hosts.yml`, Codex's `auth.json`, `~/.netrc`, `~/.curlrc`, `~/.npmrc`, `~/.ssh/**`) hold secrets and are read and written only by the person, and a consumer `.claude/settings.json` is owned by `josh sync` (a change belongs upstream in kit). Leave these files alone, or ask the user. It fires on every occurrence.";
+var ROW30 = {
+  id: "protected-file",
+  is_trigger: is_protected_file_call,
+  reason: PROTECTED_FILE_REASON,
+  decide: () => true,
+  // The opening the reason carried before it was cut to the action and the next command.
+  former_reasons: ["\u26D4 protected file: `.env` holds the Telegram bot token"],
+  about: {
+    title: "Protected file",
+    topic: "`operating-rules.md`",
+    fires: "a `Read`, `Grep`, `Edit` or `Write` of `.env` or a credential file such as gh `hosts.yml`, Codex `auth.json`, `~/.netrc` or `~/.ssh/**` (or a shell read or write of one), or an `Edit` / `Write` of `.claude/settings.json` outside kit. Every occurrence",
+    quiet: "kit itself, or the user's `~/.claude/settings.json`"
+  }
+};
+var protected_files = { ROW: ROW30, is_protected_file_call };
+
+// scripts/rules/permission-guards.ts
+var ROWS2 = [
+  index_guard.ROW,
+  destructive_command.ROW,
+  delivered_rules_guard.call_only(protected_files.ROW),
+  direct_pr_create.ROW,
+  pr_merge.ROW,
+  repo_admin.ROW,
+  egress_guard.ROW
+];
+var permission_guards = { ROWS: ROWS2 };
+
+// scripts/rules/piped-verification.ts
+var VERIFICATION_COMMANDS = /* @__PURE__ */ new Set([
+  "check",
+  "check:related",
+  "cspell",
+  "cspell:dot",
+  "eval",
+  "gate",
+  "lint",
+  "lint:eslint",
+  "lint:prettier",
+  "lint:related",
+  "overrides",
+  "ranges",
+  "test",
+  "test:e2e",
+  "test:related",
+  "test:unit"
+]);
+function is_verification_command(segment) {
+  return shell_segments.is_josh_command(segment, VERIFICATION_COMMANDS);
+}
+function is_masked_verification(command) {
+  return time_shell.discarded_commands(command).some((segment) => is_verification_command(segment));
+}
+var PIPED_VERIFICATION_REASON = "\u26D4 piped verification: a pipeline exits with its last command's status, so `pnpm josh gate | tail` reports success on a gate that failed. Reissue this call with no pipe (josh prints its verdict last), or redirect it to a file and read ranges from that file, or prefix `set -o pipefail`; read the verdict line, never the exit code alone (`prompts/collaboration-workflow/output-bounds.md`).";
+function pipelines_of(command) {
+  return shell_segments.segments_of(time_shell.unquoted(command)).map((segment) => segment.split("|").map((piece) => piece.trim()));
+}
+function check_filters(command) {
+  return pipelines_of(command).flatMap(
+    ([head = "", ...filters]) => is_verification_command(head) ? filters : []
+  );
+}
+function command_pieces(command) {
+  return pipelines_of(command).flat();
+}
+function runs_verification(command) {
+  return command_pieces(command).some((piece) => is_verification_command(piece));
+}
+function keeps_verdict_intact(command) {
+  return runs_verification(command) && !is_masked_verification(command);
+}
+var PIPEFAIL_OPEN = "(set -o pipefail; ";
+var PIPEFAIL_CLOSE = ")";
+var COMMENT_START = /(?:^|\s)#/u;
+var FULL_READING_FILTER = /^(?:tail|grep|cut|sort|uniq|wc|tee)(?=\s|$)/u;
+var EARLY_EXIT_GREP = /^grep\b.*\s(?:-[a-zA-Z]*[lLmq]|--(?:quiet|silent|max-count|files-with(?:out)?-match))/u;
+var AWK_PROGRAM = /^awk\s+(?:-F\s*\S+\s+)?'[^']*'$/u;
+var AWK_EARLY_EXIT = /\b(?:exit|nextfile|system|getline)\b|\|/u;
+var SED_TEXT = String.raw`(?:[^/\\']|\\.)*`;
+var SED_ADDRESS = String.raw`(?:\d+|\$|/${SED_TEXT}/)`;
+var SED_COMMAND = String.raw`(?:${SED_ADDRESS}(?:,${SED_ADDRESS})?)?!?(?:p|d|s/${SED_TEXT}/${SED_TEXT}/[gip\d]*)`;
+var SED_PROGRAM = new RegExp(
+  String.raw`^sed\s+(?:-[nEr]+\s+)*'${SED_COMMAND}(?:;\s*${SED_COMMAND})*'$`,
+  "u"
+);
+var ALLOWED_OPERATORS = /2>&1|&&/gu;
+var SIDE_EFFECT_SYNTAX = /[&<>`]|\$\(/u;
+var GROUP_SYNTAX = /[()]/u;
+var PIPEFAIL_NOTE = "\u21BB piped verification: the josh check was piped, so its pipeline was wrapped in `(set -o pipefail; \u2026)` to carry the check's status, and the rest of the line ran as typed. Read the printed verdict, never the exit code alone \u2014 `prompts/collaboration-workflow/output-bounds.md`.";
+function is_full_reading_script(typed) {
+  if (AWK_PROGRAM.test(typed)) return !AWK_EARLY_EXIT.test(typed);
+  return SED_PROGRAM.test(typed);
+}
+function reads_to_the_end(piece, typed) {
+  if (FULL_READING_FILTER.test(piece)) return !EARLY_EXIT_GREP.test(piece);
+  return is_full_reading_script(typed);
+}
+function typed_slices(raw, pieces, gap) {
+  const offset = { at: 0 };
+  return pieces.map((piece) => {
+    const typed = raw.slice(offset.at, offset.at + piece.length);
+    offset.at += piece.length + gap;
+    return typed;
+  });
+}
+function is_filtered_check(pieces, typed) {
+  const [head = "", ...filters] = pieces.map((piece) => piece.trim());
+  return is_verification_command(head) && filters.every((piece, index) => reads_to_the_end(piece, typed[index + 1]?.trim() ?? ""));
+}
+function has_side_effect_syntax(command) {
+  return SIDE_EFFECT_SYNTAX.test(command.replaceAll(ALLOWED_OPERATORS, " "));
+}
+function is_rewritable_part(raw, judged) {
+  const pieces = judged.split("|");
+  return !has_side_effect_syntax(raw) && !GROUP_SYNTAX.test(judged) && is_filtered_check(pieces, typed_slices(raw, pieces, 1));
+}
+function code_end(judged) {
+  const comment = COMMENT_START.exec(judged);
+  return comment === null ? judged.length : comment.index;
+}
+function wrapped(raw, judged) {
+  const code = raw.slice(0, code_end(judged));
+  const core = code.trim();
+  const lead = code.slice(0, code.indexOf(core));
+  return `${lead}${PIPEFAIL_OPEN}${core}${PIPEFAIL_CLOSE}${raw.slice(lead.length + core.length)}`;
+}
+function rewritten_part(raw, judged) {
+  if (!is_masked_verification(judged)) return raw;
+  return is_rewritable_part(raw, judged) ? wrapped(raw, judged) : void 0;
+}
+function pipefail_command(command) {
+  const judged = time_shell.blanked(command);
+  if (judged === void 0 || !is_masked_verification(command)) return void 0;
+  const pieces = shell_segments.parts_of(judged);
+  const parts = typed_slices(command, pieces, 0).map(
+    (raw, index) => rewritten_part(raw, pieces[index] ?? "")
+  );
+  const rewritten = parts.includes(void 0) ? void 0 : parts.join("");
+  return rewritten === command ? void 0 : rewritten;
+}
+function pipefail_input(call) {
+  if (call.name !== cost_blocks.BASH_TOOL || !json_value.is_record(call.input)) return void 0;
+  const command = pipefail_command(time_shell.bash_command(call.input));
+  return command === void 0 ? void 0 : { ...call.input, command };
+}
+var piped_verification = {
+  EARLY_EXIT_GREP,
+  PIPED_VERIFICATION_REASON,
+  PIPEFAIL_NOTE,
+  VERIFICATION_COMMANDS,
+  check_filters,
+  is_masked_verification,
+  keeps_verdict_intact,
+  pipefail_input,
+  runs_verification
+};
+
+// scripts/rules/poll-loop.ts
+var LOOP_KEYWORD2 = /\b(?:while|until)\s/u;
+var SLEEP_COMMAND = /\bsleep\s+\S/u;
+var COMMAND_POSITION = String.raw`(?:^|[;&|({\n]|\b(?:do|then|else)\s)\s*`;
+var UNTIL_HEADER = new RegExp(String.raw`${COMMAND_POSITION}until\s`, "u");
+var WHILE_HEADER = String.raw`${COMMAND_POSITION}while\s+(?:!\s*)?`;
+var PROBE_HEADERS = [
+  String.raw`\[\[?\s+(?:!\s*)?-[defs]\s`,
+  String.raw`test\s+(?:!\s*)?-[defs]\s`,
+  String.raw`(?:kill\s+-0|pgrep)\b`,
+  String.raw`grep\s+-[A-Za-z]*q`
+].map((probe) => new RegExp(`${WHILE_HEADER}${probe}`, "u"));
+var COUNTED_FOR = new RegExp(
+  String.raw`${COMMAND_POSITION}for(?:\s*\(\(|\s+\w+\s+in\s+(?:\$\(\s*seq\b|\{\d+\.\.))`,
+  "u"
+);
+var THROUGH_FIRST_DONE = /^[\s\S]*?\bdone\b/u;
+var SETTLE_SECONDS = 10;
+var NO_SECONDS2 = 0;
+var READ_COMMAND = /^(?:tail|cat|head|ps|stat|grep|wc|ls|pgrep|test|kill\s+-0|\[\[?)(?=\s|$)/u;
+function slept_seconds(segments) {
+  return segments.reduce(
+    (total, segment) => total + (early_heartbeat.sleep_seconds(segment) ?? NO_SECONDS2),
+    NO_SECONDS2
+  );
+}
+function is_sleep_then_read(plain) {
+  const segments = shell_segments.commands_of(plain).filter((segment) => segment !== "");
+  const first_work = segments.findIndex((segment) => !early_heartbeat.is_wait_or_inert(segment));
+  const waited = first_work === -1 ? NO_SECONDS2 : slept_seconds(segments.slice(0, first_work));
+  if (waited < SETTLE_SECONDS) return false;
+  return segments.slice(first_work).every((segment) => early_heartbeat.is_wait_or_inert(segment) || READ_COMMAND.test(segment));
+}
+function is_state_wait(plain) {
+  return UNTIL_HEADER.test(plain) || PROBE_HEADERS.some((header) => header.test(plain));
+}
+function is_counted_sleep(plain) {
+  const header = COUNTED_FOR.exec(plain);
+  if (header === null) return false;
+  const rest = plain.slice(header.index);
+  return SLEEP_COMMAND.test(THROUGH_FIRST_DONE.exec(rest)?.[0] ?? rest);
+}
+function is_sleeping_loop(plain) {
+  return LOOP_KEYWORD2.test(plain) && SLEEP_COMMAND.test(plain) || is_counted_sleep(plain);
+}
+var STREAM_READER = /\bwhile\s+read\b/u;
+function is_stream_reader(plain) {
+  return STREAM_READER.test(plain);
+}
+function is_poll_loop(command) {
+  const plain = time_shell.unquoted(command);
+  if (is_stream_reader(plain)) return false;
+  if (is_state_wait(plain)) return true;
+  return is_sleeping_loop(plain) || is_sleep_then_read(plain);
+}
+var POLL_LOOP_REASON = "\u26D4 output poll loop: a `while`/`until` or counted `for` loop, or a `sleep` chain before a read, does not know when the task finished. `run_in_background` and end the turn \u2014 its exit re-invokes you; a background `Agent` is waited on by its completion notification (lane child: bare `sleep 20`, `pnpm josh run:liveness`); CI by `pnpm josh followup` (`background-commands.md`). Fires on every occurrence.";
+var ROW31 = {
+  id: "poll-loop",
+  is_trigger: bash_triggers.on_bash_command(is_poll_loop),
+  reason: POLL_LOOP_REASON,
+  decide: () => true,
+  about: {
+    title: "Output poll loop",
+    topic: "`.claude/skills/workflow-commands/background-commands.md`",
+    fires: "a hand-written `while` / `until` wait loop over a command's output, a marker file or a process, a counted `for` that sleeps, or a `sleep` chain of 10 s or more before a read of a file or process. Every occurrence",
+    quiet: "the command started with `run_in_background` \u2014 its exit ends the wait"
+  }
+};
+var poll_loop = {
+  POLL_LOOP_REASON,
+  ROW: ROW31,
+  is_poll_loop
+};
+
+// scripts/rules/raw-field-body.ts
+var RAW_FIELD_BODY_AT = /(?:^|\s)(?:-f|--raw-field)[\s=]+['"]?body=['"]?@/u;
+function posts_at_path_literally(command) {
+  return RAW_FIELD_BODY_AT.test(command);
+}
+var RAW_FIELD_BODY_REASON = "\u26D4 literal @path body: this passes `body=@<path>` to `gh api` with a raw field flag (`-f` / `--raw-field`), which posts the string `@<path>` rather than the file. Post the comment with `pnpm josh issue:comment <N> --body-file <path>`; this rule fires on every occurrence (`prompts/collaboration-workflow/shell-body.md`).";
+var ROW32 = {
+  id: "raw-field-body",
+  is_trigger: bash_triggers.on_bash_command(posts_at_path_literally),
+  reason: RAW_FIELD_BODY_REASON,
+  decide: () => true,
+  about: {
+    title: "Posting `@path` literally",
+    topic: "`shell-body.md`",
+    fires: "a raw field (`-f` / `--raw-field`) passing `body=@<path>`. Every occurrence",
+    quiet: "`-F` / `--field body=@`, a body without `@`, or `pnpm josh issue:comment`"
+  }
+};
+var raw_field_body = { RAW_FIELD_BODY_REASON, ROW: ROW32, posts_at_path_literally };
+
+// scripts/rules/round-one-check-related.ts
+var CHECK_COMMANDS = /* @__PURE__ */ new Set(["check:related"]);
+var REVIEW_COMMANDS = /* @__PURE__ */ new Set(["run:review", "run:chain"]);
+var SHIP_COMMANDS = /* @__PURE__ */ new Set(["ship"]);
+var JOIN_FLAG = /(?:^|\s)--join(?:[=\s]|$)/u;
+var READING_MODE_FLAG = /(?:^|\s)--(?:pinned|push)(?:[=\s]|$)/u;
+var DETACH_FLAG = /(?:^|\s)--detach(?:[=\s]|$)/u;
+var TOUCHED_FLAG = /(?:^|\s)--touched(?:[=\s]|$)/u;
+function is_check_related(segment) {
+  return shell_segments.is_josh_command(segment, CHECK_COMMANDS);
+}
+function is_full_reach_check(segment) {
+  return is_check_related(segment) && !TOUCHED_FLAG.test(segment);
+}
+function review_event(segment) {
+  if (JOIN_FLAG.test(segment)) return "close";
+  return READING_MODE_FLAG.test(segment) ? "none" : "brief";
+}
+function segment_event(segment) {
+  if (shell_segments.is_josh_command(segment, REVIEW_COMMANDS)) return review_event(segment);
+  if (is_full_reach_check(segment)) return "check";
+  const is_detach = shell_segments.is_josh_command(segment, SHIP_COMMANDS) && DETACH_FLAG.test(segment);
+  return is_detach ? "close" : "none";
+}
+function block_events(block) {
+  if (tail_commands.is_bash_use(block)) {
+    const segments = shell_segments.segments_of(time_shell.bash_command(block.input));
+    return segments.map((segment) => segment_event(segment));
+  }
+  const is_edit = time_markers.tool_marker(block.name, block.input) === time_markers.EDIT_MARKER;
+  return is_edit ? ["edit"] : [];
+}
+function ran_call_ids(blocks) {
+  const results = blocks.filter((block) => block.result_id !== "" && block.refusal_guard === "");
+  return new Set(results.map((block) => block.result_id));
+}
+function round_events(tail) {
+  const blocks = time_transcript_line.parse_text(tail).flatMap((line) => line.blocks);
+  const ran = ran_call_ids(blocks);
+  return blocks.flatMap(
+    (block) => block_events(block).map((event) => event === "check" && !ran.has(block.id) ? "none" : event)
+  );
+}
+function fixes_an_open_round(tail) {
+  const events = round_events(tail);
+  const brief_at = events.lastIndexOf("brief");
+  if (brief_at === -1) return false;
+  const since_brief = new Set(events.slice(brief_at));
+  return since_brief.has("edit") && !since_brief.has("close");
+}
+function runs_in_lane_child(command, is_counted, context) {
+  if (shell_segments.segments_of(command).every((segment) => !is_counted(segment))) return false;
+  return lane_child_marker.is_child_of(context.cwd, context.env);
+}
+function is_candidate4(command, context) {
+  return runs_in_lane_child(command, is_check_related, context);
+}
+function is_full_reach_candidate(command, context) {
+  return runs_in_lane_child(command, is_full_reach_check, context);
+}
+function decide3(_call, run) {
+  return fixes_an_open_round(transcript_tail.read_tail(run.transcript));
+}
+var ROUND_ONE_CHECK_RELATED_REASON = "\u26D4 round-one check:related: round 1's fixes need no `check:related` \u2014 ship's pre-detach reruns the scoped pair on the fixed tree; refused on every occurrence. Go on to `pnpm josh run:review --join`; `--join --fixing` while round 1 has fixes to make (`.claude/skills/workflow-commands/chain-rule.md` \u2192 \"A lane child\").";
+var ROW33 = {
+  id: "round-one-check-related",
+  is_trigger: bash_triggers.on_bash_command(is_candidate4),
+  reason: ROUND_ONE_CHECK_RELATED_REASON,
+  decide: decide3,
+  about: {
+    title: "No check:related on round 1's fixes",
+    topic: '`.claude/skills/workflow-commands/chain-rule.md` \u2192 "A lane child"',
+    fires: "`pnpm josh check:related` (`josh cr`) in a lane child after an `Edit` / `Write` that follows `run:review`'s (or `run:chain`'s) brief, before `run:review --join`, `run:chain --join` or `ship --detach`. Every occurrence",
+    quiet: "no fix since the brief, already joined or detached, or not a lane child"
+  }
+};
+var round_one_check_related = {
+  ROUND_ONE_CHECK_RELATED_REASON,
+  ROW: ROW33,
+  fixes_an_open_round,
+  round_events,
+  is_full_reach_candidate
+};
+
+// scripts/rules/repeat-check-related.ts
+function repeats_before_brief(tail) {
+  const events = round_one_check_related.round_events(tail);
+  const since_close = events.slice(events.lastIndexOf("close") + 1);
+  if (since_close.includes("brief")) return false;
+  return since_close.includes("check");
+}
+function decide4(_call, run) {
+  return repeats_before_brief(transcript_tail.read_tail(run.transcript));
+}
+var REPEAT_CHECK_RELATED_REASON = '\u26D4 repeat check:related: the full-reach `check:related` runs once before the brief; refused on every later occurrence. Mid-run, run `pnpm josh check:related --touched` (never refused), or the failing check by name \u2014 `pnpm josh lint:related`, `check`, `test:related` (`--touched` mid-run), `cspell:dot` \u2014 then `pnpm josh run:review` (`.claude/skills/workflow-commands/chain-rule.md` \u2192 "A lane child").';
+var ROW34 = {
+  id: "repeat-check-related",
+  is_trigger: bash_triggers.on_bash_command(round_one_check_related.is_full_reach_candidate),
+  reason: REPEAT_CHECK_RELATED_REASON,
+  decide: decide4,
+  about: {
+    title: "One check:related before the brief",
+    topic: '`.claude/skills/workflow-commands/chain-rule.md` \u2192 "A lane child"',
+    fires: "`pnpm josh check:related` (`josh cr`) in a lane child after an earlier one that ran, with no `run:review` (or `run:chain`) brief, join or `ship --detach` since. Every occurrence",
+    quiet: "the first since the last join or detach, a brief since, a `--touched` run, or not a lane child"
+  }
+};
+var repeat_check_related = {
+  REPEAT_CHECK_RELATED_REASON,
+  ROW: ROW34,
+  repeats_before_brief
+};
+
+// scripts/rules/reviewer-foreground.ts
+var REVIEWER_AGENTS = /* @__PURE__ */ new Set(["reviewer", "reviewer-verification"]);
+var BACKGROUND_FIELD2 = "run_in_background";
+var CHAIN_RULE_STEP = '`.claude/skills/workflow-commands/chain-rule.md` \u2192 "A lane child"';
+var KILLED = "reviewer foreground: a lane child\u2019s turn end kills a background `reviewer`";
+var FOREGROUND = `\`${BACKGROUND_FIELD2}: false\``;
+var REVIEWER_FOREGROUND_NOTE = `\u21BB ${KILLED}, so the call ran with ${FOREGROUND} (${CHAIN_RULE_STEP}).`;
+var REVIEWER_FOREGROUND_REASON = `\u26D4 ${KILLED}. Reissue the call with ${FOREGROUND} (${CHAIN_RULE_STEP}). It fires on every occurrence.`;
+function is_reviewer(call) {
+  if (!agent_model.SUBAGENT_TOOLS.has(call.name) || !json_value.is_record(call.input)) return false;
+  const type = call.input["subagent_type"];
+  return typeof type === "string" && REVIEWER_AGENTS.has(type.split(":").at(-1) ?? "");
+}
+function is_foreground2(call) {
+  return json_value.is_record(call.input) && call.input[BACKGROUND_FIELD2] === false;
+}
+function is_background_reviewer(call, is_lane_child) {
+  return is_lane_child && is_reviewer(call) && !is_foreground2(call);
+}
+function foreground_input(call, is_lane_child) {
+  if (!is_background_reviewer(call, is_lane_child) || !json_value.is_record(call.input)) {
+    return void 0;
+  }
+  return { ...call.input, [BACKGROUND_FIELD2]: false };
+}
+var ROW35 = {
+  id: "reviewer-foreground",
+  is_trigger: (call, context) => is_background_reviewer(call, lane_child_marker.is_child_of(context.cwd, context.env)),
+  reason: REVIEWER_FOREGROUND_REASON,
+  decide: () => true,
+  keeps: (call) => is_reviewer(call) && is_foreground2(call),
+  reaches: is_reviewer,
+  rewrite: (call, _tail, context) => foreground_input(call, lane_child_marker.is_child_of(context.cwd, context.env)),
+  rewrite_note: REVIEWER_FOREGROUND_NOTE,
+  about: {
+    title: "Lane child reviewer dispatched in the foreground",
+    topic: CHAIN_RULE_STEP,
+    fires: "a dispatched lane child\u2019s `Agent` / `Task` call of the `reviewer` or `reviewer-verification` type without `run_in_background: false` \u2014 rewritten with it, every occurrence",
+    quiet: "not a lane child, another agent type, or `run_in_background: false` set"
+  }
+};
+var reviewer_foreground = {
+  REVIEWER_FOREGROUND_NOTE,
+  REVIEWER_FOREGROUND_REASON,
+  ROW: ROW35,
+  foreground_input,
+  is_background_reviewer
+};
+
+// scripts/rules/rule-body-guard.ts
+var { WRITE: WRITE2, is_edit_tool: is_edit_tool3, string_field: string_field2 } = edit_tool;
+var CLAUDE_DOCUMENT = /(?:^|\/)CLAUDE\.md$/u;
+var PROMPT_DOCUMENT = /(?:^|\/)prompts\/.+\.md$/u;
+var SKILL_DOCUMENT = /(?:^|\/)\.claude\/skills\/.+\.md$/u;
+function is_rule_document(file_path) {
+  return CLAUDE_DOCUMENT.test(file_path) || PROMPT_DOCUMENT.test(file_path) || SKILL_DOCUMENT.test(file_path);
+}
+var LINK_TARGET = /\]\([^)]*\)/gu;
+var BARE_URL = /https?:\/\/\S+/gu;
+function prose_of(text) {
+  return text.replaceAll(LINK_TARGET, "]()").replaceAll(BARE_URL, "");
+}
+var MIN_APPENDED_PROSE = 120;
+function adds_rule_prose(old_text, new_text) {
+  return prose_of(new_text).length - prose_of(old_text).length >= MIN_APPENDED_PROSE;
+}
+function read_existing(file_path) {
+  return file_reader.read_file_or_empty(file_path);
+}
+function texts_of(name, input, read) {
+  if (name === WRITE2) {
+    return {
+      old_text: read(string_field2(input, "file_path")),
+      new_text: string_field2(input, "content")
+    };
+  }
+  return {
+    old_text: string_field2(input, "old_string"),
+    new_text: string_field2(input, "new_string")
+  };
+}
+function rule_document_input(call) {
+  if (!is_edit_tool3(call.name) || !json_value.is_record(call.input)) return void 0;
+  return is_rule_document(string_field2(call.input, "file_path")) ? call.input : void 0;
+}
+function writes_rule_prose(call, read = read_existing) {
+  const input = rule_document_input(call);
+  if (input === void 0) return false;
+  const { old_text, new_text } = texts_of(call.name, input, read);
+  return adds_rule_prose(old_text, new_text);
+}
+var RULE_BODY_REASON = "\u26D4 rule written into prose: this edit adds rule text to CLAUDE.md, a `prompts/**` doc or a skill body. Answer question 0 (`pnpm josh oracle:list`) and the ordering question (`pnpm josh run:step`) of `prompts/collaboration-workflow/residency.md`; refused until both commands are on the transcript, then reissue this as a trigger-plus-pointer line (`prompts/collaboration-workflow/rule-delivery.md`).";
+var PLACEMENT_ORACLES = [
+  /* @__PURE__ */ new Set(["oracle:list"]),
+  /* @__PURE__ */ new Set(["run:step", "run:next"])
+];
+function ran_oracle(tail_commands_run, names) {
+  return tail_commands_run.some(
+    (command) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
+  );
+}
+function answered_placement(tail, _call) {
+  const commands = tail_commands.prior_bash_commands(tail);
+  return PLACEMENT_ORACLES.every((names) => ran_oracle(commands, names));
+}
+function runs_placement_oracle(command) {
+  return PLACEMENT_ORACLES.some(
+    (names) => shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, names))
+  );
+}
+var ROW36 = {
+  id: "rule-body",
+  is_trigger: writes_rule_prose,
+  reason: RULE_BODY_REASON,
+  already_satisfied: answered_placement,
+  keeps: bash_triggers.on_bash_command(runs_placement_oracle),
+  about: {
+    title: "Question 0 and the ordering question before writing a rule into prose",
+    topic: "`residency.md`",
+    fires: "an `Edit` / `Write` to `CLAUDE.md` / `prompts/**/*.md` / `.claude/skills/**/*.md` appending at least the threshold. Refused until both `pnpm josh oracle:list` and `pnpm josh run:step` ran",
+    quiet: "not a rule document, an append under the threshold (typo, link swap, deletion), or both commands ran"
+  }
+};
+var rule_body_guard = {
+  RULE_BODY_REASON,
+  ROW: ROW36,
+  answered_placement,
+  is_rule_document,
+  writes_rule_prose
+};
+
+// scripts/rules/shell-body-trigger.ts
+var FIELD_FLAGS = "(?:-f|-F|--field|--raw-field)";
+var MESSAGE_FLAGS = "(?:--body|--notify-message|--recommended|--alternative)";
+var FIELD_OPENING = String.raw`${FIELD_FLAGS}[\s=]*(?:'?body="|"body=)`;
+var MESSAGE_OPENING = String.raw`${MESSAGE_FLAGS}[\s=]+"`;
+var NESTED_SUBSTITUTION = String.raw`\$\([^()]*\)`;
+var SUBSTITUTION2 = String.raw`\$\((?:[^()$]|\$(?!\()|${NESTED_SUBSTITUTION})*\)`;
+var QUOTED_VALUE = String.raw`(?:[^"\\$]|\\.|\$(?!\()|${SUBSTITUTION2})*`;
+var INLINE_BODY_VALUE = new RegExp(
+  `(?:${FIELD_OPENING}|${MESSAGE_OPENING})(${QUOTED_VALUE})"`,
+  "gu"
+);
+var SHELL_EVALUATED = /[`$]/u;
+var WHOLE_VALUE_SUBSTITUTION = new RegExp(`^${SUBSTITUTION2}$`, "u");
+var BACKTICK = "`";
+var WHOLE_VALUE_FILE_REFERENCE = /^@\S+$/u;
+var ESCAPED_PAIR = /\\./gu;
+function is_whole_value_substitution(literal) {
+  return WHOLE_VALUE_SUBSTITUTION.test(literal) && !literal.includes(BACKTICK);
+}
+function is_body_already_in_a_file(literal) {
+  return WHOLE_VALUE_FILE_REFERENCE.test(literal) || is_whole_value_substitution(literal);
+}
+function is_evaluated_value(raw_value) {
+  const literal = raw_value.replaceAll(ESCAPED_PAIR, "");
+  if (is_body_already_in_a_file(literal)) return false;
+  return SHELL_EVALUATED.test(literal);
+}
+function is_shell_evaluated_body(command) {
+  for (const match of command.matchAll(INLINE_BODY_VALUE)) {
+    if (is_evaluated_value(match[1] ?? "")) return true;
+  }
+  return false;
+}
+var FILE_FLAG = /(?:--body-file|--notify-message-file)(?:[\s=]|$)/u;
+var FIELD_FILE_REFERENCE = new RegExp(String.raw`${FIELD_FLAGS}[\s=]*body=@\S`, "u");
+var ANSI_C_BODY = /(?:(?:--body|--notify-message)[\s=]+|body=)\$'/u;
+var DOUBLE_QUOTED_SPAN = /"[^"]*"/gu;
+var BODY_FLAG = new RegExp(
+  String.raw`${FIELD_FLAGS}[\s=]*'?"?body=|${MESSAGE_FLAGS}[\s=]|--body-file[\s=]|--notify-message-file[\s=]`,
+  "u"
+);
+var QUOTED_SPAN = /"[^"]*"|'[^']*'/gu;
+function inline_body_literals(command) {
+  return Array.from(
+    command.matchAll(INLINE_BODY_VALUE),
+    (match) => (match[1] ?? "").replaceAll(ESCAPED_PAIR, "")
+  );
+}
+function is_safe_body_form(command) {
+  if (ANSI_C_BODY.test(command.replaceAll(DOUBLE_QUOTED_SPAN, " "))) return true;
+  const flags = command.replaceAll(QUOTED_SPAN, " ");
+  if (FILE_FLAG.test(flags) || FIELD_FILE_REFERENCE.test(flags)) return true;
+  return inline_body_literals(command).some((literal) => is_body_already_in_a_file(literal));
+}
+function keeps_body_safe(command) {
+  return is_safe_body_form(command) && !is_shell_evaluated_body(command);
+}
+function carries_a_body(command) {
+  if (BODY_FLAG.test(command.replaceAll(QUOTED_SPAN, " "))) return true;
+  return inline_body_literals(command).length > 0;
+}
+var SHELL_BODY_REASON = "\u26D4 shell-evaluated body: this command carries a body inline in double quotes, and that body contains a backtick or a `$`, so the shell executes it. Reissue this call once the body is in a file, passed by path (`pnpm josh issue:comment <N> --body-file <path>`, `--notify-message-file <path>`), or use `$'\u2026'` quoting (`prompts/collaboration-workflow/shell-body.md`).";
+var shell_body_trigger = {
+  SHELL_BODY_REASON,
+  carries_a_body,
+  is_shell_evaluated_body,
+  keeps_body_safe
+};
+
+// scripts/rules/test-declared-commit.ts
+function is_untested_commit(call) {
+  if (!run_tail_rule.is_push_step_call(call)) return false;
+  return test_declared_changed.current_verdict() === "required";
+}
+var REASON = "\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads it `required` and names the files. Tests are required for ALL code changes: add the test and reissue, or, for a change that touches no runtime path, declare the non-runtime exception in your Step 0 work summary and reissue. It fires once per run (`CLAUDE.md` \u2192 Code Change Rules).";
+var ROW37 = {
+  id: "test-declared",
+  is_trigger: is_untested_commit,
+  reason: REASON,
+  about: {
+    title: "Test declaration",
+    topic: '`testing-guide.md` \u2192 "0. Per-Requirement Test Coverage (MANDATORY)"',
+    fires: "`pnpm josh git -y` (`josh g`) while `pnpm josh test:declared` answers `required`",
+    quiet: "`exempt` (non-runtime only) or `satisfied` (tests included)"
+  }
+};
+var test_declared_commit = { REASON, ROW: ROW37 };
+
+// scripts/rules/unasked-filing.ts
+import { z } from "zod";
+var FILING_WORDS = [
+  /起票/u,
+  /issue\s*[に化]/iu,
+  /\bfile (?:an? |the |this |these )?(?:issues?|it|them)\b/iu,
+  // A typed command whose procedure files: a split, a prerequisite, an upstream interrupt, a `new` form.
+  /^\/?(?:kickoff|fullrun|halfrun|prrun|backlogrun)\b/iu
+];
+var AFFIRMATIVE = /^(?:はい|うん|お願い|どうぞ|進めて|yes|ok|okay|sure|please do|go ahead)/iu;
+var SHORT_REPLY = 40;
+var PROPOSALS = [
+  /起票(?:しますか|しましょうか|してよい|して良い|してもよい)/u,
+  /issue\s*に(?:しますか|しましょうか)/iu,
+  /\b(?:shall|should) I file\b/iu,
+  /\bfile (?:an? |this as an? |it as an? )?issues?\?/iu
+];
+var ASSISTANT_LINE_SCHEMA = z.object({
+  type: z.literal("assistant"),
+  message: z.object({ content: z.unknown() })
+});
+var CHECK_FLAG = /\s--check\b/u;
+var QUOTED = /"[^"]*"|'[^']*'/gu;
+var UNASKED_FILING_REASON = "\u26D4 unasked filing: this interactive session files an Issue only on the person\u2019s explicit instruction (\u300C\u8D77\u7968\u300D, \u201Cfile an issue\u201D, or a command whose procedure files, such as `kickoff new`). Propose the Issue in the reply and file it once they confirm. It fires on every occurrence (`.claude/skills/workflow-commands/observation-filing.md`).";
+function is_instructed(prompt) {
+  const trimmed = issue_citation.prose_lines(prompt).join("\n").replaceAll(/(?<!`)(`+)(?!`)[\s\S]*?(?<!`)\1(?!`)/gu, "").replaceAll(/「[^「」\n]*」|『[^『』\n]*』|"[^"\n]*"|'[^'\n]*'/gu, "").trim();
+  return FILING_WORDS.some((pattern) => pattern.test(trimmed));
+}
+function reply_text(line) {
+  const parsed = ASSISTANT_LINE_SCHEMA.safeParse(
+    json_value.parse_or_undefined(codex_prompt.normalize(line))
+  );
+  return parsed.success ? time_reported_failure.result_text(parsed.data.message.content) : "";
+}
+function is_person_line(line) {
+  return last_prompt.person_prompt(line) !== void 0;
+}
+function reply_before_prompt(tail) {
+  const lines = tail.split("\n");
+  const prompt_at = lines.findLastIndex((line) => is_person_line(line));
+  const replies = lines.slice(0, Math.max(prompt_at, 0)).map((line) => reply_text(line));
+  return replies.findLast((text) => text !== "") ?? "";
+}
+function is_confirmed(prompt, tail) {
+  const trimmed = prompt.trim();
+  if (trimmed.length > SHORT_REPLY || !AFFIRMATIVE.test(trimmed)) return false;
+  const reply = reply_before_prompt(tail);
+  return PROPOSALS.some((pattern) => pattern.test(reply));
+}
+function is_asked(tail) {
+  const prompt = last_prompt.person_prompt(tail) ?? "";
+  return is_instructed(prompt) || is_confirmed(prompt, tail);
+}
+function is_run_parent(context) {
+  const repository = git_common_directory.repository(context.cwd);
+  if (repository === void 0) return false;
+  const read = run_carry.read_carry(run_carry.carry_path(repository));
+  return run_headless.driven_here(read, context.ancestry) !== void 0;
+}
+function is_unattended(context) {
+  const { env } = context;
+  if (agent_headless.is_headless(env) || run_headless.is_headless(env)) return true;
+  return lane_child_marker.marked_issue(env) !== void 0 || is_run_parent(context);
+}
+function is_writing_segment(segment) {
+  if (!bash_triggers.is_issue_filing_segment(segment)) return false;
+  return !CHECK_FLAG.test(segment.replaceAll(QUOTED, ""));
+}
+function is_writing_filing(command) {
+  return shell_segments.segments_of(command).some((segment) => is_writing_segment(segment));
+}
+function is_unasked_filing(call, context) {
+  if (!bash_triggers.on_bash_command(is_writing_filing)(call)) return false;
+  return !is_unattended(context);
+}
+var ROW38 = {
+  id: "unasked-filing",
+  is_trigger: is_unasked_filing,
+  reason: UNASKED_FILING_REASON,
+  already_satisfied: is_asked,
+  decide: () => true,
+  about: {
+    title: "Unasked filing",
+    topic: "`.claude/skills/workflow-commands/observation-filing.md`",
+    fires: "an interactive session\u2019s `pnpm josh issue:file` when the person\u2019s last prompt asks for no filing; it hands over propose-then-file. Every occurrence",
+    quiet: "an unattended run (a kit-launched or headless session, a lane child, the `backlogrun` parent), `--check`, or a prompt that asks for filing"
+  }
+};
+var unasked_filing = { ROW: ROW38, is_unasked_filing };
+
+// scripts/rules/delivered-rules.ts
+var PRETOOL_GUARD = "pnpm josh pretool:guard";
+var { is_issue_filing, on_bash_command } = bash_triggers;
+var { SHELL_BODY_REASON: SHELL_BODY_REASON2, carries_a_body: carries_a_body2, is_shell_evaluated_body: is_shell_evaluated_body2, keeps_body_safe: keeps_body_safe2 } = shell_body_trigger;
+var DELIVERED_RULES = [
+  // First: a third-party write is stopped before the first-party filing rows count anything.
+  third_party_write.ROW,
+  // Before every first-party row: a credential is refused whatever the call's other faults, and the
+  // commands those rows point at run the same scan in-process.
+  credential_body.ROW,
+  // The direct call only. The filing cap, the WIP cap and the fold question are `issue:file`'s own
+  // steps, so no row gates them.
+  direct_filing.ROW,
+  // An interactive session's `issue:file` the person did not ask for; unattended runs never fire it.
+  unasked_filing.ROW,
+  // Before the body rows: a comment posted by hand is refused whatever its body, and the command it
+  // points at takes the body by path, so the body rows have nothing left to say.
+  direct_issue_comment.ROW,
+  // Before `issue-comments`, whose rewrite would add the unfiltered comments to the same read.
+  direct_issue_read.ROW,
+  issue_comments.ROW,
+  {
+    id: "shell-body",
+    is_trigger: on_bash_command(is_shell_evaluated_body2),
+    reason: SHELL_BODY_REASON2,
+    keeps: on_bash_command(keeps_body_safe2),
+    reaches: on_bash_command(carries_a_body2),
+    about: {
+      title: "No body on the shell",
+      topic: "`shell-body.md`",
+      fires: 'a double-quoted body value (`-f body="\u2026"` / `-f "body=\u2026"` / `--body "\u2026"` / `--notify-message "\u2026"`) carrying a backtick or `$`',
+      quiet: "the shell does not evaluate the body"
+    }
+  },
+  raw_field_body.ROW,
+  // Before `piped-verification`, whose rewrite would run under `pipefail` a check that must not run.
+  round_one_check_related.ROW,
+  repeat_check_related.ROW,
+  {
+    id: "piped-verification",
+    is_trigger: on_bash_command(piped_verification.is_masked_verification),
+    reason: piped_verification.PIPED_VERIFICATION_REASON,
+    keeps: on_bash_command(piped_verification.keeps_verdict_intact),
+    reaches: on_bash_command(piped_verification.runs_verification),
+    // A masking whose filter reads to the end is rewritten under `pipefail`, never refused.
+    rewrite: piped_verification.pipefail_input,
+    rewrite_note: piped_verification.PIPEFAIL_NOTE,
+    about: {
+      title: "Piped verification",
+      topic: "`output-bounds.md`",
+      fires: "a pass/fail josh check (`gate` / `check*` / `lint*` / `cspell*` / `test*` / `eval` / `overrides` / `ranges`) in front of a pipe \u2014 rewritten under `set -o pipefail` when every filter reads to the end (`tail`, a full-reading `grep`, `cut`, `sort`, `uniq`, `wc`, `tee`, an `awk` / `sed` that cannot exit early and carries no `<` / `>` / `&`), refused otherwise",
+      quiet: "the exit code reaches the caller \u2014 a failure reads as a failure"
+    }
+  },
+  {
+    id: "early-heartbeat",
+    is_trigger: on_bash_command(early_heartbeat.is_wait_timer),
+    reason: early_heartbeat.EARLY_HEARTBEAT_REASON,
+    decide: early_heartbeat.decide,
+    keeps: on_bash_command(early_heartbeat.is_progress_watch),
+    reaches: on_bash_command(early_heartbeat.waits_for_progress),
+    about: {
+      title: "Early progress report",
+      topic: '`.claude/skills/workflow-commands/progress-watcher.md` \u2192 "Progress while the run is quiet"',
+      fires: "a `Bash` whose only purpose is waiting (`sleep` alone, or `echo` / `:` / `date`) while a timer is live or before the interval. Every occurrence",
+      quiet: "no hand-made wait timer \u2014 `run:progress` holds the one clock"
+    }
+  },
+  // Before `run-tail`: whether to commit at all is decided before how to push.
+  test_declared_commit.ROW,
+  // Before `run-tail`, so a lane child goes straight to `ship --detach` instead of through both.
+  lane_background.ROW,
+  run_tail_rule.ROW,
+  // Reads the lane name and the cut record. Once per run, not `decide`: taking the cut ends the
+  // process, and the verdicts that leave a run at the gate all need the reissue through. `reaches`
+  // tells the cutting run from the resumed one by the run's calls. Overlaps `piped-verification`
+  // safely: that row speaks first and this one delivers on the reissue.
+  {
+    id: "pre-gate-cut",
+    is_trigger: on_bash_command(pre_gate_cut.is_uncut_gate_in),
+    reason: pre_gate_cut.PRE_GATE_CUT_REASON,
+    keeps: on_bash_command(pre_gate_cut.takes_the_cut),
+    reaches: pre_gate_cut.reaches_the_pre_gate_boundary,
+    about: {
+      title: "The cut before the gate",
+      topic: "`.claude/skills/workflow-commands/pre-gate-cut.md`",
+      fires: "`pnpm josh gate` (`josh ga`) in a lane work tree whose `JOSH_LANE_CHILD` names the Issue and has no cut record",
+      quiet: "outside a lane, no marker (a person in the lane), or already cut"
+    }
+  },
+  // A split child's park is refused before `lane-park` sees it.
+  lane_split_park.ROW,
+  lane_park.ROW,
+  lane_interactive_ask.ROW,
+  agent_model.ROW,
+  investigator_foreground.ROW,
+  reviewer_foreground.ROW,
+  // After `agent-model`, its one overlap (an unnamed `general-purpose` on Fable): `model` fixes both.
+  consultation_investigation.ROW,
+  consultation_investigation.CODEX_ROW,
+  consultation_handoff.ROW,
+  lane_carry_conflict.ROW,
+  lane_switch_main.ROW,
+  // Before `timed-rerun` and `lane-direct-tool`, its overlaps (a timed or lane `vitest run`):
+  // `test:related` replaces the direct run, so neither the record nor the reservation comes first. A lane
+  // child's plain `vitest run` never reaches this order: `lane-direct-tool`'s rewrite runs before
+  // judgment (`rule-rewrite.ts`), and this row is silent on the `reserved-run` it produces.
+  direct_vitest_run.ROW,
+  // Before `lane-direct-tool`, its one overlap (a timed tool in a lane): the record is the right first
+  // act, and `lane-direct-tool` delivers on the reissue of a `time`-prefixed tool.
+  timed_rerun.ROW,
+  lane_direct_tool.ROW,
+  lane_spilled_read.ROW,
+  // Disjoint from `run-tail` by the `-y` flag.
+  josh_git_bare.ROW,
+  // The Bash-string gaps the deny glob cannot express, read by argv; `delivered-rules-bash.test.ts`
+  // pins that no two rows claim one command.
+  git_force.ROW,
+  worktree_guard.ROW,
+  ...file_edit_rows.SHELL_ROWS,
+  ...permission_guards.ROWS,
+  poll_loop.ROW,
+  // After the safety rows: a harmless read is steered only once nothing on the line is refused.
+  direct_git_status.ROW,
+  // Before `rule-body`, its one overlap: the cut is the right first act, and `rule-body` delivers on
+  // the reissue in the fresh process.
+  implementation_cut.ROW,
+  // Before `rule-body`, its one overlap (a whole-file `Write` of a rule document): the right tool is
+  // chosen before the placement questions are asked of its text.
+  file_edit_rows.REWRITE_ROW,
+  delivered_rules_guard.call_only(rule_body_guard.ROW),
+  ...oracle_consulted.ROWS
+];
+var ALONE_IN_TURN = 1;
+function batches_the_turn(call, turn) {
+  return time_batch_guard.is_guarded_call(call) && turn.length > ALONE_IN_TURN;
+}
+var BATCHING_RULE = {
+  id: "batching",
+  reason: time_batch_guard.REASON,
+  keeps: batches_the_turn,
+  reaches: time_batch_guard.is_guarded_call,
+  about: {
+    title: "Turn batching",
+    topic: "`turn-batching.md`",
+    fires: "the `Bash` / `Edit` / `Read` after three single-call turns in a row; fires **again** every three more such turns",
+    quiet: "calls per round trip above the floor"
+  }
+};
+function is_investigation_read(call) {
+  return investigation_reads.is_refusable_call(call);
+}
+var INVESTIGATION_RULE = {
+  id: "investigation",
+  reason: investigation_reads.REASON,
+  reaches: is_investigation_read,
+  about: {
+    title: "Investigation delegation threshold",
+    topic: "`delegation.md`",
+    fires: "the `Read` / `Bash` that makes the third read of a file the run will not edit; fires **again** once reads pile up to the threshold again",
+    quiet: "reads under the threshold \u2014 nothing to delegate yet"
+  }
+};
+var MEASURED_RULES = [
+  ...DELIVERED_RULES,
+  BATCHING_RULE,
+  INVESTIGATION_RULE,
+  // Delivered by `stop:guard`; listed here so `rule:value` counts its refusals.
+  concise_reply.ROW
+];
+var { SWITCH_ENV_KEY: SWITCH_ENV_KEY4, guard_of: guard_of2 } = delivered_rules_guard;
+var GUARDS = new Map(DELIVERED_RULES.map((rule) => [rule.id, guard_of2(rule)]));
+function delivery_path(rule_id, transcript_path) {
+  return GUARDS.get(rule_id)?.refusal_path(transcript_path) ?? "";
+}
+function delivery(raw_payload, now_ms = Date.now(), context = hook_context.from_process()) {
+  for (const guard of GUARDS.values()) {
+    const reason2 = guard.refusal(raw_payload, now_ms, context);
+    if (reason2 !== void 0) return reason2;
+  }
+  return void 0;
+}
+function is_enabled3() {
+  return hook_decision.is_switch_enabled(SWITCH_ENV_KEY4);
+}
+var delivered_rules = {
+  DELIVERED_RULES,
+  EARLY_HEARTBEAT_REASON: early_heartbeat.EARLY_HEARTBEAT_REASON,
+  FILE_BODY_REASON: file_edit_rows.FILE_BODY_REASON,
+  DIRECT_FILING_REASON: direct_filing.DIRECT_FILING_REASON,
+  GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
+  ISSUE_COMMENTS_REASON: issue_comments.ISSUE_COMMENTS_REASON,
+  LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,
+  LANE_PARK_REASON: lane_park.LANE_PARK_REASON,
+  MEASURED_RULES,
+  PIPED_VERIFICATION_REASON: piped_verification.PIPED_VERIFICATION_REASON,
+  POLL_LOOP_REASON: poll_loop.POLL_LOOP_REASON,
+  PRE_GATE_CUT_REASON: pre_gate_cut.PRE_GATE_CUT_REASON,
+  PRETOOL_GUARD,
+  RAW_FIELD_BODY_REASON: raw_field_body.RAW_FIELD_BODY_REASON,
+  RUN_TAIL_REASON: run_tail_rule.RUN_TAIL_REASON,
+  SHELL_BODY_REASON: SHELL_BODY_REASON2,
+  SWITCH_ENV_KEY: SWITCH_ENV_KEY4,
+  THIRD_PARTY_WRITE_REASON: third_party_write.THIRD_PARTY_WRITE_REASON,
+  WORKTREE_MUTATION_REASON: worktree_guard.WORKTREE_MUTATION_REASON,
+  delivery,
+  delivery_path,
+  is_body_only_issue_read: issue_comments.is_body_only_issue_read,
+  is_enabled: is_enabled3,
+  is_issue_filing
+};
+
+export {
+  investigation_outcome,
+  batch_outcome,
+  nested_commands,
+  piped_verification,
+  delivered_rules
+};