@joshuafolkken/kit 1.872.0

package/dist/hooks/chunk-3EJBTWVS.js

@@ -0,0 +1,1769 @@
+import {
+  git_utilities,
+  lane_park,
+  run_cut,
+  shell_segments
+} from "./chunk-33ELOKEV.js";
+import {
+  batch_outcome
+} from "./chunk-BVNWORKA.js";
+import {
+  investigation_reads,
+  investigation_refusal
+} from "./chunk-MK56LKDO.js";
+import {
+  lane_guard_policy,
+  time_batch_guard
+} from "./chunk-ARN7NCQI.js";
+import {
+  hook_decision,
+  lane_child_marker
+} from "./chunk-VEZVK6C7.js";
+import {
+  cost_blocks,
+  json_value,
+  lane_paths,
+  stamp_file,
+  time_density_hook,
+  time_shell,
+  time_transcript_line
+} from "./chunk-5P7VF5VE.js";
+
+// scripts/hooks/pretool-guard.ts
+import { text } from "node:stream/consumers";
+import { fileURLToPath } from "node:url";
+
+// scripts/rules/bash-triggers.ts
+function on_bash_command(is_match) {
+  return function is_trigger(call) {
+    if (call.name !== cost_blocks.BASH_TOOL) return false;
+    return is_match(time_shell.bash_command(call.input));
+  };
+}
+var ISSUE_CREATE_COMMAND = /\bgh\s+(?:\S+\s+)*?issue\s+create\b/u;
+var ISSUES_ENDPOINT = /repos\/[^\s'"]*\/issues(?=$|["'\s])/u;
+var TITLE_FIELD = /(?:-f|-F|--field|--raw-field)\s*'?title=/u;
+function is_issue_filing(command) {
+  if (ISSUE_CREATE_COMMAND.test(command)) return true;
+  return ISSUES_ENDPOINT.test(command) && TITLE_FIELD.test(command);
+}
+var bash_triggers = { is_issue_filing, on_bash_command };
+
+// scripts/run/run-progress.ts
+var DEFAULT_INTERVAL_MINUTES = 20;
+var INTERVAL_KEY = "JOSH_PROGRESS_INTERVAL_MINUTES";
+var MS_PER_MINUTE = 6e4;
+var MS_PER_SECOND = 1e3;
+var DEFAULT_INTERVAL_MS = DEFAULT_INTERVAL_MINUTES * MS_PER_MINUTE;
+var NO_LANES = "none";
+var NO_CHILD_YET = "no in-progress child yet";
+var NO_NEXT = "none";
+var QUIET_MARKER = "\u23F3";
+var STAMP_END = 16;
+var PAD_WIDTH = 2;
+var MINUTES_PER_HOUR = 60;
+function to_minutes(elapsed_ms) {
+  return Math.floor(elapsed_ms / MS_PER_MINUTE);
+}
+function format_minutes(elapsed_ms) {
+  return `${String(to_minutes(elapsed_ms))}m`;
+}
+function pad(value) {
+  return String(value).padStart(PAD_WIDTH, "0");
+}
+function offset_minutes(date) {
+  return Math.round(-date.getTimezoneOffset());
+}
+function format_offset(total_minutes) {
+  const sign = total_minutes < 0 ? "-" : "+";
+  const absolute = Math.abs(total_minutes);
+  return `${sign}${pad(Math.floor(absolute / MINUTES_PER_HOUR))}:${pad(absolute % MINUTES_PER_HOUR)}`;
+}
+function format_observed_at(now_ms) {
+  const minutes = offset_minutes(new Date(now_ms));
+  const local = new Date(now_ms + minutes * MS_PER_MINUTE);
+  const day = `${String(local.getUTCFullYear())}-${pad(local.getUTCMonth() + 1)}-${pad(local.getUTCDate())}`;
+  const clock = `${pad(local.getUTCHours())}:${pad(local.getUTCMinutes())}${format_offset(minutes)}`;
+  return `${day} ${clock} / ${new Date(now_ms).toISOString().slice(0, STAMP_END)}Z`;
+}
+function observation_key(observations) {
+  return JSON.stringify({ children: observations.children, lanes: observations.lanes });
+}
+function next_state(previous, key, now_ms) {
+  if (previous?.key === key) return previous;
+  return { key, unchanged_since_ms: now_ms };
+}
+function format_child(child) {
+  const labels = child.labels.length > 0 ? child.labels.join(",") : "(no labels)";
+  return `#${child.issue} ${labels} PR:${child.pr_state}`;
+}
+function format_children(children) {
+  if (children.length === 0) return NO_CHILD_YET;
+  return children.map((child) => format_child(child)).join(" \xB7 ");
+}
+function format_lanes(lanes) {
+  if (lanes.length === 0) return NO_LANES;
+  return lanes.map((lane) => `${lane.issue}:${lane.state}`).join(" ");
+}
+function format_record(record_age_ms) {
+  return record_age_ms === void 0 ? "unread" : `+${format_minutes(record_age_ms)}`;
+}
+function format_next_report(now_ms, interval_ms) {
+  return format_observed_at(now_ms + interval_ms);
+}
+function format_next_line(next) {
+  return `next ${next ?? NO_NEXT}`;
+}
+function format_report(fields) {
+  return [
+    `${QUIET_MARKER} at ${fields.observed_at}`,
+    `quiet ${fields.quiet} \xB7 unchanged ${fields.unchanged}`,
+    `children ${fields.children}`,
+    `lanes ${fields.lanes} \xB7 load ${fields.load} \xB7 record ${fields.record}`,
+    format_next_line(fields.next)
+  ].join("\n");
+}
+function format_line(observations, timing) {
+  return format_report({
+    observed_at: format_observed_at(timing.now_ms),
+    quiet: format_minutes(timing.now_ms - timing.quiet_since_ms),
+    unchanged: format_minutes(timing.now_ms - timing.unchanged_since_ms),
+    children: format_children(observations.children),
+    lanes: format_lanes(observations.lanes),
+    load: observations.load_average.toFixed(1),
+    record: format_record(observations.record_age_ms),
+    next: format_next_report(timing.now_ms, timing.interval_ms)
+  });
+}
+function is_due(last_report_ms, now_ms, interval_ms) {
+  return now_ms - last_report_ms >= interval_ms;
+}
+function minutes_from(raw) {
+  const minutes = Number(raw);
+  if (raw === void 0 || raw.trim() === "" || !Number.isFinite(minutes) || minutes <= 0) {
+    return void 0;
+  }
+  return minutes;
+}
+var run_progress = {
+  DEFAULT_INTERVAL_MINUTES,
+  DEFAULT_INTERVAL_MS,
+  INTERVAL_KEY,
+  MS_PER_MINUTE,
+  MS_PER_SECOND,
+  NO_CHILD_YET,
+  NO_NEXT,
+  format_child,
+  format_children,
+  format_lanes,
+  format_line,
+  format_next_line,
+  format_next_report,
+  format_record,
+  format_report,
+  is_due,
+  minutes_from,
+  next_state,
+  observation_key
+};
+
+// scripts/run/run-progress-clock.ts
+import { execaSync } from "execa";
+import { z } from "zod";
+var PROGRESS_PREFIX = "josh-run-progress-";
+var LIFE_PREFIX = "josh-run-progress-life-";
+var LOG_SUFFIX = ".log";
+var LOG_KEEP = 12;
+var MS_PER_MINUTE2 = 6e4;
+var LOG_STALE_MINUTES = 90;
+var LOG_STALE_MS = LOG_STALE_MINUTES * MS_PER_MINUTE2;
+var BLOCK_SEPARATOR = "\n\n";
+var GIT_TIMEOUT_MS = 5e3;
+var GIT_DIRECTORY_ARGUMENTS = ["rev-parse", "--absolute-git-dir"];
+var report_stamp_schema = z.object({ reported_at: z.string(), line: z.string().optional() });
+function parse_stamp(raw) {
+  const parsed = report_stamp_schema.safeParse(JSON.parse(raw));
+  if (!parsed.success) return void 0;
+  const reported_at = Date.parse(parsed.data.reported_at);
+  return Number.isNaN(reported_at) ? void 0 : reported_at;
+}
+function read_last_line(target) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return void 0;
+  try {
+    return report_stamp_schema.safeParse(JSON.parse(raw)).data?.line;
+  } catch {
+    return void 0;
+  }
+}
+function read_last_report(target) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return void 0;
+  try {
+    return parse_stamp(raw);
+  } catch {
+    return void 0;
+  }
+}
+function log_path_of(target) {
+  return `${target}${LOG_SUFFIX}`;
+}
+function is_log_stale(target, now_ms) {
+  const previous_ms = read_last_report(target);
+  return previous_ms === void 0 || now_ms - previous_ms > LOG_STALE_MS;
+}
+function recent_blocks(log_target, is_fresh) {
+  if (is_fresh) return [];
+  const raw = stamp_file.read_stamp_text(log_target);
+  if (raw === void 0) return [];
+  return raw.split(BLOCK_SEPARATOR).map((block) => block.trimEnd()).filter((block) => block.length > 0);
+}
+function append_line(log_target, reported_at, line, is_fresh) {
+  const block = `${reported_at}
+${line}`;
+  const blocks = [...recent_blocks(log_target, is_fresh), block].slice(-LOG_KEEP);
+  stamp_file.write_text_stamp(log_target, `${blocks.join(BLOCK_SEPARATOR)}
+`);
+}
+function mark(target, now_ms, line) {
+  const reported_at = new Date(now_ms).toISOString();
+  const kept = line ?? read_last_line(target);
+  if (line !== void 0) {
+    append_line(log_path_of(target), reported_at, line, is_log_stale(target, now_ms));
+  }
+  stamp_file.write_stamp(target, kept === void 0 ? { reported_at } : { reported_at, line: kept });
+}
+function stamp_target_of(git_directory) {
+  return stamp_file.stamp_path(PROGRESS_PREFIX, git_directory);
+}
+function life_target_of(git_directory) {
+  return stamp_file.stamp_path(LIFE_PREFIX, git_directory);
+}
+var life_schema = z.object({ alive: z.literal(true), pinged_at: z.string().optional() });
+function begin_life(target) {
+  stamp_file.write_stamp(target, { alive: true, pinged_at: (/* @__PURE__ */ new Date()).toISOString() });
+}
+function ping_life(target) {
+  begin_life(target);
+}
+function parse_pinged_at(raw) {
+  const parsed = life_schema.safeParse(JSON.parse(raw));
+  if (!parsed.success || parsed.data.pinged_at === void 0) return void 0;
+  const pinged_ms = Date.parse(parsed.data.pinged_at);
+  return Number.isNaN(pinged_ms) ? void 0 : pinged_ms;
+}
+function is_life_fresh(target, threshold_ms) {
+  const raw = stamp_file.read_stamp_text(target);
+  if (raw === void 0) return false;
+  try {
+    const pinged_ms = parse_pinged_at(raw);
+    return pinged_ms !== void 0 && Date.now() - pinged_ms < threshold_ms;
+  } catch {
+    return false;
+  }
+}
+function is_life_ended(target) {
+  return stamp_file.read_stamp_text(target) === void 0;
+}
+function end_life(target) {
+  stamp_file.remove_stamp(target);
+}
+function git_directory_sync() {
+  const git_binary = git_utilities.get_git_command_for_spawn();
+  const result = execaSync(git_binary, GIT_DIRECTORY_ARGUMENTS, {
+    reject: false,
+    timeout: GIT_TIMEOUT_MS
+  });
+  if (result.exitCode !== 0) return void 0;
+  const output = result.stdout.trim();
+  return output === "" ? void 0 : output;
+}
+function stamp_target_sync() {
+  const directory = git_directory_sync();
+  return directory === void 0 ? void 0 : stamp_target_of(directory);
+}
+function read_last_report_sync() {
+  const target = stamp_target_sync();
+  return target === void 0 ? void 0 : read_last_report(target);
+}
+var run_progress_clock = {
+  LIFE_PREFIX,
+  LOG_KEEP,
+  LOG_STALE_MS,
+  PROGRESS_PREFIX,
+  append_line,
+  begin_life,
+  end_life,
+  is_life_ended,
+  is_life_fresh,
+  life_target_of,
+  log_path_of,
+  mark,
+  parse_stamp,
+  ping_life,
+  read_last_line,
+  read_last_report,
+  read_last_report_sync,
+  stamp_target_of,
+  stamp_target_sync
+};
+
+// scripts/run/run-progress-config.ts
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { z as z2 } from "zod";
+var PACKAGE_FILE = "package.json";
+var CONFIG_FIELD = "josh";
+var INTERVAL_FIELD = "progress_interval_minutes";
+var MAX_DEPTH = 10;
+var package_schema = z2.object({
+  josh: z2.object({ progress_interval_minutes: z2.number().positive() }).optional()
+});
+function ancestors_of(start) {
+  const directories = [];
+  let current = path.resolve(start);
+  while (directories.length < MAX_DEPTH && !directories.includes(current)) {
+    directories.push(current);
+    current = path.dirname(current);
+  }
+  return directories;
+}
+function read_declared_minutes(directory) {
+  try {
+    const raw = readFileSync(path.join(directory, PACKAGE_FILE), "utf8");
+    const parsed = package_schema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data.josh?.progress_interval_minutes : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function read_package_minutes(start) {
+  for (const directory of ancestors_of(start)) {
+    const minutes = read_declared_minutes(directory);
+    if (minutes !== void 0) return minutes;
+  }
+  return void 0;
+}
+function to_ms(minutes) {
+  return minutes === void 0 ? void 0 : minutes * run_progress.MS_PER_MINUTE;
+}
+function resolve_interval_ms(raw, directory = process.cwd()) {
+  return to_ms(run_progress.minutes_from(raw)) ?? to_ms(run_progress.minutes_from(process.env[run_progress.INTERVAL_KEY])) ?? to_ms(read_package_minutes(directory)) ?? run_progress.DEFAULT_INTERVAL_MS;
+}
+function configured_interval_ms(directory = process.cwd()) {
+  return resolve_interval_ms(void 0, directory);
+}
+var run_progress_config = {
+  CONFIG_FIELD,
+  INTERVAL_FIELD,
+  PACKAGE_FILE,
+  configured_interval_ms,
+  read_package_minutes,
+  resolve_interval_ms
+};
+
+// scripts/rules/early-heartbeat.ts
+var ARM_PREFIX = "josh-heartbeat-arm-";
+var SEGMENT_SEPARATOR = /&&|\|\||;|&|\n/u;
+var SLEEP_SEGMENT = /^sleep\s+(\d+(?:\.\d+)?)([smhd]?)$/u;
+var INERT_SEGMENT = /^(?::|true|(?:echo|printf|date)\b.*)$/u;
+var LOOP_KEYWORD = /\b(?:while|until|for|do|done)\b/u;
+var SECONDS_PER_UNIT = { d: 86400, h: 3600, m: 60, s: 1 };
+var BARE_NUMBER_SECONDS = 1;
+var AMOUNT_GROUP = 1;
+var UNIT_GROUP = 2;
+var NO_SECONDS = 0;
+var ARM_RECORD = hook_decision.create_refusal_stamp(ARM_PREFIX);
+function segments_of(command) {
+  return command.split(SEGMENT_SEPARATOR).map((segment) => segment.trim()).filter((segment) => segment !== "");
+}
+function sleep_seconds(segment) {
+  const matched = SLEEP_SEGMENT.exec(segment);
+  if (matched === null) return void 0;
+  const unit = matched[UNIT_GROUP] ?? "";
+  return Number(matched[AMOUNT_GROUP]) * (SECONDS_PER_UNIT[unit] ?? BARE_NUMBER_SECONDS);
+}
+function is_wait_or_inert(segment) {
+  return sleep_seconds(segment) !== void 0 || INERT_SEGMENT.test(segment);
+}
+function is_wait_timer(command) {
+  if (LOOP_KEYWORD.test(command)) return false;
+  const segments = segments_of(command);
+  if (segments.every((segment) => sleep_seconds(segment) === void 0)) return false;
+  return segments.every((segment) => is_wait_or_inert(segment));
+}
+function wait_duration_ms(command) {
+  const seconds = segments_of(command).reduce(
+    (total, segment) => total + (sleep_seconds(segment) ?? NO_SECONDS),
+    NO_SECONDS
+  );
+  return seconds * run_progress.MS_PER_SECOND;
+}
+function is_armed(target, now_ms) {
+  return now_ms < ARM_RECORD.last_ms(target);
+}
+function landing_ms(command, now_ms, last_report_ms) {
+  const interval_ms = run_progress_config.configured_interval_ms();
+  const duration_ms = wait_duration_ms(command);
+  if (duration_ms > interval_ms) return void 0;
+  const lands_ms = now_ms + duration_ms;
+  return run_progress.is_due(last_report_ms, lands_ms, interval_ms) ? lands_ms : void 0;
+}
+function decide(call, run, can_record) {
+  const last_report_ms = run_progress_clock.read_last_report_sync();
+  if (last_report_ms === void 0) return false;
+  const target = ARM_RECORD.path(run.transcript);
+  if (is_armed(target, run.now_ms)) return true;
+  const lands_ms = landing_ms(time_shell.bash_command(call.input), run.now_ms, last_report_ms);
+  if (lands_ms === void 0) return true;
+  if (can_record) ARM_RECORD.record(target, lands_ms);
+  return false;
+}
+var EARLY_HEARTBEAT_REASON = '\u26D4 early heartbeat: this call arms a wait timer of its own, and the progress clock is not yours to keep. `pnpm josh run:progress --wait` waits the interval out for you (`JOSH_PROGRESS_INTERVAL_MINUTES`, or `josh.progress_interval_minutes` in `package.json`, default 20 minutes), prints the five labelled lines and exits \u2014 start it in the background, relay the lines it printed when it exits, and start the next one. Two timers armed at once is what produced reports 3\u20135 minutes apart on a 15-minute setting (joshuafolkken/kit#1570): a new one was armed on the turn a timer fired and again on the turn a child\'s completion woke the run, and `--mark` recorded each report without anything refusing the early ones. **An explicit ask is not a heartbeat**: if the person asked for progress now, run `pnpm josh run:progress --once`, which prints the five labelled lines whatever the clock says. If you are waiting on something rather than on a clock, wait on the thing itself \u2014 `pnpm josh followup` waits for CI. The procedure is `.claude/skills/workflow-commands/backlogrun.md` \u2192 "Progress while the run is quiet". **This rule fires on every early arm, not once per run**, so reissuing the same sleep will be refused again.';
+var PROGRESS_NAMES = /* @__PURE__ */ new Set(["run:progress"]);
+var WATCH_FLAG = /(?:^|\s)--(?:wait|once)(?=\s|$)/u;
+function is_progress_watch_segment(segment) {
+  return shell_segments.is_josh_command(segment, PROGRESS_NAMES) && WATCH_FLAG.test(segment);
+}
+function is_progress_watch(command) {
+  return segments_of(time_shell.unquoted(command)).some(
+    (segment) => is_progress_watch_segment(segment)
+  );
+}
+function waits_for_progress(command) {
+  return is_wait_timer(command) || is_progress_watch(command);
+}
+var early_heartbeat = {
+  ARM_PREFIX,
+  EARLY_HEARTBEAT_REASON,
+  decide,
+  is_progress_watch,
+  is_wait_timer,
+  wait_duration_ms,
+  waits_for_progress
+};
+
+// scripts/rules/file-body.ts
+import { existsSync } from "node:fs";
+var HEREDOC = /<<-?\s*['"]?\w+/u;
+var LINE_BREAK = "\n";
+function first_line(command) {
+  const [line] = command.split(LINE_BREAK);
+  return line ?? "";
+}
+function has_heredoc(command) {
+  return HEREDOC.test(command);
+}
+var FILE_REDIRECT = /(?:^|\s)>>?\s*(?!&)("[^"]+"|'[^']+'|\S+)/u;
+var TEE_TARGET = /\btee\s+(?:-a\s+)?(?!-)("[^"]+"|'[^']+'|\S+)/u;
+var QUOTES = /^['"]|['"]$/gu;
+function redirect_target(line) {
+  const target = FILE_REDIRECT.exec(line)?.[1] ?? TEE_TARGET.exec(line)?.[1];
+  return target === void 0 ? void 0 : target.replaceAll(QUOTES, "");
+}
+function writes_existing_file(command, has_file) {
+  if (!has_heredoc(command)) return false;
+  const target = redirect_target(first_line(command));
+  return target !== void 0 && has_file(target);
+}
+var BODY_INTERPRETERS = /* @__PURE__ */ new Set(["python", "python3", "ruby", "perl", "php"]);
+var NODE = "node";
+var NODE_EVAL = /(?:^|\s)(?:-e|--eval)\b/u;
+var WRITE_CALL = /writeFile|appendFile|createWriteStream|\.write(?:lines)?\s*\(/u;
+var WRITE_MODE = /open\s*\([^)]*['"][rbt+]*[wax]|os\.replace|shutil\.(?:copy|move)/u;
+function body_writes(command) {
+  return WRITE_CALL.test(command) || WRITE_MODE.test(command);
+}
+function is_interpreter_write(segment, command) {
+  const leading = time_shell.leading_word(segment);
+  if (BODY_INTERPRETERS.has(leading)) return has_heredoc(command) && body_writes(command);
+  return leading === NODE && NODE_EVAL.test(segment) && body_writes(segment);
+}
+var PERL = "perl";
+var PERL_IN_PLACE = /^-[A-Za-z0-9]*i/u;
+var WHITESPACE = /\s+/u;
+function is_in_place_perl(segment) {
+  if (time_shell.leading_word(segment) !== PERL) return false;
+  return segment.split(WHITESPACE).some((word) => PERL_IN_PLACE.test(word));
+}
+function has_body_interpreter(command) {
+  return shell_segments.segments_of(first_line(command)).some((segment) => is_interpreter_write(segment, command) || is_in_place_perl(segment));
+}
+function carries_a_file_body(command, has_file = existsSync) {
+  return writes_existing_file(command, has_file) || has_body_interpreter(command);
+}
+var FILE_BODY_REASON = "\u26D4 file body in a shell command: this carries a file's new text inline \u2014 a heredoc rewriting an existing file, an interpreter (`python3 - <<`, `node -e`) whose body writes, or an in-place `perl -0pi -e`. `CLAUDE.md` forbids it because the command body is re-read on every later request of the run, so an editing script written early is billed for the rest of it (`file-edits.md` measured one run at ~2m45s spent retyping existing lines). Edit a region with the Edit tool (old / new), or pass a body by path (`--field body=@<path>`, `--body-file <path>`). A new-file creation (`cat > <new-file> <<EOF`), a read-only heredoc (`cat <<EOF`), and a short `sed -i` stay allowed. **This rule fires on every occurrence, not once per run.**";
+var ROW = {
+  id: "file-body",
+  is_trigger: bash_triggers.on_bash_command((command) => carries_a_file_body(command)),
+  reason: FILE_BODY_REASON,
+  decide: () => true
+};
+var file_body = {
+  FILE_BODY_REASON,
+  ROW,
+  carries_a_file_body,
+  is_in_place_perl,
+  is_interpreter_write,
+  writes_existing_file
+};
+
+// scripts/rules/tail-commands.ts
+function is_bash_use(block) {
+  return block.type === cost_blocks.TOOL_USE_TYPE && block.name === cost_blocks.BASH_TOOL;
+}
+function bash_commands_of(line) {
+  const parsed = time_transcript_line.parse_line(line);
+  if (parsed === void 0) return [];
+  return parsed.blocks.filter((block) => is_bash_use(block)).map((block) => time_shell.bash_command(block.input));
+}
+function prior_bash_commands(tail) {
+  return tail.split("\n").flatMap((line) => bash_commands_of(line));
+}
+var tail_commands = { bash_commands_of, is_bash_use, prior_bash_commands };
+
+// scripts/rules/filing-cap.ts
+var FILING_CAP = 10;
+var CAP_REACHED = FILING_CAP;
+function is_filing_use(block) {
+  if (!tail_commands.is_bash_use(block)) return false;
+  return bash_triggers.is_issue_filing(time_shell.bash_command(block.input));
+}
+function collect_block(block, found) {
+  if (block.result_id !== "") found.refusals.set(block.result_id, block.refusal_guard);
+  if (is_filing_use(block)) found.filing_ids.push(block.id);
+}
+function collect_line(line, found) {
+  const parsed = time_transcript_line.parse_line(line);
+  if (parsed === void 0) return;
+  for (const block of parsed.blocks) collect_block(block, found);
+}
+function scan_tail(tail) {
+  const found = { filing_ids: [], refusals: /* @__PURE__ */ new Map() };
+  for (const line of tail.split("\n")) collect_line(line, found);
+  return found;
+}
+function prior_filing_count(tail) {
+  const { filing_ids, refusals } = scan_tail(tail);
+  return filing_ids.filter((id) => (refusals.get(id) ?? "") === "").length;
+}
+function decide2(_call, run) {
+  return prior_filing_count(time_density_hook.read_tail(run.transcript)) >= CAP_REACHED;
+}
+var FILING_CAP_REASON = `\u26D4 filing cap: this run has already filed ${String(FILING_CAP)} Issues, the per-run ceiling \u2014 on reaching it, stop and report rather than filing more. Automatic filing is capped so a run cannot manufacture Issues faster than they can be closed (\`.claude/skills/workflow-commands/SKILL.md\` \u2192 \xA72d, \`observation-filing.md\`). A further Issue that genuinely must exist is a person's call, not this run's. **This rule fires on every filing past the cap, not once per run**, so reissuing the same filing will be refused again.`;
+var ROW2 = {
+  id: "filing-cap",
+  is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
+  reason: FILING_CAP_REASON,
+  decide: decide2
+};
+var filing_cap = { FILING_CAP, FILING_CAP_REASON, ROW: ROW2, decide: decide2, prior_filing_count };
+
+// scripts/rules/gh-api.ts
+var GH_FLAGS = String.raw`(?:-{1,2}[\w-]+(?:[= ][^\s]+)?\s+)*`;
+var GH_API_COMMAND = new RegExp(String.raw`^gh\s+${GH_FLAGS}api\s`, "u");
+var API_METHOD = /(?:^|\s)(?:--method|-X)[= ]([A-Za-z]+)/u;
+var API_FIELD = /(?:^|\s)(?:--raw-field|--field|--input|-F|-f)(?:[= ]|$)/u;
+var READ_METHOD = "GET";
+var REPO_PATH = /repos\/([^/\s'"?]+)\/([^/\s'"?]+)/u;
+var OWNER_GROUP = 1;
+var REPO_GROUP = 2;
+function is_gh_api(segment) {
+  return GH_API_COMMAND.test(segment);
+}
+function is_read(segment) {
+  const method = API_METHOD.exec(segment)?.[1];
+  if (method !== void 0) return method.toUpperCase() === READ_METHOD;
+  return !API_FIELD.test(segment);
+}
+function is_write(segment) {
+  return !is_read(segment);
+}
+function repo_target(segment) {
+  const match = REPO_PATH.exec(segment);
+  if (match === null) return void 0;
+  return { owner: match[OWNER_GROUP] ?? "", repo: match[REPO_GROUP] ?? "" };
+}
+var gh_api = { GH_API_COMMAND, GH_FLAGS, is_gh_api, is_read, is_write, repo_target };
+
+// scripts/rules/git-argv.ts
+var ENV_ASSIGNMENT = /^[A-Za-z_]\w*=/u;
+var WRAPPER_WORDS = /* @__PURE__ */ new Set([
+  "pnpm",
+  "npx",
+  "exec",
+  "run",
+  "sudo",
+  "command"
+]);
+var SUBSHELL_OPEN = "(";
+var VALUE_TAKING_GLOBALS = /* @__PURE__ */ new Set([
+  "-C",
+  "-c",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--exec-path",
+  "--super-prefix"
+]);
+var FLAG_PREFIX = "-";
+var GIT_COMMAND = "git";
+var NEXT = 1;
+var AFTER_VALUE = 2;
+var WHITESPACE2 = /\s+/u;
+function words_of(segment) {
+  return segment.split(WHITESPACE2).filter((word) => word !== "");
+}
+function is_wrapper_token(word) {
+  return word === SUBSHELL_OPEN || ENV_ASSIGNMENT.test(word) || WRAPPER_WORDS.has(word);
+}
+function after_wrapper(words) {
+  let index = 0;
+  while (index < words.length && is_wrapper_token(words[index] ?? "")) index += NEXT;
+  return index;
+}
+function global_step(flag) {
+  return VALUE_TAKING_GLOBALS.has(flag) ? AFTER_VALUE : NEXT;
+}
+function after_globals(words, start) {
+  let index = start;
+  while (index < words.length) {
+    const flag = words[index] ?? "";
+    if (!flag.startsWith(FLAG_PREFIX)) return index;
+    index += global_step(flag);
+  }
+  return index;
+}
+function parse(segment) {
+  const words = words_of(segment);
+  const git_index = after_wrapper(words);
+  if (words[git_index] !== GIT_COMMAND) return void 0;
+  const subcommand_index = after_globals(words, git_index + NEXT);
+  return { subcommand: words[subcommand_index], args: words.slice(subcommand_index + NEXT) };
+}
+var SHORT_CLUSTER = /^-[A-Za-z]+$/u;
+function short_cluster_has(token, letters) {
+  if (!SHORT_CLUSTER.test(token)) return false;
+  const cluster = token.slice(FLAG_PREFIX.length);
+  for (let index = 0; index < letters.length; index += 1) {
+    if (cluster.includes(letters.charAt(index))) return true;
+  }
+  return false;
+}
+var git_argv = { parse, short_cluster_has, words_of };
+
+// scripts/rules/git-force.ts
+var FORCE_LONG_PREFIX = "--force";
+var DELETE_LONG = "--delete";
+var PUSH_SHORT_LETTERS = "fd";
+var FORCE_OR_DELETE_REFSPEC = /^[+:]/u;
+function is_force_or_delete_push(args) {
+  return args.some(
+    (argument) => argument.startsWith(FORCE_LONG_PREFIX) || argument === DELETE_LONG || git_argv.short_cluster_has(argument, PUSH_SHORT_LETTERS) || FORCE_OR_DELETE_REFSPEC.test(argument)
+  );
+}
+var BRANCH_DELETE_LETTERS = "dD";
+function is_branch_delete(args) {
+  return args.some(
+    (argument) => argument === DELETE_LONG || git_argv.short_cluster_has(argument, BRANCH_DELETE_LETTERS)
+  );
+}
+var PUSH_SUBCOMMAND = "push";
+var BRANCH_SUBCOMMAND = "branch";
+function is_destructive_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  if (call.subcommand === PUSH_SUBCOMMAND) return is_force_or_delete_push(call.args);
+  return call.subcommand === BRANCH_SUBCOMMAND && is_branch_delete(call.args);
+}
+function is_force_or_delete(command) {
+  return shell_segments.segments_of(command).some((segment) => is_destructive_segment(segment));
+}
+var GIT_FORCE_REASON = "\u26D4 force push or branch delete: this rewrites or removes shared history, which is Tier C and needs explicit current-turn user instruction \u2014 never an AI decision, even to fix a problem you caused (`prompts/collaboration-workflow/operating-rules.md`). The `.claude/settings.json` deny list matches globs, so it misses this spelling: a combined short cluster (`git push -uf`), a `git -C <path>` prefix, and the colon-form delete (`git push origin :branch`) all pass it. This row reads the argv instead, so the spelling does not matter. For an ordinary push use `pnpm josh git`; a force push, a `git push --delete` / `:branch`, or a `git branch -d` / `-D` is the user's to run in their own terminal. **This rule fires on every occurrence, not once per run.**";
+var ROW3 = {
+  id: "git-force",
+  is_trigger: bash_triggers.on_bash_command(is_force_or_delete),
+  reason: GIT_FORCE_REASON,
+  decide: () => true
+};
+var git_force = {
+  GIT_FORCE_REASON,
+  ROW: ROW3,
+  is_branch_delete,
+  is_force_or_delete,
+  is_force_or_delete_push
+};
+
+// scripts/rules/issue-scout.ts
+var SCOUT_NAMES = /* @__PURE__ */ new Set(["issue:scout"]);
+function runs_the_scout(command) {
+  return shell_segments.segments_of(command).some((segment) => shell_segments.is_josh_command(segment, SCOUT_NAMES));
+}
+function already_scouted(tail, _call) {
+  return tail_commands.prior_bash_commands(tail).some((command) => runs_the_scout(command));
+}
+var ISSUE_SCOUT_REASON = '\u26D4 issue scout: this files an Issue with no `pnpm josh issue:scout` earlier in the run. A duplicate is likeliest for the work that just finished, which is exactly where self-restraint is weakest. Reissue after scouting: `pnpm josh issue:scout "<title>"` (add `--body "<one-line summary, citing #N where the work follows one>"` so the epic half can answer), then read its `Duplicates:` \u2014 an **open** candidate covering the same work stops the run rather than filing a second Issue, and a `(closed)` one means the work is already done \u2014 before reissuing this filing. The procedure is `.claude/skills/workflow-commands/SKILL.md` \u2192 \xA72e. It fires once per run and cannot repeat on the call in hand.';
+var ROW4 = {
+  id: "issue-scout",
+  is_trigger: bash_triggers.on_bash_command(bash_triggers.is_issue_filing),
+  reason: ISSUE_SCOUT_REASON,
+  already_satisfied: already_scouted,
+  keeps: bash_triggers.on_bash_command(runs_the_scout)
+};
+var issue_scout = { ISSUE_SCOUT_REASON, ROW: ROW4, already_scouted, runs_the_scout };
+
+// scripts/agent/interactive-ask.ts
+import { z as z3 } from "zod";
+var INTERACTIVE_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion"]);
+function is_interactive_tool(name) {
+  return INTERACTIVE_TOOLS.has(name);
+}
+var OPTION_SCHEMA = z3.looseObject({ label: z3.string().optional() });
+var QUESTION_SCHEMA = z3.looseObject({
+  question: z3.string().optional(),
+  options: z3.array(OPTION_SCHEMA).optional()
+});
+var ASK_INPUT_SCHEMA = z3.looseObject({ questions: z3.array(QUESTION_SCHEMA).optional() });
+var DENIAL_SCHEMA = z3.looseObject({
+  tool_name: z3.string().optional(),
+  tool_input: z3.unknown().optional()
+});
+var UNKNOWN_QUESTION = "(question text unavailable)";
+var OPTION_SEPARATOR = " / ";
+var QUESTION_SEPARATOR = "; ";
+function labels_of(question) {
+  return (question.options ?? []).map((option) => option.label ?? "").filter((label) => label !== "");
+}
+function render_question(question) {
+  const labels = labels_of(question);
+  const text2 = question.question ?? UNKNOWN_QUESTION;
+  return labels.length === 0 ? text2 : `${text2} [${labels.join(OPTION_SEPARATOR)}]`;
+}
+function interactive_input(raw) {
+  const denial = DENIAL_SCHEMA.safeParse(raw);
+  if (!denial.success || !is_interactive_tool(denial.data.tool_name ?? "")) return void 0;
+  const input = ASK_INPUT_SCHEMA.safeParse(denial.data.tool_input);
+  return input.success ? input.data : void 0;
+}
+function refused_ask_of(permission_denials) {
+  if (!Array.isArray(permission_denials)) return void 0;
+  const input = permission_denials.map((raw) => interactive_input(raw)).find((one) => one !== void 0);
+  const questions = input?.questions ?? [];
+  if (questions.length === 0) return void 0;
+  return questions.map((question) => render_question(question)).join(QUESTION_SEPARATOR);
+}
+var interactive_ask = { INTERACTIVE_TOOLS, is_interactive_tool, refused_ask_of };
+
+// scripts/rules/lane-interactive-ask.ts
+function is_interactive_ask(call, is_lane_child = lane_child_marker.is_child_of(process.cwd())) {
+  if (!interactive_ask.is_interactive_tool(call.name)) return false;
+  return is_lane_child;
+}
+var LANE_INTERACTIVE_ASK_REASON = '\u26D4 lane child interactive ask: this session is a dispatched lane child and cannot ask a person, so this call is refused. Left to run it would end the turn with nothing on the Issue \u2014 the parent then finds an OPEN Issue with `in-progress` and no question (joshuafolkken/kit#2201; joshuafolkken/kit#2034 placed the same rule one tool-call too late). Do not ask: park the decision instead. Apply `needs-decision` and post a comment carrying the question, the options and whether work was stashed \u2014 `gh api repos/{owner}/{repo}/issues/<N>/labels -f \'labels[]=needs-decision\'` then `gh api repos/{owner}/{repo}/issues/<N>/comments --field body=@<path>` \u2014 then send the `confirmation` Telegram and stop. The procedure is `.claude/skills/workflow-commands/pre-gate-cut.md` \u2192 "A lane child records its park before it stops", and the park itself is `backlogrun-park.md` \u2192 "park and continue". This rule fires on every occurrence, not once per run.';
+var ROW5 = {
+  id: "lane-interactive-ask",
+  is_trigger: is_interactive_ask,
+  reason: LANE_INTERACTIVE_ASK_REASON,
+  decide: () => true
+};
+var lane_interactive_ask = { LANE_INTERACTIVE_ASK_REASON, ROW: ROW5, is_interactive_ask };
+
+// scripts/rules/piped-verification.ts
+var VERIFICATION_COMMANDS = /* @__PURE__ */ new Set([
+  "check",
+  "cspell",
+  "cspell:dot",
+  "eval",
+  "gate",
+  "lint",
+  "lint:eslint",
+  "lint:prettier",
+  "lint:related",
+  "overrides",
+  "ranges",
+  "test",
+  "test:e2e",
+  "test:related",
+  "test:unit"
+]);
+function is_verification_command(segment) {
+  return shell_segments.is_josh_command(segment, VERIFICATION_COMMANDS);
+}
+function is_masked_verification(command) {
+  return time_shell.discarded_commands(command).some((segment) => is_verification_command(segment));
+}
+var PIPED_VERIFICATION_REASON = "\u26D4 piped verification: a pipeline exits with its last command's status, so `pnpm josh gate | tail` reports success on a gate that failed, and the verdict is discarded before anything reads it. Run the check without the pipe \u2014 josh prints its verdict line last, so the harness output cap keeps it even when the middle is elided. Where the output genuinely has to be narrowed, redirect it to a file and read ranges from that file, or prefix `set -o pipefail` so the pipeline carries the check's status. Read the printed verdict either way, never the exit code alone. Read-only listings are untouched \u2014 this fires only on a command whose result means pass or fail. The rule is in `prompts/collaboration-workflow/output-bounds.md`. Reissue this call with no pipe \u2014 it fires once per run and cannot repeat on the call in hand.";
+function command_pieces(command) {
+  return shell_segments.segments_of(time_shell.unquoted(command)).flatMap((segment) => segment.split("|")).map((piece) => piece.trim());
+}
+function runs_verification(command) {
+  return command_pieces(command).some((piece) => is_verification_command(piece));
+}
+function keeps_verdict_intact(command) {
+  return runs_verification(command) && !is_masked_verification(command);
+}
+var piped_verification = {
+  PIPED_VERIFICATION_REASON,
+  VERIFICATION_COMMANDS,
+  is_masked_verification,
+  keeps_verdict_intact,
+  runs_verification
+};
+
+// scripts/rules/pre-gate-cut.ts
+var GATE_COMMANDS = /* @__PURE__ */ new Set(["gate"]);
+var CUT_COMMANDS = /* @__PURE__ */ new Set(["run:cut"]);
+var CUT_MODE_FLAG = /(?:^|\s)--(?:resume|end|json)(?:[=\s]|$)/u;
+var HOLD_COMMANDS = /* @__PURE__ */ new Set(["run:hold"]);
+var HOLD_MODE_FLAG = /(?:^|\s)--release(?:[=\s]|$)/u;
+function invokes_josh(command, names, mode_flag) {
+  return shell_segments.segments_of(command).some(
+    (segment) => shell_segments.is_josh_command(segment, names) && mode_flag?.test(segment) !== true
+  );
+}
+function runs_the_gate(command) {
+  return invokes_josh(command, GATE_COMMANDS);
+}
+function takes_the_cut(command) {
+  return invokes_josh(command, CUT_COMMANDS, CUT_MODE_FLAG);
+}
+function claims_the_hold(command) {
+  return invokes_josh(command, HOLD_COMMANDS, HOLD_MODE_FLAG);
+}
+function asks_about_the_cut(command) {
+  return invokes_josh(command, CUT_COMMANDS);
+}
+function current_state() {
+  return {
+    directory: process.cwd(),
+    carried: run_cut.carried_cut_sync,
+    marked_issue: lane_child_marker.marked_issue()
+  };
+}
+function uncut_lane_issue(state) {
+  const issue = lane_paths.lane_issue_of(state.directory);
+  if (issue === void 0) return void 0;
+  if (state.marked_issue !== issue) return void 0;
+  return state.carried()?.issue === issue ? void 0 : issue;
+}
+function is_uncut_gate(command, state = current_state()) {
+  if (!runs_the_gate(command)) return false;
+  return uncut_lane_issue(state) !== void 0;
+}
+var PRE_GATE_CUT_REASON = "\u26D4 pre-gate cut: this checkout is a lane dispatched for this issue and the gate is the boundary to cut at, so take the cut before running it. `pnpm josh run:cut <N>` ends this process and relaunches a fresh one that resumes from the gate, dropping the thinking built up while implementing rather than carrying it on every later request \u2014 joshuafolkken/kit#1839 measured 176K of 204K output riding across that boundary, and joshuafolkken/kit#1864 measured the step itself firing 0 times in 6 lane children while it was carried as prose. Issue `pnpm josh run:cut <N>` now, and read the verdict: on `cut`, **end the turn immediately** \u2014 the fresh process owns the run from there and must not be waited for; on `not-a-lane`, `unready`, `busy`, `failed` or `unknown`, this process carries the run on and the gate is simply the next call. Never relaunch a second process after `busy`. This fired because the dispatch mark names this lane; a person working here carries no mark and sees no refusal, so there is no human-or-child judgement left to make. The procedure is `.claude/skills/workflow-commands/pre-gate-cut.md`. Reissue the gate once the cut has answered \u2014 this fires once per run, so it cannot repeat on the call in hand.";
+var pre_gate_cut = {
+  PRE_GATE_CUT_REASON,
+  asks_about_the_cut,
+  claims_the_hold,
+  is_uncut_gate,
+  runs_the_gate,
+  takes_the_cut,
+  uncut_lane_issue
+};
+
+// scripts/rules/prior-comment-read.ts
+var ISSUE_PATH_NUMBER = /issues\/(\d+)/gu;
+var ISSUE_VIEW_NUMBER = /\bissue\s+view\s+(?:-{1,2}\S+\s+)*(\d+)/u;
+var ISSUE_READ_ARGUMENTS = /\bissue:read\b([\s\d]*)/u;
+var A_NUMBER = /^\d+$/u;
+var COMMENTS_ENDPOINT = /issues\/\d+\/comments\b/u;
+var VIEW_WITH_COMMENTS = /\bissue\s+view\b[^\n]*--comments\b/u;
+var ISSUE_READ_COMMAND = /\bissue:read\b/u;
+function add_issue_read_numbers(command, numbers) {
+  const match = ISSUE_READ_ARGUMENTS.exec(command);
+  if (match === null) return;
+  const tokens = (match[1] ?? "").split(/\s+/u);
+  for (const token of tokens) {
+    if (A_NUMBER.test(token)) numbers.add(Number(token));
+  }
+}
+function issue_numbers_of(command) {
+  const numbers = /* @__PURE__ */ new Set();
+  for (const match of command.matchAll(ISSUE_PATH_NUMBER)) numbers.add(Number(match[1]));
+  const view = ISSUE_VIEW_NUMBER.exec(command);
+  if (view !== null) numbers.add(Number(view[1]));
+  add_issue_read_numbers(command, numbers);
+  return numbers;
+}
+function fetches_comments(command) {
+  return COMMENTS_ENDPOINT.test(command) || VIEW_WITH_COMMENTS.test(command) || ISSUE_READ_COMMAND.test(command);
+}
+function reads_target_comments(command, target) {
+  if (!fetches_comments(command)) return false;
+  for (const number of issue_numbers_of(command)) {
+    if (target.has(number)) return true;
+  }
+  return false;
+}
+function already_read_comments_for(tail, command) {
+  const target = issue_numbers_of(command);
+  if (target.size === 0) return false;
+  return tail_commands.prior_bash_commands(tail).some((prior) => reads_target_comments(prior, target));
+}
+function already_read_for_call(tail, call) {
+  if (call.name !== cost_blocks.BASH_TOOL) return false;
+  return already_read_comments_for(tail, time_shell.bash_command(call.input));
+}
+var prior_comment_read = {
+  already_read_comments_for,
+  already_read_for_call,
+  fetches_comments,
+  issue_numbers_of
+};
+
+// scripts/rules/run-tail.ts
+var SEGMENT_PREFIX = String.raw`(?:\(\s*)?(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)*(?:npx\s+|pnpm\s+(?:exec\s+|run\s+)?)?`;
+var WORD_END = String.raw`(?=\s|$|\))`;
+var PUSH_STEP_SEGMENT = new RegExp(String.raw`^${SEGMENT_PREFIX}josh\s+(?:git|g)${WORD_END}`, "u");
+var CONFIRMED_FLAG = new RegExp(String.raw`(?:^|\s)(?:-y|--yes)${WORD_END}`, "u");
+var SKIPS_THE_PUSH = new RegExp(String.raw`(?:^|\s)--skip-push${WORD_END}`, "u");
+var BACKGROUND_KEY = "run_in_background";
+var QUOTED_SPAN = /"[^"]*"|'[^']*'/gu;
+function flags_of(segment) {
+  return segment.replaceAll(QUOTED_SPAN, " ");
+}
+function is_push_step_segment(segment) {
+  if (!PUSH_STEP_SEGMENT.test(segment)) return false;
+  const flags = flags_of(segment);
+  if (SKIPS_THE_PUSH.test(flags)) return false;
+  return CONFIRMED_FLAG.test(flags);
+}
+function is_push_step(command) {
+  return shell_segments.segments_of(command).some((segment) => is_push_step_segment(segment));
+}
+function is_backgrounded(input) {
+  if (!json_value.is_record(input)) return false;
+  return input[BACKGROUND_KEY] === true;
+}
+function is_push_step_call(call) {
+  if (call.name !== cost_blocks.BASH_TOOL) return false;
+  return is_push_step(time_shell.bash_command(call.input));
+}
+function is_backgrounded_push_step(call) {
+  if (!is_backgrounded(call.input)) return false;
+  return is_push_step_call(call);
+}
+function is_foreground_push_step(call) {
+  if (is_backgrounded(call.input)) return false;
+  return is_push_step_call(call);
+}
+function decide3() {
+  return true;
+}
+var RUN_TAIL_REASON = '\u26D4 run tail: this issues the commit-push-PR step in the foreground, where the harness decides when to stop waiting. Reissue it with `run_in_background` set. In `fullrun #1501` this call was given a 900-second timeout, the harness detached it at its own 600-second cap, and nothing read the output for a further 6m28s \u2014 45m03s of wall clock on about 17 minutes of work (joshuafolkken/kit#1510). **Never give a foreground call a timeout above the harness cap**: the cap decides, not the number. A backgrounded call re-invokes you when it exits, so the completion notification is what resumes the run. **When it arrives, the turn that reads it goes straight through any branch-2 filing and `pnpm josh epic:bundle` to `pnpm josh followup` \u2014 the turn never ends at the push.** CI went green 6m06s before the merge started in that run, and it started only because the person asked; joshuafolkken/kit#1333 had already settled that the merge is issued in the turn the review closes. While the push runs, do the work that writes nothing \u2014 drafting the completion body to a file, deciding the branch-2 disposition. `pnpm josh followup` itself stays in the **foreground** \u2014 nearly every step after it reads its result. But a tail does follow the merge, measured at 3.0 min and 5.9% of a run (joshuafolkken/kit#1462), so empty it beforehand: the steps that read the merge result stay after `followup`, and the rest are composed in the turn that issues it, bar the one exception background-commands.md names. The procedure is `.claude/skills/workflow-commands/background-commands.md`, "A command that can take minutes is issued in the background". **This rule fires on every foreground push, not once per run**, so reissuing the same call in the foreground will be refused again.';
+var run_tail = {
+  RUN_TAIL_REASON,
+  decide: decide3,
+  is_backgrounded_push_step,
+  is_foreground_push_step,
+  is_push_step,
+  is_push_step_call
+};
+
+// scripts/rules/shell-body-trigger.ts
+var FIELD_FLAGS = "(?:-f|-F|--field|--raw-field)";
+var MESSAGE_FLAGS = "(?:--body|--notify-message)";
+var FIELD_OPENING = String.raw`${FIELD_FLAGS}[\s=]*(?:'?body="|"body=)`;
+var MESSAGE_OPENING = String.raw`${MESSAGE_FLAGS}[\s=]+"`;
+var NESTED_SUBSTITUTION = String.raw`\$\([^()]*\)`;
+var SUBSTITUTION = String.raw`\$\((?:[^()$]|\$(?!\()|${NESTED_SUBSTITUTION})*\)`;
+var QUOTED_VALUE = String.raw`(?:[^"\\$]|\\.|\$(?!\()|${SUBSTITUTION})*`;
+var INLINE_BODY_VALUE = new RegExp(
+  `(?:${FIELD_OPENING}|${MESSAGE_OPENING})(${QUOTED_VALUE})"`,
+  "gu"
+);
+var SHELL_EVALUATED = /[`$]/u;
+var WHOLE_VALUE_SUBSTITUTION = new RegExp(`^${SUBSTITUTION}$`, "u");
+var BACKTICK = "`";
+var WHOLE_VALUE_FILE_REFERENCE = /^@\S+$/u;
+var ESCAPED_PAIR = /\\./gu;
+function is_whole_value_substitution(literal) {
+  return WHOLE_VALUE_SUBSTITUTION.test(literal) && !literal.includes(BACKTICK);
+}
+function is_body_already_in_a_file(literal) {
+  return WHOLE_VALUE_FILE_REFERENCE.test(literal) || is_whole_value_substitution(literal);
+}
+function is_evaluated_value(raw_value) {
+  const literal = raw_value.replaceAll(ESCAPED_PAIR, "");
+  if (is_body_already_in_a_file(literal)) return false;
+  return SHELL_EVALUATED.test(literal);
+}
+function is_shell_evaluated_body(command) {
+  for (const match of command.matchAll(INLINE_BODY_VALUE)) {
+    if (is_evaluated_value(match[1] ?? "")) return true;
+  }
+  return false;
+}
+var FILE_FLAG = /(?:--body-file|--notify-message-file)(?:[\s=]|$)/u;
+var FIELD_FILE_REFERENCE = new RegExp(String.raw`${FIELD_FLAGS}[\s=]*body=@\S`, "u");
+var ANSI_C_BODY = /(?:(?:--body|--notify-message)[\s=]+|body=)\$'/u;
+var DOUBLE_QUOTED_SPAN = /"[^"]*"/gu;
+var BODY_FLAG = new RegExp(
+  String.raw`${FIELD_FLAGS}[\s=]*'?"?body=|${MESSAGE_FLAGS}[\s=]|--body-file[\s=]|--notify-message-file[\s=]`,
+  "u"
+);
+var QUOTED_SPAN2 = /"[^"]*"|'[^']*'/gu;
+function inline_body_literals(command) {
+  return Array.from(
+    command.matchAll(INLINE_BODY_VALUE),
+    (match) => (match[1] ?? "").replaceAll(ESCAPED_PAIR, "")
+  );
+}
+function is_safe_body_form(command) {
+  if (ANSI_C_BODY.test(command.replaceAll(DOUBLE_QUOTED_SPAN, " "))) return true;
+  const flags = command.replaceAll(QUOTED_SPAN2, " ");
+  if (FILE_FLAG.test(flags) || FIELD_FILE_REFERENCE.test(flags)) return true;
+  return inline_body_literals(command).some((literal) => is_body_already_in_a_file(literal));
+}
+function keeps_body_safe(command) {
+  return is_safe_body_form(command) && !is_shell_evaluated_body(command);
+}
+function carries_a_body(command) {
+  if (BODY_FLAG.test(command.replaceAll(QUOTED_SPAN2, " "))) return true;
+  return inline_body_literals(command).length > 0;
+}
+var shell_body_trigger = {
+  carries_a_body,
+  is_safe_body_form,
+  is_shell_evaluated_body,
+  keeps_body_safe
+};
+
+// scripts/test/test-declared-changed.ts
+import { execFileSync } from "node:child_process";
+
+// scripts/test/test-declared-logic.ts
+var TEST_SUFFIXES = [".e2e.ts", ".test.ts"];
+var EXEMPT_PATHS = [".editorconfig"];
+var EXEMPT_PREFIXES = [".idea/", ".vscode/", "prompts/"];
+var EXEMPT_SUFFIXES = [".md"];
+function normalize(paths) {
+  return paths.map((path3) => path3.trim()).filter((path3) => path3 !== "");
+}
+function is_test_file(path3) {
+  return TEST_SUFFIXES.some((suffix) => path3.endsWith(suffix));
+}
+function is_exempt(path3) {
+  if (EXEMPT_PATHS.includes(path3)) return true;
+  return EXEMPT_SUFFIXES.some((suffix) => path3.endsWith(suffix)) || EXEMPT_PREFIXES.some((prefix) => path3.startsWith(prefix));
+}
+function is_runtime(path3) {
+  return !is_test_file(path3) && !is_exempt(path3);
+}
+function verdict_for(paths) {
+  const changed = normalize(paths);
+  if (changed.some((path3) => is_test_file(path3))) return "satisfied";
+  if (changed.some((path3) => is_runtime(path3))) return "required";
+  return "exempt";
+}
+function runtime_files(paths) {
+  return normalize(paths).filter((path3) => is_runtime(path3));
+}
+function exempt_files(paths) {
+  return normalize(paths).filter((path3) => is_exempt(path3));
+}
+var test_declared_logic = {
+  EXEMPT_PATHS,
+  EXEMPT_PREFIXES,
+  EXEMPT_SUFFIXES,
+  TEST_SUFFIXES,
+  exempt_files,
+  is_exempt,
+  is_runtime,
+  is_test_file,
+  runtime_files,
+  verdict_for
+};
+
+// scripts/test/test-declared-changed.ts
+var RENAME_ARROW = " -> ";
+var STATUS_PREFIX_LENGTH = 3;
+function path_of(line) {
+  const body = line.slice(STATUS_PREFIX_LENGTH);
+  const arrow = body.indexOf(RENAME_ARROW);
+  return arrow === -1 ? body : body.slice(arrow + RENAME_ARROW.length);
+}
+function read_changed_paths_sync() {
+  try {
+    const output = execFileSync("git", ["status", "--porcelain"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return output.split("\n").filter((line) => line.length > STATUS_PREFIX_LENGTH).map((line) => path_of(line));
+  } catch {
+    return [];
+  }
+}
+var injected = {};
+function source_paths() {
+  return injected.paths ?? read_changed_paths_sync();
+}
+function current_verdict(paths = source_paths()) {
+  return test_declared_logic.verdict_for(paths);
+}
+function restore_injection(previous) {
+  if (previous === void 0) {
+    delete injected.paths;
+    return;
+  }
+  injected.paths = previous;
+}
+function with_paths(paths, body) {
+  const previous = injected.paths;
+  injected.paths = paths;
+  try {
+    return body();
+  } finally {
+    restore_injection(previous);
+  }
+}
+var test_declared_changed = { current_verdict, path_of, read_changed_paths_sync, with_paths };
+
+// scripts/rules/test-declared-commit.ts
+function is_untested_commit(call) {
+  if (!run_tail.is_push_step_call(call)) return false;
+  return test_declared_changed.current_verdict() === "required";
+}
+var REASON = '\u26D4 test declared: this commits a runtime code change with no test beside it \u2014 `pnpm josh test:declared` reads the working tree as `required` (a changed file that is neither a test \u2014 `*.test.ts` / `*.e2e.ts` \u2014 nor a mechanically-exempt non-runtime path). `CLAUDE.md` \u2192 Code Change Rules requires a test for ALL code changes: a bug fix gets a regression test, a refactor gets tests pinning behavior first, logic gets a unit test, an observable UI/timing change gets an E2E. Add the declared test and reissue this commit. **If the change genuinely touches no executable runtime path** it is the pre-approved non-runtime exception \u2014 declare it in your Step 0 work summary with the reason it is exempt (non-executable config, a cosmetic asset swap) and reissue; the exception is a presentation, not a stop. Run `pnpm josh test:declared` to see the files it names. The procedure is `prompts/collaboration-workflow/rule-delivery.md` \u2192 "\u914D\u9001\u3055\u308C\u3066\u3044\u308B\u898F\u5247". This fires once per run, so reissuing will not repeat on the call in hand.';
+var ROW6 = { id: "test-declared", is_trigger: is_untested_commit, reason: REASON };
+var test_declared_commit = { REASON, ROW: ROW6, is_untested_commit };
+
+// scripts/discovery/repo-discovery.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import path2 from "node:path";
+
+// scripts/discovery/repo-origin.ts
+var GITHUB_HOST = "github.com";
+var SSH_ALIAS_PATTERN = /^github(?:-\w+)*$/u;
+var GIT_SUFFIX = ".git";
+var PATH_SEPARATOR = "/";
+var USER_SEPARATOR = "@";
+var HOST_SEPARATOR = ":";
+var OWNER_INDEX = 0;
+var REPO_INDEX = 1;
+var REPO_PATH_SEGMENTS = 2;
+var NOT_FOUND = -1;
+var SECTION_PREFIX = "[";
+var ORIGIN_SECTION = /^\[remote\s+"origin"\]$/u;
+var URL_KEY = "url";
+function is_github_hostname(host) {
+  return host.toLowerCase() === GITHUB_HOST;
+}
+function is_github_ssh_host(host) {
+  const normalized = host.toLowerCase();
+  return is_github_hostname(normalized) || SSH_ALIAS_PATTERN.test(normalized);
+}
+function strip_git_suffix(name) {
+  return name.endsWith(GIT_SUFFIX) ? name.slice(0, -GIT_SUFFIX.length) : name;
+}
+function to_identity(repository_path) {
+  const segments = repository_path.split(PATH_SEPARATOR).filter((segment) => segment !== "");
+  if (segments.length !== REPO_PATH_SEGMENTS) return void 0;
+  const owner = segments[OWNER_INDEX] ?? "";
+  const repo = strip_git_suffix(segments[REPO_INDEX] ?? "");
+  return repo === "" ? void 0 : { owner, repo };
+}
+function parse_scp_like(url) {
+  const user_end = url.indexOf(USER_SEPARATOR);
+  const authority = user_end === NOT_FOUND ? url : url.slice(user_end + 1);
+  const host_end = authority.indexOf(HOST_SEPARATOR);
+  if (host_end === NOT_FOUND) return void 0;
+  if (!is_github_ssh_host(authority.slice(0, host_end))) return void 0;
+  return to_identity(authority.slice(host_end + 1));
+}
+function parse_url_like(url) {
+  try {
+    const parsed = new URL(url);
+    return is_github_hostname(parsed.hostname) ? to_identity(parsed.pathname) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parse_origin_url(url) {
+  const trimmed = url.trim();
+  if (trimmed === "") return void 0;
+  return parse_url_like(trimmed) ?? parse_scp_like(trimmed);
+}
+function is_section_header(line) {
+  return line.startsWith(SECTION_PREFIX);
+}
+function origin_section_lines(lines) {
+  const start = lines.findIndex((line) => ORIGIN_SECTION.test(line));
+  if (start === NOT_FOUND) return [];
+  const rest = lines.slice(start + 1);
+  const end = rest.findIndex((line) => is_section_header(line));
+  return end === NOT_FOUND ? rest : rest.slice(0, end);
+}
+function entry_value(line, key) {
+  const separator = line.indexOf("=");
+  if (separator === NOT_FOUND) return void 0;
+  if (line.slice(0, separator).trim() !== key) return void 0;
+  return line.slice(separator + 1).trim();
+}
+function parse_origin_from_config(content) {
+  const lines = content.split("\n").map((line) => line.trim());
+  return origin_section_lines(lines).map((line) => entry_value(line, URL_KEY)).find((url) => url !== void 0);
+}
+function format_identity(identity) {
+  return `${identity.owner}${PATH_SEPARATOR}${identity.repo}`.toLowerCase();
+}
+var repo_origin = {
+  GITHUB_HOST,
+  is_github_hostname,
+  is_github_ssh_host,
+  parse_origin_from_config,
+  parse_origin_url,
+  format_identity
+};
+
+// scripts/discovery/repo-map-logic.ts
+var OVERRIDE_ENTRY_SEPARATOR = ",";
+var OVERRIDE_PAIR_SEPARATOR = "=";
+var OVERRIDE_PAIR_PARTS = 2;
+var KEY_INDEX = 0;
+var PATH_INDEX = 1;
+function is_same_owner(identity, current_owner2) {
+  return identity.owner.toLowerCase() === current_owner2.toLowerCase();
+}
+function add_entry(target, origin_url, repository_path, current_owner2) {
+  if (origin_url === void 0) return;
+  const identity = repo_origin.parse_origin_url(origin_url);
+  if (identity === void 0 || !is_same_owner(identity, current_owner2)) return;
+  target.set(repo_origin.format_identity(identity), repository_path);
+}
+function parse_override_entry(entry) {
+  const parts = entry.split(OVERRIDE_PAIR_SEPARATOR).map((part) => part.trim());
+  if (parts.length !== OVERRIDE_PAIR_PARTS) return void 0;
+  const key = parts[KEY_INDEX] ?? "";
+  const repository_path = parts[PATH_INDEX] ?? "";
+  if (repository_path === "") return void 0;
+  return { path: repository_path, origin_url: `https://${repo_origin.GITHUB_HOST}/${key}` };
+}
+function parse_overrides(raw) {
+  if (raw === void 0) return [];
+  return raw.split(OVERRIDE_ENTRY_SEPARATOR).map((entry) => parse_override_entry(entry)).filter((entry) => entry !== void 0);
+}
+function build_repository_map(discovered, current_owner2, override_value) {
+  const result = /* @__PURE__ */ new Map();
+  for (const entry of discovered) add_entry(result, entry.origin_url, entry.path, current_owner2);
+  for (const entry of parse_overrides(override_value)) {
+    add_entry(result, entry.origin_url, entry.path, current_owner2);
+  }
+  return result;
+}
+var repo_map_logic = {
+  is_same_owner,
+  parse_overrides,
+  build_repository_map
+};
+
+// scripts/discovery/repo-discovery.ts
+var GIT_DIRECTORY = ".git";
+var GIT_CONFIG = "config";
+var GITDIR_PREFIX = "gitdir:";
+var COMMON_DIRECTORY_FILE = "commondir";
+var OVERRIDE_ENV_KEY = "JOSH_REPO_PATHS";
+function resolve_common_directory(git_directory) {
+  const pointer = path2.join(git_directory, COMMON_DIRECTORY_FILE);
+  if (!existsSync2(pointer)) return git_directory;
+  try {
+    return path2.resolve(git_directory, readFileSync2(pointer, "utf8").trim());
+  } catch {
+    return git_directory;
+  }
+}
+function follow_git_file(repository_path, git_file) {
+  const pointer = readFileSync2(git_file, "utf8").trim();
+  if (!pointer.startsWith(GITDIR_PREFIX)) return void 0;
+  return path2.resolve(repository_path, pointer.slice(GITDIR_PREFIX.length).trim());
+}
+function resolve_git_directory(repository_path) {
+  const candidate = path2.join(repository_path, GIT_DIRECTORY);
+  if (!existsSync2(candidate)) return void 0;
+  try {
+    if (statSync(candidate).isDirectory()) return candidate;
+    const linked = follow_git_file(repository_path, candidate);
+    return linked === void 0 ? void 0 : resolve_common_directory(linked);
+  } catch {
+    return void 0;
+  }
+}
+function read_origin_url(repository_path) {
+  const git_directory = resolve_git_directory(repository_path);
+  if (git_directory === void 0) return void 0;
+  try {
+    return repo_origin.parse_origin_from_config(
+      readFileSync2(path2.join(git_directory, GIT_CONFIG), "utf8")
+    );
+  } catch {
+    return void 0;
+  }
+}
+function sibling_directories(parent) {
+  try {
+    return readdirSync(parent, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => path2.join(parent, entry.name)).toSorted((left, right) => left.localeCompare(right));
+  } catch {
+    return [];
+  }
+}
+function scan_siblings(parent) {
+  return sibling_directories(parent).map((repository_path) => ({
+    path: repository_path,
+    origin_url: read_origin_url(repository_path)
+  }));
+}
+function resolve_current_owner(repository_path) {
+  const origin_url = read_origin_url(repository_path);
+  if (origin_url === void 0) return void 0;
+  return repo_origin.parse_origin_url(origin_url)?.owner;
+}
+function main_worktree(repository_path) {
+  const git_directory = resolve_git_directory(repository_path);
+  if (git_directory === void 0) return repository_path;
+  if (path2.basename(git_directory) !== GIT_DIRECTORY) return repository_path;
+  return path2.dirname(git_directory);
+}
+function discover_repositories(repository_path, environment = process.env) {
+  const main = main_worktree(repository_path);
+  const current_owner2 = resolve_current_owner(main);
+  if (current_owner2 === void 0) return /* @__PURE__ */ new Map();
+  return repo_map_logic.build_repository_map(
+    scan_siblings(path2.dirname(main)),
+    current_owner2,
+    environment[OVERRIDE_ENV_KEY]
+  );
+}
+var repo_discovery = {
+  OVERRIDE_ENV_KEY,
+  main_worktree,
+  read_origin_url,
+  resolve_current_owner,
+  scan_siblings,
+  discover_repositories
+};
+
+// scripts/discovery/repo-party.ts
+var FIRST_PARTY = "first-party";
+var THIRD_PARTY = "third-party";
+var UNKNOWN = "unknown";
+function classify(session_owner, target) {
+  if (session_owner === void 0 || target === void 0) return UNKNOWN;
+  return session_owner.toLowerCase() === target.toLowerCase() ? FIRST_PARTY : THIRD_PARTY;
+}
+function target_owner(owner_repo) {
+  return repo_origin.parse_origin_url(`https://${repo_origin.GITHUB_HOST}/${owner_repo}`)?.owner;
+}
+function current_owner(repository_path = process.cwd()) {
+  return repo_discovery.resolve_current_owner(repository_path);
+}
+var repo_party = { FIRST_PARTY, THIRD_PARTY, UNKNOWN, classify, current_owner, target_owner };
+
+// scripts/rules/third-party-write.ts
+function is_third_party_write_segment(segment, session_owner) {
+  if (!gh_api.is_gh_api(segment) || !gh_api.is_write(segment)) return false;
+  const target = gh_api.repo_target(segment);
+  if (target === void 0) return false;
+  return repo_party.classify(session_owner, target.owner) === repo_party.THIRD_PARTY;
+}
+function writes_third_party(command, resolve_owner = repo_party.current_owner) {
+  const targets = shell_segments.segments_of(command).filter((segment) => gh_api.is_gh_api(segment) && gh_api.is_write(segment));
+  if (targets.length === 0) return false;
+  const session_owner = resolve_owner();
+  return targets.some((segment) => is_third_party_write_segment(segment, session_owner));
+}
+var THIRD_PARTY_WRITE_REASON = '\u26D4 third-party write: this `gh api` call writes to a repository whose owner is not this session \u2014 a tracker we do not own is Tier C, and every write there (Issue, comment, PR, Discussion, review) needs explicit current-turn user instruction; typing the target, or holding a correct diagnosis, is not that instruction (`CLAUDE.md` \u2192 "Third-party repositories are Tier C", `prompts/collaboration-workflow/upstream-interrupt.md`). Confirm the party with `pnpm josh repo:party <owner/repo>` \u2014 owner equality, computed not judged. A read (`-X GET`, or no field flag) passes untouched; only a write (`-f`/`-F`/`--field`/`--raw-field`/`--input`, or `-X POST|PATCH|PUT|DELETE`) is refused. Record the finding on our own Issue and draft the artifact for a person to post \u2014 do not publish it yourself. **This rule fires on every occurrence, not once per run.**';
+var ROW7 = {
+  id: "third-party-write",
+  is_trigger: bash_triggers.on_bash_command((command) => writes_third_party(command)),
+  reason: THIRD_PARTY_WRITE_REASON,
+  decide: () => true
+};
+var third_party_write = {
+  ROW: ROW7,
+  THIRD_PARTY_WRITE_REASON,
+  is_third_party_write_segment,
+  writes_third_party
+};
+
+// scripts/rules/worktree-guard.ts
+var CHECKOUT_SUBCOMMAND = "checkout";
+var RESTORE_SUBCOMMAND = "restore";
+var STASH_SUBCOMMAND = "stash";
+var PATHSPEC_SEPARATOR = "--";
+function is_worktree_checkout(args) {
+  return args.includes(PATHSPEC_SEPARATOR);
+}
+var STAGED_LONG = "--staged";
+var STAGED_LETTER = "S";
+var WORKTREE_LONG = "--worktree";
+var WORKTREE_LETTER = "W";
+function touches_worktree(args) {
+  const is_staged = args.some(
+    (argument) => argument === STAGED_LONG || git_argv.short_cluster_has(argument, STAGED_LETTER)
+  );
+  const is_worktree = args.some(
+    (argument) => argument === WORKTREE_LONG || git_argv.short_cluster_has(argument, WORKTREE_LETTER)
+  );
+  return !is_staged || is_worktree;
+}
+var PUSH_STASH = "push";
+var MESSAGE_LONG = "--message";
+var MESSAGE_SHORT_LETTER = "m";
+var READ_ONLY_STASH = /* @__PURE__ */ new Set(["list", "show"]);
+function has_message(args) {
+  return args.some(
+    (argument) => argument === MESSAGE_LONG || argument.startsWith(`${MESSAGE_LONG}=`) || git_argv.short_cluster_has(argument, MESSAGE_SHORT_LETTER)
+  );
+}
+function is_unauthorized_stash(args) {
+  const [stash_subcommand, ...rest] = args;
+  if (stash_subcommand === void 0) return true;
+  if (READ_ONLY_STASH.has(stash_subcommand)) return false;
+  if (stash_subcommand === PUSH_STASH) return !has_message(rest);
+  return true;
+}
+function is_unauthorized_segment(segment) {
+  const call = git_argv.parse(segment);
+  if (call === void 0) return false;
+  if (call.subcommand === CHECKOUT_SUBCOMMAND) return is_worktree_checkout(call.args);
+  if (call.subcommand === RESTORE_SUBCOMMAND) return touches_worktree(call.args);
+  return call.subcommand === STASH_SUBCOMMAND && is_unauthorized_stash(call.args);
+}
+function is_unauthorized_worktree_change(command) {
+  return shell_segments.segments_of(command).some((segment) => is_unauthorized_segment(segment));
+}
+var WORKTREE_MUTATION_REASON = '\u26D4 unauthorized working-tree change: `git checkout -- <path>`, `git restore <path>` and an unauthorized `git stash` mutate the working tree or the repository-wide stash every work tree shares, and none is on the `.claude/settings.json` deny list (`operating-rules.md`). Do not run them on your own judgement. A commit goes through `pnpm josh git`; a stash pop goes through `pnpm josh stash:pop "<message>"`, never a positional `git stash pop` a shared stack lets another lane divert. A stash push is authorized only inside a documented flow and only with a findable message \u2014 `git stash push -u -m "<message>"` \u2014 which this row allows; a bare `git stash`, a message-less push, or `pop` / `apply` / `drop` is refused. **This rule fires on every occurrence, not once per run.**';
+var ROW8 = {
+  id: "worktree-mutation",
+  is_trigger: bash_triggers.on_bash_command(is_unauthorized_worktree_change),
+  reason: WORKTREE_MUTATION_REASON,
+  decide: () => true
+};
+var worktree_guard = {
+  ROW: ROW8,
+  WORKTREE_MUTATION_REASON,
+  is_unauthorized_stash,
+  is_unauthorized_worktree_change,
+  is_worktree_checkout,
+  touches_worktree
+};
+
+// scripts/rules/delivered-rules.ts
+var SWITCH_ENV_KEY = "JOSH_RULE_GUARD";
+var STAMP_PREFIX = "josh-rule-guard-";
+var { is_issue_filing: is_issue_filing2, on_bash_command: on_bash_command2 } = bash_triggers;
+var WIP_CAP_REASON = "\u26D4 backlog WIP cap: count the target repository's open Issues before filing. With more than 30 open, close one first; nothing honestly closable means do not file. Two filings are exempt and proceed while stating the overage \u2014 one the run is blocked by, and an interrupt, decided by three tests rather than judgement: a verification answers wrongly, a documented workflow cannot complete, or data is lost or written outside the repository. Meeting none of the three, the finding is discretionary and waits. The count command and both procedures are in `prompts/collaboration-workflow/wip-cap.md`. Reissue this call once you have counted \u2014 it fires once per run and cannot repeat on the call in hand.";
+var ISSUE_VIEW_COMMAND = new RegExp(String.raw`^gh\s+${gh_api.GH_FLAGS}issue\s+view\s`, "u");
+var ISSUE_BODY_PATH = /repos\/[^\s'"]*\/issues\/\d+(?=$|["'\s])/u;
+var FETCHES_COMMENTS = /--comments\b|--json\s[\w,]*\bcomments\b|\/comments\b/u;
+var ISSUES_PATH = /repos\/[^\s'"]*\/issues\//u;
+var FIELD_PROJECTION = /(?:--jq|--json)[= ]\s*('[^']*'|"[^"]*"|\S+)/u;
+var NAMES_THE_BODY = /\bbody\b/u;
+function projects_away_body(segment) {
+  const projection = FIELD_PROJECTION.exec(segment);
+  if (projection === null) return false;
+  return !NAMES_THE_BODY.test(projection[1] ?? "");
+}
+function is_body_read_segment(segment) {
+  if (projects_away_body(segment)) return false;
+  if (ISSUE_VIEW_COMMAND.test(segment)) return true;
+  return gh_api.is_gh_api(segment) && ISSUE_BODY_PATH.test(segment) && gh_api.is_read(segment);
+}
+function fetches_issue_comments(segment) {
+  if (!FETCHES_COMMENTS.test(segment)) return false;
+  return ISSUE_VIEW_COMMAND.test(segment) || gh_api.is_gh_api(segment) && ISSUES_PATH.test(segment);
+}
+function is_body_only_issue_read(command) {
+  const segments = shell_segments.segments_of(command);
+  if (segments.some((segment) => fetches_issue_comments(segment))) return false;
+  return segments.some((segment) => is_body_read_segment(segment));
+}
+var ISSUE_COMMENTS_REASON = "\u26D4 an Issue's comments are part of the Issue: read them before implementing, not only the body. A decision recorded after the body was written lives only in a comment \u2014 a corrected diagnosis (joshuafolkken/kit#1537), a changed default and an added acceptance criterion (joshuafolkken/kit#1520), a scope handed to another Issue (joshuafolkken/kit#1304) \u2014 and nothing in the body says it was superseded, so a body-only reader builds the wrong thing and sees no contradiction. Reissue this read with the comments included: `gh api repos/{owner}/{repo}/issues/<N>/comments --jq '.[] | {user: .user.login, created_at, body}'` beside the body read, or `gh issue view <N> --comments` where GraphQL is reachable. Then the later text is the agreement in force \u2014 a comment supersedes the body it contradicts \u2014 except for two answers that are not the run's to make: work a comment reassigns to another Issue is out of scope and is not implemented, and a comment saying the Issue no longer has a reason to exist stops the run with a `confirmation` Telegram. The procedure is `.claude/skills/workflow-commands/SKILL.md` \u2192 \"An Issue's comments are part of the Issue\". It fires once per run and cannot repeat on the call in hand.";
+var { carries_a_body: carries_a_body2, is_shell_evaluated_body: is_shell_evaluated_body2, keeps_body_safe: keeps_body_safe2 } = shell_body_trigger;
+var SHELL_BODY_REASON = "\u26D4 shell-evaluated body: this command carries a body inline in double quotes, and that body contains a backtick or a `$`. The shell evaluates both before the command runs, so the text is executed rather than merely mangled \u2014 joshuafolkken/kit#1198 recorded a PR comment whose own words ran as git commands and switched a lane's work tree onto main. Write the body to a file and pass it by path: `gh api repos/{owner}/{repo}/issues/<N>/comments --field body=@<path>` (a PR comment is an issue comment), `pnpm josh followup --notify-message-file <path>`, `pnpm josh notify --body-file <path>`, and `--body-file <path>` wherever a command offers it. `$'\u2026'` quoting is the other safe form and is unchanged. The rule and what the trigger cannot see are in `prompts/collaboration-workflow/shell-body.md`. Reissue this call once the body is in a file \u2014 it fires once per run and cannot repeat on the call in hand.";
+var ISSUE_LISTING = /^gh\s+(?:-{1,2}[\w-]+(?:[= ]\S+)?\s+)*issue\s+list\b/u;
+var ISSUES_QUERY = /repos\/[^\s'"]*\/issues\?[^\s'"]*state=open/u;
+var OPEN_STATE = /--state[= ]open|state=open/u;
+var LABEL_FILTER = /--label\b|[?&]labels=/u;
+function counts_open_issues(command) {
+  return shell_segments.segments_of(command).some((segment) => {
+    if (LABEL_FILTER.test(segment)) return false;
+    return ISSUE_LISTING.test(segment) && OPEN_STATE.test(segment) || ISSUES_QUERY.test(segment);
+  });
+}
+function reads_issue_comments(command) {
+  return shell_segments.segments_of(command).some((segment) => fetches_issue_comments(segment));
+}
+var ASKS_ABOUT_THE_CUT = on_bash_command2(pre_gate_cut.asks_about_the_cut);
+var CLAIMS_THE_HOLD = on_bash_command2(pre_gate_cut.claims_the_hold);
+function reaches_the_pre_gate_boundary(call, _turn, run) {
+  if (!ASKS_ABOUT_THE_CUT(call)) return false;
+  return run.some((issued) => CLAIMS_THE_HOLD(issued));
+}
+var DELIVERED_RULES = [
+  // **Listed first, ahead of the filing trigger it overlaps** (joshuafolkken/kit#2122). A `gh api`
+  // that files an Issue into a repository we do not own trips both this row and `wip-cap` /
+  // `issue-scout` / `filing-cap` — but the backlog count, the scout and the per-run cap are all about
+  // filing into *our own* backlog, so on a third-party target the right answer is to stop the write
+  // entirely rather than to count anything. Placing it first means a third-party write is refused
+  // before any of those speak; on a first-party filing it is silent (the owners match), so `wip-cap`
+  // still speaks first, exactly as before. It fires on every occurrence (`git-force.ts`).
+  third_party_write.ROW,
+  {
+    id: "wip-cap",
+    is_trigger: on_bash_command2(is_issue_filing2),
+    reason: WIP_CAP_REASON,
+    keeps: on_bash_command2(counts_open_issues)
+  },
+  // **Three rows share the filing trigger** (joshuafolkken/kit#2119), listed after `wip-cap` so the
+  // backlog count still speaks first: `issue-scout` refuses a filing the run has not scouted (once per
+  // run, stood down once the scout is on the tail), and `filing-cap` refuses every filing past the
+  // per-run ceiling. Each is a real instance of the admissible overlap the comment on `delivery`
+  // describes — the losing rule's delivery is still correct one reissue later — so a scout-less,
+  // over-cap filing is delivered `wip-cap`, then `issue-scout`, then `filing-cap` across its reissues.
+  issue_scout.ROW,
+  filing_cap.ROW,
+  {
+    id: "issue-comments",
+    is_trigger: on_bash_command2(is_body_only_issue_read),
+    reason: ISSUE_COMMENTS_REASON,
+    already_satisfied: prior_comment_read.already_read_for_call,
+    keeps: on_bash_command2(reads_issue_comments)
+  },
+  {
+    id: "shell-body",
+    is_trigger: on_bash_command2(is_shell_evaluated_body2),
+    reason: SHELL_BODY_REASON,
+    keeps: on_bash_command2(keeps_body_safe2),
+    reaches: on_bash_command2(carries_a_body2)
+  },
+  {
+    id: "piped-verification",
+    is_trigger: on_bash_command2(piped_verification.is_masked_verification),
+    reason: piped_verification.PIPED_VERIFICATION_REASON,
+    keeps: on_bash_command2(piped_verification.keeps_verdict_intact),
+    reaches: on_bash_command2(piped_verification.runs_verification)
+  },
+  {
+    id: "early-heartbeat",
+    is_trigger: on_bash_command2(early_heartbeat.is_wait_timer),
+    reason: early_heartbeat.EARLY_HEARTBEAT_REASON,
+    decide: early_heartbeat.decide,
+    keeps: on_bash_command2(early_heartbeat.is_progress_watch),
+    reaches: on_bash_command2(early_heartbeat.waits_for_progress)
+  },
+  // **Listed before `run-tail`, the one row it deliberately overlaps** (joshuafolkken/kit#2118). A
+  // foreground `pnpm josh git -y` with no test beside the change is claimed by both: `test-declared`
+  // decides whether the commit should happen at all, so it is listed first, exactly as `wip-cap`
+  // precedes `shell-body` for deciding whether an Issue should exist. Nothing is lost by `run-tail`
+  // losing the race — the stamps are keyed per `id`, so the reissued push is delivered `run-tail`,
+  // which is asserted rather than assumed. The overlap only arises in a real checkout where the
+  // verdict is `required`; in the hermetic non-repo suite the git read fails to `exempt`, so
+  // `test-declared` claims nothing and the "exactly one rule" invariant over `run-tail`'s fixture holds.
+  test_declared_commit.ROW,
+  // **The one row whose trigger reads a field of the input beside the command**, so it supplies its
+  // own tool-name check rather than going through `on_bash_command`: a push step already issued with
+  // `run_in_background` is the rule obeyed, and refusing it would charge a run for doing the right
+  // thing. It supplies `decide` because a push is a recurring act — one per child in a batch, and a
+  // second inside one `fullrun` when round 2 fixes a finding in place.
+  {
+    id: "run-tail",
+    is_trigger: run_tail.is_foreground_push_step,
+    reason: run_tail.RUN_TAIL_REASON,
+    decide: run_tail.decide,
+    keeps: run_tail.is_backgrounded_push_step,
+    reaches: run_tail.is_push_step_call
+  },
+  // **The one row whose trigger consults the world beside the command**, because "is this a lane that
+  // has not cut" is not readable from the call: it is the working directory's own name and the cut
+  // record on disk. Both reads are synchronous, and the command match runs first, so a run that never
+  // types `pnpm josh gate` pays nothing for it.
+  //
+  // **Once per run rather than `decide`, and the direction of the error is why.** Taking the cut ends
+  // the process, so this is not the recurring act joshuafolkken/kit#1570 wrote `decide` for — and the
+  // five verdicts that legitimately leave a run at the gate (`not-a-lane`, `unready`, `busy`,
+  // `failed`, `unknown`) all need the reissue to go through. A row that refused every time would wedge exactly
+  // those runs; a row that refuses once cannot.
+  //
+  // **`pnpm josh rule:value` read this row with a ceiling of about 50%, and joshuafolkken/kit#1867 is
+  // what removed it** (the ceiling was recorded here by joshuafolkken/kit#1864's review round 2). A
+  // cut relaunches a *new session*, which the measurement groups as a run of its own, and that
+  // resumed run issues the entry check — so scored on the asking alone it joined the denominator
+  // while never being able to satisfy `keeps`, which only the cutting run can, and ten perfectly
+  // obedient children read as ten kept out of twenty. **The two halves are separable, just not from
+  // one call**: both processes issue byte-identical `--resume` strings, but the `fresh` verdict sends
+  // a run on to claim the working-tree hold while the `resume` verdict tells its counterpart to skip
+  // that claim. `reaches_the_pre_gate_boundary` is that conjunction, and it is why `CallTest` is
+  // handed the run's calls beside the turn's rather than a second predicate slot of its own.
+  // Dropping `reaches` altogether is still strictly worse — the trigger evaluates against the
+  // *measuring* process's working directory, so it is always false from the main checkout and the row
+  // would read as no runs at all.
+  //
+  // **It overlaps `piped-verification` on a piped gate call, and the order is safe in both
+  // directions.** `pnpm josh gate | tail` in an uncut lane is a real instance of both defects; the
+  // earlier row speaks, its own reason says to reissue, and this one delivers on the reissue — the
+  // reading "the losing rule's delivery is still correct one call later" that the comment below
+  // requires of any admissible overlap.
+  {
+    id: "pre-gate-cut",
+    is_trigger: on_bash_command2(pre_gate_cut.is_uncut_gate),
+    reason: pre_gate_cut.PRE_GATE_CUT_REASON,
+    keeps: on_bash_command2(pre_gate_cut.takes_the_cut),
+    reaches: reaches_the_pre_gate_boundary
+  },
+  // **The second row whose trigger consults the world beside the command** (joshuafolkken/kit#2034):
+  // "is this a dispatched lane child" is the dispatch mark against this checkout's own issue, read
+  // synchronously by `lane_child_marker.is_child_of`, and the command match runs first so an ordinary
+  // run pays nothing for it.
+  //
+  // **Once per run rather than `decide`, and no `already_satisfied`.** The stop ends the turn, so it
+  // is not the recurring act joshuafolkken/kit#1570 wrote `decide` for. It carries no
+  // `already_satisfied` because the park it asks for is a GitHub label a synchronous guard cannot
+  // read, and the transcript-tail alternative would read a child that merely *read*
+  // `backlogrun-park.md` — whose prose carries the `labels[]=needs-decision` command — as compliant
+  // and fall silent on a real violation. `lane-park.ts` states why one wasted reissue on the compliant
+  // path is the safe direction. `keeps` reads an actual label-application `Bash` command, never the
+  // tail, so it is not fooled the same way; `reaches` stays `is_trigger`, since a compliant run issues
+  // the same confirmation notify and belongs in the denominator.
+  {
+    id: "lane-park",
+    is_trigger: on_bash_command2(lane_park.is_unparked_stop),
+    reason: lane_park.LANE_PARK_REASON,
+    keeps: on_bash_command2(lane_park.records_the_park)
+  },
+  // **joshuafolkken/kit#2034's rule, one tool-call earlier** (joshuafolkken/kit#2201). `lane-park`
+  // fires on the `confirmation` notify a routed child reaches; a child that reaches for
+  // `AskUserQuestion` never gets there, because the harness ends its turn at the refused ask. This
+  // row's trigger is that ask, so the refusal becomes an instruction — park the question — instead of
+  // the child's death. Its trigger reads the input's tool name and consults the dispatch mark, like
+  // `lane-park`, and shares no command with any Bash row, so it claims no `gh` / `git` / `josh` call.
+  // It fires on every occurrence (`decide` returns true), the disposition `git-force.ts` takes: an
+  // interactive ask must never succeed in a child, and the route is always the park, never a reissue.
+  lane_interactive_ask.ROW,
+  // **The three Bash-string gaps the deny glob cannot express** (joshuafolkken/kit#2120), each reading
+  // the command's argv rather than a literal a glob keys on. They share no trigger with any row above —
+  // force/delete is `git push` / `git branch`, the worktree change is `git checkout` / `restore` /
+  // `stash`, and the file body is a heredoc / `node -e` / `perl -i` — so no two rows claim one command,
+  // which `delivered-rules-bash.test.ts` pins. Each declares `decide` returning true: a destructive or
+  // billed act is refused on every occurrence, never once per run (`git-force.ts`).
+  git_force.ROW,
+  worktree_guard.ROW,
+  file_body.ROW
+];
+var ALONE_IN_TURN = 1;
+function batches_the_turn(call, turn) {
+  return time_batch_guard.is_guarded_call(call) && turn.length > ALONE_IN_TURN;
+}
+var BATCHING_RULE = {
+  id: "batching",
+  reason: time_batch_guard.REASON,
+  keeps: batches_the_turn,
+  reaches: time_batch_guard.is_guarded_call
+};
+var INVESTIGATION_RULE = {
+  id: "investigation",
+  reason: investigation_reads.REASON,
+  reaches: investigation_reads.is_refusable_call
+};
+var MEASURED_RULES = [
+  ...DELIVERED_RULES,
+  BATCHING_RULE,
+  INVESTIGATION_RULE
+];
+var BATCH_STAMP = hook_decision.create_refusal_stamp(time_batch_guard.STAMP_PREFIX);
+var BATCH_REFUSAL_WINDOW_MS = 1e4;
+function will_batch_guard_refuse(tail, call, run) {
+  if (lane_guard_policy.mode_here("batching") !== "refuse") return false;
+  const refused_at_ms = BATCH_STAMP.last_ms(BATCH_STAMP.path(run.transcript));
+  if (run.now_ms - refused_at_ms < BATCH_REFUSAL_WINDOW_MS) return true;
+  return time_batch_guard.should_block(tail, call, refused_at_ms);
+}
+function is_first_delivery(tail, call, delivered_at_ms, run) {
+  if (delivered_at_ms !== hook_decision.NEVER_MS) return false;
+  return !will_batch_guard_refuse(tail, call, run);
+}
+function delivery_decision(rule) {
+  const { decide: decide4, already_satisfied } = rule;
+  if (decide4 === void 0 && already_satisfied === void 0) return is_first_delivery;
+  return function should_block(tail, call, delivered_at_ms, run) {
+    if (already_satisfied?.(tail, call) === true) return false;
+    if (decide4 === void 0) return is_first_delivery(tail, call, delivered_at_ms, run);
+    return decide4(call, run, !will_batch_guard_refuse(tail, call, run));
+  };
+}
+function guard_of(rule) {
+  return hook_decision.create_transcript_guard({
+    prefix: `${STAMP_PREFIX}${rule.id}-`,
+    switch_key: SWITCH_ENV_KEY,
+    is_candidate: rule.is_trigger,
+    should_block: delivery_decision(rule),
+    reason: rule.reason
+  });
+}
+var GUARDS = new Map(DELIVERED_RULES.map((rule) => [rule.id, guard_of(rule)]));
+function delivery_path(rule_id, transcript_path) {
+  const guard = GUARDS.get(rule_id);
+  return guard === void 0 ? "" : guard.refusal_path(transcript_path);
+}
+function delivery(raw_payload, now_ms = Date.now()) {
+  for (const guard of GUARDS.values()) {
+    const reason = guard.refusal(raw_payload, now_ms);
+    if (reason !== void 0) return reason;
+  }
+  return void 0;
+}
+function is_enabled() {
+  return hook_decision.is_switch_enabled(SWITCH_ENV_KEY);
+}
+var delivered_rules = {
+  DELIVERED_RULES,
+  EARLY_HEARTBEAT_REASON: early_heartbeat.EARLY_HEARTBEAT_REASON,
+  FILE_BODY_REASON: file_body.FILE_BODY_REASON,
+  FILING_CAP_REASON: filing_cap.FILING_CAP_REASON,
+  GIT_FORCE_REASON: git_force.GIT_FORCE_REASON,
+  ISSUE_COMMENTS_REASON,
+  ISSUE_SCOUT_REASON: issue_scout.ISSUE_SCOUT_REASON,
+  LANE_INTERACTIVE_ASK_REASON: lane_interactive_ask.LANE_INTERACTIVE_ASK_REASON,
+  LANE_PARK_REASON: lane_park.LANE_PARK_REASON,
+  MEASURED_RULES,
+  PIPED_VERIFICATION_REASON: piped_verification.PIPED_VERIFICATION_REASON,
+  PRE_GATE_CUT_REASON: pre_gate_cut.PRE_GATE_CUT_REASON,
+  RUN_TAIL_REASON: run_tail.RUN_TAIL_REASON,
+  SHELL_BODY_REASON,
+  SWITCH_ENV_KEY,
+  THIRD_PARTY_WRITE_REASON: third_party_write.THIRD_PARTY_WRITE_REASON,
+  WIP_CAP_REASON,
+  WORKTREE_MUTATION_REASON: worktree_guard.WORKTREE_MUTATION_REASON,
+  delivery,
+  delivery_path,
+  is_body_only_issue_read,
+  is_enabled,
+  is_issue_filing: is_issue_filing2,
+  is_masked_verification: piped_verification.is_masked_verification,
+  is_wait_timer: early_heartbeat.is_wait_timer
+};
+
+// scripts/hooks/pretool-guard.ts
+function combine_outcomes(batch, extra_reason) {
+  if (batch.reason !== void 0) return batch;
+  if (extra_reason !== void 0) {
+    return { reason: extra_reason, notice: void 0, fault: void 0 };
+  }
+  return batch;
+}
+function pretool_outcome(raw_payload) {
+  const batch = batch_outcome(raw_payload);
+  const investigation = investigation_refusal(raw_payload);
+  const rule = delivered_rules.delivery(raw_payload);
+  return combine_outcomes(batch, investigation ?? rule);
+}
+var pretool_guard = { combine_outcomes, pretool_outcome };
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  if (process.stdin.isTTY) hook_decision.report_no_payload("pretool:guard");
+  else hook_decision.write_outcome(await text(process.stdin), pretool_outcome);
+}
+
+export {
+  pretool_outcome,
+  pretool_guard
+};