@open-tomato/rafa 0.10.0 → 0.11.0

package/dist/index.js

@@ -1895,7 +1895,7 @@ async function report(args, repoRoot) {
   }
 }
 // package.json
-var version = "0.10.0";
+var version = "0.11.0";
 
 // src/modules/manifest.ts
 var MANIFEST_VERSION = 1;
@@ -2185,9 +2185,11 @@ function requireProject(context, command) {
   return context.project;
 }
 function resolvePlansDir(project, command, warn) {
+  return plansDirAt(project.root, resolveProjectConfig(project, command, warn).planDir);
+}
+function resolveProjectConfig(project, command, warn) {
   try {
-    const { config } = loadConfig({ root: project.root, home: project.home }, {}, warn);
-    return plansDirAt(project.root, config.planDir);
+    return loadConfig({ root: project.root, home: project.home }, {}, warn).config;
   } catch (error) {
     if (!(error instanceof ConfigError))
       throw error;
@@ -9689,12 +9691,768 @@ async function finishRelease(input, seams = {}) {
   return { outcome: "released", version: version2, subject, sha, sentence: null, body: null };
 }
 
+// src/start/risk-total.ts
+import { readFileSync as readFileSync18 } from "fs";
+
+// src/plan/risk.ts
+import { readFileSync as readFileSync17 } from "fs";
+import { isAbsolute as isAbsolute3, join as join13, relative as relative2 } from "path";
+
+// src/schema/tiers.ts
+import { existsSync as existsSync16, realpathSync as realpathSync3 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
+var SKILL_TIERS = ["project", "rafa", "user"];
+var CLAUDE_SKILLS_PATH = join12(".claude", "skills");
+var RAFA_INSTINCTS_PATH = join12(".rafa", "instincts");
+var BUNDLED_SKILLS_DIR = "skills";
+function realEntry(entry) {
+  try {
+    return realpathSync3(entry);
+  } catch {
+    return entry;
+  }
+}
+function bundledSkillsDirectory(entry) {
+  return join12(dirname6(realEntry(entry ?? Bun.main)), BUNDLED_SKILLS_DIR);
+}
+function skillTierDirectory(tier, seams) {
+  if (tier === "user")
+    return join12(seams.home, CLAUDE_SKILLS_PATH);
+  if (tier === "rafa")
+    return bundledSkillsDirectory(seams.entry);
+  return seams.projectRoot === null ? null : join12(seams.projectRoot, CLAUDE_SKILLS_PATH);
+}
+function resolveSkillTiers(seams) {
+  const located = [];
+  for (const tier of SKILL_TIERS) {
+    const dir = skillTierDirectory(tier, seams);
+    if (dir !== null)
+      located.push({ tier, dir });
+  }
+  return located;
+}
+
+// src/plan/risk/accounts.ts
+var PUSH_REMOTE = "origin";
+var GITHUB_TRACKER = "github";
+var URL_USER_INFO = /^([A-Za-z][A-Za-z0-9+.-]*:\/\/)[^@/]+@/;
+function redactRemote(url) {
+  return url.trim().replace(URL_USER_INFO, "$1***@");
+}
+function trackerChain(settings) {
+  return [...new Set([settings.trackerDefault, ...settings.trackerFallback])];
+}
+async function readAccounts(settings, seams) {
+  const pushUrl = remoteUrl(seams.git, ["remote", "get-url", "--push", PUSH_REMOTE]);
+  const fetchUrl = remoteUrl(seams.git, ["remote", "get-url", PUSH_REMOTE]);
+  const chain = trackerChain(settings);
+  const reading2 = resolvePrProvider({
+    configured: settings.prProvider,
+    dir: "",
+    readRemote: () => fetchUrl
+  });
+  const needsOwnRepo = chain.includes(GITHUB_TRACKER) || reading2.provider === "gh";
+  const ownRepo = needsOwnRepo ? await viewRepo(seams.gh, []) : null;
+  return [
+    finding("push-remote", pushRemoteText(pushUrl)),
+    finding("visibility", await visibilityText(pushUrl, seams.gh)),
+    finding("issue-tracker", trackerText(chain, ownRepo)),
+    finding("pr-provider", providerText(reading2.provider, reading2.source, ownRepo))
+  ];
+}
+function finding(subject, text) {
+  return { level: "note", kind: "account", subject, text };
+}
+function remoteUrl(git, args) {
+  const result = git(args);
+  const url = result.stdout.trim();
+  return result.ok && url !== "" ? url : null;
+}
+function pushRemoteText(pushUrl) {
+  return pushUrl === null ? `push remote: no ${PUSH_REMOTE} remote, so the loop's push would fail` : `push remote: ${PUSH_REMOTE} \u2192 ${redactRemote(pushUrl)}`;
+}
+async function visibilityText(pushUrl, gh) {
+  if (pushUrl === null) {
+    return "visibility: not read, there is no push remote";
+  }
+  if (!isGitHubRemote(pushUrl)) {
+    const host = remoteHost(pushUrl) ?? "a local path";
+    return `visibility: not read, ${host} is not a GitHub host`;
+  }
+  const slug = repoSlug(pushUrl);
+  const view = await viewRepo(gh, [slug]);
+  if (!view.ok) {
+    return `visibility: not read, ${view.reason}`;
+  }
+  const name = view.name ?? slug;
+  return view.visibility === null ? `visibility: not read, gh named no visibility for ${name}` : `visibility: ${name} is ${view.visibility}`;
+}
+function repoSlug(url) {
+  return normalizeRemote(url).replace(/^([^/]+):\d+\//, "$1/").replace(/^ssh\.github\.com\//, "github.com/");
+}
+function trackerText(chain, ownRepo) {
+  const [first, ...rest] = chain;
+  const fallback = rest.length === 0 ? "" : `, falling back to ${rest.join(", then ")}`;
+  const where = chain.includes(GITHUB_TRACKER) && ownRepo !== null ? `; github files on ${repoPhrase(ownRepo)}` : "";
+  return `issue tracker: ${first ?? "none configured"}${fallback}${where}`;
+}
+function providerText(provider, source, ownRepo) {
+  const from = source === "config" ? "set in the config" : `inferred from ${PUSH_REMOTE}`;
+  const effect = provider === "gh" && ownRepo !== null ? `, opening pull requests on ${repoPhrase(ownRepo)}` : "";
+  const none = provider === "none" ? ", so the loop pushes and opens no pull request" : "";
+  return `pull request provider: ${provider} (${from})${effect}${none}`;
+}
+function repoPhrase(view) {
+  if (!view.ok) {
+    return `the repository gh resolves, which it could not: ${view.reason}`;
+  }
+  return view.name ?? "the repository gh resolves, which it did not name";
+}
+async function viewRepo(gh, target) {
+  const result = await gh(["repo", "view", ...target, "--json", "nameWithOwner,visibility"]);
+  if (!result.ok) {
+    return { ok: false, reason: `gh repo view: ${firstLine(result.stderr) ?? "gh exited non-zero"}` };
+  }
+  const parsed = parseJsonObject(result.stdout);
+  if (parsed === null) {
+    return { ok: false, reason: "gh repo view: answered no JSON object" };
+  }
+  return {
+    ok: true,
+    name: stringField(parsed, "nameWithOwner"),
+    visibility: stringField(parsed, "visibility")?.toLowerCase() ?? null
+  };
+}
+function parseJsonObject(text) {
+  try {
+    const value = JSON.parse(text);
+    return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function stringField(object, key) {
+  const value = object[key];
+  return typeof value === "string" && value !== "" ? value : null;
+}
+function firstLine(text) {
+  return text.split(`
+`).map((line) => line.trim()).find((line) => line !== "") ?? null;
+}
+
+// src/plan/risk/commands.ts
+import { posix } from "path";
+
+// src/check/shell-lines.ts
+var SHELL_FENCE_LANGUAGES = ["bash", "sh", "shell", "zsh", "console"];
+var FOREIGN_KEYWORDS = [
+  "async",
+  "await",
+  "class",
+  "const",
+  "def",
+  "enum",
+  "fn",
+  "from",
+  "func",
+  "impl",
+  "import",
+  "interface",
+  "new",
+  "package",
+  "private",
+  "protected",
+  "public",
+  "static",
+  "struct",
+  "throw",
+  "val",
+  "var"
+];
+var HEREDOC = /<<-?\s*['"]?([A-Za-z_][A-Za-z0-9_]*)['"]?/;
+var CONTINUES = /\\$/;
+var SPACED_ASSIGNMENT = /^\s*[A-Za-z_$][A-Za-z0-9_$.]*\s+=(?!=)\s+\S/;
+var FOREIGN_COMMENT = /^\s*(?:\/\/|\/\*|\*\/|\*\s)/;
+function isShellFence(info) {
+  return SHELL_FENCE_LANGUAGES.includes(info);
+}
+function commandOf(line, info) {
+  const text = line.trim();
+  if (text === "" || text.startsWith("#"))
+    return null;
+  if (text.startsWith("$ ") || text === "$")
+    return text.slice(1).trim() || null;
+  if (info === "console")
+    return null;
+  if (text.startsWith("> "))
+    return null;
+  return text;
+}
+function heredocTerminator(command) {
+  return HEREDOC.exec(command)?.[1] ?? null;
+}
+function continuesLine(command) {
+  return CONTINUES.test(command);
+}
+function isForeignCodeLine(line) {
+  const text = line.trim();
+  if (text === "")
+    return false;
+  if (FOREIGN_COMMENT.test(text))
+    return true;
+  if (SPACED_ASSIGNMENT.test(text))
+    return true;
+  return FOREIGN_KEYWORDS.includes(text.split(/\s+/)[0] ?? "");
+}
+
+// src/plan/risk/patterns.ts
+var COMMAND_WRAPPERS = [
+  "command",
+  "do",
+  "else",
+  "env",
+  "exec",
+  "nohup",
+  "sudo",
+  "then",
+  "time",
+  "xargs"
+];
+var OPENER = String.raw`(?:^|[;&|({\x60]|\s-exec(?:dir)?\s)`;
+var ASSIGNMENTS = String.raw`(?:[A-Za-z_]\w*=\S*\s+)*`;
+var WRAPPERS = String.raw`(?:(?:${COMMAND_WRAPPERS.join("|")})(?:\s+-\S+)*\s+${ASSIGNMENTS})*`;
+var AT_COMMAND = String.raw`${OPENER}\s*${ASSIGNMENTS}${WRAPPERS}`;
+var REST = "[^;&|]*";
+var GIT_OPTIONS = String.raw`(?:\s+(?:-[Cc]\s+\S+|--?[\w-]+(?:=\S+)?))*`;
+function hasFlag(short, long) {
+  return String.raw`(?=(?:${REST}\s)?(?:-[A-Za-z]*${short}[A-Za-z]*|--${long})(?=\s|$))`;
+}
+function atCommand(name, body) {
+  return { name, expression: new RegExp(`${AT_COMMAND}${body}`) };
+}
+var DESTRUCTIVE_PATTERNS = [
+  atCommand("rm -rf", String.raw`rm\s+${hasFlag("[rR]", "recursive")}${hasFlag("f", "force")}`),
+  atCommand("git push --force", String.raw`git${GIT_OPTIONS}\s+push\b(?=${REST}\s(?:--force|-[A-Za-z]*f[A-Za-z]*)(?=\s|$))`),
+  atCommand("git reset --hard", String.raw`git${GIT_OPTIONS}\s+reset\b(?=${REST}\s--hard(?=\s|$))`),
+  atCommand("git clean -f", String.raw`git${GIT_OPTIONS}\s+clean\s+${hasFlag("f", "force")}`),
+  atCommand("sudo", String.raw`sudo(?=\s|$)`),
+  atCommand("brew install", String.raw`brew(?:\s+-\S+)*\s+install\b`),
+  atCommand("npm i -g", String.raw`npm\s+(?:i|install|add)(?=\s)(?=${REST}\s(?:-g|--global)(?=\s|$))`),
+  atCommand("pip install", String.raw`(?:python3?\s+-m\s+)?pip3?\s+install\b`),
+  atCommand("npm publish", String.raw`npm\s+publish\b(?!${REST}--dry-run)`),
+  atCommand("curl \u2026 | sh", String.raw`curl\b[^;&|]*\|(?!\|)\s*${WRAPPERS}(?:ba|z|da)?sh(?=\s|$)`),
+  atCommand("chmod -R", String.raw`chmod\s+${hasFlag("R", "recursive")}`),
+  { name: "DROP TABLE", expression: /\bDROP\s+TABLE\b/i },
+  atCommand("docker system prune", String.raw`docker\s+system\s+prune\b`)
+];
+function destructiveMatches(command) {
+  return DESTRUCTIVE_PATTERNS.filter((pattern) => pattern.expression.test(command));
+}
+
+// src/plan/risk/commands.ts
+var DEVICE_FILES = [
+  "/dev/null",
+  "/dev/stdin",
+  "/dev/stdout",
+  "/dev/stderr",
+  "/dev/tty"
+];
+var WRITES_EVERY_OPERAND = ["mv", "rm", "tee"];
+var COMMAND_PREFIXES = [...COMMAND_WRAPPERS, "!", "{"];
+var FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})[ \t]*(\S*)/;
+var FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
+var CODE_SPAN2 = /`([^`\n]+)`/g;
+var REDIRECT = /^(?:&>>|&>|>>|>\||>&|<<<|<<-|<<|<&|<>|>|<)/;
+var OUTPUT_REDIRECTS = /^(?:\d*(?:>>|>\||>&|<>|>)|&>>|&>)$/;
+var HEREDOC_REDIRECTS = /^\d*<<[-<]?$/;
+var SEPARATORS2 = ";&|()`";
+var ASSIGNMENT = /^[A-Za-z_]\w*=/;
+var SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+function openFence(open) {
+  const run = open[1] ?? "";
+  return {
+    info: (open[2] ?? "").split(/[\s,{]/)[0]?.toLowerCase() ?? "",
+    delimiter: run[0] ?? "`",
+    length: run.length,
+    terminator: null,
+    pending: null,
+    foreign: false,
+    commands: []
+  };
+}
+function closesFence(line, fence) {
+  const run = FENCE_CLOSE.exec(line)?.[1] ?? "";
+  return run !== "" && run[0] === fence.delimiter && run.length >= fence.length;
+}
+function withoutBackslash(piece) {
+  return piece.replace(/\\$/, "").trim();
+}
+function flush(fence) {
+  if (fence.pending !== null)
+    fence.commands.push({ text: fence.pending.text, line: fence.pending.line });
+  fence.pending = null;
+}
+function continuationOf(line, info) {
+  const text = line.trim();
+  return info === "console" && text.startsWith("> ") ? text.slice(2) : text;
+}
+function readFenceLine(fence, line, number) {
+  const pending = fence.pending;
+  if (pending === null && fence.terminator !== null) {
+    if (line.trim() === fence.terminator)
+      fence.terminator = null;
+    return;
+  }
+  const piece = pending === null ? commandOf(line, fence.info) : continuationOf(line, fence.info);
+  if (piece === null || piece === "")
+    return;
+  if (isForeignCodeLine(piece)) {
+    fence.foreign = true;
+    return;
+  }
+  fence.terminator = heredocTerminator(piece) ?? fence.terminator;
+  if (pending === null)
+    fence.pending = { text: withoutBackslash(piece), line: number };
+  else
+    pending.text = `${pending.text} ${withoutBackslash(piece)}`;
+  if (!continuesLine(piece))
+    flush(fence);
+}
+function commandsOf(fence) {
+  flush(fence);
+  return fence.foreign ? [] : fence.commands;
+}
+function shellCommandLines(body) {
+  const found = [];
+  let fence = null;
+  for (const [index, line] of body.split(`
+`).entries()) {
+    if (fence === null) {
+      const open = FENCE_OPEN.exec(line);
+      if (open !== null)
+        fence = openFence(open);
+      continue;
+    }
+    if (closesFence(line, fence)) {
+      found.push(...commandsOf(fence));
+      fence = null;
+      continue;
+    }
+    if (isShellFence(fence.info) && !fence.foreign)
+      readFenceLine(fence, line, index + 1);
+  }
+  if (fence !== null)
+    found.push(...commandsOf(fence));
+  return found;
+}
+function taskLineCommands(taskLine, line) {
+  const found = [];
+  for (const match of taskLine.matchAll(CODE_SPAN2)) {
+    const command = commandOf(match[1] ?? "", "sh");
+    if (command !== null && !isForeignCodeLine(command))
+      found.push({ text: command, line });
+  }
+  return found;
+}
+function quotedEnd(command, start) {
+  const quote = command[start];
+  let index = start + 1;
+  while (index < command.length && command[index] !== quote) {
+    index += quote === '"' && command[index] === "\\" ? 2 : 1;
+  }
+  return Math.min(index + 1, command.length);
+}
+function unquote(run) {
+  const closed = run.length > 1 && run.endsWith(run[0] ?? "");
+  const inner = run.slice(1, closed ? -1 : undefined);
+  return run.startsWith('"') ? inner.replace(/\\(["\\$`])/g, "$1") : inner;
+}
+function opensRedirect(rest) {
+  return rest.startsWith(">") || rest.startsWith("<") || rest.startsWith("&>");
+}
+function shellTokens(command) {
+  const tokens = [];
+  let word = "";
+  let hasWord = false;
+  const endWord = () => {
+    if (hasWord)
+      tokens.push({ kind: "word", text: word });
+    word = "";
+    hasWord = false;
+  };
+  let index = 0;
+  while (index < command.length) {
+    const char = command[index] ?? "";
+    const rest = command.slice(index);
+    if (opensRedirect(rest)) {
+      const fd = /^\d+$/.test(word) ? word : "";
+      if (fd === "")
+        endWord();
+      word = "";
+      hasWord = false;
+      const operator = REDIRECT.exec(rest)?.[0] ?? char;
+      tokens.push({ kind: "redirect", text: `${fd}${operator}` });
+      index += operator.length;
+    } else if (char === "'" || char === '"') {
+      const end = quotedEnd(command, index);
+      word += unquote(command.slice(index, end));
+      hasWord = true;
+      index = end;
+    } else if (char === "\\") {
+      word += command[index + 1] ?? "";
+      hasWord = true;
+      index += 2;
+    } else if (/\s/.test(char)) {
+      endWord();
+      index += 1;
+    } else if (SEPARATORS2.includes(char)) {
+      endWord();
+      const operator = /^(?:&&|\|\||[;&|()`])/.exec(rest)?.[0] ?? char;
+      tokens.push({ kind: "separator", text: operator });
+      index += operator.length;
+    } else {
+      word += char;
+      hasWord = true;
+      index += 1;
+    }
+  }
+  endWord();
+  return tokens;
+}
+function segmentsOf(tokens) {
+  const segments = [[]];
+  for (const token of tokens) {
+    if (token.kind === "separator")
+      segments.push([]);
+    else
+      segments.at(-1)?.push(token);
+  }
+  return segments.filter((segment) => segment.length > 0);
+}
+function wordsOf2(segment) {
+  const argv = [];
+  const redirected = [];
+  let operator = null;
+  for (const token of segment) {
+    if (token.kind === "redirect") {
+      operator = token.text;
+    } else if (operator === null) {
+      argv.push(token.text);
+    } else {
+      if (!HEREDOC_REDIRECTS.test(operator)) {
+        redirected.push({ word: token.text, writes: OUTPUT_REDIRECTS.test(operator) });
+      }
+      operator = null;
+    }
+  }
+  return { argv, redirected };
+}
+function commandIndex(argv) {
+  let index = 0;
+  let afterWrapper = false;
+  while (index < argv.length) {
+    const word = argv[index] ?? "";
+    const isWrapperFlag = afterWrapper && word.startsWith("-");
+    if (!ASSIGNMENT.test(word) && !COMMAND_PREFIXES.includes(word) && !isWrapperFlag)
+      return index;
+    afterWrapper = COMMAND_PREFIXES.includes(word) || isWrapperFlag;
+    index += 1;
+  }
+  return index;
+}
+function operandsOf(args) {
+  const end = args.indexOf("--");
+  const flagged = end === -1 ? args : args.slice(0, end);
+  const after = end === -1 ? [] : args.slice(end + 1);
+  return [...flagged.filter((word) => !word.startsWith("-")), ...after];
+}
+function copyTargets(args) {
+  const flag = args.indexOf("-t");
+  if (flag !== -1 && args[flag + 1] !== undefined)
+    return [args[flag + 1] ?? ""];
+  const long = args.find((word) => word.startsWith("--target-directory="));
+  if (long !== undefined)
+    return [long.slice("--target-directory=".length)];
+  return operandsOf(args).slice(-1);
+}
+function writtenWords(argv) {
+  const at = commandIndex(argv);
+  const name = posix.basename(argv[at] ?? "");
+  const args = argv.slice(at + 1);
+  if (WRITES_EVERY_OPERAND.includes(name))
+    return new Set(operandsOf(args));
+  if (name === "cp")
+    return new Set(copyTargets(args));
+  return new Set;
+}
+function pathCandidate(word) {
+  if (word.startsWith("/") || word.startsWith("~"))
+    return word;
+  const equals = word.indexOf("=");
+  return equals === -1 ? word : word.slice(equals + 1);
+}
+function isWithin(root, target) {
+  const step = posix.relative(posix.resolve(root), posix.resolve(target));
+  return !step.startsWith("..") && !posix.isAbsolute(step);
+}
+function isOutsidePath(path5, seams) {
+  if (SCHEME.test(path5) || path5.startsWith("//") || DEVICE_FILES.includes(path5))
+    return false;
+  if (path5 === "~" || path5.startsWith("~/"))
+    return !isWithin(seams.repoRoot, posix.join(seams.home, path5.slice(1)));
+  if (path5.startsWith("~"))
+    return true;
+  return path5.startsWith("/") && !isWithin(seams.repoRoot, path5);
+}
+function outsidePaths(command, seams) {
+  const found = new Map;
+  const note = (word, writes) => {
+    const path5 = pathCandidate(word);
+    if (isOutsidePath(path5, seams))
+      found.set(path5, (found.get(path5) ?? false) || writes);
+  };
+  for (const segment of segmentsOf(shellTokens(command))) {
+    const { argv, redirected } = wordsOf2(segment);
+    const written = writtenWords(argv);
+    for (const word of argv)
+      note(word, written.has(word) || written.has(pathCandidate(word)));
+    for (const target of redirected)
+      note(target.word, target.writes);
+  }
+  return Array.from(found, ([path5, writes]) => ({ path: path5, writes }));
+}
+function findingsOf(command, seams) {
+  const destructive = destructiveMatches(command.text).map((pattern) => ({
+    level: "high",
+    kind: "destructive",
+    text: `${pattern.name} \u2014 ${command.text}`,
+    subject: pattern.name,
+    command: command.text,
+    line: command.line
+  }));
+  const paths = outsidePaths(command.text, seams).map((path5) => ({
+    level: path5.writes ? "high" : "note",
+    kind: "outside-path",
+    text: `${path5.path} \u2014 ${path5.writes ? "written by" : "named in"} ${command.text}`,
+    subject: path5.path,
+    command: command.text,
+    line: command.line
+  }));
+  return [...destructive, ...paths];
+}
+function readCommands2(commands, seams) {
+  return commands.flatMap((command) => findingsOf(command, seams));
+}
+function readBodyCommands(body, seams) {
+  return readCommands2(shellCommandLines(body), seams);
+}
+function readTaskLineCommands(taskLine, line, seams) {
+  return readCommands2(taskLineCommands(taskLine, line), seams);
+}
+
+// src/plan/risk/secrets.ts
+var SECRET_NAME_SHAPES = [
+  { name: "*_TOKEN", expression: /_TOKEN$/ },
+  { name: "*_KEY", expression: /_KEY$/ },
+  { name: "*_SECRET", expression: /_SECRET$/ },
+  { name: "*PASSWORD*", expression: /PASSWORD/ },
+  { name: "AWS_*", expression: /^AWS_/ }
+];
+function secretShapesOf(name) {
+  return SECRET_NAME_SHAPES.filter((shape) => shape.expression.test(name));
+}
+function scanSecretNames(environment) {
+  return [...Object.keys(environment)].sort().flatMap((name) => {
+    const shapes = secretShapesOf(name);
+    if (shapes.length === 0) {
+      return [];
+    }
+    const matched = shapes.map((shape) => shape.name).join(", ");
+    return [{ level: "note", kind: "secret", text: `${name} \u2014 matches ${matched}`, subject: name }];
+  });
+}
+
+// src/plan/risk.ts
+var RISK_KINDS = ["tools", "destructive", "outside-path", "account", "secret"];
+var EVERY_TOOL = "every tool";
+var SHELL_TOOL = "Bash";
+function agentTools(frontmatter) {
+  const value = frontmatter["tools"];
+  let names = [];
+  if (typeof value === "string")
+    names = value.split(",");
+  else if (Array.isArray(value))
+    names = value.filter((entry) => typeof entry === "string");
+  const tools = [...new Set(names.map((name) => name.trim()).filter((name) => name !== ""))];
+  return tools.length === 0 ? null : tools;
+}
+function holdsShell(tools) {
+  return tools.some((tool) => tool === SHELL_TOOL || tool.startsWith(`${SHELL_TOOL}(`));
+}
+function frontmatterString(frontmatter, key) {
+  const value = frontmatter[key];
+  return typeof value === "string" && value.trim() !== "" ? value.trim() : null;
+}
+function taskAccess(declaration, seams) {
+  const budget = declaration?.budget ?? null;
+  const agent = declaration?.agent ?? null;
+  if (agent === null) {
+    const tools2 = declaration?.tools ?? null;
+    return {
+      tools: tools2,
+      source: tools2 === null ? "no agent= and no tools=" : "tools=",
+      model: declaration?.model ?? null,
+      budget
+    };
+  }
+  const definition = findAgentDefinition(agent, { repoRoot: seams.repoRoot, home: seams.home }, seams.settingSources);
+  if (definition === null) {
+    return { tools: null, source: `agent=${agent} resolves to no definition`, model: null, budget };
+  }
+  const tools = agentTools(definition.frontmatter);
+  return {
+    tools,
+    source: tools === null ? `agent=${agent} has no tools: line` : `agent=${agent}`,
+    model: frontmatterString(definition.frontmatter, "model"),
+    budget
+  };
+}
+function toolsFinding(task, plan2, seams) {
+  const access = taskAccess(task.declaration, seams);
+  const model = `model ${access.model ?? "the session default"}`;
+  const budget = access.budget === null ? "no budget=" : `budget $${String(access.budget)}`;
+  const where = { task: task.text, file: plan2, line: task.lineNum + 1 };
+  if (access.tools === null) {
+    return { level: "high", kind: "tools", text: `${EVERY_TOOL} \u2014 ${access.source}; ${model}; ${budget}`, ...where };
+  }
+  if (holdsShell(access.tools) && access.budget === null) {
+    const listed = access.tools.join(", ");
+    return { level: "note", kind: "tools", text: `${SHELL_TOOL} with no budget= \u2014 ${access.source}: ${listed}; ${model}`, ...where };
+  }
+  return null;
+}
+function displayPath(path5, seams) {
+  const absolute = isAbsolute3(path5) ? path5 : join13(seams.repoRoot, path5);
+  const within = (root) => {
+    const step = relative2(root, absolute);
+    return step === "" || step.startsWith("..") || isAbsolute3(step) ? null : step;
+  };
+  const inRepo = within(seams.repoRoot);
+  if (inRepo !== null)
+    return inRepo;
+  const inHome = within(seams.home);
+  return inHome === null ? absolute : `~/${inHome}`;
+}
+function located(finding2, file, task) {
+  const base = { level: finding2.level, kind: finding2.kind, text: finding2.text };
+  return task === undefined ? { ...base, file, line: finding2.line } : { ...base, task, file, line: finding2.line };
+}
+function readText4(path5) {
+  try {
+    return readFileSync17(path5, "utf8");
+  } catch {
+    return null;
+  }
+}
+function findSkillFile(name, seams) {
+  const tiers = resolveSkillTiers({ home: seams.home, projectRoot: seams.repoRoot, entry: seams.entry });
+  for (const { dir } of tiers) {
+    const path5 = join13(dir, name, "SKILL.md");
+    if (readText4(path5) !== null)
+      return path5;
+  }
+  return null;
+}
+function taskFiles(declaration, seams) {
+  if (declaration === null)
+    return [];
+  const agent = declaration.agent === null ? null : findAgentDefinition(declaration.agent, { repoRoot: seams.repoRoot, home: seams.home }, seams.settingSources);
+  const skills = (declaration.skills ?? []).map((name) => findSkillFile(name, seams));
+  return [agent?.path ?? null, ...skills].filter((path5) => path5 !== null);
+}
+function commandFindings(plan2, display, tasks, seams) {
+  const paths = { repoRoot: seams.repoRoot, home: seams.home };
+  const found = readBodyCommands(plan2.text, paths).map((finding2) => located(finding2, display));
+  const read = new Set;
+  const lines = plan2.text.split(`
+`);
+  for (const task of tasks) {
+    const spans = readTaskLineCommands(lines[task.lineNum] ?? "", task.lineNum + 1, paths);
+    found.push(...spans.map((finding2) => located(finding2, display, task.text)));
+    for (const file of taskFiles(task.declaration, seams)) {
+      if (read.has(file))
+        continue;
+      read.add(file);
+      const shown = displayPath(file, seams);
+      found.push(...readBodyCommands(readText4(file) ?? "", paths).map((finding2) => located(finding2, shown)));
+    }
+  }
+  return found;
+}
+function openTasks(tasks, hidden) {
+  return [...tasks, ...hidden].filter((task) => task.status !== "done").sort((a, b) => a.lineNum - b.lineNum);
+}
+function riskTotal(findings) {
+  return {
+    high: findings.filter((finding2) => finding2.level === "high").length,
+    note: findings.filter((finding2) => finding2.level === "note").length
+  };
+}
+async function assessPlanRisk(plan2, seams) {
+  const model = parsePlan(plan2.text);
+  const display = displayPath(plan2.path, seams);
+  const tasks = openTasks(model.tasks, model.hiddenTasks);
+  const tools = tasks.flatMap((task) => toolsFinding(task, display, seams) ?? []);
+  const commands = commandFindings(plan2, display, tasks, seams);
+  const accounts = (await readAccounts(seams.accounts, seams.runners)).map(({ level, kind, text }) => ({ level, kind, text }));
+  const secrets = scanSecretNames(seams.environment).map(({ level, kind, text }) => ({ level, kind, text }));
+  const findings = [...tools, ...commands, ...accounts, ...secrets];
+  return { plan: display, total: riskTotal(findings), findings };
+}
+function counted2(count, word) {
+  return count === 1 ? `${String(count)} ${word}` : `${String(count)} ${word}s`;
+}
+function riskTotalLine(report2) {
+  return `\uD83D\uDEE1  Risk: ${String(report2.total.high)} high, ${counted2(report2.total.note, "note")} \u2014 rafa plan risk ${report2.plan}`;
+}
+var KIND_WIDTH = Math.max(...RISK_KINDS.map((kind) => kind.length));
+
+// src/start/risk-total.ts
+function spawningRunners(root) {
+  return { git: createGitRunner(root), gh: createGhRunner({ cwd: root }) };
+}
+async function readRiskTotalLine(input, seams = {}) {
+  const makeRunners = seams.runners ?? spawningRunners;
+  const report2 = await assessPlanRisk({ path: input.planPath, text: readFileSync18(input.planPath, "utf8") }, {
+    repoRoot: input.repoRoot,
+    home: input.home,
+    settingSources: input.config.settingSources,
+    environment: input.environment,
+    accounts: {
+      prProvider: input.config.prProvider,
+      trackerDefault: input.config.trackerDefault,
+      trackerFallback: input.config.trackerFallback
+    },
+    runners: makeRunners(input.repoRoot)
+  });
+  return riskTotalLine(report2);
+}
+async function announceRiskTotal(input, seams = {}) {
+  const output = seams.output ?? activeOutput();
+  try {
+    output.info(await readRiskTotalLine(input, seams));
+  } catch (error) {
+    const said = error instanceof Error ? error.message : String(error);
+    output.warn(`\u26A0\uFE0F  Risk: could not read ${input.planPath} \u2014 ${said}`);
+  }
+}
+
 // src/start/session.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { relative as relative2 } from "path";
+import { relative as relative3 } from "path";
 var NOTHING_DISPATCHED = "   Nothing was checked and nothing was dispatched.";
 function recordLabel(repoRoot, sessionId) {
-  return relative2(repoRoot, sessionFilePath(repoRoot, sessionId));
+  return relative3(repoRoot, sessionFilePath(repoRoot, sessionId));
 }
 function conflictLine(repoRoot, conflict) {
   const { record } = conflict;
@@ -9724,7 +10482,7 @@ function openRefusal(repoRoot, draft, error) {
   if (!(error instanceof SessionRecordError) && !isSystemError)
     return null;
   return [
-    `\u274C Refusing to start: the session records under ${relative2(repoRoot, runsDir(repoRoot))}/ cannot be read or written.`,
+    `\u274C Refusing to start: the session records under ${relative3(repoRoot, runsDir(repoRoot))}/ cannot be read or written.`,
     `   ${messageOf(error)}`,
     NOTHING_DISPATCHED
   ].join(`
@@ -9760,7 +10518,7 @@ function openRunSession(options) {
   const draft = {
     sessionId: (seams.newSessionId ?? randomUUID8)(),
     planStub: options.planStub,
-    plan: relative2(repoRoot, options.planPath),
+    plan: relative3(repoRoot, options.planPath),
     branch: options.branch,
     pid: seams.pid ?? process.pid,
     startedAt: (seams.now ?? (() => new Date))().toISOString()
@@ -9837,11 +10595,11 @@ function announcePlanIssues(planContent) {
 }
 
 // src/start/runtime.ts
-import { existsSync as existsSync16, readdirSync as readdirSync6, realpathSync as realpathSync3, statSync as statSync9 } from "fs";
+import { existsSync as existsSync17, readdirSync as readdirSync6, realpathSync as realpathSync4, statSync as statSync9 } from "fs";
 import { homedir as homedir6 } from "os";
-import { isAbsolute as isAbsolute3, join as join12, relative as relative3, resolve as resolve10, sep } from "path";
+import { isAbsolute as isAbsolute4, join as join14, relative as relative4, resolve as resolve10, sep } from "path";
 var RUNTIME_FLAG = "--runtime";
-var RUNTIME_SUBDIR = join12(".rafa", "runtime");
+var RUNTIME_SUBDIR = join14(".rafa", "runtime");
 var RUNTIME_ENTRY = "cli.js";
 var SOURCE_DIR = "src";
 var RUNTIME_COMMAND = ["start"];
@@ -9858,10 +10616,10 @@ function resolveRuntime(value, places) {
     throw refusal3([`\u274C Refusing to start: \`--runtime\` names no runtime. Spell it ${SPELLING}.`]);
   }
   const isVersion = VERSION_SHAPE2.test(value);
-  const named = isVersion ? join12(places.home, RUNTIME_SUBDIR, value, RUNTIME_ENTRY) : resolve10(places.cwd, value);
+  const named = isVersion ? join14(places.home, RUNTIME_SUBDIR, value, RUNTIME_ENTRY) : resolve10(places.cwd, value);
   refuseInsideSource(value, named, places);
   const entry = entryOf(value, named, isVersion, places.home);
-  const real = realpathSync3(entry);
+  const real = realpathSync4(entry);
   refuseInsideSource(value, real, places);
   return real;
 }
@@ -9869,7 +10627,7 @@ function entryOf(value, named, isVersion, home) {
   if (isVersion) {
     if (isFile2(named))
       return named;
-    const root = join12(home, RUNTIME_SUBDIR);
+    const root = join14(home, RUNTIME_SUBDIR);
     const installed = installedVersions(root);
     throw refusal3([
       `\u274C Refusing to start: \`--runtime=${value}\` names no installed runtime: ${named} is no file.`,
@@ -9878,7 +10636,7 @@ function entryOf(value, named, isVersion, home) {
   }
   if (isFile2(named))
     return named;
-  const inside = join12(named, RUNTIME_ENTRY);
+  const inside = join14(named, RUNTIME_ENTRY);
   if (isDirectory(named) && isFile2(inside))
     return inside;
   throw refusal3([
@@ -9896,17 +10654,17 @@ function refuseInsideSource(value, path5, places) {
   ]);
 }
 function sourceDirs({ cwd, root }) {
-  const dirs = [join12(cwd, SOURCE_DIR), join12(root, SOURCE_DIR)];
-  const real = dirs.filter((dir) => existsSync16(dir)).map((dir) => realpathSync3(dir));
+  const dirs = [join14(cwd, SOURCE_DIR), join14(root, SOURCE_DIR)];
+  const real = dirs.filter((dir) => existsSync17(dir)).map((dir) => realpathSync4(dir));
   return [...new Set([...dirs, ...real])];
 }
 function isInside(path5, dir) {
-  const rel = relative3(dir, path5);
-  return rel === "" || !isAbsolute3(rel) && rel !== ".." && !rel.startsWith(`..${sep}`);
+  const rel = relative4(dir, path5);
+  return rel === "" || !isAbsolute4(rel) && rel !== ".." && !rel.startsWith(`..${sep}`);
 }
 function installedVersions(root) {
   try {
-    return readdirSync6(root).filter((name) => isFile2(join12(root, name, RUNTIME_ENTRY))).sort((a, b) => a.localeCompare(b));
+    return readdirSync6(root).filter((name) => isFile2(join14(root, name, RUNTIME_ENTRY))).sort((a, b) => a.localeCompare(b));
   } catch {
     return [];
   }
@@ -9949,7 +10707,7 @@ async function runFromSelectedRuntime(seams) {
 }
 function realOrResolved(path5) {
   try {
-    return realpathSync3(path5);
+    return realpathSync4(path5);
   } catch {
     return resolve10(path5);
   }
@@ -10037,11 +10795,11 @@ function eventOf(line) {
 }
 
 // src/triage/triage.ts
-import { basename as basename6, join as join13 } from "path";
+import { basename as basename6, join as join15 } from "path";
 
 // src/effort/store/tracker-refs.ts
 import { randomUUID as randomUUID9 } from "crypto";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 var SELECT_HELD = `
   SELECT seq, tracker_ref FROM findings
   WHERE session_id = ? AND artifact = ?
@@ -10164,7 +10922,7 @@ function writeTrackerRef(repoRoot, write, seams = {}) {
     wanted.json,
     collectedAt
   ];
-  const [action, stored] = withSqliteStore(path5, !existsSync17(path5), (db) => {
+  const [action, stored] = withSqliteStore(path5, !existsSync18(path5), (db) => {
     const place = db.transaction(() => placeRef(db, path5, write, wanted, insertValues));
     return place.immediate();
   });
@@ -10173,14 +10931,14 @@ function writeTrackerRef(repoRoot, write, seams = {}) {
 function readTrackerRef(repoRoot, artifact) {
   checkArtifact("read", artifact);
   const path5 = sqliteStorePath(repoRoot);
-  if (!existsSync17(path5))
+  if (!existsSync18(path5))
     return null;
   const oldest = withSqliteStore(path5, false, (db) => db.query(SELECT_OLDEST).get(artifact));
   return oldest === null ? null : heldRefOf(path5, oldest.seq, oldest.tracker_ref).ref;
 }
 
 // src/triage/triage.ts
-var PRIVATE_TRIAGE_DIR = join13(".rafa", "triage", "private");
+var PRIVATE_TRIAGE_DIR = join15(".rafa", "triage", "private");
 var SECRET_ENV_NAMES = ["GITHUB_TOKEN", "ANTHROPIC_API_KEY", "LINEAR_API_KEY"];
 var TRIAGE_MODULE = "unassigned";
 var BLOCKER_SEPARATOR = "; ";
@@ -10191,7 +10949,7 @@ var MIN_FENCE_LENGTH = 3;
 var ISSUE_OPENING = "An out-of-scope bug a rafa task session reported. The loop filed it and" + " dispatches no task for it: a plan that wants it fixed declares a task.";
 var COMMENT_OPENING = "Reported again by a rafa task session.";
 function privateTriageDir(repoRoot) {
-  return join13(repoRoot, PRIVATE_TRIAGE_DIR);
+  return join15(repoRoot, PRIVATE_TRIAGE_DIR);
 }
 function createPrivateTriageTracker(repoRoot, options = {}) {
   return createLocalTracker({
@@ -10768,6 +11526,13 @@ async function start(args, repoRoot) {
     args
   });
   guardRunBranch(planStub2, branch, args);
+  await announceRiskTotal({
+    repoRoot,
+    home: homedir7(),
+    planPath,
+    config: runConfig.config,
+    environment: process.env
+  });
   await requireNoticesAnswered();
   setActivePlanStub(planStub2);
   const session = openRunSession({ repoRoot, planPath, planStub: planStub2, branch });