@pmelab/gtd 18.0.0 → 18.1.0

package/dist/gtd.bundle.mjs

@@ -30000,7 +30000,7 @@ const handleBadArgument = (method) => (cause) => new BadArgument({
 	method,
 	cause
 });
-const access = /*#__PURE__*/ (() => {
+const access$1 = /*#__PURE__*/ (() => {
 	const nodeAccess = /*#__PURE__*/ effectify(NFS.access, /*#__PURE__*/ handleErrnoException("FileSystem", "access"), /*#__PURE__*/ handleBadArgument("access"));
 	return (path, options) => {
 		let mode = NFS.constants.F_OK;
@@ -30285,7 +30285,7 @@ const writeFile$1 = (path, data, options) => async((resume, signal) => {
 * @category layer
 */
 const layer$7 = /* @__PURE__ */ effect$1(FileSystem, /* @__PURE__ */ map$4(/*#__PURE__*/ serviceOption(WatchBackend), (backend) => make$6({
-	access,
+	access: access$1,
 	chmod,
 	chown,
 	copy,
@@ -30968,6 +30968,8 @@ const head = () => ctx().head();
 const start = () => ctx().start();
 /** The skill list `localName` (scoped from here, same as `agent()`) resolves to — for a prompt preamble. */
 const skillsFor = (localName) => ctx().skillsFor(localName);
+/** The folded access `localName` (scoped from here, same as `agent()`) resolves to — for a prompt preamble. */
+const accessFor = (localName, file) => ctx().accessFor(localName, file);
 const settingsProxy = (read) => new Proxy({}, {
 	get: (_target, key) => typeof key === "string" ? read()[key] : void 0,
 	has: (_target, key) => typeof key === "string" && key in read(),
@@ -31161,6 +31163,7 @@ const requireRevert = (edited, base) => {
 //#endregion
 //#region src/flows/index.ts
 var flows_exports = /* @__PURE__ */ __exportAll({
+	accessFor: () => accessFor,
 	agent: () => agent,
 	answered: () => answered,
 	changes: () => changes,
@@ -47480,6 +47483,34 @@ const viewOf = (format, content) => ({
 /** Every OPEN thread — last entry is the agent's — as `{ name, line, firstMe }` (0-based line). `[]` for a format with no thread concept. */
 const openThreads = (format, content) => format.openThreads?.(content) ?? [];
 //#endregion
+//#region src/replay/Access.ts
+const UNRESTRICTED = {};
+const withExtras = (globs, extras) => globs === void 0 ? null : [.../* @__PURE__ */ new Set([...globs, ...extras])];
+/**
+* Fold a step's own paths into a scope's access: each restricted side gets the
+* steering `file`, then the code threads waiting on the agent. An unrestricted
+* side stays `null`.
+*/
+const foldAccess = (scopeAccess, file, threadPaths) => {
+	const access = scopeAccess ?? UNRESTRICTED;
+	const extras = [...file === void 0 ? [] : [file], ...threadPaths];
+	return {
+		read: withExtras(access.read, extras),
+		write: withExtras(access.write, extras)
+	};
+};
+/** The shape fault of a `scope()` `access` value, or `undefined` when well-formed. */
+const accessShapeFault = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "access must be an object of { read?, write? } glob arrays";
+	for (const [side, globs] of Object.entries(value)) {
+		if (side !== "read" && side !== "write") return `unknown access key "${side}"`;
+		if (globs === void 0) continue;
+		if (!Array.isArray(globs) || globs.some((g) => typeof g !== "string")) return `access.${side} must be an array of glob strings`;
+	}
+};
+const sameGlobs = (a, b) => a === void 0 || b === void 0 ? a === b : a.length === b.length && a.every((g, i) => g === b[i]);
+const sameAccess = (a, b) => sameGlobs(a?.read, b?.read) && sameGlobs(a?.write, b?.write);
+//#endregion
 //#region src/replay/Glob.ts
 const ESCAPE_RE = /[.+^${}()|[\]\\?]/g;
 const compile = (glob) => {
@@ -47701,7 +47732,8 @@ const budgeted = (evidence, budgetBytes) => {
 		truncated
 	};
 };
-const samePersona = (a, b) => a.model === b.model && a.system === b.system && (a.skills?.length ?? 0) === (b.skills?.length ?? 0) && (a.skills ?? []).every((skill, i) => skill === b.skills?.[i]);
+const sameSkills = (a, b) => (a?.length ?? 0) === (b?.length ?? 0) && (a ?? []).every((skill, i) => skill === b?.[i]);
+const samePersona = (a, b) => a.model === b.model && a.system === b.system && sameSkills(a.skills, b.skills) && sameAccess(a.access, b.access);
 /**
 * Replay one episode: run its entry flow, answering each step from the
 * episode's commits in order, until a step has no commit left — the rest.
@@ -47791,17 +47823,34 @@ const replay = async (input) => {
 		truncated: judgeCuts.get(request) ?? []
 	} : void 0;
 	const judgeCuts = /* @__PURE__ */ new WeakMap();
-	const resolveSkills = (memory) => {
+	const resolveScoped = (memory, pick, configured, bundled) => {
 		const own = /* @__PURE__ */ new Map();
 		const names = [];
 		for (const s of scopes) {
 			if (s.name !== void 0) names.push(s.name);
-			if (s.skills !== void 0) own.set(names.join("."), s.skills);
+			const v = pick(s);
+			if (v !== void 0) own.set(names.join("."), v);
 		}
 		const parts = memory === "" ? [] : memory.split(".");
-		const hit = parts.map((_, i) => parts.slice(0, parts.length - i).join(".")).concat("").map((p) => input.configuredSkills?.[p] ?? own.get(p) ?? input.skills?.[p]).find((r) => r !== void 0);
+		return parts.map((_, i) => parts.slice(0, parts.length - i).join(".")).concat("").map((p) => configured?.[p] ?? own.get(p) ?? bundled?.[p]).find((r) => r !== void 0);
+	};
+	const resolveSkills = (memory) => {
+		const hit = resolveScoped(memory, (s) => s.skills, input.configuredSkills, input.skills);
 		return hit === void 0 || hit.length === 0 ? void 0 : hit;
 	};
+	const resolveAccess = (memory) => resolveScoped(memory, (s) => s.access, input.configuredAccess, input.access);
+	const foldedAccessFor = (scopeAccess, file) => {
+		return foldAccess(scopeAccess, file, scopeAccess?.read !== void 0 || scopeAccess?.write !== void 0 ? context.codeThreads().filter((t) => t.waitingOn === "agent").map((t) => t.path) : []);
+	};
+	const scopeAccessFault = () => {
+		for (const [i, s] of scopes.entries()) {
+			if (s.access === void 0) continue;
+			const fault = accessShapeFault(s.access);
+			if (fault === void 0) continue;
+			return `gtd: scope "${scopes.slice(0, i + 1).flatMap((o) => o.name === void 0 ? [] : [o.name]).join(".") || "root"}": ${fault}`;
+		}
+	};
+	const unfoldedAccess = /* @__PURE__ */ new WeakMap();
 	const resolve = (request) => {
 		if (request.kind === "agent") {
 			const persona = {};
@@ -47833,6 +47882,8 @@ const replay = async (input) => {
 		const occurrence = (occurrences.get(name) ?? 0) + 1;
 		occurrences.set(name, occurrence);
 		const resolved = resolve(request);
+		const memory = memoryScopeOf(name);
+		const scopeAccess = resolved.kind === "agent" ? resolveAccess(memory) : void 0;
 		const reached = {
 			id: {
 				name,
@@ -47843,11 +47894,15 @@ const replay = async (input) => {
 			actor: actorOfKind(resolved.kind),
 			request: resolved,
 			memoryScope: memoryScopeOf(name),
-			...resolved.kind === "agent" ? { skills: resolveSkills(memoryScopeOf(name)) } : {},
+			...resolved.kind === "agent" ? {
+				skills: resolveSkills(memory),
+				access: foldedAccessFor(scopeAccess, resolved.options.file)
+			} : {},
 			enteredAt: position.hash,
 			truncated: (judgeCuts.get(resolved) ?? []).length > 0,
 			scopeCalls: namedScopeCalls()
 		};
+		if (resolved.kind === "agent") unfoldedAccess.set(reached, scopeAccess);
 		trace.push(reached);
 		return reached;
 	};
@@ -47856,14 +47911,15 @@ const replay = async (input) => {
 		const identity = {
 			model: step.request.options.model,
 			system: step.request.options.system,
-			skills: step.skills
+			skills: step.skills,
+			access: unfoldedAccess.get(step)
 		};
 		const seen = personas.get(step.memoryScope);
 		if (seen === void 0) {
 			personas.set(step.memoryScope, identity);
 			return;
 		}
-		return samePersona(seen, identity) ? void 0 : `gtd: "${step.name}" runs with a different model, system prompt or skills than an earlier agent step in memory scope "${step.memoryScope || "root"}" — one scope is one conversation, and a conversation has one identity`;
+		return samePersona(seen, identity) ? void 0 : `gtd: "${step.name}" runs with a different model, system prompt, skills or file access than an earlier agent step in memory scope "${step.memoryScope || "root"}" — one scope is one conversation, and a conversation has one identity`;
 	};
 	const DIVERGED = "the workflow changed under this process; run `gtd abandon` to start over";
 	const blockerAt = (step) => {
@@ -47917,6 +47973,10 @@ const replay = async (input) => {
 		});
 		return replyFor(step.request, input.pending.verdicts ?? []);
 	};
+	const requestFault = (request) => {
+		if (request.kind === "run" && typeof request.body !== "string") return `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`;
+		return request.kind === "agent" ? scopeAccessFault() : void 0;
+	};
 	const handleStep = async (request) => {
 		if (outcome !== void 0) throw new Stop();
 		if (request.kind === "restart") return finish(endOfFlow("restart"));
@@ -47924,9 +47984,10 @@ const replay = async (input) => {
 			kind: "failed",
 			message: "gtd: a step was called without a name"
 		});
-		if (request.kind === "run" && typeof request.body !== "string") return finish({
+		const fault = requestFault(request);
+		if (fault !== void 0) return finish({
 			kind: "failed",
-			message: `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`
+			message: fault
 		});
 		const step = reach(request);
 		const blocker = blockerAt(step);
@@ -47946,7 +48007,7 @@ const replay = async (input) => {
 		if (tree === void 0) throw new Error(`gtd: changesSince(${hash}): ${hash} is not the episode base or one of its commits — pass a hash this run read from head() or start(), not one captured earlier, read from state, or from another branch`);
 		return changesBetween(tree, position.tree);
 	};
-	installContext({
+	const context = {
 		step: handleStep,
 		refuse: (message) => {
 			outcome ??= {
@@ -48001,11 +48062,13 @@ const replay = async (input) => {
 		env: input.env,
 		start: () => input.start,
 		skillsFor: (localName) => resolveSkills(memoryScopeOf(scoped(localName))) ?? [],
+		accessFor: (localName, file) => foldedAccessFor(resolveAccess(memoryScopeOf(scoped(localName))), file),
 		head: () => {
 			const rest = commits.slice(cursor);
 			return rest.length > 0 && rest.every((c) => c.parsed.step === void 0) ? rest[rest.length - 1].hash : position.hash;
 		}
-	});
+	};
+	installContext(context);
 	try {
 		const flowDone = input.flow(args).then(() => {
 			if (outcome === void 0 && trace.length === 0) outcome = {
@@ -48045,6 +48108,11 @@ const skillsPreamble = `- Load whatever's listed here that your harness actually
   prompt states first
 - Never let a loaded skill turn this turn interactive — answer nothing,
   ask nothing; this runs unattended, with no one at a keyboard`;
+/** One bullet per restricted side; empty when neither is. An empty glob list reads "nothing". */
+const accessPreamble = (access) => {
+	const globs = (list) => list.length === 0 ? "nothing" : list.join(", ");
+	return [...access.read === null ? [] : [`- This turn may read only: ${globs(access.read)}`], ...access.write === null ? [] : [`- This turn may write only: ${globs(access.write)} — anything else is refused when the turn lands`]].join("\n");
+};
 const styleBlock = `- A deliverable, not a chat reply — size follows the work; cut padding
 - Lead with the answer; never circle back to restate it
 - Flat, commanding sentences — commit to the claim, never hedge
@@ -48282,8 +48350,12 @@ const withSkills = (skills, prompt) => {
 	if (skills === void 0 || skills.trim() === "") return prompt;
 	return `${skillsPreamble.replaceAll("{skills}", skills)}\n\n${prompt}`;
 };
-/** An `agent()` step whose prompt opens with the preamble naming its scope's skills. */
-const agentWithSkills = (name, prompt, options = {}) => agent(name, withSkills(skillsFor(name).join(", "), prompt), options);
+/** An `agent()` step whose prompt opens with the preamble naming its scope's skills, then its restricted file access. */
+const agentWithSkills = (name, prompt, options = {}) => {
+	const access = accessPreamble(accessFor(name, options.file));
+	const body = access === "" ? prompt : `${access}\n\n${prompt}`;
+	return agent(name, withSkills(skillsFor(name).join(", "), body), options);
+};
 const unwindFailure = (commit) => `gtd could not unwind ${commit} out of your working tree.`;
 const idleMessage = () => `No active gtd process.
 
@@ -49905,6 +49977,18 @@ const skills = (vars) => ({
 	...Object.fromEntries(lensesOf(vars.qualityReviews ?? "").map((lens) => [`build.quality.${lens}`, builtInLenses[lens]?.skills ?? [lens]]))
 });
 //#endregion
+//#region src/workflows/access.ts
+const access = (vars) => ({
+	design: { write: [] },
+	architecture: { write: [".gtd/REQUIREMENTS.md"] },
+	"architecture.decompose": { write: [".gtd/packages/**", ".gtd/ARCHITECTURE.md"] },
+	"packages.item.spec": { write: [".gtd/SPEC_FEEDBACK.md"] },
+	"build.review": { write: [".gtd/REVIEW.md"] },
+	"build.review.fix.nits": {},
+	"build.review.fix.risks": {},
+	...Object.fromEntries(lensesOf(vars.qualityReviews ?? "").map((lens) => [`build.quality.${lens}`, { write: [] }]))
+});
+//#endregion
 //#region src/workflows/unified.ts
 var unified_exports = /* @__PURE__ */ __exportAll({
 	ARCHITECTURE: () => ARCHITECTURE,
@@ -49915,6 +49999,7 @@ var unified_exports = /* @__PURE__ */ __exportAll({
 	REQUIREMENTS: () => REQUIREMENTS,
 	REVIEW: () => REVIEW,
 	SPEC_FEEDBACK: () => SPEC_FEEDBACK,
+	access: () => access,
 	afterTail: () => afterTail,
 	agentWithSkills: () => agentWithSkills,
 	answerProductQuestions: () => answerProductQuestions,
@@ -50798,6 +50883,25 @@ const skillsJsonSchema = {
 		items: { type: "string" }
 	}
 };
+/** The `access:` shape: scope full name -> `{ read?, write? }` (`compileAccessMap`). An entry REPLACES the scope's access wholesale; the key is unvalidatable here for the same reason as `skills:`. */
+const accessJsonSchema = {
+	type: "object",
+	description: "Flat scope full-name -> { read?, write? } map of glob arrays. Each entry REPLACES the named scope's declared access wholesale (never merges into it) and reaches every nested scope that sets none of its own; a missing side is unrestricted, [] allows nothing, and {} lifts every restriction. read and write are independent: write grants no read. A key that is not a scope running a turn is a load error listing the known scopes — the schema itself cannot validate a key, only a value's shape.",
+	additionalProperties: {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			read: {
+				type: "array",
+				items: { type: "string" }
+			},
+			write: {
+				type: "array",
+				items: { type: "string" }
+			}
+		}
+	}
+};
 /**
 * A real (not `Unknown`) schema, unlike `vars`/`modes`: it is a flat settings
 * struct with no per-mode map to compile, so its JSON Schema derives from the
@@ -50825,7 +50929,8 @@ const ConfigSchema = Struct({
 	judge: optional$1(JudgeSchema),
 	modes: optional$1(Unknown.annotations({ jsonSchema: modesJsonSchema })),
 	ui: optional$1(UiSchema),
-	skills: optional$1(Unknown.annotations({ jsonSchema: skillsJsonSchema }))
+	skills: optional$1(Unknown.annotations({ jsonSchema: skillsJsonSchema })),
+	access: optional$1(Unknown.annotations({ jsonSchema: accessJsonSchema }))
 });
 //#endregion
 //#region src/workflow/vars.ts
@@ -50997,6 +51102,33 @@ const compileSkillsMap = (raw) => {
 		diagnostics
 	};
 };
+/** A flat `scope full name -> { read?, write? }` map; a malformed value is a load error and is dropped. */
+const compileAccessMap = (raw) => {
+	const diagnostics = [];
+	if (raw === void 0) return {
+		access: {},
+		diagnostics
+	};
+	if (!isPlainObject$3(raw)) {
+		diagnostics.push(err(["access"], `"access" must be a mapping of scope name -> { read?, write? }, got ${describeType(raw)}`));
+		return {
+			access: {},
+			diagnostics
+		};
+	}
+	const access = Object.create(null);
+	for (const [key, value] of Object.entries(raw)) {
+		const fault = accessShapeFault(value);
+		if (fault === void 0) access[key] = value;
+		else diagnostics.push(err(["access", key], `"access.${key}": ${fault}`));
+	}
+	return {
+		access,
+		diagnostics
+	};
+};
+/** The `.gtdrc` `access:` load-error message for a key that is not a known scope. */
+const unknownAccessKeyMessage = (key, known) => `"access.${key}" is not a scope that runs a turn — known scopes: ${known.join(", ")}`;
 /** The `.gtdrc` `skills:` load-error message for a key that is not a known scope. */
 const unknownSkillsKeyMessage = (key, known) => `"skills.${key}" is not a scope that runs a turn — known scopes: ${known.join(", ")}`;
 const MODE_COMMAND_KEYS = ["format", "validate"];
@@ -51168,6 +51300,20 @@ const compileConfig = (layers) => {
 		})));
 	}
 	const { skills: rcSkills } = compileSkillsMap(mergedConfig["skills"]);
+	const accessKeys = [];
+	for (const layer of layers) {
+		if (!isPlainObject$3(layer.value)) continue;
+		const own = compileAccessMap(layer.value["access"]);
+		diagnostics.push(...own.diagnostics.map((d) => ({
+			...d,
+			origin: layer.origin
+		})));
+		accessKeys.push(...Object.keys(own.access).map((key) => ({
+			key,
+			origin: layer.origin
+		})));
+	}
+	const { access: rcAccess } = compileAccessMap(mergedConfig["access"]);
 	const seeded = Object.fromEntries(BUILT_IN_MODE_NAMES.map((name) => [name, { validate: seededValidateCommand(name) }]));
 	return {
 		rcVars,
@@ -51179,6 +51325,8 @@ const compileConfig = (layers) => {
 		...ui !== void 0 ? { ui } : {},
 		rcSkills,
 		skillsKeys,
+		access: rcAccess,
+		accessKeys,
 		diagnostics: dedupeDiagnostics(sortDiagnostics(diagnostics, layerOrder))
 	};
 };
@@ -58110,6 +58258,9 @@ const load = gen(function* () {
 			skills: loaded.skills,
 			configuredSkills: compiled.rcSkills,
 			skillsKeys: compiled.skillsKeys,
+			access: loaded.access,
+			configuredAccess: compiled.access,
+			accessKeys: compiled.accessKeys,
 			skillsOrigin: module?.filepath ?? "(built-in default)",
 			initial
 		},
@@ -58187,6 +58338,12 @@ const skillsExport = (exports) => {
 	const record = checkSkillsRecord(value);
 	return () => record;
 };
+/** Read a module's optional `access` export — a scope full name -> `{ read?, write? }` record, or a function of the vars returning one. */
+const accessExport = (exports) => {
+	const value = exports["access"] ?? {};
+	if (typeof value === "function") return (vars) => value(vars);
+	return () => value;
+};
 const optionalFunction = (exports, name) => {
 	const value = exports[name];
 	if (value === void 0) return void 0;
@@ -58215,6 +58372,7 @@ const fromModule = (exported, origin, dependencyFiles) => {
 		envDefaults,
 		steering: stringRecord(exports, "steering"),
 		skills: skillsExport(exports),
+		access: accessExport(exports),
 		summary: optionalFunction(exports, "summary"),
 		base: optionalFunction(exports, "base"),
 		origin,
@@ -58355,6 +58513,16 @@ const checkShape = (value) => {
 	for (const [scope, names] of Object.entries(value)) if (!Array.isArray(names) || names.some((n) => typeof n !== "string")) throw new Error(`skills export: "${scope}" must be an array of skill names`);
 	return value;
 };
+/** Every `.gtdrc` key that names no known scope is a load error, one per file that wrote it. */
+const checkKeys = (keys, known, message, section) => {
+	const sorted = [...known].sort();
+	return failOnErrors(dedupeDiagnostics(sortDiagnostics(keys.filter(({ key }) => !sorted.includes(key)).map(({ key, origin }) => ({
+		severity: "error",
+		path: [section, key],
+		message: message(key, sorted),
+		origin
+	})), [...new Set(keys.map((k) => k.origin))])));
+};
 /**
 * Skill lists for the settings actually in use. `.gtdrc` `skills:` keys are
 * judged here, not at config load: only now are the pinned/entry vars known.
@@ -58364,15 +58532,29 @@ const resolveScopeSkills = (def, vars) => gen(function* () {
 		try: () => checkShape(def.skills(vars)),
 		catch: (e) => fail$4(def.skillsOrigin, e instanceof Error ? e.message : String(e))
 	});
-	const known = Object.keys(skills).sort();
-	yield* failOnErrors(dedupeDiagnostics(sortDiagnostics(def.skillsKeys.filter(({ key }) => !known.includes(key)).map(({ key, origin }) => ({
-		severity: "error",
-		path: ["skills", key],
-		message: unknownSkillsKeyMessage(key, known),
-		origin
-	})), [...new Set(def.skillsKeys.map((k) => k.origin))])));
+	yield* checkKeys(def.skillsKeys, Object.keys(skills), unknownSkillsKeyMessage, "skills");
 	return skills;
 });
+const checkAccessShape = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("access export must return an object of scope -> { read?, write? }");
+	for (const [scope, access] of Object.entries(value)) {
+		const fault = accessShapeFault(access);
+		if (fault !== void 0) throw new Error(`access export: "${scope}": ${fault}`);
+	}
+	return value;
+};
+/**
+* Access for the settings actually in use. A `.gtdrc` `access:` key may name
+* any scope the workflow gives skills or access to.
+*/
+const resolveScopeAccess = (def, skills, vars) => gen(function* () {
+	const access = yield* try_({
+		try: () => checkAccessShape(def.access(vars)),
+		catch: (e) => fail$4(def.skillsOrigin, e instanceof Error ? e.message : String(e))
+	});
+	yield* checkKeys(def.accessKeys, [.../* @__PURE__ */ new Set([...Object.keys(skills), ...Object.keys(access)])], unknownAccessKeyMessage, "access");
+	return access;
+});
 //#endregion
 //#region src/judges/providers/fixed.ts
 const fail$3 = (message) => {
@@ -63696,6 +63878,8 @@ const renderFormat = (fmt, ...args) => {
 	let i = 0;
 	return fmt.replace(/%s/g, () => args[i++] ?? "");
 };
+/** The first line of the landing refusal for a turn that wrote outside its `write` access — a stable marker drivers and tests grep for. */
+const ACCESS_REFUSAL = "gtd land: this turn wrote outside its write access — revert these paths, then run `gtd land` again:";
 //#endregion
 //#region src/wire/Demand.ts
 /**
@@ -63724,7 +63908,7 @@ const stallDiagnosis = (state, actor) => `stalled at "${state}": the last gtd(${
 /**
 * Assemble one `Demand` — the ONLY place a rest's resolved content becomes
 * `Demand.content` (`stallDiagnosis` at `kind === "stalled"`, the rendered
-* content otherwise), and the only place `session`/`validate`/`skills` are
+* content otherwise), and the only place `session`/`validate`/`skills`/`access` are
 * attached, which the `prompt` variant's own type makes impossible to do at
 * any other kind.
 */
@@ -63732,12 +63916,17 @@ const demandOf = (input) => {
 	const { rendered, kind, session, validate } = input;
 	const content = kind === "stalled" ? stallDiagnosis(rendered.state, rendered.actor) : rendered.content;
 	const skills = rendered.skills !== void 0 && rendered.skills.length > 0 ? rendered.skills : void 0;
+	const access = rendered.access ?? {
+		read: null,
+		write: null
+	};
 	return kind === "prompt" ? {
 		kind,
 		content,
 		session,
 		validate,
-		skills
+		skills,
+		access
 	} : {
 		kind,
 		content
@@ -63781,7 +63970,7 @@ const assertNeverDemand = (demand) => {
 };
 /**
 * The ONE exhaustive switch translating a `Demand` into its wire
-* `session`/`validate`/`skills` triple — only the `prompt` variant carries
+* `session`/`validate`/`skills`/`access` set — only the `prompt` variant carries
 * any of them, and every other member is listed explicitly (not a
 * `default:` fallthrough) so adding a sixth `BeatKind` without adding its
 * case here fails `tsc` at the `assertNeverDemand` call, not silently
@@ -63792,7 +63981,8 @@ const dispatchFieldsOf = (demand) => {
 		case "prompt": return {
 			session: demand.session,
 			validate: demand.validate,
-			skills: demand.skills
+			skills: demand.skills,
+			access: demand.access
 		};
 		case "capture":
 		case "message":
@@ -63800,19 +63990,20 @@ const dispatchFieldsOf = (demand) => {
 		case "stalled": return {
 			session: void 0,
 			validate: void 0,
-			skills: void 0
+			skills: void 0,
+			access: void 0
 		};
 		default: return assertNeverDemand(demand);
 	}
 };
 /**
-* Flatten a `Demand` plus its `BeatStatus` into the single 20-key document
+* Flatten a `Demand` plus its `BeatStatus` into the single 21-key document
 * `gtd next --json` emits — the ONLY place the two are joined. `cost`/
 * `costByModel` are omitted together, exactly when no cost was recorded
 * (`cost <= 0`).
 */
 const beatDocument = (demand, status) => {
-	const { session, validate, skills } = dispatchFieldsOf(demand);
+	const { session, validate, skills, access } = dispatchFieldsOf(demand);
 	const hasCost = status.cost > 0;
 	return {
 		kind: demand.kind,
@@ -63834,7 +64025,8 @@ const beatDocument = (demand, status) => {
 		cost: hasCost ? status.cost : void 0,
 		costByModel: hasCost ? status.costByModel : void 0,
 		judge: status.judge,
-		skills
+		skills,
+		access
 	};
 };
 const renderBeatJson = (document) => JSON.stringify(document) + "\n";
@@ -63971,6 +64163,195 @@ const renderLandPlain = (fields, command = "land") => fields.subject !== null ?
 //#region src/Workflow.ts
 const knownModes = (def) => Object.keys(def.modes);
 //#endregion
+//#region src/step/planStep.ts
+/**
+* At the human review gate an unconditional `gtd uncheck '<file>'` runs
+* ahead of the commit, resetting every checkbox before `git add -A` picks it
+* up — a tick is read-progress, never sign-off.
+*/
+const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
+	kind: "uncheck",
+	file: snapshot.file
+}] : [];
+const planStep = (snapshot, opts = {}) => {
+	const landing = snapshot.landing;
+	if (landing.kind === "refusal") return {
+		kind: "refusal",
+		message: landing.message
+	};
+	if (landing.kind === "noop") return {
+		kind: "noop",
+		state: snapshot.state,
+		settled: landing.settled
+	};
+	const cost = opts.cost === void 0 ? {} : { cost: {
+		cost: opts.cost,
+		...opts.model !== void 0 ? { model: opts.model } : {}
+	} };
+	if (landing.kind === "attempt") {
+		const message = formatCommitMessage({
+			actor: snapshot.actor,
+			to: snapshot.state,
+			...cost
+		});
+		return {
+			kind: "commit",
+			state: snapshot.state,
+			to: snapshot.state,
+			subject: landing.subject,
+			steps: [{
+				kind: "gitWrite",
+				write: {
+					kind: "commitAll",
+					message
+				}
+			}, {
+				kind: "outcome",
+				outcome: {
+					kind: "commit",
+					subject: landing.subject
+				}
+			}]
+		};
+	}
+	const message = formatCommitMessage({
+		...landing.spec,
+		...cost,
+		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
+	});
+	const subject = message.split("\n")[0];
+	const outcome = landing.to === snapshot.state ? {
+		kind: "outcome",
+		outcome: {
+			kind: "commit",
+			subject
+		}
+	} : {
+		kind: "outcome",
+		outcome: {
+			kind: "transition",
+			from: snapshot.state,
+			to: landing.to
+		}
+	};
+	return {
+		kind: "commit",
+		state: snapshot.state,
+		to: landing.to,
+		subject,
+		steps: [
+			...uncheckStep(snapshot),
+			{
+				kind: "gitWrite",
+				write: {
+					kind: "commitAll",
+					message
+				}
+			},
+			outcome
+		]
+	};
+};
+//#endregion
+//#region src/step/accessRefusal.ts
+/**
+* The landing refusal for changes outside `write`, or `undefined` when every
+* path is allowed. `null` is unrestricted. The message is the fix prompt: gtd
+* runs no fix turn of its own.
+*/
+const accessRefusal = (changes, write) => {
+	if (write === null) return void 0;
+	const offending = [...new Set(changes.filter((c) => !write.some((glob) => globMatches(c.path, glob))).map((c) => c.path))];
+	if (offending.length === 0) return void 0;
+	return [
+		ACCESS_REFUSAL,
+		...offending.map((path) => `  - ${path}`),
+		`allowed: ${write.length === 0 ? "(nothing)" : write.join(", ")}`
+	].join("\n");
+};
+//#endregion
+//#region src/step/planEntry.ts
+const refusal = (message) => ({
+	kind: "refusal",
+	message
+});
+const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
+	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
+	if (environmentOnly.length > 0) return yield* fail$7(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it under "env:" in .gtdrc or with a GTD_<NAME> environment variable`));
+	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
+	if (undeclared.length > 0) return refusal(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`);
+});
+/**
+* `gtd --entry <name>`: start a brand NEW process at a workflow entry, writing
+* an opening commit that carries every process setting as a `Gtd-Var:` trailer, plus a
+* `Gtd-Review-Base:` trailer when the entry fixes the process's diff base.
+* All validation is a REFUSAL, not an Effect failure.
+*/
+const planEntry = (current, actor, entry) => gen(function* () {
+	const { state: name, commandLabel, vars: varOverrides } = entry;
+	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before entering`);
+	if (current.entryRefusal !== void 0) return refusal(`${commandLabel}: ${current.entryRefusal}`);
+	const config = yield* (yield* ConfigService).load;
+	const declaredNames = Object.keys({
+		...config.workflowVars,
+		...config.rcVars
+	});
+	const overrideRefusal = yield* checkOverrides(commandLabel, varOverrides, declaredNames, Object.keys({
+		...config.workflowEnv,
+		...config.rcEnv
+	}));
+	if (overrideRefusal !== void 0) return overrideRefusal;
+	let base;
+	const baseOf = current.def.base;
+	const vars = resolveVars(config.workflowVars, config.rcVars, varOverrides, (yield* Host).env);
+	const multiline = multilineSetting(vars);
+	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
+	const template = yield* try_({
+		try: () => baseOf?.(name, vars),
+		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
+	});
+	if (baseOf !== void 0 && template !== void 0) {
+		const resolved = yield* resolveBase(name, commandLabel, baseOf, template);
+		if (typeof resolved !== "string") return resolved;
+		base = resolved;
+	}
+	const subject = formatSubject(actor, name);
+	return {
+		kind: "entry",
+		state: name,
+		subject,
+		steps: [{
+			kind: "gitWrite",
+			write: {
+				kind: "commitAll",
+				message: formatCommitMessage({
+					actor,
+					to: name,
+					...base !== void 0 ? { reviewBase: base } : {},
+					vars
+				})
+			}
+		}, {
+			kind: "outcome",
+			outcome: {
+				kind: "commit",
+				subject
+			}
+		}]
+	};
+});
+/** The entry's diff base: a commitish that resolves, is an ancestor of HEAD, and is not HEAD. */
+const resolveBase = (name, commandLabel, base, value) => gen(function* () {
+	const rendered = value.trim();
+	if (rendered === "") return refusal(`${commandLabel}: "${name}"'s reviewBase template rendered blank — template: ${base.toString()}; pass the base with --var`);
+	const git = yield* GitService;
+	const resolvedBase = yield* either(git.resolveRef(rendered));
+	if (resolvedBase._tag === "Left") return refusal(`${commandLabel}: "${rendered}" does not resolve to a commit`);
+	if (!(yield* git.isAncestor(resolvedBase.right, "HEAD"))) return refusal(`${commandLabel}: "${rendered}" is not an ancestor of HEAD`);
+	if (resolvedBase.right === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: "${rendered}" is HEAD — nothing to review`);
+	return resolvedBase.right;
+});
+//#endregion
 //#region src/Edge.ts
 const EMPTY_TREE$1 = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 const ACTORS = /* @__PURE__ */ new Set([
@@ -64240,6 +64621,8 @@ const replayFor = (setup, pending) => replay({
 	budgetBytes: setup.budget,
 	skills: setup.skills,
 	configuredSkills: setup.def.configuredSkills,
+	access: setup.access,
+	configuredAccess: setup.def.configuredAccess,
 	...pending !== void 0 ? { pending } : {}
 });
 const replayError = (outcome) => {
@@ -64268,14 +64651,15 @@ const commonOf = (step) => {
 		...optional("mode", options.mode)
 	};
 };
-const promptDef = (common, request, skills) => ({
+const promptDef = (common, request, skills, access) => ({
 	...common,
 	kind: "prompt",
 	content: request.prompt,
 	...optional("model", request.options.model),
 	...optional("system", request.options.system),
 	...optional("allowEmpty", request.options.allowEmpty),
-	...optional("skills", skills)
+	...optional("skills", skills),
+	...optional("access", access)
 });
 const scriptDef = (common, request) => ({
 	...common,
@@ -64301,7 +64685,7 @@ const stepDefOf = (step) => {
 	const request = step.request;
 	const common = commonOf(step);
 	switch (request.kind) {
-		case "agent": return promptDef(common, request, step.skills);
+		case "agent": return promptDef(common, request, step.skills, step.access);
 		case "run": return scriptDef(common, request);
 		case "judge": return judgeDef(common, request, step);
 		case "human": return messageDef(common, request, step);
@@ -64357,7 +64741,8 @@ const hintsOf = (def) => ({
 	...optional("judge", def.judge),
 	...optional("system", def.system),
 	...optional("mode", def.mode),
-	...optional("skills", def.skills)
+	...optional("skills", def.skills),
+	...optional("access", def.access)
 });
 const normalizeStatus = (raw) => raw === "A" ? "A" : raw === "D" ? "D" : "M";
 /** Per-model token totals, highest-cost first (ties broken by model name). */
@@ -64379,6 +64764,7 @@ const restAt = (ref, entryOverrides = {}) => gen(function* () {
 	const run = yield* computeProcessRun(git, def, ref);
 	const { vars, env } = settingsFor(config, run.pinnedVars, host.env, entryOverrides);
 	const skills = yield* resolveScopeSkills(def, vars);
+	const access = yield* resolveScopeAccess(def, skills, vars);
 	const budget = yield* try_({
 		try: () => judgeBudgetBytes(vars),
 		catch: (e) => e instanceof Error ? e : new Error(String(e))
@@ -64404,6 +64790,7 @@ const restAt = (ref, entryOverrides = {}) => gen(function* () {
 		env,
 		budget,
 		skills,
+		access,
 		workspace,
 		base,
 		episode,
@@ -64453,6 +64840,7 @@ const entryRefusal = (rest, name, entryVars) => gen(function* () {
 	const host = yield* Host;
 	const { vars, env } = settingsFor(config, {}, host.env, entryVars);
 	const skills = yield* resolveScopeSkills(rest.def, vars);
+	const access = yield* resolveScopeAccess(rest.def, skills, vars);
 	const workspace = rest.setup.workspace;
 	const outcome = yield* promise(() => replay({
 		flow: rest.def.flow,
@@ -64469,7 +64857,9 @@ const entryRefusal = (rest, name, entryVars) => gen(function* () {
 		start: "",
 		budgetBytes: rest.setup.budget,
 		skills,
-		configuredSkills: rest.def.configuredSkills
+		configuredSkills: rest.def.configuredSkills,
+		access,
+		configuredAccess: rest.def.configuredAccess
 	}));
 	if (outcome.kind === "refused") return outcome.message;
 	if (outcome.kind === "rest") return outcome.entryRead ? void 0 : `"${name}" is not an enterable state — this workflow reads no entry`;
@@ -64561,6 +64951,13 @@ const landingTo = (rest, to) => {
 const decideLanding = (rest, verdicts) => gen(function* () {
 	const early = cleanLanding(rest);
 	if (early !== void 0) return early;
+	if (rest.stepDef.kind === "prompt" && rest.stepDef.access?.write != null) {
+		const message = accessRefusal(rest.changes, rest.stepDef.access.write);
+		if (message !== void 0) return {
+			kind: "refusal",
+			message
+		};
+	}
 	const outcome = yield* promise(() => replayFor(rest.setup, {
 		tree: pendingTree(rest.setup.workspace, rest.setup.pendingWorktree(), reviewGateRewrite(rest.stepDef)),
 		...verdicts !== void 0 ? { verdicts } : {}
@@ -64604,178 +65001,6 @@ const summaryFor = (run) => gen(function* () {
 	});
 });
 //#endregion
-//#region src/step/planStep.ts
-/**
-* At the human review gate an unconditional `gtd uncheck '<file>'` runs
-* ahead of the commit, resetting every checkbox before `git add -A` picks it
-* up — a tick is read-progress, never sign-off.
-*/
-const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
-	kind: "uncheck",
-	file: snapshot.file
-}] : [];
-const planStep = (snapshot, opts = {}) => {
-	const landing = snapshot.landing;
-	if (landing.kind === "refusal") return {
-		kind: "refusal",
-		message: landing.message
-	};
-	if (landing.kind === "noop") return {
-		kind: "noop",
-		state: snapshot.state,
-		settled: landing.settled
-	};
-	const cost = opts.cost === void 0 ? {} : { cost: {
-		cost: opts.cost,
-		...opts.model !== void 0 ? { model: opts.model } : {}
-	} };
-	if (landing.kind === "attempt") {
-		const message = formatCommitMessage({
-			actor: snapshot.actor,
-			to: snapshot.state,
-			...cost
-		});
-		return {
-			kind: "commit",
-			state: snapshot.state,
-			to: snapshot.state,
-			subject: landing.subject,
-			steps: [{
-				kind: "gitWrite",
-				write: {
-					kind: "commitAll",
-					message
-				}
-			}, {
-				kind: "outcome",
-				outcome: {
-					kind: "commit",
-					subject: landing.subject
-				}
-			}]
-		};
-	}
-	const message = formatCommitMessage({
-		...landing.spec,
-		...cost,
-		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
-	});
-	const subject = message.split("\n")[0];
-	const outcome = landing.to === snapshot.state ? {
-		kind: "outcome",
-		outcome: {
-			kind: "commit",
-			subject
-		}
-	} : {
-		kind: "outcome",
-		outcome: {
-			kind: "transition",
-			from: snapshot.state,
-			to: landing.to
-		}
-	};
-	return {
-		kind: "commit",
-		state: snapshot.state,
-		to: landing.to,
-		subject,
-		steps: [
-			...uncheckStep(snapshot),
-			{
-				kind: "gitWrite",
-				write: {
-					kind: "commitAll",
-					message
-				}
-			},
-			outcome
-		]
-	};
-};
-//#endregion
-//#region src/step/planEntry.ts
-const refusal = (message) => ({
-	kind: "refusal",
-	message
-});
-const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
-	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
-	if (environmentOnly.length > 0) return yield* fail$7(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it under "env:" in .gtdrc or with a GTD_<NAME> environment variable`));
-	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
-	if (undeclared.length > 0) return refusal(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`);
-});
-/**
-* `gtd --entry <name>`: start a brand NEW process at a workflow entry, writing
-* an opening commit that carries every process setting as a `Gtd-Var:` trailer, plus a
-* `Gtd-Review-Base:` trailer when the entry fixes the process's diff base.
-* All validation is a REFUSAL, not an Effect failure.
-*/
-const planEntry = (current, actor, entry) => gen(function* () {
-	const { state: name, commandLabel, vars: varOverrides } = entry;
-	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before entering`);
-	if (current.entryRefusal !== void 0) return refusal(`${commandLabel}: ${current.entryRefusal}`);
-	const config = yield* (yield* ConfigService).load;
-	const declaredNames = Object.keys({
-		...config.workflowVars,
-		...config.rcVars
-	});
-	const overrideRefusal = yield* checkOverrides(commandLabel, varOverrides, declaredNames, Object.keys({
-		...config.workflowEnv,
-		...config.rcEnv
-	}));
-	if (overrideRefusal !== void 0) return overrideRefusal;
-	let base;
-	const baseOf = current.def.base;
-	const vars = resolveVars(config.workflowVars, config.rcVars, varOverrides, (yield* Host).env);
-	const multiline = multilineSetting(vars);
-	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
-	const template = yield* try_({
-		try: () => baseOf?.(name, vars),
-		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
-	});
-	if (baseOf !== void 0 && template !== void 0) {
-		const resolved = yield* resolveBase(name, commandLabel, baseOf, template);
-		if (typeof resolved !== "string") return resolved;
-		base = resolved;
-	}
-	const subject = formatSubject(actor, name);
-	return {
-		kind: "entry",
-		state: name,
-		subject,
-		steps: [{
-			kind: "gitWrite",
-			write: {
-				kind: "commitAll",
-				message: formatCommitMessage({
-					actor,
-					to: name,
-					...base !== void 0 ? { reviewBase: base } : {},
-					vars
-				})
-			}
-		}, {
-			kind: "outcome",
-			outcome: {
-				kind: "commit",
-				subject
-			}
-		}]
-	};
-});
-/** The entry's diff base: a commitish that resolves, is an ancestor of HEAD, and is not HEAD. */
-const resolveBase = (name, commandLabel, base, value) => gen(function* () {
-	const rendered = value.trim();
-	if (rendered === "") return refusal(`${commandLabel}: "${name}"'s reviewBase template rendered blank — template: ${base.toString()}; pass the base with --var`);
-	const git = yield* GitService;
-	const resolvedBase = yield* either(git.resolveRef(rendered));
-	if (resolvedBase._tag === "Left") return refusal(`${commandLabel}: "${rendered}" does not resolve to a commit`);
-	if (!(yield* git.isAncestor(resolvedBase.right, "HEAD"))) return refusal(`${commandLabel}: "${rendered}" is not an ancestor of HEAD`);
-	if (resolvedBase.right === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: "${rendered}" is HEAD — nothing to review`);
-	return resolvedBase.right;
-});
-//#endregion
 //#region src/RetainedHistory.ts
 /** Per-worktree (`refs/worktree/gtd/*`) so linked worktrees sharing one `.git` don't clobber each other's retained history. */
 const HISTORY_REF = "refs/worktree/gtd/history";
@@ -76757,7 +76982,8 @@ never stored, so a plain peek is exactly as safe to call as a dispatch would
 be — and, when the state declares a validatable steering file, \`validate\`
 (the script that formats then validates it), and, when the turn's scope declares
 skills, \`skills\` (an array of the skill names, already trimmed and split —
-\`--json=skills.0\` reads the first). When set: \`model\`, \`memory\`,
+\`--json=skills.0\` reads the first), and always \`access\`
+(\`{read, write}\`, each an array of globs or \`null\` for unrestricted). When set: \`model\`, \`memory\`,
 \`label\`, \`file\`, \`mode\`, \`edges\`, \`judge\` (the pending judgment's rendered
 document). When a cost has been recorded (a prior \`gtd land --cost=<n>\`):
 \`cost\`, \`costByModel\`.
@@ -76856,6 +77082,13 @@ const DRIVER_OBLIGATIONS = `
     turn sees only those. An absent field means none. A CLI that cannot
     restrict relies on the preamble gtd already puts in the prompt — the
     reference body's \`claude -p\` does exactly that.
+12. Map each prompt turn's \`--json=access.read\` / \`--json=access.write\`
+    (arrays of globs, \`null\` = unrestricted) onto the chosen CLI's sandbox
+    (Codex \`workspace-write\` plus writable roots) or a container with
+    \`:ro\` / \`:rw\` bind mounts. \`access\` is a prompt-only field. A CLI
+    that cannot restrict relies on the preamble and gtd's landing check. When
+    \`gtd land\` refuses naming an access violation, re-prompt the turn with
+    the refusal text and land again, or stop.
 `;
 const RECOVERY = `
 ## Recovery