@ramon-sg/issue-flow 0.3.1 → 0.3.3

package/README.md

@@ -75,7 +75,7 @@ Qué hace, en orden:
    - Si el PR se mergeó y no queda trabajo sin pushear, ofrece borrar el worktree y la rama.
    - Si no, dice cómo retomar.
 
-**Permisos:** si el repo tiene [`claude-repo-guard`](https://github.com/ramon-sg/claude-repo-guard), Claude se abre en modo auto con su contexto (lo mismo que `claude:auto`). Con `--ask-permissions` se abre con tus settings, y con `--free` sin sandbox ni preguntas (como `claude:free`). Sin `claude-repo-guard`, se abre con tus settings. `--plan` devuelve esos mismos argumentos en `claudeArgs`.
+**Permisos:** si el repo tiene [`claude-repo-guard`](https://github.com/ramon-sg/claude-repo-guard), Claude se abre en modo auto con su contexto (lo mismo que `claude:auto`). Con `--ask-permissions` se abre con tus settings, con `--free` sin sandbox ni preguntas (como `claude:free`), y con `--free --no-repo-deny` también sin los `deny` del `.claude/settings.json` del repo, que vuelven al salir ([qué quita cada modo](docs/flujos/terminal.md#opciones)). Sin `claude-repo-guard`, se abre con tus settings. `--plan` devuelve esos mismos argumentos en `claudeArgs`. El atajo es `npm run issue:start:free 42`. Con npm, las opciones van después de `--` (`npm run issue:start -- 42 --free`); con pnpm, bun o yarn no hace falta. La tabla de cada administrador está en [Flujos](docs/flujos.md#administradores). `issue-flow issue start --help` explica cada opción.
 
 ### Con la nube y con otras herramientas
 
@@ -196,7 +196,7 @@ npx @ramon-sg/issue-flow doctor                   # revisa que el repo esté com
 `apply` deja el repo como lo pide la versión que corre, y correrlo otra vez no cambia nada. La versión la elige quien actualiza, al elegir cuál correr: `apply` no cambia la versión de ningún otro paquete.
 
 1. **`.agents/flow.json`:** si no existe, lo crea con el `$schema` de esta versión y, si el repo tiene `paseo.json`, con su plantilla de rama y sus tipos. Esa primera vez propone las recetas que sugieren los archivos del repo (con `--yes`, todas; sin terminal y sin `--yes`, no escribe nada y lo dice). Si ya existe, no pregunta: corre las migraciones de esta versión, mueve el `$schema` y suma las recetas de `--recipe`.
-2. **`package.json`:** `@ramon-sg/issue-flow` en esta versión, exacta. `@ramon-sg/github-rest` y los scripts `issue:start`, `worktree:prune` y `pr:worktree` solo si faltan: un `github-rest` que el repo ya tiene se queda, con un aviso si no llega a la versión que necesitan las skills.
+2. **`package.json`:** `@ramon-sg/issue-flow` en esta versión, exacta. `@ramon-sg/github-rest` y los scripts `issue:start`, `issue:start:free`, `worktree:prune` y `pr:worktree` solo si faltan (`issue:start:free` no se agrega si el repo tiene su propio `issue:start`, que se saltaría): un `github-rest` que el repo ya tiene se queda, con un aviso si no llega a la versión que necesitan las skills.
 3. **`.claude/settings.json`:** los hooks `SessionStart`, `WorktreeCreate` y `WorktreeRemove`, fijados a esta versión y con 600 segundos. El de `SessionStart` corre `claude-cloud session` en la nube, así que un hook propio de `claude-cloud` se quita para que no corra dos veces.
 
 No consulta npm, y nunca baja de versión: si el repo ya tiene una issue-flow más nueva (por ejemplo, `package.json` subido a mano antes del `install`), o un rango como `^0.2.6`, se detiene y dice qué correr. `--json` da `{ version, changes, kept, written, next }`. Sale con 0 si aplicó o no había nada que hacer, y con 1 si se negó o tenía que preguntar y no pudo.

package/dist/cli-flags.d.ts

@@ -0,0 +1,97 @@
+/**
+ * @file The CLI's flags and which command takes each one, apart from cli.ts (which runs on
+ * import) so the tests can check the usage text against them.
+ */
+import type { parseArgs } from "node:util";
+/** Options of the CLI. */
+export declare const OPTIONS: {
+    readonly repo: {
+        readonly type: "string";
+        readonly short: "R";
+    };
+    readonly json: {
+        readonly type: "boolean";
+    };
+    readonly help: {
+        readonly type: "boolean";
+        readonly short: "h";
+    };
+    readonly missing: {
+        readonly type: "boolean";
+    };
+    readonly limit: {
+        readonly type: "string";
+    };
+    readonly namer: {
+        readonly type: "string";
+    };
+    readonly yes: {
+        readonly type: "boolean";
+        readonly short: "y";
+    };
+    readonly "dry-run": {
+        readonly type: "boolean";
+    };
+    readonly branch: {
+        readonly type: "boolean";
+    };
+    readonly resume: {
+        readonly type: "string";
+    };
+    readonly new: {
+        readonly type: "boolean";
+    };
+    readonly "no-launch": {
+        readonly type: "boolean";
+    };
+    readonly "ask-permissions": {
+        readonly type: "boolean";
+    };
+    readonly free: {
+        readonly type: "boolean";
+    };
+    readonly "no-repo-deny": {
+        readonly type: "boolean";
+    };
+    readonly plan: {
+        readonly type: "boolean";
+    };
+    readonly cloud: {
+        readonly type: "boolean";
+    };
+    readonly here: {
+        readonly type: "boolean";
+    };
+    readonly teleport: {
+        readonly type: "boolean";
+    };
+    readonly adopt: {
+        readonly type: "boolean";
+    };
+    readonly only: {
+        readonly type: "string";
+    };
+    readonly path: {
+        readonly type: "string";
+    };
+    readonly next: {
+        readonly type: "boolean";
+    };
+    readonly "no-setup": {
+        readonly type: "boolean";
+    };
+    readonly recipe: {
+        readonly type: "string";
+    };
+    readonly update: {
+        readonly type: "boolean";
+    };
+};
+/** The parsed flags. */
+export type Flags = ReturnType<typeof parseArgs<{
+    options: typeof OPTIONS;
+    allowPositionals: true;
+    strict: true;
+}>>["values"];
+/** Flags each command takes, besides `--repo`, `--help` and `--namer`. */
+export declare const COMMAND_FLAGS: Record<string, (keyof Flags)[]>;

package/dist/cli-flags.js

@@ -0,0 +1,66 @@
+/** Options of the CLI. */
+export const OPTIONS = {
+    repo: { type: "string", short: "R" },
+    json: { type: "boolean" },
+    help: { type: "boolean", short: "h" },
+    missing: { type: "boolean" },
+    limit: { type: "string" },
+    namer: { type: "string" },
+    yes: { type: "boolean", short: "y" },
+    "dry-run": { type: "boolean" },
+    branch: { type: "boolean" },
+    resume: { type: "string" },
+    new: { type: "boolean" },
+    "no-launch": { type: "boolean" },
+    "ask-permissions": { type: "boolean" },
+    free: { type: "boolean" },
+    "no-repo-deny": { type: "boolean" },
+    plan: { type: "boolean" },
+    cloud: { type: "boolean" },
+    here: { type: "boolean" },
+    teleport: { type: "boolean" },
+    adopt: { type: "boolean" },
+    only: { type: "string" },
+    path: { type: "string" },
+    next: { type: "boolean" },
+    "no-setup": { type: "boolean" },
+    recipe: { type: "string" },
+    update: { type: "boolean" },
+};
+/** Flags each command takes, besides `--repo`, `--help` and `--namer`. */
+export const COMMAND_FLAGS = {
+    branch: ["json", "missing", "limit", "yes", "dry-run"],
+    start: [
+        "yes",
+        "dry-run",
+        "branch",
+        "resume",
+        "new",
+        "no-launch",
+        "ask-permissions",
+        "free",
+        "no-repo-deny",
+        "plan",
+        "cloud",
+        "here",
+        "teleport",
+        "adopt",
+    ],
+    "worktree setup": ["only"],
+    "worktree teardown": ["path"],
+    "worktree ports": ["next"],
+    "worktree cleanup": ["path"],
+    "worktree prune": ["only", "yes"],
+    session: [],
+    "pr worktree": ["no-setup"],
+    "adapter setup": ["only"],
+    "adapter issue": [],
+    "adapter archive": [],
+    "hook worktree-create": [],
+    "hook worktree-remove": [],
+    apply: ["yes", "dry-run", "json", "recipe"],
+    init: ["yes", "recipe"],
+    doctor: ["json"],
+    upgrade: ["dry-run"],
+    "labels sync": ["update", "dry-run", "json"],
+};

package/dist/cli-setup.d.ts

@@ -2,7 +2,7 @@
  * @file The `apply` and `doctor` commands of the CLI, and `init` and `upgrade`, which run
  * `apply` now and say so: their flags turned into options.
  */
-import type { Flags } from "./cli.js";
+import type { Flags } from "./cli-flags.js";
 import { type Output } from "./output.js";
 /** The setup commands. */
 export declare const SETUP_COMMANDS: string[];

package/dist/cli-worktree.d.ts

@@ -2,7 +2,7 @@
  * @file The `worktree`, `session`, `adapter` and `hook` commands of the CLI: their flags
  * turned into options.
  */
-import type { Flags } from "./cli.js";
+import type { Flags } from "./cli-flags.js";
 import { type FlowConfig } from "./config.js";
 import { type Output } from "./output.js";
 /** The commands of `issue-flow worktree`. */

package/dist/cli.d.ts

@@ -1,99 +1,7 @@
 #!/usr/bin/env node
-/**
- * @file `issue-flow` CLI. Warnings on stderr; exits 0 on success, 1 if GitHub, an edit or
- * the start of an issue failed (or was declined) and 2 on bad usage or a bad
- * `.agents/flow.json`.
- */
-import { parseArgs } from "node:util";
+import { type Flags } from "./cli-flags.js";
 import { type FlowConfig } from "./config.js";
 import { type Output } from "./output.js";
-/** Options of the CLI. */
-declare const OPTIONS: {
-    readonly repo: {
-        readonly type: "string";
-        readonly short: "R";
-    };
-    readonly json: {
-        readonly type: "boolean";
-    };
-    readonly help: {
-        readonly type: "boolean";
-        readonly short: "h";
-    };
-    readonly missing: {
-        readonly type: "boolean";
-    };
-    readonly limit: {
-        readonly type: "string";
-    };
-    readonly namer: {
-        readonly type: "string";
-    };
-    readonly yes: {
-        readonly type: "boolean";
-        readonly short: "y";
-    };
-    readonly "dry-run": {
-        readonly type: "boolean";
-    };
-    readonly branch: {
-        readonly type: "boolean";
-    };
-    readonly resume: {
-        readonly type: "string";
-    };
-    readonly new: {
-        readonly type: "boolean";
-    };
-    readonly "no-launch": {
-        readonly type: "boolean";
-    };
-    readonly "ask-permissions": {
-        readonly type: "boolean";
-    };
-    readonly free: {
-        readonly type: "boolean";
-    };
-    readonly plan: {
-        readonly type: "boolean";
-    };
-    readonly cloud: {
-        readonly type: "boolean";
-    };
-    readonly here: {
-        readonly type: "boolean";
-    };
-    readonly teleport: {
-        readonly type: "boolean";
-    };
-    readonly adopt: {
-        readonly type: "boolean";
-    };
-    readonly only: {
-        readonly type: "string";
-    };
-    readonly path: {
-        readonly type: "string";
-    };
-    readonly next: {
-        readonly type: "boolean";
-    };
-    readonly "no-setup": {
-        readonly type: "boolean";
-    };
-    readonly recipe: {
-        readonly type: "string";
-    };
-    readonly update: {
-        readonly type: "boolean";
-    };
-};
-/** The parsed flags. */
-export type Flags = ReturnType<typeof parseArgs<{
-    options: typeof OPTIONS;
-    allowPositionals: true;
-    strict: true;
-}>>["values"];
 /**
  * The repo of the command: `-R`, then the config's `repo`, then `GH_REPO`, then origin.
  * @param flag - The `-R` value.
@@ -111,6 +19,19 @@ export declare function repoOf(flag: string | undefined, config: FlowConfig, cwd
  * @example ownFlags("worktree ports", { next: true })
  */
 export declare function ownFlags(command: string, flags: Flags): void;
+/**
+ * Splits the arguments from the command that `pr worktree` runs after `--`. Anywhere else
+ * a `--` is dropped, since pnpm passes it on as it is (`pnpm issue:start -- 42` runs
+ * `issue start -- 42`), and so is one right after `pr worktree` with no PR number before it
+ * (`pnpm pr:worktree -- 5`).
+ * @param argv - The arguments.
+ * @returns The arguments for issue-flow, and the command, or null if there is none.
+ * @example splitArgs(["pr", "worktree", "5", "--", "npm", "test"]) // { args: ["pr", "worktree", "5"], command: ["npm", "test"] }
+ */
+export declare function splitArgs(argv: string[]): {
+    args: string[];
+    command: string[] | null;
+};
 /**
  * Runs the CLI.
  * @param argv - Arguments without `node` or the script.
@@ -120,4 +41,3 @@ export declare function ownFlags(command: string, flags: Flags): void;
  * @throws UsageError, ConfigError or GitHubError, which the entry point handles.
  */
 export declare function main(argv: string[], out: Output, cwd: string): Promise<number>;
-export {};

package/dist/cli.js

@@ -5,6 +5,7 @@
  * `.agents/flow.json`.
  */
 import { parseArgs } from "node:util";
+import { COMMAND_FLAGS, OPTIONS } from "./cli-flags.js";
 import { GitHubError, InvalidRepoEnvError, resolveRepo } from "@ramon-sg/github-rest";
 import { branchMissing, branchOf } from "./commands/issue-branch.js";
 import { issueStart } from "./commands/issue-start.js";
@@ -15,71 +16,7 @@ import { prWorktree } from "./commands/pr-worktree.js";
 import { ConfigError } from "./config-base.js";
 import { loadConfig } from "./config.js";
 import { processOutput, UsageError } from "./output.js";
-import { USAGE } from "./usage.js";
-/** Options of the CLI. */
-const OPTIONS = {
-    repo: { type: "string", short: "R" },
-    json: { type: "boolean" },
-    help: { type: "boolean", short: "h" },
-    missing: { type: "boolean" },
-    limit: { type: "string" },
-    namer: { type: "string" },
-    yes: { type: "boolean", short: "y" },
-    "dry-run": { type: "boolean" },
-    branch: { type: "boolean" },
-    resume: { type: "string" },
-    new: { type: "boolean" },
-    "no-launch": { type: "boolean" },
-    "ask-permissions": { type: "boolean" },
-    free: { type: "boolean" },
-    plan: { type: "boolean" },
-    cloud: { type: "boolean" },
-    here: { type: "boolean" },
-    teleport: { type: "boolean" },
-    adopt: { type: "boolean" },
-    only: { type: "string" },
-    path: { type: "string" },
-    next: { type: "boolean" },
-    "no-setup": { type: "boolean" },
-    recipe: { type: "string" },
-    update: { type: "boolean" },
-};
-/** Flags each command takes, besides `--repo`, `--help` and `--namer`. */
-const COMMAND_FLAGS = {
-    branch: ["json", "missing", "limit", "yes", "dry-run"],
-    start: [
-        "yes",
-        "dry-run",
-        "branch",
-        "resume",
-        "new",
-        "no-launch",
-        "ask-permissions",
-        "free",
-        "plan",
-        "cloud",
-        "here",
-        "teleport",
-        "adopt",
-    ],
-    "worktree setup": ["only"],
-    "worktree teardown": ["path"],
-    "worktree ports": ["next"],
-    "worktree cleanup": ["path"],
-    "worktree prune": ["only", "yes"],
-    session: [],
-    "pr worktree": ["no-setup"],
-    "adapter setup": ["only"],
-    "adapter issue": [],
-    "adapter archive": [],
-    "hook worktree-create": [],
-    "hook worktree-remove": [],
-    apply: ["yes", "dry-run", "json", "recipe"],
-    init: ["yes", "recipe"],
-    doctor: ["json"],
-    upgrade: ["dry-run"],
-    "labels sync": ["update", "dry-run", "json"],
-};
+import { usageOf } from "./usage.js";
 /** An issue number: digits only. */
 const NUMBER = /^\d+$/;
 /** A positive whole number. */
@@ -145,8 +82,10 @@ export function ownFlags(command, flags) {
 function permissionsOf(flags) {
     if (flags["ask-permissions"] && flags.free)
         throw new UsageError("use --ask-permissions or --free, not both.");
+    if (flags["no-repo-deny"] && !flags.free)
+        throw new UsageError("--no-repo-deny goes with --free.");
     if (flags.free)
-        return "free";
+        return flags["no-repo-deny"] ? "free-no-repo-deny" : "free";
     return flags["ask-permissions"] ? "ask" : "default";
 }
 /**
@@ -162,18 +101,18 @@ function startArgs(flags, rest) {
         throw new UsageError("issue start needs one issue number.");
     if (flags.resume !== undefined && flags.new)
         throw new UsageError("--resume does not go with --new.");
-    const conflicting = flags.branch || flags["dry-run"] || flags.yes || flags.resume !== undefined || flags.new;
+    const conflicting = flags.branch || flags["dry-run"] || flags.yes || flags.resume !== undefined || flags.new || flags["no-repo-deny"];
     if (flags.plan && conflicting)
-        throw new UsageError("--plan does not go with --branch, --dry-run, --yes, --resume nor --new.");
+        throw new UsageError("--plan does not go with --branch, --dry-run, --yes, --resume, --new nor --no-repo-deny.");
     cloudArgs(flags);
     return Number(text);
 }
 /** The flags that do not go together with each way of starting, besides each other. */
 const EXCLUSIVE = {
-    cloud: ["branch", "plan", "ask-permissions", "free"],
-    here: ["branch", "plan", "ask-permissions", "free"],
+    cloud: ["branch", "plan", "ask-permissions", "free", "no-repo-deny"],
+    here: ["branch", "plan", "ask-permissions", "free", "no-repo-deny"],
     teleport: ["plan", "new", "no-launch"],
-    adopt: ["branch", "plan", "resume", "new", "ask-permissions", "free"],
+    adopt: ["branch", "plan", "resume", "new", "ask-permissions", "free", "no-repo-deny"],
 };
 /**
  * Checks `--cloud`, `--here`, `--teleport` and `--adopt`: at most one, and none with the
@@ -192,6 +131,41 @@ function cloudArgs(flags) {
     if (other !== undefined)
         throw new UsageError(`--${way} does not go with --${other}.`);
 }
+/**
+ * The positionals of some arguments, with each flag's value left out (`-R o/r` is a flag).
+ * @param args - The arguments.
+ * @returns The positionals.
+ */
+function positionalsOf(args) {
+    return parseArgs({ args, options: OPTIONS, allowPositionals: true, strict: false }).positionals;
+}
+/**
+ * Splits the arguments from the command that `pr worktree` runs after `--`. Anywhere else
+ * a `--` is dropped, since pnpm passes it on as it is (`pnpm issue:start -- 42` runs
+ * `issue start -- 42`), and so is one right after `pr worktree` with no PR number before it
+ * (`pnpm pr:worktree -- 5`).
+ * @param argv - The arguments.
+ * @returns The arguments for issue-flow, and the command, or null if there is none.
+ * @example splitArgs(["pr", "worktree", "5", "--", "npm", "test"]) // { args: ["pr", "worktree", "5"], command: ["npm", "test"] }
+ */
+export function splitArgs(argv) {
+    let args = argv;
+    for (let dashes = args.indexOf("--"); dashes !== -1; dashes = args.indexOf("--")) {
+        const words = positionalsOf(args.slice(0, dashes));
+        if (words[0] === "pr" && words[1] === "worktree" && words.length > 2)
+            return { args: args.slice(0, dashes), command: args.slice(dashes + 1) };
+        args = args.filter((_, index) => index !== dashes);
+    }
+    return { args, command: null };
+}
+/**
+ * The command's words, as `usageOf` takes them.
+ * @param argv - The arguments.
+ * @returns The positionals, without the flags nor their values.
+ */
+function commandWords(argv) {
+    return positionalsOf(splitArgs(argv).args);
+}
 /**
  * Runs the CLI.
  * @param argv - Arguments without `node` or the script.
@@ -201,23 +175,20 @@ function cloudArgs(flags) {
  * @throws UsageError, ConfigError or GitHubError, which the entry point handles.
  */
 export async function main(argv, out, cwd) {
-    const dashes = argv.indexOf("--");
-    const command = dashes === -1 ? null : argv.slice(dashes + 1);
+    const { args, command } = splitArgs(argv);
     let parsed;
     try {
-        parsed = parseArgs({ args: dashes === -1 ? argv : argv.slice(0, dashes), options: OPTIONS, allowPositionals: true, strict: true });
+        parsed = parseArgs({ args, options: OPTIONS, allowPositionals: true, strict: true });
     }
     catch (error) {
         throw new UsageError(error instanceof Error ? error.message : String(error));
     }
     const { values: flags, positionals } = parsed;
     if (flags.help) {
-        out.stdout(`${USAGE}\n`);
+        out.stdout(`${usageOf(positionals)}\n`);
         return 0;
     }
     const [group, sub, ...rest] = positionals;
-    if (command !== null && (group !== "pr" || sub !== "worktree"))
-        throw new UsageError("-- only goes with pr worktree.");
     if (group === "pr")
         return runPr(sub, rest, flags, { out, cwd, command });
     if (group === "labels")
@@ -363,6 +334,6 @@ main(process.argv.slice(2), out, process.cwd()).then((code) => {
 }, (error) => {
     const usage = error instanceof UsageError;
     const config = error instanceof ConfigError;
-    out.stderr(`issue-flow: ${error instanceof Error ? error.message : String(error)}\n${usage ? `${USAGE}\n` : ""}`);
+    out.stderr(`issue-flow: ${error instanceof Error ? error.message : String(error)}\n${usage ? `${usageOf(commandWords(process.argv.slice(2)))}\n` : ""}`);
     process.exitCode = usage || config ? 2 : 1;
 });

package/dist/commands/issue-start.js

@@ -17,6 +17,7 @@ import { inPath, launchSession, permissionArgs, teleportSession } from "../launc
 import { emitJson, warn } from "../output.js";
 import { findOpenPlan, findPlan } from "../plan-doc.js";
 import { proposeBranches } from "../propose.js";
+import { liftRepoDeny, restoreRepoDeny } from "../repo-deny.js";
 import { lockWorktree, unlockWorktree } from "../session-lock.js";
 import { afterSession, choosePlace, copyWorktreeIncludes, prepareBranch, publish } from "../start-place.js";
 import { chooseAdopted, fetchOrigin, finishHere, launchCloud, placeAdopted, placeCloud, placeHere, prCloudSession, prepareHere, readAdopted, renameAdopted, withoutFresh, } from "../start-modes.js";
@@ -245,6 +246,31 @@ function question(state) {
         };
     return { text: "Start the issue?", declined: "did nothing." };
 }
+/**
+ * Before opening Claude: puts back the repo's deny rules a session whose terminal was
+ * closed left out, and with `--free --no-repo-deny` takes them out for this one. With
+ * another session in the worktree it touches nothing, as it may be using them.
+ * @param state - The start.
+ * @param lock - The worktree lock.
+ * @returns What to put back, or null if nothing was taken out.
+ */
+function liftForSession(state, lock) {
+    const { out, commonDir, branch } = state;
+    const wanted = state.options.permissions === "free-no-repo-deny";
+    if (lock.shared) {
+        if (wanted)
+            warn(out, "another session uses this worktree: the repo's deny rules stay.");
+        return null;
+    }
+    const leftover = restoreRepoDeny(commonDir, branch, state.workDir, null);
+    if (leftover !== null)
+        warn(out, leftover);
+    if (!wanted)
+        return null;
+    const { message, saved } = liftRepoDeny(state.workDir, commonDir, branch);
+    out.stdout(`${message}\n`);
+    return saved;
+}
 /**
  * Opens Claude in the place, locking a worktree meanwhile, and then offers the cleanup.
  * Without `claude` or with `--no-launch`, says how to open it.
@@ -264,6 +290,7 @@ async function openSession(state) {
     process.once("exit", release);
     forgetTypedAhead();
     const permissions = permissionArgs(options.permissions, state.workDir, state.mainRoot).args;
+    const lifted = liftForSession(state, lock);
     if (options.teleport) {
         out.stdout(`Bringing the cloud session${state.cloudSession === null ? "" : ` (${state.cloudSession})`}. To resume it later: claude --resume\n`);
         teleportSession(state.workDir, permissions, state.cloudSession);
@@ -278,6 +305,11 @@ async function openSession(state) {
             color: issueColor(state.labels, options.config.colors)?.color ?? null,
             permissions,
         }, (text) => warn(out, text));
+    if (lifted !== null) {
+        const problem = restoreRepoDeny(state.commonDir, state.branch, state.workDir, lifted);
+        if (problem !== null)
+            warn(out, problem);
+    }
     release();
     process.off("exit", release);
     await afterSession(state, lock);

package/dist/launch.d.ts

@@ -3,8 +3,12 @@ import { type StartMode } from "./issue-text.js";
 export declare const AUTO_MODE_FILE = ".claude/repo-guard.auto-mode.json";
 /** Folder, inside the shared `.git`, with one file per branch holding its session id. */
 export declare const SESSIONS_DIR = "issue-flow-sessions";
-/** How Claude asks for permissions: chosen by the flags, or the default. */
-export type Permissions = "default" | "ask" | "free";
+/**
+ * How Claude asks for permissions: chosen by the flags, or the default. `free-no-repo-deny`
+ * is `--free --no-repo-deny`: the same arguments as `free`, and `issue start` also takes the
+ * repo's deny rules out while Claude runs (see repo-deny.ts).
+ */
+export type Permissions = "default" | "ask" | "free" | "free-no-repo-deny";
 /** The arguments of the permission mode, and how the summary names it. */
 export interface PermissionArgs {
     args: string[];
@@ -53,7 +57,16 @@ export declare function sessionExists(id: string): boolean;
  */
 export declare function savedSession(commonDir: string, branch: string): string | null;
 /**
- * Forgets a branch's session id, once its work is gone.
+ * The note `--no-repo-deny` keeps while the repo's deny rules are out, next to the
+ * branch's session id.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @returns The path.
+ * @example noteFile("/repo/.git", "feat/42-x") // "/repo/.git/issue-flow-sessions/feat+42-x.repo-deny.json"
+ */
+export declare function noteFile(commonDir: string, branch: string): string;
+/**
+ * Forgets a branch's session id (and its `--no-repo-deny` note), once its work is gone.
  * @param commonDir - The shared `.git`.
  * @param branch - The branch.
  * @example forgetSession("/repo/.git", "feat/42-x")

package/dist/launch.js

@@ -1,8 +1,8 @@
 /**
  * @file Opens Claude for an issue in the same terminal. The permission mode follows
  * `claude-repo-guard` when the repo has it: auto mode with its classifier context by
- * default, plain `claude` with `--ask-permissions`, and no sandbox nor questions with
- * `--free`. Each branch keeps its session id, so starting the issue again resumes it.
+ * default, plain `claude` with `--ask-permissions`, no sandbox nor questions with `--free`,
+ * and also without the repo's deny rules with `--free --no-repo-deny`. Each branch keeps its session id, so starting the issue again resumes it.
  * Ported from `launch_session` and `run_claude` in Abastio's `scripts/start-issue.sh`.
  */
 import { randomUUID } from "node:crypto";
@@ -32,7 +32,12 @@ export function permissionArgs(permissions, workDir, mainRoot) {
     if (permissions === "free")
         return {
             args: ["--settings", NO_SANDBOX, "--dangerously-skip-permissions"],
-            label: "none: no sandbox and no questions (--free)",
+            label: "none: no sandbox and no questions; deny rules still apply (--free)",
+        };
+    if (permissions === "free-no-repo-deny")
+        return {
+            args: ["--settings", NO_SANDBOX, "--dangerously-skip-permissions"],
+            label: "none: no sandbox, no questions and no deny rules of the repo; yours still apply (--free --no-repo-deny)",
         };
     if (permissions === "ask")
         return { args: [], label: "your settings (--ask-permissions)" };
@@ -96,13 +101,25 @@ export function savedSession(commonDir, branch) {
     return id !== "" && sessionExists(id) ? id : null;
 }
 /**
- * Forgets a branch's session id, once its work is gone.
+ * The note `--no-repo-deny` keeps while the repo's deny rules are out, next to the
+ * branch's session id.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @returns The path.
+ * @example noteFile("/repo/.git", "feat/42-x") // "/repo/.git/issue-flow-sessions/feat+42-x.repo-deny.json"
+ */
+export function noteFile(commonDir, branch) {
+    return `${sessionFile(commonDir, branch)}.repo-deny.json`;
+}
+/**
+ * Forgets a branch's session id (and its `--no-repo-deny` note), once its work is gone.
  * @param commonDir - The shared `.git`.
  * @param branch - The branch.
  * @example forgetSession("/repo/.git", "feat/42-x")
  */
 export function forgetSession(commonDir, branch) {
     rmSync(sessionFile(commonDir, branch), { force: true });
+    rmSync(noteFile(commonDir, branch), { force: true });
 }
 /**
  * Runs Claude in the terminal; its exit code does not matter, what follows runs anyway.

package/dist/package-edits.js

@@ -100,9 +100,13 @@ export function reaches(current, tested) {
 export const KEPT = "kept ";
 /** The package the skills call, which the repo gets if it lacks it. */
 export const GITHUB_REST = "@ramon-sg/github-rest";
+/** The script that starts an issue, and its shortcut with `--free`. */
+const START_SCRIPT = "issue:start";
+const FREE_SCRIPT = "issue:start:free";
 /** The scripts `apply` adds. */
 const FLOW_SCRIPTS = {
     "issue:start": "issue-flow issue start",
+    "issue:start:free": "issue-flow issue start --free",
     "worktree:prune": "issue-flow worktree prune",
     "pr:worktree": "issue-flow pr worktree",
 };
@@ -156,8 +160,13 @@ export function withFlowPackages(pkg, versions) {
         pin(GITHUB_REST, versions.githubRest, "devDependencies", null);
     else if (!reaches(rest.version, versions.githubRest))
         changes.push(`${KEPT}${GITHUB_REST} ${rest.version} (the skills need ${versions.githubRest} or newer: raise it)`);
+    // NOTE: with its own issue:start (a wrapper), issue:start:free would skip it: it is not
+    // added, and the flow's one gets a note.
+    const ownStart = scripts[START_SCRIPT] !== undefined && scripts[START_SCRIPT] !== FLOW_SCRIPTS[START_SCRIPT];
+    if (ownStart && scripts[FREE_SCRIPT] === FLOW_SCRIPTS[FREE_SCRIPT])
+        changes.push(`${KEPT}scripts: ${FREE_SCRIPT}, which skips the repo's own ${START_SCRIPT}: make it run that one with --free, or delete it`);
     for (const [name, command] of Object.entries(FLOW_SCRIPTS)) {
-        if (scripts[name] !== undefined)
+        if (scripts[name] !== undefined || (name === FREE_SCRIPT && ownStart))
             continue;
         scripts[name] = command;
         changes.push(`scripts: ${name}`);

package/dist/repo-deny.d.ts

@@ -0,0 +1,54 @@
+/** The repo's Claude settings, relative to the checkout. */
+export declare const REPO_SETTINGS = ".claude/settings.json";
+/** What it takes to put the rules back. */
+export interface Lifted {
+    /** The file as it was. */
+    original: string;
+    /** The file as issue-flow left it, without the rules. */
+    lifted: string;
+}
+/**
+ * The settings without `permissions.deny` (and without `permissions` if nothing else is
+ * left in it), or null if they have no rules to take out.
+ * @param text - The settings file.
+ * @returns The new text, or null.
+ * @throws SyntaxError if the file is not JSON.
+ * @example withoutDeny('{"permissions":{"deny":["Edit(/x)"]}}') // "{}\n"
+ */
+export declare function withoutDeny(text: string): string | null;
+/**
+ * The settings with the original's deny rules added back (keeping any the text has).
+ * @param text - The settings now.
+ * @param original - The settings with the rules.
+ * @returns The new text.
+ * @throws SyntaxError if either is not JSON.
+ * @example withDeny("{}", '{"permissions":{"deny":["Edit(/x)"]}}') // '{\n  "permissions": {\n    "deny": [\n      "Edit(/x)"\n    ]\n  }\n}\n'
+ */
+export declare function withDeny(text: string, original: string): string;
+/**
+ * Takes the `deny` rules out of the worktree's settings and hides the change from git. A
+ * note in the shared `.git` keeps the original in case the process dies before it puts
+ * them back; the caller keeps what it returns and puts them back from that.
+ * @param workDir - The worktree.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @returns What happened, for the person, and what to put back (null if nothing was taken).
+ * @example liftRepoDeny(wt, "/repo/.git", "feat/42-x").message
+ */
+export declare function liftRepoDeny(workDir: string, commonDir: string, branch: string): {
+    message: string;
+    saved: Lifted | null;
+};
+/**
+ * Puts the rules back in the worktree's settings. From `saved` when the caller kept it (the
+ * note is in reach of the session, so it is only trusted after a process that died); else
+ * from the branch's note, if there is one. If Claude changed the file meanwhile, the rules
+ * go back on top of its change, with a warning to review it.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @param workDir - The worktree, never taken from the note.
+ * @param saved - What liftRepoDeny returned, or null to read the note.
+ * @returns A warning, or null if there was nothing to say.
+ * @example restoreRepoDeny("/repo/.git", "feat/42-x", wt, null) // null
+ */
+export declare function restoreRepoDeny(commonDir: string, branch: string, workDir: string, saved: Lifted | null): string | null;

package/dist/repo-deny.js

@@ -0,0 +1,128 @@
+/**
+ * @file `--free --no-repo-deny`: takes the `deny` rules out of the worktree's
+ * `.claude/settings.json` while Claude runs, and puts them back when it exits. Claude adds
+ * the `deny` of every settings file it loads and `--dangerously-skip-permissions` respects
+ * them, so a flag cannot drop them; and `--setting-sources user,local` drops them but also
+ * the repo's `CLAUDE.md`, skills, agents and MCP servers. Editing the worktree's own copy
+ * keeps all that, and leaves the main checkout and the other worktrees alone.
+ *
+ * While the rules are out, `git update-index --skip-worktree` hides the change from
+ * `git status` and `git add`, so it never lands in a commit. A note in the shared `.git`
+ * keeps the original, so a session whose terminal was closed is put back on the next
+ * `issue start` of the branch.
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { git } from "./git.js";
+import { noteFile } from "./launch.js";
+/** The repo's Claude settings, relative to the checkout. */
+export const REPO_SETTINGS = ".claude/settings.json";
+/**
+ * The settings without `permissions.deny` (and without `permissions` if nothing else is
+ * left in it), or null if they have no rules to take out.
+ * @param text - The settings file.
+ * @returns The new text, or null.
+ * @throws SyntaxError if the file is not JSON.
+ * @example withoutDeny('{"permissions":{"deny":["Edit(/x)"]}}') // "{}\n"
+ */
+export function withoutDeny(text) {
+    const settings = JSON.parse(text);
+    const deny = settings.permissions?.deny;
+    if (!Array.isArray(deny) || deny.length === 0)
+        return null;
+    const { deny: _dropped, ...permissions } = settings.permissions ?? {};
+    const { permissions: _old, ...rest } = settings;
+    const result = Object.keys(permissions).length === 0 ? rest : { ...rest, permissions };
+    return `${JSON.stringify(result, null, 2)}\n`;
+}
+/**
+ * The settings with the original's deny rules added back (keeping any the text has).
+ * @param text - The settings now.
+ * @param original - The settings with the rules.
+ * @returns The new text.
+ * @throws SyntaxError if either is not JSON.
+ * @example withDeny("{}", '{"permissions":{"deny":["Edit(/x)"]}}') // '{\n  "permissions": {\n    "deny": [\n      "Edit(/x)"\n    ]\n  }\n}\n'
+ */
+export function withDeny(text, original) {
+    const settings = JSON.parse(text);
+    const deny = JSON.parse(original).permissions?.deny ?? [];
+    const now = Array.isArray(settings.permissions?.deny) ? settings.permissions.deny : [];
+    const merged = [...deny, ...now.filter((rule) => !deny.includes(rule))];
+    return `${JSON.stringify({ ...settings, permissions: { ...settings.permissions, deny: merged } }, null, 2)}\n`;
+}
+/**
+ * Takes the `deny` rules out of the worktree's settings and hides the change from git. A
+ * note in the shared `.git` keeps the original in case the process dies before it puts
+ * them back; the caller keeps what it returns and puts them back from that.
+ * @param workDir - The worktree.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @returns What happened, for the person, and what to put back (null if nothing was taken).
+ * @example liftRepoDeny(wt, "/repo/.git", "feat/42-x").message
+ */
+export function liftRepoDeny(workDir, commonDir, branch) {
+    const file = join(workDir, REPO_SETTINGS);
+    if (!existsSync(file))
+        return { message: `the repo has no ${REPO_SETTINGS}: there are no deny rules to take out.`, saved: null };
+    const original = readFileSync(file, "utf8");
+    let lifted;
+    try {
+        lifted = withoutDeny(original);
+    }
+    catch {
+        return { message: `${REPO_SETTINGS} is not valid JSON: its deny rules stay.`, saved: null };
+    }
+    if (lifted === null)
+        return { message: `${REPO_SETTINGS} has no deny rules: nothing to take out.`, saved: null };
+    const saved = { original, lifted };
+    const note = noteFile(commonDir, branch);
+    mkdirSync(dirname(note), { recursive: true });
+    writeFileSync(note, `${JSON.stringify(saved)}\n`);
+    writeFileSync(file, lifted);
+    git(workDir, ["update-index", "--skip-worktree", REPO_SETTINGS]);
+    return { message: `took out the deny rules of ${REPO_SETTINGS} for this session; they come back when Claude exits.`, saved };
+}
+/**
+ * Puts the rules back in the worktree's settings. From `saved` when the caller kept it (the
+ * note is in reach of the session, so it is only trusted after a process that died); else
+ * from the branch's note, if there is one. If Claude changed the file meanwhile, the rules
+ * go back on top of its change, with a warning to review it.
+ * @param commonDir - The shared `.git`.
+ * @param branch - The branch.
+ * @param workDir - The worktree, never taken from the note.
+ * @param saved - What liftRepoDeny returned, or null to read the note.
+ * @returns A warning, or null if there was nothing to say.
+ * @example restoreRepoDeny("/repo/.git", "feat/42-x", wt, null) // null
+ */
+export function restoreRepoDeny(commonDir, branch, workDir, saved) {
+    const note = noteFile(commonDir, branch);
+    let from = saved;
+    if (from === null) {
+        if (!existsSync(note))
+            return null;
+        try {
+            from = JSON.parse(readFileSync(note, "utf8"));
+        }
+        catch {
+            rmSync(note, { force: true });
+            return `could not read ${note}; check the deny rules of ${REPO_SETTINGS} with git diff.`;
+        }
+    }
+    rmSync(note, { force: true });
+    if (!existsSync(workDir))
+        return null;
+    const file = join(workDir, REPO_SETTINGS);
+    git(workDir, ["update-index", "--no-skip-worktree", REPO_SETTINGS]);
+    const now = existsSync(file) ? readFileSync(file, "utf8") : null;
+    if (now === from.lifted || now === null) {
+        writeFileSync(file, from.original);
+        return null;
+    }
+    try {
+        writeFileSync(file, withDeny(now, from.original));
+    }
+    catch {
+        return `Claude left ${REPO_SETTINGS} as invalid JSON, so its deny rules could not be put back: fix it and add them before committing (git diff ${REPO_SETTINGS}).`;
+    }
+    return `Claude changed ${REPO_SETTINGS} during the session: its deny rules are back on top of that change; review it with git diff ${REPO_SETTINGS}.`;
+}

package/dist/usage.d.ts

@@ -2,4 +2,13 @@
  * @file The usage text of the CLI, printed with `--help` and after a usage error.
  */
 /** Usage text. */
-export declare const USAGE = "Usage:\n  issue-flow issue branch <n>... [--namer claude|title] [--json] [-R owner/repo]\n  issue-flow issue branch --missing [--limit <n>] [--namer claude|title] [--dry-run | --yes] [--json] [-R owner/repo]\n  issue-flow issue start <n> [--branch] [--dry-run | --yes] [--resume <branch> | --new] [--no-launch]\n                             [--ask-permissions | --free] [--namer claude|title] [-R owner/repo]\n  issue-flow issue start <n> --plan [--ask-permissions | --free] [--namer claude|title] [-R owner/repo]\n  issue-flow issue start <n> --cloud | --here | --teleport | --adopt [...]\n  issue-flow worktree setup [--only <step>]\n  issue-flow worktree teardown [--path <dir>]\n  issue-flow worktree ports [--next]\n  issue-flow worktree cleanup [--path <dir>]\n  issue-flow worktree prune [--only <dir>] [--yes] [-R owner/repo]\n  issue-flow pr worktree <n> [--no-setup] [-R owner/repo] [-- [<command>...]]\n  issue-flow adapter setup [--only <step>] | issue [<url>] | archive [-R owner/repo]\n  issue-flow session\n  issue-flow hook worktree-create | worktree-remove\n  issue-flow apply [--yes] [--dry-run] [--json] [--recipe <name>,...]\n  issue-flow doctor [--json]\n  issue-flow labels sync [--update] [--dry-run] [--json] [-R owner/repo]\n\nThe slug comes from the issue's \"Slug de rama\" block, then from Claude, then from the title,\nand the branch from the repo's template (an older \"Rama sugerida\" block is used if it fits).\n--missing adds the slug block to every open issue without a block, after confirming.\n\nissue start makes the branch in a worktree (or, with --branch, in this checkout), the\nstart commit, the push, the draft PR and the assignment, after confirming, and opens\nClaude: in auto mode if the repo has claude-repo-guard, with your settings with\n--ask-permissions, and with no sandbox nor questions with --free. --plan prints the branch\nand the prompt as JSON and changes nothing.\n\n--cloud confirms here and opens a Claude cloud session that starts the issue there.\n--here, inside a cloud session, starts it in this checkout and opens nothing. --teleport\nbrings the cloud session noted in the PR to the worktree. --adopt starts it in the\nworktree another tool (Orca, Paseo) just made, without asking nor opening Claude.\n\nworktree runs the steps of \"worktrees\" in .agents/flow.json: setup prepares this worktree,\nteardown cleans it before it goes (steps, ports, Docker), ports prints or moves its block\nof ports, cleanup deletes the Docker of deleted worktrees, and prune deletes the worktrees\nwhose PR was merged or closed. session is the SessionStart hook of Claude Code.\n\npr worktree makes (or reuses) a worktree on a PR's own branch, to review and fix it; with\n--, it runs the command there (Claude if none). adapter is what Orca and Paseo run: setup\nwhen they make a worktree (its steps and, if it came from an issue, issue start --adopt),\nissue to start one by hand, and archive before they delete it. hook implements Claude\nCode's WorktreeCreate and WorktreeRemove for claude --worktree.\n\napply leaves the repo as this version needs it: .agents/flow.json (the first time, with\nthe recipes its files suggest), issue-flow at this version and github-rest and the scripts\nif missing in package.json, and the hooks; it changes no other version, and refuses a newer\nissue-flow or a range. doctor checks them. npx agent-kitchen apply runs apply at the version\nit picks, along with the skills, claude-cloud and claude-repo-guard. init and upgrade still\nrun apply, with a warning, until 0.4.0.\n\nlabels sync makes in GitHub the labels the flow wants (\"labels\" in .agents/flow.json: the\nissue types and P1 to P4 by default) that the repo lacks. Names ignore case and are never\nrenamed nor deleted; --update also fixes the color and description of those that differ.";
+export declare const USAGE = "Usage:\n  issue-flow issue branch <n>... [--namer claude|title] [--json] [-R owner/repo]\n  issue-flow issue branch --missing [--limit <n>] [--namer claude|title] [--dry-run | --yes] [--json] [-R owner/repo]\n  issue-flow issue start <n> [--branch] [--dry-run | --yes] [--resume <branch> | --new] [--no-launch]\n                             [--ask-permissions | --free [--no-repo-deny]] [--namer claude|title] [-R owner/repo]\n  issue-flow issue start <n> --plan [--ask-permissions | --free] [--namer claude|title] [-R owner/repo]\n  issue-flow issue start <n> --cloud | --here | --teleport | --adopt [...]\n  issue-flow worktree setup [--only <step>]\n  issue-flow worktree teardown [--path <dir>]\n  issue-flow worktree ports [--next]\n  issue-flow worktree cleanup [--path <dir>]\n  issue-flow worktree prune [--only <dir>] [--yes] [-R owner/repo]\n  issue-flow pr worktree <n> [--no-setup] [-R owner/repo] [-- [<command>...]]\n  issue-flow adapter setup [--only <step>] | issue [<url>] | archive [-R owner/repo]\n  issue-flow session\n  issue-flow hook worktree-create | worktree-remove\n  issue-flow apply [--yes] [--dry-run] [--json] [--recipe <name>,...]\n  issue-flow doctor [--json]\n  issue-flow labels sync [--update] [--dry-run] [--json] [-R owner/repo]\n\nThe slug comes from the issue's \"Slug de rama\" block, then from Claude, then from the title,\nand the branch from the repo's template (an older \"Rama sugerida\" block is used if it fits).\n--missing adds the slug block to every open issue without a block, after confirming.\n\nissue start makes the branch in a worktree (or, with --branch, in this checkout), the\nstart commit, the push, the draft PR and the assignment, after confirming, and opens\nClaude: in auto mode if the repo has claude-repo-guard, with your settings with\n--ask-permissions, with no sandbox nor questions with --free, and also without the repo's\ndeny rules with --free --no-repo-deny. --plan prints the branch and the prompt as JSON and\nchanges nothing. issue start --help explains each flag.\n\n--cloud confirms here and opens a Claude cloud session that starts the issue there.\n--here, inside a cloud session, starts it in this checkout and opens nothing. --teleport\nbrings the cloud session noted in the PR to the worktree. --adopt starts it in the\nworktree another tool (Orca, Paseo) just made, without asking nor opening Claude.\n\nworktree runs the steps of \"worktrees\" in .agents/flow.json: setup prepares this worktree,\nteardown cleans it before it goes (steps, ports, Docker), ports prints or moves its block\nof ports, cleanup deletes the Docker of deleted worktrees, and prune deletes the worktrees\nwhose PR was merged or closed. session is the SessionStart hook of Claude Code.\n\npr worktree makes (or reuses) a worktree on a PR's own branch, to review and fix it; with\n--, it runs the command there (Claude if none). adapter is what Orca and Paseo run: setup\nwhen they make a worktree (its steps and, if it came from an issue, issue start --adopt),\nissue to start one by hand, and archive before they delete it. hook implements Claude\nCode's WorktreeCreate and WorktreeRemove for claude --worktree.\n\napply leaves the repo as this version needs it: .agents/flow.json (the first time, with\nthe recipes its files suggest), issue-flow at this version and github-rest and the scripts\nif missing in package.json, and the hooks; it changes no other version, and refuses a newer\nissue-flow or a range. doctor checks them. npx agent-kitchen apply runs apply at the version\nit picks, along with the skills, claude-cloud and claude-repo-guard. init and upgrade still\nrun apply, with a warning, until 0.4.0.\n\nlabels sync makes in GitHub the labels the flow wants (\"labels\" in .agents/flow.json: the\nissue types and P1 to P4 by default) that the repo lacks. Names ignore case and are never\nrenamed nor deleted; --update also fixes the color and description of those that differ.";
+/** Usage text of `issue start`, printed with `issue start --help`. */
+export declare const START_USAGE = "Usage: issue-flow issue start <n> [flags]\n\nStarts issue <n>: the branch (in a worktree, or in this checkout with --branch), the empty\nstart commit, the push, the draft PR and the assignment, after confirming; then it opens\nClaude there.\n\nFlags:\n  --dry-run            show what it would do and change nothing\n  -y, --yes            do it without asking\n  --branch             in this checkout instead of a worktree\n  --resume <branch>    take that branch of the issue\n  --new                make another branch, even if the issue has one\n  --no-launch          leave everything ready and do not open Claude\n  --namer claude|title who names the branch when the issue has no slug block\n  -R owner/repo        another repo than the checkout's\n  --plan               print the branch and the prompt as JSON, and change nothing\n  --cloud              open a Claude cloud session that starts the issue there\n  --here               inside a cloud session, start it in this checkout\n  --teleport           bring the cloud session noted in the PR to the worktree\n  --adopt              start it in the worktree Orca or Paseo just made\n  -h, --help           this help\n\nPermissions of the Claude it opens (one at most):\n  (none)               auto mode if the repo has claude-repo-guard, else your settings\n  --ask-permissions    your settings: Claude asks before what they do not allow\n  --free               no sandbox and no questions, as claude:free\n  --no-repo-deny       with --free: also without the deny rules of the repo's settings\n\nWhat each one takes away, and what stays:\n  (none), --ask-permissions\n                       take nothing away: the sandbox, the questions your settings ask\n                       and every deny rule stay.\n  --free               takes away the sandbox and the questions. Every deny rule stays:\n                       yours (~/.claude), the repo's (.claude/settings.json) and the\n                       local ones (.claude/settings.local.json).\n  --free --no-repo-deny\n                       also takes the deny rules out of the worktree's\n                       .claude/settings.json while Claude runs, and puts them back when it\n                       exits; git does not see the change meanwhile. Your deny rules and the\n                       local ones stay, and so do the repo's hooks, attribution, CLAUDE.md,\n                       skills, agents and MCP servers. If Claude changes that file, the\n                       rules go back on top of its change, with a warning to review it. If\n                       the terminal closes first, the next issue start of the issue puts\n                       them back.\n\nFrom the repo's scripts (issue:start, and issue:start:free, which adds --free):\n  npm run issue:start:free 42           npm passes a number on as it is\n  npm run issue:start -- 42 --free      but keeps the flags for itself, unless after --\n  pnpm issue:start 42 --free            pnpm, bun and yarn pass everything on\n  bun run issue:start 42 --free\n  yarn issue:start 42 --free\nA -- does no harm with any of them: issue-flow drops it.\n\nissue:start:free does not go with --ask-permissions, --cloud, --here nor --adopt: use\nissue:start for those. --no-repo-deny goes after it, as any flag:\n  npm run issue:start:free -- 42 --no-repo-deny\n  pnpm issue:start:free 42 --no-repo-deny";
+/**
+ * The usage text for a command: its own if it has one, else the whole CLI's.
+ * @param words - The command's words, as given (`["issue", "start", "42"]`).
+ * @returns The text.
+ * @example usageOf(["issue", "start"]) === START_USAGE
+ */
+export declare function usageOf(words: string[]): string;

package/dist/usage.js

@@ -6,7 +6,7 @@ export const USAGE = `Usage:
   issue-flow issue branch <n>... [--namer claude|title] [--json] [-R owner/repo]
   issue-flow issue branch --missing [--limit <n>] [--namer claude|title] [--dry-run | --yes] [--json] [-R owner/repo]
   issue-flow issue start <n> [--branch] [--dry-run | --yes] [--resume <branch> | --new] [--no-launch]
-                             [--ask-permissions | --free] [--namer claude|title] [-R owner/repo]
+                             [--ask-permissions | --free [--no-repo-deny]] [--namer claude|title] [-R owner/repo]
   issue-flow issue start <n> --plan [--ask-permissions | --free] [--namer claude|title] [-R owner/repo]
   issue-flow issue start <n> --cloud | --here | --teleport | --adopt [...]
   issue-flow worktree setup [--only <step>]
@@ -29,8 +29,9 @@ and the branch from the repo's template (an older "Rama sugerida" block is used
 issue start makes the branch in a worktree (or, with --branch, in this checkout), the
 start commit, the push, the draft PR and the assignment, after confirming, and opens
 Claude: in auto mode if the repo has claude-repo-guard, with your settings with
---ask-permissions, and with no sandbox nor questions with --free. --plan prints the branch
-and the prompt as JSON and changes nothing.
+--ask-permissions, with no sandbox nor questions with --free, and also without the repo's
+deny rules with --free --no-repo-deny. --plan prints the branch and the prompt as JSON and
+changes nothing. issue start --help explains each flag.
 
 --cloud confirms here and opens a Claude cloud session that starts the issue there.
 --here, inside a cloud session, starts it in this checkout and opens nothing. --teleport
@@ -58,3 +59,72 @@ run apply, with a warning, until 0.4.0.
 labels sync makes in GitHub the labels the flow wants ("labels" in .agents/flow.json: the
 issue types and P1 to P4 by default) that the repo lacks. Names ignore case and are never
 renamed nor deleted; --update also fixes the color and description of those that differ.`;
+/** Usage text of `issue start`, printed with `issue start --help`. */
+export const START_USAGE = `Usage: issue-flow issue start <n> [flags]
+
+Starts issue <n>: the branch (in a worktree, or in this checkout with --branch), the empty
+start commit, the push, the draft PR and the assignment, after confirming; then it opens
+Claude there.
+
+Flags:
+  --dry-run            show what it would do and change nothing
+  -y, --yes            do it without asking
+  --branch             in this checkout instead of a worktree
+  --resume <branch>    take that branch of the issue
+  --new                make another branch, even if the issue has one
+  --no-launch          leave everything ready and do not open Claude
+  --namer claude|title who names the branch when the issue has no slug block
+  -R owner/repo        another repo than the checkout's
+  --plan               print the branch and the prompt as JSON, and change nothing
+  --cloud              open a Claude cloud session that starts the issue there
+  --here               inside a cloud session, start it in this checkout
+  --teleport           bring the cloud session noted in the PR to the worktree
+  --adopt              start it in the worktree Orca or Paseo just made
+  -h, --help           this help
+
+Permissions of the Claude it opens (one at most):
+  (none)               auto mode if the repo has claude-repo-guard, else your settings
+  --ask-permissions    your settings: Claude asks before what they do not allow
+  --free               no sandbox and no questions, as claude:free
+  --no-repo-deny       with --free: also without the deny rules of the repo's settings
+
+What each one takes away, and what stays:
+  (none), --ask-permissions
+                       take nothing away: the sandbox, the questions your settings ask
+                       and every deny rule stay.
+  --free               takes away the sandbox and the questions. Every deny rule stays:
+                       yours (~/.claude), the repo's (.claude/settings.json) and the
+                       local ones (.claude/settings.local.json).
+  --free --no-repo-deny
+                       also takes the deny rules out of the worktree's
+                       .claude/settings.json while Claude runs, and puts them back when it
+                       exits; git does not see the change meanwhile. Your deny rules and the
+                       local ones stay, and so do the repo's hooks, attribution, CLAUDE.md,
+                       skills, agents and MCP servers. If Claude changes that file, the
+                       rules go back on top of its change, with a warning to review it. If
+                       the terminal closes first, the next issue start of the issue puts
+                       them back.
+
+From the repo's scripts (issue:start, and issue:start:free, which adds --free):
+  npm run issue:start:free 42           npm passes a number on as it is
+  npm run issue:start -- 42 --free      but keeps the flags for itself, unless after --
+  pnpm issue:start 42 --free            pnpm, bun and yarn pass everything on
+  bun run issue:start 42 --free
+  yarn issue:start 42 --free
+A -- does no harm with any of them: issue-flow drops it.
+
+issue:start:free does not go with --ask-permissions, --cloud, --here nor --adopt: use
+issue:start for those. --no-repo-deny goes after it, as any flag:
+  npm run issue:start:free -- 42 --no-repo-deny
+  pnpm issue:start:free 42 --no-repo-deny`;
+/** The usage text of each command that has its own, by its words. */
+const OWN_USAGE = { "issue start": START_USAGE };
+/**
+ * The usage text for a command: its own if it has one, else the whole CLI's.
+ * @param words - The command's words, as given (`["issue", "start", "42"]`).
+ * @returns The text.
+ * @example usageOf(["issue", "start"]) === START_USAGE
+ */
+export function usageOf(words) {
+    return OWN_USAGE[words.slice(0, 2).join(" ")] ?? USAGE;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ramon-sg/issue-flow",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Issue-to-PR workflow for any repo: names each issue's branch, creates its worktree, opens the draft PR and launches Claude Code, locally and in Claude's cloud.",
   "license": "MIT",
   "type": "module",