@scalequality/cli 0.4.9-rc.3 → 0.4.9

package/dist/connect.cjs

@@ -685,684 +685,1570 @@ function credentialAlias(raw) {
   };
 }
 
-// src/application/services/workspaceSandbox/SessionTransport.ts
-var SessionGoneError = class extends Error {
-  constructor(status) {
-    super(`session unavailable (${status})`);
-    this.status = status;
-    this.name = "SessionGoneError";
+// src/application/services/workspaceSandbox/toolPolicy.ts
+var import_fs3 = require("fs");
+var import_promises4 = require("fs/promises");
+var import_path3 = require("path");
+
+// src/application/services/workspaceSandbox/workspaceGit.ts
+var import_child_process = require("child_process");
+var import_util = require("util");
+var import_crypto = require("crypto");
+var import_promises2 = require("fs/promises");
+var import_fs2 = require("fs");
+var import_os = require("os");
+var import_path2 = require("path");
+
+// src/application/services/workspaceSandbox/checkpointMap.ts
+var CHECKPOINT_MAP_VERSION = 2;
+var LOCAL_FOLDER_KEY = ".";
+function parseCheckpoints(raw, legacyRepo) {
+  const out2 = /* @__PURE__ */ new Map();
+  if (!raw) return out2;
+  const trimmed = raw.trimStart();
+  if (trimmed.startsWith("{")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (parsed && parsed.version === CHECKPOINT_MAP_VERSION && parsed.repos && typeof parsed.repos === "object" && !Array.isArray(parsed.repos)) {
+        for (const [repo2, patch] of Object.entries(parsed.repos)) {
+          if (repo2 && typeof patch === "string" && patch) out2.set(repo2, patch);
+        }
+      }
+    } catch {
+    }
+    return out2;
   }
-  status;
-};
-var TransportError = class extends Error {
-  constructor(message, status, retryable) {
-    super(message);
-    this.status = status;
-    this.retryable = retryable;
-    this.name = "TransportError";
+  out2.set(legacyRepo ?? LOCAL_FOLDER_KEY, raw);
+  return out2;
+}
+function serializeCheckpoints(map) {
+  const repos = {};
+  for (const key of [...map.keys()].sort()) {
+    const patch = map.get(key);
+    if (patch) repos[key] = patch;
   }
-  status;
-  retryable;
-  /** The API's error code (e.g. REPOSITORY_NOT_IN_SCOPE), when it sent one. */
-  code;
-};
+  return Object.keys(repos).length ? JSON.stringify({ version: CHECKPOINT_MAP_VERSION, repos }) : "";
+}
 
-// src/application/services/workspaceSandbox/HttpSessionTransport.ts
-var GONE = [401, 403, 404, 410];
-var HttpSessionTransport = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.fetchImpl = opts.fetchImpl ?? fetch;
-    this.gone = new Set(opts.goneStatuses ?? GONE);
-    const base = opts.baseUrl.replace(/\/+$/, "");
-    this.root = `${base}/api/ai-governance/internal/workspace-sessions/${encodeURIComponent(opts.sessionId)}`;
+// src/application/services/workspaceSandbox/workspaceGit.ts
+var run = (0, import_util.promisify)(import_child_process.execFile);
+var CHECKPOINT_BASE_HEADER = "ScaleQuality-Base:";
+var DIFF_CAPS = { perFileBytes: 200 * 1024, totalBytes: 2 * 1024 * 1024, maxFiles: 500 };
+async function git(args, opts) {
+  const { stdout } = await run("git", args, {
+    cwd: opts.cwd,
+    timeout: opts.timeoutMs ?? 6e4,
+    maxBuffer: opts.maxBuffer ?? 64 * 1024 * 1024,
+    env: gitEnv(opts.env),
+    windowsHide: true
+  });
+  return stdout;
+}
+async function gitBuffer(args, opts) {
+  const { stdout } = await run("git", args, {
+    cwd: opts.cwd,
+    timeout: opts.timeoutMs ?? 6e4,
+    maxBuffer: opts.maxBuffer ?? 64 * 1024 * 1024,
+    env: gitEnv(opts.env),
+    windowsHide: true,
+    encoding: "buffer"
+  });
+  return stdout;
+}
+function gitEnv(extra) {
+  const env = {};
+  for (const k of ["PATH", "HOME", "LANG", "LC_ALL", "TMPDIR", "GIT_CONFIG_GLOBAL"]) if (process.env[k] != null) env[k] = process.env[k];
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_CONFIG_NOSYSTEM = "1";
+  return { ...env, ...extra ?? {} };
+}
+function scopeSpec(scope) {
+  return scope?.prefix ? ["--", scope.prefix] : [];
+}
+async function repoIndexFile(root) {
+  const dotGit = (0, import_path2.join)(root, ".git");
+  const st = await (0, import_promises2.stat)(dotGit).catch(() => null);
+  if (!st || st.isDirectory()) return (0, import_path2.join)(dotGit, "index");
+  const out2 = await git(["rev-parse", "--git-path", "index"], { cwd: root }).catch(() => "");
+  return out2.trim() ? (0, import_path2.resolve)(root, out2.trim()) : (0, import_path2.join)(dotGit, "index");
+}
+async function withWorktreeIndex(root, fn, scope) {
+  const tag = `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const idx = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-ws-index-${tag}`);
+  const real = scope?.index !== void 0 ? scope.index : await repoIndexFile(root);
+  if (real && (0, import_fs2.existsSync)(real)) {
+    await (0, import_promises2.copyFile)(real, idx);
+    const st = await (0, import_promises2.stat)(real).catch(() => null);
+    if (st) await (0, import_promises2.utimes)(idx, st.atime, st.mtime).catch(() => void 0);
   }
-  opts;
-  fetchImpl;
-  root;
-  gone;
-  async bootstrap() {
-    const raw = await this.get(`/bootstrap?features=${ENGINE_FEATURES.join(",")}`, this.opts.requestTimeoutMs ?? 3e4);
-    return toSessionBootstrap(raw);
+  const env = { ...scope?.env ?? {}, GIT_INDEX_FILE: idx, ...scope?.prefix || scope?.paths ? { GIT_LITERAL_PATHSPECS: "1" } : {} };
+  const list = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-ws-paths-${tag}`);
+  try {
+    if (scope?.paths) {
+      if (scope.paths.length) {
+        await (0, import_promises2.writeFile)(list, scope.paths.join("\0"), "utf8");
+        await git(["add", "-A", "-f", `--pathspec-from-file=${list}`, "--pathspec-file-nul"], { cwd: root, env, timeoutMs: 5 * 6e4 });
+      }
+    } else {
+      await git(["add", "-A", ...scopeSpec(scope)], { cwd: root, env, timeoutMs: 5 * 6e4 });
+    }
+    return await fn(env);
+  } finally {
+    await (0, import_promises2.rm)(idx, { force: true }).catch(() => void 0);
+    await (0, import_promises2.rm)(list, { force: true }).catch(() => void 0);
   }
-  async pollCommands(waitSeconds, signal) {
-    const wait = Math.max(0, Math.min(25, Math.floor(waitSeconds)));
-    const body = await this.get(`/commands?wait=${wait}`, (wait + 15) * 1e3, signal);
-    return Array.isArray(body?.commands) ? body.commands : [];
+}
+async function listChanges(root, base, scope) {
+  return withWorktreeIndex(root, (env) => listChangesWithEnv(root, base, env, scope), scope);
+}
+async function listChangesWithEnv(root, base, env, scope) {
+  const nameStatus = await git(["diff", "--cached", "--no-renames", "--name-status", "-z", base, ...scopeSpec(scope)], { cwd: root, env });
+  const numstat = await git(["diff", "--cached", "--no-renames", "--numstat", "-z", base, ...scopeSpec(scope)], { cwd: root, env });
+  const counts = /* @__PURE__ */ new Map();
+  for (const rec of numstat.split("\0")) {
+    if (!rec) continue;
+    const m = /^(-|\d+)\t(-|\d+)\t([\s\S]*)$/.exec(rec);
+    if (!m) continue;
+    counts.set(m[3], { a: m[1] === "-" ? 0 : Number(m[1]), d: m[2] === "-" ? 0 : Number(m[2]), bin: m[1] === "-" });
+  }
+  const parts = nameStatus.split("\0");
+  const out2 = [];
+  for (let i = 0; i + 1 < parts.length; i += 2) {
+    const code = parts[i];
+    const path = parts[i + 1];
+    if (!code || !path) continue;
+    const status = code.startsWith("A") ? "added" : code.startsWith("D") ? "deleted" : "modified";
+    const c = counts.get(path) ?? { a: 0, d: 0, bin: false };
+    out2.push({ path, status, additions: c.a, deletions: c.d, binary: c.bin });
+  }
+  return out2;
+}
+async function computeDiff(root, base, caps = DIFF_CAPS, scope) {
+  return withWorktreeIndex(root, async (env) => {
+    const changes = await listChangesWithEnv(root, base, env, scope);
+    const files = [];
+    let total = 0;
+    for (const [i, c] of changes.entries()) {
+      const entry = { path: c.path, status: c.status, additions: c.additions, deletions: c.deletions, patch: "" };
+      if (c.binary) {
+        entry.binary = true;
+      } else if (i >= caps.maxFiles || total >= caps.totalBytes) {
+        entry.truncated = true;
+      } else {
+        let patch = await git(["diff", "--cached", "--no-renames", base, "--", c.path], { cwd: root, env }).catch(() => "");
+        const room = Math.min(caps.perFileBytes, caps.totalBytes - total);
+        if (Buffer.byteLength(patch, "utf8") > room) {
+          patch = truncateUtf8(patch, room);
+          entry.truncated = true;
+        }
+        total += Buffer.byteLength(patch, "utf8");
+        entry.patch = patch;
+        if (!entry.truncated) {
+          const hunks = parseHunks(c.path, patch).map(({ lines: _l, ...h }) => h);
+          if (hunks.length) entry.hunks = hunks;
+        }
+      }
+      files.push(entry);
+    }
+    return files;
+  }, scope);
+}
+async function worktreeTreeId(root, scope) {
+  return withWorktreeIndex(root, async (env) => (await git(["write-tree"], { cwd: root, env })).trim(), scope);
+}
+async function checkpointPatch(root, base, scope) {
+  return withWorktreeIndex(root, async (env) => {
+    const patch = await git(["diff", "--cached", "--no-renames", "--binary", base, ...scopeSpec(scope)], { cwd: root, env, maxBuffer: 512 * 1024 * 1024 });
+    return patch ? `${CHECKPOINT_BASE_HEADER} ${base}
+${patch}` : "";
+  }, scope);
+}
+var PR_FILE_MAX_BYTES = 2 * 1024 * 1024;
+async function prText(abs) {
+  const st = await (0, import_promises2.stat)(abs).catch(() => null);
+  if (!st || !st.isFile()) return { reason: "missing" };
+  if (st.size > PR_FILE_MAX_BYTES) return { reason: "too_large" };
+  const buf = await (0, import_promises2.readFile)(abs);
+  if (buf.includes(0)) return { reason: "binary" };
+  const content = buf.toString("utf8");
+  if (Buffer.byteLength(content, "utf8") !== buf.length || content.includes("\uFFFD")) return { reason: "not_utf8" };
+  return { content };
+}
+async function filesForPullRequest(root, base, published = [], scope) {
+  const changes = await listChanges(root, base, scope);
+  const out2 = { files: [], skipped: [] };
+  for (const c of changes) {
+    if (c.status === "deleted") {
+      out2.files.push({ path: c.path, content: "", deleted: true });
+      continue;
+    }
+    if (c.binary) {
+      out2.skipped.push({ path: c.path, reason: "binary" });
+      continue;
+    }
+    const r = await prText((0, import_path2.join)(root, c.path));
+    if ("content" in r) out2.files.push({ path: c.path, content: r.content });
+    else if (r.reason === "missing") out2.files.push({ path: c.path, content: "", deleted: true });
+    else out2.skipped.push({ path: c.path, reason: r.reason });
+  }
+  const changed = new Set(changes.map((c) => c.path));
+  for (const path of published) {
+    if (changed.has(path) || !path || path.startsWith("/") || path.split("/").includes("..")) continue;
+    if (scope?.prefix && !path.startsWith(`${scope.prefix}/`)) continue;
+    const buf = await gitBuffer(["show", `${base}:${path}`], { cwd: root, maxBuffer: 8 * 1024 * 1024, env: scope?.env }).catch(() => null);
+    if (buf === null) {
+      out2.files.push({ path, content: "", deleted: true });
+      continue;
+    }
+    const content = buf.toString("utf8");
+    if (buf.includes(0) || Buffer.byteLength(content, "utf8") !== buf.length) {
+      out2.skipped.push({ path, reason: "binary" });
+      continue;
+    }
+    out2.files.push({ path, content });
+  }
+  return out2;
+}
+async function resolveInside(root, p) {
+  if (!p || p.includes("\0")) return null;
+  const abs = (0, import_path2.resolve)(root, p);
+  const realRoot = await (0, import_promises2.realpath)(root).catch(() => (0, import_path2.resolve)(root));
+  let probe = abs;
+  while (!(0, import_fs2.existsSync)(probe) && (0, import_path2.dirname)(probe) !== probe) probe = (0, import_path2.dirname)(probe);
+  const realProbe = await (0, import_promises2.realpath)(probe).catch(() => probe);
+  const rest = (0, import_path2.relative)(probe, abs);
+  const finalPath = rest ? (0, import_path2.join)(realProbe, rest) : realProbe;
+  if (finalPath !== realRoot && !finalPath.startsWith(realRoot + import_path2.sep)) return null;
+  return finalPath;
+}
+async function discardPath(root, base, relPath) {
+  if ((0, import_path2.isAbsolute)(relPath)) relPath = (0, import_path2.relative)(root, relPath);
+  const abs = await resolveInside(root, relPath);
+  if (!abs) throw new Error("PATH_OUTSIDE_WORKSPACE");
+  const rel = (0, import_path2.relative)(await (0, import_promises2.realpath)(root).catch(() => root), abs).split(import_path2.sep).join("/");
+  if (rel === "" || rel === ".git" || rel.startsWith(".git/")) throw new Error("PATH_NOT_DISCARDABLE");
+  const existed = await git(["cat-file", "-e", `${base}:${rel}`], { cwd: root }).then(() => true, () => false);
+  if (existed) {
+    await git(["checkout", base, "--", rel], { cwd: root });
+    await git(["reset", "-q", "--", rel], { cwd: root }).catch(() => void 0);
+    return "restored";
   }
-  async postEvents(events) {
-    if (events.length === 0) return;
-    await this.post("/events", { events }, this.opts.requestTimeoutMs ?? 3e4);
+  await (0, import_promises2.rm)(abs, { recursive: true, force: true });
+  await git(["rm", "-q", "--cached", "--ignore-unmatch", "--", rel], { cwd: root }).catch(() => void 0);
+  return "removed";
+}
+function truncateUtf8(s, maxBytes) {
+  if (maxBytes <= 0) return "";
+  const buf = Buffer.from(s, "utf8");
+  if (buf.length <= maxBytes) return s;
+  let end = maxBytes;
+  while (end > 0 && (buf[end] & 192) === 128) end--;
+  return buf.subarray(0, end).toString("utf8");
+}
+function tailUtf8(s, maxBytes) {
+  const buf = Buffer.from(s, "utf8");
+  if (buf.length <= maxBytes) return s;
+  let start = buf.length - maxBytes;
+  while (start < buf.length && (buf[start] & 192) === 128) start++;
+  return buf.subarray(start).toString("utf8");
+}
+function parseHunks(path, patch) {
+  const out2 = [];
+  let current = null;
+  for (const line of patch.split("\n")) {
+    const m = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (m) {
+      current = {
+        hash: "",
+        header: line,
+        lines: [],
+        oldStart: Number(m[1]),
+        oldLines: m[2] === void 0 ? 1 : Number(m[2]),
+        newStart: Number(m[3]),
+        newLines: m[4] === void 0 ? 1 : Number(m[4])
+      };
+      out2.push(current);
+      continue;
+    }
+    if (!current) continue;
+    if (line.startsWith(" ") || line.startsWith("+") || line.startsWith("-") || line.startsWith("\\")) current.lines.push(line);
   }
-  callTool(name, args, approvalId) {
-    if (!/^[a-z][a-z0-9_]{0,63}$/.test(name)) throw new TransportError("invalid tool name", null, false);
-    return this.post(`/tools/${name}`, approvalId ? { args, approvalId } : { args }, this.opts.toolTimeoutMs ?? 12e4);
+  const seen = /* @__PURE__ */ new Map();
+  for (const h of out2) {
+    const base = (0, import_crypto.createHash)("sha256").update(`${path}
+${h.lines.join("\n")}`).digest("hex").slice(0, 16);
+    const n = (seen.get(base) ?? 0) + 1;
+    seen.set(base, n);
+    h.hash = n === 1 ? base : `${base}-${n}`;
   }
-  async mcpTools() {
-    const raw = await this.get("/mcp/tools", this.opts.requestTimeoutMs ?? 6e4);
-    return orgMcpCatalogOf(raw);
+  return out2;
+}
+async function discardHunk(root, base, relPath, hash, scope) {
+  const abs = await resolveInside(root, relPath);
+  if (!abs) throw new Error("PATH_OUTSIDE_WORKSPACE");
+  const rel = (0, import_path2.relative)(await (0, import_promises2.realpath)(root).catch(() => root), abs).split(import_path2.sep).join("/");
+  if (rel === "" || rel === ".git" || rel.startsWith(".git/")) throw new Error("PATH_NOT_DISCARDABLE");
+  return withWorktreeIndex(root, async (env) => {
+    const patch = await git(["diff", "--cached", "--no-renames", "--no-color", base, "--", rel], { cwd: root, env });
+    if (!patch) return "not_found";
+    const hunk = parseHunks(rel, patch).find((h) => h.hash === hash);
+    if (!hunk) return "not_found";
+    const headerEnd = patch.indexOf("\n@@");
+    const fileHeader = patch.slice(0, headerEnd + 1);
+    const one = `${fileHeader}${hunk.header}
+${hunk.lines.join("\n")}
+`;
+    const file = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-hunk-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}.patch`);
+    await (0, import_promises2.writeFile)(file, one, "utf8");
+    try {
+      await git(["apply", "-R", "--whitespace=nowarn", file], { cwd: root, env: scope?.env });
+    } finally {
+      await (0, import_promises2.rm)(file, { force: true }).catch(() => void 0);
+    }
+    return "discarded";
+  }, scope);
+}
+async function restoreTree(root, treeId, scope) {
+  if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(treeId)) throw new Error("INVALID_TREE");
+  await withWorktreeIndex(root, async (env) => {
+    const now = (await git(["write-tree"], { cwd: root, env })).trim();
+    const added = await git(["diff", "--no-renames", "--name-only", "-z", "--diff-filter=A", treeId, now, ...scopeSpec(scope)], { cwd: root, env });
+    for (const rel of added.split("\0").filter(Boolean)) {
+      const abs = await resolveInside(root, rel);
+      if (abs) await (0, import_promises2.rm)(abs, { force: true });
+    }
+    if (scope?.prefix) {
+      await git(["checkout", treeId, "--", scope.prefix], { cwd: root, env }).catch(() => void 0);
+      return;
+    }
+    await git(["read-tree", treeId], { cwd: root, env });
+    await git(["checkout-index", "-a", "-f"], { cwd: root, env });
+  }, scope);
+}
+
+// src/application/services/workspaceSandbox/webFetchGuard.ts
+var import_promises3 = require("dns/promises");
+var import_net = require("net");
+var defaultLookup = (host) => (0, import_promises3.lookup)(host, { all: true, verbatim: true });
+var ALLOWED_PORTS = /* @__PURE__ */ new Set(["", "80", "443", "8080", "8443"]);
+function v4Private(ip) {
+  const [a, b] = ip.split(".").map(Number);
+  return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 || a === 198 && (b === 18 || b === 19);
+}
+function v6Private(ip) {
+  const s = ip.toLowerCase().replace(/^\[|\]$/g, "");
+  if (s === "::" || s === "::1") return true;
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(s);
+  if (mapped) return v4Private(mapped[1]);
+  const head = parseInt(s.split(":")[0] || "0", 16);
+  return (head & 65024) === 64512 || (head & 65472) === 65152 || (head & 65280) === 65280 || s.startsWith("fd00:ec2::");
+}
+function privateAddress(ip) {
+  const kind = (0, import_net.isIP)(ip.replace(/^\[|\]$/g, ""));
+  if (kind === 4) return v4Private(ip);
+  if (kind === 6) return v6Private(ip);
+  return true;
+}
+async function webFetchDenial(raw, resolve8 = defaultLookup) {
+  if (typeof raw !== "string" || !raw.trim()) return "WebFetch needs a URL.";
+  let url;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    return "WebFetch needs a valid http or https URL.";
   }
-  mcpCall(req) {
-    return this.post("/mcp/call", req, this.opts.toolTimeoutMs ?? 18e4);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return "WebFetch reads only http and https pages.";
+  if (url.username || url.password) return "URLs with credentials cannot be fetched from the workspace.";
+  if (!ALLOWED_PORTS.has(url.port)) return "WebFetch reads public pages on the standard web ports only.";
+  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (!host || host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal") || host.endsWith(".local")) {
+    return "Addresses of this machine or its private network cannot be fetched from the workspace.";
   }
-  openPullRequest(req) {
-    return this.post("/pull-request", req, this.opts.toolTimeoutMs ?? 18e4);
+  if ((0, import_net.isIP)(host)) return privateAddress(host) ? "Addresses of this machine or its private network cannot be fetched from the workspace." : null;
+  let addresses;
+  try {
+    addresses = await resolve8(host);
+  } catch {
+    return `The host ${host} could not be resolved.`;
   }
-  async checkpoint(req) {
-    await this.post("/checkpoint", req, this.opts.requestTimeoutMs ?? 6e4);
+  if (!addresses.length || addresses.some((a) => privateAddress(a.address))) {
+    return "Addresses of this machine or its private network cannot be fetched from the workspace.";
   }
-  async openRepository(repoFullName) {
-    const raw = await this.post("/repositories/open", { repoFullName }, this.opts.requestTimeoutMs ?? 3e4);
-    const text3 = (v, fallback = "") => typeof v === "string" ? v : fallback;
-    const defaultBranch = text3(raw?.defaultBranch, "main");
-    return {
-      cloneUrl: text3(raw?.cloneUrl),
-      scheme: text3(raw?.scheme),
-      token: text3(raw?.token),
-      provider: text3(raw?.provider),
-      repoFullName: text3(raw?.repoFullName, repoFullName),
-      defaultBranch,
-      branch: typeof raw?.branch === "string" ? raw.branch : defaultBranch
-    };
+  return null;
+}
+
+// src/application/services/workspaceSandbox/toolPolicy.ts
+var SQ_MCP_SERVER = "scalequality";
+var SQ_MCP_PREFIX = `mcp__${SQ_MCP_SERVER}__`;
+var DENIED_TOOLS = ["WebSearch", "RemoteTrigger", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "PushNotification", "EnterWorktree", "ExitWorktree", "Artifact", "Workflow", "SendFeedback", "ClaudeDesign", "Projects"];
+var READ_TOOLS = { Read: "file_path", Glob: "path", Grep: "path", LS: "path" };
+var WRITE_TOOLS = { Write: "file_path", Edit: "file_path", MultiEdit: "file_path", NotebookEdit: "notebook_path" };
+var WRITE_TOOL_PATHS = WRITE_TOOLS;
+var HARMLESS = /* @__PURE__ */ new Set(["TodoWrite", "BashOutput", "KillShell", "TaskStop", "TaskOutput", "Skill"]);
+var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
+var SQ_READ_ONLY = /* @__PURE__ */ new Set([
+  "get_project_measurement",
+  "get_measurement_findings",
+  "get_agent_options",
+  "get_agent_quote",
+  "get_pr_followup_status",
+  "get_agent_request",
+  "get_measurement_request",
+  "get_measurement_setup",
+  "explain_change_request",
+  "read_scalequality_guide",
+  "list_repositories",
+  "open_repository",
+  "measure_change"
+]);
+var BASH_MAX_TIMEOUT_MS = 10 * 60 * 1e3;
+var CLOUD_BASH_DENY = [
+  { re: /\bgit\b[^\n;&|]*\s(push|send-pack|send-email|request-pull)\b/, why: "Publishing from the workspace is not allowed. Use the open_pull_request tool; it asks the user for approval." },
+  { re: /\bgit\b[^\n;&|]*\sremote\b/, why: "Git remotes are managed by ScaleQuality and cannot be read or changed from the workspace." }
+];
+var BASH_DENY = [
+  { re: /\bgit\b[^\n;&|]*\scredential\b/, why: "Git credentials are not available in the workspace." },
+  { re: /\bgit\b[^\n;&|]*\sconfig\b[^\n;&|]*(credential|insteadof|pushinsteadof|extraheader|\bremote\.|\burl\.)/, why: "Git credential and remote settings cannot be changed from the workspace." },
+  { re: /credential[._-]?helper/, why: "Git credential helpers cannot be configured in the workspace." },
+  { re: /\/proc\/[^\s'"]*\/(environ|mem)\b/, why: "Process environments are not readable from the workspace." },
+  { re: /\b(INTERNAL_API_SECRET|WORKSPACE_SESSION_SECRET|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL)\b/, why: "Workspace credentials are not available to commands." },
+  { re: /(^|[;&|(`]|\$\()\s*(env|printenv|export\s+-p|declare\s+-x|set)\s*($|[;&|)>`])/, why: "Dumping the whole environment is not allowed; read the specific variable your task needs." }
+];
+var HOME_PREFIX = String.raw`(~|\$\{?home\}?|\$\{?userprofile\}?|/users/[^/\s]+|/home/[^/\s]+|/root)/`;
+var LOCAL_BASH_DENY = [
+  { re: /(^|[\s=:/~])\.(ssh|aws|gnupg)(\/|\s|$)/i, why: "Credential directories on this machine are not readable from the workspace." },
+  { re: /(^|[\s=:/~])\.(netrc|git-credentials|pgpass)\b/i, why: "Credential files on this machine are not readable from the workspace." },
+  // Projects have their own .npmrc or .docker folder; only the ones in the home directory hold credentials.
+  { re: new RegExp(`${HOME_PREFIX}\\.(npmrc|yarnrc\\.yml|pypirc|docker|kube|azure|config/(gh|hub|gcloud|op))\\b`, "i"), why: "Credential files on this machine are not readable from the workspace." },
+  { re: /(^|[;&|(`]|\$\()\s*(security\s+(find|dump|export)-|gh\s+auth\s+(token|status\s+-t\b|status\s+--show-token)|op\s+(read|item\s+get)|pass\s+show|secret-tool\s+lookup|aws\s+configure\s+(get|export-credentials)|gcloud\s+auth\s+print-)/i, why: "Credential stores on this machine are not readable from the workspace." }
+];
+function normalizeCommand(command) {
+  return command.replace(/\\\n/g, " ").replace(/['"\\]/g, "").replace(/[ \t]+/g, " ").toLowerCase();
+}
+function bashDenial(command, opts = {}) {
+  const n = normalizeCommand(command);
+  for (const { re, why } of BASH_DENY) if (re.test(n) || re.test(command)) return why;
+  if (!opts.local) {
+    for (const { re, why } of CLOUD_BASH_DENY) if (re.test(n) || re.test(command)) return why;
   }
-  async importedHistory() {
-    const raw = await this.get("/imported", this.opts.requestTimeoutMs ?? 6e4);
-    const messages = Array.isArray(raw?.messages) ? raw.messages : [];
-    return {
-      messages: messages.filter((m) => !!m && typeof m === "object" && (m.role === "user" || m.role === "assistant")).map((m) => ({
-        role: m.role,
-        text: typeof m.text === "string" ? m.text : "",
-        at: typeof m.at === "string" ? m.at : null,
-        ...Array.isArray(m.tools) ? { tools: m.tools.filter((t) => !!t && typeof t.name === "string" && typeof t.summary === "string") } : {}
-      }))
-    };
+  if (opts.local) {
+    for (const { re, why } of LOCAL_BASH_DENY) if (re.test(n) || re.test(command)) return why;
   }
-  async saveTranscript(t) {
-    await this.post("/transcript", t, this.opts.requestTimeoutMs ?? 6e4);
+  return null;
+}
+async function realpathLoose(p) {
+  let probe = (0, import_path3.resolve)(p);
+  while (!(0, import_fs3.existsSync)(probe) && (0, import_path3.dirname)(probe) !== probe) probe = (0, import_path3.dirname)(probe);
+  const real = await (0, import_promises4.realpath)(probe).catch(() => probe);
+  const rest = (0, import_path3.relative)(probe, (0, import_path3.resolve)(p));
+  return rest ? (0, import_path3.join)(real, rest) : real;
+}
+function inside(root, abs) {
+  return abs === root || abs.startsWith(root + import_path3.sep);
+}
+var PLAN_ONLY_READS = "Plan mode is read-only: read and search the code, write the plan to the plan file, then call ExitPlanMode. Changes start after the user approves the plan.";
+var READ_ONLY_PROGRAMS = /* @__PURE__ */ new Set([
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "rg",
+  "ag",
+  "tree",
+  "pwd",
+  "file",
+  "stat",
+  "du",
+  "df",
+  "sort",
+  "uniq",
+  "cut",
+  "tr",
+  "which",
+  "echo",
+  "basename",
+  "dirname",
+  "realpath",
+  "diff",
+  "cloc",
+  "jq",
+  "less",
+  "nl",
+  "column",
+  "date",
+  "uname",
+  "true"
+]);
+var READ_ONLY_GIT = /* @__PURE__ */ new Set(["status", "log", "show", "diff", "blame", "branch", "ls-files", "ls-tree", "grep", "rev-parse", "describe", "shortlog", "tag", "cat-file", "reflog"]);
+function readOnlyCommand(command) {
+  if (/[<>`]|\$\(|\$\{/.test(command)) return false;
+  const segments2 = command.split(/\|\||&&|\||;/).map((s) => s.trim()).filter(Boolean);
+  if (!segments2.length) return false;
+  return segments2.every((seg) => {
+    const words = seg.split(/\s+/);
+    let i = 0;
+    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) i++;
+    const program = words[i] ?? "";
+    const rest = words.slice(i + 1);
+    if (program === "git") {
+      const sub = rest.find((w) => !w.startsWith("-"));
+      if (!sub || !READ_ONLY_GIT.has(sub)) return false;
+      if (sub === "branch" || sub === "tag") return rest.slice(rest.indexOf(sub) + 1).every((w) => /^(-a|-r|-v|-vv|-l|--list|--all|--show-current|--sort=\S+|--contains|--merged|--no-merged)$/.test(w));
+      return !rest.some((w) => /^(--output|--open-files-in-pager|-O|--ext-diff)(=|$)/.test(w) || /^-O\S/.test(w));
+    }
+    if (program === "find") return !rest.some((w) => /^-(delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/.test(w));
+    if (program === "rg") return !rest.some((w) => /^--pre(=|$)/.test(w));
+    if (program === "sort" || program === "tree") return !rest.some((w) => /^(-o|--output)/.test(w));
+    if (program === "uniq") return rest.filter((w) => !w.startsWith("-")).length <= 1;
+    return READ_ONLY_PROGRAMS.has(program);
+  });
+}
+async function decideToolUse(toolName, input, ctx) {
+  if (toolName.startsWith("mcp__") && ctx.orgMcpTools?.all.has(toolName)) {
+    if (ctx.plan && !ctx.orgMcpTools.readOnly.has(toolName)) return { behavior: "deny", message: PLAN_ONLY_READS };
+    return { behavior: "allow", updatedInput: input };
   }
-  async saveBaseMeasurement(r) {
-    await this.post("/measurements/base", r, this.opts.requestTimeoutMs ?? 3e4);
+  if (toolName.startsWith("mcp__")) {
+    if (!toolName.startsWith(SQ_MCP_PREFIX)) return { behavior: "deny", message: "Only ScaleQuality tools and the MCP servers your organization approved are available in this workspace." };
+    if (ctx.plan && !SQ_READ_ONLY.has(toolName.slice(SQ_MCP_PREFIX.length))) return { behavior: "deny", message: PLAN_ONLY_READS };
+    return { behavior: "allow", updatedInput: input };
   }
-  async reply(commandId, reply) {
-    if (!/^[A-Za-z0-9-]{1,80}$/.test(commandId)) throw new TransportError("invalid command id", null, false);
-    await this.post(`/replies/${commandId}`, reply, this.opts.requestTimeoutMs ?? 3e4);
+  if (HARMLESS.has(toolName)) return { behavior: "allow", updatedInput: input };
+  if (SUBAGENT_TOOLS.has(toolName)) {
+    if (typeof input.prompt !== "string" || !input.prompt.trim()) return { behavior: "deny", message: "A subagent needs a task (prompt)." };
+    const updated = { ...input, run_in_background: false };
+    for (const k of ["isolation", "model", "name", "team_name", "mode"]) delete updated[k];
+    return { behavior: "allow", updatedInput: updated };
   }
-  async refreshRuntime() {
-    const raw = await this.post("/runtime", {}, this.opts.requestTimeoutMs ?? 3e4);
-    const boot = toSessionBootstrap({ session: { model: raw?.model, reasoning: raw?.reasoning }, runtime: raw?.runtime, repository: null });
-    return { model: boot.model, runtime: boot.runtime, reasoning: boot.reasoning ?? null };
+  if (toolName === "WebFetch") {
+    const why = await webFetchDenial(input.url, ctx.lookup);
+    return why ? { behavior: "deny", message: why } : { behavior: "allow", updatedInput: input };
   }
-  headers(json) {
-    return {
-      "x-workspace-session-secret": this.opts.secret,
-      accept: "application/json",
-      ...this.opts.userAgent ? { "user-agent": this.opts.userAgent } : {},
-      ...json ? { "content-type": "application/json" } : {}
-    };
+  if (ctx.protections?.secretFiles && (toolName in READ_TOOLS || toolName in WRITE_TOOLS)) {
+    const why = secretFileToolDenial(toolName, input);
+    if (why) return { behavior: "deny", message: why, reason: "PROTECTION_SECRET_FILE" };
   }
-  async get(path, timeoutMs, outer) {
-    const attempts = Math.max(1, this.opts.getAttempts ?? 4);
-    const delay = this.opts.retryDelayMs ?? 1e3;
-    let last;
-    for (let i = 0; i < attempts; i++) {
-      if (outer?.aborted) throw new TransportError("aborted", null, false);
-      try {
-        return await this.request("GET", path, void 0, timeoutMs, outer);
-      } catch (e) {
-        last = e;
-        if (e instanceof SessionGoneError) throw e;
-        if (e instanceof TransportError && !e.retryable) throw e;
-        if (i < attempts - 1) await sleep(delay * 2 ** i, outer);
-      }
+  if (toolName in WRITE_TOOLS && ctx.planDir) {
+    const raw = input[WRITE_TOOLS[toolName]];
+    if (typeof raw === "string" && raw.endsWith(".md")) {
+      const plans = await realpathLoose(ctx.planDir);
+      const abs = await realpathLoose((0, import_path3.resolve)(ctx.planDir, raw));
+      if (inside(plans, abs) && abs !== plans) return { behavior: "allow", updatedInput: input };
     }
-    throw last;
-  }
-  post(path, body, timeoutMs) {
-    return this.request("POST", path, body, timeoutMs);
   }
-  async request(method, path, body, timeoutMs, outer) {
-    const signals = [AbortSignal.timeout(timeoutMs), ...outer ? [outer] : []];
-    const signal = signals.length > 1 ? anySignal(signals) : signals[0];
-    let res;
-    try {
-      res = await this.fetchImpl(this.root + path, {
-        method,
-        headers: this.headers(body !== void 0),
-        body: body !== void 0 ? JSON.stringify(body) : void 0,
-        signal
-      });
-    } catch (e) {
-      throw new TransportError(`${method} ${routeLabel(path)} failed: ${e.name}`, null, true);
+  if (ctx.plan && toolName in WRITE_TOOLS) return { behavior: "deny", message: PLAN_ONLY_READS };
+  if (toolName in READ_TOOLS || toolName in WRITE_TOOLS) {
+    const field = READ_TOOLS[toolName] ?? WRITE_TOOLS[toolName];
+    const raw = input[field];
+    if ((raw === void 0 || raw === null || raw === "") && toolName in READ_TOOLS && toolName !== "Read") {
+      return { behavior: "allow", updatedInput: input };
     }
-    if (this.gone.has(res.status)) {
-      await res.body?.cancel().catch(() => void 0);
-      throw new SessionGoneError(res.status);
+    if (typeof raw !== "string" || raw.length === 0) return { behavior: "deny", message: `${toolName} needs a path inside the repository.` };
+    const abs = await resolveInside(ctx.root, raw);
+    let denied = false;
+    for (const d of ctx.deniedRoots ?? []) {
+      const realDenied = await (0, import_promises4.realpath)(d).catch(() => (0, import_path3.resolve)(d));
+      if (abs && inside(realDenied, abs)) denied = true;
     }
-    if (!res.ok) {
-      const code = await res.text().then((t) => JSON.parse(t)?.code, () => void 0).catch(() => void 0);
-      const retryable = res.status === 429 || res.status >= 500;
-      const error = new TransportError(`${method} ${routeLabel(path)} answered ${res.status}`, res.status, retryable);
-      if (typeof code === "string" && /^[A-Z_]{3,80}$/.test(code)) error.code = code;
-      throw error;
+    if (abs && !denied) {
+      if (toolName in WRITE_TOOLS) {
+        const realRoot = await (0, import_promises4.realpath)(ctx.root).catch(() => (0, import_path3.resolve)(ctx.root));
+        const rel = (0, import_path3.relative)(realRoot, abs).split(import_path3.sep);
+        if (rel.includes(".git")) return { behavior: "deny", message: "Files under .git cannot be written from the workspace." };
+      }
+      return { behavior: "allow", updatedInput: input };
     }
-    if (res.status === 204) return void 0;
-    const text3 = await res.text();
-    if (!text3) return void 0;
-    try {
-      return JSON.parse(text3);
-    } catch {
-      throw new TransportError(`${method} ${routeLabel(path)} returned invalid JSON`, res.status, false);
+    if (toolName in READ_TOOLS) {
+      for (const extra of ctx.extraReadRoots ?? []) {
+        const e = await resolveInside(extra, raw);
+        const realExtra = await (0, import_promises4.realpath)(extra).catch(() => (0, import_path3.resolve)(extra));
+        if (e && inside(realExtra, e)) return { behavior: "allow", updatedInput: input };
+      }
     }
+    return { behavior: "deny", message: `${toolName} is limited to files inside the repository (${ctx.root}).` };
   }
-};
-function anySignal(signals) {
-  const native = AbortSignal.any;
-  if (typeof native === "function") return native.call(AbortSignal, signals);
-  const ac = new AbortController();
-  for (const s of signals) {
-    if (s.aborted) {
-      ac.abort(s.reason);
-      return ac.signal;
-    }
-    s.addEventListener("abort", () => ac.abort(s.reason), { once: true });
+  if (toolName === "Bash") {
+    const command = typeof input.command === "string" ? input.command : "";
+    if (!command.trim()) return { behavior: "deny", message: "Empty command." };
+    const why = bashDenial(command, { local: ctx.local });
+    if (why) return { behavior: "deny", message: why };
+    const secret = ctx.protections?.secretFiles ? secretFileCommandDenial(command) : null;
+    if (secret) return { behavior: "deny", message: secret, reason: "PROTECTION_SECRET_FILE" };
+    if (ctx.plan && !readOnlyCommand(command)) return { behavior: "deny", message: PLAN_ONLY_READS };
+    const updated = { ...input };
+    delete updated.dangerouslyDisableSandbox;
+    const t = typeof input.timeout === "number" && Number.isFinite(input.timeout) ? input.timeout : void 0;
+    if (t !== void 0) updated.timeout = Math.max(1e3, Math.min(BASH_MAX_TIMEOUT_MS, t));
+    return { behavior: "allow", updatedInput: updated };
   }
-  return ac.signal;
-}
-function routeLabel(path) {
-  return path.split("?")[0];
-}
-function sleep(ms, signal) {
-  return new Promise((resolve8) => {
-    const t = setTimeout(resolve8, ms);
-    signal?.addEventListener("abort", () => {
-      clearTimeout(t);
-      resolve8();
-    }, { once: true });
-  });
+  if (toolName === "WebSearch") {
+    return { behavior: "deny", message: "Web search is not available in the ScaleQuality workspace. Fetch a specific page with WebFetch." };
+  }
+  return { behavior: "deny", message: `${toolName} is not available in the ScaleQuality workspace.` };
 }
-var ENGINE_FEATURES = ["message_queue_v1"];
-function toSessionBootstrap(raw) {
-  if (raw && raw.repo && !raw.repository) return raw;
-  const session = raw?.session ?? {};
-  const repository = raw?.repository && typeof raw.repository === "object" ? raw.repository : null;
-  const runtime = raw?.runtime ?? {};
-  const text3 = (v, fallback = "") => typeof v === "string" ? v : fallback;
-  const defaultBranch = text3(repository?.defaultBranch, "main");
-  const repo2 = repository ? {
-    cloneUrl: text3(repository.cloneUrl),
-    scheme: text3(repository.scheme),
-    token: text3(repository.token),
-    provider: text3(repository.provider, text3(session.provider)),
-    repoFullName: text3(repository.repoFullName, text3(session.repoFullName)),
-    defaultBranch
-  } : null;
-  const repositories = scopeRepos(raw?.repositories) ?? scopeRepos(session.scope?.repos) ?? (repo2 ? [{ repoFullName: repo2.repoFullName, provider: repo2.provider, projectId: text3(session.projectId), defaultBranch: repo2.defaultBranch }] : []);
-  const rawScope = session.scope && typeof session.scope === "object" ? session.scope : null;
-  const kind = rawScope?.kind === "ALL" || rawScope?.kind === "TEAM" || rawScope?.kind === "BUSINESS_AREA" ? rawScope.kind : "PROJECTS";
+
+// src/application/services/workspaceSandbox/protections.ts
+var NO_PROTECTIONS = Object.freeze({ secretFiles: false, protectedPush: false, deployApproval: false, destructiveCommands: false, unknownPackage: null });
+var KNOWN_RULES = {
+  "secret-files": ["block"],
+  "protected-push": ["require"],
+  "deploy-approval": ["require"],
+  "destructive-commands": ["require"],
+  "unknown-package": ["block", "warn"]
+};
+function protectionsWireOf(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const r = raw;
+  if (!r.rules || typeof r.rules !== "object" || Array.isArray(r.rules)) return null;
+  const rules = {};
+  for (const [key, value] of Object.entries(r.rules)) {
+    if (typeof value === "string" && KNOWN_RULES[key]?.includes(value)) rules[key] = value;
+  }
+  const version = typeof r.version === "number" && Number.isFinite(r.version) ? r.version : 0;
+  return Object.keys(rules).length ? { version, rules } : null;
+}
+function parseProtections(raw) {
+  const wire = protectionsWireOf(raw);
+  if (!wire) return NO_PROTECTIONS;
+  const r = wire.rules;
   return {
-    repo: repo2,
-    repositories,
-    scope: {
-      kind,
-      teamId: typeof rawScope?.teamId === "string" ? rawScope.teamId : null,
-      projectIds: Array.isArray(rawScope?.projectIds) ? rawScope.projectIds.filter((p) => typeof p === "string") : typeof session.projectId === "string" && session.projectId ? [session.projectId] : [],
-      repos: repositories
-    },
-    branch: text3(session.branch, repo2 ? defaultBranch : ""),
-    projectId: text3(session.projectId),
-    model: text3(session.model, "sq-auto"),
-    runtime: {
-      baseUrl: text3(runtime.baseUrl),
-      token: text3(runtime.token),
-      models: runtime.models,
-      primaryModel: typeof runtime.primaryModel === "string" ? runtime.primaryModel : null,
-      fastModel: typeof runtime.fastModel === "string" ? runtime.fastModel : null,
-      maxOutputTokens: typeof runtime.maxOutputTokens === "number" ? runtime.maxOutputTokens : null,
-      maxOutputTokensCeiling: typeof runtime.maxOutputTokensCeiling === "number" ? runtime.maxOutputTokensCeiling : null,
-      reasoning: parseReasoningCapability(runtime.reasoning),
-      aliases: Array.isArray(runtime.aliases) ? runtime.aliases.filter((a) => typeof a?.alias === "string").map(credentialAlias) : void 0
-    },
-    reasoning: isReasoningLevel(session.reasoning) ? session.reasoning : null,
-    imported: importedInfo(session.imported),
-    checkpointPatch: typeof raw?.checkpointPatch === "string" ? raw.checkpointPatch : null,
-    sdkSessionId: typeof session.sdkSessionId === "string" ? session.sdkSessionId : null,
-    workspaceKind: session.workspaceKind === "LOCAL" ? "LOCAL" : "CLOUD",
-    projectName: typeof session.projectName === "string" ? session.projectName : typeof raw?.project?.name === "string" ? raw.project.name : null,
-    folderLink: typeof session.folderLink?.projectId === "string" && session.folderLink.projectId ? { projectId: session.folderLink.projectId } : null,
-    transcript: transcriptOf(raw?.transcript),
-    baseMeasurements: raw?.baseMeasurements && typeof raw.baseMeasurements === "object" && !Array.isArray(raw.baseMeasurements) ? raw.baseMeasurements : {},
-    pullRequests: pullRequestsOf(raw?.pullRequests),
-    skills: skillsOf(raw?.skills),
-    plugins: pluginsOf(raw?.plugins),
-    environments: environmentsOf(raw?.environments)
+    secretFiles: r["secret-files"] === "block",
+    protectedPush: r["protected-push"] === "require",
+    deployApproval: r["deploy-approval"] === "require",
+    destructiveCommands: r["destructive-commands"] === "require",
+    unknownPackage: r["unknown-package"] === "block" || r["unknown-package"] === "warn" ? r["unknown-package"] : null
   };
 }
-function transcriptOf(raw) {
-  const t = raw;
-  if (!t || typeof t !== "object" || typeof t.sdkSessionId !== "string" || t.encoding !== "gzip-base64" || typeof t.data !== "string") return null;
-  return { sdkSessionId: t.sdkSessionId, encoding: "gzip-base64", data: t.data, bytes: typeof t.bytes === "number" ? t.bytes : 0, sha256: typeof t.sha256 === "string" ? t.sha256 : "" };
+var SECRET_FILE_MESSAGE = "Blocked by your organization's protection: secret files are never sent to the model. Do not try to read this file another way; ask the user for the specific value your task needs, or use the example file (such as .env.example).";
+var ENV_TEMPLATES = /* @__PURE__ */ new Set(["example", "sample", "template", "dist"]);
+var SECRET_EXTENSIONS = /\.(pem|key|p12|pfx|jks|keystore)$/;
+var SECRET_NAMES = /* @__PURE__ */ new Set([".npmrc", ".pypirc", ".netrc", ".git-credentials", "credentials.json", "secrets.yml", "secrets.yaml", "terraform.tfvars"]);
+function isSecretPath(path) {
+  const clean = path.trim().replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+  if (!clean) return false;
+  const parts = clean.split("/");
+  const name = parts[parts.length - 1];
+  if (name === ".env") return true;
+  if (name.startsWith(".env.")) return !name.slice(5).split(".").some((part) => ENV_TEMPLATES.has(part));
+  if (SECRET_EXTENSIONS.test(name)) return true;
+  if (/^id_(rsa|dsa|ecdsa|ed25519)/.test(name) && !name.endsWith(".pub")) return true;
+  if (SECRET_NAMES.has(name) || name.endsWith(".auto.tfvars")) return true;
+  if (/^service-account.*\.json$/.test(name)) return true;
+  return name === "credentials" && parts[parts.length - 2] === ".aws";
+}
+var SECRET_SAMPLES = [
+  ".env",
+  ".env.local",
+  ".env.production",
+  "server.pem",
+  "tls.key",
+  "cert.p12",
+  "cert.pfx",
+  "release.jks",
+  "app.keystore",
+  "id_rsa",
+  "id_ed25519",
+  ".npmrc",
+  ".pypirc",
+  ".netrc",
+  ".git-credentials",
+  "credentials.json",
+  "service-account.json",
+  "service-account-prod.json",
+  "prod.auto.tfvars",
+  "terraform.tfvars",
+  ".aws/credentials",
+  "secrets.yml",
+  "secrets.yaml"
+];
+var ORDINARY_SAMPLES = ["package.json", "index.ts", "main.py", "README.md", "app.yml", "app.yaml", "main.tf", "Main.java", "config"];
+function globRegex(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += ".*";
+        i++;
+        if (glob[i + 1] === "/") i++;
+      } else re += "[^/]*";
+    } else if (c === "?") re += "[^/]";
+    else if (c === "{") re += "(";
+    else if (c === "}") re += ")";
+    else if (c === ",") re += "|";
+    else re += c.replace(/[.+^$()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`, "i");
+}
+function globTargetsSecrets(glob) {
+  const patterns = glob.split(/\s+/).filter(Boolean).filter((g) => !g.startsWith("!"));
+  return patterns.some((g) => {
+    let re;
+    try {
+      re = globRegex(g.replace(/^\.\//, ""));
+    } catch {
+      return false;
+    }
+    const test = (name) => re.test(name) || !g.includes("/") && re.test(name.split("/").pop());
+    return SECRET_SAMPLES.some(test) && !ORDINARY_SAMPLES.some(test);
+  });
+}
+var SECRET_READ_DENY_RULES = [
+  ...[
+    ".env",
+    ".env.local",
+    ".env.*.local",
+    ".env.development",
+    ".env.dev",
+    ".env.production",
+    ".env.prod",
+    ".env.staging",
+    ".env.stage",
+    ".env.test",
+    ".env.testing",
+    ".env.qa",
+    ".env.uat",
+    ".env.preview",
+    ".env.ci",
+    ".env.docker",
+    ".env.vault",
+    ".env.keys",
+    ".env.backup",
+    ".env.bak",
+    ".env.old",
+    ".env.secret",
+    ".env.secrets",
+    ".env.override",
+    "*.pem",
+    "*.key",
+    "*.p12",
+    "*.pfx",
+    "*.jks",
+    "*.keystore",
+    "id_rsa",
+    "id_rsa_*",
+    "id_dsa",
+    "id_dsa_*",
+    "id_ecdsa",
+    "id_ecdsa_*",
+    "id_ed25519",
+    "id_ed25519_*",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials",
+    "credentials.json",
+    "service-account*.json",
+    "*.auto.tfvars",
+    "terraform.tfvars",
+    ".aws/credentials",
+    "secrets.yml",
+    "secrets.yaml"
+  ].map((p) => `Read(**/${p})`)
+];
+var FILE_TOOL_PATHS = {
+  Read: ["file_path"],
+  Write: ["file_path"],
+  Edit: ["file_path"],
+  MultiEdit: ["file_path"],
+  NotebookEdit: ["notebook_path"],
+  Grep: ["path"],
+  Glob: ["path"],
+  LS: ["path"]
+};
+function secretFileToolDenial(toolName, input) {
+  for (const field of FILE_TOOL_PATHS[toolName] ?? []) {
+    const v = input[field];
+    if (typeof v === "string" && isSecretPath(v)) return SECRET_FILE_MESSAGE;
+  }
+  if (toolName === "Grep" && typeof input.glob === "string" && globTargetsSecrets(input.glob)) return SECRET_FILE_MESSAGE;
+  return null;
 }
-var strings = (v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).filter(([, x]) => typeof x === "string")) : {};
-function environmentsOf(raw) {
-  if (!Array.isArray(raw)) return [];
-  return raw.filter((e) => !!e && typeof e === "object" && typeof e.projectId === "string").slice(0, 50).map((e) => ({ projectId: e.projectId, setupCommand: typeof e.setupCommand === "string" && e.setupCommand.trim() ? e.setupCommand : null, env: strings(e.env), secrets: strings(e.secrets) }));
+var HARMLESS_WITH_SECRET = /* @__PURE__ */ new Set(["ls", "stat", "test", "[", "[[", "file", "wc", "rm", "touch", "echo", "printf", "chmod", "mkdir", "realpath", "basename", "dirname", "du", "true", "cd", "pwd"]);
+var HARMLESS_GIT_WITH_SECRET = /* @__PURE__ */ new Set(["status", "add", "rm", "check-ignore", "ls-files", "update-index"]);
+var RECURSIVE_SEARCH = /(^|\s)(grep|egrep|fgrep)\s(.*\s)?(-[a-z]*r[a-z]*|--recursive|--dereference-recursive)(\s|$)|(^|\s)(rg|ag|ack|ack-grep)(\s|$)|(^|\s)git\s+(-c\s+\S+\s+)*grep(\s|$)/;
+function commandSegments(command) {
+  return command.replace(/\\\n/g, " ").split(/\|\||&&|[|;&\n\r`]|\$\(|<\(|>\(|[()]/).map((s) => s.trim()).filter(Boolean);
 }
-function pluginsOf(raw) {
-  if (!Array.isArray(raw)) return [];
-  return raw.filter((p) => !!p && typeof p === "object" && typeof p.name === "string" && Array.isArray(p.files)).slice(0, 20).map((p) => ({ name: p.name, files: p.files.filter((f) => !!f && typeof f.path === "string" && typeof f.content === "string").slice(0, 300) }));
+function programWords(segment) {
+  const words = segment.split(/\s+/).filter(Boolean);
+  let i = 0;
+  for (; ; ) {
+    const w = words[i];
+    if (w === void 0) break;
+    if (/^[a-z_][a-z0-9_]*=/i.test(w)) {
+      i++;
+      continue;
+    }
+    if (["sudo", "doas", "command", "builtin", "exec", "nohup", "time", "nice", "env", "xargs"].includes(w.replace(/^.*\//, ""))) {
+      i++;
+      while (words[i]?.startsWith("-")) i++;
+      continue;
+    }
+    break;
+  }
+  return words.slice(i);
 }
-function skillsOf(raw) {
-  if (!Array.isArray(raw)) return [];
-  return raw.filter((s) => !!s && typeof s === "object").filter((s) => typeof s.name === "string" && typeof s.body === "string").slice(0, 200).map((s) => ({
-    name: s.name,
-    description: typeof s.description === "string" ? s.description : "",
-    body: s.body,
-    argumentHint: typeof s.argumentHint === "string" ? s.argumentHint : null
-  }));
+function pathPieces(word) {
+  return word.replace(/^[<>]+/, "").split(/[=:@,]/).map((p) => p.replace(/^[<>]+/, "")).filter(Boolean);
 }
-function pullRequestsOf(raw) {
-  const out2 = {};
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return out2;
-  for (const [repo2, v] of Object.entries(raw)) {
-    if (!v || typeof v.branch !== "string") continue;
-    out2[repo2] = {
-      branch: v.branch,
-      number: typeof v.number === "number" ? v.number : null,
-      url: typeof v.url === "string" ? v.url : null,
-      files: Array.isArray(v.files) ? v.files.filter((f) => typeof f === "string") : []
-    };
+function secretFileCommandDenial(command) {
+  const n = normalizeCommand(command);
+  const segments2 = commandSegments(n);
+  const words = n.split(/[\s|;&()`]+/).filter(Boolean);
+  const namesSecret = words.some((w) => pathPieces(w).some(isSecretPath)) || /(^|\s)(source|\.)\s+\S*\.env(\s|$)/.test(n);
+  if (namesSecret) {
+    const onlyHarmless = segments2.every((seg) => {
+      const w = programWords(seg);
+      const p = (w[0] ?? "").replace(/^.*\//, "");
+      if (p === "git") {
+        const sub = w.slice(1).find((x) => !x.startsWith("-"));
+        return !!sub && HARMLESS_GIT_WITH_SECRET.has(sub);
+      }
+      if (p === "cp" || p === "mv" || p === "install") {
+        const args = w.slice(1).filter((x) => !x.startsWith("-"));
+        return args.length >= 2 && !args.slice(0, -1).some((a) => pathPieces(a).some(isSecretPath));
+      }
+      return HARMLESS_WITH_SECRET.has(p);
+    });
+    if (!onlyHarmless || /<\s*[^<\s]/.test(n.replace(/<<-?\s*\S+/g, ""))) return SECRET_FILE_MESSAGE;
+  }
+  const pipelineStarts = n.replace(/\\\n/g, " ").split(/&&|\|\||[;&\n\r`]|\$\(|<\(|>\(|[()]/).map((c) => c.split("|")[0].trim()).filter(Boolean);
+  if (pipelineStarts.some((seg) => RECURSIVE_SEARCH.test(programWords(seg).join(" ")))) {
+    return "Blocked by your organization's protection: secret files are never sent to the model, and a recursive search from a command would read them. Use the Grep tool for this search (it skips secret files), or search specific files by name.";
+  }
+  return null;
+}
+var RECURSIVE_FLAG = /(^|\s)(-[a-z]*r[a-z]*|--recursive)(\s|$)/;
+var DESTRUCTIVE_SEGMENT = [
+  (w) => w[0] === "rm" && RECURSIVE_FLAG.test(w.slice(1).join(" ")),
+  (w, seg) => w[0] === "find" && /\s-delete(\s|$)/.test(seg),
+  (w, seg) => w[0] === "find" && /\s-exec(dir)?\s+(\S*\/)?rm\s/.test(seg),
+  (w, seg) => w[0] === "git" && /(^|\s)reset\s+(.*\s)?--hard(\s|$)/.test(seg),
+  (w, seg) => w[0] === "git" && /(^|\s)clean\s+(.*\s)?(-[a-z]*f[a-z]*|--force)(\s|$)/.test(seg),
+  (w, seg) => w[0] === "git" && /(^|\s)checkout\s+(.*\s)?(--\s+)?(\.|:\/|\*)(\s|$)/.test(seg),
+  (w, seg) => w[0] === "git" && /(^|\s)restore\s+(.*\s)?(\.|:\/|\*)(\s|$)/.test(seg),
+  (w) => w[0] === "dd",
+  (w) => !!w[0]?.startsWith("mkfs"),
+  (w) => w[0] === "shred",
+  (w, seg) => w[0] === "chmod" && RECURSIVE_FLAG.test(seg) && /(^|\s)(0?777|a\+rwx|ugo\+rwx)(\s|$)/.test(seg),
+  (w, seg) => w[0] === "chown" && RECURSIVE_FLAG.test(seg),
+  (w) => w[0] === "dropdb"
+];
+var DOWNLOAD_TO_SHELL = [
+  /\b(curl|wget|fetch)\b[^|;\n]*\|\s*(sudo\s+(-\S+\s+)*)?(env\s+)?(\S*\/)?(sh|bash|zsh|dash|ksh|fish|python3?|perl|ruby|node)(\s|$)/,
+  /\b(sh|bash|zsh|dash|ksh|fish|source|\.)\s+<\(\s*(curl|wget)\b/,
+  /\b(sh|bash|zsh|dash|ksh|fish)\s+-c\s+\$\(\s*(curl|wget)\b/,
+  /\beval\s+\$\(\s*(curl|wget)\b/
+];
+function isDestructiveCommand(command) {
+  const n = normalizeCommand(command);
+  if (DOWNLOAD_TO_SHELL.some((re) => re.test(n))) return true;
+  if (/\bdrop\s+(database|table|schema)\b/.test(n)) return true;
+  if (/(^|[\s;&|(])(psql|mysql|mariadb|sqlite3|clickhouse-client|cockroach)\b.*\btruncate\b/.test(n)) return true;
+  return commandSegments(n).some((seg) => {
+    const words = programWords(seg).map((w, i) => i === 0 ? w.replace(/^.*\//, "") : w);
+    return DESTRUCTIVE_SEGMENT.some((test) => test(words, words.join(" ")));
+  });
+}
+var DEPLOY = [
+  /\b(npm|pnpm|yarn|bun)\s+(.*\s)?publish(\s|$)/,
+  /\bcargo\s+publish\b/,
+  /\bgem\s+push\b/,
+  /\bpoetry\s+publish\b/,
+  /\btwine\s+upload\b/,
+  /\b(docker|podman)\s+(image\s+)?push\b/,
+  /\b(terraform|tofu)\s+(.*\s)?(apply|destroy)\b/,
+  /\bpulumi\s+(.*\s)?(up|destroy|update)\b/,
+  /\bcdk\s+(.*\s)?(deploy|destroy)\b/,
+  /\b(serverless|sls)\s+(.*\s)?deploy\b/,
+  /\bkubectl\s+(.*\s)?(apply|delete|rollout)\b/,
+  /\bhelm\s+(.*\s)?(install|upgrade|uninstall)\b/,
+  /(^|\s)vercel(\s+.*)?\s(--prod|deploy)\b/,
+  /\bnetlify\s+(.*\s)?deploy\b/,
+  /\b(fly|flyctl)\s+(.*\s)?deploy\b/,
+  /\bwrangler\s+(.*\s)?(deploy|publish)\b/,
+  /\bgcloud\s+(.*\s)?deploy\b/,
+  /\baz\s+(.*\s)?(deploy|deployment|webapp\s+up)\b/,
+  /\baws\s+(.*\s)?cloudformation\s+(.*\s)?deploy\b/,
+  /\baws\s+(.*\s)?ecs\s+(.*\s)?update-service\b/,
+  /\baws\s+(.*\s)?lambda\s+(.*\s)?update-function-code\b/,
+  /\baws\s+(.*\s)?s3\s+sync\s+(.*\s)?\S+\s+s3:\/\/\S+(\s+-.*)?$/,
+  /\bgh\s+release\s+create\b/,
+  /\beas\s+submit\b/,
+  /\bmvn\b.*\bdeploy\b/,
+  /\bgradlew?\b.*\bpublish/,
+  /\bdotnet\s+nuget\s+push\b/,
+  /\bfirebase\s+(.*\s)?deploy\b/,
+  /\beb\s+deploy\b/
+];
+function isDeployCommand(command) {
+  return commandSegments(normalizeCommand(command)).some((seg) => {
+    const words = programWords(seg);
+    const text3 = words.join(" ");
+    return DEPLOY.some((re) => re.test(text3));
+  });
+}
+var PROTECTED_BRANCH = /^(main|master|production|prod|develop|development|release\/.+)$/;
+function isProtectedBranch(branch2) {
+  return PROTECTED_BRANCH.test(branch2.replace(/^refs\/heads\//, "").toLowerCase());
+}
+var PUSH_VALUE_FLAGS = /* @__PURE__ */ new Set(["-o", "--push-option", "--repo", "--receive-pack", "--exec", "--signed"]);
+function gitPushes(command) {
+  const out2 = [];
+  for (const seg of commandSegments(normalizeCommand(command))) {
+    const words = programWords(seg);
+    if ((words[0] ?? "").replace(/^.*\//, "") !== "git") continue;
+    let i = 1;
+    while (i < words.length && words[i].startsWith("-")) i += words[i] === "-C" || words[i] === "-c" ? 2 : 1;
+    if (words[i] !== "push") continue;
+    const t = { branches: [], current: false, force: false, all: false };
+    let tagsOnly = false;
+    const positional = [];
+    for (let j = i + 1; j < words.length; j++) {
+      const w = words[j];
+      if (w === "--") {
+        positional.push(...words.slice(j + 1));
+        break;
+      }
+      if (PUSH_VALUE_FLAGS.has(w)) {
+        j++;
+        continue;
+      }
+      if (/^--force(-with-lease|-if-includes)?(=|$)/.test(w) || w === "--mirror") t.force = true;
+      if (w === "--all" || w === "--mirror" || w === "--branches") t.all = true;
+      if (w === "--tags") tagsOnly = true;
+      if (/^-[a-z]+$/.test(w) && !w.startsWith("--") && w.includes("f")) t.force = true;
+      if (w.startsWith("-")) continue;
+      positional.push(w);
+    }
+    const refspecs = positional.slice(1);
+    if (!refspecs.length && !tagsOnly) t.current = true;
+    for (const spec of refspecs) {
+      if (spec.startsWith("+")) t.force = true;
+      const s = spec.replace(/^\+/, "");
+      const dst = s.includes(":") ? s.slice(s.indexOf(":") + 1) : s;
+      const name = dst.replace(/^refs\/heads\//, "");
+      if (!name) continue;
+      if (name === "head" || name === "@") t.current = true;
+      else t.branches.push(name);
+    }
+    out2.push(t);
   }
   return out2;
 }
-function importedInfo(raw) {
-  if (!raw || typeof raw !== "object") return null;
-  const r = raw;
-  if (r.source !== "CLAUDE_CODE" && r.source !== "CODEX" || !isExternalId(r.externalId)) return null;
-  return {
-    source: r.source,
-    externalId: r.externalId,
-    title: typeof r.title === "string" ? r.title : "",
-    folder: typeof r.folder === "string" ? r.folder : null,
-    messageCount: typeof r.messageCount === "number" ? r.messageCount : 0,
-    nativeResume: r.nativeResume === true
-  };
+async function isProtectedPush(command, currentBranch) {
+  const pushes = gitPushes(command);
+  if (!pushes.length) return false;
+  let current;
+  for (const p of pushes) {
+    if (p.force || p.all || p.branches.some(isProtectedBranch)) return true;
+    if (p.current) {
+      if (current === void 0) current = await currentBranch().catch(() => null);
+      if (!current || current === "head" || current === "HEAD" || isProtectedBranch(current)) return true;
+    }
+  }
+  return false;
 }
-function scopeRepos(raw) {
-  if (!Array.isArray(raw)) return null;
-  return raw.filter((r) => r && typeof r === "object" && typeof r.repoFullName === "string").map((r) => ({
-    repoFullName: r.repoFullName,
-    provider: typeof r.provider === "string" ? r.provider : "",
-    projectId: typeof r.projectId === "string" ? r.projectId : "",
-    defaultBranch: typeof r.defaultBranch === "string" ? r.defaultBranch : null
-  }));
+var NPM_NAME = /^(@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/;
+var PYPI_NAME = /^[a-z0-9]([a-z0-9._-]*[a-z0-9])?$/;
+var CRATE_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+var NPM_VALUE_FLAGS = /* @__PURE__ */ new Set(["--registry", "--prefix", "-w", "--workspace", "--tag", "--omit", "--include", "--cache", "--userconfig", "-c", "--filter", "-F", "--dir", "-C", "--cwd", "-p", "--package"]);
+var PIP_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-r",
+  "--requirement",
+  "-c",
+  "--constraint",
+  "-e",
+  "--editable",
+  "-i",
+  "--index-url",
+  "--extra-index-url",
+  "-f",
+  "--find-links",
+  "-t",
+  "--target",
+  "--prefix",
+  "--root",
+  "--python",
+  "-p",
+  "--group",
+  "--optional",
+  "-G",
+  "--source",
+  "--platform",
+  "--python-version",
+  "--implementation",
+  "--abi",
+  "--trusted-host",
+  "--cert",
+  "--client-cert",
+  "--cache-dir",
+  "--src",
+  "--upgrade-strategy",
+  "--progress-bar",
+  "--log",
+  "--timeout",
+  "--retries",
+  "--proxy",
+  "-E",
+  "--extras",
+  "--with",
+  "--dev-group"
+]);
+var CARGO_VALUE_FLAGS = /* @__PURE__ */ new Set(["-F", "--features", "--rename", "-p", "--package", "--registry", "--manifest-path", "--target", "--branch", "--tag", "--rev"]);
+function notRegistryTarget(t) {
+  return /^(\.|\/|~|file:|link:|workspace:|portal:|patch:|git[+:]|github:|gitlab:|bitbucket:|https?:|ssh:)/.test(t) || /\.(tgz|tar\.gz|tar|zip|whl)$/.test(t) || t.includes("://");
+}
+function npmName(target) {
+  if (notRegistryTarget(target)) return null;
+  const alias = /^[^@]+@npm:(.+)$/.exec(target) ?? /^@[^/]+\/[^@]+@npm:(.+)$/.exec(target);
+  const t = alias ? alias[1] : target;
+  const scoped = t.startsWith("@");
+  const at = t.indexOf("@", scoped ? 1 : 0);
+  const name = at > 0 ? t.slice(0, at) : t;
+  if (!scoped && name.includes("/")) return null;
+  return NPM_NAME.test(name) ? name : null;
+}
+function pypiName(target) {
+  if (notRegistryTarget(target) || target.includes(" @ ")) return null;
+  const name = target.split(/[\[<>=!~;@\s]/)[0];
+  return PYPI_NAME.test(name) ? name : null;
+}
+function crateName(target) {
+  const name = target.split("@")[0];
+  return CRATE_NAME.test(name) ? name : null;
+}
+function targets(words, valueFlags) {
+  const out2 = [];
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (valueFlags.has(w)) {
+      i++;
+      continue;
+    }
+    if (w.startsWith("-")) continue;
+    out2.push(w);
+  }
+  return out2;
 }
-function orgMcpCatalogOf(raw) {
-  const r = raw ?? {};
-  const servers = (Array.isArray(r.servers) ? r.servers : []).filter((s) => !!s && typeof s === "object" && typeof s.server === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(s.server)).slice(0, 20).map((s) => ({
-    server: s.server,
-    description: typeof s.description === "string" ? s.description : null,
-    approval: typeof s.approval === "string" ? s.approval : "WRITE",
-    tools: (Array.isArray(s.tools) ? s.tools : []).filter((t) => !!t && typeof t === "object" && typeof t.name === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(t.name)).slice(0, 100).map((t) => ({
-      name: t.name,
-      description: typeof t.description === "string" ? t.description : "",
-      inputSchema: t.inputSchema && typeof t.inputSchema === "object" && !Array.isArray(t.inputSchema) ? t.inputSchema : { type: "object" },
-      readOnly: t.readOnly === true
-    }))
-  }));
-  const unavailable = (Array.isArray(r.unavailable) ? r.unavailable : []).filter((u) => !!u && typeof u.server === "string").map((u) => ({ server: String(u.server).slice(0, 32), error: typeof u.error === "string" ? u.error.slice(0, 60) : "MCP_FAILED" }));
-  return { servers, unavailable };
+function packageInstalls(command, opts = {}) {
+  const out2 = [];
+  const add = (ecosystem, name) => {
+    if (name && !out2.some((p) => p.ecosystem === ecosystem && p.name === name)) out2.push({ ecosystem, name });
+  };
+  for (const seg of commandSegments(normalizeCommand(command))) {
+    let w = programWords(seg);
+    const p = (w[0] ?? "").replace(/^.*\//, "");
+    const rest = w.slice(1);
+    const otherRegistry = rest.some((x) => /^(--registry|--index-url|-i)(=|$)/.test(x));
+    if (otherRegistry) continue;
+    if (["npm", "pnpm", "yarn", "bun"].includes(p)) {
+      const args = targets(rest, NPM_VALUE_FLAGS);
+      let k = 0;
+      if (args[0] === "global") k = 1;
+      const sub = args[k];
+      const installs = sub === "add" || (sub === "install" || sub === "i" || sub === "in") && p !== "yarn";
+      if (installs) for (const t of args.slice(k + 1)) add("npm", npmName(t));
+      if ((p === "pnpm" || p === "yarn") && sub === "dlx" && args[k + 1]) add("npm", npmName(args[k + 1]));
+      if (p === "npm" && (sub === "exec" || sub === "x") && args[k + 1]) {
+        const name = npmName(args[k + 1]);
+        if (name && !opts.installedLocally?.(name)) add("npm", name);
+      }
+      continue;
+    }
+    if (p === "npx" || p === "bunx" || p === "pnpx") {
+      const pkgFlag = rest.findIndex((x) => x === "-p" || x === "--package");
+      if (pkgFlag >= 0 && rest[pkgFlag + 1]) {
+        add("npm", npmName(rest[pkgFlag + 1]));
+        continue;
+      }
+      const first = targets(rest, /* @__PURE__ */ new Set(["--registry", "--cache", "--prefix"]))[0];
+      const name = first ? npmName(first) : null;
+      if (name && !opts.installedLocally?.(name)) add("npm", name);
+      continue;
+    }
+    if (/^python[0-9.]*$/.test(p) && rest[0] === "-m" && /^pip3?$/.test(rest[1] ?? "")) w = [rest[1], ...rest.slice(2)];
+    else if (p === "uv" && rest[0] === "pip") w = ["pip", ...rest.slice(1)];
+    const q = (w[0] ?? "").replace(/^.*\//, "");
+    const r = w.slice(1);
+    if (/^pip3?(\.\d+)?$/.test(q) && r[0] === "install") {
+      for (const t of targets(r.slice(1), PIP_VALUE_FLAGS)) add("pypi", pypiName(t));
+      continue;
+    }
+    if ((q === "uv" || q === "poetry") && r[0] === "add") {
+      for (const t of targets(r.slice(1), PIP_VALUE_FLAGS)) add("pypi", pypiName(t));
+      continue;
+    }
+    if (q === "cargo" && r[0] === "add") {
+      if (r.some((x) => /^--(git|path)(=|$)/.test(x))) continue;
+      for (const t of targets(r.slice(1), CARGO_VALUE_FLAGS)) add("crates", crateName(t));
+    }
+  }
+  return out2;
 }
-
-// src/application/services/workspaceSandbox/localWorkspace.ts
-var import_promises4 = require("fs/promises");
-var import_os3 = require("os");
-var import_path4 = require("path");
-
-// src/application/services/workspaceSandbox/localTracking.ts
-var import_crypto2 = require("crypto");
-var import_fs3 = require("fs");
-var import_promises3 = require("fs/promises");
-var import_os2 = require("os");
-var import_path3 = require("path");
-
-// src/application/services/workspaceSandbox/workspaceGit.ts
-var import_child_process = require("child_process");
-var import_util = require("util");
-var import_crypto = require("crypto");
-var import_promises2 = require("fs/promises");
-var import_fs2 = require("fs");
-var import_os = require("os");
-var import_path2 = require("path");
-
-// src/application/services/workspaceSandbox/checkpointMap.ts
-var CHECKPOINT_MAP_VERSION = 2;
-var LOCAL_FOLDER_KEY = ".";
-function parseCheckpoints(raw, legacyRepo) {
-  const out2 = /* @__PURE__ */ new Map();
-  if (!raw) return out2;
-  const trimmed = raw.trimStart();
-  if (trimmed.startsWith("{")) {
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (parsed && parsed.version === CHECKPOINT_MAP_VERSION && parsed.repos && typeof parsed.repos === "object" && !Array.isArray(parsed.repos)) {
-        for (const [repo2, patch] of Object.entries(parsed.repos)) {
-          if (repo2 && typeof patch === "string" && patch) out2.set(repo2, patch);
-        }
+var NEW_PACKAGE_DAYS = 30;
+var REGISTRY_TIMEOUT_MS = 3e3;
+function registryUrl(p) {
+  if (p.ecosystem === "npm") return `https://registry.npmjs.org/${p.name.replace("/", "%2F")}`;
+  if (p.ecosystem === "pypi") return `https://pypi.org/pypi/${encodeURIComponent(p.name)}/json`;
+  return `https://crates.io/api/v1/crates/${encodeURIComponent(p.name)}`;
+}
+function firstPublished(p, body) {
+  let iso3 = null;
+  if (p.ecosystem === "npm") iso3 = body?.time?.created;
+  else if (p.ecosystem === "crates") iso3 = body?.crate?.created_at;
+  else {
+    let min = null;
+    const releases = body?.releases && typeof body.releases === "object" ? Object.values(body.releases) : [];
+    for (const files of releases) {
+      if (!Array.isArray(files)) continue;
+      for (const f of files) {
+        const t2 = Date.parse(String(f?.upload_time_iso_8601 ?? f?.upload_time ?? ""));
+        if (Number.isFinite(t2) && (min === null || t2 < min)) min = t2;
       }
-    } catch {
     }
+    return min === null ? null : new Date(min);
+  }
+  const t = typeof iso3 === "string" ? Date.parse(iso3) : NaN;
+  return Number.isFinite(t) ? new Date(t) : null;
+}
+var RegistryChecker = class {
+  constructor(o = {}) {
+    this.o = o;
+  }
+  o;
+  cache = /* @__PURE__ */ new Map();
+  async check(refs) {
+    const out2 = /* @__PURE__ */ new Map();
+    const signal = AbortSignal.timeout(this.o.timeoutMs ?? REGISTRY_TIMEOUT_MS);
+    await Promise.all(refs.map(async (p) => {
+      const key = `${p.ecosystem}:${p.name}`;
+      const cached = this.cache.get(key);
+      if (cached) {
+        out2.set(key, cached);
+        return;
+      }
+      const status = await this.lookup(p, signal);
+      if (status !== "UNVERIFIED") this.cache.set(key, status);
+      out2.set(key, status);
+    }));
     return out2;
   }
-  out2.set(legacyRepo ?? LOCAL_FOLDER_KEY, raw);
-  return out2;
-}
-function serializeCheckpoints(map) {
-  const repos = {};
-  for (const key of [...map.keys()].sort()) {
-    const patch = map.get(key);
-    if (patch) repos[key] = patch;
+  async lookup(p, signal) {
+    try {
+      const res = await (this.o.fetchImpl ?? fetch)(registryUrl(p), {
+        headers: { accept: "application/json", "user-agent": this.o.userAgent ?? "scalequality-code (+https://scalequality.io)" },
+        signal,
+        redirect: "follow"
+      });
+      if (res.status === 404) return "NOT_FOUND";
+      if (!res.ok) return "UNVERIFIED";
+      const body = await res.json();
+      const first = firstPublished(p, body);
+      if (!first) return "UNVERIFIED";
+      const ageDays = ((this.o.now?.() ?? /* @__PURE__ */ new Date()).getTime() - first.getTime()) / 864e5;
+      return ageDays < NEW_PACKAGE_DAYS ? "TOO_NEW" : "OK";
+    } catch {
+      return "UNVERIFIED";
+    }
+  }
+};
+function mayNeedProtection(command, p) {
+  if (p.destructiveCommands && isDestructiveCommand(command)) return true;
+  if (p.deployApproval && isDeployCommand(command)) return true;
+  if (p.protectedPush && gitPushes(command).length > 0) return true;
+  return p.unknownPackage !== null && packageInstalls(command).length > 0;
+}
+function packageMessage(name, ecosystem, reason) {
+  const registry = ecosystem === "npm" ? "npm" : ecosystem === "pypi" ? "PyPI" : "crates.io";
+  return reason === "NOT_FOUND" ? `Blocked by your organization's protection: the package "${name}" does not exist in the public ${registry} registry. It was not installed. Check the name (it may be a typo or an invented package) and ask the user before trying another one.` : `Blocked by your organization's protection: the package "${name}" was first published on ${registry} less than ${NEW_PACKAGE_DAYS} days ago. It was not installed. Use an established package or ask the user.`;
+}
+async function protectionVerdict(command, p, deps) {
+  const reasons = [];
+  let pkg = null;
+  if (p.unknownPackage) {
+    const refs = packageInstalls(command, { installedLocally: deps.installedLocally });
+    if (refs.length) {
+      const results = await deps.registry.check(refs);
+      const flagged = refs.map((r) => ({ r, status: results.get(`${r.ecosystem}:${r.name}`) ?? "UNVERIFIED" })).filter((x) => x.status !== "OK");
+      const definite = flagged.find((x) => x.status === "NOT_FOUND" || x.status === "TOO_NEW");
+      if (definite && p.unknownPackage === "block") {
+        const reason = definite.status;
+        return { kind: "deny", message: packageMessage(definite.r.name, definite.r.ecosystem, reason), reason: "PROTECTION_UNKNOWN_PACKAGE", package: definite.r.name, packageReason: reason };
+      }
+      const ask = definite ?? (p.unknownPackage === "block" ? flagged[0] : void 0);
+      if (ask) {
+        reasons.push("PROTECTION_UNKNOWN_PACKAGE");
+        pkg = { name: ask.r.name, reason: ask.status };
+      }
+    }
+  }
+  if (p.destructiveCommands && isDestructiveCommand(command)) reasons.push("PROTECTION_DESTRUCTIVE_COMMAND");
+  if (p.deployApproval && isDeployCommand(command)) reasons.push("PROTECTION_DEPLOY");
+  if (p.protectedPush && await isProtectedPush(command, deps.currentBranch)) reasons.push("PROTECTION_PROTECTED_PUSH");
+  if (!reasons.length) return { kind: "allow" };
+  return { kind: "ask", reasons, ...pkg ? { package: pkg.name, packageReason: pkg.reason } : {} };
+}
+var PROTECTION_MESSAGES = {
+  rejected: "Your organization's protection requires a person to approve this command, and the user denied it. It did not run. Do not run it again or another way unless the user asks.",
+  timedOut: (minutes) => `Your organization's protection requires a person to approve this command, and nobody answered within ${minutes} minutes. It did not run. Ask the user before trying it again.`,
+  stopped: "The request was stopped before the command ran.",
+  unavailable: "Your organization's protection requires a person to approve this command, and the approval could not be requested. It did not run. Tell the user; do not try to run it another way."
+};
+
+// src/application/services/workspaceSandbox/SessionTransport.ts
+var SessionGoneError = class extends Error {
+  constructor(status) {
+    super(`session unavailable (${status})`);
+    this.status = status;
+    this.name = "SessionGoneError";
+  }
+  status;
+};
+var TransportError = class extends Error {
+  constructor(message, status, retryable) {
+    super(message);
+    this.status = status;
+    this.retryable = retryable;
+    this.name = "TransportError";
+  }
+  status;
+  retryable;
+  /** The API's error code (e.g. REPOSITORY_NOT_IN_SCOPE), when it sent one. */
+  code;
+};
+
+// src/application/services/workspaceSandbox/HttpSessionTransport.ts
+var GONE = [401, 403, 404, 410];
+var HttpSessionTransport = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.gone = new Set(opts.goneStatuses ?? GONE);
+    const base = opts.baseUrl.replace(/\/+$/, "");
+    this.root = `${base}/api/ai-governance/internal/workspace-sessions/${encodeURIComponent(opts.sessionId)}`;
+  }
+  opts;
+  fetchImpl;
+  root;
+  gone;
+  async bootstrap() {
+    const raw = await this.get(`/bootstrap?features=${ENGINE_FEATURES.join(",")}`, this.opts.requestTimeoutMs ?? 3e4);
+    return toSessionBootstrap(raw);
+  }
+  async pollCommands(waitSeconds, signal) {
+    const wait = Math.max(0, Math.min(25, Math.floor(waitSeconds)));
+    const body = await this.get(`/commands?wait=${wait}`, (wait + 15) * 1e3, signal);
+    return Array.isArray(body?.commands) ? body.commands : [];
+  }
+  async postEvents(events) {
+    if (events.length === 0) return;
+    await this.post("/events", { events }, this.opts.requestTimeoutMs ?? 3e4);
+  }
+  callTool(name, args, approvalId) {
+    if (!/^[a-z][a-z0-9_]{0,63}$/.test(name)) throw new TransportError("invalid tool name", null, false);
+    return this.post(`/tools/${name}`, approvalId ? { args, approvalId } : { args }, this.opts.toolTimeoutMs ?? 12e4);
+  }
+  async mcpTools() {
+    const raw = await this.get("/mcp/tools", this.opts.requestTimeoutMs ?? 6e4);
+    return orgMcpCatalogOf(raw);
+  }
+  mcpCall(req) {
+    return this.post("/mcp/call", req, this.opts.toolTimeoutMs ?? 18e4);
+  }
+  openPullRequest(req) {
+    return this.post("/pull-request", req, this.opts.toolTimeoutMs ?? 18e4);
+  }
+  async checkpoint(req) {
+    await this.post("/checkpoint", req, this.opts.requestTimeoutMs ?? 6e4);
+  }
+  async openRepository(repoFullName) {
+    const raw = await this.post("/repositories/open", { repoFullName }, this.opts.requestTimeoutMs ?? 3e4);
+    const text3 = (v, fallback = "") => typeof v === "string" ? v : fallback;
+    const defaultBranch = text3(raw?.defaultBranch, "main");
+    return {
+      cloneUrl: text3(raw?.cloneUrl),
+      scheme: text3(raw?.scheme),
+      token: text3(raw?.token),
+      provider: text3(raw?.provider),
+      repoFullName: text3(raw?.repoFullName, repoFullName),
+      defaultBranch,
+      branch: typeof raw?.branch === "string" ? raw.branch : defaultBranch
+    };
+  }
+  async importedHistory() {
+    const raw = await this.get("/imported", this.opts.requestTimeoutMs ?? 6e4);
+    const messages = Array.isArray(raw?.messages) ? raw.messages : [];
+    return {
+      messages: messages.filter((m) => !!m && typeof m === "object" && (m.role === "user" || m.role === "assistant")).map((m) => ({
+        role: m.role,
+        text: typeof m.text === "string" ? m.text : "",
+        at: typeof m.at === "string" ? m.at : null,
+        ...Array.isArray(m.tools) ? { tools: m.tools.filter((t) => !!t && typeof t.name === "string" && typeof t.summary === "string") } : {}
+      }))
+    };
   }
-  return Object.keys(repos).length ? JSON.stringify({ version: CHECKPOINT_MAP_VERSION, repos }) : "";
-}
-
-// src/application/services/workspaceSandbox/workspaceGit.ts
-var run = (0, import_util.promisify)(import_child_process.execFile);
-var CHECKPOINT_BASE_HEADER = "ScaleQuality-Base:";
-var DIFF_CAPS = { perFileBytes: 200 * 1024, totalBytes: 2 * 1024 * 1024, maxFiles: 500 };
-async function git(args, opts) {
-  const { stdout } = await run("git", args, {
-    cwd: opts.cwd,
-    timeout: opts.timeoutMs ?? 6e4,
-    maxBuffer: opts.maxBuffer ?? 64 * 1024 * 1024,
-    env: gitEnv(opts.env),
-    windowsHide: true
-  });
-  return stdout;
-}
-async function gitBuffer(args, opts) {
-  const { stdout } = await run("git", args, {
-    cwd: opts.cwd,
-    timeout: opts.timeoutMs ?? 6e4,
-    maxBuffer: opts.maxBuffer ?? 64 * 1024 * 1024,
-    env: gitEnv(opts.env),
-    windowsHide: true,
-    encoding: "buffer"
-  });
-  return stdout;
-}
-function gitEnv(extra) {
-  const env = {};
-  for (const k of ["PATH", "HOME", "LANG", "LC_ALL", "TMPDIR", "GIT_CONFIG_GLOBAL"]) if (process.env[k] != null) env[k] = process.env[k];
-  env.GIT_TERMINAL_PROMPT = "0";
-  env.GIT_CONFIG_NOSYSTEM = "1";
-  return { ...env, ...extra ?? {} };
-}
-function scopeSpec(scope) {
-  return scope?.prefix ? ["--", scope.prefix] : [];
-}
-async function repoIndexFile(root) {
-  const dotGit = (0, import_path2.join)(root, ".git");
-  const st = await (0, import_promises2.stat)(dotGit).catch(() => null);
-  if (!st || st.isDirectory()) return (0, import_path2.join)(dotGit, "index");
-  const out2 = await git(["rev-parse", "--git-path", "index"], { cwd: root }).catch(() => "");
-  return out2.trim() ? (0, import_path2.resolve)(root, out2.trim()) : (0, import_path2.join)(dotGit, "index");
-}
-async function withWorktreeIndex(root, fn, scope) {
-  const tag = `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
-  const idx = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-ws-index-${tag}`);
-  const real = scope?.index !== void 0 ? scope.index : await repoIndexFile(root);
-  if (real && (0, import_fs2.existsSync)(real)) {
-    await (0, import_promises2.copyFile)(real, idx);
-    const st = await (0, import_promises2.stat)(real).catch(() => null);
-    if (st) await (0, import_promises2.utimes)(idx, st.atime, st.mtime).catch(() => void 0);
+  async saveTranscript(t) {
+    await this.post("/transcript", t, this.opts.requestTimeoutMs ?? 6e4);
   }
-  const env = { ...scope?.env ?? {}, GIT_INDEX_FILE: idx, ...scope?.prefix || scope?.paths ? { GIT_LITERAL_PATHSPECS: "1" } : {} };
-  const list = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-ws-paths-${tag}`);
-  try {
-    if (scope?.paths) {
-      if (scope.paths.length) {
-        await (0, import_promises2.writeFile)(list, scope.paths.join("\0"), "utf8");
-        await git(["add", "-A", "-f", `--pathspec-from-file=${list}`, "--pathspec-file-nul"], { cwd: root, env, timeoutMs: 5 * 6e4 });
-      }
-    } else {
-      await git(["add", "-A", ...scopeSpec(scope)], { cwd: root, env, timeoutMs: 5 * 6e4 });
-    }
-    return await fn(env);
-  } finally {
-    await (0, import_promises2.rm)(idx, { force: true }).catch(() => void 0);
-    await (0, import_promises2.rm)(list, { force: true }).catch(() => void 0);
+  async saveBaseMeasurement(r) {
+    await this.post("/measurements/base", r, this.opts.requestTimeoutMs ?? 3e4);
   }
-}
-async function listChanges(root, base, scope) {
-  return withWorktreeIndex(root, (env) => listChangesWithEnv(root, base, env, scope), scope);
-}
-async function listChangesWithEnv(root, base, env, scope) {
-  const nameStatus = await git(["diff", "--cached", "--no-renames", "--name-status", "-z", base, ...scopeSpec(scope)], { cwd: root, env });
-  const numstat = await git(["diff", "--cached", "--no-renames", "--numstat", "-z", base, ...scopeSpec(scope)], { cwd: root, env });
-  const counts = /* @__PURE__ */ new Map();
-  for (const rec of numstat.split("\0")) {
-    if (!rec) continue;
-    const m = /^(-|\d+)\t(-|\d+)\t([\s\S]*)$/.exec(rec);
-    if (!m) continue;
-    counts.set(m[3], { a: m[1] === "-" ? 0 : Number(m[1]), d: m[2] === "-" ? 0 : Number(m[2]), bin: m[1] === "-" });
+  async reply(commandId, reply) {
+    if (!/^[A-Za-z0-9-]{1,80}$/.test(commandId)) throw new TransportError("invalid command id", null, false);
+    await this.post(`/replies/${commandId}`, reply, this.opts.requestTimeoutMs ?? 3e4);
   }
-  const parts = nameStatus.split("\0");
-  const out2 = [];
-  for (let i = 0; i + 1 < parts.length; i += 2) {
-    const code = parts[i];
-    const path = parts[i + 1];
-    if (!code || !path) continue;
-    const status = code.startsWith("A") ? "added" : code.startsWith("D") ? "deleted" : "modified";
-    const c = counts.get(path) ?? { a: 0, d: 0, bin: false };
-    out2.push({ path, status, additions: c.a, deletions: c.d, binary: c.bin });
+  async requestCommandApproval(body) {
+    const raw = await this.post("/command-approvals", body, this.opts.requestTimeoutMs ?? 3e4);
+    const approvalId = typeof raw?.approvalId === "string" ? raw.approvalId : "";
+    if (!approvalId) throw new TransportError("invalid command approval response", 502, false);
+    return { approvalId };
   }
-  return out2;
-}
-async function computeDiff(root, base, caps = DIFF_CAPS, scope) {
-  return withWorktreeIndex(root, async (env) => {
-    const changes = await listChangesWithEnv(root, base, env, scope);
-    const files = [];
-    let total = 0;
-    for (const [i, c] of changes.entries()) {
-      const entry = { path: c.path, status: c.status, additions: c.additions, deletions: c.deletions, patch: "" };
-      if (c.binary) {
-        entry.binary = true;
-      } else if (i >= caps.maxFiles || total >= caps.totalBytes) {
-        entry.truncated = true;
-      } else {
-        let patch = await git(["diff", "--cached", "--no-renames", base, "--", c.path], { cwd: root, env }).catch(() => "");
-        const room = Math.min(caps.perFileBytes, caps.totalBytes - total);
-        if (Buffer.byteLength(patch, "utf8") > room) {
-          patch = truncateUtf8(patch, room);
-          entry.truncated = true;
-        }
-        total += Buffer.byteLength(patch, "utf8");
-        entry.patch = patch;
-        if (!entry.truncated) {
-          const hunks = parseHunks(c.path, patch).map(({ lines: _l, ...h }) => h);
-          if (hunks.length) entry.hunks = hunks;
-        }
+  async cancelCommandApproval(approvalId, reason) {
+    await this.post(`/command-approvals/${encodeURIComponent(approvalId)}/cancel`, { reason }, this.opts.requestTimeoutMs ?? 3e4);
+  }
+  async refreshRuntime() {
+    const raw = await this.post("/runtime", {}, this.opts.requestTimeoutMs ?? 3e4);
+    const boot = toSessionBootstrap({ session: { model: raw?.model, reasoning: raw?.reasoning }, runtime: raw?.runtime, repository: null });
+    return { model: boot.model, runtime: boot.runtime, reasoning: boot.reasoning ?? null };
+  }
+  headers(json) {
+    return {
+      "x-workspace-session-secret": this.opts.secret,
+      accept: "application/json",
+      ...this.opts.userAgent ? { "user-agent": this.opts.userAgent } : {},
+      ...json ? { "content-type": "application/json" } : {}
+    };
+  }
+  async get(path, timeoutMs, outer) {
+    const attempts = Math.max(1, this.opts.getAttempts ?? 4);
+    const delay = this.opts.retryDelayMs ?? 1e3;
+    let last;
+    for (let i = 0; i < attempts; i++) {
+      if (outer?.aborted) throw new TransportError("aborted", null, false);
+      try {
+        return await this.request("GET", path, void 0, timeoutMs, outer);
+      } catch (e) {
+        last = e;
+        if (e instanceof SessionGoneError) throw e;
+        if (e instanceof TransportError && !e.retryable) throw e;
+        if (i < attempts - 1) await sleep(delay * 2 ** i, outer);
       }
-      files.push(entry);
     }
-    return files;
-  }, scope);
-}
-async function worktreeTreeId(root, scope) {
-  return withWorktreeIndex(root, async (env) => (await git(["write-tree"], { cwd: root, env })).trim(), scope);
-}
-async function checkpointPatch(root, base, scope) {
-  return withWorktreeIndex(root, async (env) => {
-    const patch = await git(["diff", "--cached", "--no-renames", "--binary", base, ...scopeSpec(scope)], { cwd: root, env, maxBuffer: 512 * 1024 * 1024 });
-    return patch ? `${CHECKPOINT_BASE_HEADER} ${base}
-${patch}` : "";
-  }, scope);
-}
-var PR_FILE_MAX_BYTES = 2 * 1024 * 1024;
-async function prText(abs) {
-  const st = await (0, import_promises2.stat)(abs).catch(() => null);
-  if (!st || !st.isFile()) return { reason: "missing" };
-  if (st.size > PR_FILE_MAX_BYTES) return { reason: "too_large" };
-  const buf = await (0, import_promises2.readFile)(abs);
-  if (buf.includes(0)) return { reason: "binary" };
-  const content = buf.toString("utf8");
-  if (Buffer.byteLength(content, "utf8") !== buf.length || content.includes("\uFFFD")) return { reason: "not_utf8" };
-  return { content };
-}
-async function filesForPullRequest(root, base, published = [], scope) {
-  const changes = await listChanges(root, base, scope);
-  const out2 = { files: [], skipped: [] };
-  for (const c of changes) {
-    if (c.status === "deleted") {
-      out2.files.push({ path: c.path, content: "", deleted: true });
-      continue;
+    throw last;
+  }
+  post(path, body, timeoutMs) {
+    return this.request("POST", path, body, timeoutMs);
+  }
+  async request(method, path, body, timeoutMs, outer) {
+    const signals = [AbortSignal.timeout(timeoutMs), ...outer ? [outer] : []];
+    const signal = signals.length > 1 ? anySignal(signals) : signals[0];
+    let res;
+    try {
+      res = await this.fetchImpl(this.root + path, {
+        method,
+        headers: this.headers(body !== void 0),
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal
+      });
+    } catch (e) {
+      throw new TransportError(`${method} ${routeLabel(path)} failed: ${e.name}`, null, true);
     }
-    if (c.binary) {
-      out2.skipped.push({ path: c.path, reason: "binary" });
-      continue;
+    if (this.gone.has(res.status)) {
+      await res.body?.cancel().catch(() => void 0);
+      throw new SessionGoneError(res.status);
     }
-    const r = await prText((0, import_path2.join)(root, c.path));
-    if ("content" in r) out2.files.push({ path: c.path, content: r.content });
-    else if (r.reason === "missing") out2.files.push({ path: c.path, content: "", deleted: true });
-    else out2.skipped.push({ path: c.path, reason: r.reason });
-  }
-  const changed = new Set(changes.map((c) => c.path));
-  for (const path of published) {
-    if (changed.has(path) || !path || path.startsWith("/") || path.split("/").includes("..")) continue;
-    if (scope?.prefix && !path.startsWith(`${scope.prefix}/`)) continue;
-    const buf = await gitBuffer(["show", `${base}:${path}`], { cwd: root, maxBuffer: 8 * 1024 * 1024, env: scope?.env }).catch(() => null);
-    if (buf === null) {
-      out2.files.push({ path, content: "", deleted: true });
-      continue;
+    if (!res.ok) {
+      const code = await res.text().then((t) => JSON.parse(t)?.code, () => void 0).catch(() => void 0);
+      const retryable = res.status === 429 || res.status >= 500;
+      const error = new TransportError(`${method} ${routeLabel(path)} answered ${res.status}`, res.status, retryable);
+      if (typeof code === "string" && /^[A-Z_]{3,80}$/.test(code)) error.code = code;
+      throw error;
+    }
+    if (res.status === 204) return void 0;
+    const text3 = await res.text();
+    if (!text3) return void 0;
+    try {
+      return JSON.parse(text3);
+    } catch {
+      throw new TransportError(`${method} ${routeLabel(path)} returned invalid JSON`, res.status, false);
     }
-    const content = buf.toString("utf8");
-    if (buf.includes(0) || Buffer.byteLength(content, "utf8") !== buf.length) {
-      out2.skipped.push({ path, reason: "binary" });
-      continue;
+  }
+};
+function anySignal(signals) {
+  const native = AbortSignal.any;
+  if (typeof native === "function") return native.call(AbortSignal, signals);
+  const ac = new AbortController();
+  for (const s of signals) {
+    if (s.aborted) {
+      ac.abort(s.reason);
+      return ac.signal;
     }
-    out2.files.push({ path, content });
+    s.addEventListener("abort", () => ac.abort(s.reason), { once: true });
   }
-  return out2;
+  return ac.signal;
 }
-async function resolveInside(root, p) {
-  if (!p || p.includes("\0")) return null;
-  const abs = (0, import_path2.resolve)(root, p);
-  const realRoot = await (0, import_promises2.realpath)(root).catch(() => (0, import_path2.resolve)(root));
-  let probe = abs;
-  while (!(0, import_fs2.existsSync)(probe) && (0, import_path2.dirname)(probe) !== probe) probe = (0, import_path2.dirname)(probe);
-  const realProbe = await (0, import_promises2.realpath)(probe).catch(() => probe);
-  const rest = (0, import_path2.relative)(probe, abs);
-  const finalPath = rest ? (0, import_path2.join)(realProbe, rest) : realProbe;
-  if (finalPath !== realRoot && !finalPath.startsWith(realRoot + import_path2.sep)) return null;
-  return finalPath;
+function routeLabel(path) {
+  return path.split("?")[0];
 }
-async function discardPath(root, base, relPath) {
-  if ((0, import_path2.isAbsolute)(relPath)) relPath = (0, import_path2.relative)(root, relPath);
-  const abs = await resolveInside(root, relPath);
-  if (!abs) throw new Error("PATH_OUTSIDE_WORKSPACE");
-  const rel = (0, import_path2.relative)(await (0, import_promises2.realpath)(root).catch(() => root), abs).split(import_path2.sep).join("/");
-  if (rel === "" || rel === ".git" || rel.startsWith(".git/")) throw new Error("PATH_NOT_DISCARDABLE");
-  const existed = await git(["cat-file", "-e", `${base}:${rel}`], { cwd: root }).then(() => true, () => false);
-  if (existed) {
-    await git(["checkout", base, "--", rel], { cwd: root });
-    await git(["reset", "-q", "--", rel], { cwd: root }).catch(() => void 0);
-    return "restored";
-  }
-  await (0, import_promises2.rm)(abs, { recursive: true, force: true });
-  await git(["rm", "-q", "--cached", "--ignore-unmatch", "--", rel], { cwd: root }).catch(() => void 0);
-  return "removed";
+function sleep(ms, signal) {
+  return new Promise((resolve8) => {
+    const t = setTimeout(resolve8, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(t);
+      resolve8();
+    }, { once: true });
+  });
 }
-function truncateUtf8(s, maxBytes) {
-  if (maxBytes <= 0) return "";
-  const buf = Buffer.from(s, "utf8");
-  if (buf.length <= maxBytes) return s;
-  let end = maxBytes;
-  while (end > 0 && (buf[end] & 192) === 128) end--;
-  return buf.subarray(0, end).toString("utf8");
+var ENGINE_FEATURES = ["message_queue_v1"];
+function toSessionBootstrap(raw) {
+  if (raw && raw.repo && !raw.repository) return raw;
+  const session = raw?.session ?? {};
+  const repository = raw?.repository && typeof raw.repository === "object" ? raw.repository : null;
+  const runtime = raw?.runtime ?? {};
+  const text3 = (v, fallback = "") => typeof v === "string" ? v : fallback;
+  const defaultBranch = text3(repository?.defaultBranch, "main");
+  const repo2 = repository ? {
+    cloneUrl: text3(repository.cloneUrl),
+    scheme: text3(repository.scheme),
+    token: text3(repository.token),
+    provider: text3(repository.provider, text3(session.provider)),
+    repoFullName: text3(repository.repoFullName, text3(session.repoFullName)),
+    defaultBranch
+  } : null;
+  const repositories = scopeRepos(raw?.repositories) ?? scopeRepos(session.scope?.repos) ?? (repo2 ? [{ repoFullName: repo2.repoFullName, provider: repo2.provider, projectId: text3(session.projectId), defaultBranch: repo2.defaultBranch }] : []);
+  const rawScope = session.scope && typeof session.scope === "object" ? session.scope : null;
+  const kind = rawScope?.kind === "ALL" || rawScope?.kind === "TEAM" || rawScope?.kind === "BUSINESS_AREA" ? rawScope.kind : "PROJECTS";
+  return {
+    repo: repo2,
+    repositories,
+    scope: {
+      kind,
+      teamId: typeof rawScope?.teamId === "string" ? rawScope.teamId : null,
+      projectIds: Array.isArray(rawScope?.projectIds) ? rawScope.projectIds.filter((p) => typeof p === "string") : typeof session.projectId === "string" && session.projectId ? [session.projectId] : [],
+      repos: repositories
+    },
+    branch: text3(session.branch, repo2 ? defaultBranch : ""),
+    projectId: text3(session.projectId),
+    model: text3(session.model, "sq-auto"),
+    runtime: {
+      baseUrl: text3(runtime.baseUrl),
+      token: text3(runtime.token),
+      models: runtime.models,
+      primaryModel: typeof runtime.primaryModel === "string" ? runtime.primaryModel : null,
+      fastModel: typeof runtime.fastModel === "string" ? runtime.fastModel : null,
+      maxOutputTokens: typeof runtime.maxOutputTokens === "number" ? runtime.maxOutputTokens : null,
+      maxOutputTokensCeiling: typeof runtime.maxOutputTokensCeiling === "number" ? runtime.maxOutputTokensCeiling : null,
+      reasoning: parseReasoningCapability(runtime.reasoning),
+      aliases: Array.isArray(runtime.aliases) ? runtime.aliases.filter((a) => typeof a?.alias === "string").map(credentialAlias) : void 0,
+      protections: protectionsWireOf(runtime.protections)
+    },
+    reasoning: isReasoningLevel(session.reasoning) ? session.reasoning : null,
+    imported: importedInfo(session.imported),
+    checkpointPatch: typeof raw?.checkpointPatch === "string" ? raw.checkpointPatch : null,
+    sdkSessionId: typeof session.sdkSessionId === "string" ? session.sdkSessionId : null,
+    workspaceKind: session.workspaceKind === "LOCAL" ? "LOCAL" : "CLOUD",
+    projectName: typeof session.projectName === "string" ? session.projectName : typeof raw?.project?.name === "string" ? raw.project.name : null,
+    folderLink: typeof session.folderLink?.projectId === "string" && session.folderLink.projectId ? { projectId: session.folderLink.projectId } : null,
+    transcript: transcriptOf(raw?.transcript),
+    baseMeasurements: raw?.baseMeasurements && typeof raw.baseMeasurements === "object" && !Array.isArray(raw.baseMeasurements) ? raw.baseMeasurements : {},
+    pullRequests: pullRequestsOf(raw?.pullRequests),
+    skills: skillsOf(raw?.skills),
+    plugins: pluginsOf(raw?.plugins),
+    environments: environmentsOf(raw?.environments)
+  };
 }
-function tailUtf8(s, maxBytes) {
-  const buf = Buffer.from(s, "utf8");
-  if (buf.length <= maxBytes) return s;
-  let start = buf.length - maxBytes;
-  while (start < buf.length && (buf[start] & 192) === 128) start++;
-  return buf.subarray(start).toString("utf8");
+function transcriptOf(raw) {
+  const t = raw;
+  if (!t || typeof t !== "object" || typeof t.sdkSessionId !== "string" || t.encoding !== "gzip-base64" || typeof t.data !== "string") return null;
+  return { sdkSessionId: t.sdkSessionId, encoding: "gzip-base64", data: t.data, bytes: typeof t.bytes === "number" ? t.bytes : 0, sha256: typeof t.sha256 === "string" ? t.sha256 : "" };
 }
-function parseHunks(path, patch) {
-  const out2 = [];
-  let current = null;
-  for (const line of patch.split("\n")) {
-    const m = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/.exec(line);
-    if (m) {
-      current = {
-        hash: "",
-        header: line,
-        lines: [],
-        oldStart: Number(m[1]),
-        oldLines: m[2] === void 0 ? 1 : Number(m[2]),
-        newStart: Number(m[3]),
-        newLines: m[4] === void 0 ? 1 : Number(m[4])
-      };
-      out2.push(current);
-      continue;
-    }
-    if (!current) continue;
-    if (line.startsWith(" ") || line.startsWith("+") || line.startsWith("-") || line.startsWith("\\")) current.lines.push(line);
-  }
-  const seen = /* @__PURE__ */ new Map();
-  for (const h of out2) {
-    const base = (0, import_crypto.createHash)("sha256").update(`${path}
-${h.lines.join("\n")}`).digest("hex").slice(0, 16);
-    const n = (seen.get(base) ?? 0) + 1;
-    seen.set(base, n);
-    h.hash = n === 1 ? base : `${base}-${n}`;
+var strings = (v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).filter(([, x]) => typeof x === "string")) : {};
+function environmentsOf(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((e) => !!e && typeof e === "object" && typeof e.projectId === "string").slice(0, 50).map((e) => ({ projectId: e.projectId, setupCommand: typeof e.setupCommand === "string" && e.setupCommand.trim() ? e.setupCommand : null, env: strings(e.env), secrets: strings(e.secrets) }));
+}
+function pluginsOf(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((p) => !!p && typeof p === "object" && typeof p.name === "string" && Array.isArray(p.files)).slice(0, 20).map((p) => ({ name: p.name, files: p.files.filter((f) => !!f && typeof f.path === "string" && typeof f.content === "string").slice(0, 300) }));
+}
+function skillsOf(raw) {
+  if (!Array.isArray(raw)) return [];
+  return raw.filter((s) => !!s && typeof s === "object").filter((s) => typeof s.name === "string" && typeof s.body === "string").slice(0, 200).map((s) => ({
+    name: s.name,
+    description: typeof s.description === "string" ? s.description : "",
+    body: s.body,
+    argumentHint: typeof s.argumentHint === "string" ? s.argumentHint : null
+  }));
+}
+function pullRequestsOf(raw) {
+  const out2 = {};
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return out2;
+  for (const [repo2, v] of Object.entries(raw)) {
+    if (!v || typeof v.branch !== "string") continue;
+    out2[repo2] = {
+      branch: v.branch,
+      number: typeof v.number === "number" ? v.number : null,
+      url: typeof v.url === "string" ? v.url : null,
+      files: Array.isArray(v.files) ? v.files.filter((f) => typeof f === "string") : []
+    };
   }
   return out2;
 }
-async function discardHunk(root, base, relPath, hash, scope) {
-  const abs = await resolveInside(root, relPath);
-  if (!abs) throw new Error("PATH_OUTSIDE_WORKSPACE");
-  const rel = (0, import_path2.relative)(await (0, import_promises2.realpath)(root).catch(() => root), abs).split(import_path2.sep).join("/");
-  if (rel === "" || rel === ".git" || rel.startsWith(".git/")) throw new Error("PATH_NOT_DISCARDABLE");
-  return withWorktreeIndex(root, async (env) => {
-    const patch = await git(["diff", "--cached", "--no-renames", "--no-color", base, "--", rel], { cwd: root, env });
-    if (!patch) return "not_found";
-    const hunk = parseHunks(rel, patch).find((h) => h.hash === hash);
-    if (!hunk) return "not_found";
-    const headerEnd = patch.indexOf("\n@@");
-    const fileHeader = patch.slice(0, headerEnd + 1);
-    const one = `${fileHeader}${hunk.header}
-${hunk.lines.join("\n")}
-`;
-    const file = (0, import_path2.join)((0, import_os.tmpdir)(), `sq-hunk-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}.patch`);
-    await (0, import_promises2.writeFile)(file, one, "utf8");
-    try {
-      await git(["apply", "-R", "--whitespace=nowarn", file], { cwd: root, env: scope?.env });
-    } finally {
-      await (0, import_promises2.rm)(file, { force: true }).catch(() => void 0);
-    }
-    return "discarded";
-  }, scope);
+function importedInfo(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const r = raw;
+  if (r.source !== "CLAUDE_CODE" && r.source !== "CODEX" || !isExternalId(r.externalId)) return null;
+  return {
+    source: r.source,
+    externalId: r.externalId,
+    title: typeof r.title === "string" ? r.title : "",
+    folder: typeof r.folder === "string" ? r.folder : null,
+    messageCount: typeof r.messageCount === "number" ? r.messageCount : 0,
+    nativeResume: r.nativeResume === true
+  };
 }
-async function restoreTree(root, treeId, scope) {
-  if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(treeId)) throw new Error("INVALID_TREE");
-  await withWorktreeIndex(root, async (env) => {
-    const now = (await git(["write-tree"], { cwd: root, env })).trim();
-    const added = await git(["diff", "--no-renames", "--name-only", "-z", "--diff-filter=A", treeId, now, ...scopeSpec(scope)], { cwd: root, env });
-    for (const rel of added.split("\0").filter(Boolean)) {
-      const abs = await resolveInside(root, rel);
-      if (abs) await (0, import_promises2.rm)(abs, { force: true });
-    }
-    if (scope?.prefix) {
-      await git(["checkout", treeId, "--", scope.prefix], { cwd: root, env }).catch(() => void 0);
-      return;
-    }
-    await git(["read-tree", treeId], { cwd: root, env });
-    await git(["checkout-index", "-a", "-f"], { cwd: root, env });
-  }, scope);
+function scopeRepos(raw) {
+  if (!Array.isArray(raw)) return null;
+  return raw.filter((r) => r && typeof r === "object" && typeof r.repoFullName === "string").map((r) => ({
+    repoFullName: r.repoFullName,
+    provider: typeof r.provider === "string" ? r.provider : "",
+    projectId: typeof r.projectId === "string" ? r.projectId : "",
+    defaultBranch: typeof r.defaultBranch === "string" ? r.defaultBranch : null
+  }));
+}
+function orgMcpCatalogOf(raw) {
+  const r = raw ?? {};
+  const servers = (Array.isArray(r.servers) ? r.servers : []).filter((s) => !!s && typeof s === "object" && typeof s.server === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(s.server)).slice(0, 20).map((s) => ({
+    server: s.server,
+    description: typeof s.description === "string" ? s.description : null,
+    approval: typeof s.approval === "string" ? s.approval : "WRITE",
+    tools: (Array.isArray(s.tools) ? s.tools : []).filter((t) => !!t && typeof t === "object" && typeof t.name === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(t.name)).slice(0, 100).map((t) => ({
+      name: t.name,
+      description: typeof t.description === "string" ? t.description : "",
+      inputSchema: t.inputSchema && typeof t.inputSchema === "object" && !Array.isArray(t.inputSchema) ? t.inputSchema : { type: "object" },
+      readOnly: t.readOnly === true
+    }))
+  }));
+  const unavailable = (Array.isArray(r.unavailable) ? r.unavailable : []).filter((u) => !!u && typeof u.server === "string").map((u) => ({ server: String(u.server).slice(0, 32), error: typeof u.error === "string" ? u.error.slice(0, 60) : "MCP_FAILED" }));
+  return { servers, unavailable };
 }
 
+// src/application/services/workspaceSandbox/localWorkspace.ts
+var import_promises6 = require("fs/promises");
+var import_os3 = require("os");
+var import_path5 = require("path");
+
 // src/application/services/workspaceSandbox/localTracking.ts
-var posix = (p) => p.split(import_path3.sep).join("/");
+var import_crypto2 = require("crypto");
+var import_fs4 = require("fs");
+var import_promises5 = require("fs/promises");
+var import_os2 = require("os");
+var import_path4 = require("path");
+var posix = (p) => p.split(import_path4.sep).join("/");
 function underPrefix(path, prefix) {
   if (!prefix) return true;
   const clean = path.replace(/^\/+/, "");
@@ -1428,14 +2314,14 @@ async function discoverRepositories(root, limits = {}) {
         const children = [];
         let isRepo = false;
         try {
-          const d = await (0, import_promises3.opendir)(dir);
+          const d = await (0, import_promises5.opendir)(dir);
           for await (const e of d) {
             if (e.name === ".git") {
               isRepo = true;
               continue;
             }
             if (!e.isDirectory() || e.name.startsWith(".") || DISCOVERY_SKIP.has(e.name)) continue;
-            children.push((0, import_path3.join)(dir, e.name));
+            children.push((0, import_path4.join)(dir, e.name));
           }
         } catch {
           continue;
@@ -1476,7 +2362,7 @@ async function repoFingerprint(root) {
     const r = recs[i];
     if (!r || r.length < 4) continue;
     n++;
-    const st = await (0, import_promises3.stat)((0, import_path3.join)(root, r.slice(3))).catch(() => null);
+    const st = await (0, import_promises5.stat)((0, import_path4.join)(root, r.slice(3))).catch(() => null);
     h.update(`\0${st ? `${st.size}:${st.mtimeMs}` : "-"}`);
     if (r[0] === "R" || r[0] === "C") i++;
   }
@@ -1497,13 +2383,13 @@ var LooseFileTracker = class {
     return this.o.root;
   }
   get gitDir() {
-    return (0, import_path3.join)(this.o.stateDir, "shadow.git");
+    return (0, import_path4.join)(this.o.stateDir, "shadow.git");
   }
   get baseIndex() {
-    return (0, import_path3.join)(this.o.stateDir, "base.index");
+    return (0, import_path4.join)(this.o.stateDir, "base.index");
   }
   get manifest() {
-    return (0, import_path3.join)(this.o.stateDir, "manifest.json");
+    return (0, import_path4.join)(this.o.stateDir, "manifest.json");
   }
   get env() {
     return { GIT_DIR: this.gitDir, GIT_WORK_TREE: this.o.root };
@@ -1513,8 +2399,8 @@ var LooseFileTracker = class {
     return this.entries.map((e) => e.path);
   }
   async init() {
-    await (0, import_promises3.mkdir)(this.o.stateDir, { recursive: true, mode: 448 });
-    if (!(0, import_fs3.existsSync)((0, import_path3.join)(this.gitDir, "HEAD"))) {
+    await (0, import_promises5.mkdir)(this.o.stateDir, { recursive: true, mode: 448 });
+    if (!(0, import_fs4.existsSync)((0, import_path4.join)(this.gitDir, "HEAD"))) {
       await git(["init", "-q", "--bare", this.gitDir], { cwd: this.o.stateDir });
       for (const [k, v] of [
         ["core.bare", "false"],
@@ -1527,7 +2413,7 @@ var LooseFileTracker = class {
         await git(["config", k, v], { cwd: this.o.stateDir, env: { GIT_DIR: this.gitDir } });
       }
     }
-    const saved = await (0, import_promises3.readFile)(this.manifest, "utf8").then((t) => JSON.parse(t), () => null);
+    const saved = await (0, import_promises5.readFile)(this.manifest, "utf8").then((t) => JSON.parse(t), () => null);
     if (saved?.version === 1 && saved.root === this.o.root && Array.isArray(saved.entries)) {
       this.entries = saved.entries.filter((e) => e && typeof e.path === "string" && typeof e.existed === "boolean");
     }
@@ -1539,12 +2425,12 @@ var LooseFileTracker = class {
     return next;
   }
   async track(abs) {
-    const rel = (0, import_path3.relative)(this.o.root, abs);
-    if (!rel || rel.startsWith("..") || (0, import_path3.isAbsolute)(rel)) return;
+    const rel = (0, import_path4.relative)(this.o.root, abs);
+    if (!rel || rel.startsWith("..") || (0, import_path4.isAbsolute)(rel)) return;
     const path = posix(rel);
     if (path.split("/").includes(".git") || this.entries.some((e) => e.path === path) || this.skipped.has(path)) return;
-    if (this.o.excluded().some((r) => abs === r || abs.startsWith(r + import_path3.sep))) return;
-    const st = await (0, import_promises3.lstat)(abs).catch(() => null);
+    if (this.o.excluded().some((r) => abs === r || abs.startsWith(r + import_path4.sep))) return;
+    const st = await (0, import_promises5.lstat)(abs).catch(() => null);
     if (st && !st.isFile()) return;
     if (st && st.size > (this.o.maxBytes ?? LOOSE_FILE_MAX_BYTES)) {
       this.skipped.add(path);
@@ -1562,8 +2448,8 @@ var LooseFileTracker = class {
   async persist() {
     const tmp = `${this.manifest}.${process.pid}.tmp`;
     const data = { version: 1, root: this.o.root, entries: this.entries };
-    await (0, import_promises3.writeFile)(tmp, JSON.stringify(data), { mode: 384 });
-    await (0, import_promises3.rename)(tmp, this.manifest);
+    await (0, import_promises5.writeFile)(tmp, JSON.stringify(data), { mode: 384 });
+    await (0, import_promises5.rename)(tmp, this.manifest);
   }
   /** Waits for the copies in progress. */
   settled() {
@@ -1577,8 +2463,8 @@ var LooseFileTracker = class {
   scope() {
     return {
       env: this.env,
-      index: (0, import_fs3.existsSync)(this.baseIndex) ? this.baseIndex : null,
-      paths: this.entries.filter((e) => e.existed || (0, import_fs3.existsSync)((0, import_path3.join)(this.o.root, e.path))).map((e) => e.path)
+      index: (0, import_fs4.existsSync)(this.baseIndex) ? this.baseIndex : null,
+      paths: this.entries.filter((e) => e.existed || (0, import_fs4.existsSync)((0, import_path4.join)(this.o.root, e.path))).map((e) => e.path)
     };
   }
   entry(path) {
@@ -1600,546 +2486,284 @@ var LooseFileTracker = class {
     if (e.existed) {
       await git(["checkout-index", "-f", "--", e.path], { cwd: this.o.root, env: { ...this.env, GIT_INDEX_FILE: this.baseIndex, GIT_LITERAL_PATHSPECS: "1" } });
     } else {
-      await (0, import_promises3.rm)(abs, { force: true });
-    }
-  }
-  async discardHunk(path, hash) {
-    await this.chain;
-    const e = this.entry(path);
-    return discardHunk(this.o.root, await this.baseTree(), e.path, hash, this.scope());
-  }
-  /** The files as they are now, and how many files were tracked then. */
-  async snapshot() {
-    await this.chain;
-    if (!this.entries.length) return JSON.stringify({ t: null, n: 0 });
-    return JSON.stringify({ t: await worktreeTreeId(this.o.root, this.scope()), n: this.entries.length });
-  }
-  /**
-   * Back to a snapshot: the files tracked then return to their content then;
-   * the ones first changed later return to their copy (that was their content
-   * then, since the session had not touched them).
-   */
-  async restore(snapshot) {
-    await this.chain;
-    const snap = JSON.parse(snapshot);
-    if (!this.entries.length) return;
-    const idx = (0, import_path3.join)((0, import_os2.tmpdir)(), `sq-loose-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`);
-    const env = { ...this.env, GIT_INDEX_FILE: idx };
-    let target;
-    try {
-      if (snap.t) await git(["read-tree", snap.t], { cwd: this.o.root, env });
-      else await git(["read-tree", "--empty"], { cwd: this.o.root, env });
-      for (const e of this.entries.slice(snap.n)) {
-        if (!e.existed) continue;
-        const line = (await git(["ls-files", "-s", "--", e.path], { cwd: this.o.root, env: { ...this.env, GIT_INDEX_FILE: this.baseIndex, GIT_LITERAL_PATHSPECS: "1" } })).trim();
-        const m = /^(\d+) ([0-9a-f]+) \d\t/.exec(line);
-        if (m) await git(["update-index", "--add", "--cacheinfo", `${m[1]},${m[2]},${e.path}`], { cwd: this.o.root, env });
-      }
-      target = (await git(["write-tree"], { cwd: this.o.root, env })).trim();
-    } finally {
-      await (0, import_promises3.rm)(idx, { force: true }).catch(() => void 0);
-    }
-    await restoreTree(this.o.root, target, this.scope());
-  }
-  async checkpoint() {
-    await this.chain;
-    if (!this.entries.length) return "";
-    return checkpointPatch(this.o.root, await this.baseTree(), this.scope());
-  }
-  async prFiles(published) {
-    await this.chain;
-    if (!this.entries.length && !published.length) return { files: [], skipped: [] };
-    return filesForPullRequest(this.o.root, await this.baseTree(), published, this.scope());
-  }
-  async treeId() {
-    await this.chain;
-    return this.entries.length ? worktreeTreeId(this.o.root, this.scope()) : null;
-  }
-};
-var SESSION_STATE_MAX_AGE_MS = 30 * 24 * 60 * 6e4;
-async function pruneSessionStates(parent, keep, now = Date.now(), maxAgeMs = SESSION_STATE_MAX_AGE_MS) {
-  const removed = [];
-  for (const name of await (0, import_promises3.readdir)(parent).catch(() => [])) {
-    const dir = (0, import_path3.join)(parent, name);
-    if (dir === keep) continue;
-    const st = await (0, import_promises3.stat)((0, import_path3.join)(dir, "manifest.json")).catch(() => null) ?? await (0, import_promises3.stat)(dir).catch(() => null);
-    if (!st || now - st.mtimeMs < maxAgeMs) continue;
-    await (0, import_promises3.rm)(dir, { recursive: true, force: true }).catch(() => void 0);
-    removed.push(name);
-  }
-  return removed;
-}
-
-// src/application/services/workspaceSandbox/localWorkspace.ts
-var EMPTY_TREE = {
-  sha1: "4b825dc642cb6eb9a060e54bf8d69288fbee4904",
-  sha256: "6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321"
-};
-var LocalWorkspaceError = class extends Error {
-  constructor(code, publicMessage) {
-    super(publicMessage);
-    this.code = code;
-    this.publicMessage = publicMessage;
-    this.name = "LocalWorkspaceError";
-  }
-  code;
-  publicMessage;
-};
-async function localFolderRoot(dir) {
-  const abs = (0, import_path4.resolve)(dir);
-  const st = await (0, import_promises4.stat)(abs).catch(() => null);
-  if (!st || !st.isDirectory()) throw new LocalWorkspaceError("FOLDER_NOT_FOUND", `The folder ${abs} does not exist.`);
-  return (0, import_promises4.realpath)(abs);
-}
-var posix2 = (p) => p.split(import_path4.sep).join("/");
-async function enclosingRepository(root) {
-  let missing = false;
-  const top = await git(["rev-parse", "--show-toplevel"], { cwd: root }).then((o) => o.trim(), (e) => {
-    if (e?.code === "ENOENT") missing = true;
-    return "";
-  });
-  if (missing) return "gitMissing";
-  if (!top) return null;
-  const realTop = await (0, import_promises4.realpath)(top).catch(() => top);
-  if (realTop === root) return { top: realTop, prefix: "" };
-  const prefix = posix2((0, import_path4.relative)(realTop, root));
-  if (!prefix || prefix.startsWith("..")) return null;
-  const env = { GIT_LITERAL_PATHSPECS: "1" };
-  const inHead = (await git(["ls-tree", "-d", "--name-only", "HEAD", "--", prefix], { cwd: realTop, env }).catch(() => "")).trim().length > 0;
-  if (inHead) return { top: realTop, prefix };
-  const home = await (0, import_promises4.realpath)((0, import_os3.homedir)()).catch(() => (0, import_os3.homedir)());
-  if (realTop === home || (0, import_path4.relative)(realTop, home).split(import_path4.sep)[0] !== "..") return null;
-  const ignored = await git(["check-ignore", "-q", "--", prefix], { cwd: realTop, env }).then(() => true, () => false);
-  return ignored ? null : { top: realTop, prefix };
-}
-async function repoHead(top) {
-  const head = (await git(["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: top }).catch(() => "")).trim();
-  let baseRevision = head;
-  let baseKind = "commit";
-  if (!head) {
-    const format = (await git(["rev-parse", "--show-object-format"], { cwd: top }).catch(() => "sha1")).trim();
-    baseRevision = EMPTY_TREE[format] ?? EMPTY_TREE.sha1;
-    baseKind = "empty-tree";
-  }
-  const branch2 = (await git(["symbolic-ref", "--short", "-q", "HEAD"], { cwd: top }).catch(() => "")).trim() || null;
-  const originUrl = (await git(["config", "--get", "remote.origin.url"], { cwd: top }).catch(() => "")).trim() || null;
-  return { baseRevision, baseKind, branch: branch2, originUrl: originUrl ? stripUserinfo(originUrl) : null };
-}
-async function nestedRepo(folder, dir) {
-  const real = await (0, import_promises4.realpath)(dir).catch(() => null);
-  if (!real) return null;
-  const top = (await git(["rev-parse", "--show-toplevel"], { cwd: real }).catch(() => "")).trim();
-  if (!top || await (0, import_promises4.realpath)(top).catch(() => top) !== real) return null;
-  return { root: real, rel: posix2((0, import_path4.relative)(folder, real)), ...await repoHead(real) };
-}
-async function inspectLocalFolder(dir, opts = {}) {
-  const root = await localFolderRoot(dir);
-  const owner = await enclosingRepository(root);
-  if (owner === null || owner === "gitMissing") {
-    const gitAvailable = owner !== "gitMissing";
-    const found = gitAvailable ? await discoverRepositories(root, opts.discovery) : { repos: [], truncated: false, scannedDirs: 0 };
-    const repos = (await mapLimit(found.repos, 8, (d) => nestedRepo(root, d).catch(() => null))).filter((r) => !!r);
-    return {
-      kind: "folder",
-      root,
-      repoRoot: null,
-      prefix: "",
-      baseRevision: "",
-      baseKind: "commit",
-      branch: null,
-      changedAtStart: 0,
-      originUrl: null,
-      headOnRemote: null,
-      repos,
-      reposTruncated: found.truncated,
-      gitAvailable
-    };
-  }
-  const { top, prefix } = owner;
-  const head = await repoHead(top);
-  const status = await git(
-    ["--no-optional-locks", "status", "--porcelain", "-z", "--untracked-files=all", ...prefix ? ["--", prefix] : []],
-    { cwd: top, timeoutMs: 5 * 6e4, env: { GIT_LITERAL_PATHSPECS: "1" } }
-  ).catch(() => "");
-  const changedAtStart = countPorcelainZ(status);
-  let headOnRemote = null;
-  const anyRemoteBranch = (await git(["branch", "-r"], { cwd: top }).catch(() => "")).trim().length > 0;
-  if (head.baseKind === "commit" && anyRemoteBranch) {
-    const remotes = await git(["branch", "-r", "--contains", head.baseRevision], { cwd: top }).catch(() => null);
-    headOnRemote = remotes === null ? null : remotes.trim().length > 0;
-  }
-  return { kind: prefix ? "subfolder" : "repo", root, repoRoot: top, prefix, ...head, changedAtStart, headOnRemote, repos: [], reposTruncated: false, gitAvailable: true };
-}
-function countPorcelainZ(out2) {
-  const recs = out2.split("\0");
-  let n = 0;
-  for (let i = 0; i < recs.length; i++) {
-    const r = recs[i];
-    if (!r || r.length < 4) continue;
-    n++;
-    if (r[0] === "R" || r[0] === "C") i++;
-  }
-  return n;
-}
-function remotePathSegments(url) {
-  const u = url.trim();
-  const scp = /^(?:[^@\s/]+@)?([^:\s/]+):(?!\/\/)(.+)$/.exec(u);
-  let host = "";
-  let path = u;
-  if (scp && !/^[a-z][a-z0-9+.-]*:\/\//i.test(u)) {
-    host = scp[1];
-    path = scp[2];
-  } else {
-    try {
-      const parsed = new URL(u);
-      host = parsed.hostname;
-      path = parsed.pathname;
-    } catch {
-      path = u;
-    }
-  }
-  const segments2 = path.split("/").map((s) => {
-    try {
-      return decodeURIComponent(s);
-    } catch {
-      return s;
+      await (0, import_promises5.rm)(abs, { force: true });
     }
-  }).map((s) => s.toLowerCase().replace(/\.git$/, "")).filter((s) => s && s !== "_git" && s !== "v3");
-  return { host: host.toLowerCase(), segments: segments2 };
-}
-var PROVIDER_HOSTS = [[/github/, "GITHUB"], [/gitlab/, "GITLAB"], [/bitbucket/, "BITBUCKET"], [/(dev\.azure|visualstudio)/, "AZURE"]];
-function matchRemoteToScope(originUrl, repos) {
-  if (!originUrl) return null;
-  const { host, segments: segments2 } = remotePathSegments(originUrl);
-  if (!segments2.length) return null;
-  const provider = PROVIDER_HOSTS.find(([re]) => re.test(host))?.[1] ?? null;
-  let best = [];
-  let bestLen = 0;
-  for (const r of repos) {
-    const rs = r.repoFullName.toLowerCase().split("/").map((s) => s.replace(/\.git$/, "")).filter(Boolean);
-    if (!rs.length || rs.length > segments2.length) continue;
-    const offset = segments2.length - rs.length;
-    if (!rs.every((s, i) => s === segments2[offset + i])) continue;
-    if (rs.length > bestLen) {
-      best = [r];
-      bestLen = rs.length;
-    } else if (rs.length === bestLen) best.push(r);
-  }
-  if (best.length > 1 && provider) best = best.filter((r) => r.provider.toUpperCase().startsWith(provider));
-  return best.length === 1 ? best[0] : null;
-}
-function localFolderRepo(originUrl, repos, linkedProjectId) {
-  const linked = linkedProjectId ? repos.filter((r) => r.projectId === linkedProjectId) : [];
-  if (linked.length) return { repo: matchRemoteToScope(originUrl, linked) ?? (linked.length === 1 ? linked[0] : null), linked };
-  return { repo: matchRemoteToScope(originUrl, repos), linked: [] };
-}
-function bootScopeRepos(boot) {
-  if (boot.scope?.repos) return boot.scope.repos;
-  if (boot.repositories) return boot.repositories;
-  return boot.repo ? [{ repoFullName: boot.repo.repoFullName, provider: boot.repo.provider, projectId: boot.projectId, defaultBranch: boot.repo.defaultBranch }] : [];
-}
-function stripUserinfo(url) {
-  return url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]+@/i, "$1");
-}
-async function prepareLocalWorkspace(dir, _boot, onStep) {
-  const t0 = Date.now();
-  onStep?.("Reading the local folder");
-  const local = await inspectLocalFolder(dir);
-  return {
-    baseRevision: local.baseRevision,
-    baseKind: local.baseKind,
-    branch: local.branch ?? "HEAD",
-    restore: "none",
-    originUrl: local.originUrl,
-    timings: { local_folder: Date.now() - t0 },
-    local
-  };
-}
-function localWarnings(local, boot) {
-  const out2 = [];
-  if (local.kind === "folder") {
-    if (local.reposTruncated) out2.push(`The folder is large: the repositories inside it were looked for up to ${DISCOVERY_LIMITS.maxDepth} levels down, for a few seconds. Others are still available; their changes are tracked when you edit them here.`);
-    return out2;
   }
-  const { repo: match, linked } = localFolderRepo(local.originUrl, bootScopeRepos(boot), boot.folderLink?.projectId);
-  const sessionBranch = match ? boot.repo?.repoFullName === match.repoFullName ? boot.branch || boot.repo.defaultBranch : match.defaultBranch : null;
-  if (sessionBranch && local.branch && local.branch !== sessionBranch) {
-    out2.push(`This folder is on branch "${local.branch}", and the session targets "${sessionBranch}". A pull request is opened against "${sessionBranch}" and only when it is at the same commit as this folder.`);
+  async discardHunk(path, hash) {
+    await this.chain;
+    const e = this.entry(path);
+    return discardHunk(this.o.root, await this.baseTree(), e.path, hash, this.scope());
   }
-  if (!local.branch) out2.push("This folder is on a detached HEAD.");
-  if (local.headOnRemote === false) out2.push("HEAD has commits that are not on any remote branch this folder knows about. Push them first if you plan to open a pull request from this session.");
-  if (local.changedAtStart > 0) out2.push(`${local.changedAtStart} file(s) already differ from HEAD. They are part of this session's change.`);
-  if (linked.length) {
-    if (!match) out2.push(`This folder is linked to a project with several repositories (${linked.map((r) => r.repoFullName).join(", ")}). A pull request names the one it goes to.`);
-    return out2;
+  /** The files as they are now, and how many files were tracked then. */
+  async snapshot() {
+    await this.chain;
+    if (!this.entries.length) return JSON.stringify({ t: null, n: 0 });
+    return JSON.stringify({ t: await worktreeTreeId(this.o.root, this.scope()), n: this.entries.length });
   }
-  if (local.originUrl && !match) {
-    out2.push(`The origin remote (${local.originUrl}) is not a repository in this session's scope. You can work on the code here; a pull request cannot be opened from this folder.`);
+  /**
+   * Back to a snapshot: the files tracked then return to their content then;
+   * the ones first changed later return to their copy (that was their content
+   * then, since the session had not touched them).
+   */
+  async restore(snapshot) {
+    await this.chain;
+    const snap = JSON.parse(snapshot);
+    if (!this.entries.length) return;
+    const idx = (0, import_path4.join)((0, import_os2.tmpdir)(), `sq-loose-${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`);
+    const env = { ...this.env, GIT_INDEX_FILE: idx };
+    let target;
+    try {
+      if (snap.t) await git(["read-tree", snap.t], { cwd: this.o.root, env });
+      else await git(["read-tree", "--empty"], { cwd: this.o.root, env });
+      for (const e of this.entries.slice(snap.n)) {
+        if (!e.existed) continue;
+        const line = (await git(["ls-files", "-s", "--", e.path], { cwd: this.o.root, env: { ...this.env, GIT_INDEX_FILE: this.baseIndex, GIT_LITERAL_PATHSPECS: "1" } })).trim();
+        const m = /^(\d+) ([0-9a-f]+) \d\t/.exec(line);
+        if (m) await git(["update-index", "--add", "--cacheinfo", `${m[1]},${m[2]},${e.path}`], { cwd: this.o.root, env });
+      }
+      target = (await git(["write-tree"], { cwd: this.o.root, env })).trim();
+    } finally {
+      await (0, import_promises5.rm)(idx, { force: true }).catch(() => void 0);
+    }
+    await restoreTree(this.o.root, target, this.scope());
   }
-  if (!local.originUrl) out2.push("This folder has no origin remote, so it is not matched to a repository in this session's scope. You can work on the code here; a pull request cannot be opened from this folder.");
-  return out2;
-}
-
-// src/application/services/workspaceSandbox/toolPolicy.ts
-var import_fs4 = require("fs");
-var import_promises6 = require("fs/promises");
-var import_path5 = require("path");
-
-// src/application/services/workspaceSandbox/webFetchGuard.ts
-var import_promises5 = require("dns/promises");
-var import_net = require("net");
-var defaultLookup = (host) => (0, import_promises5.lookup)(host, { all: true, verbatim: true });
-var ALLOWED_PORTS = /* @__PURE__ */ new Set(["", "80", "443", "8080", "8443"]);
-function v4Private(ip) {
-  const [a, b] = ip.split(".").map(Number);
-  return a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 || a === 198 && (b === 18 || b === 19);
-}
-function v6Private(ip) {
-  const s = ip.toLowerCase().replace(/^\[|\]$/g, "");
-  if (s === "::" || s === "::1") return true;
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(s);
-  if (mapped) return v4Private(mapped[1]);
-  const head = parseInt(s.split(":")[0] || "0", 16);
-  return (head & 65024) === 64512 || (head & 65472) === 65152 || (head & 65280) === 65280 || s.startsWith("fd00:ec2::");
-}
-function privateAddress(ip) {
-  const kind = (0, import_net.isIP)(ip.replace(/^\[|\]$/g, ""));
-  if (kind === 4) return v4Private(ip);
-  if (kind === 6) return v6Private(ip);
-  return true;
-}
-async function webFetchDenial(raw, resolve8 = defaultLookup) {
-  if (typeof raw !== "string" || !raw.trim()) return "WebFetch needs a URL.";
-  let url;
-  try {
-    url = new URL(raw.trim());
-  } catch {
-    return "WebFetch needs a valid http or https URL.";
+  async checkpoint() {
+    await this.chain;
+    if (!this.entries.length) return "";
+    return checkpointPatch(this.o.root, await this.baseTree(), this.scope());
   }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return "WebFetch reads only http and https pages.";
-  if (url.username || url.password) return "URLs with credentials cannot be fetched from the workspace.";
-  if (!ALLOWED_PORTS.has(url.port)) return "WebFetch reads public pages on the standard web ports only.";
-  const host = url.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (!host || host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal") || host.endsWith(".local")) {
-    return "Addresses of this machine or its private network cannot be fetched from the workspace.";
+  async prFiles(published) {
+    await this.chain;
+    if (!this.entries.length && !published.length) return { files: [], skipped: [] };
+    return filesForPullRequest(this.o.root, await this.baseTree(), published, this.scope());
   }
-  if ((0, import_net.isIP)(host)) return privateAddress(host) ? "Addresses of this machine or its private network cannot be fetched from the workspace." : null;
-  let addresses;
-  try {
-    addresses = await resolve8(host);
-  } catch {
-    return `The host ${host} could not be resolved.`;
+  async treeId() {
+    await this.chain;
+    return this.entries.length ? worktreeTreeId(this.o.root, this.scope()) : null;
   }
-  if (!addresses.length || addresses.some((a) => privateAddress(a.address))) {
-    return "Addresses of this machine or its private network cannot be fetched from the workspace.";
+};
+var SESSION_STATE_MAX_AGE_MS = 30 * 24 * 60 * 6e4;
+async function pruneSessionStates(parent, keep, now = Date.now(), maxAgeMs = SESSION_STATE_MAX_AGE_MS) {
+  const removed = [];
+  for (const name of await (0, import_promises5.readdir)(parent).catch(() => [])) {
+    const dir = (0, import_path4.join)(parent, name);
+    if (dir === keep) continue;
+    const st = await (0, import_promises5.stat)((0, import_path4.join)(dir, "manifest.json")).catch(() => null) ?? await (0, import_promises5.stat)(dir).catch(() => null);
+    if (!st || now - st.mtimeMs < maxAgeMs) continue;
+    await (0, import_promises5.rm)(dir, { recursive: true, force: true }).catch(() => void 0);
+    removed.push(name);
   }
-  return null;
+  return removed;
 }
 
-// src/application/services/workspaceSandbox/toolPolicy.ts
-var SQ_MCP_SERVER = "scalequality";
-var SQ_MCP_PREFIX = `mcp__${SQ_MCP_SERVER}__`;
-var DENIED_TOOLS = ["WebSearch", "RemoteTrigger", "CronCreate", "CronDelete", "CronList", "ScheduleWakeup", "PushNotification", "EnterWorktree", "ExitWorktree", "Artifact", "Workflow", "SendFeedback", "ClaudeDesign", "Projects"];
-var READ_TOOLS = { Read: "file_path", Glob: "path", Grep: "path", LS: "path" };
-var WRITE_TOOLS = { Write: "file_path", Edit: "file_path", MultiEdit: "file_path", NotebookEdit: "notebook_path" };
-var WRITE_TOOL_PATHS = WRITE_TOOLS;
-var HARMLESS = /* @__PURE__ */ new Set(["TodoWrite", "BashOutput", "KillShell", "TaskStop", "TaskOutput", "Skill"]);
-var SUBAGENT_TOOLS = /* @__PURE__ */ new Set(["Agent", "Task"]);
-var SQ_READ_ONLY = /* @__PURE__ */ new Set([
-  "get_project_measurement",
-  "get_measurement_findings",
-  "get_agent_options",
-  "get_agent_quote",
-  "get_pr_followup_status",
-  "get_agent_request",
-  "get_measurement_request",
-  "get_measurement_setup",
-  "explain_change_request",
-  "read_scalequality_guide",
-  "list_repositories",
-  "open_repository",
-  "measure_change"
-]);
-var BASH_MAX_TIMEOUT_MS = 10 * 60 * 1e3;
-var CLOUD_BASH_DENY = [
-  { re: /\bgit\b[^\n;&|]*\s(push|send-pack|send-email|request-pull)\b/, why: "Publishing from the workspace is not allowed. Use the open_pull_request tool; it asks the user for approval." },
-  { re: /\bgit\b[^\n;&|]*\sremote\b/, why: "Git remotes are managed by ScaleQuality and cannot be read or changed from the workspace." }
-];
-var BASH_DENY = [
-  { re: /\bgit\b[^\n;&|]*\scredential\b/, why: "Git credentials are not available in the workspace." },
-  { re: /\bgit\b[^\n;&|]*\sconfig\b[^\n;&|]*(credential|insteadof|pushinsteadof|extraheader|\bremote\.|\burl\.)/, why: "Git credential and remote settings cannot be changed from the workspace." },
-  { re: /credential[._-]?helper/, why: "Git credential helpers cannot be configured in the workspace." },
-  { re: /\/proc\/[^\s'"]*\/(environ|mem)\b/, why: "Process environments are not readable from the workspace." },
-  { re: /\b(INTERNAL_API_SECRET|WORKSPACE_SESSION_SECRET|ANTHROPIC_API_KEY|ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL)\b/, why: "Workspace credentials are not available to commands." },
-  { re: /(^|[;&|(`]|\$\()\s*(env|printenv|export\s+-p|declare\s+-x|set)\s*($|[;&|)>`])/, why: "Dumping the whole environment is not allowed; read the specific variable your task needs." }
-];
-var HOME_PREFIX = String.raw`(~|\$\{?home\}?|\$\{?userprofile\}?|/users/[^/\s]+|/home/[^/\s]+|/root)/`;
-var LOCAL_BASH_DENY = [
-  { re: /(^|[\s=:/~])\.(ssh|aws|gnupg)(\/|\s|$)/i, why: "Credential directories on this machine are not readable from the workspace." },
-  { re: /(^|[\s=:/~])\.(netrc|git-credentials|pgpass)\b/i, why: "Credential files on this machine are not readable from the workspace." },
-  // Projects have their own .npmrc or .docker folder; only the ones in the home directory hold credentials.
-  { re: new RegExp(`${HOME_PREFIX}\\.(npmrc|yarnrc\\.yml|pypirc|docker|kube|azure|config/(gh|hub|gcloud|op))\\b`, "i"), why: "Credential files on this machine are not readable from the workspace." },
-  { re: /(^|[;&|(`]|\$\()\s*(security\s+(find|dump|export)-|gh\s+auth\s+(token|status\s+-t\b|status\s+--show-token)|op\s+(read|item\s+get)|pass\s+show|secret-tool\s+lookup|aws\s+configure\s+(get|export-credentials)|gcloud\s+auth\s+print-)/i, why: "Credential stores on this machine are not readable from the workspace." }
-];
-function normalizeCommand(command) {
-  return command.replace(/\\\n/g, " ").replace(/['"\\]/g, "").replace(/[ \t]+/g, " ").toLowerCase();
-}
-function bashDenial(command, opts = {}) {
-  const n = normalizeCommand(command);
-  for (const { re, why } of BASH_DENY) if (re.test(n) || re.test(command)) return why;
-  if (!opts.local) {
-    for (const { re, why } of CLOUD_BASH_DENY) if (re.test(n) || re.test(command)) return why;
-  }
-  if (opts.local) {
-    for (const { re, why } of LOCAL_BASH_DENY) if (re.test(n) || re.test(command)) return why;
+// src/application/services/workspaceSandbox/localWorkspace.ts
+var EMPTY_TREE = {
+  sha1: "4b825dc642cb6eb9a060e54bf8d69288fbee4904",
+  sha256: "6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321"
+};
+var LocalWorkspaceError = class extends Error {
+  constructor(code, publicMessage) {
+    super(publicMessage);
+    this.code = code;
+    this.publicMessage = publicMessage;
+    this.name = "LocalWorkspaceError";
   }
-  return null;
-}
-async function realpathLoose(p) {
-  let probe = (0, import_path5.resolve)(p);
-  while (!(0, import_fs4.existsSync)(probe) && (0, import_path5.dirname)(probe) !== probe) probe = (0, import_path5.dirname)(probe);
-  const real = await (0, import_promises6.realpath)(probe).catch(() => probe);
-  const rest = (0, import_path5.relative)(probe, (0, import_path5.resolve)(p));
-  return rest ? (0, import_path5.join)(real, rest) : real;
-}
-function inside(root, abs) {
-  return abs === root || abs.startsWith(root + import_path5.sep);
+  code;
+  publicMessage;
+};
+async function localFolderRoot(dir) {
+  const abs = (0, import_path5.resolve)(dir);
+  const st = await (0, import_promises6.stat)(abs).catch(() => null);
+  if (!st || !st.isDirectory()) throw new LocalWorkspaceError("FOLDER_NOT_FOUND", `The folder ${abs} does not exist.`);
+  return (0, import_promises6.realpath)(abs);
 }
-var PLAN_ONLY_READS = "Plan mode is read-only: read and search the code, write the plan to the plan file, then call ExitPlanMode. Changes start after the user approves the plan.";
-var READ_ONLY_PROGRAMS = /* @__PURE__ */ new Set([
-  "ls",
-  "cat",
-  "head",
-  "tail",
-  "wc",
-  "grep",
-  "rg",
-  "ag",
-  "tree",
-  "pwd",
-  "file",
-  "stat",
-  "du",
-  "df",
-  "sort",
-  "uniq",
-  "cut",
-  "tr",
-  "which",
-  "echo",
-  "basename",
-  "dirname",
-  "realpath",
-  "diff",
-  "cloc",
-  "jq",
-  "less",
-  "nl",
-  "column",
-  "date",
-  "uname",
-  "true"
-]);
-var READ_ONLY_GIT = /* @__PURE__ */ new Set(["status", "log", "show", "diff", "blame", "branch", "ls-files", "ls-tree", "grep", "rev-parse", "describe", "shortlog", "tag", "cat-file", "reflog"]);
-function readOnlyCommand(command) {
-  if (/[<>`]|\$\(|\$\{/.test(command)) return false;
-  const segments2 = command.split(/\|\||&&|\||;/).map((s) => s.trim()).filter(Boolean);
-  if (!segments2.length) return false;
-  return segments2.every((seg) => {
-    const words = seg.split(/\s+/);
-    let i = 0;
-    while (i < words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i])) i++;
-    const program = words[i] ?? "";
-    const rest = words.slice(i + 1);
-    if (program === "git") {
-      const sub = rest.find((w) => !w.startsWith("-"));
-      if (!sub || !READ_ONLY_GIT.has(sub)) return false;
-      if (sub === "branch" || sub === "tag") return rest.slice(rest.indexOf(sub) + 1).every((w) => /^(-a|-r|-v|-vv|-l|--list|--all|--show-current|--sort=\S+|--contains|--merged|--no-merged)$/.test(w));
-      return !rest.some((w) => /^(--output|--open-files-in-pager|-O|--ext-diff)(=|$)/.test(w) || /^-O\S/.test(w));
-    }
-    if (program === "find") return !rest.some((w) => /^-(delete|exec|execdir|ok|okdir|fprint|fprint0|fprintf|fls)$/.test(w));
-    if (program === "rg") return !rest.some((w) => /^--pre(=|$)/.test(w));
-    if (program === "sort" || program === "tree") return !rest.some((w) => /^(-o|--output)/.test(w));
-    if (program === "uniq") return rest.filter((w) => !w.startsWith("-")).length <= 1;
-    return READ_ONLY_PROGRAMS.has(program);
+var posix2 = (p) => p.split(import_path5.sep).join("/");
+async function enclosingRepository(root) {
+  let missing = false;
+  const top = await git(["rev-parse", "--show-toplevel"], { cwd: root }).then((o) => o.trim(), (e) => {
+    if (e?.code === "ENOENT") missing = true;
+    return "";
   });
+  if (missing) return "gitMissing";
+  if (!top) return null;
+  const realTop = await (0, import_promises6.realpath)(top).catch(() => top);
+  if (realTop === root) return { top: realTop, prefix: "" };
+  const prefix = posix2((0, import_path5.relative)(realTop, root));
+  if (!prefix || prefix.startsWith("..")) return null;
+  const env = { GIT_LITERAL_PATHSPECS: "1" };
+  const inHead = (await git(["ls-tree", "-d", "--name-only", "HEAD", "--", prefix], { cwd: realTop, env }).catch(() => "")).trim().length > 0;
+  if (inHead) return { top: realTop, prefix };
+  const home = await (0, import_promises6.realpath)((0, import_os3.homedir)()).catch(() => (0, import_os3.homedir)());
+  if (realTop === home || (0, import_path5.relative)(realTop, home).split(import_path5.sep)[0] !== "..") return null;
+  const ignored = await git(["check-ignore", "-q", "--", prefix], { cwd: realTop, env }).then(() => true, () => false);
+  return ignored ? null : { top: realTop, prefix };
 }
-async function decideToolUse(toolName, input, ctx) {
-  if (toolName.startsWith("mcp__") && ctx.orgMcpTools?.all.has(toolName)) {
-    if (ctx.plan && !ctx.orgMcpTools.readOnly.has(toolName)) return { behavior: "deny", message: PLAN_ONLY_READS };
-    return { behavior: "allow", updatedInput: input };
+async function repoHead(top) {
+  const head = (await git(["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: top }).catch(() => "")).trim();
+  let baseRevision = head;
+  let baseKind = "commit";
+  if (!head) {
+    const format = (await git(["rev-parse", "--show-object-format"], { cwd: top }).catch(() => "sha1")).trim();
+    baseRevision = EMPTY_TREE[format] ?? EMPTY_TREE.sha1;
+    baseKind = "empty-tree";
   }
-  if (toolName.startsWith("mcp__")) {
-    if (!toolName.startsWith(SQ_MCP_PREFIX)) return { behavior: "deny", message: "Only ScaleQuality tools and the MCP servers your organization approved are available in this workspace." };
-    if (ctx.plan && !SQ_READ_ONLY.has(toolName.slice(SQ_MCP_PREFIX.length))) return { behavior: "deny", message: PLAN_ONLY_READS };
-    return { behavior: "allow", updatedInput: input };
+  const branch2 = (await git(["symbolic-ref", "--short", "-q", "HEAD"], { cwd: top }).catch(() => "")).trim() || null;
+  const originUrl = (await git(["config", "--get", "remote.origin.url"], { cwd: top }).catch(() => "")).trim() || null;
+  return { baseRevision, baseKind, branch: branch2, originUrl: originUrl ? stripUserinfo(originUrl) : null };
+}
+async function nestedRepo(folder, dir) {
+  const real = await (0, import_promises6.realpath)(dir).catch(() => null);
+  if (!real) return null;
+  const top = (await git(["rev-parse", "--show-toplevel"], { cwd: real }).catch(() => "")).trim();
+  if (!top || await (0, import_promises6.realpath)(top).catch(() => top) !== real) return null;
+  return { root: real, rel: posix2((0, import_path5.relative)(folder, real)), ...await repoHead(real) };
+}
+async function inspectLocalFolder(dir, opts = {}) {
+  const root = await localFolderRoot(dir);
+  const owner = await enclosingRepository(root);
+  if (owner === null || owner === "gitMissing") {
+    const gitAvailable = owner !== "gitMissing";
+    const found = gitAvailable ? await discoverRepositories(root, opts.discovery) : { repos: [], truncated: false, scannedDirs: 0 };
+    const repos = (await mapLimit(found.repos, 8, (d) => nestedRepo(root, d).catch(() => null))).filter((r) => !!r);
+    return {
+      kind: "folder",
+      root,
+      repoRoot: null,
+      prefix: "",
+      baseRevision: "",
+      baseKind: "commit",
+      branch: null,
+      changedAtStart: 0,
+      originUrl: null,
+      headOnRemote: null,
+      repos,
+      reposTruncated: found.truncated,
+      gitAvailable
+    };
   }
-  if (HARMLESS.has(toolName)) return { behavior: "allow", updatedInput: input };
-  if (SUBAGENT_TOOLS.has(toolName)) {
-    if (typeof input.prompt !== "string" || !input.prompt.trim()) return { behavior: "deny", message: "A subagent needs a task (prompt)." };
-    const updated = { ...input, run_in_background: false };
-    for (const k of ["isolation", "model", "name", "team_name", "mode"]) delete updated[k];
-    return { behavior: "allow", updatedInput: updated };
+  const { top, prefix } = owner;
+  const head = await repoHead(top);
+  const status = await git(
+    ["--no-optional-locks", "status", "--porcelain", "-z", "--untracked-files=all", ...prefix ? ["--", prefix] : []],
+    { cwd: top, timeoutMs: 5 * 6e4, env: { GIT_LITERAL_PATHSPECS: "1" } }
+  ).catch(() => "");
+  const changedAtStart = countPorcelainZ(status);
+  let headOnRemote = null;
+  const anyRemoteBranch = (await git(["branch", "-r"], { cwd: top }).catch(() => "")).trim().length > 0;
+  if (head.baseKind === "commit" && anyRemoteBranch) {
+    const remotes = await git(["branch", "-r", "--contains", head.baseRevision], { cwd: top }).catch(() => null);
+    headOnRemote = remotes === null ? null : remotes.trim().length > 0;
   }
-  if (toolName === "WebFetch") {
-    const why = await webFetchDenial(input.url, ctx.lookup);
-    return why ? { behavior: "deny", message: why } : { behavior: "allow", updatedInput: input };
+  return { kind: prefix ? "subfolder" : "repo", root, repoRoot: top, prefix, ...head, changedAtStart, headOnRemote, repos: [], reposTruncated: false, gitAvailable: true };
+}
+function countPorcelainZ(out2) {
+  const recs = out2.split("\0");
+  let n = 0;
+  for (let i = 0; i < recs.length; i++) {
+    const r = recs[i];
+    if (!r || r.length < 4) continue;
+    n++;
+    if (r[0] === "R" || r[0] === "C") i++;
   }
-  if (toolName in WRITE_TOOLS && ctx.planDir) {
-    const raw = input[WRITE_TOOLS[toolName]];
-    if (typeof raw === "string" && raw.endsWith(".md")) {
-      const plans = await realpathLoose(ctx.planDir);
-      const abs = await realpathLoose((0, import_path5.resolve)(ctx.planDir, raw));
-      if (inside(plans, abs) && abs !== plans) return { behavior: "allow", updatedInput: input };
+  return n;
+}
+function remotePathSegments(url) {
+  const u = url.trim();
+  const scp = /^(?:[^@\s/]+@)?([^:\s/]+):(?!\/\/)(.+)$/.exec(u);
+  let host = "";
+  let path = u;
+  if (scp && !/^[a-z][a-z0-9+.-]*:\/\//i.test(u)) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    try {
+      const parsed = new URL(u);
+      host = parsed.hostname;
+      path = parsed.pathname;
+    } catch {
+      path = u;
     }
   }
-  if (ctx.plan && toolName in WRITE_TOOLS) return { behavior: "deny", message: PLAN_ONLY_READS };
-  if (toolName in READ_TOOLS || toolName in WRITE_TOOLS) {
-    const field = READ_TOOLS[toolName] ?? WRITE_TOOLS[toolName];
-    const raw = input[field];
-    if ((raw === void 0 || raw === null || raw === "") && toolName in READ_TOOLS && toolName !== "Read") {
-      return { behavior: "allow", updatedInput: input };
-    }
-    if (typeof raw !== "string" || raw.length === 0) return { behavior: "deny", message: `${toolName} needs a path inside the repository.` };
-    const abs = await resolveInside(ctx.root, raw);
-    let denied = false;
-    for (const d of ctx.deniedRoots ?? []) {
-      const realDenied = await (0, import_promises6.realpath)(d).catch(() => (0, import_path5.resolve)(d));
-      if (abs && inside(realDenied, abs)) denied = true;
-    }
-    if (abs && !denied) {
-      if (toolName in WRITE_TOOLS) {
-        const realRoot = await (0, import_promises6.realpath)(ctx.root).catch(() => (0, import_path5.resolve)(ctx.root));
-        const rel = (0, import_path5.relative)(realRoot, abs).split(import_path5.sep);
-        if (rel.includes(".git")) return { behavior: "deny", message: "Files under .git cannot be written from the workspace." };
-      }
-      return { behavior: "allow", updatedInput: input };
-    }
-    if (toolName in READ_TOOLS) {
-      for (const extra of ctx.extraReadRoots ?? []) {
-        const e = await resolveInside(extra, raw);
-        const realExtra = await (0, import_promises6.realpath)(extra).catch(() => (0, import_path5.resolve)(extra));
-        if (e && inside(realExtra, e)) return { behavior: "allow", updatedInput: input };
-      }
+  const segments2 = path.split("/").map((s) => {
+    try {
+      return decodeURIComponent(s);
+    } catch {
+      return s;
     }
-    return { behavior: "deny", message: `${toolName} is limited to files inside the repository (${ctx.root}).` };
+  }).map((s) => s.toLowerCase().replace(/\.git$/, "")).filter((s) => s && s !== "_git" && s !== "v3");
+  return { host: host.toLowerCase(), segments: segments2 };
+}
+var PROVIDER_HOSTS = [[/github/, "GITHUB"], [/gitlab/, "GITLAB"], [/bitbucket/, "BITBUCKET"], [/(dev\.azure|visualstudio)/, "AZURE"]];
+function matchRemoteToScope(originUrl, repos) {
+  if (!originUrl) return null;
+  const { host, segments: segments2 } = remotePathSegments(originUrl);
+  if (!segments2.length) return null;
+  const provider = PROVIDER_HOSTS.find(([re]) => re.test(host))?.[1] ?? null;
+  let best = [];
+  let bestLen = 0;
+  for (const r of repos) {
+    const rs = r.repoFullName.toLowerCase().split("/").map((s) => s.replace(/\.git$/, "")).filter(Boolean);
+    if (!rs.length || rs.length > segments2.length) continue;
+    const offset = segments2.length - rs.length;
+    if (!rs.every((s, i) => s === segments2[offset + i])) continue;
+    if (rs.length > bestLen) {
+      best = [r];
+      bestLen = rs.length;
+    } else if (rs.length === bestLen) best.push(r);
   }
-  if (toolName === "Bash") {
-    const command = typeof input.command === "string" ? input.command : "";
-    if (!command.trim()) return { behavior: "deny", message: "Empty command." };
-    const why = bashDenial(command, { local: ctx.local });
-    if (why) return { behavior: "deny", message: why };
-    if (ctx.plan && !readOnlyCommand(command)) return { behavior: "deny", message: PLAN_ONLY_READS };
-    const updated = { ...input };
-    delete updated.dangerouslyDisableSandbox;
-    const t = typeof input.timeout === "number" && Number.isFinite(input.timeout) ? input.timeout : void 0;
-    if (t !== void 0) updated.timeout = Math.max(1e3, Math.min(BASH_MAX_TIMEOUT_MS, t));
-    return { behavior: "allow", updatedInput: updated };
+  if (best.length > 1 && provider) best = best.filter((r) => r.provider.toUpperCase().startsWith(provider));
+  return best.length === 1 ? best[0] : null;
+}
+function localFolderRepo(originUrl, repos, linkedProjectId) {
+  const linked = linkedProjectId ? repos.filter((r) => r.projectId === linkedProjectId) : [];
+  if (linked.length) return { repo: matchRemoteToScope(originUrl, linked) ?? (linked.length === 1 ? linked[0] : null), linked };
+  return { repo: matchRemoteToScope(originUrl, repos), linked: [] };
+}
+function bootScopeRepos(boot) {
+  if (boot.scope?.repos) return boot.scope.repos;
+  if (boot.repositories) return boot.repositories;
+  return boot.repo ? [{ repoFullName: boot.repo.repoFullName, provider: boot.repo.provider, projectId: boot.projectId, defaultBranch: boot.repo.defaultBranch }] : [];
+}
+function stripUserinfo(url) {
+  return url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]+@/i, "$1");
+}
+async function prepareLocalWorkspace(dir, _boot, onStep) {
+  const t0 = Date.now();
+  onStep?.("Reading the local folder");
+  const local = await inspectLocalFolder(dir);
+  return {
+    baseRevision: local.baseRevision,
+    baseKind: local.baseKind,
+    branch: local.branch ?? "HEAD",
+    restore: "none",
+    originUrl: local.originUrl,
+    timings: { local_folder: Date.now() - t0 },
+    local
+  };
+}
+function localWarnings(local, boot) {
+  const out2 = [];
+  if (local.kind === "folder") {
+    if (local.reposTruncated) out2.push(`The folder is large: the repositories inside it were looked for up to ${DISCOVERY_LIMITS.maxDepth} levels down, for a few seconds. Others are still available; their changes are tracked when you edit them here.`);
+    return out2;
   }
-  if (toolName === "WebSearch") {
-    return { behavior: "deny", message: "Web search is not available in the ScaleQuality workspace. Fetch a specific page with WebFetch." };
+  const { repo: match, linked } = localFolderRepo(local.originUrl, bootScopeRepos(boot), boot.folderLink?.projectId);
+  const sessionBranch = match ? boot.repo?.repoFullName === match.repoFullName ? boot.branch || boot.repo.defaultBranch : match.defaultBranch : null;
+  if (sessionBranch && local.branch && local.branch !== sessionBranch) {
+    out2.push(`This folder is on branch "${local.branch}", and the session targets "${sessionBranch}". A pull request is opened against "${sessionBranch}" and only when it is at the same commit as this folder.`);
   }
-  return { behavior: "deny", message: `${toolName} is not available in the ScaleQuality workspace.` };
+  if (!local.branch) out2.push("This folder is on a detached HEAD.");
+  if (local.headOnRemote === false) out2.push("HEAD has commits that are not on any remote branch this folder knows about. Push them first if you plan to open a pull request from this session.");
+  if (local.changedAtStart > 0) out2.push(`${local.changedAtStart} file(s) already differ from HEAD. They are part of this session's change.`);
+  if (linked.length) {
+    if (!match) out2.push(`This folder is linked to a project with several repositories (${linked.map((r) => r.repoFullName).join(", ")}). A pull request names the one it goes to.`);
+    return out2;
+  }
+  if (local.originUrl && !match) {
+    out2.push(`The origin remote (${local.originUrl}) is not a repository in this session's scope. You can work on the code here; a pull request cannot be opened from this folder.`);
+  }
+  if (!local.originUrl) out2.push("This folder has no origin remote, so it is not matched to a repository in this session's scope. You can work on the code here; a pull request cannot be opened from this folder.");
+  return out2;
 }
 
 // src/application/services/workspaceSandbox/commandRules.ts
@@ -2395,13 +3019,19 @@ var BrowserCommandGate = class {
     this.chain = next.catch(() => void 0);
     return next;
   }
+  checkProtected(command, opts) {
+    const next = this.chain.then(() => this.ask(command, { description: opts.description, signal: opts.signal, protection: opts }));
+    this.chain = next.catch(() => void 0);
+    return next;
+  }
   checkEdit(path, opts = {}) {
     const next = this.chain.then(() => this.ask(`edit ${path}`, { signal: opts.signal, edit: { path, ...opts.preview ? { preview: opts.preview } : {} } }));
     this.chain = next.catch(() => void 0);
     return next;
   }
   async ask(command, opts) {
-    if (!opts.edit && matchingRule(command, this.allRules())) return { allow: true };
+    const protection = opts.protection;
+    if (!opts.edit && !protection && matchingRule(command, this.allRules())) return { allow: true };
     if (opts.signal?.aborted) return { allow: false, message: STOPPED };
     let approvalId;
     let approved = false;
@@ -2410,19 +3040,21 @@ var BrowserCommandGate = class {
         command,
         cwd: this.o.root,
         ...opts.description ? { description: opts.description.slice(0, 1e3) } : {},
-        reasons: opts.edit ? [] : approvalReasons(command),
-        suggestedRule: opts.edit ? null : suggestRule(command),
-        ...opts.edit ? { edit: { path: opts.edit.path, ...opts.edit.preview ? { preview: opts.edit.preview.slice(0, 4e3) } : {} } } : {}
+        reasons: opts.edit ? [] : protection ? [...protection.reasons, ...approvalReasons(command)] : approvalReasons(command),
+        suggestedRule: opts.edit || protection ? null : suggestRule(command),
+        ...opts.edit ? { edit: { path: opts.edit.path, ...opts.edit.preview ? { preview: opts.edit.preview.slice(0, 4e3) } : {} } } : {},
+        ...protection?.package ? { package: protection.package, ...protection.packageReason ? { packageReason: protection.packageReason } : {} } : {}
       }));
     } catch (e) {
       this.o.log?.(`command approval could not be requested: ${e.message}`);
       const code = e instanceof CommandApprovalError ? e.code : null;
+      if (protection && code !== "COMMAND_NOT_ALLOWED") return { allow: false, message: PROTECTION_MESSAGES.unavailable };
       return {
         allow: false,
         message: code === "COMMAND_NOT_ALLOWED" ? "This command is not allowed in the ScaleQuality workspace. It did not run; do not try to run it another way." : "The command could not be sent to the user for approval, so it did not run. Tell the user; do not try to run it another way."
       };
     }
-    if (approved) return { allow: true };
+    if (approved && !protection) return { allow: true };
     this.o.onWaiting?.(command);
     const timeoutMs = this.o.timeoutMs ?? COMMAND_APPROVAL_TIMEOUT_MS;
     const timer = new AbortController();
@@ -2433,12 +3065,14 @@ var BrowserCommandGate = class {
     if (!decision) {
       const reason = opts.signal?.aborted ? "STOPPED" : "TIMED_OUT";
       void this.o.api.cancel(approvalId, reason).catch(() => void 0);
+      if (protection) return { allow: false, message: reason === "STOPPED" ? PROTECTION_MESSAGES.stopped : PROTECTION_MESSAGES.timedOut(Math.round(timeoutMs / 6e4)) };
       return reason === "STOPPED" ? { allow: false, message: STOPPED } : { allow: false, message: `The user did not answer the approval for this command within ${Math.round(timeoutMs / 6e4)} minutes, so it did not run. Ask the user before trying it again.` };
     }
     if (decision.decision === "REJECT") {
+      if (protection) return { allow: false, message: PROTECTION_MESSAGES.rejected };
       return opts.edit ? { allow: false, message: `The user declined this change to ${opts.edit.path} in the browser. The file was not changed. Ask the user what to do differently.` } : { allow: false, message: "The user denied this command in the browser. It did not run. Do not run the same command again unless the user asks; continue another way or ask the user." };
     }
-    if (decision.remember) {
+    if (decision.remember && !protection) {
       if (this.o.onRemember) this.o.onRemember(decision.remember);
       else this.remembered.push(decision.remember);
     }
@@ -4476,7 +5110,7 @@ function limitInEngineText(text3) {
 // src/application/services/workspaceSandbox/scalequalityTools.ts
 var import_crypto4 = require("crypto");
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/external.js
+// node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
   BRAND: () => BRAND,
@@ -4588,7 +5222,7 @@ __export(external_exports, {
   void: () => voidType
 });
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/helpers/util.js
+// node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
   util2.assertEqual = (_) => {
@@ -4722,7 +5356,7 @@ var getParsedType = (data) => {
   }
 };
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/ZodError.js
+// node_modules/zod/v3/ZodError.js
 var ZodIssueCode = util.arrayToEnum([
   "invalid_type",
   "invalid_literal",
@@ -4840,7 +5474,7 @@ ZodError.create = (issues) => {
   return error;
 };
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/locales/en.js
+// node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
   let message;
   switch (issue.code) {
@@ -4943,7 +5577,7 @@ var errorMap = (issue, _ctx) => {
 };
 var en_default = errorMap;
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/errors.js
+// node_modules/zod/v3/errors.js
 var overrideErrorMap = en_default;
 function setErrorMap(map) {
   overrideErrorMap = map;
@@ -4952,7 +5586,7 @@ function getErrorMap() {
   return overrideErrorMap;
 }
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/helpers/parseUtil.js
+// node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
   const { data, path, errorMaps, issueData } = params;
   const fullPath = [...path, ...issueData.path || []];
@@ -5062,14 +5696,14 @@ var isDirty = (x) => x.status === "dirty";
 var isValid = (x) => x.status === "valid";
 var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/helpers/errorUtil.js
+// node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
   errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
   errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
 })(errorUtil || (errorUtil = {}));
 
-// ../../../../../../../Users/erikfernandes/GIT/load-n-scale/.codex-worktrees/aigov-code-queue/node_modules/zod/v3/types.js
+// node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
   constructor(parent, value, path, key) {
     this._cachedPath = [];
@@ -9297,6 +9931,51 @@ var TurnTiming = class {
   }
 };
 
+// src/application/services/workspaceSandbox/protectionApproval.ts
+function gateProtectionApprover(gate) {
+  if (!gate.checkProtected) return null;
+  return { ask: (command, check) => gate.checkProtected(command, check) };
+}
+function cloudProtectionApprover(o) {
+  let chain = Promise.resolve();
+  const ask = async (command, check) => {
+    if (check.signal?.aborted) return { allow: false, message: PROTECTION_MESSAGES.stopped };
+    let approvalId;
+    try {
+      ({ approvalId } = await o.calls.requestCommandApproval({
+        command,
+        cwd: o.cwd,
+        ...check.description ? { description: check.description.slice(0, 1e3) } : {},
+        reasons: [...check.reasons],
+        suggestedRule: null,
+        ...check.package ? { package: check.package, ...check.packageReason ? { packageReason: check.packageReason } : {} } : {}
+      }));
+    } catch (e) {
+      o.log?.(`protection approval could not be requested: ${e.message}`);
+      return { allow: false, message: PROTECTION_MESSAGES.unavailable };
+    }
+    const timeoutMs = o.timeoutMs ?? COMMAND_APPROVAL_TIMEOUT_MS;
+    const timer = new AbortController();
+    const t = setTimeout(() => timer.abort(), timeoutMs);
+    t.unref?.();
+    const decision = await o.broker.wait(approvalId, check.signal ? anySignal([check.signal, timer.signal]) : timer.signal);
+    clearTimeout(t);
+    if (!decision) {
+      const reason = check.signal?.aborted ? "STOPPED" : "TIMED_OUT";
+      void o.calls.cancelCommandApproval(approvalId, reason).catch(() => void 0);
+      return { allow: false, message: reason === "STOPPED" ? PROTECTION_MESSAGES.stopped : PROTECTION_MESSAGES.timedOut(Math.round(timeoutMs / 6e4)) };
+    }
+    return decision.decision === "APPROVE" ? { allow: true } : { allow: false, message: PROTECTION_MESSAGES.rejected };
+  };
+  return {
+    ask(command, check) {
+      const next = chain.then(() => ask(command, check));
+      chain = next.catch(() => void 0);
+      return next;
+    }
+  };
+}
+
 // src/application/services/workspaceSandbox/systemPrompt.ts
 var FOLDER_LISTED = 60;
 function layoutLines(root, l) {
@@ -10041,6 +10720,9 @@ var WorkspaceEngine = class {
   redactor = new Redactor();
   sink;
   broker = new ApprovalBroker();
+  /** Registry answers of unknown-package, kept for the session. */
+  registry = new RegistryChecker();
+  approver;
   boot = null;
   scope = { kind: "PROJECTS", teamId: null, projectIds: [], repos: [] };
   /** Open repositories by folder. */
@@ -10907,6 +11589,42 @@ ${String(item.content)}` : String(item.content);
       this.error("MODEL_SWITCH_FAILED", { model: boot.runtime.primaryModel || boot.model });
     }
   }
+  /**
+   * The organization's protection rules in force: the ones the latest credential brought (bootstrap, model switch,
+   * renewal). None when the Runtime sent none.
+   */
+  protections() {
+    const raw = this.boot?.runtime?.protections;
+    return raw ? parseProtections(raw) : NO_PROTECTIONS;
+  }
+  /** What the protections read from the workspace: the registries, the checked out branch, the installed packages. */
+  protectionDeps() {
+    return {
+      registry: this.registry,
+      currentBranch: async () => (await git(["rev-parse", "--abbrev-ref", "HEAD"], { cwd: this.deps.root, timeoutMs: 3e3 })).trim() || null,
+      installedLocally: (name) => [this.deps.root, ...[...this.repos.values()].map((r) => r.root)].some((dir) => (0, import_fs9.existsSync)((0, import_path15.join)(dir, "node_modules", name, "package.json")) || (0, import_fs9.existsSync)((0, import_path15.join)(dir, "node_modules", ".bin", name)))
+    };
+  }
+  /**
+   * Who approves a command a protection holds: on a connected computer the browser gate (its decisions come through
+   * the CLI), in the cloud workspace the same card through the internal route, decided on this engine's poll.
+   */
+  protectionApprover() {
+    if (this.approver !== void 0) return this.approver;
+    const gate = this.deps.commandGate;
+    const transport = this.deps.transport;
+    if (gate) {
+      this.approver = gateProtectionApprover(timedGate(gate, (ms) => this.live?.timing.permission(ms)));
+    } else if (transport.requestCommandApproval && transport.cancelCommandApproval) {
+      this.approver = cloudProtectionApprover({
+        calls: { requestCommandApproval: (b) => transport.requestCommandApproval(b), cancelCommandApproval: (id, r) => transport.cancelCommandApproval(id, r) },
+        broker: this.broker,
+        cwd: this.deps.root,
+        log: (msg) => this.deps.log.warn(this.redactor.text(msg))
+      });
+    } else this.approver = null;
+    return this.approver;
+  }
   /**
    * A fresh gateway credential for the same model (silent): the limits and protections of now. A failure keeps
    * the current one; the turn runs as before.
@@ -11750,7 +12468,8 @@ ${text3}`;
       skills: { dir: this.skillsDir(), enabled: enabledSkillNames(t.off.skillEntries), pluginDirs: t.off.pluginDirs },
       skillsKey: this.skillsSent,
       orgMcpServers: org ? t.off.mcpServers : {},
-      folderWrites: this.localFolder?.kind === "folder"
+      folderWrites: this.localFolder?.kind === "folder",
+      secretFiles: this.protections().secretFiles
     };
   }
   /**
@@ -11780,6 +12499,9 @@ ${text3}`;
       ...Object.keys(i.orgMcpServers).length ? { orgMcpServers: i.orgMcpServers } : {},
       pathToClaudeCodeExecutable: this.deps.pathToClaudeCodeExecutable,
       commandGate: gate ? timedGate(gate, (ms) => this.live?.timing.permission(ms)) : void 0,
+      secretFiles: i.secretFiles,
+      protections: () => this.protections(),
+      protection: { deps: this.protectionDeps(), approver: this.protectionApprover() },
       beforeTool: async () => {
         const t0 = Date.now();
         await this.toolGate;
@@ -12512,11 +13234,13 @@ function buildQueryOptions(o) {
     if (name.startsWith("mcp__") && provenance?.source && provenance.source !== "sdk") {
       return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "Only ScaleQuality tools are available in this workspace." } };
     }
-    const d = await decideToolUse(name, input.tool_input ?? {}, o.policy);
-    const gated = d.behavior === "allow" && !!gate && (name === "Bash" || !!gate.checkEdit && !o.plan && name in WRITE_TOOL_PATHS);
+    const protections = o.protections?.() ?? NO_PROTECTIONS;
+    const d = await decideToolUse(name, input.tool_input ?? {}, { ...o.policy, protections });
+    const guarded = d.behavior === "allow" && name === "Bash" && mayNeedProtection(String(d.updatedInput.command ?? ""), protections);
+    const gated = guarded || d.behavior === "allow" && !!gate && (name === "Bash" || !!gate.checkEdit && !o.plan && name in WRITE_TOOL_PATHS);
     if (d.behavior === "allow" && !gated) await beforeWrite(name, d.updatedInput);
     if (gated) {
-      return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: "Commands and changes on this machine follow the person's permission mode." } };
+      return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "ask", permissionDecisionReason: guarded ? "This command follows the organization's protections." : "Commands and changes on this machine follow the person's permission mode." } };
     }
     return d.behavior === "allow" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: d.updatedInput } } : { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: d.message } };
   };
@@ -12532,8 +13256,28 @@ function buildQueryOptions(o) {
       o.onPlan?.(text3);
       return { behavior: "deny", message: "The plan is now with the user for review in ScaleQuality. Do not continue and do not call more tools: end your turn with one short sentence saying the plan is ready for review." };
     }
-    const d = await decideToolUse(toolName, input, o.policy);
+    const protections = o.protections?.() ?? NO_PROTECTIONS;
+    const d = await decideToolUse(toolName, input, { ...o.policy, protections });
     if (d.behavior !== "allow") return { behavior: "deny", message: d.message };
+    let protectionApproved = false;
+    if (toolName === "Bash" && mayNeedProtection(String(d.updatedInput.command ?? ""), protections)) {
+      const command = String(d.updatedInput.command ?? "");
+      const signal = opts?.signal ?? o.abortController.signal;
+      if (!o.protection) return { behavior: "deny", message: PROTECTION_MESSAGES.unavailable };
+      const v = await protectionVerdict(command, protections, o.protection.deps);
+      if (v.kind === "deny") return { behavior: "deny", message: v.message };
+      if (v.kind === "ask") {
+        const approver = o.protection.approver;
+        const r = approver ? await approver.ask(command, {
+          reasons: v.reasons,
+          ...v.package ? { package: v.package, packageReason: v.packageReason } : {},
+          description: typeof input.description === "string" ? input.description : void 0,
+          signal
+        }) : { allow: false, message: PROTECTION_MESSAGES.unavailable };
+        if (!r.allow) return { behavior: "deny", message: r.message };
+        protectionApproved = true;
+      }
+    }
     if (gate?.checkEdit && !o.plan && toolName in WRITE_TOOL_PATHS) {
       const field = WRITE_TOOL_PATHS[toolName];
       const path = typeof d.updatedInput[field] === "string" ? (0, import_path15.relative)(o.root, d.updatedInput[field]) || String(d.updatedInput[field]) : "";
@@ -12541,7 +13285,7 @@ function buildQueryOptions(o) {
       if (!r.allow) return { behavior: "deny", message: r.message };
     }
     await beforeWrite(toolName, d.updatedInput);
-    if (gate && toolName === "Bash") {
+    if (gate && toolName === "Bash" && !protectionApproved) {
       const r = await gate.check(String(d.updatedInput.command ?? ""), {
         description: typeof input.description === "string" ? input.description : void 0,
         signal: opts?.signal ?? o.abortController.signal
@@ -12570,7 +13314,8 @@ function buildQueryOptions(o) {
     tools: o.plan ? PLAN_TOOLS : MODEL_TOOLS,
     // No settings file is read (settingSources above); these are ours: WebFetch asks no outside service
     // before fetching (the policy already decided), and plan files stay in the engine's own folder.
-    settings: { skipWebFetchPreflight: true },
+    // secret-files: Read deny rules, which the engine also applies to its searches (Grep and Glob skip those files).
+    settings: { skipWebFetchPreflight: true, ...o.secretFiles ? { permissions: { deny: [...SECRET_READ_DENY_RULES] } } : {} },
     // Skills: the built-in ones that fit the workspace and the plugin the engine built (never the repository's .claude settings).
     ...o.skills ? { plugins: [o.skills.dir, ...o.skills.pluginDirs ?? []].map((path) => ({ type: "local", path, skipMcpDiscovery: true })), skills: o.skills.enabled } : { skills: [] },
     disallowedTools: DENIED_TOOLS,
@@ -12598,7 +13343,8 @@ function timedGate(gate, took) {
   };
   return {
     check: (command, opts) => timed(() => gate.check(command, opts)),
-    ...gate.checkEdit ? { checkEdit: (path, opts) => timed(() => gate.checkEdit(path, opts)) } : {}
+    ...gate.checkEdit ? { checkEdit: (path, opts) => timed(() => gate.checkEdit(path, opts)) } : {},
+    ...gate.checkProtected ? { checkProtected: (command, opts) => timed(() => gate.checkProtected(command, opts)) } : {}
   };
 }
 async function hasLocalTranscript(configDir, sessionId) {