@staix/agent-hub 0.23.1 → 0.25.0

package/src/cli/output.ts

@@ -7,6 +7,7 @@ import { cells, TABLES, table, fitLine, wrap, duration, relative, plural, termin
 import { taskProgress } from "../ui/task-progress.ts";
 import { backendLabel } from "./status-lines.ts";
 import { ownerIsolationText } from "./role-holders.ts";
+import { schedulePeriodText, scheduleWhen } from "../hub/schedules.ts";
 import { formatReport, formatTaskReport, type Report, type TaskReport } from "../hub/report.ts";
 import type { Counter, LimitsResult, TotalResult, UsageResult } from "../hub/usage-rollup.ts";
 
@@ -20,7 +21,7 @@ export interface StatusOutput {
   /** #843 AC3: installed agent CLIs not on a verified version; ids, version, state and a receipt path only. */
   agentDrift?: readonly { id: string; version: string; state: string; receipt: string }[];
   /** #512a: one row per machine-local schedule; ids, times and a state only, never task text. */
-  schedules?: readonly { id: string; every: string; class: string; queue: string; next: number; last?: number; task?: number; state: string; coalesced?: number; error?: string }[];
+  schedules?: readonly { id: string; every?: string; cron?: string; zone?: string; class: string; queue: string; next: number; last?: number; task?: number; state: string; coalesced?: number; error?: string }[];
   taskStalls?: readonly { task: number; cause: { kind: string; peer?: string; dependency?: number; code: string } }[];
   pendingTaskOffers?: readonly { task: number; peer: string }[];
   isolatedChecks?: { pending?: number; orphans?: string[]; unknownReceipts?: readonly string[]; maintenanceUnavailable?: boolean };
@@ -218,8 +219,8 @@ export function renderStatus(data: StatusOutput, columns?: number, now = Date.no
     for (const pending of data.retainedConfig) out.push(...detail("retained reason", `${pending.key}: ${pending.reason}`, columns, "attention"));
   }
   for (const row of data.schedules ?? []) {
-    const when = (at: number) => new Date(at).toISOString().replace("T", " ").slice(0, 16) + "Z";
-    const text = `${row.state === "paused" ? `paused (ahub schedule resume ${row.id}); would be next ${when(row.next)}` : row.state === "scheduled" ? `next ${when(row.next)}` : row.state === "due" ? "due now" : row.state === "waiting" ? `due, waiting for task #${row.task} to close` : "due, held (the hub is stopping or recovering)"}; every ${row.every}; ${row.class} to ${row.queue}${row.last ? `; last ${when(row.last)}${row.task ? ` as task #${row.task}` : ""}` : "; never run"}${row.coalesced ? `; ${row.coalesced} skipped run${row.coalesced === 1 ? "" : "s"} coalesced` : ""}${row.error ? `; last error: ${row.error}` : ""}`;
+    const when = (at: number) => row.zone ? scheduleWhen(row, at) : new Date(at).toISOString().replace("T", " ").slice(0, 16) + "Z";
+    const text = `${row.state === "paused" ? `paused (ahub schedule resume ${row.id}); would be next ${when(row.next)}` : row.state === "scheduled" ? `next ${when(row.next)}` : row.state === "due" ? "due now" : row.state === "waiting" ? `due, waiting for task #${row.task} to close` : "due, held (the hub is stopping or recovering)"}; ${schedulePeriodText(row)}; ${row.class} to ${row.queue}${row.last ? `; last ${when(row.last)}${row.task ? ` as task #${row.task}` : ""}` : "; never run"}${row.coalesced ? `; ${row.coalesced} skipped run${row.coalesced === 1 ? "" : "s"} coalesced` : ""}${row.error ? `; last error: ${row.error}` : ""}`;
     out.push(...detail(`schedule ${row.id}`, text, columns, row.error ? "attention" : undefined));
   }
   if (data.queueBackpressure) {
@@ -347,6 +348,8 @@ export function renderBacklog(cards: any[], columns?: number, now = Date.now(),
   return [...rows(names, table, columns), [], ...lines(summary, columns)];
 }
 /** #724: one line per task. TITLE goes last and is cut to the room left; at a narrow width REVIEWER, CLASS and AGE give way first. */
+/** #604: a task another project handed over says so on the board: the project id and the peer, both ids and nothing a handoff wrote. */
+const handoffMark = (task: any): string => task?.handoffOrigin ? `  (handed off from ${String(task.handoffOrigin.projectId).slice(0, 24)} by ${String(task.handoffOrigin.peer).slice(0, 32)})` : "";
 function compactBoard(tasks: any[], data: OutputCell[][], columns: number, staged: boolean): Span[][] {
   const head = ["ID", "STATE", "OWNER", "REVIEWER", "CLASS", "AGE", "AFTER", ...(staged ? ["STAGE"] : []), "TITLE"];
   let table = tasks.map((task, i) => {
@@ -355,7 +358,7 @@ function compactBoard(tasks: any[], data: OutputCell[][], columns: number, stage
     const meter = /^\[[^\]]*\](?: cancelled)?/.exec(row[7]?.text ?? "")?.[0] ?? "[----]";
     const stage = task.lifecycle ? `${meter} ${task.lifecycle.stage}: ${stageCode(String(task.lifecycle.next ?? ""))}` : meter;
     const short = task.lifecycle ? `${meter} ${stageCode(String(task.lifecycle.next ?? ""))}` : meter;
-    return [row[0]!, row[1]!, row[2]!, row[3]!, row[4]!, row[5]!, span(after, undefined, true), ...(staged ? [{ ...span(stage, row[7]!.tone, true), short }] : []), span(flat(task.title))];
+    return [row[0]!, row[1]!, row[2]!, row[3]!, row[4]!, row[5]!, span(after, undefined, true), ...(staged ? [{ ...span(stage, row[7]!.tone, true), short }] : []), span(`${flat(task.title)}${handoffMark(task)}`)];
   });
   let names = [...head];
   const drop = (name: string) => { const at = names.indexOf(name); if (at < 0) return; names = names.filter((_, i) => i !== at); table = table.map(row => row.filter((_, i) => i !== at)); };
@@ -389,7 +392,7 @@ export function renderBoard(tasks: any[], columns?: number, now = Date.now(), fu
     const row = cells(s, task, false, now, stages);
     row[2] = span(row[2]!.text, peerTone(task.owner ?? ""));
     row[3] = span(row[3]!.text, peerTone(task.reviewer ?? ""));
-    row[6] = span(`${task.title}${task.deps?.length ? `  after ${task.deps.map((id: number) => `#${id}`).join(", ")}` : ""}${task.signals?.includes("pii") ? `  (ahub task show ${task.id})` : ""}`);
+    row[6] = span(`${task.title}${handoffMark(task)}${task.deps?.length ? `  after ${task.deps.map((id: number) => `#${id}`).join(", ")}` : ""}${task.signals?.includes("pii") ? `  (ahub task show ${task.id})` : ""}`);
     if (allTasks === null) row.pop();
     return row;
   });

package/src/cli/schedule-output.ts

@@ -3,22 +3,26 @@
 import { blank, grid, heading, pair, s } from "./sdlc-output.ts";
 import { moment } from "./sdlc-output.ts";
 import type { Span, Tone } from "./console-state.ts";
+import { schedulePeriodText, scheduleWhen } from "../hub/schedules.ts";
 
 const list = (value: unknown): any[] => Array.isArray(value) ? value : [];
 const TONE: Record<string, Tone | undefined> = { due: "attention", waiting: "attention", held: "attention", paused: "muted", scheduled: undefined };
 const WHEN: Record<string, string> = { scheduled: "next", due: "due now", waiting: "due, waiting for its task to close", held: "due, held (the hub is stopping or recovering)", paused: "paused" };
 
 /** The next run, as the person reads it: a paused schedule says so and what it would have been. */
-export const nextText = (row: any, now: number): string =>
-  row?.state === "paused" ? `paused (would be ${moment(row.next, now)})` : row?.state === "scheduled" ? moment(row.next, now) : WHEN[row?.state] ?? "unknown";
+export const nextText = (row: any, now: number): string => {
+  // A calendar schedule reads its next run in its own zone, with the relative time after it; an `every` schedule keeps the UTC form.
+  const at = (instant: unknown) => row?.zone && typeof instant === "number" && Number.isFinite(instant) ? `${scheduleWhen(row, instant)} (${moment(instant, now).replace(/^.*?\((.*)\)$/, "$1")})` : moment(instant, now);
+  return row?.state === "paused" ? `paused (would be ${at(row.next)})` : row?.state === "scheduled" ? at(row.next) : WHEN[row?.state] ?? "unknown";
+};
 
 /** `ahub schedule list`: one row per configured schedule with its next run. */
 export function renderScheduleList(rows: unknown, columns?: number, now = Date.now()): Span[][] {
   const schedules = list(rows);
   if (!schedules.length) return [[s("no schedules configured; add them under `schedules` in .agenthub/config.local.json", "muted")]];
   const out: Span[][] = [...heading(`Schedules (${schedules.length})`, columns)];
-  out.push(...grid(["ID", "EVERY", "CLASS", "QUEUE", "STATE", "NEXT RUN", "LAST RUN", "TASK"], schedules.map((row: any) => [
-    s(row.id, "issueRef"), s(row.every), s(row.class), s(row.queue), s(row.state, TONE[row.state]), s(nextText(row, now), TONE[row.state]),
+  out.push(...grid(["ID", "SCHEDULE", "CLASS", "QUEUE", "STATE", "NEXT RUN", "LAST RUN", "TASK"], schedules.map((row: any) => [
+    s(row.id, "issueRef"), s(row.cron !== undefined ? schedulePeriodText(row) : String(row.every)), s(row.class), s(row.queue), s(row.state, TONE[row.state]), s(nextText(row, now), TONE[row.state]),
     s(row.last ? moment(row.last, now) : "never", "muted"), s(row.task === undefined ? "-" : `#${row.task}`, "taskRef"),
   ]), columns));
   for (const row of schedules) {

package/src/cli/setup-homes.ts

@@ -0,0 +1,46 @@
+import { checkClaudeHome, claudeHomeEnvironment, type ClaudeHome, type ClaudeHomeProbe } from "./claude-homes.ts";
+import { installClaudeProfileHook } from "./claude-profile-hook.ts";
+
+export interface SetupHomesPorts {
+  env: NodeJS.ProcessEnv;
+  packageRoot: string;
+  yes: boolean;
+  interactive?: boolean;
+  homes: readonly ClaudeHome[];
+  probe: ClaudeHomeProbe;
+  run(argv: readonly string[], env: NodeJS.ProcessEnv): Promise<number>;
+  ask(prompt: string): Promise<string | null>;
+  print(line: string): void;
+  current?(): void;
+}
+/** Selected homes only. Native plugin operations and the project-neutral hook share one person confirmation. */
+export async function setupClaudeHomes(ports: SetupHomesPorts): Promise<void> {
+  ports.current?.();
+  if (!ports.homes.length) { ports.print("No Claude configuration home in use was found; set CLAUDE_CONFIG_DIR to select one."); return; }
+  const initial = [];
+  for (const home of ports.homes) initial.push(await checkClaudeHome(home, ports.packageRoot, ports.env, ports.probe, undefined, true));
+  for (const check of initial) {
+    ports.print(`Claude home ${check.home.path}: plugin ${check.plugin.state}; hook ${check.hook.state}.`);
+    if (check.plugin.state === "unknown" || check.hook.state === "refused") throw new Error(`Claude setup cannot safely inspect ${check.home.path}; nothing was changed`);
+  }
+  for (const check of initial) if (check.next) ports.print(`${check.home.path}: ${check.next.argv.join(" ")} (${check.next.why})`);
+  if (initial.every(check => !check.next && check.hook.state === "installed")) return;
+  if (!ports.yes && ports.interactive === false) throw new Error("not a terminal: nothing was changed; rerun with --yes to apply");
+  if (!ports.yes && !["y", "yes"].includes((await ports.ask("Install the hub plugin and project-neutral hook in these Claude homes? [y/N] "))?.trim().toLowerCase() ?? "")) { ports.print("Claude setup was not changed."); return; }
+  ports.current?.();
+  for (const check of initial) {
+    let current = check;
+    for (let step = 0; current.next && step < 6; step++) {
+      ports.print(`${check.home.path}: ${current.next.argv.join(" ")} (${current.next.why})`);
+      ports.current?.();
+      if (await ports.run(current.next.argv, claudeHomeEnvironment(check.home, ports.env)) !== 0) throw new Error(`Claude plugin setup failed for ${check.home.path}; no later home was changed`);
+      current = await checkClaudeHome({ ...check.home, exists: true }, ports.packageRoot, ports.env, ports.probe, undefined, true);
+      if (current.plugin.state === "unknown") throw new Error(`Claude plugin inventory is unavailable for ${check.home.path}`);
+    }
+    if (current.next) throw new Error(`Claude setup exceeded six plugin steps for ${check.home.path}`);
+    ports.current?.();
+    const hook = installClaudeProfileHook(check.home);
+    if (hook.state !== "installed") throw new Error(hook.reason);
+    ports.print(`${check.home.path}: plugin current; hook ${hook.changed ? "installed" : "current"}. ${hook.reason}`);
+  }
+}

package/src/cli/setup.ts

@@ -1,2 +1,2 @@
 /** Compatibility exports; native plugin policy belongs to its adapter definition leaf. */
-export { PLUGIN, parseList, pluginState, nextStep, type InstalledPlugin, type Marketplace, type PluginState, type SetupStep } from "../adapters/definitions/native-cli-claude-setup.ts";
+export { PLUGIN, CLAUDE_PLUGIN_INVENTORY, parseList, pluginState, nextStep, type InstalledPlugin, type Marketplace, type PluginState, type SetupStep } from "../adapters/definitions/native-cli-claude-setup.ts";

package/src/cli/study-output.ts

@@ -0,0 +1,71 @@
+// Human output for `ahub study draft|revise|approve|approve-protocol|close|show`. Pure: the hub's parsed JSON in, spans out, no I/O. `--json` is the caller's branch and prints the same text.
+// A campaign is named by ids, revisions, states and counts. The hub already stubs private campaigns, tasks and sources; this file never asks for a question, scope, path or excerpt.
+import { blank, grid, heading, pair, s } from "./sdlc-output.ts";
+import type { Span, Tone } from "./console-state.ts";
+
+const list = (value: unknown): any[] => Array.isArray(value) ? value : [];
+const count = (value: unknown): number => typeof value === "number" && Number.isFinite(value) ? value : 0;
+const STATUS_TONE: Record<string, Tone | undefined> = { approved: undefined, draft: "attention", superseded: "muted", closed: "muted" };
+
+/** `ahub study show` with no id: one page of campaigns of this project, with the command that continues it when the hub says there is more. */
+export function renderStudyList(page: unknown, columns?: number): Span[][] {
+  const campaigns = list((page as any)?.campaigns), next = typeof (page as any)?.next === "string" ? (page as any).next as string : undefined;
+  if (!campaigns.length) return [[s("no research campaigns in this project; a planner or you draft one with `ahub study draft <parent> <contract.json>`", "muted")]];
+  const out: Span[][] = [...heading(`Research campaigns (${campaigns.length}${next ? ", more follow" : ""})`, columns)];
+  out.push(...grid(["ID", "REV", "STATUS", "PARENT", "UNITS"], campaigns.map((row: any) => [
+    s(row.id, "issueRef"), s(`r${count(row.revision)}`), s(row.status, STATUS_TONE[row.status]), s(`#${count(row.parentTaskId)}`, "taskRef"), s(count(row.unitCount)),
+  ]), columns));
+  if (next) out.push(blank, [s(`more campaigns: ahub study show --after ${next}`, "muted")]);
+  return out;
+}
+
+const SUPPORT_TONE: Record<string, Tone | undefined> = { enforceable: undefined, supported: undefined, advisory: "muted", unavailable: "attention", unsupported: "attention", unknown: "attention" };
+
+/** `ahub study show <id>`: the coverage and stop projection the hub computed. Held work is said first, with every reason. */
+export function renderStudyShow(projection: unknown, columns?: number): Span[][] {
+  const p = projection as any, units = list(p?.units), rounds = list(p?.discoveryRounds), reasons = list(p?.reasons);
+  const out: Span[][] = [...heading(`Research campaign ${p?.id ?? "?"}, revision ${count(p?.revision)}${p?.held ? ", dispatch HELD" : ""}`, columns)];
+  for (const reason of reasons) out.push(...pair("held", reason, columns, 8, "attention"));
+  if (p?.sharedPeerLedger) out.push(...pair("budget", "one run ledger is shared by the peers", columns, 8, "muted"));
+  if (rounds.length) out.push(...pair("rounds", rounds.map((round: any) => `${count(round.round)}: ${round.complete ? "discovery complete" : "discovery open"}`).join(", "), columns, 8));
+  out.push(blank);
+  if (!units.length) return [...out, [s("no units", "muted")]];
+  out.push(...grid(["UNIT", "ROUND", "TASK", "STATE", "PURPOSE", "HANDOFF", "SOURCES"], units.map((unit: any) => {
+    const handoff = unit.handoff ?? {};
+    const evidence = handoff.insufficientEvidence ? "insufficient evidence" : handoff.complete ? "complete" : handoff.present ? "incomplete" : "none";
+    const covered = list(unit.sourceIds).length;
+    const note = [unit.intentionalIndependentCheck ? "independent check" : "", list(unit.duplicateSourceIds).length ? `${list(unit.duplicateSourceIds).length} duplicated` : ""].filter(Boolean).join(", ");
+    return [s(unit.unitId, "issueRef"), s(count(unit.round)), s(unit.taskId == null ? "-" : `#${unit.taskId}`, "taskRef"), s(unit.state), s(unit.purpose), s(evidence, handoff.complete || handoff.insufficientEvidence ? undefined : "attention"),
+      s(covered ? `${list(handoff.coveredSourceIds).length}/${covered} covered${note ? `, ${note}` : ""}` : note || "-", "muted")];
+  }), columns));
+  // Every resource of a unit is shown whenever the campaign names a budget, with its support state: a limit the ledger does not carry (`null`) is a placeholder, not a reason to hide a row that says
+  // `unavailable` or `advisory`. A campaign that names no budget has nothing to say (its `tokens` row reads `unavailable` whatever the ledger is), so the hub's `budgetNamed` decides, not the values.
+  const budgeted = units.flatMap((unit: any) => Object.entries(unit.budget ?? {}).filter(([, value]: [string, any]) => value && typeof value === "object").map(([name, value]: [string, any]) => ({ unit: unit.unitId, name, value })));
+  if (budgeted.length && p?.budgetNamed === true) {
+    out.push(blank, ...heading("Budget", columns));
+    out.push(...grid(["UNIT", "RESOURCE", "SUPPORT", "USED", "LIMIT"], budgeted.map(({ unit, name, value }) => [
+      s(unit, "issueRef"), s(name), s(value.support, SUPPORT_TONE[value.support]), s(value.used === null || value.used === undefined ? "-" : value.used), s(value.limit === null || value.limit === undefined ? "-" : value.limit),
+    ]), columns));
+  }
+  return out;
+}
+
+const VERB: Record<string, string> = { draft: "drafted", revise: "drafted as the next revision", approve: "approved", close: "closed" };
+
+/** The receipt of a draft, revision, approval or close. */
+export function renderStudyReceipt(op: string, receipt: unknown, columns?: number): Span[][] {
+  const r = receipt as any, units = list(r?.units);
+  if (op === "approve_protocol") {
+    const hash = (value: unknown) => typeof value === "string" && value.length === 64 && /^[a-f0-9]{64}$/.test(value) ? value : "unknown";
+    const by = typeof r?.approvedBy === "string" && /^[a-z][a-z0-9_-]{0,63}$/.test(r.approvedBy) ? r.approvedBy : "unknown";
+    const at = typeof r?.approvedAt === "number" && Number.isFinite(r.approvedAt) && r.approvedAt >= 0 && r.approvedAt <= 8_640_000_000_000_000
+      ? new Date(r.approvedAt).toISOString().slice(0, 19).replace("T", " ") + " UTC" : "unknown";
+    return [...heading("Research protocol approval", columns), ...pair("protocol hash", hash(r?.protocolHash), columns, 16),
+      ...pair("evaluator hash", hash(r?.evaluatorHash), columns, 16), ...pair("approved by", by, columns, 16), ...pair("approved at", at, columns, 16)];
+  }
+  const out: Span[][] = [...heading(`Research campaign ${r?.id ?? "?"} revision ${count(r?.revision)} ${VERB[op] ?? op}`, columns)];
+  out.push(...pair("status", r?.status, columns, 8, STATUS_TONE[r?.status]), ...pair("parent", `#${count(r?.parentTaskId)}`, columns, 8, "taskRef"), ...pair("units", count(r?.unitCount), columns, 8));
+  if (units.length) out.push(blank, ...grid(["UNIT", "TASK", "ROUND"], units.map((unit: any) => [s(unit.unitId, "issueRef"), s(`#${count(unit.taskId)}`, "taskRef"), s(count(unit.round))]), columns));
+  if (op === "draft" || op === "revise") out.push(blank, [s(`nothing is dispatched until you approve: ahub study approve ${r?.id} ${count(r?.revision)}`, "muted")]);
+  return out;
+}

package/src/cli/study.ts

@@ -0,0 +1,58 @@
+// Argument parsing for `ahub study` (#601). Pure: argv in, one request description or a usage line out, so the I/O in main.ts stays a thin dispatcher and every form is testable without a daemon.
+export const STUDY_USAGE = "usage: ahub study draft <parent> <contract.json> | revise <id> <revision> <contract.json> | approve <id> <revision> | approve-protocol <hash> | close <id> <revision> --reason <text> | show [<id> | --after <id>] [--json] [--color=auto|always|never]";
+
+export type StudyRequest =
+  | { op: "draft"; parentTaskId: number; file: string }
+  | { op: "revise"; id: string; revision: number; file: string }
+  | { op: "approve"; id: string; revision: number }
+  | { op: "approve_protocol"; hash: string }
+  | { op: "close"; id: string; revision: number; reason: string }
+  | { op: "show"; id?: string; after?: string };
+
+const ID = /^rc-[a-f0-9]{12}$/, INT = /^[1-9]\d{0,8}$/;
+
+/** `operands` is argv with the presentation flags (`--json`, `--color=`) already removed by `splitPresentation`. `--reason` takes the rest of the words, as `task cancel --reason` does. */
+export function parseStudyArgs(operands: readonly string[]): StudyRequest | { usage: string } {
+  const usage = (detail?: string) => ({ usage: detail ? `${detail}\n${STUDY_USAGE}` : STUDY_USAGE });
+  const [sub, ...rest] = operands;
+  const id = (value: string | undefined) => value !== undefined && ID.test(value) ? value : undefined;
+  const int = (value: string | undefined) => value !== undefined && INT.test(value) ? Number(value) : undefined;
+  if (sub === "approve-protocol") {
+    if (rest.length !== 1) return usage();
+    const hash = rest[0];
+    return hash?.length === 64 && /^[a-f0-9]{64}$/.test(hash) ? { op: "approve_protocol", hash } : usage("a protocol hash is 64 lowercase hexadecimal characters");
+  }
+  if (sub === "show") {
+    // `--after <id>` continues a list from the cursor a previous page printed; it has no meaning with an id, which shows one campaign.
+    if (rest[0] === "--after") {
+      if (rest.length !== 2) return usage();
+      return id(rest[1]) ? { op: "show", after: rest[1]! } : usage("a campaign id looks like rc-0123456789ab");
+    }
+    if (rest.length > 1) return usage();
+    if (rest[0] === undefined) return { op: "show" };
+    return id(rest[0]) ? { op: "show", id: rest[0] } : usage("a campaign id looks like rc-0123456789ab");
+  }
+  if (sub === "draft") {
+    const parent = int(rest[0]);
+    if (parent === undefined || !rest[1] || rest.length !== 2) return usage();
+    return { op: "draft", parentTaskId: parent, file: rest[1] };
+  }
+  if (sub === "revise") {
+    const revision = int(rest[1]);
+    if (!id(rest[0]) || revision === undefined || !rest[2] || rest.length !== 3) return usage();
+    return { op: "revise", id: rest[0]!, revision, file: rest[2] };
+  }
+  if (sub === "approve") {
+    const revision = int(rest[1]);
+    if (!id(rest[0]) || revision === undefined || rest.length !== 2) return usage();
+    return { op: "approve", id: rest[0]!, revision };
+  }
+  if (sub === "close") {
+    const revision = int(rest[1]);
+    const at = rest.indexOf("--reason");
+    if (!id(rest[0]) || revision === undefined || at !== 2) return usage();
+    const reason = rest.slice(at + 1).join(" ").trim();
+    return reason ? { op: "close", id: rest[0]!, revision, reason } : usage("study close needs a reason");
+  }
+  return usage();
+}

package/src/cli/task-output.ts

@@ -104,6 +104,7 @@ function taskBlock(task: any, columns: number | undefined, now: number, detail:
     ...pair("class", dash(task?.class), columns, w, undefined, "  "), ...pair("owner", taskHolderText(task, "owner"), columns, w, undefined, "  "), ...pair("reviewer", taskHolderText(task, "reviewer"), columns, w, undefined, "  "));
   if (task?.planner !== undefined) out.push(...pair("planner", taskHolderText(task, "planner"), columns, w, undefined, "  "));
   if (task?.reserved) out.push(...pair("reserved", task.reserved, columns, w, undefined, "  "));
+  if (task?.handoffOrigin) out.push(...pair("from", `project ${task.handoffOrigin.projectId}, handed off by ${task.handoffOrigin.peer}${typeof task.handoffOrigin.task === "number" ? ` (their task #${task.handoffOrigin.task})` : ""}`, columns, w, "attention", "  "));
   out.push(...pair("after", ids(task?.deps), columns, w, undefined, "  "));
   if (typeof task?.release === "number") out.push(...pair("release", `#${task.release}`, columns, w, undefined, "  "));
   if (typeof task?.rank === "number" || typeof task?.priority === "number") out.push(...pair("planning", [typeof task.rank === "number" ? `rank ${task.rank}` : "", typeof task.priority === "number" ? `priority P${task.priority}` : "", task.pinned ? "pinned" : ""].filter(Boolean).join(", "), columns, w, undefined, "  "));

package/src/hub/action-class.ts

@@ -6,7 +6,7 @@ export type ActionClass = typeof ACTION_CLASSES[number];
 const SHELL_TOOLS = new Set(["bash", "shell", "shell_command", "exec_command", "run_shell_command"]);
 const LIMIT = 16_384;
 /** `nested`: the commands of each substitution in the segment (`$(...)`, a backtick). They run in a subshell, so their `cd` never moves the outer cwd. */
-type Command = { words: string[]; outputs: string[]; nested?: Command[][] };
+type Command = { words: string[]; outputs: string[]; nested?: Command[][]; /** A redirect of any kind (`>`, `>>`, `<`, `>|`): its target is not recorded as a word, so a caller that needs to know whether the command writes anything must count it. */ redirected?: true };
 
 /** Bound the whole input before accepting any prefix, including unsupported suffixes. */
 function segmentLimit(text: string): boolean {
@@ -105,7 +105,7 @@ function commands(text: string, nest = 0): Command[] | undefined {
   if (text.length > LIMIT || text.includes("\0") || !segmentLimit(text)) return;
   const result: Command[] = [];
   let words: string[] = [], outputs: string[] = [], word = "", active = false, quote = "";
-  let redirect: false | "overwrite" | "skip" = false;
+  let redirect: false | "overwrite" | "skip" = false, redirected = false;
   const flush = () => {
     if (!active) return;
     if (redirect === "overwrite") outputs.push(word);
@@ -113,7 +113,7 @@ function commands(text: string, nest = 0): Command[] | undefined {
     word = ""; active = false; redirect = false;
   };
   let nested: Command[][] = [];
-  const finish = () => { flush(); if (words.length || outputs.length || nested.length) result.push({ words, outputs, ...(nested.length ? { nested } : {}) }); words = []; outputs = []; nested = []; };
+  const finish = () => { flush(); if (words.length || outputs.length || nested.length) result.push({ words, outputs, ...(nested.length ? { nested } : {}), ...(redirected ? { redirected: true as const } : {}) }); words = []; outputs = []; nested = []; redirected = false; };
   for (let i = 0; i < text.length; i++) {
     const c = text[i]!;
     if (quote === "'") { if (c === "'") quote = ""; else word += c; continue; }
@@ -149,6 +149,7 @@ function commands(text: string, nest = 0): Command[] | undefined {
         i += 1 + duplicate[0].length; continue;
       }
       redirect = c === "<" || text[i + 1] === ">" ? "skip" : "overwrite";
+      redirected = true;
       if (text[i + 1] === ">" || text[i + 1] === "|") i++;
       continue;
     }
@@ -428,10 +429,191 @@ function curlWrites(input: string[]): boolean {
   return writes();
 }
 
-function sequence(parsed: Command[], root: string, initial: string[], found: Set<ActionClass>, depth = 0): void {
+/**
+ * #999 T3, the floor policy: what the classifier needs to tell an ordinary branch push or own-repository pull request from a release-grade one.
+ * The classifier stays pure, so the host supplies these facts. A fact that is missing is unknown, and unknown keeps the strictest class (#762).
+ * Without a `FloorFacts` argument nothing here runs and every class is exactly what it was before the floor existed.
+ */
+export interface FloorFacts {
+  /** The default branch from the authoritative remote read. Without it every push still asks. */
+  defaultBranch?: string;
+  /** The project's own GitHub repository, `owner/name`. Without it a `--repo` flag still asks. */
+  repository?: string;
+  /** Whether a local tag of that name exists in `cwd`: `false` only when git proved there is none. */
+  refIsTag?: (name: string, cwd: string) => boolean | undefined;
+  /** The branch checked out in `cwd`, or undefined when detached or unknown. */
+  currentBranch?: (cwd: string) => string | undefined;
+  /** Whether `cwd` is inside the project's own git repository (its top level is the execution root), so `origin` and `gh` mean the project's remote. `true` only when proven: a nested clone has another `origin`. */
+  inOwnRepository?: (cwd: string) => boolean | undefined;
+  /**
+   * Whether a plain `git push origin <branch>` from `cwd` can only write the project's own repository and only the named branch: every effective push URL of `origin`
+   * (`remote.origin.pushurl`, `url.*.pushInsteadOf`) is the project's repository, and no configuration can add refs to the push (`push.followTags`, `push.pushOption`,
+   * `remote.origin.push`, `remote.origin.mirror`), and the hub's own environment overrides none of it. `true` only when proven.
+   */
+  pushIsOwn?: (cwd: string) => boolean | undefined;
+  /**
+   * Whether `gh` run in `cwd` with no `--repo` resolves to the project's own repository: the checkout has no remote but `origin`, its `gh-resolved` marker does not name another
+   * repository, and neither `GH_REPO` nor `GH_HOST` is set in the hub's environment. `true` only when proven.
+   */
+  ghDefaultIsOwn?: (cwd: string) => boolean | undefined;
+}
+/** The only `git push` options the floor lets through. Force, delete, tags, mirror, prune, no-verify, push options and another repository all ask. */
+const FLOOR_PUSH_LONG = new Set(["--set-upstream", "--quiet", "--verbose", "--dry-run", "--porcelain", "--atomic", "--progress", "--no-progress"]);
+const FLOOR_PUSH_SHORT = "uqvn";
+const BRANCH_NAME = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const plainBranch = (name: string): boolean => BRANCH_NAME.test(name) && !name.includes("..") && !name.includes("//") && !name.endsWith("/") && !name.endsWith(".lock") && name !== "HEAD";
+const isDefaultBranch = (name: string, floor: FloorFacts): boolean => ["main", "master", floor.defaultBranch ?? ""].some(known => known !== "" && known.toLowerCase() === name.toLowerCase());
+/** Every candidate cwd is a known directory inside the execution root: `cd /elsewhere`, `cd $X` and `cd ~` leave the floor. */
+const withinRoot = (root: string, cwd: string[]): boolean => isAbsolute(root) && cwd.length > 0 && cwd.every(at => at !== "" && !outside(".", root, at));
+/** One push refspec is an ordinary branch push: literal, unforced, a non-default branch that git cannot read as a tag or another ref type. */
+function floorRefspec(spec: string, cwd: string[], floor: FloorFacts): boolean {
+  if (!floor.defaultBranch || spec.startsWith("+") || spec.startsWith("-") || opaque(spec)) return false;
+  const parts = spec.split(":");
+  if (parts.length > 2 || parts.some(part => part === "")) return false;       // `:branch` deletes, and `x:` or `a:b:c` is no refspec
+  const [src, dst] = parts as [string, string | undefined];
+  const target = dst ?? src;
+  const names: Array<{ name: string; qualified: boolean }> = [];
+  if (dst === undefined && src === "HEAD") {
+    for (const at of cwd) { const branch = floor.currentBranch?.(at); if (!branch) return false; names.push({ name: branch, qualified: true }); }
+  } else {
+    const qualified = target.startsWith("refs/heads/");
+    if (target.startsWith("refs/") && !qualified) return false;                 // refs/tags/, refs/notes/, refs/pull/ ...
+    names.push({ name: qualified ? target.slice("refs/heads/".length) : target, qualified });
+  }
+  for (const { name, qualified } of names) {
+    if (!plainBranch(name) || isDefaultBranch(name, floor)) return false;
+    if (qualified) continue;
+    // Git reads `heads/main` as refs/heads/main and `tags/v1` as a tag, and a bare name that is also a tag is ambiguous: only a proven non-tag passes.
+    if (["heads", "tags", "remotes", "refs"].includes(name.split("/")[0]!)) return false;
+    if (cwd.some(at => floor.refIsTag?.(name, at) !== false)) return false;
+  }
+  // `src:dst` with an unqualified dst takes its type from src: a source that may be a tag would push a tag. A qualified source is the ref it names (`refs/tags/v1` is a tag, never probed
+  // as a branch called `refs/tags/v1`), and a bare source with a ref-type prefix (`tags/v1`, `heads/x`, `remotes/...`) is not a plain branch name either.
+  if (dst !== undefined && src !== "HEAD" && (!dst.startsWith("refs/") || src.startsWith("refs/"))) {
+    if (src.startsWith("refs/")) { if (!src.startsWith("refs/heads/") || !plainBranch(src.slice("refs/heads/".length))) return false; }
+    else if (!plainBranch(src) || ["heads", "tags", "remotes", "refs"].includes(src.split("/")[0]!) || cwd.some(at => floor.refIsTag?.(src, at) !== false)) return false;
+  }
+  return true;
+}
+/** `git push` the floor does not ask about: an unforced push of non-default branches to `origin`, from inside the execution root. */
+function floorPush(globals: string[], args: string[], root: string, cwd: string[], floor: FloorFacts): boolean {
+  if (!withinRoot(root, cwd) || cwd.some(at => floor.inOwnRepository?.(at) !== true || floor.pushIsOwn?.(at) !== true)) return false;
+  let at = cwd;                                                                 // where git runs: `-C dir` moves it, and the tag and branch reads follow
+  let moved = false;
+  for (let i = 0; i < globals.length; i++) {
+    const option = globals[i]!;
+    if (["--no-pager", "-P", "-p", "--paginate", "--no-optional-locks"].includes(option)) continue;
+    if (option !== "-C" || moved) return false;                                 // -c, --git-dir, --work-tree and the rest can point `origin` anywhere
+    const dir = globals[++i];
+    if (!dir || opaque(dir) || cwd.some(from => outside(dir, root, from))) return false;
+    at = cwd.map(from => resolve(from, dir));
+    if (at.some(where => floor.inOwnRepository?.(where) !== true || floor.pushIsOwn?.(where) !== true)) return false;   // `-C` into a nested clone reaches that clone's origin
+    moved = true;
+  }
+  const operands: string[] = [];
+  let literal = false;
+  for (const arg of args) {
+    if (opaque(arg)) return false;
+    if (!literal && arg === "--") { literal = true; continue; }
+    if (!literal && arg.startsWith("--")) { if (!FLOOR_PUSH_LONG.has(arg)) return false; continue; }
+    if (!literal && /^-[^-]/.test(arg)) { if (![...arg.slice(1)].every(flag => FLOOR_PUSH_SHORT.includes(flag))) return false; continue; }
+    operands.push(arg);
+  }
+  const [remote, ...specs] = operands;
+  // A bare `git push` or `git push origin` follows push.default and may reach the default branch: it keeps asking.
+  return remote === "origin" && specs.length > 0 && specs.every(spec => floorRefspec(spec, at, floor));
+}
+/**
+ * The options of each `gh pr` subcommand the floor knows, with their arity: a value belongs to its option and never names a repository (a `--body` that holds a pull request URL is text, not a selector).
+ * An option not listed here is unknown, and an unknown option keeps the call asking: it may take a value the floor would then misread as a positional or a selector.
+ * `-R` and `--repo` are handled apart. Sources: `gh pr create|comment|review|merge --help`.
+ */
+const GH_PR_OPTIONS: Readonly<Record<string, { readonly flags: readonly string[]; readonly values: readonly string[] }>> = {
+  comment: { flags: ["-e", "--editor", "-w", "--web", "--edit-last", "--delete-last", "--create-if-none", "--yes"], values: ["-b", "--body", "-F", "--body-file"] },
+  create: { flags: ["-d", "--draft", "--dry-run", "-f", "--fill", "--fill-first", "--fill-verbose", "-w", "--web", "--no-maintainer-edit"],
+    values: ["-a", "--assignee", "-B", "--base", "-b", "--body", "-F", "--body-file", "-H", "--head", "-l", "--label", "-m", "--milestone", "-p", "--project", "-r", "--reviewer", "-T", "--template", "-t", "--title", "--recover"] },
+  review: { flags: ["-a", "--approve", "-c", "--comment", "-r", "--request-changes"], values: ["-b", "--body", "-F", "--body-file"] },
+  merge: { flags: ["--auto", "-d", "--delete-branch", "--disable-auto", "-m", "--merge", "-r", "--rebase", "-s", "--squash"], values: ["-A", "--author-email", "-b", "--body", "-F", "--body-file", "--match-head-commit", "-t", "--subject"] },
+};
+/** `gh pr create|comment|review|merge` the floor does not ask about: the project's own repository, never an admin merge, never a foreign URL. */
+function floorPullRequest(sub: string, args: string[], root: string, cwd: string[], floor: FloorFacts): boolean {
+  const own = floor.repository?.toLowerCase(), options = GH_PR_OPTIONS[sub];
+  if (!own || !options || !withinRoot(root, cwd) || cwd.some(at => floor.inOwnRepository?.(at) !== true)) return false;   // an unknown repository is not the project's own
+  const sameRepository = (value: string | undefined): boolean => !!value && !opaque(value) && value.toLowerCase() === own;
+  let explicit = false;                                                          // the call names the project's own repository itself, so gh's default and GH_REPO do not matter
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (opaque(arg) || arg === "--admin" || arg.startsWith("--admin=")) return false;
+    if (arg === "-R" || arg === "--repo") { if (!sameRepository(args[++i])) return false; explicit = true; continue; }
+    if (arg.startsWith("--repo=")) { if (!sameRepository(arg.slice("--repo=".length))) return false; explicit = true; continue; }
+    if (/^-R./.test(arg)) { if (!sameRepository(arg.slice(2))) return false; explicit = true; continue; }
+    if (arg.startsWith("-")) {
+      const [name] = arg.split("=", 1) as [string], inline = arg.includes("=");
+      if (options.values.includes(name)) {
+        // The value is the option's: never a selector. But an expansion or a glob in it can become several words, one of them a real `-R`/`--repo`, so it is judged before it is skipped.
+        const value = inline ? arg.slice(name.length + 1) : args[i + 1];
+        if (value === undefined || opaque(value) || globby(value)) return false;
+        if (!inline) i++;
+        continue;
+      }
+      if (options.flags.includes(arg)) continue;
+      return false;                                                                // `--`, a cluster, an option the floor does not know: unknown is strict
+    }
+    // A positional: a pull request number or branch, or a URL, which can be another repository's.
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(arg)) {
+      const match = /^https:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/[0-9]+\/?$/.exec(arg);
+      if (!sameRepository(match?.[1])) return false;
+      explicit = true;
+    }
+  }
+  // With no selector gh picks its own default (`gh repo set-default`, another remote, GH_REPO): only a proven own default passes.
+  return explicit || cwd.every(at => floor.ghDefaultIsOwn?.(at) === true);
+}
+
+/**
+ * Commands that cannot change what the floor's facts were read from (git configuration, the checked-out branch, remotes, gh's default repository, the environment). A command
+ * earlier on the same line that is anything else ends the floor for the rest of that line: the facts were read before it ran.
+ */
+const FLOOR_INERT_GIT = new Set(["add", "commit", "status", "diff", "log", "show", "rm", "mv", "blame", "ls-files", "rev-parse", "describe", "shortlog"]);
+/** Every `find` primary that writes a file or runs a command: `-fprintf` and the other `-f*` actions create or truncate a named file (`.git/config` included), the `-exec` family runs code, `-delete` removes. */
+const FIND_WRITERS = new Set(["-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf", "-fls"]);
+/**
+ * A glob character: the shell may expand an unquoted one into several words, so the value is not the one it looks like.
+ * ponytail: the tokenizer drops quote state, so a quoted `--body "why?"` or a markdown `* item` is judged like an unquoted glob and asks. Ceiling: a prose body with `*`, `?` or `[`
+ * asks even where the shell would not expand it. Upgrade path: have `commands` mark a word that held an unquoted glob character, then test that mark here.
+ */
+const globby = (word: string): boolean => /[*?[]/.test(word);
+const FLOOR_INERT_PROGRAMS = new Set(["echo", "printf", "true", "false", ":", "ls", "pwd", "cat", "head", "tail", "wc", "rg", "grep", "test", "[", "sleep", "cd", "diff", "stat", "find"]);   // not `tree -o` or `file -C`: they write a named file
+function floorInert(command: Command, root: string, cwd: string[], floor: FloorFacts): boolean {
+  if (command.outputs.length > 0 || command.redirected || command.nested?.length) return false;   // any redirect may write .git/config (`>>` is not an output of the destroy rule); a substitution runs commands of its own
+  if (unwrapped(command.words).length !== command.words.length) return false;   // `env X=1 ...`, `sudo`, `VAR=x cmd`
+  const [name, ...args] = command.words;
+  if (!name || opaque(name) || command.words.some(opaque)) return false;
+  const program = basename(name);
+  if (program === "git") {
+    const heads = commandHeads(args, ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env"], ["-P", "-p", "--no-pager", "--paginate", "--literal-pathspecs", "--bare", "--no-optional-locks", "--no-replace-objects"], ["push"]);
+    if (heads.length !== 1 || args.includes("-c") || args.some(arg => arg.startsWith("--config-env"))) return false;
+    // A push the floor itself lets through only writes remote refs and, with `-u`, this branch's upstream: none of what the floor reads (push destination, tag and push settings, the default repository).
+    if (heads[0]!.name === "push") return floorPush(args.slice(0, args.length - heads[0]!.args.length - 1), heads[0]!.args, root, cwd, floor);
+    // `git diff|log|show|blame --output=<file>` writes a named file (`.git/config` included), and a glob can expand into that option: both end the floor.
+    if (["diff", "log", "show", "blame"].includes(heads[0]!.name) && args.some(arg => arg === "--output" || arg.startsWith("--output=") || arg.startsWith("--out") || globby(arg))) return false;
+    return FLOOR_INERT_GIT.has(heads[0]!.name);
+  }
+  if (!FLOOR_INERT_PROGRAMS.has(program)) return false;
+  // `find` and `rg` take actions as options: a writer primary (`-fprintf`, `-exec`, `--pre`) makes them non-inert, and so does a glob anywhere in their arguments, because the shell
+  // expands an unquoted one before they run and a file named `-fprintf` or `--pre` becomes that option (floor-find-output-invalidates-facts). The tokenizer does not keep quote state,
+  // so a quoted `-name '*.ts'` also ends the floor for the rest of the line (the ponytail on `globby`).
+  if (program === "find" && args.some(arg => FIND_WRITERS.has(arg) || /^-f(?:print|ls)/.test(arg) || globby(arg))) return false;
+  if (program === "rg" && args.some(arg => arg === "--pre" || arg.startsWith("--pre=") || globby(arg))) return false;
+  return true;
+}
+
+function sequence(parsed: Command[], root: string, initial: string[], found: Set<ActionClass>, depth = 0, floor?: FloorFacts): void {
   const cwd = new Set(initial);
+  let facts = floor;
   for (const command of parsed) {
-    classify(command, root, [...cwd], found, depth);
+    classify(command, root, [...cwd], found, depth, facts);
+    if (facts && !floorInert(command, root, [...cwd], facts)) facts = undefined;
     const [program, ...args] = unwrapped(command.words);
     const target = args[0] === "--" ? args[1] : args[0];
     // Retain both outcomes: cd may fail, or be in a pipeline/conditional branch.
@@ -447,8 +629,10 @@ function sequence(parsed: Command[], root: string, initial: string[], found: Set
     }
   }
 }
-function classify(command: Command, root: string, cwd: string[], found: Set<ActionClass>, depth = 0): void {
-  for (const group of command.nested ?? []) sequence(group, root, cwd, found, depth);   // a substitution's own cwd state; only its classes come back
+function classify(command: Command, root: string, cwd: string[], found: Set<ActionClass>, depth = 0, floor?: FloorFacts): void {
+  for (const group of command.nested ?? []) sequence(group, root, cwd, found, depth, floor);   // a substitution's own cwd state; only its classes come back
+  // The floor applies only to a bare command: `env X=1 git push`, `GIT_SSH_COMMAND=... git push`, `sudo`, `timeout`, `if` and the other wrappers `unwrapped` peels can redirect or re-time a push the floor cannot read.
+  const bare = floor !== undefined && unwrapped(command.words).length === command.words.length;
   const words = unwrapped(command.words);
   const program = basename(words.shift() ?? "");
   if (["sh", "bash", "zsh"].includes(program) && depth < 2) {
@@ -458,7 +642,8 @@ function classify(command: Command, root: string, cwd: string[], found: Set<Acti
     if (mode && /^-[A-Za-z]*c[A-Za-z]*$/.test(mode)) {
       if (shell[0] === "--") shell.shift();
       const nested = shell[0] === undefined ? undefined : commands(shell[0].replaceAll(OPAQUE, "$_"));
-      if (nested) sequence(nested, root, cwd, found, depth + 1);
+      // A wrapped shell (`env GH_REPO=x sh -c '...'`) runs its text under whatever the wrapper set: the floor's authority does not reach inside it.
+      if (nested) sequence(nested, root, cwd, found, depth + 1, bare ? floor : undefined);
     }
   }
   if (command.outputs.some(p => cwd.some(at => outside(p, root, at)))) found.add("destroy");
@@ -467,7 +652,7 @@ function classify(command: Command, root: string, cwd: string[], found: Set<Acti
       ["-P", "-p", "--no-pager", "--paginate", "--literal-pathspecs", "--bare", "--no-optional-locks", "--no-replace-objects"], ["push", "reset", "clean", "branch"]);
     if (heads.some(head => opaque(head.name))) { found.add("publish"); found.add("destroy"); }   // `git $CMD`: the strictest classes git reaches (#762)
     for (const { name: sub, args } of heads) {
-      if (sub === "push") found.add("publish");
+      if (sub === "push" && !(bare && floorPush(words.slice(0, words.length - args.length - 1), args, root, cwd, floor!))) found.add("publish");
       if (sub === "reset" && (args.some(w => w === "--hard" || w.startsWith("--hard=")) || mayBeFlag(args))) found.add("destroy");
       if (sub === "clean" && forcedClean(args)) found.add("destroy");
       if (sub === "branch" && (flags(args, "D") || args.includes("--delete") && args.includes("--force") || mayBeFlag(args))) found.add("destroy");
@@ -498,7 +683,11 @@ function classify(command: Command, root: string, cwd: string[], found: Set<Acti
   if (program === "pipx" && words[0] === "install" || program === "brew" && ["install", "reinstall"].includes(words[0] ?? "") || ["pip", "pip3"].includes(program) && words[0] === "install" && words.includes("--user")) found.add("install");
   if (program === "gh") {
     if (words[0] === "release" && ["create", "upload", "edit", "delete"].includes(words[1] ?? "")) found.add("publish");
-    if (["issue", "pr", "gist"].includes(words[0] ?? "") && ["create", "comment", "edit", "close", "reopen", "merge", "review", "delete"].includes(words[1] ?? "")) found.add("external-write");
+    if (["issue", "pr", "gist"].includes(words[0] ?? "") && ["create", "comment", "edit", "close", "reopen", "merge", "review", "delete"].includes(words[1] ?? "")) {
+      // Floor: a pull request in the project's own repository is ordinary work. Issues, gists, edits, closes and deletes keep asking.
+      const ordinary = bare && words[0] === "pr" && ["create", "comment", "review", "merge"].includes(words[1]!) && floorPullRequest(words[1]!, words.slice(2), root, cwd, floor!);
+      if (!ordinary) found.add("external-write");
+    }
     if (opaque(words[0])) { found.add("publish"); found.add("external-write"); }   // `gh $GROUP ...`: the strictest classes gh reaches (#762)
     else if (opaque(words[1]) && ["release"].includes(words[0] ?? "")) found.add("publish");
     else if (opaque(words[1]) && ["issue", "pr", "gist", "run", "workflow", "repo", "secret", "variable", "label"].includes(words[0] ?? "")) found.add("external-write");
@@ -529,7 +718,7 @@ function classify(command: Command, root: string, cwd: string[], found: Set<Acti
  * Literal cd retains both success/failure cwd candidates (at most 128); it may
  * overclassify a later relative write and is not a shell control-flow proof.
  */
-export function classifyAction(tool: string, args: unknown, executionRoot: string): ActionClass[] {
+export function classifyAction(tool: string, args: unknown, executionRoot: string, floor?: FloorFacts): ActionClass[] {
   if (typeof tool !== "string" || tool.length > 128 || typeof executionRoot !== "string" || executionRoot.length > LIMIT) return [];
   if (typeof args === "string") {
     if (args.length > LIMIT) return [];
@@ -542,14 +731,14 @@ export function classifyAction(tool: string, args: unknown, executionRoot: strin
   const boundedArgv = (value: unknown): value is string[] => Array.isArray(value) && value.length <= 256 && value.every(w => typeof w === "string" && w.length <= LIMIT) && value.join("").length <= LIMIT;
   const location = input.cwd ?? input.workdir;
   const cwd = typeof location === "string" && location.startsWith("~") ? "" : typeof location === "string" && location.length <= LIMIT && !/[$`]/.test(location) ? resolve(executionRoot, location) : executionRoot;
-  if (tool.toLowerCase() === "git" && boundedArgv(input.args)) classify({ words: ["git", ...input.args], outputs: [] }, executionRoot, [cwd], found);
+  if (tool.toLowerCase() === "git" && boundedArgv(input.args)) classify({ words: ["git", ...input.args], outputs: [] }, executionRoot, [cwd], found, 0, floor);
   if (SHELL_TOOLS.has(tool.toLowerCase())) {
     const raw = input.command ?? input.cmd;
     if (typeof raw === "string") {
       const parsed = commands(raw);
-      if (parsed) sequence(parsed, executionRoot, [cwd], found);
+      if (parsed) sequence(parsed, executionRoot, [cwd], found, 0, floor);
     } else if (boundedArgv(raw)) {
-      classify({ words: raw, outputs: [] }, executionRoot, [cwd], found);
+      classify({ words: raw, outputs: [] }, executionRoot, [cwd], found, 0, floor);
     }
   }
   return ACTION_CLASSES.filter(value => found.has(value));