auto-mode 0.10.0 → 0.11.0

package/dist/{render-verdict-1xtCI2is.js → render-verdict-BiGjYb1x.js}

@@ -1,7 +1,8 @@
 import { readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, parse, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -2922,7 +2923,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -2933,7 +2934,7 @@ const memo = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -2999,10 +3000,10 @@ const memo = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -5526,574 +5527,613 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
+const PRESETS = {
+	jev: {
+		protocol: "system-one",
+		baseURL: "https://api.typesafe.ai",
+		model: "jev-1.13.0",
+		apiKeyEnv: "TYPESAFE_API_KEY",
+		reasoning: false,
+		maxTokens: 3e3,
+		timeoutMs: 5e3
+	},
+	spark: {
+		baseURL: "https://api.meta.ai",
+		model: "muse-spark-1.3-contributor",
+		apiKeyEnv: "META_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	claude: {
+		baseURL: "https://api.anthropic.com",
+		model: "claude-haiku-4-5-20251001",
+		apiKeyEnv: "ANTHROPIC_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	glm: {
+		baseURL: "https://api.z.ai/api/anthropic",
+		model: "glm-5.3-flash",
+		apiKeyEnv: "ZAI_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 6e4
+	}
+};
+const MESSAGES_DEFAULTS = {
+	protocol: "messages",
+	baseURL: "https://api.anthropic.com",
+	reasoning: true,
+	maxTokens: 3e3,
+	timeoutMs: 45e3
+};
+function findPreset(id) {
+	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
+}
 //#endregion
-//#region src/config/load-claude-rules.ts
-async function loadClaudeRules(path) {
-	const empty = {
-		environment: [],
-		allow: [],
-		soft_deny: [],
-		hard_deny: []
-	};
-	if (path === null) return empty;
-	const configDir = process.env["CLAUDE_CONFIG_DIR"];
-	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
-	const settingsPath = path ?? join(base, "settings.json");
+//#region src/config/read-api-key-from-command.ts
+function readApiKeyFromCommand(command, options = {}) {
+	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - Date.now();
+	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
+	return new Promise((resolve) => {
+		const grouped = process.platform !== "win32";
+		const child = spawn("/bin/sh", ["-c", command], {
+			detached: grouped,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		let output = "";
+		let settled = false;
+		let stopped = false;
+		const setResult = (value) => {
+			if (!settled) {
+				settled = true;
+				clearTimeout(timer);
+				options.signal?.removeEventListener("abort", stopChild);
+				resolve(value);
+			}
+		};
+		const stopChild = () => {
+			if (stopped) return;
+			stopped = true;
+			try {
+				if (grouped && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+				else child.kill("SIGKILL");
+			} catch {
+				child.kill("SIGKILL");
+			}
+		};
+		const timer = setTimeout(stopChild, Math.min(5e3, remainingMs));
+		options.signal?.addEventListener("abort", stopChild, { once: true });
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			if (stopped) return;
+			output += chunk;
+			if (output.length > 65536) stopChild();
+		});
+		child.on("error", () => {
+			setResult(null);
+		});
+		child.on("close", (code) => {
+			const key = !stopped && code === 0 && output.trim() !== "" ? output.trim() : null;
+			setResult(key);
+		});
+	});
+}
+//#endregion
+//#region src/config/config.ts
+const SCOPE_SOURCE_KINDS = [
+	"cwd",
+	"session",
+	"globs",
+	"atc"
+];
+const DEFAULT_PROVIDER = findPreset("jev");
+if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
+const DEFAULT_DENIAL_BUDGET = {
+	consecutive: 3,
+	perSession: 20
+};
+const DEFAULT_SCOPE_SOURCES = {
+	cwd: { kind: "cwd" },
+	session: { kind: "session" }
+};
+const DEFAULT_CONFIG = {
+	provider: DEFAULT_PROVIDER,
+	onFailure: "defer",
+	minConfidence: .8,
+	denialBudget: DEFAULT_DENIAL_BUDGET,
+	scopeSources: DEFAULT_SCOPE_SOURCES
+};
+function resolveConfigPath() {
+	const xdg = process.env["XDG_CONFIG_HOME"];
+	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
+	return join(base, "auto-mode", "config.json");
+}
+async function loadConfig(path = resolveConfigPath()) {
 	let raw;
 	try {
-		raw = await readFile(settingsPath, "utf8");
+		raw = await readFile(path, "utf8");
 	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
-		throw new Error("Claude settings unreadable", { cause: error });
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return DEFAULT_CONFIG;
+		throw new Error("auto-mode configuration unreadable", { cause: error });
 	}
-	const entries = array(string()).optional();
-	const schema = object({ autoMode: object({
-		environment: entries,
-		allow: entries,
-		soft_deny: entries,
-		hard_deny: entries
-	}).optional() });
-	let body;
+	let json;
 	try {
-		body = JSON.parse(raw);
+		json = JSON.parse(raw);
 	} catch {
-		throw new Error("Claude settings contain invalid JSON");
+		throw new Error(`${path} is not valid JSON`);
 	}
-	const parsed = schema.safeParse(body);
-	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
-	const rules = parsed.data;
+	return buildConfig(json, path);
+}
+const text = string().min(1);
+const positive = number().positive();
+const denialBudgetSchema = strictObject({
+	consecutive: number().int().positive().optional(),
+	perSession: number().int().positive().optional()
+});
+const configFileSchema = strictObject({
+	classifiers: record(text, unknown()).optional(),
+	scopeSources: record(text, unknown()).optional(),
+	decision: strictObject({
+		classifier: text.optional(),
+		judge: text.nullable().optional(),
+		minConfidence: number().min(.5).max(1).optional(),
+		onFailure: _enum(["defer", "deny"]).optional(),
+		denialBudget: denialBudgetSchema.optional()
+	}).optional(),
+	policy: strictObject({
+		rulesPath: text.nullable().optional(),
+		frameworkPath: text.nullable().optional(),
+		claudeSettingsPath: text.nullable().optional()
+	}).optional()
+});
+function buildConfig(json, path) {
+	const parsed = configFileSchema.safeParse(json);
+	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
+	const file = parsed.data;
+	const warnings = [];
+	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
+	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
+	const configuredSources = file.scopeSources === void 0 ? null : scopeSources.entries;
+	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`), ...collectScopeWarnings(configuredSources).map((line) => `${path}: scopeSources ${line}`));
+	const decision = file.decision ?? {};
+	const policy = file.policy ?? {};
+	const judgeID = decision.judge ?? null;
 	return {
-		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
-		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
-		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
-		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
+		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
+		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
+		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
+		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
+		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
+		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
+		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
+		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
+		denialBudget: {
+			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
+			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
+		},
+		warnings
 	};
 }
-//#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
+function collectScopeWarnings(entries) {
+	if (entries === null) return [];
+	const sources = Object.values(entries);
+	return [...sources.some((source) => source.kind === "cwd") ? [] : ["has no cwd entry, so the task owns only what the other sources name"], ...sources.flatMap((source) => source.paths ?? []).filter((glob) => glob.includes(".worktrees")).map((glob) => `glob ${glob} covers worktrees that other tasks own`)];
+}
+function buildRegistry(raw, parseEntry) {
+	const entries = /* @__PURE__ */ new Map();
+	const dropped = [];
+	const droppedIDs = [];
+	for (const [id, entry] of Object.entries(raw)) {
+		const result = parseEntry(id, entry);
+		if (typeof result === "string") {
+			dropped.push(`${id} dropped: ${result}`);
+			droppedIDs.push(id);
+		} else entries.set(id, result);
+	}
+	return {
+		entries: Object.fromEntries(entries),
+		dropped,
+		droppedIDs
 	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			collectSegment();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			collectSegment();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
+}
+const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
+const classifierEntrySchema = strictObject({
+	kind: text.optional(),
+	baseURL: text.optional(),
+	model: text.optional(),
+	apiKeyEnv: text.optional(),
+	apiKeyCommand: text.optional(),
+	reasoning: boolean().optional(),
+	maxTokens: positive.optional(),
+	timeoutMs: positive.optional()
+});
+const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+	"apiKey",
+	"key",
+	"token",
+	"secret"
+]);
+function parseClassifierEntry(id, entry) {
+	if (typeof entry === "object" && entry !== null) {
+		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
+		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
 	}
-	collectSegment();
+	const parsed = classifierEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = parsed.data.kind ?? id;
+	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
+	const model = parsed.data.model ?? base?.model;
+	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
 	return {
-		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
+		protocol: base.protocol ?? "messages",
+		baseURL: parsed.data.baseURL ?? base.baseURL,
+		model,
+		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
+		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
+		reasoning: parsed.data.reasoning ?? base.reasoning,
+		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
+		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
 	};
 }
-//#endregion
-//#region src/containment/collect-scope-findings.ts
-function collectScopeFindings(action, scope) {
-	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
-	const command = action.input["command"];
-	const findings = [
-		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
-		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
-		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
-	];
-	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
+const scopeSourceEntrySchema = strictObject({
+	kind: text.optional(),
+	paths: array(text).min(1).optional()
+});
+function parseScopeSourceEntry(id, entry) {
+	const parsed = scopeSourceEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
+	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
+	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
+		kind,
+		paths: parsed.data.paths.map((glob) => expandHomePath(glob) ?? glob)
+	};
+	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
 }
-const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
-	"Edit",
-	"MultiEdit",
-	"Write",
-	"NotebookEdit"
-]);
-function collectTargetFindings(directory, target, scope) {
-	const path = resolvePath(directory, target, scope.home);
-	return path === null ? [] : collectPathFindings(path, scope);
+function formatFirstIssue(issues) {
+	const [issue] = issues;
+	if (issue === void 0) return "invalid entry";
+	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
 }
-const CREDENTIAL_PATHS = [
-	".ssh",
-	".aws",
-	".gnupg",
-	".gitconfig",
-	".netrc",
-	".npmrc",
-	".config/gh"
-];
-function collectPathFindings(path, scope) {
-	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
-		kind: "credential",
-		target: path
-	}];
-	return isInScope(path, scope) ? [] : [{
-		kind: "path",
-		target: path
-	}];
+function resolveRole(role, id, entries, droppedIDs, path) {
+	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
+	if (entry !== void 0) return entry;
+	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
+	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
+	return parseBuiltIn(id);
 }
-function collectToolFindings(action, scope) {
-	const verb = action.tool.split("__").at(-1) ?? "";
-	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
-	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
-	return !verb.includes("merge") && typeof number === "number" && scope.pullRequests.includes(number) ? [] : [{
-		kind: "remote-write",
-		target: action.tool
-	}];
+function parseBuiltIn(id) {
+	const resolved = parseClassifierEntry(id, {});
+	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
+	return resolved;
 }
-const PATH_WRITERS = /* @__PURE__ */ new Set([
-	"rm",
-	"rmdir",
-	"shred",
-	"truncate",
-	"chmod",
-	"chown"
-]);
-const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
-	"cp",
-	"mv",
-	"rsync",
-	"ln"
-]);
-function collectCommandFindings(command, cwd, scope) {
-	const findings = [];
-	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
-	let directory = cwd;
-	for (const segment of splitShellCommand(command).segments) {
-		const [name, ...args] = getCommandWords(splitWords$1(segment.text));
-		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
-		if (name === void 0) continue;
-		if (name === "cd" && hasPipe) directory = null;
-		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
-		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope));
-	}
-	return findings;
+function expandHomePath(path) {
+	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
 }
-function collectProgramFindings(name, args, directory, cwd, scope) {
-	const resolve = (path) => collectTargetFindings(directory, path, scope);
-	const operands = args.filter((word) => !word.startsWith("-"));
-	if (name === "git") return collectGitFindings(args, directory, cwd, scope);
-	if (name === "gh") return collectGhFindings(args, scope);
-	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
-	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
-	if (name === "find" && args.some((word) => word === "-delete" || word === "-exec")) return operands.slice(0, 1).flatMap((path) => resolve(path));
-	if ((name === "perl" || name === "sed") && args.some((word) => /^-\w*i/u.test(word))) return collectInPlaceFiles(args).flatMap((path) => resolve(path));
-	if (name === "ssh-keygen") return collectKeygenFiles(args).flatMap((path) => resolve(path));
-	if (name === "ssh") {
-		const logIndex = args.indexOf("-E");
-		const log = logIndex === -1 ? void 0 : args[logIndex + 1];
-		return [...log === void 0 ? [] : resolve(log), ...collectSSHFindings(args)];
-	}
-	if (name === "scp") {
-		const destination = collectSSHOperands(args).at(-1);
-		if (destination === void 0 || /^[^/]+:/u.test(destination)) return destination === void 0 ? [] : [{
-			kind: "remote-write",
-			target: "scp"
-		}];
-		return resolve(destination);
-	}
-	if (name === "curl") return collectCurlFindings(args);
-	const finding = findProgramFinding(name, args);
-	return finding === null ? [] : [finding];
+function resolveApiKey(provider, options = {}) {
+	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
+	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
+	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return Promise.resolve(null);
+	return readApiKeyFromCommand(provider.apiKeyCommand, options);
 }
-function collectCopyFindings(name, args, operands) {
-	const optionIndex = args.findIndex((word) => word === "-t" || word === "--target-directory");
-	let targetDirectory = args.find((word) => word.startsWith("--target-directory="))?.slice(19);
-	if (targetDirectory === void 0 && optionIndex !== -1) targetDirectory = args[optionIndex + 1];
-	if (targetDirectory !== void 0) {
-		const sources = operands.filter((word) => word !== targetDirectory);
-		return [targetDirectory, ...name === "mv" ? sources : []];
+//#endregion
+//#region src/config/load-claude-rules.ts
+async function loadClaudeRules(path) {
+	const empty = {
+		environment: [],
+		allow: [],
+		soft_deny: [],
+		hard_deny: []
+	};
+	if (path === null) return empty;
+	const configDir = process.env["CLAUDE_CONFIG_DIR"];
+	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
+	const settingsPath = path ?? join(base, "settings.json");
+	let raw;
+	try {
+		raw = await readFile(settingsPath, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
+		throw new Error("Claude settings unreadable", { cause: error });
 	}
-	if (operands.length < 2) return [];
-	return [operands.at(-1) ?? "", ...name === "mv" ? operands.slice(0, -1) : []];
-}
-const KEYGEN_READ_OPTIONS = /* @__PURE__ */ new Set([
-	"-l",
-	"-y",
-	"-F",
-	"-B",
-	"-R"
-]);
-function collectKeygenFiles(args) {
-	if (args.some((word) => KEYGEN_READ_OPTIONS.has(word))) return [];
-	const index = args.indexOf("-f");
-	const file = index === -1 ? void 0 : args[index + 1];
-	return file === void 0 ? [] : [file];
+	const entries = array(string()).optional();
+	const schema = object({ autoMode: object({
+		environment: entries,
+		allow: entries,
+		soft_deny: entries,
+		hard_deny: entries
+	}).optional() });
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		throw new Error("Claude settings contain invalid JSON");
+	}
+	const parsed = schema.safeParse(body);
+	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
+	const rules = parsed.data;
+	return {
+		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
+		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
+		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
+		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
+	};
 }
-const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-c",
-	"-D",
-	"-E",
-	"-F",
-	"-i",
-	"-J",
-	"-l",
-	"-L",
-	"-m"
-]);
-const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-o",
-	"-p",
-	"-P",
-	"-Q",
-	"-R",
-	"-S",
-	"-W",
-	"-w"
-]);
-function collectSSHOperands(args) {
-	const operands = [];
-	for (let index = 0; index < args.length; index += 1) {
-		const word = args[index] ?? "";
-		if (operands.length > 0 || !word.startsWith("-")) operands.push(word);
-		else if (SSH_VALUE_OPTIONS.has(word) || SSH_MORE_VALUE_OPTIONS.has(word)) index += 1;
-	}
-	return operands;
-}
-const SSH_READS = /* @__PURE__ */ new Set([
-	"cat",
-	"df",
-	"du",
-	"free",
-	"head",
-	"id",
-	"ls",
-	"ps",
-	"pwd",
-	"stat",
-	"tail",
-	"uname",
-	"uptime",
-	"whoami"
-]);
-function collectSSHFindings(args) {
-	const [host, ...remote] = collectSSHOperands(args);
-	if (host === void 0) return [];
-	const command = remote.join(" ");
-	const [program] = command.trim().split(/\s+/u);
-	return SSH_READS.has(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command) ? [] : [{
-		kind: "remote-write",
-		target: "ssh"
-	}];
-}
-const LOCAL_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"0.0.0.0"
-]);
-function collectCurlFindings(args) {
-	const joined = args.join(" ");
-	const isUpload = args.some((word) => /^-[a-zA-Z]*[dFT]$|^--(?:data\S*|form|upload-file|json)$/u.test(word));
-	const isWriteMethod = /(?:-X\s*|--request\s+)(?:POST|PUT|PATCH|DELETE)/u.test(joined);
-	if (!isUpload && !isWriteMethod) return [];
-	const hosts = args.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
-	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host)) ? [] : [{
-		kind: "remote-write",
-		target: "curl upload"
-	}];
-}
-const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
-	"clean",
-	"reset",
-	"checkout",
-	"switch",
-	"merge",
-	"commit",
-	"rm",
-	"stash",
-	"push"
-]);
-function collectGitFindings(args, directory, cwd, scope) {
-	let gitDirectory = directory;
-	let index = 0;
-	while (index < args.length && args[index]?.startsWith("-") === true) {
-		const option = args[index];
-		if (option === "-C") gitDirectory = resolvePath(gitDirectory, args[index + 1] ?? "", scope.home);
-		index += option === "-C" || option === "-c" ? 2 : 1;
-	}
-	const subcommand = args[index] ?? "";
-	const rest = args.slice(index + 1);
-	const operands = rest.filter((word) => !word.startsWith("-"));
-	const findings = [];
-	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope)) findings.push({
-		kind: "path",
-		target: gitDirectory
-	});
-	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope));
-	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
-		kind: "branch",
-		target: branch
-	});
-	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
-	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
-		kind: "credential",
-		target: `git config ${operands[0] ?? ""}`
-	});
-	if (subcommand === "push") {
-		const currentBranch = gitDirectory === cwd ? scope.currentBranch : null;
-		findings.push(...collectPushFindings(rest, operands, currentBranch, scope));
-	}
-	return findings;
-}
-function collectPushFindings(rest, operands, currentBranch, scope) {
-	const [remote, ...refspecs] = operands;
-	const findings = [];
-	if (rest.includes("--all") || rest.includes("--mirror")) findings.push({
-		kind: "branch",
-		target: "--all"
-	});
-	if (remote !== void 0 && !isUnresolved(remote) && !isOwnedRemote(remote, scope)) findings.push({
-		kind: "remote-write",
-		target: remote
-	});
-	const destinations = refspecs.length === 0 && !rest.includes("--tags") ? ["HEAD"] : refspecs;
-	for (const refspec of destinations) {
-		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
-		const branch = named === "HEAD" ? currentBranch : named;
-		if (branch !== null && !isUnresolved(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
-			kind: "branch",
-			target: branch
-		});
+//#endregion
+//#region src/model/load-repository-context.ts
+async function loadRepositoryContext(cwd) {
+	if ([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR"
+	].some((name) => process.env[name] !== void 0)) return null;
+	let directory = resolve(cwd);
+	for (;;) {
+		const gitPath = join(directory, ".git");
+		try {
+			await stat(gitPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
+			const parent = dirname(directory);
+			if (parent === directory) return null;
+			directory = parent;
+			continue;
+		}
+		let gitDir = gitPath;
+		let head;
+		try {
+			try {
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			} catch {
+				const link = await readFile(gitPath, "utf8");
+				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
+				if (path === void 0) return null;
+				gitDir = resolve(directory, path.trim());
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			}
+		} catch {
+			return null;
+		}
+		let commonDir = gitDir;
+		try {
+			const common = await readFile(join(gitDir, "commondir"), "utf8");
+			commonDir = resolve(gitDir, common.trim());
+		} catch {
+			commonDir = gitDir;
+		}
+		let defaultBranch = null;
+		try {
+			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
+		} catch {
+			defaultBranch = null;
+		}
+		return {
+			cwd: resolve(cwd),
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch
+		};
 	}
-	return findings;
-}
-function isUnresolved(word) {
-	return /[$`]/u.test(word);
 }
-function isOwnedRemote(remote, scope) {
-	if (scope.remotes.some((entry) => entry.name === remote)) return true;
-	const slug = toRepositorySlug(remote);
-	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
 }
+//#endregion
+//#region src/containment/to-repository-slug.ts
 function toRepositorySlug(reference) {
 	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
 	if (match?.groups === void 0) return null;
 	const parts = match.groups;
 	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
 }
-const GH_PR_WRITES = /* @__PURE__ */ new Set([
-	"comment",
-	"merge",
-	"edit",
-	"close",
-	"review",
-	"ready",
-	"reopen"
-]);
-const GH_REMOTE_WRITES = /* @__PURE__ */ new Set([
-	"gist",
-	"release",
-	"repo",
-	"ruleset",
-	"label",
-	"workflow"
-]);
-const GH_CREDENTIAL_WRITES = /* @__PURE__ */ new Set([
-	"secret",
-	"variable",
-	"ssh-key",
-	"gpg-key"
-]);
-const GH_READS = /* @__PURE__ */ new Set([
-	"list",
-	"view",
-	"clone",
-	"status",
-	"checks",
-	"diff"
+//#endregion
+//#region src/scope/merge-scope-facts.ts
+function mergeScopeFacts(all) {
+	const pullRequests = /* @__PURE__ */ new Map();
+	for (const pull of all.flatMap((facts) => facts.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
+	return {
+		worktrees: [...new Set(all.flatMap((facts) => facts.worktrees))],
+		branches: [...new Set(all.flatMap((facts) => facts.branches))],
+		pullRequests: [...pullRequests.values()],
+		pathGlobs: [...new Set(all.flatMap((facts) => facts.pathGlobs))]
+	};
+}
+//#endregion
+//#region src/scope/build-task-scope.ts
+function buildTaskScope(input) {
+	const merged = mergeScopeFacts(input.facts);
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
+	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
+	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
+		number: pull.number,
+		repository: pull.repository
+	}));
+	return {
+		home: input.home,
+		worktrees: merged.worktrees,
+		branches,
+		currentBranch: input.currentBranch,
+		remotes: input.remotes,
+		pullRequests,
+		pathGlobs: merged.pathGlobs
+	};
+}
+const DEFAULT_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
 ]);
-function collectGhFindings(args, scope) {
-	const group = args[0] ?? "";
-	const verb = args[1] ?? "";
-	if (group === "pr" && GH_PR_WRITES.has(verb)) {
-		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
-		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
-		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
-		return verb !== "merge" && scope.pullRequests.includes(number) && (repo === void 0 || isCheckoutRepository(repo, scope)) ? [] : [{
-			kind: "remote-write",
-			target: `gh pr ${verb}`
-		}];
-	}
-	if (group === "issue" && verb !== "" && !GH_READS.has(verb)) return [{
-		kind: "remote-write",
-		target: `gh issue ${verb}`
-	}];
-	if (group === "api") return collectGhAPIFindings(args.slice(1), scope);
-	if (group === "auth" && [
-		"refresh",
-		"login",
-		"logout"
-	].includes(verb)) return [{
-		kind: "credential",
-		target: `gh auth ${verb}`
-	}];
-	if (GH_CREDENTIAL_WRITES.has(group) && !GH_READS.has(verb)) return [{
-		kind: "credential",
-		target: `gh ${group} ${verb}`
-	}];
-	if (GH_REMOTE_WRITES.has(group) && !GH_READS.has(verb)) return [{
-		kind: "remote-write",
-		target: `gh ${group} ${verb}`
-	}];
-	return [];
-}
-function isCheckoutRepository(repo, scope) {
-	const wanted = repo.toLowerCase().replace(/\.git$/u, "");
-	return scope.remotes.some((remote) => {
-		const slug = toRepositorySlug(remote.url);
-		return slug !== null && (slug === wanted || slug.endsWith(`/${wanted}`));
-	});
+//#endregion
+//#region src/scope/find-checkout.ts
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start) {
+	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
 }
-function collectGhAPIFindings(args, scope) {
-	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
-	if (endpoint === "graphql") return args.some((word) => /\bmutation\b/u.test(word)) ? [{
-		kind: "remote-write",
-		target: "gh api graphql mutation"
-	}] : [];
-	const methodIndex = args.findIndex((word) => word === "-X" || word === "--method");
-	const method = methodIndex === -1 ? null : (args[methodIndex + 1] ?? "").toUpperCase();
-	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
-	if (method === "GET" || method === null && !hasFields) return [];
-	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
-	if (pull !== void 0 && scope.pullRequests.includes(Number(pull["number"])) && isCheckoutRepository(pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
-	return [{
-		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
-		target: `gh api ${endpoint}`
-	}];
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
 }
-const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
-function findProgramFinding(name, args) {
-	const joined = args.join(" ");
-	if (name === "op" && /^(?:item|vault|document) (?:edit|create|delete)\b/u.test(joined)) return {
-		kind: "credential",
-		target: `op ${args[0] ?? ""} ${args[1] ?? ""}`
-	};
-	if (name === "aws" && args[0] === "iam" && IAM_WRITE.test(args[1] ?? "")) return {
-		kind: "credential",
-		target: `aws iam ${args[1] ?? ""}`
-	};
-	if (name === "docker" && /\b(?:volume|system|image|container) prune\b|\bvolume rm\b|\bdown\b.*(?:-v|--volumes)\b/u.test(joined)) return {
-		kind: "prune",
-		target: `docker ${joined}`
-	};
-	if (name === "npm" && args[0] === "publish") return {
-		kind: "remote-write",
-		target: "npm publish"
-	};
-	if (name === "kubectl" && /\b(?:apply|delete|replace|patch|scale)\b/u.test(joined)) return {
-		kind: "remote-write",
-		target: "kubectl write"
-	};
-	if (name === "terraform" && /\b(?:apply|destroy|import)\b/u.test(joined)) return {
-		kind: "remote-write",
-		target: "terraform write"
-	};
-	if (name === "psql" && /\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu.test(joined)) return {
-		kind: "remote-write",
-		target: "database write"
-	};
-	if (/^(?:bun|npm|pnpm|yarn)$/u.test(name) && /\bdeploy\b/u.test(joined) && /prod/u.test(joined)) return {
-		kind: "remote-write",
-		target: "production deploy"
-	};
-	return null;
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
 }
-function collectRedirectTargets(text) {
-	const targets = [];
-	let quote = null;
-	let index = 0;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (quote !== null) {
-			quote = ch === quote ? null : quote;
-			index += 1;
-		} else if (ch === "'" || ch === "\"") {
-			quote = ch;
-			index += 1;
-		} else if (ch === ">" && text.charAt(index - 1) !== "<") {
-			let next = index + 1;
-			if (text.charAt(next) === ">" || text.charAt(next) === "|") next += 1;
-			if (text.charAt(next) === "&") {
-				index = next + 1;
-				continue;
-			}
-			const [target, end] = readWord(text, next);
-			if (target !== "") targets.push(target);
-			index = end;
-		} else index += 1;
+//#endregion
+//#region src/scope/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
+			if (url !== void 0) remotes.push({
+				name: section,
+				url
+			});
+		}
 	}
-	return targets;
+	return remotes;
 }
-function readWord(text, start) {
-	let index = start;
-	while (/\s/u.test(text.charAt(index))) index += 1;
-	let word = "";
-	let quote = null;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (quote !== null) {
-			if (ch === quote) quote = null;
-			else word += ch;
-		} else if (ch === "'" || ch === "\"") quote = ch;
-		else if (/[\s;&|<>()]/u.test(ch)) break;
-		else word += ch;
-		index += 1;
+//#endregion
+//#region src/scope/types.ts
+const EMPTY_SCOPE_FACTS = {
+	worktrees: [],
+	branches: [],
+	pullRequests: [],
+	pathGlobs: []
+};
+const EMPTY_SESSION_SCOPE = {
+	worktrees: [],
+	branches: [],
+	pullRequests: []
+};
+//#endregion
+//#region src/scope/load-session-scope.ts
+const name = string().min(1);
+const pullRequestSchema = strictObject({
+	number: number().int().positive(),
+	head: name,
+	repository: name
+});
+const branchSchema = strictObject({
+	name,
+	commonDir: name
+});
+const sessionScopeSchema = strictObject({
+	worktrees: array(name),
+	branches: array(branchSchema),
+	pullRequests: array(pullRequestSchema)
+});
+async function loadSessionScope(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_SESSION_SCOPE;
 	}
-	return [word, index];
-}
-function collectInPlaceFiles(args) {
-	const files = [];
-	let skipNext = false;
-	let sawScript = false;
-	for (const word of args) if (skipNext) {
-		skipNext = false;
-		sawScript = true;
-	} else if (/^-\w*e$/u.test(word)) skipNext = true;
-	else if (!word.startsWith("-")) {
-		if (sawScript) files.push(word);
-		else sawScript = true;
+	try {
+		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
+	} catch {
+		return EMPTY_SESSION_SCOPE;
 	}
-	return files;
 }
-function getCommandWords(words) {
+//#endregion
+//#region src/scope/resolve-session-scope-path.ts
+function resolveSessionScopePath(stateDir, sessionID) {
+	const key = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
+	return join(stateDir, "session-scope", `${key}.json`);
+}
+//#endregion
+//#region src/scope/pick-scope-source-reader.ts
+function pickScopeSourceReader(source) {
+	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
+		worktrees: [context.worktree],
+		branches: context.branch === null ? [] : [context.branch]
+	}));
+	if (source.kind === "session") return async (context) => {
+		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
+		return buildFacts({
+			worktrees: scope.worktrees,
+			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
+			pullRequests: scope.pullRequests
+		});
+	};
+	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
+	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
+}
+function buildFacts(facts) {
+	return {
+		...EMPTY_SCOPE_FACTS,
+		...facts
+	};
+}
+//#endregion
+//#region src/scope/load-task-scope.ts
+async function loadTaskScope(request, sources) {
+	const cwd = resolve(request.cwd);
+	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
+	const branch = context?.branch ?? null;
+	const sourceContext = {
+		sessionID: request.sessionID,
+		cwd,
+		worktree: checkout?.worktree ?? cwd,
+		commonDir: checkout?.commonDir ?? null,
+		branch,
+		stateDir: request.stateDir
+	};
+	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
+	return buildTaskScope({
+		home: homedir(),
+		currentBranch: branch,
+		defaultBranch: context?.defaultBranch ?? null,
+		remotes,
+		facts
+	});
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
+//#region src/rules/split-command-words.ts
+function splitCommandWords(text) {
+	const words = splitWords$1(text);
 	let index = 0;
 	while (index < words.length) {
 		const word = words[index] ?? "";
@@ -6128,490 +6168,595 @@ function splitWords$1(text) {
 	if (started) words.push(current);
 	return words;
 }
-function resolvePath(cwd, path, home) {
-	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
-	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
-	if (cwd === null && !isAbsolute(expanded)) return null;
-	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
-	return normalize(absolute).replace(/(?<=.)\/$/u, "");
-}
-const SCRATCH_PATHS = [
-	"/tmp",
-	"/dev/null",
-	"/dev/stdout",
-	"/dev/stderr"
-];
-function isInScope(path, scope) {
-	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry))) return true;
-	return scope.worktrees.some((worktree) => {
-		const isNested = isUnder(path, join(worktree, ".worktrees"));
-		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
-		return isUnder(path, worktree) && (!isNested || isOtherOwned);
-	});
-}
-function isUnder(path, root) {
-	return path === root || path.startsWith(`${root}/`);
-}
 //#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory) return null;
-			directory = parent;
-			continue;
-		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
-		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
+//#region src/rules/split-shell-command.ts
+function splitShellCommand(command) {
+	const segments = [];
+	let current = "";
+	let quote = null;
+	let unparsed = false;
+	let i = 0;
+	const collectSegment = () => {
+		const text = current.trim();
+		if (text !== "") segments.push({ text });
+		current = "";
+	};
+	while (i < command.length) {
+		const ch = command.charAt(i);
+		if (quote !== null) {
+			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (ch === quote) quote = null;
+			current += ch;
+			i += 1;
+			continue;
 		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
+		if (ch === "'" || ch === "\"") {
+			quote = ch;
+			current += ch;
+			i += 1;
+			continue;
 		}
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
-		};
+		if (ch === "\\") {
+			current += command.slice(i, i + 2);
+			i += 2;
+			continue;
+		}
+		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
+			unparsed = true;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
+			collectSegment();
+			i += 2;
+			continue;
+		}
+		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
+			collectSegment();
+			i += 1;
+			continue;
+		}
+		current += ch;
+		i += 1;
 	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
-}
-//#endregion
-//#region src/containment/build-cwd-scope.ts
-function buildCWDScope(input) {
-	const isDefault = input.branch === input.defaultBranch || input.defaultBranch === null && DEFAULT_NAMES.has(input.branch ?? "");
+	collectSegment();
 	return {
-		home: input.home,
-		worktrees: [input.worktree],
-		branches: input.branch !== null && !isDefault ? [input.branch] : [],
-		currentBranch: input.branch,
-		remotes: input.remotes,
-		pullRequests: []
+		segments,
+		hasUnparsedConstruct: unparsed || quote !== null
 	};
 }
-const DEFAULT_NAMES = /* @__PURE__ */ new Set([
-	"main",
-	"master",
-	"trunk",
-	"develop"
-]);
 //#endregion
-//#region src/containment/load-task-scope.ts
-async function loadTaskScope(cwd) {
-	const [checkout, context] = await Promise.all([findCheckout(resolve(cwd)), loadRepositoryContext(cwd)]);
-	return buildCWDScope({
-		home: homedir(),
-		worktree: checkout?.worktree ?? resolve(cwd),
-		branch: context?.branch ?? null,
-		defaultBranch: context?.defaultBranch ?? null,
-		remotes: checkout === null ? [] : await readRemotes(checkout.commonDir)
-	});
+//#region src/containment/collect-scope-findings.ts
+function collectScopeFindings(action, scope) {
+	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
+	const command = action.input["command"];
+	const findings = [
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
+		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
+	];
+	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
 }
-const GIT_OVERRIDES = [
-	"GIT_DIR",
-	"GIT_WORK_TREE",
-	"GIT_COMMON_DIR"
+const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit"
+]);
+function collectTargetFindings(directory, target, scope) {
+	const path = resolvePath(directory, target, scope.home);
+	return path === null ? [] : collectPathFindings(path, scope);
+}
+const CREDENTIAL_PATHS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".gitconfig",
+	".netrc",
+	".npmrc",
+	".config/gh"
 ];
-async function findCheckout(start) {
-	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
-	for (let directory = start;; directory = dirname(directory)) {
-		const gitPath = join(directory, ".git");
-		const info = await stat(gitPath).catch(() => null);
-		if (info !== null) {
-			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
-			return gitDir === null ? null : {
-				worktree: directory,
-				commonDir: await findCommonDir(gitDir)
-			};
-		}
-		if (dirname(directory) === directory) return null;
-	}
+function collectPathFindings(path, scope) {
+	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
+		kind: "credential",
+		target: path
+	}];
+	return isInScope(path, scope) ? [] : [{
+		kind: "path",
+		target: path
+	}];
 }
-async function findLinkedGitDir(directory, gitPath) {
-	const link = await readFile(gitPath, "utf8").catch(() => "");
-	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
-	return path === void 0 ? null : resolve(directory, path.trim());
+function collectToolFindings(action, scope) {
+	const verb = action.tool.split("__").at(-1) ?? "";
+	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
+	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
+	const owner = action.input["owner"];
+	const name = action.input["repo"];
+	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
+	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+		kind: "remote-write",
+		target: action.tool
+	}];
 }
-async function findCommonDir(gitDir) {
-	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
-	return common === null ? gitDir : resolve(gitDir, common.trim());
+const PATH_WRITERS = /* @__PURE__ */ new Set([
+	"rm",
+	"rmdir",
+	"shred",
+	"truncate",
+	"chmod",
+	"chown"
+]);
+const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
+	"cp",
+	"mv",
+	"rsync",
+	"ln"
+]);
+function collectCommandFindings(command, cwd, scope) {
+	const findings = [];
+	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
+	let directory = cwd;
+	for (const segment of splitShellCommand(command).segments) {
+		const [name, ...args] = splitCommandWords(segment.text);
+		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
+		if (name === void 0) continue;
+		if (name === "cd" && hasPipe) directory = null;
+		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
+		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope));
+	}
+	return findings;
 }
-async function readRemotes(commonDir) {
-	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
-	const remotes = [];
-	let section = null;
-	for (const line of config.split("\n")) {
-		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
-		if (header !== void 0) section = header;
-		else if (/^\s*\[/u.test(line)) section = null;
-		else if (section !== null) {
-			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
-			if (url !== void 0) remotes.push({
-				name: section,
-				url
-			});
-		}
+function collectProgramFindings(name, args, directory, cwd, scope) {
+	const resolve = (path) => collectTargetFindings(directory, path, scope);
+	const operands = args.filter((word) => !word.startsWith("-"));
+	if (name === "git") return collectGitFindings(args, directory, cwd, scope);
+	if (name === "gh") return collectGhFindings(args, scope);
+	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
+	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
+	if (name === "find" && args.some((word) => word === "-delete" || word === "-exec")) return operands.slice(0, 1).flatMap((path) => resolve(path));
+	if ((name === "perl" || name === "sed") && args.some((word) => /^-\w*i/u.test(word))) return collectInPlaceFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh-keygen") return collectKeygenFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh") {
+		const logIndex = args.indexOf("-E");
+		const log = logIndex === -1 ? void 0 : args[logIndex + 1];
+		return [...log === void 0 ? [] : resolve(log), ...collectSSHFindings(args)];
 	}
-	return remotes;
+	if (name === "scp") {
+		const destination = collectSSHOperands(args).at(-1);
+		if (destination === void 0 || /^[^/]+:/u.test(destination)) return destination === void 0 ? [] : [{
+			kind: "remote-write",
+			target: "scp"
+		}];
+		return resolve(destination);
+	}
+	if (name === "curl") return collectCurlFindings(args);
+	const launcher = [name, ...args].findIndex((word) => word.includes("auto-mode"));
+	if (launcher !== -1 && [name, ...args].slice(launcher + 1).includes("record")) return [{
+		kind: "credential",
+		target: "auto-mode record"
+	}];
+	const finding = findProgramFinding(name, args);
+	return finding === null ? [] : [finding];
 }
-//#endregion
-//#region src/containment/check-containment.ts
-const CONTAINMENT_RULE = "Outside Task Scope";
-async function checkContainment(request) {
-	let scope;
-	try {
-		scope = await loadTaskScope(request.cwd);
-	} catch {
-		return null;
+function collectCopyFindings(name, args, operands) {
+	const optionIndex = args.findIndex((word) => word === "-t" || word === "--target-directory");
+	let targetDirectory = args.find((word) => word.startsWith("--target-directory="))?.slice(19);
+	if (targetDirectory === void 0 && optionIndex !== -1) targetDirectory = args[optionIndex + 1];
+	if (targetDirectory !== void 0) {
+		const sources = operands.filter((word) => word !== targetDirectory);
+		return [targetDirectory, ...name === "mv" ? sources : []];
 	}
-	const findings = collectScopeFindings({
-		tool: request.toolName,
-		cwd: request.cwd,
-		input: request.toolInput
-	}, scope);
-	if (findings.length === 0) return null;
-	return {
-		rule: CONTAINMENT_RULE,
-		reason: formatContainmentReason(findings, scope),
-		findings
-	};
+	if (operands.length < 2) return [];
+	return [operands.at(-1) ?? "", ...name === "mv" ? operands.slice(0, -1) : []];
 }
-const KIND_LABELS = {
-	path: "path",
-	branch: "branch",
-	"remote-write": "remote target",
-	credential: "credential or global setting",
-	prune: "shared resource"
-};
-function formatContainmentReason(findings, scope) {
-	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
-	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
-	const [branch] = scope.branches;
-	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`the worktree ${scope.worktrees.join(", ")}${branch === void 0 ? "" : ` and the branch ${branch}`}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
+const KEYGEN_READ_OPTIONS = /* @__PURE__ */ new Set([
+	"-l",
+	"-y",
+	"-F",
+	"-B",
+	"-R"
+]);
+function collectKeygenFiles(args) {
+	if (args.some((word) => KEYGEN_READ_OPTIONS.has(word))) return [];
+	const index = args.indexOf("-f");
+	const file = index === -1 ? void 0 : args[index + 1];
+	return file === void 0 ? [] : [file];
 }
-const PRESETS = {
-	jev: {
-		protocol: "system-one",
-		baseURL: "https://api.typesafe.ai",
-		model: "jev-1.13.0",
-		apiKeyEnv: "TYPESAFE_API_KEY",
-		reasoning: false,
-		maxTokens: 3e3,
-		timeoutMs: 5e3
-	},
-	spark: {
-		baseURL: "https://api.meta.ai",
-		model: "muse-spark-1.3-contributor",
-		apiKeyEnv: "META_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	claude: {
-		baseURL: "https://api.anthropic.com",
-		model: "claude-haiku-4-5-20251001",
-		apiKeyEnv: "ANTHROPIC_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	glm: {
-		baseURL: "https://api.z.ai/api/anthropic",
-		model: "glm-5.3-flash",
-		apiKeyEnv: "ZAI_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 6e4
+const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-c",
+	"-D",
+	"-E",
+	"-F",
+	"-i",
+	"-J",
+	"-l",
+	"-L",
+	"-m"
+]);
+const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-o",
+	"-p",
+	"-P",
+	"-Q",
+	"-R",
+	"-S",
+	"-W",
+	"-w"
+]);
+function collectSSHOperands(args) {
+	const operands = [];
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index] ?? "";
+		if (operands.length > 0 || !word.startsWith("-")) operands.push(word);
+		else if (SSH_VALUE_OPTIONS.has(word) || SSH_MORE_VALUE_OPTIONS.has(word)) index += 1;
 	}
-};
-const MESSAGES_DEFAULTS = {
-	protocol: "messages",
-	baseURL: "https://api.anthropic.com",
-	reasoning: true,
-	maxTokens: 3e3,
-	timeoutMs: 45e3
-};
-function findPreset(id) {
-	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
+	return operands;
 }
-//#endregion
-//#region src/config/read-api-key-from-command.ts
-function readApiKeyFromCommand(command, options = {}) {
-	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - Date.now();
-	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
-	return new Promise((resolve) => {
-		const grouped = process.platform !== "win32";
-		const child = spawn("/bin/sh", ["-c", command], {
-			detached: grouped,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-		let output = "";
-		let settled = false;
-		let stopped = false;
-		const setResult = (value) => {
-			if (!settled) {
-				settled = true;
-				clearTimeout(timer);
-				options.signal?.removeEventListener("abort", stopChild);
-				resolve(value);
-			}
-		};
-		const stopChild = () => {
-			if (stopped) return;
-			stopped = true;
-			try {
-				if (grouped && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
-				else child.kill("SIGKILL");
-			} catch {
-				child.kill("SIGKILL");
-			}
-		};
-		const timer = setTimeout(stopChild, Math.min(5e3, remainingMs));
-		options.signal?.addEventListener("abort", stopChild, { once: true });
-		child.stdout.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			if (stopped) return;
-			output += chunk;
-			if (output.length > 65536) stopChild();
-		});
-		child.on("error", () => {
-			setResult(null);
-		});
-		child.on("close", (code) => {
-			const key = !stopped && code === 0 && output.trim() !== "" ? output.trim() : null;
-			setResult(key);
-		});
+const SSH_READS = /* @__PURE__ */ new Set([
+	"cat",
+	"df",
+	"du",
+	"free",
+	"head",
+	"id",
+	"ls",
+	"ps",
+	"pwd",
+	"stat",
+	"tail",
+	"uname",
+	"uptime",
+	"whoami"
+]);
+function collectSSHFindings(args) {
+	const [host, ...remote] = collectSSHOperands(args);
+	if (host === void 0) return [];
+	const command = remote.join(" ");
+	const [program] = command.trim().split(/\s+/u);
+	return SSH_READS.has(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command) ? [] : [{
+		kind: "remote-write",
+		target: "ssh"
+	}];
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"0.0.0.0"
+]);
+function collectCurlFindings(args) {
+	const joined = args.join(" ");
+	const isUpload = args.some((word) => /^-[a-zA-Z]*[dFT]$|^--(?:data\S*|form|upload-file|json)$/u.test(word));
+	const isWriteMethod = /(?:-X\s*|--request\s+)(?:POST|PUT|PATCH|DELETE)/u.test(joined);
+	if (!isUpload && !isWriteMethod) return [];
+	const hosts = args.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
+	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host)) ? [] : [{
+		kind: "remote-write",
+		target: "curl upload"
+	}];
+}
+const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
+	"clean",
+	"reset",
+	"checkout",
+	"switch",
+	"merge",
+	"commit",
+	"rm",
+	"stash",
+	"push"
+]);
+function collectGitFindings(args, directory, cwd, scope) {
+	let gitDirectory = directory;
+	let index = 0;
+	while (index < args.length && args[index]?.startsWith("-") === true) {
+		const option = args[index];
+		if (option === "-C") gitDirectory = resolvePath(gitDirectory, args[index + 1] ?? "", scope.home);
+		index += option === "-C" || option === "-c" ? 2 : 1;
+	}
+	const subcommand = args[index] ?? "";
+	const rest = args.slice(index + 1);
+	const operands = rest.filter((word) => !word.startsWith("-"));
+	const findings = [];
+	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope)) findings.push({
+		kind: "path",
+		target: gitDirectory
+	});
+	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope));
+	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
+		kind: "branch",
+		target: branch
+	});
+	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
+	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
+		kind: "credential",
+		target: `git config ${operands[0] ?? ""}`
 	});
+	if (subcommand === "push") {
+		const currentBranch = gitDirectory === cwd ? scope.currentBranch : null;
+		findings.push(...collectPushFindings(rest, operands, currentBranch, scope));
+	}
+	return findings;
 }
-//#endregion
-//#region src/config/config.ts
-const SCOPE_SOURCE_KINDS = [
-	"cwd",
-	"session",
-	"globs",
-	"atc"
-];
-const DEFAULT_PROVIDER = findPreset("jev");
-if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
-const DEFAULT_DENIAL_BUDGET = {
-	consecutive: 3,
-	perSession: 20
-};
-const DEFAULT_CONFIG = {
-	provider: DEFAULT_PROVIDER,
-	onFailure: "defer",
-	minConfidence: .8,
-	denialBudget: DEFAULT_DENIAL_BUDGET
-};
-function resolveConfigPath() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
-	return join(base, "auto-mode", "config.json");
+function collectPushFindings(rest, operands, currentBranch, scope) {
+	const [remote, ...refspecs] = operands;
+	const findings = [];
+	if (rest.includes("--all") || rest.includes("--mirror")) findings.push({
+		kind: "branch",
+		target: "--all"
+	});
+	if (remote !== void 0 && !isUnresolved(remote) && !isOwnedRemote(remote, scope)) findings.push({
+		kind: "remote-write",
+		target: remote
+	});
+	const destinations = refspecs.length === 0 && !rest.includes("--tags") ? ["HEAD"] : refspecs;
+	for (const refspec of destinations) {
+		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
+		const branch = named === "HEAD" ? currentBranch : named;
+		if (branch !== null && !isUnresolved(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
+			kind: "branch",
+			target: branch
+		});
+	}
+	return findings;
+}
+function isUnresolved(word) {
+	return /[$`]/u.test(word);
+}
+function isOwnedRemote(remote, scope) {
+	if (scope.remotes.some((entry) => entry.name === remote)) return true;
+	const slug = toRepositorySlug(remote);
+	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
+}
+const GH_PR_WRITES = /* @__PURE__ */ new Set([
+	"comment",
+	"merge",
+	"edit",
+	"close",
+	"review",
+	"ready",
+	"reopen"
+]);
+const GH_REMOTE_WRITES = /* @__PURE__ */ new Set([
+	"gist",
+	"release",
+	"repo",
+	"ruleset",
+	"label",
+	"workflow"
+]);
+const GH_CREDENTIAL_WRITES = /* @__PURE__ */ new Set([
+	"secret",
+	"variable",
+	"ssh-key",
+	"gpg-key"
+]);
+const GH_READS = /* @__PURE__ */ new Set([
+	"list",
+	"view",
+	"clone",
+	"status",
+	"checks",
+	"diff"
+]);
+function collectGhFindings(args, scope) {
+	const group = args[0] ?? "";
+	const verb = args[1] ?? "";
+	if (group === "pr" && GH_PR_WRITES.has(verb)) {
+		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
+		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
+		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
+		return verb !== "merge" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+			kind: "remote-write",
+			target: `gh pr ${verb}`
+		}];
+	}
+	if (group === "issue" && verb !== "" && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh issue ${verb}`
+	}];
+	if (group === "api") return collectGhAPIFindings(args.slice(1), scope);
+	if (group === "auth" && [
+		"refresh",
+		"login",
+		"logout"
+	].includes(verb)) return [{
+		kind: "credential",
+		target: `gh auth ${verb}`
+	}];
+	if (GH_CREDENTIAL_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "credential",
+		target: `gh ${group} ${verb}`
+	}];
+	if (GH_REMOTE_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh ${group} ${verb}`
+	}];
+	return [];
+}
+function isOwnedPullRequest(number, repo, scope) {
+	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
+	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
+	return scope.pullRequests.some((pull) => pull.number === number && (wanted === void 0 ? slugs.size === 1 && slugs.has(pull.repository) : pull.repository === wanted || pull.repository.endsWith(`/${wanted}`)));
+}
+function collectGhAPIFindings(args, scope) {
+	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
+	if (endpoint === "graphql") return args.some((word) => /\bmutation\b/u.test(word)) ? [{
+		kind: "remote-write",
+		target: "gh api graphql mutation"
+	}] : [];
+	const methodIndex = args.findIndex((word) => word === "-X" || word === "--method");
+	const method = methodIndex === -1 ? null : (args[methodIndex + 1] ?? "").toUpperCase();
+	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
+	if (method === "GET" || method === null && !hasFields) return [];
+	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
+	if (pull !== void 0 && isOwnedPullRequest(Number(pull["number"]), pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
+	return [{
+		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
+		target: `gh api ${endpoint}`
+	}];
+}
+const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
+function findProgramFinding(name, args) {
+	const joined = args.join(" ");
+	if (name === "op" && /^(?:item|vault|document) (?:edit|create|delete)\b/u.test(joined)) return {
+		kind: "credential",
+		target: `op ${args[0] ?? ""} ${args[1] ?? ""}`
+	};
+	if (name === "aws" && args[0] === "iam" && IAM_WRITE.test(args[1] ?? "")) return {
+		kind: "credential",
+		target: `aws iam ${args[1] ?? ""}`
+	};
+	if (name === "docker" && /\b(?:volume|system|image|container) prune\b|\bvolume rm\b|\bdown\b.*(?:-v|--volumes)\b/u.test(joined)) return {
+		kind: "prune",
+		target: `docker ${joined}`
+	};
+	if (name === "npm" && args[0] === "publish") return {
+		kind: "remote-write",
+		target: "npm publish"
+	};
+	if (name === "kubectl" && /\b(?:apply|delete|replace|patch|scale)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "kubectl write"
+	};
+	if (name === "terraform" && /\b(?:apply|destroy|import)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "terraform write"
+	};
+	if (name === "psql" && /\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu.test(joined)) return {
+		kind: "remote-write",
+		target: "database write"
+	};
+	if (/^(?:bun|npm|pnpm|yarn)$/u.test(name) && /\bdeploy\b/u.test(joined) && /prod/u.test(joined)) return {
+		kind: "remote-write",
+		target: "production deploy"
+	};
+	return null;
 }
-async function loadConfig(path = resolveConfigPath()) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return DEFAULT_CONFIG;
-		throw new Error("auto-mode configuration unreadable", { cause: error });
-	}
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch {
-		throw new Error(`${path} is not valid JSON`);
+function collectRedirectTargets(text) {
+	const targets = [];
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			quote = ch === quote ? null : quote;
+			index += 1;
+		} else if (ch === "'" || ch === "\"") {
+			quote = ch;
+			index += 1;
+		} else if (ch === ">" && text.charAt(index - 1) !== "<") {
+			let next = index + 1;
+			if (text.charAt(next) === ">" || text.charAt(next) === "|") next += 1;
+			if (text.charAt(next) === "&") {
+				index = next + 1;
+				continue;
+			}
+			const [target, end] = readWord(text, next);
+			if (target !== "") targets.push(target);
+			index = end;
+		} else index += 1;
 	}
-	return buildConfig(json, path);
-}
-const text = string().min(1);
-const positive = number().positive();
-const denialBudgetSchema = strictObject({
-	consecutive: number().int().positive().optional(),
-	perSession: number().int().positive().optional()
-});
-const configFileSchema = strictObject({
-	classifiers: record(text, unknown()).optional(),
-	scopeSources: record(text, unknown()).optional(),
-	decision: strictObject({
-		classifier: text.optional(),
-		judge: text.nullable().optional(),
-		minConfidence: number().min(.5).max(1).optional(),
-		onFailure: _enum(["defer", "deny"]).optional(),
-		denialBudget: denialBudgetSchema.optional()
-	}).optional(),
-	policy: strictObject({
-		rulesPath: text.nullable().optional(),
-		frameworkPath: text.nullable().optional(),
-		claudeSettingsPath: text.nullable().optional()
-	}).optional()
-});
-function buildConfig(json, path) {
-	const parsed = configFileSchema.safeParse(json);
-	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
-	const file = parsed.data;
-	const warnings = [];
-	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
-	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
-	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`));
-	const decision = file.decision ?? {};
-	const policy = file.policy ?? {};
-	const judgeID = decision.judge ?? null;
-	return {
-		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
-		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
-		scopeSources: scopeSources.entries,
-		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
-		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
-		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
-		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
-		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
-		denialBudget: {
-			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
-			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
-		},
-		warnings
-	};
+	return targets;
 }
-function buildRegistry(raw, parseEntry) {
-	const entries = /* @__PURE__ */ new Map();
-	const dropped = [];
-	const droppedIDs = [];
-	for (const [id, entry] of Object.entries(raw)) {
-		const result = parseEntry(id, entry);
-		if (typeof result === "string") {
-			dropped.push(`${id} dropped: ${result}`);
-			droppedIDs.push(id);
-		} else entries.set(id, result);
+function readWord(text, start) {
+	let index = start;
+	while (/\s/u.test(text.charAt(index))) index += 1;
+	let word = "";
+	let quote = null;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			if (ch === quote) quote = null;
+			else word += ch;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (/[\s;&|<>()]/u.test(ch)) break;
+		else word += ch;
+		index += 1;
 	}
-	return {
-		entries: Object.fromEntries(entries),
-		dropped,
-		droppedIDs
-	};
+	return [word, index];
 }
-const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
-const classifierEntrySchema = strictObject({
-	kind: text.optional(),
-	baseURL: text.optional(),
-	model: text.optional(),
-	apiKeyEnv: text.optional(),
-	apiKeyCommand: text.optional(),
-	reasoning: boolean().optional(),
-	maxTokens: positive.optional(),
-	timeoutMs: positive.optional()
-});
-const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
-	"apiKey",
-	"key",
-	"token",
-	"secret"
-]);
-function parseClassifierEntry(id, entry) {
-	if (typeof entry === "object" && entry !== null) {
-		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
-		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
+function collectInPlaceFiles(args) {
+	const files = [];
+	let skipNext = false;
+	let sawScript = false;
+	for (const word of args) if (skipNext) {
+		skipNext = false;
+		sawScript = true;
+	} else if (/^-\w*e$/u.test(word)) skipNext = true;
+	else if (!word.startsWith("-")) {
+		if (sawScript) files.push(word);
+		else sawScript = true;
 	}
-	const parsed = classifierEntrySchema.safeParse(entry);
-	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
-	const kind = parsed.data.kind ?? id;
-	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
-	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
-	const model = parsed.data.model ?? base?.model;
-	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
-	return {
-		protocol: base.protocol ?? "messages",
-		baseURL: parsed.data.baseURL ?? base.baseURL,
-		model,
-		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
-		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
-		reasoning: parsed.data.reasoning ?? base.reasoning,
-		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
-		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
-	};
+	return files;
 }
-const scopeSourceEntrySchema = strictObject({
-	kind: text.optional(),
-	paths: array(text).min(1).optional()
-});
-function parseScopeSourceEntry(id, entry) {
-	const parsed = scopeSourceEntrySchema.safeParse(entry);
-	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
-	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
-	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
-	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
-		kind,
-		paths: parsed.data.paths
-	};
-	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
+function resolvePath(cwd, path, home) {
+	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
+	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
+	if (cwd === null && !isAbsolute(expanded)) return null;
+	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
+	return normalize(absolute).replace(/(?<=.)\/$/u, "");
 }
-function formatFirstIssue(issues) {
-	const [issue] = issues;
-	if (issue === void 0) return "invalid entry";
-	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
+const SCRATCH_PATHS = [
+	"/tmp",
+	"/dev/null",
+	"/dev/stdout",
+	"/dev/stderr"
+];
+function isInScope(path, scope) {
+	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+	return scope.worktrees.some((worktree) => {
+		const isNested = isUnder(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
+		return isUnder(path, worktree) && (!isNested || isOtherOwned);
+	});
 }
-function resolveRole(role, id, entries, droppedIDs, path) {
-	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
-	if (entry !== void 0) return entry;
-	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
-	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
-	return parseBuiltIn(id);
+function isUnder(path, root) {
+	return path === root || path.startsWith(`${root}/`);
 }
-function parseBuiltIn(id) {
-	const resolved = parseClassifierEntry(id, {});
-	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
-	return resolved;
+//#endregion
+//#region src/containment/check-containment.ts
+const CONTAINMENT_RULE = "Outside Task Scope";
+async function checkContainment(request, sources) {
+	let scope;
+	try {
+		scope = await loadTaskScope({
+			sessionID: request.sessionID,
+			cwd: request.cwd,
+			stateDir: resolveStateDir()
+		}, sources);
+	} catch {
+		return null;
+	}
+	const findings = collectScopeFindings({
+		tool: request.toolName,
+		cwd: request.cwd,
+		input: request.toolInput
+	}, scope);
+	if (findings.length === 0) return null;
+	return {
+		rule: CONTAINMENT_RULE,
+		reason: formatContainmentReason(findings, scope),
+		findings
+	};
 }
-function expandHomePath(path) {
-	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+const KIND_LABELS = {
+	path: "path",
+	branch: "branch",
+	"remote-write": "remote target",
+	credential: "credential or global setting",
+	prune: "shared resource"
+};
+function formatContainmentReason(findings, scope) {
+	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
+	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
+	const branches = scope.branches.length === 0 ? "" : ` and ${formatList("branch", "branches", scope.branches)}`;
+	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`${formatList("worktree", "worktrees", scope.worktrees)}${branches}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
 }
-function resolveApiKey(provider, options = {}) {
-	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
-	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
-	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return Promise.resolve(null);
-	return readApiKeyFromCommand(provider.apiKeyCommand, options);
+function formatList(one, many, values) {
+	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
@@ -7743,7 +7888,7 @@ async function classifyAction(request, config, options = {}) {
 	}
 	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
-	const containment = await checkContainment(request);
+	const containment = await checkContainment(request, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
 	if (containment !== null) {
 		const guidance = await tryReadDenialGuidance();
 		return {
@@ -7850,4 +7995,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, string as g, strictObject as h, classifyLocally as i, DEFAULT_DENIAL_BUDGET as l, number as m, parseActionRequest as n, parseModelVerdict as o, PRESETS as p, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };
+export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, loadRepositoryContext as _, classifyWithModel as a, DEFAULT_SCOPE_SOURCES as b, splitShellCommand as c, resolveSessionScopePath as d, loadSessionScope as f, toRepositorySlug as g, findCheckout as h, classifyLocally as i, splitCommandWords as l, loadCheckoutRemotes as m, parseActionRequest as n, parseModelVerdict as o, EMPTY_SESSION_SCOPE as p, classifyAction as r, loadPolicy as s, renderVerdict as t, resolveStateDir as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };