auto-mode 0.10.0 → 0.12.0

package/dist/{render-verdict-1xtCI2is.js → render-verdict-FhSKxlO9.js}

@@ -1,8 +1,22 @@
-import { readFile, stat } from "node:fs/promises";
+import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
+import { lstat, readFile, realpath, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, parse, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/bypass/resolve-edit-target.ts
+async function resolveEditTarget(path) {
+	const missing = [];
+	for (let current = path;; current = dirname(current)) try {
+		const real = await realpath(current);
+		return join(real, ...missing.toReversed());
+	} catch {
+		if (await lstat(current).catch(() => null) !== null || dirname(current) === current) return null;
+		missing.push(basename(current));
+	}
+}
+//#endregion
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -2922,7 +2936,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -2933,7 +2947,7 @@ const memo = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -2999,10 +3013,10 @@ const memo = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -5526,79 +5540,414 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
+const PRESETS = {
+	jev: {
+		protocol: "system-one",
+		baseURL: "https://api.typesafe.ai",
+		model: "jev-1.13.0",
+		apiKeyEnv: "TYPESAFE_API_KEY",
+		reasoning: false,
+		maxTokens: 3e3,
+		timeoutMs: 5e3
+	},
+	spark: {
+		baseURL: "https://api.meta.ai",
+		model: "muse-spark-1.3-contributor",
+		apiKeyEnv: "META_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	claude: {
+		baseURL: "https://api.anthropic.com",
+		model: "claude-haiku-4-5-20251001",
+		apiKeyEnv: "ANTHROPIC_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	glm: {
+		baseURL: "https://api.z.ai/api/anthropic",
+		model: "glm-5.3-flash",
+		apiKeyEnv: "ZAI_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 6e4
+	}
+};
+const MESSAGES_DEFAULTS = {
+	protocol: "messages",
+	baseURL: "https://api.anthropic.com",
+	reasoning: true,
+	maxTokens: 3e3,
+	timeoutMs: 45e3
+};
+function findPreset(id) {
+	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
+}
 //#endregion
-//#region src/config/load-claude-rules.ts
-async function loadClaudeRules(path) {
-	const empty = {
-		environment: [],
-		allow: [],
-		soft_deny: [],
-		hard_deny: []
-	};
-	if (path === null) return empty;
-	const configDir = process.env["CLAUDE_CONFIG_DIR"];
-	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
-	const settingsPath = path ?? join(base, "settings.json");
+//#region src/config/read-api-key-from-command.ts
+function readApiKeyFromCommand(command, options = {}) {
+	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - Date.now();
+	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
+	return new Promise((resolve) => {
+		const grouped = process.platform !== "win32";
+		const child = spawn("/bin/sh", ["-c", command], {
+			detached: grouped,
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+		let output = "";
+		let settled = false;
+		let stopped = false;
+		const setResult = (value) => {
+			if (!settled) {
+				settled = true;
+				clearTimeout(timer);
+				options.signal?.removeEventListener("abort", stopChild);
+				resolve(value);
+			}
+		};
+		const stopChild = () => {
+			if (stopped) return;
+			stopped = true;
+			try {
+				if (grouped && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
+				else child.kill("SIGKILL");
+			} catch {
+				child.kill("SIGKILL");
+			}
+		};
+		const timer = setTimeout(stopChild, Math.min(5e3, remainingMs));
+		options.signal?.addEventListener("abort", stopChild, { once: true });
+		child.stdout.setEncoding("utf8");
+		child.stdout.on("data", (chunk) => {
+			if (stopped) return;
+			output += chunk;
+			if (output.length > 65536) stopChild();
+		});
+		child.on("error", () => {
+			setResult(null);
+		});
+		child.on("close", (code) => {
+			const key = !stopped && code === 0 && output.trim() !== "" ? output.trim() : null;
+			setResult(key);
+		});
+	});
+}
+//#endregion
+//#region src/config/config.ts
+const SCOPE_SOURCE_KINDS = [
+	"cwd",
+	"session",
+	"globs",
+	"atc"
+];
+const DEFAULT_PROVIDER = findPreset("jev");
+if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
+const DEFAULT_DENIAL_BUDGET = {
+	consecutive: 3,
+	perSession: 20
+};
+const DEFAULT_SCOPE_SOURCES = {
+	cwd: { kind: "cwd" },
+	session: { kind: "session" }
+};
+const DEFAULT_CONFIG = {
+	provider: DEFAULT_PROVIDER,
+	onFailure: "defer",
+	minConfidence: .8,
+	denialBudget: DEFAULT_DENIAL_BUDGET,
+	scopeSources: DEFAULT_SCOPE_SOURCES
+};
+function resolveConfigPath() {
+	const xdg = process.env["XDG_CONFIG_HOME"];
+	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
+	return join(base, "auto-mode", "config.json");
+}
+async function loadConfig(path = resolveConfigPath()) {
 	let raw;
 	try {
-		raw = await readFile(settingsPath, "utf8");
+		raw = await readFile(path, "utf8");
 	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
-		throw new Error("Claude settings unreadable", { cause: error });
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return DEFAULT_CONFIG;
+		throw new Error("auto-mode configuration unreadable", { cause: error });
 	}
-	const entries = array(string()).optional();
-	const schema = object({ autoMode: object({
-		environment: entries,
-		allow: entries,
-		soft_deny: entries,
-		hard_deny: entries
-	}).optional() });
-	let body;
+	let json;
 	try {
-		body = JSON.parse(raw);
+		json = JSON.parse(raw);
 	} catch {
-		throw new Error("Claude settings contain invalid JSON");
+		throw new Error(`${path} is not valid JSON`);
 	}
-	const parsed = schema.safeParse(body);
-	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
-	const rules = parsed.data;
+	return buildConfig(json, path);
+}
+const text = string().min(1);
+const positive = number().positive();
+const denialBudgetSchema = strictObject({
+	consecutive: number().int().positive().optional(),
+	perSession: number().int().positive().optional()
+});
+const configFileSchema = strictObject({
+	classifiers: record(text, unknown()).optional(),
+	scopeSources: record(text, unknown()).optional(),
+	decision: strictObject({
+		classifier: text.optional(),
+		judge: text.nullable().optional(),
+		minConfidence: number().min(.5).max(1).optional(),
+		onFailure: _enum(["defer", "deny"]).optional(),
+		denialBudget: denialBudgetSchema.optional()
+	}).optional(),
+	policy: strictObject({
+		rulesPath: text.nullable().optional(),
+		frameworkPath: text.nullable().optional(),
+		claudeSettingsPath: text.nullable().optional()
+	}).optional()
+});
+function buildConfig(json, path) {
+	const parsed = configFileSchema.safeParse(json);
+	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
+	const file = parsed.data;
+	const warnings = [];
+	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
+	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
+	const configuredSources = file.scopeSources === void 0 ? null : scopeSources.entries;
+	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`), ...collectScopeWarnings(configuredSources).map((line) => `${path}: scopeSources ${line}`));
+	const decision = file.decision ?? {};
+	const policy = file.policy ?? {};
+	const judgeID = decision.judge ?? null;
 	return {
-		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
-		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
-		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
-		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
+		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
+		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
+		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
+		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
+		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
+		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
+		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
+		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
+		denialBudget: {
+			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
+			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
+		},
+		warnings
 	};
 }
-//#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
+function collectScopeWarnings(entries) {
+	if (entries === null) return [];
+	const sources = Object.values(entries);
+	return [...sources.some((source) => source.kind === "cwd") ? [] : ["has no cwd entry, so the task owns only what the other sources name"], ...sources.flatMap((source) => source.paths ?? []).filter((glob) => glob.includes(".worktrees")).map((glob) => `glob ${glob} covers worktrees that other tasks own`)];
+}
+function buildRegistry(raw, parseEntry) {
+	const entries = /* @__PURE__ */ new Map();
+	const dropped = [];
+	const droppedIDs = [];
+	for (const [id, entry] of Object.entries(raw)) {
+		const result = parseEntry(id, entry);
+		if (typeof result === "string") {
+			dropped.push(`${id} dropped: ${result}`);
+			droppedIDs.push(id);
+		} else entries.set(id, result);
+	}
+	return {
+		entries: Object.fromEntries(entries),
+		dropped,
+		droppedIDs
 	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
+}
+const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
+const classifierEntrySchema = strictObject({
+	kind: text.optional(),
+	baseURL: text.optional(),
+	model: text.optional(),
+	apiKeyEnv: text.optional(),
+	apiKeyCommand: text.optional(),
+	reasoning: boolean().optional(),
+	maxTokens: positive.optional(),
+	timeoutMs: positive.optional()
+});
+const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+	"apiKey",
+	"key",
+	"token",
+	"secret"
+]);
+function parseClassifierEntry(id, entry) {
+	if (typeof entry === "object" && entry !== null) {
+		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
+		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
+	}
+	const parsed = classifierEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = parsed.data.kind ?? id;
+	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
+	const model = parsed.data.model ?? base?.model;
+	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
+	return {
+		protocol: base.protocol ?? "messages",
+		baseURL: parsed.data.baseURL ?? base.baseURL,
+		model,
+		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
+		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
+		reasoning: parsed.data.reasoning ?? base.reasoning,
+		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
+		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
+	};
+}
+const scopeSourceEntrySchema = strictObject({
+	kind: text.optional(),
+	paths: array(text).min(1).optional()
+});
+function parseScopeSourceEntry(id, entry) {
+	const parsed = scopeSourceEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
+	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
+	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
+		kind,
+		paths: parsed.data.paths.map((glob) => expandHomePath(glob) ?? glob)
+	};
+	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
+}
+function formatFirstIssue(issues) {
+	const [issue] = issues;
+	if (issue === void 0) return "invalid entry";
+	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
+}
+function resolveRole(role, id, entries, droppedIDs, path) {
+	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
+	if (entry !== void 0) return entry;
+	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
+	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
+	return parseBuiltIn(id);
+}
+function parseBuiltIn(id) {
+	const resolved = parseClassifierEntry(id, {});
+	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
+	return resolved;
+}
+function expandHomePath(path) {
+	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+}
+function resolveApiKey(provider, options = {}) {
+	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
+	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
+	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return Promise.resolve(null);
+	return readApiKeyFromCommand(provider.apiKeyCommand, options);
+}
+//#endregion
+//#region src/config/load-claude-rules.ts
+async function loadClaudeRules(path) {
+	const empty = {
+		environment: [],
+		allow: [],
+		soft_deny: [],
+		hard_deny: []
+	};
+	if (path === null) return empty;
+	const configDir = process.env["CLAUDE_CONFIG_DIR"];
+	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
+	const settingsPath = path ?? join(base, "settings.json");
+	let raw;
+	try {
+		raw = await readFile(settingsPath, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
+		throw new Error("Claude settings unreadable", { cause: error });
+	}
+	const entries = array(string()).optional();
+	const schema = object({ autoMode: object({
+		environment: entries,
+		allow: entries,
+		soft_deny: entries,
+		hard_deny: entries
+	}).optional() });
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		throw new Error("Claude settings contain invalid JSON");
+	}
+	const parsed = schema.safeParse(body);
+	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
+	const rules = parsed.data;
+	return {
+		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
+		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
+		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
+		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
+	};
+}
+//#endregion
+//#region src/rules/split-command-words.ts
+function splitCommandWords(text) {
+	const words = splitWords$1(text);
+	let index = 0;
+	while (index < words.length) {
+		const word = words[index] ?? "";
+		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
+		else if (word === "env") {
+			index += 1;
+			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
+		} else if (word === "timeout") index += 2;
+		else break;
+	}
+	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
+}
+function splitWords$1(text) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	let started = false;
+	for (const ch of text) if (quote !== null) {
+		if (ch === quote) quote = null;
+		else current += ch;
+	} else if (ch === "'" || ch === "\"") {
+		quote = ch;
+		started = true;
+	} else if (/\s/u.test(ch)) {
+		if (started) words.push(current);
+		current = "";
+		started = false;
+	} else {
+		current += ch;
+		started = true;
+	}
+	if (started) words.push(current);
+	return words;
+}
+//#endregion
+//#region src/rules/split-shell-command.ts
+function splitShellCommand(command) {
+	const segments = [];
+	let current = "";
+	let quote = null;
+	let unparsed = false;
+	let i = 0;
+	const collectSegment = () => {
+		const text = current.trim();
+		if (text !== "") segments.push({ text });
+		current = "";
+	};
+	while (i < command.length) {
+		const ch = command.charAt(i);
+		if (quote !== null) {
+			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (ch === quote) quote = null;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			quote = ch;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "\\") {
+			current += command.slice(i, i + 2);
 			i += 2;
 			continue;
 		}
@@ -5628,6 +5977,14 @@ function splitShellCommand(command) {
 	};
 }
 //#endregion
+//#region src/containment/to-repository-slug.ts
+function toRepositorySlug(reference) {
+	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
+	if (match?.groups === void 0) return null;
+	const parts = match.groups;
+	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
+}
+//#endregion
 //#region src/containment/collect-scope-findings.ts
 function collectScopeFindings(action, scope) {
 	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
@@ -5672,7 +6029,10 @@ function collectToolFindings(action, scope) {
 	const verb = action.tool.split("__").at(-1) ?? "";
 	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
 	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
-	return !verb.includes("merge") && typeof number === "number" && scope.pullRequests.includes(number) ? [] : [{
+	const owner = action.input["owner"];
+	const name = action.input["repo"];
+	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
+	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
 		kind: "remote-write",
 		target: action.tool
 	}];
@@ -5696,7 +6056,7 @@ function collectCommandFindings(command, cwd, scope) {
 	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
 	let directory = cwd;
 	for (const segment of splitShellCommand(command).segments) {
-		const [name, ...args] = getCommandWords(splitWords$1(segment.text));
+		const [name, ...args] = splitCommandWords(segment.text);
 		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
 		if (name === void 0) continue;
 		if (name === "cd" && hasPipe) directory = null;
@@ -5729,6 +6089,11 @@ function collectProgramFindings(name, args, directory, cwd, scope) {
 		return resolve(destination);
 	}
 	if (name === "curl") return collectCurlFindings(args);
+	const launcher = [name, ...args].findIndex((word) => word.includes("auto-mode"));
+	if (launcher !== -1 && [name, ...args].slice(launcher + 1).includes("record")) return [{
+		kind: "credential",
+		target: "auto-mode record"
+	}];
 	const finding = findProgramFinding(name, args);
 	return finding === null ? [] : [finding];
 }
@@ -5903,12 +6268,6 @@ function isOwnedRemote(remote, scope) {
 	const slug = toRepositorySlug(remote);
 	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
 }
-function toRepositorySlug(reference) {
-	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
-	if (match?.groups === void 0) return null;
-	const parts = match.groups;
-	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
-}
 const GH_PR_WRITES = /* @__PURE__ */ new Set([
 	"comment",
 	"merge",
@@ -5947,7 +6306,7 @@ function collectGhFindings(args, scope) {
 		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
 		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
 		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
-		return verb !== "merge" && scope.pullRequests.includes(number) && (repo === void 0 || isCheckoutRepository(repo, scope)) ? [] : [{
+		return verb !== "merge" && isOwnedPullRequest(number, repo, scope) ? [] : [{
 			kind: "remote-write",
 			target: `gh pr ${verb}`
 		}];
@@ -5975,12 +6334,10 @@ function collectGhFindings(args, scope) {
 	}];
 	return [];
 }
-function isCheckoutRepository(repo, scope) {
-	const wanted = repo.toLowerCase().replace(/\.git$/u, "");
-	return scope.remotes.some((remote) => {
-		const slug = toRepositorySlug(remote.url);
-		return slug !== null && (slug === wanted || slug.endsWith(`/${wanted}`));
-	});
+function isOwnedPullRequest(number, repo, scope) {
+	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
+	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
+	return scope.pullRequests.some((pull) => pull.number === number && (wanted === void 0 ? slugs.size === 1 && slugs.has(pull.repository) : pull.repository === wanted || pull.repository.endsWith(`/${wanted}`)));
 }
 function collectGhAPIFindings(args, scope) {
 	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
@@ -5993,7 +6350,7 @@ function collectGhAPIFindings(args, scope) {
 	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
 	if (method === "GET" || method === null && !hasFields) return [];
 	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
-	if (pull !== void 0 && scope.pullRequests.includes(Number(pull["number"])) && isCheckoutRepository(pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
+	if (pull !== void 0 && isOwnedPullRequest(Number(pull["number"]), pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
 	return [{
 		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
 		target: `gh api ${endpoint}`
@@ -6090,528 +6447,64 @@ function collectInPlaceFiles(args) {
 	else if (!word.startsWith("-")) {
 		if (sawScript) files.push(word);
 		else sawScript = true;
-	}
-	return files;
-}
-function getCommandWords(words) {
-	let index = 0;
-	while (index < words.length) {
-		const word = words[index] ?? "";
-		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
-		else if (word === "env") {
-			index += 1;
-			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
-		} else if (word === "timeout") index += 2;
-		else break;
-	}
-	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
-}
-function splitWords$1(text) {
-	const words = [];
-	let current = "";
-	let quote = null;
-	let started = false;
-	for (const ch of text) if (quote !== null) {
-		if (ch === quote) quote = null;
-		else current += ch;
-	} else if (ch === "'" || ch === "\"") {
-		quote = ch;
-		started = true;
-	} else if (/\s/u.test(ch)) {
-		if (started) words.push(current);
-		current = "";
-		started = false;
-	} else {
-		current += ch;
-		started = true;
-	}
-	if (started) words.push(current);
-	return words;
-}
-function resolvePath(cwd, path, home) {
-	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
-	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
-	if (cwd === null && !isAbsolute(expanded)) return null;
-	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
-	return normalize(absolute).replace(/(?<=.)\/$/u, "");
-}
-const SCRATCH_PATHS = [
-	"/tmp",
-	"/dev/null",
-	"/dev/stdout",
-	"/dev/stderr"
-];
-function isInScope(path, scope) {
-	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry))) return true;
-	return scope.worktrees.some((worktree) => {
-		const isNested = isUnder(path, join(worktree, ".worktrees"));
-		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
-		return isUnder(path, worktree) && (!isNested || isOtherOwned);
-	});
-}
-function isUnder(path, root) {
-	return path === root || path.startsWith(`${root}/`);
-}
-//#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory) return null;
-			directory = parent;
-			continue;
-		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
-		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
-		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
-		}
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
-		};
-	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
-}
-//#endregion
-//#region src/containment/build-cwd-scope.ts
-function buildCWDScope(input) {
-	const isDefault = input.branch === input.defaultBranch || input.defaultBranch === null && DEFAULT_NAMES.has(input.branch ?? "");
-	return {
-		home: input.home,
-		worktrees: [input.worktree],
-		branches: input.branch !== null && !isDefault ? [input.branch] : [],
-		currentBranch: input.branch,
-		remotes: input.remotes,
-		pullRequests: []
-	};
-}
-const DEFAULT_NAMES = /* @__PURE__ */ new Set([
-	"main",
-	"master",
-	"trunk",
-	"develop"
-]);
-//#endregion
-//#region src/containment/load-task-scope.ts
-async function loadTaskScope(cwd) {
-	const [checkout, context] = await Promise.all([findCheckout(resolve(cwd)), loadRepositoryContext(cwd)]);
-	return buildCWDScope({
-		home: homedir(),
-		worktree: checkout?.worktree ?? resolve(cwd),
-		branch: context?.branch ?? null,
-		defaultBranch: context?.defaultBranch ?? null,
-		remotes: checkout === null ? [] : await readRemotes(checkout.commonDir)
-	});
-}
-const GIT_OVERRIDES = [
-	"GIT_DIR",
-	"GIT_WORK_TREE",
-	"GIT_COMMON_DIR"
-];
-async function findCheckout(start) {
-	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
-	for (let directory = start;; directory = dirname(directory)) {
-		const gitPath = join(directory, ".git");
-		const info = await stat(gitPath).catch(() => null);
-		if (info !== null) {
-			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
-			return gitDir === null ? null : {
-				worktree: directory,
-				commonDir: await findCommonDir(gitDir)
-			};
-		}
-		if (dirname(directory) === directory) return null;
-	}
-}
-async function findLinkedGitDir(directory, gitPath) {
-	const link = await readFile(gitPath, "utf8").catch(() => "");
-	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
-	return path === void 0 ? null : resolve(directory, path.trim());
-}
-async function findCommonDir(gitDir) {
-	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
-	return common === null ? gitDir : resolve(gitDir, common.trim());
-}
-async function readRemotes(commonDir) {
-	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
-	const remotes = [];
-	let section = null;
-	for (const line of config.split("\n")) {
-		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
-		if (header !== void 0) section = header;
-		else if (/^\s*\[/u.test(line)) section = null;
-		else if (section !== null) {
-			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
-			if (url !== void 0) remotes.push({
-				name: section,
-				url
-			});
-		}
-	}
-	return remotes;
-}
-//#endregion
-//#region src/containment/check-containment.ts
-const CONTAINMENT_RULE = "Outside Task Scope";
-async function checkContainment(request) {
-	let scope;
-	try {
-		scope = await loadTaskScope(request.cwd);
-	} catch {
-		return null;
-	}
-	const findings = collectScopeFindings({
-		tool: request.toolName,
-		cwd: request.cwd,
-		input: request.toolInput
-	}, scope);
-	if (findings.length === 0) return null;
-	return {
-		rule: CONTAINMENT_RULE,
-		reason: formatContainmentReason(findings, scope),
-		findings
-	};
-}
-const KIND_LABELS = {
-	path: "path",
-	branch: "branch",
-	"remote-write": "remote target",
-	credential: "credential or global setting",
-	prune: "shared resource"
-};
-function formatContainmentReason(findings, scope) {
-	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
-	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
-	const [branch] = scope.branches;
-	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`the worktree ${scope.worktrees.join(", ")}${branch === void 0 ? "" : ` and the branch ${branch}`}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
-}
-const PRESETS = {
-	jev: {
-		protocol: "system-one",
-		baseURL: "https://api.typesafe.ai",
-		model: "jev-1.13.0",
-		apiKeyEnv: "TYPESAFE_API_KEY",
-		reasoning: false,
-		maxTokens: 3e3,
-		timeoutMs: 5e3
-	},
-	spark: {
-		baseURL: "https://api.meta.ai",
-		model: "muse-spark-1.3-contributor",
-		apiKeyEnv: "META_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	claude: {
-		baseURL: "https://api.anthropic.com",
-		model: "claude-haiku-4-5-20251001",
-		apiKeyEnv: "ANTHROPIC_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	glm: {
-		baseURL: "https://api.z.ai/api/anthropic",
-		model: "glm-5.3-flash",
-		apiKeyEnv: "ZAI_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 6e4
-	}
-};
-const MESSAGES_DEFAULTS = {
-	protocol: "messages",
-	baseURL: "https://api.anthropic.com",
-	reasoning: true,
-	maxTokens: 3e3,
-	timeoutMs: 45e3
-};
-function findPreset(id) {
-	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
-}
-//#endregion
-//#region src/config/read-api-key-from-command.ts
-function readApiKeyFromCommand(command, options = {}) {
-	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - Date.now();
-	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
-	return new Promise((resolve) => {
-		const grouped = process.platform !== "win32";
-		const child = spawn("/bin/sh", ["-c", command], {
-			detached: grouped,
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		});
-		let output = "";
-		let settled = false;
-		let stopped = false;
-		const setResult = (value) => {
-			if (!settled) {
-				settled = true;
-				clearTimeout(timer);
-				options.signal?.removeEventListener("abort", stopChild);
-				resolve(value);
-			}
-		};
-		const stopChild = () => {
-			if (stopped) return;
-			stopped = true;
-			try {
-				if (grouped && child.pid !== void 0) process.kill(-child.pid, "SIGKILL");
-				else child.kill("SIGKILL");
-			} catch {
-				child.kill("SIGKILL");
-			}
-		};
-		const timer = setTimeout(stopChild, Math.min(5e3, remainingMs));
-		options.signal?.addEventListener("abort", stopChild, { once: true });
-		child.stdout.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
-			if (stopped) return;
-			output += chunk;
-			if (output.length > 65536) stopChild();
-		});
-		child.on("error", () => {
-			setResult(null);
-		});
-		child.on("close", (code) => {
-			const key = !stopped && code === 0 && output.trim() !== "" ? output.trim() : null;
-			setResult(key);
-		});
-	});
-}
-//#endregion
-//#region src/config/config.ts
-const SCOPE_SOURCE_KINDS = [
-	"cwd",
-	"session",
-	"globs",
-	"atc"
-];
-const DEFAULT_PROVIDER = findPreset("jev");
-if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
-const DEFAULT_DENIAL_BUDGET = {
-	consecutive: 3,
-	perSession: 20
-};
-const DEFAULT_CONFIG = {
-	provider: DEFAULT_PROVIDER,
-	onFailure: "defer",
-	minConfidence: .8,
-	denialBudget: DEFAULT_DENIAL_BUDGET
-};
-function resolveConfigPath() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
-	return join(base, "auto-mode", "config.json");
-}
-async function loadConfig(path = resolveConfigPath()) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return DEFAULT_CONFIG;
-		throw new Error("auto-mode configuration unreadable", { cause: error });
-	}
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch {
-		throw new Error(`${path} is not valid JSON`);
-	}
-	return buildConfig(json, path);
-}
-const text = string().min(1);
-const positive = number().positive();
-const denialBudgetSchema = strictObject({
-	consecutive: number().int().positive().optional(),
-	perSession: number().int().positive().optional()
-});
-const configFileSchema = strictObject({
-	classifiers: record(text, unknown()).optional(),
-	scopeSources: record(text, unknown()).optional(),
-	decision: strictObject({
-		classifier: text.optional(),
-		judge: text.nullable().optional(),
-		minConfidence: number().min(.5).max(1).optional(),
-		onFailure: _enum(["defer", "deny"]).optional(),
-		denialBudget: denialBudgetSchema.optional()
-	}).optional(),
-	policy: strictObject({
-		rulesPath: text.nullable().optional(),
-		frameworkPath: text.nullable().optional(),
-		claudeSettingsPath: text.nullable().optional()
-	}).optional()
-});
-function buildConfig(json, path) {
-	const parsed = configFileSchema.safeParse(json);
-	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
-	const file = parsed.data;
-	const warnings = [];
-	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
-	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
-	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`));
-	const decision = file.decision ?? {};
-	const policy = file.policy ?? {};
-	const judgeID = decision.judge ?? null;
-	return {
-		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
-		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
-		scopeSources: scopeSources.entries,
-		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
-		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
-		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
-		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
-		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
-		denialBudget: {
-			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
-			perSession: decision.denialBudget?.perSession ?? DEFAULT_DENIAL_BUDGET.perSession
-		},
-		warnings
-	};
-}
-function buildRegistry(raw, parseEntry) {
-	const entries = /* @__PURE__ */ new Map();
-	const dropped = [];
-	const droppedIDs = [];
-	for (const [id, entry] of Object.entries(raw)) {
-		const result = parseEntry(id, entry);
-		if (typeof result === "string") {
-			dropped.push(`${id} dropped: ${result}`);
-			droppedIDs.push(id);
-		} else entries.set(id, result);
-	}
-	return {
-		entries: Object.fromEntries(entries),
-		dropped,
-		droppedIDs
-	};
-}
-const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
-const classifierEntrySchema = strictObject({
-	kind: text.optional(),
-	baseURL: text.optional(),
-	model: text.optional(),
-	apiKeyEnv: text.optional(),
-	apiKeyCommand: text.optional(),
-	reasoning: boolean().optional(),
-	maxTokens: positive.optional(),
-	timeoutMs: positive.optional()
-});
-const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
-	"apiKey",
-	"key",
-	"token",
-	"secret"
-]);
-function parseClassifierEntry(id, entry) {
-	if (typeof entry === "object" && entry !== null) {
-		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
-		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
-	}
-	const parsed = classifierEntrySchema.safeParse(entry);
-	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
-	const kind = parsed.data.kind ?? id;
-	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
-	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
-	const model = parsed.data.model ?? base?.model;
-	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
-	return {
-		protocol: base.protocol ?? "messages",
-		baseURL: parsed.data.baseURL ?? base.baseURL,
-		model,
-		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
-		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
-		reasoning: parsed.data.reasoning ?? base.reasoning,
-		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
-		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
-	};
+	}
+	return files;
 }
-const scopeSourceEntrySchema = strictObject({
-	kind: text.optional(),
-	paths: array(text).min(1).optional()
-});
-function parseScopeSourceEntry(id, entry) {
-	const parsed = scopeSourceEntrySchema.safeParse(entry);
-	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
-	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
-	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
-	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
-		kind,
-		paths: parsed.data.paths
-	};
-	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
+function resolvePath(cwd, path, home) {
+	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
+	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
+	if (cwd === null && !isAbsolute(expanded)) return null;
+	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
+	return normalize(absolute).replace(/(?<=.)\/$/u, "");
 }
-function formatFirstIssue(issues) {
-	const [issue] = issues;
-	if (issue === void 0) return "invalid entry";
-	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
+const SCRATCH_PATHS = [
+	"/tmp",
+	"/dev/null",
+	"/dev/stdout",
+	"/dev/stderr"
+];
+function isInScope(path, scope) {
+	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+	return scope.worktrees.some((worktree) => {
+		const isNested = isUnder(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
+		return isUnder(path, worktree) && (!isNested || isOtherOwned);
+	});
 }
-function resolveRole(role, id, entries, droppedIDs, path) {
-	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
-	if (entry !== void 0) return entry;
-	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
-	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
-	return parseBuiltIn(id);
+function isUnder(path, root) {
+	return path === root || path.startsWith(`${root}/`);
 }
-function parseBuiltIn(id) {
-	const resolved = parseClassifierEntry(id, {});
-	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
-	return resolved;
+//#endregion
+//#region src/containment/check-containment.ts
+const CONTAINMENT_RULE = "Outside Task Scope";
+function checkContainment(request, scope) {
+	const findings = collectScopeFindings({
+		tool: request.toolName,
+		cwd: request.cwd,
+		input: request.toolInput
+	}, scope);
+	if (findings.length === 0) return null;
+	return {
+		rule: CONTAINMENT_RULE,
+		reason: formatContainmentReason(findings, scope),
+		findings
+	};
 }
-function expandHomePath(path) {
-	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+const KIND_LABELS = {
+	path: "path",
+	branch: "branch",
+	"remote-write": "remote target",
+	credential: "credential or global setting",
+	prune: "shared resource"
+};
+function formatContainmentReason(findings, scope) {
+	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
+	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
+	const branches = scope.branches.length === 0 ? "" : ` and ${formatList("branch", "branches", scope.branches)}`;
+	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`${formatList("worktree", "worktrees", scope.worktrees)}${branches}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
 }
-function resolveApiKey(provider, options = {}) {
-	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
-	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
-	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return Promise.resolve(null);
-	return readApiKeyFromCommand(provider.apiKeyCommand, options);
+function formatList(one, many, values) {
+	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
@@ -6882,6 +6775,68 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
+//#region src/model/load-repository-context.ts
+async function loadRepositoryContext(cwd) {
+	if ([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR"
+	].some((name) => process.env[name] !== void 0)) return null;
+	let directory = resolve(cwd);
+	for (;;) {
+		const gitPath = join(directory, ".git");
+		try {
+			await stat(gitPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
+			const parent = dirname(directory);
+			if (parent === directory) return null;
+			directory = parent;
+			continue;
+		}
+		let gitDir = gitPath;
+		let head;
+		try {
+			try {
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			} catch {
+				const link = await readFile(gitPath, "utf8");
+				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
+				if (path === void 0) return null;
+				gitDir = resolve(directory, path.trim());
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			}
+		} catch {
+			return null;
+		}
+		let commonDir = gitDir;
+		try {
+			const common = await readFile(join(gitDir, "commondir"), "utf8");
+			commonDir = resolve(gitDir, common.trim());
+		} catch {
+			commonDir = gitDir;
+		}
+		let defaultBranch = null;
+		try {
+			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
+		} catch {
+			defaultBranch = null;
+		}
+		return {
+			cwd: resolve(cwd),
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch
+		};
+	}
+}
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+}
+//#endregion
 //#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
 const t = Symbol.for("@ts-pattern/matcher");
 const e = Symbol.for("@ts-pattern/isVariadic");
@@ -7726,6 +7681,199 @@ function toUnquoted(word) {
 	return (first === "'" || first === "\"") && word.at(-1) === first ? word.slice(1, -1) : word;
 }
 //#endregion
+//#region src/scope/find-checkout.ts
+const GIT_OVERRIDES$1 = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start) {
+	if (GIT_OVERRIDES$1.some((name) => process.env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
+}
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
+}
+//#endregion
+//#region src/scope/merge-scope-facts.ts
+function mergeScopeFacts(all) {
+	const pullRequests = /* @__PURE__ */ new Map();
+	for (const pull of all.flatMap((facts) => facts.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
+	return {
+		worktrees: [...new Set(all.flatMap((facts) => facts.worktrees))],
+		branches: [...new Set(all.flatMap((facts) => facts.branches))],
+		pullRequests: [...pullRequests.values()],
+		pathGlobs: [...new Set(all.flatMap((facts) => facts.pathGlobs))]
+	};
+}
+//#endregion
+//#region src/scope/build-task-scope.ts
+function buildTaskScope(input) {
+	const merged = mergeScopeFacts(input.facts);
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
+	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
+	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
+		number: pull.number,
+		repository: pull.repository
+	}));
+	return {
+		home: input.home,
+		worktrees: merged.worktrees,
+		branches,
+		currentBranch: input.currentBranch,
+		remotes: input.remotes,
+		pullRequests,
+		pathGlobs: merged.pathGlobs
+	};
+}
+const DEFAULT_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
+]);
+//#endregion
+//#region src/scope/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
+			if (url !== void 0) remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+//#endregion
+//#region src/scope/types.ts
+const EMPTY_SCOPE_FACTS = {
+	worktrees: [],
+	branches: [],
+	pullRequests: [],
+	pathGlobs: []
+};
+const EMPTY_SESSION_SCOPE = {
+	worktrees: [],
+	branches: [],
+	pullRequests: []
+};
+//#endregion
+//#region src/scope/load-session-scope.ts
+const name = string().min(1);
+const pullRequestSchema = strictObject({
+	number: number().int().positive(),
+	head: name,
+	repository: name
+});
+const branchSchema = strictObject({
+	name,
+	commonDir: name
+});
+const sessionScopeSchema = strictObject({
+	worktrees: array(name),
+	branches: array(branchSchema),
+	pullRequests: array(pullRequestSchema)
+});
+async function loadSessionScope(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+	try {
+		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+}
+//#endregion
+//#region src/scope/resolve-session-scope-path.ts
+function resolveSessionScopePath(stateDir, sessionID) {
+	const key = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
+	return join(stateDir, "session-scope", `${key}.json`);
+}
+//#endregion
+//#region src/scope/pick-scope-source-reader.ts
+function pickScopeSourceReader(source) {
+	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
+		worktrees: [context.worktree],
+		branches: context.branch === null ? [] : [context.branch]
+	}));
+	if (source.kind === "session") return async (context) => {
+		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
+		return buildFacts({
+			worktrees: scope.worktrees,
+			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
+			pullRequests: scope.pullRequests
+		});
+	};
+	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
+	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
+}
+function buildFacts(facts) {
+	return {
+		...EMPTY_SCOPE_FACTS,
+		...facts
+	};
+}
+//#endregion
+//#region src/scope/load-task-scope.ts
+async function loadTaskScope(request, sources) {
+	const cwd = resolve(request.cwd);
+	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
+	const branch = context?.branch ?? null;
+	const sourceContext = {
+		sessionID: request.sessionID,
+		cwd,
+		worktree: checkout?.worktree ?? cwd,
+		commonDir: checkout?.commonDir ?? null,
+		branch,
+		stateDir: request.stateDir
+	};
+	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
+	return buildTaskScope({
+		home: homedir(),
+		currentBranch: branch,
+		defaultBranch: context?.defaultBranch ?? null,
+		remotes,
+		facts
+	});
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
 //#region src/classify-action.ts
 async function classifyAction(request, config, options = {}) {
 	let configured = null;
@@ -7741,9 +7889,11 @@ async function classifyAction(request, config, options = {}) {
 			unavailable: true
 		};
 	}
-	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
+	const hasConfiguredDenies = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0);
+	const local = hasConfiguredDenies ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
-	const containment = await checkContainment(request);
+	const scope = await tryLoadTaskScope(request, config);
+	const containment = scope === null ? null : checkContainment(request, scope);
 	if (containment !== null) {
 		const guidance = await tryReadDenialGuidance();
 		return {
@@ -7754,6 +7904,13 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	if (local.kind === "allow") return buildLocalAllow(local.exception);
+	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope);
+	if (edit?.kind === "bypass") return {
+		verdict: { kind: "allow" },
+		decidingStage: "bypass",
+		note: `allowed by the edit bypass: ${edit.target}`,
+		status: "allow"
+	};
 	if (options.localOnly === true) return {
 		verdict: null,
 		decidingStage: "local",
@@ -7769,6 +7926,51 @@ async function classifyAction(request, config, options = {}) {
 	};
 }
 const READ_ONLY_EXCEPTION = "Read-only actions";
+async function tryLoadTaskScope(request, config) {
+	try {
+		return await loadTaskScope({
+			sessionID: request.sessionID,
+			cwd: request.cwd,
+			stateDir: resolveStateDir()
+		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
+	} catch {
+		return null;
+	}
+}
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function tryClassifyEdit(request, scope) {
+	const fields = getEditFields(request.toolName);
+	const path = fields === null ? void 0 : request.toolInput[fields.path];
+	if (typeof path !== "string" || path === "") return null;
+	try {
+		const ownDirs = [dirname(resolveConfigPath()), resolveStateDir()];
+		const requested = resolve(request.cwd, path);
+		const [target, worktrees, protectedDirs] = await Promise.all([
+			resolveEditTarget(requested),
+			Promise.all(scope.worktrees.map((worktree) => resolveEditTarget(worktree))),
+			Promise.all(ownDirs.map((dir) => resolveEditTarget(dir)))
+		]);
+		if (target === null || GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
+		const [checkout, current] = await Promise.all([findCheckout(dirname(target)), request.toolName === "Edit" ? readFile(target, "utf8").catch(() => null) : null]);
+		return (await import("./classify-edit-D8GC6b91.js")).classifyEdit({
+			toolName: request.toolName,
+			toolInput: request.toolInput,
+			requested,
+			target,
+			checkout: checkout?.worktree ?? null,
+			current
+		}, {
+			worktrees: worktrees.filter((worktree) => worktree !== null),
+			protectedDirs: [...ownDirs, ...protectedDirs.filter((dir) => dir !== null)]
+		});
+	} catch {
+		return null;
+	}
+}
 function buildLocalAllow(exception) {
 	return {
 		verdict: { kind: "allow" },
@@ -7850,4 +8052,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, string as g, strictObject as h, classifyLocally as i, DEFAULT_DENIAL_BUDGET as l, number as m, parseActionRequest as n, parseModelVerdict as o, PRESETS as p, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };
+export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, splitCommandWords as _, resolveSessionScopePath as a, DEFAULT_SCOPE_SOURCES as b, loadCheckoutRemotes as c, classifyWithModel as d, parseModelVerdict as f, splitShellCommand as g, toRepositorySlug as h, resolveStateDir as i, findCheckout as l, loadPolicy as m, parseActionRequest as n, loadSessionScope as o, loadRepositoryContext as p, classifyAction as r, EMPTY_SESSION_SCOPE as s, renderVerdict as t, classifyLocally as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };