auto-mode 0.11.0 → 0.13.0

package/dist/{render-verdict-BiGjYb1x.js → render-verdict-De8aTmg-.js}

@@ -1,9 +1,22 @@
-import { readFile, stat } from "node:fs/promises";
+import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
+import { lstat, readFile, realpath, stat } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/bypass/resolve-edit-target.ts
+async function resolveEditTarget(path) {
+	const missing = [];
+	for (let current = path;; current = dirname(current)) try {
+		const real = await realpath(current);
+		return join(real, ...missing.toReversed());
+	} catch {
+		if (await lstat(current).catch(() => null) !== null || dirname(current) === current) return null;
+		missing.push(basename(current));
+	}
+}
+//#endregion
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5868,66 +5881,100 @@ async function loadClaudeRules(path) {
 	};
 }
 //#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory) return null;
-			directory = parent;
+//#region src/rules/split-command-words.ts
+function splitCommandWords(text) {
+	const words = splitWords$1(text);
+	let index = 0;
+	while (index < words.length) {
+		const word = words[index] ?? "";
+		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
+		else if (word === "env") {
+			index += 1;
+			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
+		} else if (word === "timeout") index += 2;
+		else break;
+	}
+	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
+}
+function splitWords$1(text) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	let started = false;
+	for (const ch of text) if (quote !== null) {
+		if (ch === quote) quote = null;
+		else current += ch;
+	} else if (ch === "'" || ch === "\"") {
+		quote = ch;
+		started = true;
+	} else if (/\s/u.test(ch)) {
+		if (started) words.push(current);
+		current = "";
+		started = false;
+	} else {
+		current += ch;
+		started = true;
+	}
+	if (started) words.push(current);
+	return words;
+}
+//#endregion
+//#region src/rules/split-shell-command.ts
+function splitShellCommand(command) {
+	const segments = [];
+	let current = "";
+	let quote = null;
+	let unparsed = false;
+	let i = 0;
+	const collectSegment = () => {
+		const text = current.trim();
+		if (text !== "") segments.push({ text });
+		current = "";
+	};
+	while (i < command.length) {
+		const ch = command.charAt(i);
+		if (quote !== null) {
+			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (ch === quote) quote = null;
+			current += ch;
+			i += 1;
 			continue;
 		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
+		if (ch === "'" || ch === "\"") {
+			quote = ch;
+			current += ch;
+			i += 1;
+			continue;
 		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
+		if (ch === "\\") {
+			current += command.slice(i, i + 2);
+			i += 2;
+			continue;
 		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
+		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
+			unparsed = true;
+			current += ch;
+			i += 1;
+			continue;
 		}
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
-		};
+		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
+			collectSegment();
+			i += 2;
+			continue;
+		}
+		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
+			collectSegment();
+			i += 1;
+			continue;
+		}
+		current += ch;
+		i += 1;
 	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+	collectSegment();
+	return {
+		segments,
+		hasUnparsedConstruct: unparsed || quote !== null
+	};
 }
 //#endregion
 //#region src/containment/to-repository-slug.ts
@@ -5938,346 +5985,57 @@ function toRepositorySlug(reference) {
 	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
 }
 //#endregion
-//#region src/scope/merge-scope-facts.ts
-function mergeScopeFacts(all) {
-	const pullRequests = /* @__PURE__ */ new Map();
-	for (const pull of all.flatMap((facts) => facts.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
-	return {
-		worktrees: [...new Set(all.flatMap((facts) => facts.worktrees))],
-		branches: [...new Set(all.flatMap((facts) => facts.branches))],
-		pullRequests: [...pullRequests.values()],
-		pathGlobs: [...new Set(all.flatMap((facts) => facts.pathGlobs))]
-	};
-}
-//#endregion
-//#region src/scope/build-task-scope.ts
-function buildTaskScope(input) {
-	const merged = mergeScopeFacts(input.facts);
-	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
-	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
-	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
-		number: pull.number,
-		repository: pull.repository
-	}));
-	return {
-		home: input.home,
-		worktrees: merged.worktrees,
-		branches,
-		currentBranch: input.currentBranch,
-		remotes: input.remotes,
-		pullRequests,
-		pathGlobs: merged.pathGlobs
-	};
+//#region src/containment/collect-scope-findings.ts
+function collectScopeFindings(action, scope) {
+	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
+	const command = action.input["command"];
+	const findings = [
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
+		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
+	];
+	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
 }
-const DEFAULT_NAMES = /* @__PURE__ */ new Set([
-	"main",
-	"master",
-	"trunk",
-	"develop"
+const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit"
 ]);
-//#endregion
-//#region src/scope/find-checkout.ts
-const GIT_OVERRIDES = [
-	"GIT_DIR",
-	"GIT_WORK_TREE",
-	"GIT_COMMON_DIR"
-];
-async function findCheckout(start) {
-	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
-	for (let directory = start;; directory = dirname(directory)) {
-		const gitPath = join(directory, ".git");
-		const info = await stat(gitPath).catch(() => null);
-		if (info !== null) {
-			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
-			return gitDir === null ? null : {
-				worktree: directory,
-				commonDir: await findCommonDir(gitDir)
-			};
-		}
-		if (dirname(directory) === directory) return null;
-	}
+function collectTargetFindings(directory, target, scope) {
+	const path = resolvePath(directory, target, scope.home);
+	return path === null ? [] : collectPathFindings(path, scope);
 }
-async function findLinkedGitDir(directory, gitPath) {
-	const link = await readFile(gitPath, "utf8").catch(() => "");
-	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
-	return path === void 0 ? null : resolve(directory, path.trim());
+const CREDENTIAL_PATHS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".gitconfig",
+	".netrc",
+	".npmrc",
+	".config/gh"
+];
+function collectPathFindings(path, scope) {
+	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
+		kind: "credential",
+		target: path
+	}];
+	return isInScope(path, scope) ? [] : [{
+		kind: "path",
+		target: path
+	}];
 }
-async function findCommonDir(gitDir) {
-	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
-	return common === null ? gitDir : resolve(gitDir, common.trim());
-}
-//#endregion
-//#region src/scope/load-checkout-remotes.ts
-async function loadCheckoutRemotes(commonDir) {
-	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
-	const remotes = [];
-	let section = null;
-	for (const line of config.split("\n")) {
-		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
-		if (header !== void 0) section = header;
-		else if (/^\s*\[/u.test(line)) section = null;
-		else if (section !== null) {
-			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
-			if (url !== void 0) remotes.push({
-				name: section,
-				url
-			});
-		}
-	}
-	return remotes;
-}
-//#endregion
-//#region src/scope/types.ts
-const EMPTY_SCOPE_FACTS = {
-	worktrees: [],
-	branches: [],
-	pullRequests: [],
-	pathGlobs: []
-};
-const EMPTY_SESSION_SCOPE = {
-	worktrees: [],
-	branches: [],
-	pullRequests: []
-};
-//#endregion
-//#region src/scope/load-session-scope.ts
-const name = string().min(1);
-const pullRequestSchema = strictObject({
-	number: number().int().positive(),
-	head: name,
-	repository: name
-});
-const branchSchema = strictObject({
-	name,
-	commonDir: name
-});
-const sessionScopeSchema = strictObject({
-	worktrees: array(name),
-	branches: array(branchSchema),
-	pullRequests: array(pullRequestSchema)
-});
-async function loadSessionScope(path) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
-	try {
-		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
-		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
-}
-//#endregion
-//#region src/scope/resolve-session-scope-path.ts
-function resolveSessionScopePath(stateDir, sessionID) {
-	const key = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
-	return join(stateDir, "session-scope", `${key}.json`);
-}
-//#endregion
-//#region src/scope/pick-scope-source-reader.ts
-function pickScopeSourceReader(source) {
-	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
-		worktrees: [context.worktree],
-		branches: context.branch === null ? [] : [context.branch]
-	}));
-	if (source.kind === "session") return async (context) => {
-		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
-		return buildFacts({
-			worktrees: scope.worktrees,
-			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
-			pullRequests: scope.pullRequests
-		});
-	};
-	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
-	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
-}
-function buildFacts(facts) {
-	return {
-		...EMPTY_SCOPE_FACTS,
-		...facts
-	};
-}
-//#endregion
-//#region src/scope/load-task-scope.ts
-async function loadTaskScope(request, sources) {
-	const cwd = resolve(request.cwd);
-	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
-	const branch = context?.branch ?? null;
-	const sourceContext = {
-		sessionID: request.sessionID,
-		cwd,
-		worktree: checkout?.worktree ?? cwd,
-		commonDir: checkout?.commonDir ?? null,
-		branch,
-		stateDir: request.stateDir
-	};
-	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
-	return buildTaskScope({
-		home: homedir(),
-		currentBranch: branch,
-		defaultBranch: context?.defaultBranch ?? null,
-		remotes,
-		facts
-	});
-}
-//#endregion
-//#region src/state/resolve-state-dir.ts
-function resolveStateDir() {
-	const stateHome = process.env["XDG_STATE_HOME"];
-	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
-	return join(base, "auto-mode");
-}
-//#endregion
-//#region src/rules/split-command-words.ts
-function splitCommandWords(text) {
-	const words = splitWords$1(text);
-	let index = 0;
-	while (index < words.length) {
-		const word = words[index] ?? "";
-		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
-		else if (word === "env") {
-			index += 1;
-			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
-		} else if (word === "timeout") index += 2;
-		else break;
-	}
-	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
-}
-function splitWords$1(text) {
-	const words = [];
-	let current = "";
-	let quote = null;
-	let started = false;
-	for (const ch of text) if (quote !== null) {
-		if (ch === quote) quote = null;
-		else current += ch;
-	} else if (ch === "'" || ch === "\"") {
-		quote = ch;
-		started = true;
-	} else if (/\s/u.test(ch)) {
-		if (started) words.push(current);
-		current = "";
-		started = false;
-	} else {
-		current += ch;
-		started = true;
-	}
-	if (started) words.push(current);
-	return words;
-}
-//#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
-	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			collectSegment();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			collectSegment();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
-	}
-	collectSegment();
-	return {
-		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
-	};
-}
-//#endregion
-//#region src/containment/collect-scope-findings.ts
-function collectScopeFindings(action, scope) {
-	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
-	const command = action.input["command"];
-	const findings = [
-		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
-		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
-		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
-	];
-	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
-}
-const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
-	"Edit",
-	"MultiEdit",
-	"Write",
-	"NotebookEdit"
-]);
-function collectTargetFindings(directory, target, scope) {
-	const path = resolvePath(directory, target, scope.home);
-	return path === null ? [] : collectPathFindings(path, scope);
-}
-const CREDENTIAL_PATHS = [
-	".ssh",
-	".aws",
-	".gnupg",
-	".gitconfig",
-	".netrc",
-	".npmrc",
-	".config/gh"
-];
-function collectPathFindings(path, scope) {
-	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
-		kind: "credential",
-		target: path
-	}];
-	return isInScope(path, scope) ? [] : [{
-		kind: "path",
-		target: path
-	}];
-}
-function collectToolFindings(action, scope) {
-	const verb = action.tool.split("__").at(-1) ?? "";
-	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
-	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
-	const owner = action.input["owner"];
-	const name = action.input["repo"];
-	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
-	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
-		kind: "remote-write",
-		target: action.tool
-	}];
+function collectToolFindings(action, scope) {
+	const verb = action.tool.split("__").at(-1) ?? "";
+	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
+	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
+	const owner = action.input["owner"];
+	const name = action.input["repo"];
+	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
+	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+		kind: "remote-write",
+		target: action.tool
+	}];
 }
 const PATH_WRITERS = /* @__PURE__ */ new Set([
 	"rm",
@@ -6719,17 +6477,7 @@ function isUnder(path, root) {
 //#endregion
 //#region src/containment/check-containment.ts
 const CONTAINMENT_RULE = "Outside Task Scope";
-async function checkContainment(request, sources) {
-	let scope;
-	try {
-		scope = await loadTaskScope({
-			sessionID: request.sessionID,
-			cwd: request.cwd,
-			stateDir: resolveStateDir()
-		}, sources);
-	} catch {
-		return null;
-	}
+function checkContainment(request, scope) {
 	const findings = collectScopeFindings({
 		tool: request.toolName,
 		cwd: request.cwd,
@@ -6759,6 +6507,18 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region src/model/build-task-scope-summary.ts
+function buildTaskScopeSummary(scope) {
+	return {
+		worktrees: scope.worktrees,
+		branches: scope.branches,
+		pullRequests: scope.pullRequests.map((pull) => ({
+			repository: pull.repository,
+			number: pull.number
+		}))
+	};
+}
+//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir() {
 	let dir = import.meta.dirname;
@@ -6862,7 +6622,7 @@ function readResult(body) {
 //#endregion
 //#region src/model/build-request.ts
 const MAX_INPUT_CHARS = 4e3;
-function buildUserMessage(payload, transcript, reasoning) {
+function buildUserMessage(payload, transcript, reasoning, repositoryContext = null) {
 	const history = transcript.length === 0 ? "(no transcript available from this harness)" : transcript.map((entry) => `${entry.role}: ${entry.text}`).join("\n\n");
 	const input = JSON.stringify(payload.toolInput, null, 2).slice(0, MAX_INPUT_CHARS);
 	const closing = reasoning ? "Work through the classification process, then end your reply with the output contract tags." : "Reply with the output contract tags and nothing else.";
@@ -6870,7 +6630,7 @@ function buildUserMessage(payload, transcript, reasoning) {
 ${history}
 </transcript>
 
-<action>
+${repositoryContext === null ? "" : `<repository>\n${JSON.stringify(repositoryContext, null, 2)}\n</repository>\n\n`}<action>
 tool: ${payload.toolName}
 cwd: ${payload.cwd}
 input:
@@ -6974,57 +6734,196 @@ function classifyDecisionAnswers(request, result, minConfidence) {
 		const answer = result.answers[id];
 		if (answer === void 0) throw new Error("Decision answer missing");
 		return {
-			rule,
-			answer
+			rule,
+			answer
+		};
+	});
+	for (const tier of ["hard", "soft"]) for (const entry of entries) if (entry.rule.tier === tier && entry.answer.choice === "block" && entry.answer.confidence >= minConfidence && entry.answer.probabilities.block >= minConfidence) return {
+		kind: "block",
+		rule: entry.rule
+	};
+	let uncertain = null;
+	for (const entry of entries) {
+		const answer = entry.answer;
+		if (!(answer.choice === "allow" && answer.confidence >= minConfidence && answer.probabilities.allow >= minConfidence) && (uncertain === null || answer.probabilities.block > uncertain.answer.probabilities.block)) uncertain = entry;
+	}
+	return uncertain === null ? { kind: "allow" } : {
+		kind: "uncertain",
+		rule: uncertain.rule
+	};
+}
+//#endregion
+//#region src/model/collect-decision-contributors.ts
+function collectDecisionContributors(request, result, minConfidence) {
+	const decision = classifyDecisionAnswers(request, result, minConfidence);
+	return Object.entries(request.rules).flatMap(([id, rule]) => {
+		const answer = result.answers[id];
+		if (answer === void 0) throw new Error("Decision answer missing");
+		return (decision.kind === "block" ? rule === decision.rule : decision.kind === "uncertain" && (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence)) ? [{
+			rule: rule.source === "shipped" ? rule.name : id,
+			source: rule.source,
+			tier: rule.tier,
+			choice: answer.choice,
+			confidence: answer.confidence,
+			probability: answer.probabilities[answer.choice]
+		}] : [];
+	});
+}
+//#endregion
+//#region src/model/decision-request-error.ts
+var DecisionRequestError = class extends Error {
+	reason;
+	requestBytes;
+	constructor(reason, requestBytes, message, options) {
+		super(message, options);
+		this.name = "DecisionRequestError";
+		this.reason = reason;
+		this.requestBytes = requestBytes;
+	}
+};
+//#endregion
+//#region src/model/format-classifier-note.ts
+function formatClassifierNote(note, apiKey) {
+	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
+}
+//#endregion
+//#region src/scope/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const value = /^\s*(?:push)?url\s*=(?<value>.*)$/iu.exec(line)?.groups?.["value"];
+			const url = value === void 0 ? "" : parseConfigValue(value);
+			if (url !== "") remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+function parseConfigValue(raw) {
+	let value = "";
+	let isQuoted = false;
+	for (let index = 0; index < raw.length; index += 1) {
+		const char = raw[index] ?? "";
+		if (char === "\\") {
+			const next = raw[index + 1] ?? "";
+			value += {
+				n: "\n",
+				t: "	",
+				b: ""
+			}[next] ?? next;
+			index += 1;
+		} else if (char === "\"") isQuoted = !isQuoted;
+		else if (!isQuoted && (char === "#" || char === ";")) break;
+		else value += char;
+	}
+	return value.trim();
+}
+//#endregion
+//#region src/model/load-repository-context.ts
+async function loadRepositoryContext(cwd) {
+	if ([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR"
+	].some((name) => process.env[name] !== void 0)) return null;
+	let directory = resolve(cwd);
+	for (;;) {
+		const gitPath = join(directory, ".git");
+		try {
+			await stat(gitPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
+			const parent = dirname(directory);
+			if (parent === directory) return null;
+			directory = parent;
+			continue;
+		}
+		let gitDir = gitPath;
+		let head;
+		try {
+			try {
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			} catch {
+				const link = await readFile(gitPath, "utf8");
+				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
+				if (path === void 0) return null;
+				gitDir = resolve(directory, path.trim());
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			}
+		} catch {
+			return null;
+		}
+		let commonDir = gitDir;
+		try {
+			const common = await readFile(join(gitDir, "commondir"), "utf8");
+			commonDir = resolve(gitDir, common.trim());
+		} catch {
+			commonDir = gitDir;
+		}
+		let defaultBranch = null;
+		try {
+			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
+		} catch {
+			defaultBranch = null;
+		}
+		const remotes = await loadCheckoutRemotes(commonDir);
+		return {
+			cwd: resolve(cwd),
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch,
+			remotes: remotes.flatMap((remote) => {
+				const url = normalizeRemoteURL(remote.url);
+				return url === null ? [] : [{
+					name: remote.name,
+					url
+				}];
+			})
 		};
-	});
-	for (const tier of ["hard", "soft"]) for (const entry of entries) if (entry.rule.tier === tier && entry.answer.choice === "block" && entry.answer.confidence >= minConfidence && entry.answer.probabilities.block >= minConfidence) return {
-		kind: "block",
-		rule: entry.rule
-	};
-	let uncertain = null;
-	for (const entry of entries) {
-		const answer = entry.answer;
-		if (!(answer.choice === "allow" && answer.confidence >= minConfidence && answer.probabilities.allow >= minConfidence) && (uncertain === null || answer.probabilities.block > uncertain.answer.probabilities.block)) uncertain = entry;
 	}
-	return uncertain === null ? { kind: "allow" } : {
-		kind: "uncertain",
-		rule: uncertain.rule
-	};
 }
-//#endregion
-//#region src/model/collect-decision-contributors.ts
-function collectDecisionContributors(request, result, minConfidence) {
-	const decision = classifyDecisionAnswers(request, result, minConfidence);
-	return Object.entries(request.rules).flatMap(([id, rule]) => {
-		const answer = result.answers[id];
-		if (answer === void 0) throw new Error("Decision answer missing");
-		return (decision.kind === "block" ? rule === decision.rule : decision.kind === "uncertain" && (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence)) ? [{
-			rule: rule.source === "shipped" ? rule.name : id,
-			source: rule.source,
-			tier: rule.tier,
-			choice: answer.choice,
-			confidence: answer.confidence,
-			probability: answer.probabilities[answer.choice]
-		}] : [];
-	});
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+}
+function normalizeRemoteURL(url) {
+	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
+		const parsed = URL.parse(url);
+		if (parsed === null) return null;
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return parsed.href;
+	}
+	const slash = url.indexOf("/");
+	const end = slash === -1 ? url.length : slash;
+	const at = url.lastIndexOf("@", end);
+	return at === -1 ? url : url.slice(at + 1);
 }
 //#endregion
-//#region src/model/decision-request-error.ts
-var DecisionRequestError = class extends Error {
-	reason;
-	requestBytes;
-	constructor(reason, requestBytes, message, options) {
-		super(message, options);
-		this.name = "DecisionRequestError";
-		this.reason = reason;
-		this.requestBytes = requestBytes;
-	}
-};
-//#endregion
-//#region src/model/format-classifier-note.ts
-function formatClassifierNote(note, apiKey) {
-	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
+//#region src/model/load-repository-evidence.ts
+async function loadRepositoryEvidence(cwd, taskScope) {
+	const context = await loadRepositoryContext(cwd);
+	if (taskScope === void 0) return context;
+	return {
+		...context ?? {
+			cwd: resolve(cwd),
+			branch: null,
+			defaultBranch: null
+		},
+		taskScope
+	};
 }
 //#endregion
 //#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
@@ -7537,17 +7436,13 @@ async function classifyWithJev(payload, config, options = {}) {
 		if (key === null) throw new Error("no API key: set the configured environment variable or key command");
 		stage = "evidence";
 		const directUserText = payload.decisionContext?.agentID === null ? payload.decisionContext.lastDirectUserMessage?.text ?? null : null;
-		const command = payload.toolInput["command"] ?? payload.toolInput["cmd"];
-		const hasGitCommand = typeof command === "string" && /\bgit\s/u.test(command);
-		const isFileEdit = payload.toolName === "Write" || payload.toolName === "Edit";
-		const needsRepositoryContext = hasGitCommand || isFileEdit;
 		const [policy, rules, repositoryContext] = await Promise.all([
 			loadPolicy({
 				classifierPath: config.classifierPath,
 				rulesPath: config.rulesPath
 			}, "decision.md"),
 			loadClaudeRules(config.claudeSettingsPath),
-			needsRepositoryContext ? loadRepositoryContext(payload.cwd) : Promise.resolve(null)
+			loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null)
 		]);
 		const request = buildDecisionRequest(payload, policy, rules, directUserText, config.rulesPath === void 0 ? "shipped" : "replacement", repositoryContext);
 		const remainingMs = options.deadlineAt === void 0 ? config.provider.timeoutMs : options.deadlineAt - Date.now();
@@ -7655,10 +7550,12 @@ async function classifyWithModel(payload, config, options = {}) {
 		return buildFailure(config, `policy unreadable: ${toMessage(error)}`);
 	}
 	const directMessage = payload.decisionContext?.agentID === null ? payload.decisionContext.lastDirectUserMessage : null;
-	const user = buildUserMessage(payload, directMessage === null ? [] : [{
+	const transcript = directMessage === null ? [] : [{
 		role: "user",
 		text: directMessage.text
-	}], config.provider.reasoning);
+	}];
+	const repositoryContext = await loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null);
+	const user = buildUserMessage(payload, transcript, config.provider.reasoning, repositoryContext);
 	try {
 		const result = await sendMessage(config.provider, apiKey, {
 			system,
@@ -7871,6 +7768,179 @@ function toUnquoted(word) {
 	return (first === "'" || first === "\"") && word.at(-1) === first ? word.slice(1, -1) : word;
 }
 //#endregion
+//#region src/scope/find-checkout.ts
+const GIT_OVERRIDES$1 = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start) {
+	if (GIT_OVERRIDES$1.some((name) => process.env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
+}
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
+}
+//#endregion
+//#region src/scope/merge-scope-facts.ts
+function mergeScopeFacts(all) {
+	const pullRequests = /* @__PURE__ */ new Map();
+	for (const pull of all.flatMap((facts) => facts.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
+	return {
+		worktrees: [...new Set(all.flatMap((facts) => facts.worktrees))],
+		branches: [...new Set(all.flatMap((facts) => facts.branches))],
+		pullRequests: [...pullRequests.values()],
+		pathGlobs: [...new Set(all.flatMap((facts) => facts.pathGlobs))]
+	};
+}
+//#endregion
+//#region src/scope/build-task-scope.ts
+function buildTaskScope(input) {
+	const merged = mergeScopeFacts(input.facts);
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
+	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
+	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
+		number: pull.number,
+		repository: pull.repository
+	}));
+	return {
+		home: input.home,
+		worktrees: merged.worktrees,
+		branches,
+		currentBranch: input.currentBranch,
+		remotes: input.remotes,
+		pullRequests,
+		pathGlobs: merged.pathGlobs
+	};
+}
+const DEFAULT_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
+]);
+//#endregion
+//#region src/scope/types.ts
+const EMPTY_SCOPE_FACTS = {
+	worktrees: [],
+	branches: [],
+	pullRequests: [],
+	pathGlobs: []
+};
+const EMPTY_SESSION_SCOPE = {
+	worktrees: [],
+	branches: [],
+	pullRequests: []
+};
+//#endregion
+//#region src/scope/load-session-scope.ts
+const name = string().min(1);
+const pullRequestSchema = strictObject({
+	number: number().int().positive(),
+	head: name,
+	repository: name
+});
+const branchSchema = strictObject({
+	name,
+	commonDir: name
+});
+const sessionScopeSchema = strictObject({
+	worktrees: array(name),
+	branches: array(branchSchema),
+	pullRequests: array(pullRequestSchema)
+});
+async function loadSessionScope(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+	try {
+		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+}
+//#endregion
+//#region src/scope/resolve-session-scope-path.ts
+function resolveSessionScopePath(stateDir, sessionID) {
+	const key = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
+	return join(stateDir, "session-scope", `${key}.json`);
+}
+//#endregion
+//#region src/scope/pick-scope-source-reader.ts
+function pickScopeSourceReader(source) {
+	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
+		worktrees: [context.worktree],
+		branches: context.branch === null ? [] : [context.branch]
+	}));
+	if (source.kind === "session") return async (context) => {
+		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
+		return buildFacts({
+			worktrees: scope.worktrees,
+			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
+			pullRequests: scope.pullRequests
+		});
+	};
+	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
+	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
+}
+function buildFacts(facts) {
+	return {
+		...EMPTY_SCOPE_FACTS,
+		...facts
+	};
+}
+//#endregion
+//#region src/scope/load-task-scope.ts
+async function loadTaskScope(request, sources) {
+	const cwd = resolve(request.cwd);
+	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
+	const branch = context?.branch ?? null;
+	const sourceContext = {
+		sessionID: request.sessionID,
+		cwd,
+		worktree: checkout?.worktree ?? cwd,
+		commonDir: checkout?.commonDir ?? null,
+		branch,
+		stateDir: request.stateDir
+	};
+	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
+	return buildTaskScope({
+		home: homedir(),
+		currentBranch: branch,
+		defaultBranch: context?.defaultBranch ?? null,
+		remotes,
+		facts
+	});
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
 //#region src/classify-action.ts
 async function classifyAction(request, config, options = {}) {
 	let configured = null;
@@ -7886,9 +7956,11 @@ async function classifyAction(request, config, options = {}) {
 			unavailable: true
 		};
 	}
-	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
+	const hasConfiguredDenies = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0);
+	const local = hasConfiguredDenies ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
-	const containment = await checkContainment(request, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
+	const scope = await tryLoadTaskScope(request, config);
+	const containment = scope === null ? null : checkContainment(request, scope);
 	if (containment !== null) {
 		const guidance = await tryReadDenialGuidance();
 		return {
@@ -7899,13 +7971,24 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	if (local.kind === "allow") return buildLocalAllow(local.exception);
+	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope);
+	if (edit?.kind === "bypass") return {
+		verdict: { kind: "allow" },
+		decidingStage: "bypass",
+		note: `allowed by the edit bypass: ${edit.target}`,
+		status: "allow"
+	};
 	if (options.localOnly === true) return {
 		verdict: null,
 		decidingStage: "local",
 		note: `${request.toolName} needs the model tier, which this run skipped`,
 		status: "skipped"
 	};
-	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, options), tryReadDenialGuidance()]);
+	const taskScope = scope === null ? void 0 : buildTaskScopeSummary(scope);
+	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, {
+		...options,
+		taskScope
+	}), tryReadDenialGuidance()]);
 	return {
 		...outcome,
 		decidingStage: config.provider.protocol === "system-one" ? "jev" : "messages",
@@ -7914,6 +7997,51 @@ async function classifyAction(request, config, options = {}) {
 	};
 }
 const READ_ONLY_EXCEPTION = "Read-only actions";
+async function tryLoadTaskScope(request, config) {
+	try {
+		return await loadTaskScope({
+			sessionID: request.sessionID,
+			cwd: request.cwd,
+			stateDir: resolveStateDir()
+		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
+	} catch {
+		return null;
+	}
+}
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function tryClassifyEdit(request, scope) {
+	const fields = getEditFields(request.toolName);
+	const path = fields === null ? void 0 : request.toolInput[fields.path];
+	if (typeof path !== "string" || path === "") return null;
+	try {
+		const ownDirs = [dirname(resolveConfigPath()), resolveStateDir()];
+		const requested = resolve(request.cwd, path);
+		const [target, worktrees, protectedDirs] = await Promise.all([
+			resolveEditTarget(requested),
+			Promise.all(scope.worktrees.map((worktree) => resolveEditTarget(worktree))),
+			Promise.all(ownDirs.map((dir) => resolveEditTarget(dir)))
+		]);
+		if (target === null || GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
+		const [checkout, current] = await Promise.all([findCheckout(dirname(target)), request.toolName === "Edit" ? readFile(target, "utf8").catch(() => null) : null]);
+		return (await import("./classify-edit-D8GC6b91.js")).classifyEdit({
+			toolName: request.toolName,
+			toolInput: request.toolInput,
+			requested,
+			target,
+			checkout: checkout?.worktree ?? null,
+			current
+		}, {
+			worktrees: worktrees.filter((worktree) => worktree !== null),
+			protectedDirs: [...ownDirs, ...protectedDirs.filter((dir) => dir !== null)]
+		});
+	} catch {
+		return null;
+	}
+}
 function buildLocalAllow(exception) {
 	return {
 		verdict: { kind: "allow" },
@@ -7995,4 +8123,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, loadRepositoryContext as _, classifyWithModel as a, DEFAULT_SCOPE_SOURCES as b, splitShellCommand as c, resolveSessionScopePath as d, loadSessionScope as f, toRepositorySlug as g, findCheckout as h, classifyLocally as i, splitCommandWords as l, loadCheckoutRemotes as m, parseActionRequest as n, parseModelVerdict as o, EMPTY_SESSION_SCOPE as p, classifyAction as r, loadPolicy as s, renderVerdict as t, resolveStateDir as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };
+export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, splitCommandWords as _, resolveSessionScopePath as a, DEFAULT_SCOPE_SOURCES as b, findCheckout as c, parseModelVerdict as d, loadRepositoryContext as f, splitShellCommand as g, toRepositorySlug as h, resolveStateDir as i, classifyLocally as l, loadPolicy as m, parseActionRequest as n, loadSessionScope as o, loadCheckoutRemotes as p, classifyAction as r, EMPTY_SESSION_SCOPE as s, renderVerdict as t, classifyWithModel as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };