auto-mode 0.12.0 → 0.14.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { D as string, E as strictObject, T as number, _ as splitCommandWords, a as resolveSessionScopePath, b as DEFAULT_SCOPE_SOURCES, c as loadCheckoutRemotes, g as splitShellCommand, h as toRepositorySlug, i as resolveStateDir, l as findCheckout, m as loadPolicy, n as parseActionRequest, o as loadSessionScope, p as loadRepositoryContext, r as classifyAction, s as EMPTY_SESSION_SCOPE, t as renderVerdict, x as loadConfig, y as DEFAULT_DENIAL_BUDGET } from "./render-verdict-FhSKxlO9.js";
+import { D as string, E as strictObject, T as number, _ as splitCommandWords, a as resolveSessionScopePath, b as DEFAULT_SCOPE_SOURCES, c as findCheckout, f as loadRepositoryContext, g as splitShellCommand, h as toRepositorySlug, i as resolveStateDir, m as loadPolicy, n as parseActionRequest, o as loadSessionScope, p as loadCheckoutRemotes, r as classifyAction, s as EMPTY_SESSION_SCOPE, t as renderVerdict, x as loadConfig, y as DEFAULT_DENIAL_BUDGET } from "./render-verdict-QLyj-g7d.js";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, normalize } from "node:path";
 import { homedir } from "node:os";

package/dist/index.d.ts

@@ -4,49 +4,6 @@ interface DenialBudget {
   readonly perSession: number;
 }
 //#endregion
-//#region src/config/types.d.ts
-interface EvaluationOptions {
-  readonly deadlineAt?: number | undefined;
-  readonly signal?: Readonly<AbortSignal> | undefined;
-}
-//#endregion
-//#region src/config/presets.d.ts
-export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
-//#endregion
-//#region src/config/config.d.ts
-interface ProviderConfig {
-  readonly protocol?: 'messages' | 'system-one';
-  readonly baseURL: string;
-  readonly model: string;
-  readonly apiKeyEnv?: string | undefined;
-  readonly apiKeyCommand?: string | undefined;
-  readonly reasoning: boolean;
-  readonly maxTokens: number;
-  readonly timeoutMs: number;
-}
-interface ScopeSource {
-  readonly kind: ScopeSourceKind;
-  readonly paths?: readonly string[];
-}
-type ScopeSourceKind = (typeof SCOPE_SOURCE_KINDS)[number];
-declare const SCOPE_SOURCE_KINDS: readonly ['cwd', 'session', 'globs', 'atc'];
-interface Config {
-  readonly provider: ProviderConfig;
-  readonly judge?: ProviderConfig | null;
-  readonly scopeSources?: Readonly<Record<string, ScopeSource>>;
-  readonly classifierPath?: string | undefined;
-  readonly rulesPath?: string | undefined;
-  readonly onFailure: 'defer' | 'deny';
-  readonly claudeSettingsPath?: string | null | undefined;
-  readonly minConfidence?: number | undefined;
-  readonly denialBudget?: DenialBudget;
-  readonly warnings?: readonly string[];
-}
-export declare const DEFAULT_CONFIG: Config;
-export declare function resolveConfigPath(): string;
-export declare function loadConfig(path?: string): Promise<Config>;
-export declare function resolveApiKey(provider: ProviderConfig, options?: EvaluationOptions): Promise<string | null>;
-//#endregion
 //#region src/request/types.d.ts
 interface UserTask {
   readonly text: string;
@@ -88,6 +45,14 @@ interface DecisionRule {
   readonly source: 'shipped' | 'replacement' | 'configured';
   readonly text: string;
 }
+interface TaskScopeSummary {
+  readonly worktrees: readonly string[];
+  readonly branches: readonly string[];
+  readonly pullRequests: readonly {
+    readonly repository: string;
+    readonly number: number;
+  }[];
+}
 interface DecisionAnswer {
   readonly type: 'choice';
   readonly choice: 'allow' | 'block' | 'ask';
@@ -114,6 +79,50 @@ interface DecisionDiagnostics {
   }[];
 }
 //#endregion
+//#region src/config/types.d.ts
+interface EvaluationOptions {
+  readonly deadlineAt?: number | undefined;
+  readonly signal?: Readonly<AbortSignal> | undefined;
+  readonly taskScope?: TaskScopeSummary | undefined;
+}
+//#endregion
+//#region src/config/presets.d.ts
+export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
+//#endregion
+//#region src/config/config.d.ts
+interface ProviderConfig {
+  readonly protocol?: 'messages' | 'system-one';
+  readonly baseURL: string;
+  readonly model: string;
+  readonly apiKeyEnv?: string | undefined;
+  readonly apiKeyCommand?: string | undefined;
+  readonly reasoning: boolean;
+  readonly maxTokens: number;
+  readonly timeoutMs: number;
+}
+interface ScopeSource {
+  readonly kind: ScopeSourceKind;
+  readonly paths?: readonly string[];
+}
+type ScopeSourceKind = (typeof SCOPE_SOURCE_KINDS)[number];
+declare const SCOPE_SOURCE_KINDS: readonly ['cwd', 'session', 'globs', 'atc'];
+interface Config {
+  readonly provider: ProviderConfig;
+  readonly judge?: ProviderConfig | null;
+  readonly scopeSources?: Readonly<Record<string, ScopeSource>>;
+  readonly classifierPath?: string | undefined;
+  readonly rulesPath?: string | undefined;
+  readonly onFailure: 'defer' | 'deny';
+  readonly claudeSettingsPath?: string | null | undefined;
+  readonly minConfidence?: number | undefined;
+  readonly denialBudget?: DenialBudget;
+  readonly warnings?: readonly string[];
+}
+export declare const DEFAULT_CONFIG: Config;
+export declare function resolveConfigPath(): string;
+export declare function loadConfig(path?: string): Promise<Config>;
+export declare function resolveApiKey(provider: ProviderConfig, options?: EvaluationOptions): Promise<string | null>;
+//#endregion
 //#region src/classify-action.d.ts
 type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'messages' | 'retry';
 interface ActionOutcome {

package/dist/index.js

@@ -1,2 +1,2 @@
-import { C as resolveConfigPath, S as resolveApiKey, d as classifyWithModel, f as parseModelVerdict, m as loadPolicy, n as parseActionRequest, r as classifyAction, t as renderVerdict, u as classifyLocally, v as DEFAULT_CONFIG, w as PRESETS, x as loadConfig } from "./render-verdict-FhSKxlO9.js";
+import { C as resolveConfigPath, S as resolveApiKey, d as parseModelVerdict, l as classifyLocally, m as loadPolicy, n as parseActionRequest, r as classifyAction, t as renderVerdict, u as classifyWithModel, v as DEFAULT_CONFIG, w as PRESETS, x as loadConfig } from "./render-verdict-QLyj-g7d.js";
 export { DEFAULT_CONFIG, PRESETS, classifyAction, classifyLocally, classifyWithModel, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath };

package/dist/{render-verdict-FhSKxlO9.js → render-verdict-QLyj-g7d.js}

@@ -5654,7 +5654,8 @@ const DEFAULT_DENIAL_BUDGET = {
 };
 const DEFAULT_SCOPE_SOURCES = {
 	cwd: { kind: "cwd" },
-	session: { kind: "session" }
+	session: { kind: "session" },
+	atc: { kind: "atc" }
 };
 const DEFAULT_CONFIG = {
 	provider: DEFAULT_PROVIDER,
@@ -6507,6 +6508,18 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region src/model/build-task-scope-summary.ts
+function buildTaskScopeSummary(scope) {
+	return {
+		worktrees: scope.worktrees,
+		branches: scope.branches,
+		pullRequests: scope.pullRequests.map((pull) => ({
+			repository: pull.repository,
+			number: pull.number
+		}))
+	};
+}
+//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir() {
 	let dir = import.meta.dirname;
@@ -6610,7 +6623,7 @@ function readResult(body) {
 //#endregion
 //#region src/model/build-request.ts
 const MAX_INPUT_CHARS = 4e3;
-function buildUserMessage(payload, transcript, reasoning) {
+function buildUserMessage(payload, transcript, reasoning, repositoryContext = null) {
 	const history = transcript.length === 0 ? "(no transcript available from this harness)" : transcript.map((entry) => `${entry.role}: ${entry.text}`).join("\n\n");
 	const input = JSON.stringify(payload.toolInput, null, 2).slice(0, MAX_INPUT_CHARS);
 	const closing = reasoning ? "Work through the classification process, then end your reply with the output contract tags." : "Reply with the output contract tags and nothing else.";
@@ -6618,7 +6631,7 @@ function buildUserMessage(payload, transcript, reasoning) {
 ${history}
 </transcript>
 
-<action>
+${repositoryContext === null ? "" : `<repository>\n${JSON.stringify(repositoryContext, null, 2)}\n</repository>\n\n`}<action>
 tool: ${payload.toolName}
 cwd: ${payload.cwd}
 input:
@@ -6775,6 +6788,46 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
+//#region src/scope/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const value = /^\s*(?:push)?url\s*=(?<value>.*)$/iu.exec(line)?.groups?.["value"];
+			const url = value === void 0 ? "" : parseConfigValue(value);
+			if (url !== "") remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+function parseConfigValue(raw) {
+	let value = "";
+	let isQuoted = false;
+	for (let index = 0; index < raw.length; index += 1) {
+		const char = raw[index] ?? "";
+		if (char === "\\") {
+			const next = raw[index + 1] ?? "";
+			value += {
+				n: "\n",
+				t: "	",
+				b: ""
+			}[next] ?? next;
+			index += 1;
+		} else if (char === "\"") isQuoted = !isQuoted;
+		else if (!isQuoted && (char === "#" || char === ";")) break;
+		else value += char;
+	}
+	return value.trim();
+}
+//#endregion
 //#region src/model/load-repository-context.ts
 async function loadRepositoryContext(cwd) {
 	if ([
@@ -6822,10 +6875,18 @@ async function loadRepositoryContext(cwd) {
 		} catch {
 			defaultBranch = null;
 		}
+		const remotes = await loadCheckoutRemotes(commonDir);
 		return {
 			cwd: resolve(cwd),
 			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
+			defaultBranch,
+			remotes: remotes.flatMap((remote) => {
+				const url = normalizeRemoteURL(remote.url);
+				return url === null ? [] : [{
+					name: remote.name,
+					url
+				}];
+			})
 		};
 	}
 }
@@ -6836,6 +6897,35 @@ function parseReference(content, prefix) {
 	const branch = value.slice(marker.length);
 	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
 }
+function normalizeRemoteURL(url) {
+	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
+		const parsed = URL.parse(url);
+		if (parsed === null) return null;
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return parsed.href;
+	}
+	const slash = url.indexOf("/");
+	const end = slash === -1 ? url.length : slash;
+	const at = url.lastIndexOf("@", end);
+	return at === -1 ? url : url.slice(at + 1);
+}
+//#endregion
+//#region src/model/load-repository-evidence.ts
+async function loadRepositoryEvidence(cwd, taskScope) {
+	const context = await loadRepositoryContext(cwd);
+	if (taskScope === void 0) return context;
+	return {
+		...context ?? {
+			cwd: resolve(cwd),
+			branch: null,
+			defaultBranch: null
+		},
+		taskScope
+	};
+}
 //#endregion
 //#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
 const t = Symbol.for("@ts-pattern/matcher");
@@ -7347,17 +7437,13 @@ async function classifyWithJev(payload, config, options = {}) {
 		if (key === null) throw new Error("no API key: set the configured environment variable or key command");
 		stage = "evidence";
 		const directUserText = payload.decisionContext?.agentID === null ? payload.decisionContext.lastDirectUserMessage?.text ?? null : null;
-		const command = payload.toolInput["command"] ?? payload.toolInput["cmd"];
-		const hasGitCommand = typeof command === "string" && /\bgit\s/u.test(command);
-		const isFileEdit = payload.toolName === "Write" || payload.toolName === "Edit";
-		const needsRepositoryContext = hasGitCommand || isFileEdit;
 		const [policy, rules, repositoryContext] = await Promise.all([
 			loadPolicy({
 				classifierPath: config.classifierPath,
 				rulesPath: config.rulesPath
 			}, "decision.md"),
 			loadClaudeRules(config.claudeSettingsPath),
-			needsRepositoryContext ? loadRepositoryContext(payload.cwd) : Promise.resolve(null)
+			loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null)
 		]);
 		const request = buildDecisionRequest(payload, policy, rules, directUserText, config.rulesPath === void 0 ? "shipped" : "replacement", repositoryContext);
 		const remainingMs = options.deadlineAt === void 0 ? config.provider.timeoutMs : options.deadlineAt - Date.now();
@@ -7465,10 +7551,12 @@ async function classifyWithModel(payload, config, options = {}) {
 		return buildFailure(config, `policy unreadable: ${toMessage(error)}`);
 	}
 	const directMessage = payload.decisionContext?.agentID === null ? payload.decisionContext.lastDirectUserMessage : null;
-	const user = buildUserMessage(payload, directMessage === null ? [] : [{
+	const transcript = directMessage === null ? [] : [{
 		role: "user",
 		text: directMessage.text
-	}], config.provider.reasoning);
+	}];
+	const repositoryContext = await loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null);
+	const user = buildUserMessage(payload, transcript, config.provider.reasoning, repositoryContext);
 	try {
 		const result = await sendMessage(config.provider, apiKey, {
 			system,
@@ -7750,24 +7838,104 @@ const DEFAULT_NAMES = /* @__PURE__ */ new Set([
 	"develop"
 ]);
 //#endregion
-//#region src/scope/load-checkout-remotes.ts
-async function loadCheckoutRemotes(commonDir) {
-	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
-	const remotes = [];
-	let section = null;
-	for (const line of config.split("\n")) {
-		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
-		if (header !== void 0) section = header;
-		else if (/^\s*\[/u.test(line)) section = null;
-		else if (section !== null) {
-			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
-			if (url !== void 0) remotes.push({
-				name: section,
-				url
-			});
-		}
+//#region src/scope/build-atc-scope-facts.ts
+function buildAtcScopeFacts(record, isInRepository) {
+	const scope = record.scope;
+	const checkouts = [scope.workspace, ...scope.worktrees];
+	return {
+		worktrees: checkouts.map((checkout) => checkout.path),
+		branches: [...checkouts.flatMap((checkout) => checkout.branch !== null && isInRepository(checkout.path) ? [checkout.branch] : []), ...scope.branches.flatMap((branch) => isInRepository(branch.repo ?? scope.workspace.path) ? [branch.name] : [])],
+		pullRequests: scope.pullRequests.flatMap((pull) => {
+			const repository = toRepositorySlug(`https://${findHost(pull.url)}/${pull.repo}`);
+			return pull.branch === null || repository === null ? [] : [{
+				number: pull.number,
+				head: pull.branch,
+				repository
+			}];
+		}),
+		pathGlobs: []
+	};
+}
+function findHost(url) {
+	return (url === void 0 ? null : URL.parse(url)?.host) ?? "github.com";
+}
+//#endregion
+//#region src/scope/load-atc-session-record.ts
+const name$1 = string().min(1);
+const path = name$1.refine(isAbsolute, "an absolute path");
+const checkoutSchema = object({
+	path,
+	branch: name$1.nullable()
+}).readonly();
+const branchSchema$1 = object({
+	name: name$1,
+	repo: path.optional()
+}).readonly();
+const pullRequestSchema$1 = object({
+	repo: name$1,
+	number: number().int().positive(),
+	url: name$1.optional(),
+	branch: name$1.nullable()
+}).readonly();
+const scopeSchema = object({
+	workspace: checkoutSchema,
+	worktrees: array(checkoutSchema).readonly(),
+	branches: array(branchSchema$1).readonly(),
+	pullRequests: array(pullRequestSchema$1).readonly()
+}).readonly();
+const recordSchema = object({
+	format: literal("atc.session-record"),
+	version: literal(1),
+	session: name$1,
+	scope: scopeSchema
+}).readonly();
+async function loadAtcSessionRecord(location, sessionID) {
+	if (location === void 0 || location === "") return { kind: "absent" };
+	if (!isAbsolute(location)) return {
+		kind: "malformed",
+		diagnostic: `atc session record path is not absolute: ${location}`
+	};
+	let raw;
+	try {
+		raw = await readFile(location, "utf8");
+	} catch (error) {
+		return isMissing(error) ? { kind: "absent" } : {
+			kind: "malformed",
+			diagnostic: `atc session record unreadable: ${location}`
+		};
 	}
-	return remotes;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return {
+			kind: "malformed",
+			diagnostic: `atc session record is not JSON: ${location}`
+		};
+	}
+	const result = recordSchema.safeParse(parsed);
+	if (!result.success) {
+		const [issue] = result.error.issues;
+		return {
+			kind: "malformed",
+			diagnostic: `atc session record ignored: ${issue === void 0 ? "record" : issue.path.join(".") || "record"} does not match version 1: ${location}`
+		};
+	}
+	if (sessionID === void 0 || sessionID === "") return {
+		kind: "malformed",
+		diagnostic: `atc session record has no session to match: ${location}`
+	};
+	if (result.data.session !== sessionID) return {
+		kind: "malformed",
+		diagnostic: `atc session record belongs to another session: ${location}`
+	};
+	return {
+		kind: "record",
+		record: result.data
+	};
+}
+function isMissing(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 //#endregion
 //#region src/scope/types.ts
@@ -7835,7 +8003,23 @@ function pickScopeSourceReader(source) {
 		});
 	};
 	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
-	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
+	return async (context) => {
+		const loaded = await loadAtcSessionRecord(context.atcRecordPath, context.atcSessionID);
+		if (loaded.kind === "malformed") process.stderr.write(`auto-mode: ${loaded.diagnostic}\n`);
+		if (loaded.kind !== "record") return EMPTY_SCOPE_FACTS;
+		const scope = loaded.record.scope;
+		const paths = /* @__PURE__ */ new Set([
+			scope.workspace.path,
+			...scope.worktrees.map((worktree) => worktree.path),
+			...scope.branches.map((branch) => branch.repo ?? scope.workspace.path)
+		]);
+		const entries = await Promise.all([...paths].map((path) => findCommonDirEntry(path)));
+		const commonDirs = new Map(entries);
+		return buildAtcScopeFacts(loaded.record, (path) => context.commonDir !== null && commonDirs.get(path) === context.commonDir);
+	};
+}
+async function findCommonDirEntry(path) {
+	return [path, (await findCheckout(path))?.commonDir ?? null];
 }
 function buildFacts(facts) {
 	return {
@@ -7855,7 +8039,9 @@ async function loadTaskScope(request, sources) {
 		worktree: checkout?.worktree ?? cwd,
 		commonDir: checkout?.commonDir ?? null,
 		branch,
-		stateDir: request.stateDir
+		stateDir: request.stateDir,
+		atcRecordPath: process.env["ATC_SESSION_RECORD"],
+		atcSessionID: process.env["ATC_SESSION_ID"]
 	};
 	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
 	return buildTaskScope({
@@ -7917,7 +8103,11 @@ async function classifyAction(request, config, options = {}) {
 		note: `${request.toolName} needs the model tier, which this run skipped`,
 		status: "skipped"
 	};
-	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, options), tryReadDenialGuidance()]);
+	const taskScope = scope === null ? void 0 : buildTaskScopeSummary(scope);
+	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, {
+		...options,
+		taskScope
+	}), tryReadDenialGuidance()]);
 	return {
 		...outcome,
 		decidingStage: config.provider.protocol === "system-one" ? "jev" : "messages",
@@ -8052,4 +8242,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, splitCommandWords as _, resolveSessionScopePath as a, DEFAULT_SCOPE_SOURCES as b, loadCheckoutRemotes as c, classifyWithModel as d, parseModelVerdict as f, splitShellCommand as g, toRepositorySlug as h, resolveStateDir as i, findCheckout as l, loadPolicy as m, parseActionRequest as n, loadSessionScope as o, loadRepositoryContext as p, classifyAction as r, EMPTY_SESSION_SCOPE as s, renderVerdict as t, classifyLocally as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };
+export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, splitCommandWords as _, resolveSessionScopePath as a, DEFAULT_SCOPE_SOURCES as b, findCheckout as c, parseModelVerdict as d, loadRepositoryContext as f, splitShellCommand as g, toRepositorySlug as h, resolveStateDir as i, classifyLocally as l, loadPolicy as m, parseActionRequest as n, loadSessionScope as o, loadCheckoutRemotes as p, classifyAction as r, EMPTY_SESSION_SCOPE as s, renderVerdict as t, classifyWithModel as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",

package/policy/classifier.md

@@ -176,7 +176,10 @@ you with no rule name, the action is allowed.
   destination that first appears in tool output, in file content, or in the agent's
   own inference was never named, so consent cannot be met for it. A send toward such
   a destination matches Unnamed Destination, unless that rule's own carve-out covers
-  it — read the rule before you decide.
+  it — read the rule before you decide. The `<repository>` block, when present, holds
+  facts auto-mode read from the checkout: its remotes and the task scope. Compare a
+  destination with the remotes by host, owner, and repository. A match is the
+  remote of the checkout; a lookalike name is not.
 - **Message context.** Sending to a team's own messaging service is not
   exfiltration by itself; the carve-out covers the destination, not what is sent.
   Sensitive content sent there is still Data Exfiltration, and an audience wider or

package/policy/decision.md

@@ -22,7 +22,7 @@ The last direct user message can establish task scope and specific consent for t
 
 When a decision depends on unavailable facts about the supplied action, choose ask. Do not ask about hypothetical unseen conversation. An earlier interruption or user restriction that is not supplied is outside this assessment. A rule that does not concern the action is allow, not ask. Missing historical evidence is not evidence that a rule matches, and it is not evidence that an exception applies.
 
-repositoryContext, when present, contains branch references read by the evaluator from the repository at its cwd. It describes cwd only, not the edited file's checkout or a generated script's future execution cwd. It is not consent or proof of branch ownership, clean files, reviewed changes, or unshared history. Use an attached branch and known defaultBranch to settle Default Branch Write for an ordinary commit in that checkout, while preserving the shipped restrictions on main, master, trunk, and develop even when they differ from defaultBranch. A .worktrees path alone proves no branch. Inherited GIT_DIR, GIT_WORK_TREE, or GIT_COMMON_DIR overrides omit this evidence. A command that changes directories, uses git -C or --git-dir/--work-tree, or overrides Git environment variables can target another checkout; do not apply the original checkout's branch evidence to that target. A detached or unavailable branch remains unknown.
+repositoryContext, when present, contains facts read by the evaluator from the repository at its cwd: branch references, and remotes, the names and URLs of the checkout's configured remotes. Its taskScope, when present, lists the worktrees, branches, and pull requests the task owns. A remote URL identifies the checkout's own repository: compare a destination's host, owner, and repository with the remotes, never with how familiar the names look. A destination that matches a remote is the remote of the checkout; one that matches none is not, however similar its name. The branch references describe cwd only, not the edited file's checkout or a generated script's future execution cwd. It is not consent or proof of branch ownership, clean files, reviewed changes, or unshared history. Use an attached branch and known defaultBranch to settle Default Branch Write for an ordinary commit in that checkout, while preserving the shipped restrictions on main, master, trunk, and develop even when they differ from defaultBranch. A .worktrees path alone proves no branch. Inherited GIT_DIR, GIT_WORK_TREE, or GIT_COMMON_DIR overrides omit this evidence. A command that changes directories, uses git -C or --git-dir/--work-tree, or overrides Git environment variables can target another checkout; do not apply the original checkout's branch evidence to that target. A detached or unavailable branch remains unknown.
 
 ## Action evaluation