auto-mode 0.14.0 → 0.15.0

package/dist/{render-verdict-QLyj-g7d.js → render-verdict-Bj2tGqBI.js}

@@ -1,22 +1,10 @@
 import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
 import { lstat, readFile, realpath, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
-import { homedir } from "node:os";
 import { spawn } from "node:child_process";
+import { homedir } from "node:os";
 import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
-//#region src/bypass/resolve-edit-target.ts
-async function resolveEditTarget(path) {
-	const missing = [];
-	for (let current = path;; current = dirname(current)) try {
-		const real = await realpath(current);
-		return join(real, ...missing.toReversed());
-	} catch {
-		if (await lstat(current).catch(() => null) !== null || dirname(current) === current) return null;
-		missing.push(basename(current));
-	}
-}
-//#endregion
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5586,9 +5574,15 @@ function findPreset(id) {
 	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
 }
 //#endregion
+//#region src/config/to-timer-delay.ts
+function toTimerDelay(ms) {
+	return Math.max(1, Math.ceil(ms));
+}
+//#endregion
 //#region src/config/read-api-key-from-command.ts
 function readApiKeyFromCommand(command, options = {}) {
-	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - Date.now();
+	const now = options.now ?? Date.now;
+	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - now();
 	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
 	return new Promise((resolve) => {
 		const grouped = process.platform !== "win32";
@@ -5598,7 +5592,11 @@ function readApiKeyFromCommand(command, options = {}) {
 				"ignore",
 				"pipe",
 				"ignore"
-			]
+			],
+			...options.host === void 0 ? {} : { env: {
+				HOME: options.host.home,
+				...options.host.env
+			} }
 		});
 		let output = "";
 		let settled = false;
@@ -5606,7 +5604,7 @@ function readApiKeyFromCommand(command, options = {}) {
 		const setResult = (value) => {
 			if (!settled) {
 				settled = true;
-				clearTimeout(timer);
+				timer.removeEventListener("abort", stopChild);
 				options.signal?.removeEventListener("abort", stopChild);
 				resolve(value);
 			}
@@ -5621,8 +5619,10 @@ function readApiKeyFromCommand(command, options = {}) {
 				child.kill("SIGKILL");
 			}
 		};
-		const timer = setTimeout(stopChild, Math.min(5e3, remainingMs));
+		const timer = (options.timeout ?? ((ms) => AbortSignal.timeout(ms)))(toTimerDelay(Math.min(5e3, remainingMs)));
+		timer.addEventListener("abort", stopChild, { once: true });
 		options.signal?.addEventListener("abort", stopChild, { once: true });
+		if (timer.aborted) stopChild();
 		child.stdout.setEncoding("utf8");
 		child.stdout.on("data", (chunk) => {
 			if (stopped) return;
@@ -5639,6 +5639,23 @@ function readApiKeyFromCommand(command, options = {}) {
 	});
 }
 //#endregion
+//#region src/containment/scratch-paths.ts
+const SCRATCH_PATHS = [
+	"/tmp",
+	"/dev/null",
+	"/dev/stdout",
+	"/dev/stderr"
+];
+//#endregion
+//#region src/config/read-host-environment.ts
+function readHostEnvironment() {
+	return {
+		env: process.env,
+		home: homedir(),
+		scratchPaths: SCRATCH_PATHS
+	};
+}
+//#endregion
 //#region src/config/config.ts
 const SCOPE_SOURCE_KINDS = [
 	"cwd",
@@ -5664,12 +5681,13 @@ const DEFAULT_CONFIG = {
 	denialBudget: DEFAULT_DENIAL_BUDGET,
 	scopeSources: DEFAULT_SCOPE_SOURCES
 };
-function resolveConfigPath() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
+function resolveConfigPath(host = readHostEnvironment()) {
+	const xdg = host.env["XDG_CONFIG_HOME"];
+	const base = xdg !== void 0 && xdg !== "" ? xdg : join(host.home, ".config");
 	return join(base, "auto-mode", "config.json");
 }
-async function loadConfig(path = resolveConfigPath()) {
+async function loadConfig(configPath, host = readHostEnvironment()) {
+	const path = configPath ?? resolveConfigPath(host);
 	let raw;
 	try {
 		raw = await readFile(path, "utf8");
@@ -5683,7 +5701,7 @@ async function loadConfig(path = resolveConfigPath()) {
 	} catch {
 		throw new Error(`${path} is not valid JSON`);
 	}
-	return buildConfig(json, path);
+	return buildConfig(json, path, host.home);
 }
 const text = string().min(1);
 const positive = number().positive();
@@ -5707,13 +5725,13 @@ const configFileSchema = strictObject({
 		claudeSettingsPath: text.nullable().optional()
 	}).optional()
 });
-function buildConfig(json, path) {
+function buildConfig(json, path, home) {
 	const parsed = configFileSchema.safeParse(json);
 	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
 	const file = parsed.data;
 	const warnings = [];
 	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
-	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
+	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry, home));
 	const configuredSources = file.scopeSources === void 0 ? null : scopeSources.entries;
 	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`), ...collectScopeWarnings(configuredSources).map((line) => `${path}: scopeSources ${line}`));
 	const decision = file.decision ?? {};
@@ -5723,10 +5741,10 @@ function buildConfig(json, path) {
 		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
 		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
 		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
-		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
-		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
+		classifierPath: expandHomePath(policy.frameworkPath ?? void 0, home),
+		rulesPath: expandHomePath(policy.rulesPath ?? void 0, home),
 		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
-		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
+		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath, home),
 		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
 		denialBudget: {
 			consecutive: decision.denialBudget?.consecutive ?? DEFAULT_DENIAL_BUDGET.consecutive,
@@ -5801,14 +5819,14 @@ const scopeSourceEntrySchema = strictObject({
 	kind: text.optional(),
 	paths: array(text).min(1).optional()
 });
-function parseScopeSourceEntry(id, entry) {
+function parseScopeSourceEntry(id, entry, home) {
 	const parsed = scopeSourceEntrySchema.safeParse(entry);
 	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
 	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
 	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
 	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
 		kind,
-		paths: parsed.data.paths.map((glob) => expandHomePath(glob) ?? glob)
+		paths: parsed.data.paths.map((glob) => expandHomePath(glob, home) ?? glob)
 	};
 	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
 }
@@ -5829,18 +5847,113 @@ function parseBuiltIn(id) {
 	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
 	return resolved;
 }
-function expandHomePath(path) {
-	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+function expandHomePath(path, home) {
+	return path?.startsWith("~/") === true ? join(home, path.slice(2)) : path;
 }
 function resolveApiKey(provider, options = {}) {
-	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
+	const host = options.host ?? readHostEnvironment();
+	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : host.env[provider.apiKeyEnv];
 	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
 	if (provider.apiKeyCommand === void 0 || provider.apiKeyCommand === "") return Promise.resolve(null);
-	return readApiKeyFromCommand(provider.apiKeyCommand, options);
+	return readApiKeyFromCommand(provider.apiKeyCommand, {
+		...options,
+		host
+	});
+}
+//#endregion
+//#region src/scope/find-checkout.ts
+const GIT_OVERRIDES$1 = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start, env) {
+	if (GIT_OVERRIDES$1.some((name) => env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
+}
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir(host) {
+	const stateHome = host.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(host.home, ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
+//#region src/bypass/resolve-edit-target.ts
+async function resolveEditTarget(path) {
+	const missing = [];
+	for (let current = path;; current = dirname(current)) try {
+		const real = await realpath(current);
+		return join(real, ...missing.toReversed());
+	} catch {
+		if (await lstat(current).catch(() => null) !== null || dirname(current) === current) return null;
+		missing.push(basename(current));
+	}
+}
+//#endregion
+//#region src/bypass/try-classify-edit.ts
+const DISK_EDIT_FILE_READER = {
+	resolveEditTarget,
+	findCheckout,
+	readFile: (path) => readFile(path, "utf8")
+};
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function tryClassifyEdit(request, scope, host, files = DISK_EDIT_FILE_READER) {
+	const fields = getEditFields(request.toolName);
+	const path = fields === null ? void 0 : request.toolInput[fields.path];
+	if (typeof path !== "string" || path === "") return null;
+	try {
+		const ownDirs = [dirname(resolveConfigPath(host)), resolveStateDir(host)];
+		const requested = resolve(request.cwd, path);
+		const [target, worktrees, protectedDirs] = await Promise.all([
+			files.resolveEditTarget(requested),
+			Promise.all(scope.worktrees.map((worktree) => files.resolveEditTarget(worktree))),
+			Promise.all(ownDirs.map((dir) => files.resolveEditTarget(dir)))
+		]);
+		if (target === null || GIT_OVERRIDES.some((name) => host.env[name] !== void 0)) return null;
+		const [checkout, current] = await Promise.all([files.findCheckout(dirname(target), host.env), request.toolName === "Edit" ? files.readFile(target).catch(() => null) : null]);
+		return (await import("./classify-edit-LpoeenGt.js")).classifyEdit({
+			toolName: request.toolName,
+			toolInput: request.toolInput,
+			requested,
+			target,
+			checkout: checkout?.worktree ?? null,
+			current
+		}, {
+			worktrees: worktrees.filter((worktree) => worktree !== null),
+			protectedDirs: [...ownDirs, ...protectedDirs.filter((dir) => dir !== null)]
+		});
+	} catch {
+		return null;
+	}
 }
 //#endregion
 //#region src/config/load-claude-rules.ts
-async function loadClaudeRules(path) {
+async function loadClaudeRules(path, host) {
 	const empty = {
 		environment: [],
 		allow: [],
@@ -5848,8 +5961,8 @@ async function loadClaudeRules(path) {
 		hard_deny: []
 	};
 	if (path === null) return empty;
-	const configDir = process.env["CLAUDE_CONFIG_DIR"];
-	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
+	const configDir = host.env["CLAUDE_CONFIG_DIR"];
+	const base = configDir === void 0 || configDir === "" ? join(host.home, ".claude") : configDir;
 	const settingsPath = path ?? join(base, "settings.json");
 	let raw;
 	try {
@@ -5987,13 +6100,13 @@ function toRepositorySlug(reference) {
 }
 //#endregion
 //#region src/containment/collect-scope-findings.ts
-function collectScopeFindings(action, scope) {
+function collectScopeFindings(action, scope, scratchPaths = SCRATCH_PATHS) {
 	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
 	const command = action.input["command"];
 	const findings = [
-		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope, scratchPaths) : [],
 		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
-		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope, scratchPaths) : []
 	];
 	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
 }
@@ -6003,9 +6116,9 @@ const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
 	"Write",
 	"NotebookEdit"
 ]);
-function collectTargetFindings(directory, target, scope) {
+function collectTargetFindings(directory, target, scope, scratchPaths) {
 	const path = resolvePath(directory, target, scope.home);
-	return path === null ? [] : collectPathFindings(path, scope);
+	return path === null ? [] : collectPathFindings(path, scope, scratchPaths);
 }
 const CREDENTIAL_PATHS = [
 	".ssh",
@@ -6016,12 +6129,12 @@ const CREDENTIAL_PATHS = [
 	".npmrc",
 	".config/gh"
 ];
-function collectPathFindings(path, scope) {
+function collectPathFindings(path, scope, scratchPaths) {
 	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
 		kind: "credential",
 		target: path
 	}];
-	return isInScope(path, scope) ? [] : [{
+	return isInScope(path, scope, scratchPaths) ? [] : [{
 		kind: "path",
 		target: path
 	}];
@@ -6052,24 +6165,24 @@ const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
 	"rsync",
 	"ln"
 ]);
-function collectCommandFindings(command, cwd, scope) {
+function collectCommandFindings(command, cwd, scope, scratchPaths) {
 	const findings = [];
 	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
 	let directory = cwd;
 	for (const segment of splitShellCommand(command).segments) {
 		const [name, ...args] = splitCommandWords(segment.text);
-		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
+		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope, scratchPaths));
 		if (name === void 0) continue;
 		if (name === "cd" && hasPipe) directory = null;
 		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
-		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope));
+		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope, scratchPaths));
 	}
 	return findings;
 }
-function collectProgramFindings(name, args, directory, cwd, scope) {
-	const resolve = (path) => collectTargetFindings(directory, path, scope);
+function collectProgramFindings(name, args, directory, cwd, scope, scratchPaths) {
+	const resolve = (path) => collectTargetFindings(directory, path, scope, scratchPaths);
 	const operands = args.filter((word) => !word.startsWith("-"));
-	if (name === "git") return collectGitFindings(args, directory, cwd, scope);
+	if (name === "git") return collectGitFindings(args, directory, cwd, scope, scratchPaths);
 	if (name === "gh") return collectGhFindings(args, scope);
 	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
 	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
@@ -6207,7 +6320,7 @@ const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
 	"stash",
 	"push"
 ]);
-function collectGitFindings(args, directory, cwd, scope) {
+function collectGitFindings(args, directory, cwd, scope, scratchPaths) {
 	let gitDirectory = directory;
 	let index = 0;
 	while (index < args.length && args[index]?.startsWith("-") === true) {
@@ -6219,11 +6332,11 @@ function collectGitFindings(args, directory, cwd, scope) {
 	const rest = args.slice(index + 1);
 	const operands = rest.filter((word) => !word.startsWith("-"));
 	const findings = [];
-	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope)) findings.push({
+	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope, scratchPaths)) findings.push({
 		kind: "path",
 		target: gitDirectory
 	});
-	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope));
+	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope, scratchPaths));
 	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
 		kind: "branch",
 		target: branch
@@ -6458,14 +6571,8 @@ function resolvePath(cwd, path, home) {
 	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
 	return normalize(absolute).replace(/(?<=.)\/$/u, "");
 }
-const SCRATCH_PATHS = [
-	"/tmp",
-	"/dev/null",
-	"/dev/stdout",
-	"/dev/stderr"
-];
-function isInScope(path, scope) {
-	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+function isInScope(path, scope, scratchPaths) {
+	if (scratchPaths.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
 	return scope.worktrees.some((worktree) => {
 		const isNested = isUnder(path, join(worktree, ".worktrees"));
 		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
@@ -6478,12 +6585,12 @@ function isUnder(path, root) {
 //#endregion
 //#region src/containment/check-containment.ts
 const CONTAINMENT_RULE = "Outside Task Scope";
-function checkContainment(request, scope) {
+function checkContainment(request, scope, scratchPaths) {
 	const findings = collectScopeFindings({
 		tool: request.toolName,
 		cwd: request.cwd,
 		input: request.toolInput
-	}, scope);
+	}, scope, scratchPaths);
 	if (findings.length === 0) return null;
 	return {
 		rule: CONTAINMENT_RULE,
@@ -6521,12 +6628,12 @@ function buildTaskScopeSummary(scope) {
 }
 //#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
-function resolveShippedPolicyDir() {
-	let dir = import.meta.dirname;
+function resolveShippedPolicyDir(startDir = import.meta.dirname, stopDir = parse(startDir).root) {
+	let dir = startDir;
 	for (;;) {
 		if (existsSync(join(dir, "policy", "classifier.md"))) return join(dir, "policy");
 		const parent = dirname(dir);
-		if (parent === dir || dir === parse(dir).root) throw new Error("auto-mode cannot find its shipped policy/ directory");
+		if (parent === dir || dir === stopDir) throw new Error("auto-mode cannot find its shipped policy/ directory");
 		dir = parent;
 	}
 }
@@ -6543,11 +6650,13 @@ async function loadPolicy(paths = {}, framework = "classifier.md") {
 }
 //#endregion
 //#region src/model/anthropic-client.ts
-async function sendMessage(provider, apiKey, request) {
+async function sendMessage(provider, apiKey, request, signal) {
 	const controller = new AbortController();
-	const timer = setTimeout(() => {
+	const stopRequest = () => {
 		controller.abort();
-	}, provider.timeoutMs);
+	};
+	signal.addEventListener("abort", stopRequest, { once: true });
+	if (signal.aborted) controller.abort();
 	try {
 		const response = await fetch(`${provider.baseURL.replace(/\/$/, "")}/v1/messages`, {
 			method: "POST",
@@ -6580,7 +6689,7 @@ async function sendMessage(provider, apiKey, request) {
 		}
 		return readResult(body);
 	} finally {
-		clearTimeout(timer);
+		signal.removeEventListener("abort", stopRequest);
 	}
 }
 const contentBlockSchema = union([object({
@@ -6623,7 +6732,7 @@ function readResult(body) {
 //#endregion
 //#region src/model/build-request.ts
 const MAX_INPUT_CHARS = 4e3;
-function buildUserMessage(payload, transcript, reasoning, repositoryContext = null) {
+function buildUserMessage(payload, transcript, reasoning, repositoryContext = null, mcpServers = []) {
 	const history = transcript.length === 0 ? "(no transcript available from this harness)" : transcript.map((entry) => `${entry.role}: ${entry.text}`).join("\n\n");
 	const input = JSON.stringify(payload.toolInput, null, 2).slice(0, MAX_INPUT_CHARS);
 	const closing = reasoning ? "Work through the classification process, then end your reply with the output contract tags." : "Reply with the output contract tags and nothing else.";
@@ -6631,7 +6740,7 @@ function buildUserMessage(payload, transcript, reasoning, repositoryContext = nu
 ${history}
 </transcript>
 
-${repositoryContext === null ? "" : `<repository>\n${JSON.stringify(repositoryContext, null, 2)}\n</repository>\n\n`}<action>
+${repositoryContext === null ? "" : `<repository>\n${JSON.stringify(repositoryContext, null, 2)}\n</repository>\n\n`}${mcpServers.length === 0 ? "" : `<mcp-servers>\n${JSON.stringify(mcpServers, null, 2)}\n</mcp-servers>\n\n`}<action>
 tool: ${payload.toolName}
 cwd: ${payload.cwd}
 input:
@@ -6663,7 +6772,7 @@ function buildTaskContext(context) {
 }
 //#endregion
 //#region src/model/build-decision-request.ts
-function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage, rulesSource = "replacement", repositoryContext = null) {
+function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage, rulesSource = "replacement", repositoryContext = null, mcpServers = []) {
 	const rules = {};
 	let tier = null;
 	for (const section of policy.split(/(?=^## |^### )/mu)) if (section.startsWith("## HARD BLOCK rules")) tier = "hard";
@@ -6711,6 +6820,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 			rulesSource,
 			configuredRules,
 			...repositoryContext === null ? {} : { repositoryContext },
+			...mcpServers.length === 0 ? {} : { mcpServers },
 			lastUserMessage: payload.decisionContext === void 0 || payload.decisionContext.agentID === null ? lastUserMessage : null,
 			...payload.decisionContext === void 0 ? {} : { taskContext: buildTaskContext(payload.decisionContext) },
 			action: {
@@ -6729,6 +6839,17 @@ function buildEvidenceGuidance(name) {
 	return "";
 }
 //#endregion
+//#region node_modules/.bun/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js
+var isProduction = process.env.NODE_ENV === "production";
+var prefix = "Invariant failed";
+function invariant(condition, message) {
+	if (condition) return;
+	if (isProduction) throw new Error(prefix);
+	var provided = typeof message === "function" ? message() : message;
+	var value = provided ? "".concat(prefix, ": ").concat(provided) : prefix;
+	throw new Error(value);
+}
+//#endregion
 //#region src/model/classify-decision-answers.ts
 function classifyDecisionAnswers(request, result, minConfidence) {
 	const entries = Object.entries(request.rules).map(([id, rule]) => {
@@ -6759,7 +6880,7 @@ function collectDecisionContributors(request, result, minConfidence) {
 	const decision = classifyDecisionAnswers(request, result, minConfidence);
 	return Object.entries(request.rules).flatMap(([id, rule]) => {
 		const answer = result.answers[id];
-		if (answer === void 0) throw new Error("Decision answer missing");
+		invariant(answer, "the classification refused a result with a rule unanswered");
 		return (decision.kind === "block" ? rule === decision.rule : decision.kind === "uncertain" && (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence)) ? [{
 			rule: rule.source === "shipped" ? rule.name : id,
 			source: rule.source,
@@ -6788,6 +6909,83 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
+//#region src/model/load-mcp-servers.ts
+const serverSchema = looseObject({
+	type: string().optional(),
+	url: string().optional()
+});
+const serversSchema = record(string(), unknown()).optional();
+const approvalSchema = looseObject({
+	enableAllProjectMcpServers: boolean().optional(),
+	enabledMcpjsonServers: array(string()).optional(),
+	disabledMcpjsonServers: array(string()).optional()
+});
+const stateSchema = looseObject({
+	mcpServers: serversSchema,
+	projects: record(string(), looseObject({
+		...approvalSchema.shape,
+		mcpServers: serversSchema
+	})).optional()
+});
+const projectFileSchema = looseObject({ mcpServers: serversSchema });
+async function loadMCPServers(cwd, host) {
+	const configDir = host.env["CLAUDE_CONFIG_DIR"];
+	const hasConfigDir = configDir !== void 0 && configDir !== "";
+	const statePath = hasConfigDir ? join(configDir, ".claude.json") : join(host.home, ".claude.json");
+	const settingsDir = hasConfigDir ? configDir : join(host.home, ".claude");
+	const settingsPath = join(settingsDir, "settings.json");
+	const [state, settings] = await Promise.all([readJSON(statePath, stateSchema), readJSON(settingsPath, approvalSchema)]);
+	const directory = resolve(cwd);
+	const projectDir = (await findCheckout(directory, host.env))?.worktree ?? directory;
+	const project = state?.projects?.[projectDir];
+	const projectFile = await readJSON(join(projectDir, ".mcp.json"), projectFileSchema);
+	const approvals = [settings, project].filter((entry) => entry !== void 0 && entry !== null);
+	const isDisabled = (name) => approvals.some((entry) => entry.disabledMcpjsonServers?.includes(name) === true);
+	const isEnabled = (name) => approvals.some((entry) => entry.enableAllProjectMcpServers === true || entry.enabledMcpjsonServers?.includes(name) === true);
+	const facts = [
+		...buildServerFacts(project?.mcpServers, "local"),
+		...buildServerFacts(projectFile?.mcpServers, "project").filter((server) => isEnabled(server.name) && !isDisabled(server.name)),
+		...buildServerFacts(state?.mcpServers, "user")
+	];
+	return facts.filter((server, index) => facts.findIndex((other) => other.name === server.name) === index);
+}
+async function readJSON(path, schema) {
+	try {
+		const text = await readFile(path, "utf8");
+		const parsed = schema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : null;
+	} catch {
+		return null;
+	}
+}
+const MAX_NAME_LENGTH = 128;
+const TRANSPORTS = {
+	stdio: "stdio",
+	http: "http",
+	"streamable-http": "http",
+	sse: "sse",
+	ws: "ws"
+};
+function buildServerFacts(servers, scope) {
+	return Object.entries(servers ?? {}).flatMap(([name, entry]) => {
+		const server = serverSchema.safeParse(entry);
+		if (!server.success || name === "" || name.length > MAX_NAME_LENGTH) return [];
+		const transport = TRANSPORTS[server.data.type ?? (server.data.url === void 0 ? "stdio" : "")];
+		if (transport === void 0) return [];
+		return [{
+			name,
+			scope,
+			transport,
+			host: transport === "stdio" || server.data.url === void 0 ? null : findEndpointHost(server.data.url)
+		}];
+	});
+}
+function findEndpointHost(url) {
+	const parsed = URL.parse(url);
+	if (parsed === null || !/^(?:https?|wss?):$/u.test(parsed.protocol) || /[${}]/u.test(parsed.host)) return null;
+	return parsed.host;
+}
+//#endregion
 //#region src/scope/load-checkout-remotes.ts
 async function loadCheckoutRemotes(commonDir) {
 	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
@@ -6829,12 +7027,12 @@ function parseConfigValue(raw) {
 }
 //#endregion
 //#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
+async function loadRepositoryContext(cwd, env, stopDir = parse(resolve(cwd)).root) {
 	if ([
 		"GIT_DIR",
 		"GIT_WORK_TREE",
 		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
+	].some((name) => env[name] !== void 0)) return null;
 	let directory = resolve(cwd);
 	for (;;) {
 		const gitPath = join(directory, ".git");
@@ -6843,7 +7041,7 @@ async function loadRepositoryContext(cwd) {
 		} catch (error) {
 			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
 			const parent = dirname(directory);
-			if (parent === directory) return null;
+			if (parent === directory || directory === resolve(stopDir)) return null;
 			directory = parent;
 			continue;
 		}
@@ -6914,8 +7112,8 @@ function normalizeRemoteURL(url) {
 }
 //#endregion
 //#region src/model/load-repository-evidence.ts
-async function loadRepositoryEvidence(cwd, taskScope) {
-	const context = await loadRepositoryContext(cwd);
+async function loadRepositoryEvidence(cwd, taskScope, env, stopDir) {
+	const context = await loadRepositoryContext(cwd, env, stopDir);
 	if (taskScope === void 0) return context;
 	return {
 		...context ?? {
@@ -7324,6 +7522,28 @@ function pickDecisionVerdict(request, result, minConfidence) {
 	})).exhaustive();
 }
 //#endregion
+//#region src/model/decision-response-schema.ts
+const probability = number().min(0).max(1);
+const answerSchema = object({
+	type: literal("choice"),
+	choice: _enum([
+		"allow",
+		"block",
+		"ask"
+	]),
+	confidence: probability,
+	probabilities: strictObject({
+		allow: probability,
+		block: probability,
+		ask: probability
+	})
+});
+const decisionResponseSchema = object({
+	model: string().min(1),
+	answers: record(string(), answerSchema),
+	usage: object({ input_tokens: number().int().nonnegative() })
+});
+//#endregion
 //#region src/model/send-decision.ts
 async function sendDecision(provider, apiKey, request, signal) {
 	const input = {
@@ -7351,11 +7571,8 @@ async function sendDecision(provider, apiKey, request, signal) {
 	const stopRequest = () => {
 		controller.abort();
 	};
-	signal?.addEventListener("abort", stopRequest, { once: true });
-	if (signal?.aborted === true) controller.abort();
-	const timer = setTimeout(() => {
-		controller.abort();
-	}, provider.timeoutMs);
+	signal.addEventListener("abort", stopRequest, { once: true });
+	if (signal.aborted) controller.abort();
 	try {
 		let response;
 		try {
@@ -7373,26 +7590,6 @@ async function sendDecision(provider, apiKey, request, signal) {
 			throw new DecisionRequestError("network", requestBytes, "Decision API request failed");
 		}
 		if (!response.ok) throw new DecisionRequestError("http-status", requestBytes, `Decision API returned HTTP ${response.status}`);
-		const probability = number().min(0).max(1);
-		const answer = object({
-			type: literal("choice"),
-			choice: _enum([
-				"allow",
-				"block",
-				"ask"
-			]),
-			confidence: probability,
-			probabilities: strictObject({
-				allow: probability,
-				block: probability,
-				ask: probability
-			})
-		});
-		const schema = object({
-			model: string().min(1),
-			answers: record(string(), answer),
-			usage: object({ input_tokens: number().int().nonnegative() })
-		});
 		let responseBody;
 		try {
 			responseBody = await response.json();
@@ -7400,7 +7597,7 @@ async function sendDecision(provider, apiKey, request, signal) {
 			if (error instanceof Error && error.name === "AbortError") throw new DecisionRequestError("aborted", requestBytes, "Decision request aborted", { cause: error });
 			throw new DecisionRequestError("invalid-response", requestBytes, "Decision API returned invalid JSON");
 		}
-		const parsedResponse = schema.safeParse(responseBody);
+		const parsedResponse = decisionResponseSchema.safeParse(responseBody);
 		if (!parsedResponse.success) throw new DecisionRequestError("invalid-response", requestBytes, "Decision API returned a malformed response");
 		const parsed = parsedResponse.data;
 		if (Object.keys(parsed.answers).length !== Object.keys(request.questions).length) throw new DecisionRequestError("invalid-response", requestBytes, "Decision API returned an incomplete answer set");
@@ -7417,19 +7614,19 @@ async function sendDecision(provider, apiKey, request, signal) {
 			requestBytes
 		};
 	} finally {
-		clearTimeout(timer);
-		signal?.removeEventListener("abort", stopRequest);
+		signal.removeEventListener("abort", stopRequest);
 	}
 }
 //#endregion
 //#region src/model/classify-with-jev.ts
-async function classifyWithJev(payload, config, options = {}) {
+async function classifyWithJev(payload, config, options) {
 	const start = performance.now();
+	const now = options.now ?? Date.now;
 	let key = null;
 	let stage = "credential";
 	const minConfidence = config.minConfidence ?? .8;
 	let keySource = "none";
-	const envKey = config.provider.apiKeyEnv === void 0 ? void 0 : process.env[config.provider.apiKeyEnv];
+	const envKey = config.provider.apiKeyEnv === void 0 ? void 0 : options.host.env[config.provider.apiKeyEnv];
 	if (envKey !== void 0 && envKey !== "") keySource = "environment";
 	else if (config.provider.apiKeyCommand !== void 0 && config.provider.apiKeyCommand !== "") keySource = "command";
 	try {
@@ -7437,23 +7634,22 @@ async function classifyWithJev(payload, config, options = {}) {
 		if (key === null) throw new Error("no API key: set the configured environment variable or key command");
 		stage = "evidence";
 		const directUserText = payload.decisionContext?.agentID === null ? payload.decisionContext.lastDirectUserMessage?.text ?? null : null;
-		const [policy, rules, repositoryContext] = await Promise.all([
+		const [policy, rules, repositoryContext, mcpServers] = await Promise.all([
 			loadPolicy({
 				classifierPath: config.classifierPath,
 				rulesPath: config.rulesPath
 			}, "decision.md"),
-			loadClaudeRules(config.claudeSettingsPath),
-			loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null)
+			loadClaudeRules(config.claudeSettingsPath, options.host),
+			loadRepositoryEvidence(payload.cwd, options.taskScope, options.host.env).catch(() => null),
+			loadMCPServers(payload.cwd, options.host).catch(() => [])
 		]);
-		const request = buildDecisionRequest(payload, policy, rules, directUserText, config.rulesPath === void 0 ? "shipped" : "replacement", repositoryContext);
-		const remainingMs = options.deadlineAt === void 0 ? config.provider.timeoutMs : options.deadlineAt - Date.now();
+		const request = buildDecisionRequest(payload, policy, rules, directUserText, config.rulesPath === void 0 ? "shipped" : "replacement", repositoryContext, mcpServers);
+		const remainingMs = options.deadlineAt === void 0 ? config.provider.timeoutMs : options.deadlineAt - now();
 		if (remainingMs <= 0 || options.signal?.aborted === true) throw new DOMException("Evaluation deadline expired", "AbortError");
-		const provider = {
-			...config.provider,
-			timeoutMs: Math.min(config.provider.timeoutMs, remainingMs)
-		};
+		const timer = (options.timeout ?? ((ms) => AbortSignal.timeout(ms)))(toTimerDelay(Math.min(config.provider.timeoutMs, remainingMs)));
+		const signal = options.signal === void 0 ? timer : AbortSignal.any([timer, options.signal]);
 		stage = "request";
-		const result = await sendDecision(provider, key, request, options.signal);
+		const result = await sendDecision(config.provider, key, request, signal);
 		stage = "response";
 		const verdict = pickDecisionVerdict(request, result, minConfidence);
 		return {
@@ -7477,7 +7673,7 @@ async function classifyWithJev(payload, config, options = {}) {
 		if (options.signal?.aborted === true) {
 			reason = "evaluation cancelled";
 			status = "cancelled";
-		} else if (options.deadlineAt !== void 0 && Date.now() >= options.deadlineAt) {
+		} else if (options.deadlineAt !== void 0 && now() >= options.deadlineAt) {
 			reason = "evaluation deadline expired";
 			status = "timeout";
 		} else if (error instanceof Error) {
@@ -7538,8 +7734,15 @@ function parseModelVerdict(text) {
 //#endregion
 //#region src/model/classify-with-model.ts
 async function classifyWithModel(payload, config, options = {}) {
-	if (config.provider.protocol === "system-one") return classifyWithJev(payload, config, options);
-	const apiKey = await resolveApiKey(config.provider);
+	const host = options.host ?? readHostEnvironment();
+	if (config.provider.protocol === "system-one") return classifyWithJev(payload, config, {
+		...options,
+		host
+	});
+	const apiKey = await resolveApiKey(config.provider, {
+		...options,
+		host
+	});
 	if (apiKey === null) return buildFailure(config, "no API key: set the configured environment variable or key command");
 	let system;
 	try {
@@ -7555,13 +7758,14 @@ async function classifyWithModel(payload, config, options = {}) {
 		role: "user",
 		text: directMessage.text
 	}];
-	const repositoryContext = await loadRepositoryEvidence(payload.cwd, options.taskScope).catch(() => null);
-	const user = buildUserMessage(payload, transcript, config.provider.reasoning, repositoryContext);
+	const [repositoryContext, mcpServers] = await Promise.all([loadRepositoryEvidence(payload.cwd, options.taskScope, host.env).catch(() => null), loadMCPServers(payload.cwd, host).catch(() => [])]);
+	const user = buildUserMessage(payload, transcript, config.provider.reasoning, repositoryContext, mcpServers);
 	try {
+		const timeout = options.timeout ?? ((ms) => AbortSignal.timeout(ms));
 		const result = await sendMessage(config.provider, apiKey, {
 			system,
 			user
-		});
+		}, timeout(toTimerDelay(config.provider.timeoutMs)));
 		if (result.text.trim() === "") return buildFailure(config, `${config.provider.model} returned no text; raise maxTokens`);
 		const verdict = parseModelVerdict(formatClassifierNote(result.text, apiKey));
 		const cache = `${result.cachedInputTokens} cached / ${result.cacheWriteTokens} written / ${result.newInputTokens} new / ${result.outputTokens} out`;
@@ -7593,19 +7797,8 @@ function toMessage(error) {
 }
 //#endregion
 //#region src/policy/read-denial-guidance.ts
-async function readDenialGuidance() {
-	return (await readFile(join(resolveShippedPolicyDir(), "denial.md"), "utf8")).trim();
-}
-//#endregion
-//#region node_modules/.bun/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js
-var isProduction = process.env.NODE_ENV === "production";
-var prefix = "Invariant failed";
-function invariant(condition, message) {
-	if (condition) return;
-	if (isProduction) throw new Error(prefix);
-	var provided = typeof message === "function" ? message() : message;
-	var value = provided ? "".concat(prefix, ": ").concat(provided) : prefix;
-	throw new Error(value);
+async function readDenialGuidance(policyDir = resolveShippedPolicyDir()) {
+	return (await readFile(join(policyDir, "denial.md"), "utf8")).trim();
 }
 //#endregion
 //#region src/rules/local-allowlists.ts
@@ -7769,37 +7962,6 @@ function toUnquoted(word) {
 	return (first === "'" || first === "\"") && word.at(-1) === first ? word.slice(1, -1) : word;
 }
 //#endregion
-//#region src/scope/find-checkout.ts
-const GIT_OVERRIDES$1 = [
-	"GIT_DIR",
-	"GIT_WORK_TREE",
-	"GIT_COMMON_DIR"
-];
-async function findCheckout(start) {
-	if (GIT_OVERRIDES$1.some((name) => process.env[name] !== void 0)) return null;
-	for (let directory = start;; directory = dirname(directory)) {
-		const gitPath = join(directory, ".git");
-		const info = await stat(gitPath).catch(() => null);
-		if (info !== null) {
-			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
-			return gitDir === null ? null : {
-				worktree: directory,
-				commonDir: await findCommonDir(gitDir)
-			};
-		}
-		if (dirname(directory) === directory) return null;
-	}
-}
-async function findLinkedGitDir(directory, gitPath) {
-	const link = await readFile(gitPath, "utf8").catch(() => "");
-	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
-	return path === void 0 ? null : resolve(directory, path.trim());
-}
-async function findCommonDir(gitDir) {
-	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
-	return common === null ? gitDir : resolve(gitDir, common.trim());
-}
-//#endregion
 //#region src/scope/merge-scope-facts.ts
 function mergeScopeFacts(all) {
 	const pullRequests = /* @__PURE__ */ new Map();
@@ -7989,7 +8151,7 @@ function resolveSessionScopePath(stateDir, sessionID) {
 }
 //#endregion
 //#region src/scope/pick-scope-source-reader.ts
-function pickScopeSourceReader(source) {
+function pickScopeSourceReader(source, findSourceCheckout = findCheckout) {
 	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
 		worktrees: [context.worktree],
 		branches: context.branch === null ? [] : [context.branch]
@@ -8005,7 +8167,7 @@ function pickScopeSourceReader(source) {
 	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
 	return async (context) => {
 		const loaded = await loadAtcSessionRecord(context.atcRecordPath, context.atcSessionID);
-		if (loaded.kind === "malformed") process.stderr.write(`auto-mode: ${loaded.diagnostic}\n`);
+		if (loaded.kind === "malformed") context.stderr.write(`auto-mode: ${loaded.diagnostic}\n`);
 		if (loaded.kind !== "record") return EMPTY_SCOPE_FACTS;
 		const scope = loaded.record.scope;
 		const paths = /* @__PURE__ */ new Set([
@@ -8013,13 +8175,13 @@ function pickScopeSourceReader(source) {
 			...scope.worktrees.map((worktree) => worktree.path),
 			...scope.branches.map((branch) => branch.repo ?? scope.workspace.path)
 		]);
-		const entries = await Promise.all([...paths].map((path) => findCommonDirEntry(path)));
+		const entries = await Promise.all([...paths].map((path) => findCommonDirEntry(path, context.env, findSourceCheckout)));
 		const commonDirs = new Map(entries);
 		return buildAtcScopeFacts(loaded.record, (path) => context.commonDir !== null && commonDirs.get(path) === context.commonDir);
 	};
 }
-async function findCommonDirEntry(path) {
-	return [path, (await findCheckout(path))?.commonDir ?? null];
+async function findCommonDirEntry(path, env, findSourceCheckout) {
+	return [path, (await findSourceCheckout(path, env))?.commonDir ?? null];
 }
 function buildFacts(facts) {
 	return {
@@ -8029,23 +8191,25 @@ function buildFacts(facts) {
 }
 //#endregion
 //#region src/scope/load-task-scope.ts
-async function loadTaskScope(request, sources) {
+async function loadTaskScope(request, sources, host, stderr) {
 	const cwd = resolve(request.cwd);
-	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
+	const [checkout, context] = await Promise.all([findCheckout(cwd, host.env), loadRepositoryContext(cwd, host.env)]);
 	const branch = context?.branch ?? null;
 	const sourceContext = {
+		env: host.env,
 		sessionID: request.sessionID,
 		cwd,
 		worktree: checkout?.worktree ?? cwd,
 		commonDir: checkout?.commonDir ?? null,
 		branch,
 		stateDir: request.stateDir,
-		atcRecordPath: process.env["ATC_SESSION_RECORD"],
-		atcSessionID: process.env["ATC_SESSION_ID"]
+		atcRecordPath: host.env["ATC_SESSION_RECORD"],
+		atcSessionID: host.env["ATC_SESSION_ID"],
+		stderr
 	};
 	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
 	return buildTaskScope({
-		home: homedir(),
+		home: host.home,
 		currentBranch: branch,
 		defaultBranch: context?.defaultBranch ?? null,
 		remotes,
@@ -8053,18 +8217,12 @@ async function loadTaskScope(request, sources) {
 	});
 }
 //#endregion
-//#region src/state/resolve-state-dir.ts
-function resolveStateDir() {
-	const stateHome = process.env["XDG_STATE_HOME"];
-	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
-	return join(base, "auto-mode");
-}
-//#endregion
 //#region src/classify-action.ts
 async function classifyAction(request, config, options = {}) {
+	const host = options.host ?? readHostEnvironment();
 	let configured = null;
 	if (config.provider.protocol === "system-one") try {
-		configured = await loadClaudeRules(config.claudeSettingsPath);
+		configured = await loadClaudeRules(config.claudeSettingsPath, host);
 	} catch {
 		const guidance = config.onFailure === "deny" ? await tryReadDenialGuidance() : null;
 		return {
@@ -8078,8 +8236,8 @@ async function classifyAction(request, config, options = {}) {
 	const hasConfiguredDenies = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0);
 	const local = hasConfiguredDenies ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
-	const scope = await tryLoadTaskScope(request, config);
-	const containment = scope === null ? null : checkContainment(request, scope);
+	const scope = await tryLoadTaskScope(request, config, host, options.stderr ?? process.stderr);
+	const containment = scope === null ? null : checkContainment(request, scope, host.scratchPaths);
 	if (containment !== null) {
 		const guidance = await tryReadDenialGuidance();
 		return {
@@ -8090,7 +8248,7 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	if (local.kind === "allow") return buildLocalAllow(local.exception);
-	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope);
+	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope, host);
 	if (edit?.kind === "bypass") return {
 		verdict: { kind: "allow" },
 		decidingStage: "bypass",
@@ -8106,7 +8264,8 @@ async function classifyAction(request, config, options = {}) {
 	const taskScope = scope === null ? void 0 : buildTaskScopeSummary(scope);
 	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, {
 		...options,
-		taskScope
+		taskScope,
+		host
 	}), tryReadDenialGuidance()]);
 	return {
 		...outcome,
@@ -8116,47 +8275,13 @@ async function classifyAction(request, config, options = {}) {
 	};
 }
 const READ_ONLY_EXCEPTION = "Read-only actions";
-async function tryLoadTaskScope(request, config) {
+async function tryLoadTaskScope(request, config, host, stderr) {
 	try {
 		return await loadTaskScope({
 			sessionID: request.sessionID,
 			cwd: request.cwd,
-			stateDir: resolveStateDir()
-		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
-	} catch {
-		return null;
-	}
-}
-const GIT_OVERRIDES = [
-	"GIT_DIR",
-	"GIT_WORK_TREE",
-	"GIT_COMMON_DIR"
-];
-async function tryClassifyEdit(request, scope) {
-	const fields = getEditFields(request.toolName);
-	const path = fields === null ? void 0 : request.toolInput[fields.path];
-	if (typeof path !== "string" || path === "") return null;
-	try {
-		const ownDirs = [dirname(resolveConfigPath()), resolveStateDir()];
-		const requested = resolve(request.cwd, path);
-		const [target, worktrees, protectedDirs] = await Promise.all([
-			resolveEditTarget(requested),
-			Promise.all(scope.worktrees.map((worktree) => resolveEditTarget(worktree))),
-			Promise.all(ownDirs.map((dir) => resolveEditTarget(dir)))
-		]);
-		if (target === null || GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
-		const [checkout, current] = await Promise.all([findCheckout(dirname(target)), request.toolName === "Edit" ? readFile(target, "utf8").catch(() => null) : null]);
-		return (await import("./classify-edit-D8GC6b91.js")).classifyEdit({
-			toolName: request.toolName,
-			toolInput: request.toolInput,
-			requested,
-			target,
-			checkout: checkout?.worktree ?? null,
-			current
-		}, {
-			worktrees: worktrees.filter((worktree) => worktree !== null),
-			protectedDirs: [...ownDirs, ...protectedDirs.filter((dir) => dir !== null)]
-		});
+			stateDir: resolveStateDir(host)
+		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES, host, stderr);
 	} catch {
 		return null;
 	}
@@ -8185,7 +8310,7 @@ async function tryReadDenialGuidance() {
 	}
 }
 //#endregion
-//#region src/request/parse-action-request.ts
+//#region src/request/action-request-schema.ts
 const userTaskSchema = strictObject({
 	text: string(),
 	origin: _enum([
@@ -8209,7 +8334,7 @@ const decisionContextSchema = strictObject({
 	lastDirectUserMessage: userTaskSchema.nullable(),
 	omittedTaskContext: array(omissionSchema)
 });
-const requestSchema = strictObject({
+const actionRequestSchema = strictObject({
 	sessionID: string().min(1),
 	toolUseID: string().min(1).optional(),
 	cwd: string().min(1),
@@ -8217,8 +8342,10 @@ const requestSchema = strictObject({
 	toolInput: looseObject({}),
 	context: decisionContextSchema
 });
+//#endregion
+//#region src/request/parse-action-request.ts
 function parseActionRequest(body) {
-	const parsed = requestSchema.safeParse(body);
+	const parsed = actionRequestSchema.safeParse(body);
 	if (!parsed.success) return null;
 	const context = parsed.data.context;
 	return {
@@ -8242,4 +8369,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, splitCommandWords as _, resolveSessionScopePath as a, DEFAULT_SCOPE_SOURCES as b, findCheckout as c, parseModelVerdict as d, loadRepositoryContext as f, splitShellCommand as g, toRepositorySlug as h, resolveStateDir as i, classifyLocally as l, loadPolicy as m, parseActionRequest as n, loadSessionScope as o, loadCheckoutRemotes as p, classifyAction as r, EMPTY_SESSION_SCOPE as s, renderVerdict as t, classifyWithModel as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };
+export { resolveConfigPath as C, strictObject as D, number as E, string as O, resolveApiKey as S, PRESETS as T, findCheckout as _, loadSessionScope as a, DEFAULT_SCOPE_SOURCES as b, classifyWithModel as c, loadCheckoutRemotes as d, loadPolicy as f, resolveStateDir as g, splitCommandWords as h, resolveSessionScopePath as i, parseModelVerdict as l, splitShellCommand as m, parseActionRequest as n, EMPTY_SESSION_SCOPE as o, toRepositorySlug as p, classifyAction as r, classifyLocally as s, renderVerdict as t, loadRepositoryContext as u, DEFAULT_CONFIG as v, readHostEnvironment as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };