auto-mode 0.15.0 → 0.17.0

package/README.md

@@ -58,10 +58,10 @@ assessment.
 
 ## Decisions and failures
 
-Jev evaluates each named rule with a typed choice. auto-mode returns a denial for a confident block,
-approval when every rule confidently allows the action, and a denial for uncertain decisions. Every
-denial names its rule, the harm, and what clears it, and the agent continues on another path. The
-confidence threshold is configurable and needs evaluation against your actions.
+Jev evaluates each named rule with a typed choice between allow and block. auto-mode allows the
+action unless some rule's block probability reaches the threshold, 0.2 by default. Every denial
+names the rule with the highest block probability, the harm, and what clears it, and the agent
+continues on another path. The threshold is configurable and needs evaluation against your actions.
 
 A missing key, failed API call, malformed response, or oversized request follows
 `decision.onFailure`. The default `defer` writes no verdict and keeps the prompt; `deny` fails

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { D as strictObject, E as number, O as string, _ as findCheckout, a as loadSessionScope, b as DEFAULT_SCOPE_SOURCES, d as loadCheckoutRemotes, f as loadPolicy, g as resolveStateDir, h as splitCommandWords, i as resolveSessionScopePath, m as splitShellCommand, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as toRepositorySlug, r as classifyAction, t as renderVerdict, u as loadRepositoryContext, w as readHostEnvironment, x as loadConfig, y as DEFAULT_DENIAL_BUDGET } from "./render-verdict-Bj2tGqBI.js";
-import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, normalize } from "node:path";
+import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-Bx9Lw7gO.js";
+import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { constants } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 import { parseArgs } from "node:util";
@@ -16,11 +17,13 @@ const DESCRIPTIVE_FIELDS = { Bash: [
 function buildRetryKey(request) {
 	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
 	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const message = request.decisionContext?.lastDirectUserMessage ?? null;
 	const canonical = JSON.stringify(sortKeys({
 		cwd: request.cwd,
 		toolName: request.toolName,
 		toolInput: input,
-		lastDirectUserMessage: request.decisionContext?.lastDirectUserMessage?.text ?? null
+		lastDirectUserMessage: message?.text ?? null,
+		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
 	}));
 	return createHash("sha256").update(canonical).digest("hex");
 }
@@ -136,6 +139,82 @@ async function writeDenialState(path, state) {
 	await rename(staged, path);
 }
 //#endregion
+//#region src/capture/resolve-capture-dir.ts
+function resolveCaptureDir(capture, host) {
+	return capture.dir ?? join(resolveStateDir(host), "captures");
+}
+//#endregion
+//#region src/capture/find-enclosing-work-tree.ts
+async function findEnclosingWorkTree(path) {
+	const real = await resolveExistingPrefix(resolve(path));
+	for (let directory = real;; directory = dirname(directory)) {
+		if (await hasGitEntry(directory)) return directory;
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function resolveExistingPrefix(path) {
+	const missing = [];
+	for (let current = path;; current = dirname(current)) {
+		const real = await realpath(current).catch(() => null);
+		if (real !== null) return join(real, ...missing.toReversed());
+		if (dirname(current) === current) return path;
+		missing.push(basename(current));
+	}
+}
+const ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function hasGitEntry(directory) {
+	try {
+		await lstat(join(directory, ".git"));
+		return true;
+	} catch (error) {
+		return !(error instanceof Error && "code" in error && ABSENT_CODES.has(String(error.code)));
+	}
+}
+//#endregion
+//#region src/capture/try-write-request-capture.ts
+async function tryWriteRequestCapture(dir, record) {
+	if (!isAbsolute(dir)) return {
+		kind: "refused",
+		reason: `the capture dir ${dir} is not an absolute path`
+	};
+	try {
+		const before = await findEnclosingWorkTree(dir);
+		if (before !== null) return {
+			kind: "refused",
+			reason: `the capture dir is inside the git work tree ${before}`
+		};
+		await mkdir(dir, {
+			recursive: true,
+			mode: 448
+		});
+		const real = await realpath(dir);
+		const after = await findEnclosingWorkTree(real);
+		if (after !== null) return {
+			kind: "refused",
+			reason: `the capture dir is inside the git work tree ${after}`
+		};
+		if (((await stat(real)).mode & 63) !== 0) await chmod(real, 448);
+		await writeOwnerFile(join(real, ".gitignore"), "*\n", constants.O_TRUNC);
+		const path = join(real, `requests-${record.time.slice(0, 10)}.jsonl`);
+		await writeOwnerFile(path, `${JSON.stringify(record)}\n`, constants.O_APPEND);
+		return {
+			kind: "written",
+			path
+		};
+	} catch {
+		return { kind: "failed" };
+	}
+}
+async function writeOwnerFile(path, text, flag) {
+	const handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | flag, 384);
+	try {
+		if (((await handle.stat()).mode & 63) !== 0) await handle.chmod(384);
+		await handle.writeFile(text);
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
 //#region src/config/build-jev-only-config.ts
 function buildJevOnlyConfig(config) {
 	if (config.provider.protocol !== "system-one") return null;
@@ -153,7 +232,7 @@ async function writeActionDiagnostic(payload, entry, host, warnings) {
 	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(host), "actions.jsonl");
 	if (path === "") return;
 	const record = {
-		schemaVersion: 3,
+		schemaVersion: 4,
 		time: (/* @__PURE__ */ new Date()).toISOString(),
 		invocationID: entry.invocationID,
 		sessionHash: toHash(payload.sessionID),
@@ -163,7 +242,8 @@ async function writeActionDiagnostic(payload, entry, host, warnings) {
 		decidingStage: entry.decidingStage ?? null,
 		denials: entry.denials ?? null,
 		escalation: entry.escalation ?? false,
-		diagnostics: entry.diagnostics ?? null
+		diagnostics: entry.diagnostics ?? null,
+		judge: entry.judge ?? null
 	};
 	try {
 		await mkdir(dirname(path), {
@@ -196,7 +276,8 @@ function parseScopeRecordRequest(body) {
 //#endregion
 //#region src/scope/read-pull-request.ts
 const LOOKUP_TIMEOUT_MS = 5e3;
-function readPullRequest(repository, number) {
+function readPullRequest(repository, number, options = {}) {
+	const [file, ...prefix] = options.command ?? ["gh"];
 	const args = [
 		"pr",
 		"view",
@@ -207,7 +288,8 @@ function readPullRequest(repository, number) {
 		"headRefName,createdAt"
 	];
 	return new Promise((resolve) => {
-		const child = spawn("gh", [
+		const child = spawn(file, [
+			...prefix,
 			...args,
 			"--jq",
 			"[.headRefName, .createdAt] | @tsv"
@@ -217,7 +299,7 @@ function readPullRequest(repository, number) {
 				"pipe",
 				"ignore"
 			],
-			timeout: LOOKUP_TIMEOUT_MS
+			timeout: options.timeoutMs ?? LOOKUP_TIMEOUT_MS
 		});
 		let output = "";
 		child.stdout.setEncoding("utf8");
@@ -615,8 +697,20 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 				session: plan.state.session
 			},
 			escalation: plan.escalation,
-			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics }
+			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics },
+			...outcome.judge === void 0 ? {} : { judge: outcome.judge }
 		}, host, io.stderr);
+		if (config.capture?.enabled === true) {
+			const captured = await tryWriteRequestCapture(resolveCaptureDir(config.capture, host), {
+				schemaVersion: 1,
+				time: (/* @__PURE__ */ new Date()).toISOString(),
+				request: body,
+				verdict: plan.verdict,
+				decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
+				escalation: plan.escalation
+			});
+			printCaptureNote(io.stderr, captured);
+		}
 		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
 		return printNote(io.stderr, explain || outcome.unavailable === true, note);
 	} finally {
@@ -640,6 +734,10 @@ async function tryWriteDenialState(stderr, path, state) {
 function printVerdict(stdout, verdict) {
 	stdout.write(renderVerdict(verdict));
 }
+function printCaptureNote(stderr, captured) {
+	if (captured.kind === "refused") stderr.write(`auto-mode: capture skipped: ${captured.reason}\n`);
+	if (captured.kind === "failed") stderr.write("auto-mode: capture unavailable\n");
+}
 async function runRecord(io) {
 	const raw = await io.stdin();
 	let body;

package/dist/index.d.ts

@@ -1,14 +1,11 @@
-//#region src/budget/types.d.ts
-interface DenialBudget {
-  readonly consecutive: number;
-  readonly perSession: number;
-}
-//#endregion
 //#region src/request/types.d.ts
 interface UserTask {
   readonly text: string;
   readonly origin: 'composer' | 'bridge' | 'sdk';
 }
+interface DirectUserMessage extends UserTask {
+  readonly freshness?: 'stale' | undefined;
+}
 interface DecisionContext {
   readonly agentID: string | null;
   readonly originalUserTask: UserTask | null;
@@ -16,7 +13,7 @@ interface DecisionContext {
     readonly text: string;
     readonly origin: 'agent.spawn';
   } | null;
-  readonly lastDirectUserMessage: UserTask | null;
+  readonly lastDirectUserMessage: DirectUserMessage | null;
   readonly omittedTaskContext: readonly {
     readonly field: 'originalUserTask' | 'delegatedTask';
     readonly reason: 'unavailable' | 'budget';
@@ -45,6 +42,51 @@ interface DecisionRule {
   readonly source: 'shipped' | 'replacement' | 'configured';
   readonly text: string;
 }
+type DecisionChoice = 'allow' | 'block';
+type RecordedDecisionChoice = DecisionChoice | 'ask';
+interface DecisionQuestion<Choice extends string = DecisionChoice> {
+  readonly type: 'choice';
+  readonly instructions: string;
+  readonly criteria: Readonly<Record<Choice, string>>;
+}
+interface DecisionInput<Choice extends string = DecisionChoice> {
+  readonly state: {
+    readonly policy: string;
+    readonly answerGuidance: string;
+    readonly rulesSource: 'shipped' | 'replacement';
+    readonly configuredRules: ClaudeRules;
+    readonly lastUserMessage: string | null;
+    readonly repositoryContext?: RepositoryContext;
+    readonly mcpServers?: readonly MCPServerFact[];
+    readonly taskContext?: DecisionContext;
+    readonly action: {
+      readonly tool: string;
+      readonly cwd: string;
+      readonly input: Readonly<Record<string, unknown>>;
+    };
+  };
+  readonly questions: Readonly<Record<string, DecisionQuestion<Choice>>>;
+}
+interface DecisionRequest extends DecisionInput {
+  readonly rules: Readonly<Record<string, DecisionRule>>;
+}
+interface RepositoryContext {
+  readonly cwd: string;
+  readonly branch: string | null;
+  readonly defaultBranch: string | null;
+  readonly remotes?: readonly RepositoryRemote[] | undefined;
+  readonly taskScope?: TaskScopeSummary | undefined;
+}
+interface MCPServerFact {
+  readonly name: string;
+  readonly scope: 'user' | 'local' | 'project';
+  readonly transport: 'stdio' | 'http' | 'sse' | 'ws';
+  readonly host: string | null;
+}
+interface RepositoryRemote {
+  readonly name: string;
+  readonly url: string;
+}
 interface TaskScopeSummary {
   readonly worktrees: readonly string[];
   readonly branches: readonly string[];
@@ -53,12 +95,18 @@ interface TaskScopeSummary {
     readonly number: number;
   }[];
 }
-interface DecisionAnswer {
+interface DecisionAnswer<Choice extends string = DecisionChoice> {
   readonly type: 'choice';
-  readonly choice: 'allow' | 'block' | 'ask';
-  readonly probabilities: Readonly<Record<'allow' | 'block' | 'ask', number>>;
+  readonly choice: Choice;
+  readonly probabilities: Readonly<Record<Choice, number>>;
   readonly confidence: number;
 }
+interface DecisionResult<Choice extends string = DecisionChoice> {
+  readonly model: string;
+  readonly answers: Readonly<Record<string, DecisionAnswer<Choice>>>;
+  readonly inputTokens: number;
+  readonly requestBytes: number;
+}
 type DecisionFailureReason = 'request-too-large' | 'aborted' | 'network' | 'http-status' | 'invalid-response';
 interface DecisionDiagnostics {
   readonly status: 'allow' | 'deny' | 'failure' | 'timeout' | 'cancelled';
@@ -68,14 +116,14 @@ interface DecisionDiagnostics {
   readonly failureReason: DecisionFailureReason | null;
   readonly requestBytes: number | null;
   readonly elapsedMs: number;
-  readonly minConfidence: number;
+  readonly blockThreshold: number;
   readonly contributors: readonly {
     readonly rule: string;
     readonly source: DecisionRule['source'];
     readonly tier: DecisionRule['tier'];
     readonly choice: DecisionAnswer['choice'];
     readonly confidence: number;
-    readonly probability: number;
+    readonly blockProbability: number;
   }[];
 }
 //#endregion
@@ -88,7 +136,18 @@ interface HostEnvironment {
   readonly home: string;
   readonly scratchPaths?: readonly string[] | undefined;
 }
+interface ClaudeRules {
+  readonly environment: readonly string[];
+  readonly allow: readonly string[];
+  readonly soft_deny: readonly string[];
+  readonly hard_deny: readonly string[];
+}
+interface ClaudeSettings {
+  readonly rules: ClaudeRules;
+  readonly userSettings: unknown;
+}
 interface EvaluationOptions {
+  readonly claudeSettings?: ClaudeSettings | undefined;
   readonly deadlineAt?: number | undefined;
   readonly signal?: Readonly<AbortSignal> | undefined;
   readonly taskScope?: TaskScopeSummary | undefined;
@@ -97,12 +156,79 @@ interface EvaluationOptions {
   readonly timeout?: ((ms: number) => AbortSignal) | undefined;
 }
 //#endregion
+//#region src/containment/collect-scope-findings.d.ts
+interface ScopeRemote {
+  readonly name: string;
+  readonly url: string;
+}
+interface OwnedPullRequest {
+  readonly number: number;
+  readonly repository: string;
+}
+interface OwnedScope {
+  readonly home: string;
+  readonly worktrees: readonly string[];
+  readonly branches: readonly string[];
+  readonly currentBranch: string | null;
+  readonly remotes: readonly ScopeRemote[];
+  readonly pullRequests: readonly OwnedPullRequest[];
+  readonly pathGlobs: readonly string[];
+}
+interface ScopeFinding {
+  readonly kind: 'path' | 'branch' | 'remote-write' | 'credential' | 'prune';
+  readonly target: string;
+}
+//#endregion
+//#region src/scope/find-checkout.d.ts
+interface Checkout {
+  readonly worktree: string;
+  readonly commonDir: string;
+}
+//#endregion
+//#region src/bypass/classify-edit.d.ts
+type EditClassification = {
+  readonly kind: 'bypass';
+  readonly target: string;
+} | {
+  readonly kind: 'jev';
+  readonly reason: string;
+};
+//#endregion
+//#region src/bypass/try-classify-edit.d.ts
+interface EditFileReader {
+  readonly resolveEditTarget: (path: string) => Promise<string | null>;
+  readonly findCheckout: (directory: string, env: HostEnvironment['env']) => Promise<Checkout | null>;
+  readonly readFile: (path: string) => Promise<string>;
+}
+export declare function tryClassifyEdit(request: Readonly<ActionRequest>, scope: Readonly<OwnedScope>, host: Readonly<HostEnvironment>, files?: Readonly<EditFileReader>): Promise<EditClassification | null>;
+//#endregion
+//#region src/budget/types.d.ts
+interface DenialBudget {
+  readonly consecutive: number;
+  readonly perSession: number;
+}
+//#endregion
+//#region src/judge/types.d.ts
+type OverturnBasis = 'consent' | 'misread';
+type JudgeOverturns = 'consent' | 'any';
+type JudgeStatus = 'confirmed' | 'overturned' | 'held' | 'failed';
+type JudgeFailure = 'credential' | 'policy' | 'request' | 'timeout' | 'unreadable';
+interface JudgeDiagnostics {
+  readonly status: JudgeStatus;
+  readonly failureReason: JudgeFailure | null;
+  readonly overturnBasis: OverturnBasis | null;
+  readonly model: string;
+  readonly rule: string;
+  readonly tier: 'hard' | 'soft';
+  readonly elapsedMs: number;
+}
+//#endregion
 //#region src/config/presets.d.ts
 export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
 //#endregion
 //#region src/config/config.d.ts
 interface ProviderConfig {
-  readonly protocol?: 'messages' | 'system-one';
+  readonly protocol?: 'messages' | 'system-one' | 'claude-code';
   readonly baseURL: string;
   readonly model: string;
   readonly apiKeyEnv?: string | undefined;
@@ -117,16 +243,22 @@ interface ScopeSource {
 }
 type ScopeSourceKind = (typeof SCOPE_SOURCE_KINDS)[number];
 declare const SCOPE_SOURCE_KINDS: readonly ['cwd', 'session', 'globs', 'atc'];
+interface CaptureConfig {
+  readonly enabled: boolean;
+  readonly dir?: string | undefined;
+}
 interface Config {
   readonly provider: ProviderConfig;
   readonly judge?: ProviderConfig | null;
+  readonly judgeOverturns?: JudgeOverturns;
   readonly scopeSources?: Readonly<Record<string, ScopeSource>>;
   readonly classifierPath?: string | undefined;
   readonly rulesPath?: string | undefined;
   readonly onFailure: 'defer' | 'deny';
   readonly claudeSettingsPath?: string | null | undefined;
-  readonly minConfidence?: number | undefined;
+  readonly blockThreshold?: number | undefined;
   readonly denialBudget?: DenialBudget;
+  readonly capture?: CaptureConfig;
   readonly warnings?: readonly string[];
 }
 export declare const DEFAULT_CONFIG: Config;
@@ -135,7 +267,7 @@ export declare function loadConfig(configPath?: string, host?: Readonly<HostEnvi
 export declare function resolveApiKey(provider: ProviderConfig, options?: EvaluationOptions): Promise<string | null>;
 //#endregion
 //#region src/classify-action.d.ts
-type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'messages' | 'retry';
+type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'judge' | 'messages' | 'retry';
 interface ActionOutcome {
   readonly verdict: Verdict | null;
   readonly decidingStage: DecidingStage;
@@ -143,6 +275,7 @@ interface ActionOutcome {
   readonly status: 'allow' | 'skipped' | 'failure' | DecisionDiagnostics['status'];
   readonly unavailable?: boolean;
   readonly diagnostics?: DecisionDiagnostics;
+  readonly judge?: JudgeDiagnostics;
 }
 interface ClassifyOptions extends EvaluationOptions {
   readonly localOnly?: boolean;
@@ -150,24 +283,70 @@ interface ClassifyOptions extends EvaluationOptions {
 }
 export declare function classifyAction(request: ActionRequest, config: Config, options?: ClassifyOptions): Promise<ActionOutcome>;
 //#endregion
+//#region src/config/load-claude-rules.d.ts
+export declare function loadClaudeRules(path: string | null | undefined, host: Readonly<HostEnvironment>): Promise<ClaudeRules>;
+//#endregion
+//#region src/containment/check-containment.d.ts
+interface ContainmentDeny {
+  readonly rule: string;
+  readonly reason: string;
+  readonly findings: readonly ScopeFinding[];
+}
+export declare function checkContainment(request: Readonly<ActionRequest>, scope: Readonly<OwnedScope>, scratchPaths?: readonly string[]): ContainmentDeny | null;
+//#endregion
+//#region src/model/build-decision-request.d.ts
+export declare function buildDecisionRequest(payload: ActionRequest, policy: string, configuredRules: ClaudeRules, lastUserMessage: string | null, rulesSource?: 'shipped' | 'replacement', repositoryContext?: RepositoryContext | null, mcpServers?: readonly MCPServerFact[]): DecisionRequest;
+//#endregion
+//#region src/policy/build-deny-reason.d.ts
+type DenyBasis = 'matched' | 'unresolved';
+//#endregion
+//#region src/model/find-denied-rule.d.ts
+interface DeniedRule {
+  readonly rule: DecisionRule;
+  readonly basis: DenyBasis;
+}
+//#endregion
+//#region src/judge/classify-with-judge.d.ts
+interface JudgeEvidence extends DeniedRule {
+  readonly repositoryContext: RepositoryContext | null;
+}
+//#endregion
 //#region src/model/classify-with-model.d.ts
 interface ModelOutcome {
   readonly verdict: Verdict | null;
   readonly note: string;
   readonly unavailable?: boolean;
   readonly diagnostics?: DecisionDiagnostics;
+  readonly review?: JudgeEvidence;
 }
 export declare function classifyWithModel(payload: ActionRequest, config: Config, options?: EvaluationOptions): Promise<ModelOutcome>;
 //#endregion
+//#region src/model/decision-request-error.d.ts
+export declare class DecisionRequestError extends Error {
+  readonly reason: DecisionFailureReason;
+  readonly requestBytes: number;
+  constructor(reason: DecisionFailureReason, requestBytes: number, message: string, options?: Readonly<ErrorOptions>);
+}
+//#endregion
 //#region src/model/parse-verdict.d.ts
 export declare function parseModelVerdict(text: string): Verdict;
 //#endregion
+//#region src/model/send-decision.d.ts
+interface SendOptions {
+  readonly fetch?: (url: string, init: Readonly<RequestInit>) => Promise<Response>;
+}
+interface SendDecisionOptions<Choice extends string> extends SendOptions {
+  readonly choices: readonly [Choice, ...Choice[]];
+}
+export declare function sendDecision(provider: ProviderConfig, apiKey: string, request: DecisionInput, signal: Readonly<AbortSignal>, options?: SendOptions): Promise<DecisionResult>;
+export declare function sendDecision<Choice extends string>(provider: ProviderConfig, apiKey: string, request: DecisionInput<Choice>, signal: Readonly<AbortSignal>, options: SendDecisionOptions<Choice>): Promise<DecisionResult<Choice>>;
+//#endregion
 //#region src/policy/load-policy.d.ts
 interface PolicyPaths {
   readonly classifierPath?: string | undefined;
   readonly rulesPath?: string | undefined;
 }
-export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md'): Promise<string>;
+export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md' | 'judge.md'): Promise<string>;
 //#endregion
 //#region src/request/parse-action-request.d.ts
 export declare function parseActionRequest(body: unknown): ActionRequest | null;
@@ -184,4 +363,48 @@ type LocalVerdict = {
 };
 export declare function classifyLocally(payload: ActionRequest): LocalVerdict;
 //#endregion
-export type { ActionOutcome, ActionRequest, ClassifyOptions, Config, DecisionContext, LocalVerdict, ModelOutcome, PolicyPaths, ProviderConfig, ScopeSource, Verdict };
+//#region src/scope/types.d.ts
+interface ScopePullRequest {
+  readonly number: number;
+  readonly head: string;
+  readonly repository: string;
+}
+interface ScopeFacts {
+  readonly worktrees: readonly string[];
+  readonly branches: readonly string[];
+  readonly pullRequests: readonly ScopePullRequest[];
+  readonly pathGlobs: readonly string[];
+}
+type ScopeEvent = {
+  readonly kind: 'worktree';
+  readonly path: string;
+} | {
+  readonly kind: 'branch';
+  readonly name: string;
+  readonly directory: string;
+} | {
+  readonly kind: 'pull-request';
+  readonly directory: string;
+  readonly head: string | null;
+};
+interface SessionBranch {
+  readonly name: string;
+  readonly commonDir: string;
+}
+interface SessionScope {
+  readonly worktrees: readonly string[];
+  readonly branches: readonly SessionBranch[];
+  readonly pullRequests: readonly ScopePullRequest[];
+}
+//#endregion
+//#region src/scope/build-task-scope.d.ts
+interface TaskScopeInput {
+  readonly home: string;
+  readonly currentBranch: string | null;
+  readonly defaultBranch: string | null;
+  readonly remotes: readonly ScopeRemote[];
+  readonly facts: readonly ScopeFacts[];
+}
+export declare function buildTaskScope(input: Readonly<TaskScopeInput>): OwnedScope;
+//#endregion
+export type { ActionOutcome, ActionRequest, ClassifyOptions, ClaudeRules, Config, ContainmentDeny, DecisionContext, DecisionRequest, DecisionResult, DecisionRule, EditClassification, LocalVerdict, ModelOutcome, OwnedScope, PolicyPaths, ProviderConfig, RecordedDecisionChoice, RepositoryContext, ScopeEvent, ScopeSource, SessionScope, Verdict };

package/dist/index.js

@@ -1,2 +1,7 @@
-import { C as resolveConfigPath, S as resolveApiKey, T as PRESETS, c as classifyWithModel, f as loadPolicy, l as parseModelVerdict, n as parseActionRequest, r as classifyAction, s as classifyLocally, t as renderVerdict, v as DEFAULT_CONFIG, x as loadConfig } from "./render-verdict-Bj2tGqBI.js";
-export { DEFAULT_CONFIG, PRESETS, classifyAction, classifyLocally, classifyWithModel, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath };
+import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-Bx9Lw7gO.js";
+//#region src/config/load-claude-rules.ts
+async function loadClaudeRules(path, host) {
+	return (await loadClaudeSettings(path, host)).rules;
+}
+//#endregion
+export { DEFAULT_CONFIG, DecisionRequestError, PRESETS, buildDecisionRequest, buildTaskScope, checkContainment, classifyAction, classifyLocally, classifyWithModel, loadClaudeRules, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath, sendDecision, tryClassifyEdit };