auto-mode 0.16.0 → 0.18.0

package/README.md

@@ -96,7 +96,8 @@ if (request !== null) {
 
 `classifyAction` runs both tiers and returns the verdict, a note, and diagnostics. A request carries
 the session identity, the action, and the task context; `parseActionRequest` builds one from the
-mod's JSON.
+mod's JSON. Build every request with `parseActionRequest`: it drops a child agent's direct user
+message, and the classifiers trust the request they receive.
 
 ## Documentation
 

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
-import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-u3_ftSEp.js";
-import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, join, normalize } from "node:path";
+import { C as resolveStateDir, D as DEFAULT_SCOPE_SOURCES, E as DEFAULT_DENIAL_BUDGET, F as string, N as number, O as loadConfig, P as strictObject, a as loadSessionScope, b as splitCommandWords, f as loadRepositoryContext, g as loadPolicy, i as resolveSessionScopePath, j as readHostEnvironment, n as parseActionRequest, o as EMPTY_SESSION_SCOPE, p as loadCheckoutRemotes, r as classifyAction, t as renderVerdict, v as toRepositorySlug, w as findCheckout, y as splitShellCommand } from "./render-verdict-lM31QV2u.js";
+import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { constants } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { text } from "node:stream/consumers";
 import { parseArgs } from "node:util";
@@ -16,11 +17,13 @@ const DESCRIPTIVE_FIELDS = { Bash: [
 function buildRetryKey(request) {
 	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
 	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const message = request.decisionContext?.lastDirectUserMessage ?? null;
 	const canonical = JSON.stringify(sortKeys({
 		cwd: request.cwd,
 		toolName: request.toolName,
 		toolInput: input,
-		lastDirectUserMessage: request.decisionContext?.lastDirectUserMessage?.text ?? null
+		lastDirectUserMessage: message?.text ?? null,
+		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
 	}));
 	return createHash("sha256").update(canonical).digest("hex");
 }
@@ -136,6 +139,82 @@ async function writeDenialState(path, state) {
 	await rename(staged, path);
 }
 //#endregion
+//#region src/capture/resolve-capture-dir.ts
+function resolveCaptureDir(capture, host) {
+	return capture.dir ?? join(resolveStateDir(host), "captures");
+}
+//#endregion
+//#region src/capture/find-enclosing-work-tree.ts
+async function findEnclosingWorkTree(path) {
+	const real = await resolveExistingPrefix(resolve(path));
+	for (let directory = real;; directory = dirname(directory)) {
+		if (await hasGitEntry(directory)) return directory;
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function resolveExistingPrefix(path) {
+	const missing = [];
+	for (let current = path;; current = dirname(current)) {
+		const real = await realpath(current).catch(() => null);
+		if (real !== null) return join(real, ...missing.toReversed());
+		if (dirname(current) === current) return path;
+		missing.push(basename(current));
+	}
+}
+const ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function hasGitEntry(directory) {
+	try {
+		await lstat(join(directory, ".git"));
+		return true;
+	} catch (error) {
+		return !(error instanceof Error && "code" in error && ABSENT_CODES.has(String(error.code)));
+	}
+}
+//#endregion
+//#region src/capture/try-write-request-capture.ts
+async function tryWriteRequestCapture(dir, record) {
+	if (!isAbsolute(dir)) return {
+		kind: "refused",
+		reason: `the capture dir ${dir} is not an absolute path`
+	};
+	try {
+		const before = await findEnclosingWorkTree(dir);
+		if (before !== null) return {
+			kind: "refused",
+			reason: `the capture dir is inside the git work tree ${before}`
+		};
+		await mkdir(dir, {
+			recursive: true,
+			mode: 448
+		});
+		const real = await realpath(dir);
+		const after = await findEnclosingWorkTree(real);
+		if (after !== null) return {
+			kind: "refused",
+			reason: `the capture dir is inside the git work tree ${after}`
+		};
+		if (((await stat(real)).mode & 63) !== 0) await chmod(real, 448);
+		await writeOwnerFile(join(real, ".gitignore"), "*\n", constants.O_TRUNC);
+		const path = join(real, `requests-${record.time.slice(0, 10)}.jsonl`);
+		await writeOwnerFile(path, `${JSON.stringify(record)}\n`, constants.O_APPEND);
+		return {
+			kind: "written",
+			path
+		};
+	} catch {
+		return { kind: "failed" };
+	}
+}
+async function writeOwnerFile(path, text, flag) {
+	const handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | flag, 384);
+	try {
+		if (((await handle.stat()).mode & 63) !== 0) await handle.chmod(384);
+		await handle.writeFile(text);
+	} finally {
+		await handle.close();
+	}
+}
+//#endregion
 //#region src/config/build-jev-only-config.ts
 function buildJevOnlyConfig(config) {
 	if (config.provider.protocol !== "system-one") return null;
@@ -153,7 +232,7 @@ async function writeActionDiagnostic(payload, entry, host, warnings) {
 	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveStateDir(host), "actions.jsonl");
 	if (path === "") return;
 	const record = {
-		schemaVersion: 3,
+		schemaVersion: 4,
 		time: (/* @__PURE__ */ new Date()).toISOString(),
 		invocationID: entry.invocationID,
 		sessionHash: toHash(payload.sessionID),
@@ -163,7 +242,8 @@ async function writeActionDiagnostic(payload, entry, host, warnings) {
 		decidingStage: entry.decidingStage ?? null,
 		denials: entry.denials ?? null,
 		escalation: entry.escalation ?? false,
-		diagnostics: entry.diagnostics ?? null
+		diagnostics: entry.diagnostics ?? null,
+		judge: entry.judge ?? null
 	};
 	try {
 		await mkdir(dirname(path), {
@@ -194,6 +274,22 @@ function parseScopeRecordRequest(body) {
 	return parsed.success ? parsed.data : null;
 }
 //#endregion
+//#region src/request/to-mod-request.ts
+function toModRequest(request) {
+	const context = request.decisionContext;
+	return {
+		sessionID: request.sessionID,
+		...request.toolUseID === void 0 ? {} : { toolUseID: request.toolUseID },
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: request.toolInput,
+		context: {
+			...context,
+			omittedTaskContext: [...context.omittedTaskContext]
+		}
+	};
+}
+//#endregion
 //#region src/scope/read-pull-request.ts
 const LOOKUP_TIMEOUT_MS = 5e3;
 function readPullRequest(repository, number, options = {}) {
@@ -255,6 +351,17 @@ function collectPullRequestAddresses(text) {
 }
 const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
 //#endregion
+//#region mods/auto-mode/contract/scope-commands.ts
+const SCOPE_COMMANDS = {
+	git: [
+		"worktree add",
+		"checkout",
+		"switch",
+		"branch"
+	],
+	gh: ["pr create"]
+};
+//#endregion
 //#region src/scope/collect-scope-events.ts
 function collectScopeEvents(command, cwd, home) {
 	const events = [];
@@ -264,7 +371,7 @@ function collectScopeEvents(command, cwd, home) {
 		const [name, ...args] = splitCommandWords(segment.text);
 		if (name === "cd") directory = hasPipe ? null : resolvePath(directory, args[0] ?? home, home);
 		else if (name === "git" && directory !== null) events.push(...collectGitEvents(args, directory, home));
-		else if (name === "gh" && directory !== null && args[0] === "pr" && args[1] === "create") events.push({
+		else if (name === "gh" && directory !== null && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null) events.push({
 			kind: "pull-request",
 			directory,
 			head: findOptionValue(args, ["--head", "-H"])
@@ -272,15 +379,6 @@ function collectScopeEvents(command, cwd, home) {
 	}
 	return events;
 }
-const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"-c",
-	"-C",
-	"--create",
-	"--force-create"
-]);
-const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
 function collectGitEvents(args, cwd, home) {
 	let directory = cwd;
 	let index = 0;
@@ -288,34 +386,33 @@ function collectGitEvents(args, cwd, home) {
 		if (args[index] === "-C") directory = resolvePath(directory, args[index + 1] ?? "", home);
 		index += args[index] === "-C" || args[index] === "-c" ? 2 : 1;
 	}
-	const subcommand = args[index];
-	const rest = args.slice(index + 1);
-	if (directory === null) return [];
-	if (subcommand === "worktree" && rest[0] === "add") {
-		const path = findWorktreePath(rest.slice(1));
-		const resolved = path === null ? null : resolvePath(directory, path, home);
-		return resolved === null ? [] : [{
-			kind: "worktree",
-			path: resolved
-		}];
-	}
-	if (subcommand === "checkout" || subcommand === "switch") {
-		const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
-		return name === null ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
-	}
-	if (subcommand === "branch" && !rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) {
-		const name = rest.find((word) => !word.startsWith("-"));
-		return name === void 0 || isUnresolved(name) ? [] : [{
-			kind: "branch",
-			name,
-			directory
-		}];
+	const found = findScopeCommand(SCOPE_COMMANDS.git, args.slice(index));
+	if (directory === null || found === null) return [];
+	return GIT_EVENT_COLLECTORS[found.command](found.rest, directory, home);
+}
+function findScopeCommand(commands, args) {
+	for (const command of commands) {
+		const words = command.split(" ");
+		if (words.every((word, index) => args[index] === word)) return {
+			command,
+			rest: args.slice(words.length)
+		};
 	}
-	return [];
+	return null;
+}
+const GIT_EVENT_COLLECTORS = {
+	"worktree add": collectWorktreeEvents,
+	checkout: collectSwitchEvents,
+	switch: collectSwitchEvents,
+	branch: collectBranchEvents
+};
+function collectWorktreeEvents(rest, directory, home) {
+	const path = findWorktreePath(rest);
+	const resolved = path === null ? null : resolvePath(directory, path, home);
+	return resolved === null ? [] : [{
+		kind: "worktree",
+		path: resolved
+	}];
 }
 const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"-b",
@@ -330,6 +427,32 @@ function findWorktreePath(args) {
 	}
 	return null;
 }
+const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-B",
+	"-c",
+	"-C",
+	"--create",
+	"--force-create"
+]);
+const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
+function collectSwitchEvents(rest, directory) {
+	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
+	return name === null ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
+function collectBranchEvents(rest, directory) {
+	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
+	const name = rest.find((word) => !word.startsWith("-"));
+	return name === void 0 || isUnresolved(name) ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
 function findOptionValue(args, options) {
 	const index = args.findIndex((word) => options.includes(word));
 	const value = index === -1 ? void 0 : args[index + 1];
@@ -617,8 +740,20 @@ async function run(io, explain, localOnly, jevOnly, deadline) {
 				session: plan.state.session
 			},
 			escalation: plan.escalation,
-			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics }
+			...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics },
+			...outcome.judge === void 0 ? {} : { judge: outcome.judge }
 		}, host, io.stderr);
+		if (config.capture?.enabled === true) {
+			const captured = await tryWriteRequestCapture(resolveCaptureDir(config.capture, host), {
+				schemaVersion: 1,
+				time: (/* @__PURE__ */ new Date()).toISOString(),
+				request: toModRequest(request),
+				verdict: plan.verdict,
+				decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
+				escalation: plan.escalation
+			});
+			printCaptureNote(io.stderr, captured);
+		}
 		const note = plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note;
 		return printNote(io.stderr, explain || outcome.unavailable === true, note);
 	} finally {
@@ -642,6 +777,10 @@ async function tryWriteDenialState(stderr, path, state) {
 function printVerdict(stdout, verdict) {
 	stdout.write(renderVerdict(verdict));
 }
+function printCaptureNote(stderr, captured) {
+	if (captured.kind === "refused") stderr.write(`auto-mode: capture skipped: ${captured.reason}\n`);
+	if (captured.kind === "failed") stderr.write("auto-mode: capture unavailable\n");
+}
 async function runRecord(io) {
 	const raw = await io.stdin();
 	let body;

package/dist/index.d.ts

@@ -1,29 +1,48 @@
-//#region src/request/types.d.ts
+//#region mods/auto-mode/contract/message-origins.d.ts
+declare const MESSAGE_ORIGINS: readonly ['composer', 'bridge', 'sdk'];
+//#endregion
+//#region mods/auto-mode/contract/types.d.ts
+type MessageOrigin = (typeof MESSAGE_ORIGINS)[number];
 interface UserTask {
   readonly text: string;
-  readonly origin: 'composer' | 'bridge' | 'sdk';
+  readonly origin: MessageOrigin;
 }
-interface DecisionContext {
+interface DirectUserMessage extends UserTask {
+  readonly freshness?: 'stale' | undefined;
+}
+interface DelegatedTask {
+  readonly text: string;
+  readonly origin: 'agent.spawn';
+}
+interface TaskOmission {
+  readonly field: 'originalUserTask' | 'delegatedTask';
+  readonly reason: 'unavailable' | 'budget';
+}
+interface ModContext {
   readonly agentID: string | null;
   readonly originalUserTask: UserTask | null;
-  readonly delegatedTask: {
-    readonly text: string;
-    readonly origin: 'agent.spawn';
-  } | null;
-  readonly lastDirectUserMessage: UserTask | null;
-  readonly omittedTaskContext: readonly {
-    readonly field: 'originalUserTask' | 'delegatedTask';
-    readonly reason: 'unavailable' | 'budget';
-  }[];
+  readonly delegatedTask: DelegatedTask | null;
+  readonly lastDirectUserMessage: DirectUserMessage | null;
+  readonly omittedTaskContext: TaskOmission[];
 }
-interface ActionRequest {
+interface ModRequest {
   readonly sessionID: string;
   readonly toolUseID?: string | undefined;
   readonly cwd: string;
   readonly toolName: string;
   readonly toolInput: Readonly<Record<string, unknown>>;
-  readonly decisionContext?: DecisionContext | undefined;
+  readonly context: ModContext;
 }
+//#endregion
+//#region src/request/types.d.ts
+type DeepReadonly<T> = T extends readonly (infer Item)[] ? readonly DeepReadonly<Item>[] : T extends object ? { readonly [Key in keyof T]: DeepReadonly<T[Key]>; } : T;
+type DecisionContext = DeepReadonly<ModContext>;
+type ActionRequest = DeepReadonly<Omit<ModRequest, 'context'>> & {
+  readonly decisionContext?: DecisionContext | undefined;
+};
+type ParsedActionRequest = ActionRequest & {
+  readonly decisionContext: DecisionContext;
+};
 type Verdict = {
   readonly kind: 'allow';
 } | {
@@ -205,12 +224,27 @@ interface DenialBudget {
   readonly perSession: number;
 }
 //#endregion
+//#region src/judge/types.d.ts
+type OverturnBasis = 'consent' | 'misread';
+type JudgeOverturns = 'consent' | 'any';
+type JudgeStatus = 'confirmed' | 'overturned' | 'held' | 'failed';
+type JudgeFailure = 'credential' | 'policy' | 'request' | 'timeout' | 'unreadable';
+interface JudgeDiagnostics {
+  readonly status: JudgeStatus;
+  readonly failureReason: JudgeFailure | null;
+  readonly overturnBasis: OverturnBasis | null;
+  readonly model: string;
+  readonly rule: string;
+  readonly tier: 'hard' | 'soft';
+  readonly elapsedMs: number;
+}
+//#endregion
 //#region src/config/presets.d.ts
 export declare const PRESETS: Readonly<Record<string, ProviderConfig>>;
 //#endregion
 //#region src/config/config.d.ts
 interface ProviderConfig {
-  readonly protocol?: 'messages' | 'system-one';
+  readonly protocol?: 'messages' | 'system-one' | 'claude-code';
   readonly baseURL: string;
   readonly model: string;
   readonly apiKeyEnv?: string | undefined;
@@ -225,9 +259,14 @@ interface ScopeSource {
 }
 type ScopeSourceKind = (typeof SCOPE_SOURCE_KINDS)[number];
 declare const SCOPE_SOURCE_KINDS: readonly ['cwd', 'session', 'globs', 'atc'];
+interface CaptureConfig {
+  readonly enabled: boolean;
+  readonly dir?: string | undefined;
+}
 interface Config {
   readonly provider: ProviderConfig;
   readonly judge?: ProviderConfig | null;
+  readonly judgeOverturns?: JudgeOverturns;
   readonly scopeSources?: Readonly<Record<string, ScopeSource>>;
   readonly classifierPath?: string | undefined;
   readonly rulesPath?: string | undefined;
@@ -235,6 +274,7 @@ interface Config {
   readonly claudeSettingsPath?: string | null | undefined;
   readonly blockThreshold?: number | undefined;
   readonly denialBudget?: DenialBudget;
+  readonly capture?: CaptureConfig;
   readonly warnings?: readonly string[];
 }
 export declare const DEFAULT_CONFIG: Config;
@@ -243,7 +283,7 @@ export declare function loadConfig(configPath?: string, host?: Readonly<HostEnvi
 export declare function resolveApiKey(provider: ProviderConfig, options?: EvaluationOptions): Promise<string | null>;
 //#endregion
 //#region src/classify-action.d.ts
-type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'messages' | 'retry';
+type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'judge' | 'messages' | 'retry';
 interface ActionOutcome {
   readonly verdict: Verdict | null;
   readonly decidingStage: DecidingStage;
@@ -251,6 +291,7 @@ interface ActionOutcome {
   readonly status: 'allow' | 'skipped' | 'failure' | DecisionDiagnostics['status'];
   readonly unavailable?: boolean;
   readonly diagnostics?: DecisionDiagnostics;
+  readonly judge?: JudgeDiagnostics;
 }
 interface ClassifyOptions extends EvaluationOptions {
   readonly localOnly?: boolean;
@@ -272,12 +313,27 @@ export declare function checkContainment(request: Readonly<ActionRequest>, scope
 //#region src/model/build-decision-request.d.ts
 export declare function buildDecisionRequest(payload: ActionRequest, policy: string, configuredRules: ClaudeRules, lastUserMessage: string | null, rulesSource?: 'shipped' | 'replacement', repositoryContext?: RepositoryContext | null, mcpServers?: readonly MCPServerFact[]): DecisionRequest;
 //#endregion
+//#region src/policy/build-deny-reason.d.ts
+type DenyBasis = 'matched' | 'unresolved';
+//#endregion
+//#region src/model/find-denied-rule.d.ts
+interface DeniedRule {
+  readonly rule: DecisionRule;
+  readonly basis: DenyBasis;
+}
+//#endregion
+//#region src/judge/classify-with-judge.d.ts
+interface JudgeEvidence extends DeniedRule {
+  readonly repositoryContext: RepositoryContext | null;
+}
+//#endregion
 //#region src/model/classify-with-model.d.ts
 interface ModelOutcome {
   readonly verdict: Verdict | null;
   readonly note: string;
   readonly unavailable?: boolean;
   readonly diagnostics?: DecisionDiagnostics;
+  readonly review?: JudgeEvidence;
 }
 export declare function classifyWithModel(payload: ActionRequest, config: Config, options?: EvaluationOptions): Promise<ModelOutcome>;
 //#endregion
@@ -306,10 +362,10 @@ interface PolicyPaths {
   readonly classifierPath?: string | undefined;
   readonly rulesPath?: string | undefined;
 }
-export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md'): Promise<string>;
+export declare function loadPolicy(paths?: PolicyPaths, framework?: 'classifier.md' | 'decision.md' | 'judge.md'): Promise<string>;
 //#endregion
 //#region src/request/parse-action-request.d.ts
-export declare function parseActionRequest(body: unknown): ActionRequest | null;
+export declare function parseActionRequest(body: unknown): ParsedActionRequest | null;
 //#endregion
 //#region src/request/render-verdict.d.ts
 export declare function renderVerdict(verdict: Verdict): string;

package/dist/index.js

@@ -1,4 +1,4 @@
-import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-u3_ftSEp.js";
+import { A as resolveConfigPath, M as PRESETS, O as loadConfig, S as tryClassifyEdit, T as DEFAULT_CONFIG, _ as checkContainment, c as classifyLocally, d as sendDecision, g as loadPolicy, h as buildDecisionRequest, k as resolveApiKey, l as classifyWithModel, m as DecisionRequestError, n as parseActionRequest, r as classifyAction, s as buildTaskScope, t as renderVerdict, u as parseModelVerdict, x as loadClaudeSettings } from "./render-verdict-lM31QV2u.js";
 //#region src/config/load-claude-rules.ts
 async function loadClaudeRules(path, host) {
 	return (await loadClaudeSettings(path, host)).rules;