auto-mode 0.19.0 → 0.19.2

package/dist/{render-verdict-CcVLBFKT.js → render-verdict-DBcgB5CC.js}

@@ -1,10 +1,11 @@
 import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
-import { lstat, readFile, realpath, stat } from "node:fs/promises";
+import { appendFile, lstat, mkdir, open, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
+import { createHash, randomUUID } from "node:crypto";
+import { setTimeout } from "node:timers/promises";
 import { existsSync } from "node:fs";
-import { createHash } from "node:crypto";
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5529,6 +5530,24 @@ function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
 //#endregion
+//#region src/state/resolve-xdg-dir.ts
+const BASE_DIRS = {
+	config: {
+		variable: "XDG_CONFIG_HOME",
+		fallback: [".config"]
+	},
+	state: {
+		variable: "XDG_STATE_HOME",
+		fallback: [".local", "state"]
+	}
+};
+function resolveXDGDir(host, kind) {
+	const dir = BASE_DIRS[kind];
+	const base = host.env[dir.variable];
+	const root = base === void 0 || base === "" ? join(host.home, ...dir.fallback) : base;
+	return join(root, "auto-mode");
+}
+//#endregion
 //#region src/config/presets.ts
 const MESSAGES_DEFAULTS = {
 	protocol: "messages",
@@ -5580,40 +5599,36 @@ function findPreset(id) {
 	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
 }
 //#endregion
-//#region src/config/to-timer-delay.ts
-function toTimerDelay(ms) {
-	return Math.max(1, Math.ceil(ms));
-}
-//#endregion
-//#region src/config/read-api-key-from-command.ts
-function readApiKeyFromCommand(command, options = {}) {
-	const now = options.now ?? Date.now;
-	const remainingMs = options.deadlineAt === void 0 ? 5e3 : options.deadlineAt - now();
-	if (remainingMs <= 0 || options.signal?.aborted === true) return Promise.resolve(null);
+//#region src/process/run-capped.ts
+function runCapped(file, args, options) {
 	return new Promise((resolve) => {
 		const grouped = process.platform !== "win32";
-		const child = spawn("/bin/sh", ["-c", command], {
+		const child = spawn(file, args, {
 			detached: grouped,
 			stdio: [
-				"ignore",
+				options.input === void 0 ? "ignore" : "pipe",
 				"pipe",
 				"ignore"
 			],
-			...options.host === void 0 ? {} : { env: {
-				HOME: options.host.home,
-				...options.host.env
-			} }
+			...options.cwd === void 0 ? {} : { cwd: options.cwd },
+			...options.env === void 0 ? {} : { env: options.env }
 		});
-		let output = "";
+		const chunks = [];
+		let size = 0;
 		let settled = false;
 		let stopped = false;
-		const setResult = (value) => {
-			if (!settled) {
-				settled = true;
-				timer.removeEventListener("abort", stopChild);
-				options.signal?.removeEventListener("abort", stopChild);
-				resolve(value);
-			}
+		let exited;
+		const setResult = (exitCode, failedToStart) => {
+			if (settled) return;
+			settled = true;
+			options.signal.removeEventListener("abort", stopChild);
+			if (stopped) child.stdout?.destroy();
+			resolve({
+				exitCode,
+				stdout: stopped || failedToStart ? "" : Buffer.concat(chunks).toString("utf8"),
+				stopped,
+				failedToStart
+			});
 		};
 		const stopChild = () => {
 			if (stopped) return;
@@ -5624,28 +5639,57 @@ function readApiKeyFromCommand(command, options = {}) {
 			} catch {
 				child.kill("SIGKILL");
 			}
+			if (exited !== void 0) setResult(exited, false);
 		};
-		const timer = (options.timeout ?? ((ms) => AbortSignal.timeout(ms)))(toTimerDelay(Math.min(5e3, remainingMs)));
-		timer.addEventListener("abort", stopChild, { once: true });
-		options.signal?.addEventListener("abort", stopChild, { once: true });
-		if (timer.aborted) stopChild();
-		child.stdout.setEncoding("utf8");
-		child.stdout.on("data", (chunk) => {
+		options.signal.addEventListener("abort", stopChild, { once: true });
+		if (options.signal.aborted) stopChild();
+		child.stdout?.on("data", (chunk) => {
 			if (stopped) return;
-			output += chunk;
-			if (output.length > 65536) stopChild();
+			chunks.push(chunk);
+			size += chunk.length;
+			if (size > options.maxOutputBytes) stopChild();
 		});
+		child.stdin?.on("error", () => {});
+		child.stdin?.end(options.input);
 		child.on("error", () => {
-			setResult(null);
+			setResult(null, !stopped);
+		});
+		child.on("exit", (code) => {
+			exited = code;
+			if (stopped) setResult(code, false);
 		});
 		child.on("close", (code) => {
-			const key = !stopped && code === 0 && output.trim() !== "" ? output.trim() : null;
-			setResult(key);
+			setResult(code, false);
 		});
 	});
 }
 //#endregion
-//#region src/containment/scratch-paths.ts
+//#region src/config/to-timer-delay.ts
+function toTimerDelay(ms) {
+	return Math.max(1, Math.ceil(ms));
+}
+//#endregion
+//#region src/config/read-api-key-from-command.ts
+const KEY_COMMAND_TIMEOUT_MS = 5e3;
+const MAX_KEY_OUTPUT_BYTES = 65536;
+async function readApiKeyFromCommand(command, options = {}) {
+	const now = options.now ?? Date.now;
+	const remainingMs = options.deadlineAt === void 0 ? KEY_COMMAND_TIMEOUT_MS : options.deadlineAt - now();
+	if (remainingMs <= 0 || options.signal?.aborted === true) return null;
+	const timer = (options.timeout ?? ((ms) => AbortSignal.timeout(ms)))(toTimerDelay(Math.min(KEY_COMMAND_TIMEOUT_MS, remainingMs)));
+	const result = await runCapped("/bin/sh", ["-c", command], {
+		signal: options.signal === void 0 ? timer : AbortSignal.any([timer, options.signal]),
+		maxOutputBytes: MAX_KEY_OUTPUT_BYTES,
+		env: options.host === void 0 ? void 0 : {
+			HOME: options.host.home,
+			...options.host.env
+		}
+	});
+	const key = result.stdout.trim();
+	return !result.stopped && result.exitCode === 0 && key !== "" ? key : null;
+}
+//#endregion
+//#region src/config/scratch-paths.ts
 const SCRATCH_PATHS = [
 	"/tmp",
 	"/dev/null",
@@ -5691,9 +5735,7 @@ const DEFAULT_CONFIG = {
 	scopeSources: DEFAULT_SCOPE_SOURCES
 };
 function resolveConfigPath(host = readHostEnvironment()) {
-	const xdg = host.env["XDG_CONFIG_HOME"];
-	const base = xdg !== void 0 && xdg !== "" ? xdg : join(host.home, ".config");
-	return join(base, "auto-mode", "config.json");
+	return join(resolveXDGDir(host, "config"), "config.json");
 }
 async function loadConfig(configPath, host = readHostEnvironment()) {
 	const path = configPath ?? resolveConfigPath(host);
@@ -5884,26 +5926,44 @@ function resolveApiKey(provider, options = {}) {
 	});
 }
 //#endregion
-//#region src/scope/find-checkout.ts
+//#region src/git/find-git-entry.ts
+async function findGitEntry(start, stopDir = parse(start).root) {
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		if (await hasEntry(gitPath)) return {
+			directory,
+			gitPath
+		};
+		if (dirname(directory) === directory || directory === stopDir) return null;
+	}
+}
+const ABSENT_CODES = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+async function hasEntry(path) {
+	try {
+		await lstat(path);
+		return true;
+	} catch (error) {
+		return !(error instanceof Error && "code" in error && ABSENT_CODES.has(String(error.code)));
+	}
+}
+//#endregion
+//#region src/git/find-checkout.ts
 const GIT_OVERRIDES$1 = [
 	"GIT_DIR",
 	"GIT_WORK_TREE",
 	"GIT_COMMON_DIR"
 ];
-async function findCheckout(start, env, stopDir = parse(start).root) {
+async function findCheckout(start, env, stopDir) {
 	if (GIT_OVERRIDES$1.some((name) => env[name] !== void 0)) return null;
-	for (let directory = start;; directory = dirname(directory)) {
-		const gitPath = join(directory, ".git");
-		const info = await stat(gitPath).catch(() => null);
-		if (info !== null) {
-			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
-			return gitDir === null ? null : {
-				worktree: directory,
-				commonDir: await findCommonDir(gitDir)
-			};
-		}
-		if (dirname(directory) === directory || directory === stopDir) return null;
-	}
+	const entry = await findGitEntry(start, stopDir);
+	const info = entry === null ? null : await stat(entry.gitPath).catch(() => null);
+	if (entry === null || info === null) return null;
+	const gitDir = info.isDirectory() ? entry.gitPath : await findLinkedGitDir(entry.directory, entry.gitPath);
+	return gitDir === null ? null : {
+		worktree: entry.directory,
+		gitDir,
+		commonDir: await findCommonDir(gitDir)
+	};
 }
 async function findLinkedGitDir(directory, gitPath) {
 	const link = await readFile(gitPath, "utf8").catch(() => "");
@@ -5915,13 +5975,6 @@ async function findCommonDir(gitDir) {
 	return common === null ? gitDir : resolve(gitDir, common.trim());
 }
 //#endregion
-//#region src/state/resolve-state-dir.ts
-function resolveStateDir(host) {
-	const stateHome = host.env["XDG_STATE_HOME"];
-	const base = stateHome === void 0 || stateHome === "" ? join(host.home, ".local", "state") : stateHome;
-	return join(base, "auto-mode");
-}
-//#endregion
 //#region src/bypass/resolve-edit-target.ts
 async function resolveEditTarget(path) {
 	const missing = [];
@@ -5945,12 +5998,16 @@ const GIT_OVERRIDES = [
 	"GIT_WORK_TREE",
 	"GIT_COMMON_DIR"
 ];
-async function tryClassifyEdit(request, scope, host, files = DISK_EDIT_FILE_READER) {
+async function tryClassifyEdit(request, scope, host, reader = {}) {
+	const files = {
+		...DISK_EDIT_FILE_READER,
+		...reader
+	};
 	const fields = getEditFields(request.toolName);
 	const path = fields === null ? void 0 : request.toolInput[fields.path];
 	if (typeof path !== "string" || path === "") return null;
 	try {
-		const ownDirs = [dirname(resolveConfigPath(host)), resolveStateDir(host)];
+		const ownDirs = [dirname(resolveConfigPath(host)), resolveXDGDir(host, "state")];
 		const requested = resolve(request.cwd, path);
 		const [target, worktrees, protectedDirs] = await Promise.all([
 			files.resolveEditTarget(requested),
@@ -5975,11 +6032,192 @@ async function tryClassifyEdit(request, scope, host, files = DISK_EDIT_FILE_READ
 	}
 }
 //#endregion
+//#region src/budget/build-retry-key.ts
+const DESCRIPTIVE_FIELDS = { Bash: [
+	"description",
+	"timeout",
+	"run_in_background"
+] };
+function buildRetryKey(request) {
+	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
+	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const message = request.decisionContext?.lastDirectUserMessage ?? null;
+	const canonical = JSON.stringify(sortKeys({
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: input,
+		lastDirectUserMessage: message?.text ?? null,
+		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
+	}));
+	return createHash("sha256").update(canonical).digest("hex");
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
+	return value;
+}
+//#endregion
+//#region src/budget/find-retry-deny.ts
+function findRetryDeny(state, retryKey) {
+	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
+	return {
+		kind: "deny",
+		rule: state.lastDenied.rule,
+		reason: state.lastDenied.reason
+	};
+}
+//#endregion
+//#region src/state/load-json-file.ts
+async function loadJSONFile(path, schema, fallback) {
+	try {
+		const text = await readFile(path, "utf8");
+		const parsed = schema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : fallback;
+	} catch {
+		return fallback;
+	}
+}
+//#endregion
+//#region src/budget/types.ts
+const EMPTY_DENIAL_STATE = {
+	consecutive: 0,
+	session: 0,
+	lastDenied: null
+};
+//#endregion
+//#region src/budget/load-denial-state.ts
+const count = number().int().nonnegative();
+const stateSchema$1 = strictObject({
+	consecutive: count,
+	session: count,
+	lastDenied: strictObject({
+		retryKey: string().min(1),
+		rule: string(),
+		reason: string()
+	}).nullable()
+});
+function loadDenialState(path) {
+	return loadJSONFile(path, stateSchema$1, EMPTY_DENIAL_STATE);
+}
+//#endregion
+//#region src/budget/plan-denial-budget.ts
+function planDenialBudget(state, verdict, retryKey, budget) {
+	if (verdict === null) return {
+		verdict: null,
+		state,
+		escalation: false
+	};
+	if (verdict.kind === "allow") return {
+		verdict,
+		state: {
+			...state,
+			consecutive: 0,
+			lastDenied: null
+		},
+		escalation: false
+	};
+	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
+		verdict: null,
+		state: EMPTY_DENIAL_STATE,
+		escalation: true
+	};
+	const next = {
+		consecutive: state.consecutive + 1,
+		session: state.session + 1,
+		lastDenied: {
+			retryKey,
+			rule: verdict.rule,
+			reason: verdict.reason
+		}
+	};
+	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
+	return {
+		verdict: {
+			...verdict,
+			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
+		},
+		state: next,
+		escalation: false
+	};
+}
+function formatDenialsLeft(left) {
+	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
+	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
+}
+//#endregion
+//#region src/budget/resolve-denial-state-path.ts
+function resolveDenialStatePath(request, stateDir) {
+	const agentID = request.decisionContext?.agentID ?? "";
+	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
+	return join(stateDir, "denials", `${key}.json`);
+}
+//#endregion
+//#region src/state/update-json-file.ts
+const SYSTEM_CLOCK = {
+	now: Date.now,
+	wait: (ms) => setTimeout(ms)
+};
+async function updateJSONFile(path, load, update, clock = SYSTEM_CLOCK) {
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const lock = `${path}.lock`;
+	await claimLock(lock, clock);
+	try {
+		const previous = await load(path);
+		const next = update(previous);
+		if (next !== previous) {
+			const staged = `${path}.${randomUUID()}.tmp`;
+			await writeFile(staged, `${JSON.stringify(next)}\n`, { mode: 384 });
+			await rename(staged, path);
+		}
+		return {
+			previous,
+			next
+		};
+	} finally {
+		await rm(lock, { force: true });
+	}
+}
+const STALE_LOCK_MS = 1e4;
+const LOCK_WAIT_MS = 3e3;
+const LOCK_POLL_MS = 10;
+async function claimLock(lock, clock) {
+	const deadline = clock.now() + LOCK_WAIT_MS;
+	for (;;) {
+		try {
+			await (await open(lock, "wx", 384)).close();
+			return;
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+		}
+		const held = await stat(lock).catch(() => null);
+		if (held !== null && clock.now() - held.mtimeMs > STALE_LOCK_MS) await rm(lock, { force: true });
+		else if (clock.now() > deadline) throw new Error("state file lock unavailable");
+		else await clock.wait(LOCK_POLL_MS);
+	}
+}
+//#endregion
+//#region src/budget/update-denial-state.ts
+function updateDenialState(path, update, clock) {
+	return updateJSONFile(path, loadDenialState, update, clock);
+}
+//#endregion
+//#region src/config/resolve-claude-config-path.ts
+const DEFAULT_DIRS = {
+	"settings.json": [".claude"],
+	".claude.json": []
+};
+function resolveClaudeConfigPath(host, file) {
+	const configDir = host.env["CLAUDE_CONFIG_DIR"];
+	const dir = configDir === void 0 || configDir === "" ? join(host.home, ...DEFAULT_DIRS[file]) : configDir;
+	return join(dir, file);
+}
+//#endregion
 //#region src/config/load-claude-settings.ts
 async function loadClaudeSettings(path, host) {
-	const configDir = host.env["CLAUDE_CONFIG_DIR"];
-	const base = configDir === void 0 || configDir === "" ? join(host.home, ".claude") : configDir;
-	const userPath = join(base, "settings.json");
+	const userPath = resolveClaudeConfigPath(host, "settings.json");
 	if (path === void 0) {
 		const body = await readSettings(userPath);
 		return {
@@ -6032,108 +6270,259 @@ function parseRules(body) {
 	};
 }
 //#endregion
-//#region src/rules/split-command-words.ts
-function splitCommandWords(text) {
-	const words = splitWords$1(text);
+//#region src/git/to-repository-slug.ts
+function toRepositorySlug(reference) {
+	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
+	if (match?.groups === void 0) return null;
+	const parts = match.groups;
+	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
+}
+//#endregion
+//#region src/shell/is-unresolved-word.ts
+function isUnresolvedWord(word) {
+	return /[$`]/u.test(word);
+}
+//#endregion
+//#region src/shell/resolve-shell-path.ts
+function resolveShellPath(directory, path, home) {
+	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
+	if (isUnresolvedWord(expanded) || expanded.startsWith("~") || expanded === "") return null;
+	if (directory === null && !isAbsolute(expanded)) return null;
+	const absolute = isAbsolute(expanded) || directory === null ? expanded : join(directory, expanded);
+	return normalize(absolute).replace(/(?<=.)\/$/u, "");
+}
+//#endregion
+//#region src/shell/split-shell-tokens.ts
+function splitShellTokens(text) {
+	const tokens = [];
+	let hasSubstitution = false;
 	let index = 0;
-	while (index < words.length) {
-		const word = words[index] ?? "";
-		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
-		else if (word === "env") {
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (/\s/u.test(ch) && ch !== "\n") {
 			index += 1;
-			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
-		} else if (word === "timeout") index += 2;
-		else break;
+			continue;
+		}
+		const separator = findOperator(SEPARATORS, text, index);
+		if (separator !== void 0 && !text.startsWith("&>", index)) {
+			tokens.push({
+				kind: "separator",
+				operator: separator,
+				start: index,
+				end: index + separator.length
+			});
+			index += separator.length;
+			continue;
+		}
+		const word = readWord(text, index);
+		hasSubstitution ||= word.hasSubstitution;
+		const operator = findOperator(REDIRECTS, text, word.end);
+		const isDescriptor = operator !== void 0 && /^\d+$/u.test(word.raw);
+		if (word.raw !== "" && !isDescriptor) {
+			if (word.isUnterminated) return {
+				tokens: [...tokens, buildWordToken(word, index)],
+				hasSubstitution,
+				isUnterminated: true
+			};
+			tokens.push(buildWordToken(word, index));
+			index = word.end;
+			continue;
+		}
+		if (operator === void 0) {
+			index += 1;
+			continue;
+		}
+		const redirect = readRedirect(text, word.end, operator);
+		hasSubstitution ||= redirect.hasSubstitution;
+		tokens.push({
+			kind: "redirect",
+			operator: `${word.raw}${operator}`,
+			target: redirect.target,
+			start: index,
+			end: redirect.end
+		});
+		if (redirect.isUnterminated) return {
+			tokens,
+			hasSubstitution,
+			isUnterminated: true
+		};
+		index = redirect.end;
 	}
-	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
+	return {
+		tokens,
+		hasSubstitution,
+		isUnterminated: false
+	};
+}
+const SEPARATORS = [
+	"&&",
+	"||",
+	";",
+	"|",
+	"&",
+	"\n"
+];
+const REDIRECTS = [
+	"&>>",
+	"&>",
+	"<<<",
+	"<<-",
+	"<<",
+	"<&",
+	"<>",
+	"<(",
+	"<",
+	">>",
+	">|",
+	">&",
+	">(",
+	">"
+];
+function findOperator(operators, text, index) {
+	return operators.find((operator) => text.startsWith(operator, index));
 }
-function splitWords$1(text) {
-	const words = [];
-	let current = "";
-	let quote = null;
-	let started = false;
-	for (const ch of text) if (quote !== null) {
-		if (ch === quote) quote = null;
-		else current += ch;
-	} else if (ch === "'" || ch === "\"") {
-		quote = ch;
-		started = true;
-	} else if (/\s/u.test(ch)) {
-		if (started) words.push(current);
-		current = "";
-		started = false;
-	} else {
-		current += ch;
-		started = true;
-	}
-	if (started) words.push(current);
-	return words;
+function buildWordToken(word, start) {
+	return {
+		kind: "word",
+		value: word.value,
+		raw: word.raw,
+		start,
+		end: word.end
+	};
 }
-//#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
+function readWord(text, start) {
+	let value = "";
 	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
-	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
+	let hasSubstitution = false;
+	let parenAt = null;
+	let index = start;
+	while (index < text.length) {
+		const ch = text.charAt(index);
 		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (quote === "\"" && (text.startsWith("$(", index) || ch === "`")) hasSubstitution = true;
 			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
+			else value += ch;
+			index += 1;
 			continue;
 		}
 		if (ch === "'" || ch === "\"") {
 			quote = ch;
-			current += ch;
-			i += 1;
+			index += 1;
 			continue;
 		}
 		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
+			value += text.slice(index, index + 2);
+			index += 2;
 			continue;
 		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			collectSegment();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			collectSegment();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
+		if (/\s/u.test(ch) || /[;&|<>]/u.test(ch)) break;
+		if (text.startsWith("$(", index) || ch === "`") hasSubstitution = true;
+		if ((ch === "(" || ch === ")") && parenAt === null) parenAt = value.length;
+		value += ch;
+		index += 1;
+	}
+	return {
+		value,
+		raw: text.slice(start, Math.min(index, text.length)),
+		end: Math.min(index, text.length),
+		parenAt,
+		hasSubstitution,
+		isUnterminated: quote !== null
+	};
+}
+function readRedirect(text, start, operator) {
+	let index = start + operator.length;
+	while (index < text.length && /\s/u.test(text.charAt(index)) && text.charAt(index) !== "\n") index += 1;
+	const word = readWord(text, index);
+	const isProcess = operator.endsWith("(");
+	if (word.raw === "") return {
+		target: null,
+		end: index,
+		hasSubstitution: isProcess,
+		isUnterminated: false
+	};
+	return {
+		target: word.parenAt === null ? word.value : word.value.slice(0, word.parenAt),
+		end: word.end,
+		hasSubstitution: isProcess || word.hasSubstitution,
+		isUnterminated: word.isUnterminated
+	};
+}
+//#endregion
+//#region src/shell/split-command-words.ts
+function splitCommandWords(text) {
+	const words = splitShellTokens(text).tokens.flatMap((token) => token.kind === "word" ? [token.value] : []);
+	let index = 0;
+	while (index < words.length) {
+		const word = words[index] ?? "";
+		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
+		else if (word === "env") {
+			index += 1;
+			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
+		} else if (word === "timeout") index += 2;
+		else break;
+	}
+	return words.slice(index);
+}
+//#endregion
+//#region src/shell/split-shell-command.ts
+function splitShellCommand(command) {
+	const scanned = splitShellTokens(command);
+	const segments = [];
+	let start = null;
+	let end = 0;
+	for (const token of [...scanned.tokens, null]) if (token === null || token.kind === "separator") {
+		if (start !== null) segments.push({ text: command.slice(start, end) });
+		start = null;
+	} else {
+		start ??= token.start;
+		end = token.end;
 	}
-	collectSegment();
 	return {
 		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
+		hasUnparsedConstruct: scanned.hasSubstitution || scanned.isUnterminated || scanned.tokens.some((token) => token.kind === "redirect" && token.operator.includes(">"))
 	};
 }
 //#endregion
-//#region src/containment/to-repository-slug.ts
-function toRepositorySlug(reference) {
-	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
-	if (match?.groups === void 0) return null;
-	const parts = match.groups;
-	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
+//#region src/shell/collect-shell-commands.ts
+function collectShellCommands(command, cwd, home) {
+	const hasPipe = splitShellTokens(command).tokens.some((token) => token.kind === "separator" && token.operator === "|");
+	let directory = cwd;
+	return splitShellCommand(command).segments.map((segment) => {
+		const words = splitCommandWords(segment.text);
+		const entry = {
+			words,
+			directory,
+			writeTargets: collectWriteTargets(segment.text)
+		};
+		if (words[0] === "cd") directory = hasPipe ? null : resolveShellPath(directory, words[1] ?? home, home);
+		return entry;
+	});
+}
+const WRITE_REDIRECTS = /* @__PURE__ */ new Set([
+	">",
+	">>",
+	">|",
+	"&>",
+	"&>>"
+]);
+function collectWriteTargets(text) {
+	return splitShellTokens(text).tokens.flatMap((token) => token.kind === "redirect" && token.target !== null && token.target !== "" && WRITE_REDIRECTS.has(token.operator.replace(/^\d+/u, "")) ? [token.target] : []);
+}
+//#endregion
+//#region src/shell/split-git-command.ts
+function splitGitCommand(args, directory, home) {
+	let gitDirectory = directory;
+	let index = 0;
+	while (index < args.length && args[index]?.startsWith("-") === true) {
+		const option = args[index];
+		if (option === "-C") gitDirectory = resolveShellPath(gitDirectory, args[index + 1] ?? "", home);
+		index += option === "-C" || option === "-c" ? 2 : 1;
+	}
+	return {
+		directory: gitDirectory,
+		args: args.slice(index)
+	};
 }
 //#endregion
 //#region src/containment/collect-scope-findings.ts
@@ -6154,7 +6543,7 @@ const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
 	"NotebookEdit"
 ]);
 function collectTargetFindings(directory, target, scope, scratchPaths) {
-	const path = resolvePath(directory, target, scope.home);
+	const path = resolveShellPath(directory, target, scope.home);
 	return path === null ? [] : collectPathFindings(path, scope, scratchPaths);
 }
 const CREDENTIAL_PATHS = [
@@ -6204,15 +6593,10 @@ const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
 ]);
 function collectCommandFindings(command, cwd, scope, scratchPaths) {
 	const findings = [];
-	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
-	let directory = cwd;
-	for (const segment of splitShellCommand(command).segments) {
-		const [name, ...args] = splitCommandWords(segment.text);
-		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope, scratchPaths));
-		if (name === void 0) continue;
-		if (name === "cd" && hasPipe) directory = null;
-		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
-		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope, scratchPaths));
+	for (const entry of collectShellCommands(command, cwd, scope.home)) {
+		const [name, ...args] = entry.words;
+		for (const target of entry.writeTargets) findings.push(...collectTargetFindings(entry.directory, target, scope, scratchPaths));
+		if (name !== void 0 && name !== "cd") findings.push(...collectProgramFindings(name, args, entry.directory, cwd, scope, scratchPaths));
 	}
 	return findings;
 }
@@ -6358,15 +6742,9 @@ const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
 	"push"
 ]);
 function collectGitFindings(args, directory, cwd, scope, scratchPaths) {
-	let gitDirectory = directory;
-	let index = 0;
-	while (index < args.length && args[index]?.startsWith("-") === true) {
-		const option = args[index];
-		if (option === "-C") gitDirectory = resolvePath(gitDirectory, args[index + 1] ?? "", scope.home);
-		index += option === "-C" || option === "-c" ? 2 : 1;
-	}
-	const subcommand = args[index] ?? "";
-	const rest = args.slice(index + 1);
+	const git = splitGitCommand(args, directory, scope.home);
+	const gitDirectory = git.directory;
+	const [subcommand = "", ...rest] = git.args;
 	const operands = rest.filter((word) => !word.startsWith("-"));
 	const findings = [];
 	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope, scratchPaths)) findings.push({
@@ -6396,7 +6774,7 @@ function collectPushFindings(rest, operands, currentBranch, scope) {
 		kind: "branch",
 		target: "--all"
 	});
-	if (remote !== void 0 && !isUnresolved(remote) && !isOwnedRemote(remote, scope)) findings.push({
+	if (remote !== void 0 && !isUnresolvedWord(remote) && !isOwnedRemote(remote, scope)) findings.push({
 		kind: "remote-write",
 		target: remote
 	});
@@ -6404,16 +6782,13 @@ function collectPushFindings(rest, operands, currentBranch, scope) {
 	for (const refspec of destinations) {
 		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
 		const branch = named === "HEAD" ? currentBranch : named;
-		if (branch !== null && !isUnresolved(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
+		if (branch !== null && !isUnresolvedWord(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
 			kind: "branch",
 			target: branch
 		});
 	}
 	return findings;
 }
-function isUnresolved(word) {
-	return /[$`]/u.test(word);
-}
 function isOwnedRemote(remote, scope) {
 	if (scope.remotes.some((entry) => entry.name === remote)) return true;
 	const slug = toRepositorySlug(remote);
@@ -6544,49 +6919,6 @@ function findProgramFinding(name, args) {
 	};
 	return null;
 }
-function collectRedirectTargets(text) {
-	const targets = [];
-	let quote = null;
-	let index = 0;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (quote !== null) {
-			quote = ch === quote ? null : quote;
-			index += 1;
-		} else if (ch === "'" || ch === "\"") {
-			quote = ch;
-			index += 1;
-		} else if (ch === ">" && text.charAt(index - 1) !== "<") {
-			let next = index + 1;
-			if (text.charAt(next) === ">" || text.charAt(next) === "|") next += 1;
-			if (text.charAt(next) === "&") {
-				index = next + 1;
-				continue;
-			}
-			const [target, end] = readWord(text, next);
-			if (target !== "") targets.push(target);
-			index = end;
-		} else index += 1;
-	}
-	return targets;
-}
-function readWord(text, start) {
-	let index = start;
-	while (/\s/u.test(text.charAt(index))) index += 1;
-	let word = "";
-	let quote = null;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (quote !== null) {
-			if (ch === quote) quote = null;
-			else word += ch;
-		} else if (ch === "'" || ch === "\"") quote = ch;
-		else if (/[\s;&|<>()]/u.test(ch)) break;
-		else word += ch;
-		index += 1;
-	}
-	return [word, index];
-}
 function collectInPlaceFiles(args) {
 	const files = [];
 	let skipNext = false;
@@ -6601,13 +6933,6 @@ function collectInPlaceFiles(args) {
 	}
 	return files;
 }
-function resolvePath(cwd, path, home) {
-	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
-	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
-	if (cwd === null && !isAbsolute(expanded)) return null;
-	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
-	return normalize(absolute).replace(/(?<=.)\/$/u, "");
-}
 function isInScope(path, scope, scratchPaths) {
 	if (scratchPaths.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
 	return scope.worktrees.some((worktree) => {
@@ -6652,10 +6977,116 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
-//#region mods/auto-mode/contract/find-current-direct-user-message.ts
-function findCurrentDirectUserMessage(message) {
-	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
-}
+//#region src/diagnostics/write-action-diagnostic.ts
+async function writeActionDiagnostic(payload, entry, host, warnings) {
+	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveXDGDir(host, "state"), "actions.jsonl");
+	if (path === "") return;
+	const record = {
+		schemaVersion: 4,
+		time: (/* @__PURE__ */ new Date()).toISOString(),
+		invocationID: entry.invocationID,
+		sessionHash: toHash(payload.sessionID),
+		actionHash: payload.toolUseID === void 0 ? null : toHash(payload.toolUseID),
+		status: entry.status,
+		verdict: entry.verdict ?? null,
+		decidingStage: entry.decidingStage ?? null,
+		denials: entry.denials ?? null,
+		escalation: entry.escalation ?? false,
+		diagnostics: entry.diagnostics ?? null,
+		judge: entry.judge ?? null
+	};
+	try {
+		await mkdir(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		await appendFile(path, `${JSON.stringify(record)}\n`, { mode: 384 });
+	} catch {
+		warnings.write("auto-mode: diagnostics unavailable\n");
+	}
+}
+function toHash(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+//#endregion
+//#region src/git/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const value = /^\s*(?:push)?url\s*=(?<value>.*)$/iu.exec(line)?.groups?.["value"];
+			const url = value === void 0 ? "" : parseConfigValue(value);
+			if (url !== "") remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+function parseConfigValue(raw) {
+	let value = "";
+	let isQuoted = false;
+	for (let index = 0; index < raw.length; index += 1) {
+		const char = raw[index] ?? "";
+		if (char === "\\") {
+			const next = raw[index + 1] ?? "";
+			value += {
+				n: "\n",
+				t: "	",
+				b: ""
+			}[next] ?? next;
+			index += 1;
+		} else if (char === "\"") isQuoted = !isQuoted;
+		else if (!isQuoted && (char === "#" || char === ";")) break;
+		else value += char;
+	}
+	return value.trim();
+}
+//#endregion
+//#region src/git/load-checkout-facts.ts
+async function loadCheckoutFacts(cwd, env, options = {}) {
+	const directory = resolve(cwd);
+	const stopDir = options.stopDir === void 0 ? void 0 : resolve(options.stopDir);
+	const checkout = await (options.findCheckout === void 0 ? findCheckout(directory, env, stopDir) : options.findCheckout(directory, env));
+	if (checkout === null) return {
+		cwd: directory,
+		checkout,
+		head: null,
+		remotes: []
+	};
+	const [head, originHead, remotes] = await Promise.all([
+		readFile(join(checkout.gitDir, "HEAD"), "utf8").catch(() => null),
+		readFile(join(checkout.commonDir, "refs", "remotes", "origin", "HEAD"), "utf8").catch(() => null),
+		loadCheckoutRemotes(checkout.commonDir)
+	]);
+	return {
+		cwd: directory,
+		checkout,
+		head: head === null ? null : {
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch: originHead === null ? null : parseReference(originHead, "refs/remotes/origin/")
+		},
+		remotes
+	};
+}
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+}
+//#endregion
+//#region mods/auto-mode/contract/find-current-direct-user-message.ts
+function findCurrentDirectUserMessage(message) {
+	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
+}
 //#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir(startDir = import.meta.dirname, stopDir = parse(startDir).root) {
@@ -6990,7 +7421,7 @@ const DENY_REASONS = {
 	"Default Branch Write": {
 		tier: "soft",
 		harm: "committing, pushing, or merging directly to the default branch",
-		clears: "A direct user instruction that names the branch clears it."
+		clears: "A direct user instruction that asks for this action and names its branch clears it."
 	},
 	"Publish and Release": {
 		tier: "soft",
@@ -7127,7 +7558,7 @@ function parseJudgeReply(text) {
 	};
 }
 //#endregion
-//#region src/model/anthropic-client.ts
+//#region src/messages/anthropic-client.ts
 async function sendMessage(provider, apiKey, request, signal) {
 	const response = await fetch(`${provider.baseURL.replace(/\/$/, "")}/v1/messages`, {
 		method: "POST",
@@ -7199,8 +7630,9 @@ function readResult(body) {
 }
 //#endregion
 //#region src/judge/run-claude-code.ts
+const MAX_REPLY_BYTES = 1048576;
 async function runClaudeCode(provider, request, env, signal) {
-	const child = spawn("claude", [
+	const result = await runCapped("claude", [
 		"-p",
 		"--model",
 		provider.model,
@@ -7215,29 +7647,14 @@ async function runClaudeCode(provider, request, env, signal) {
 		"--output-format",
 		"json"
 	], {
-		cwd: tmpdir(),
-		env: buildChildEnv(env),
 		signal,
-		killSignal: "SIGKILL",
-		stdio: [
-			"pipe",
-			"pipe",
-			"ignore"
-		]
-	});
-	const chunks = [];
-	child.stdout.on("data", (chunk) => {
-		chunks.push(chunk);
-	});
-	const closed = new Promise((resolve, reject) => {
-		child.once("error", reject);
-		child.once("close", resolve);
+		maxOutputBytes: MAX_REPLY_BYTES,
+		input: request.user,
+		cwd: tmpdir(),
+		env: buildChildEnv(env)
 	});
-	child.stdin.on("error", () => {});
-	child.stdin.end(request.user);
-	const exitCode = await closed;
-	const body = CLAUDE_OUTPUT.safeParse(parseOutputJSON(Buffer.concat(chunks).toString("utf8")));
-	if (exitCode !== 0 || !body.success || body.data.is_error || body.data.result === void 0) throw new Error(`claude -p failed with exit code ${String(exitCode)}`);
+	const body = CLAUDE_OUTPUT.safeParse(parseOutputJSON(result.stdout));
+	if (result.exitCode !== 0 || !body.success || body.data.is_error || body.data.result === void 0) throw new Error(`claude -p failed with exit code ${String(result.exitCode)}`);
 	return {
 		text: body.data.result,
 		model: provider.model
@@ -7346,6 +7763,116 @@ function buildTaskScopeSummary(scope) {
 	};
 }
 //#endregion
+//#region src/git/build-repository-context.ts
+function buildRepositoryContext(facts) {
+	if (facts.head === null) return null;
+	return {
+		cwd: facts.cwd,
+		branch: facts.head.branch,
+		defaultBranch: facts.head.defaultBranch,
+		remotes: facts.remotes.flatMap((remote) => {
+			const url = normalizeRemoteURL(remote.url);
+			return url === null ? [] : [{
+				name: remote.name,
+				url
+			}];
+		})
+	};
+}
+function normalizeRemoteURL(url) {
+	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
+		const parsed = URL.parse(url);
+		if (parsed === null) return null;
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return parsed.href;
+	}
+	const slash = url.indexOf("/");
+	const end = slash === -1 ? url.length : slash;
+	const at = url.lastIndexOf("@", end);
+	return at === -1 ? url : url.slice(at + 1);
+}
+//#endregion
+//#region src/git/build-repository-evidence.ts
+function buildRepositoryEvidence(facts, taskScope) {
+	const context = buildRepositoryContext(facts);
+	if (taskScope === void 0) return context;
+	return {
+		...context ?? {
+			cwd: facts.cwd,
+			branch: null,
+			defaultBranch: null
+		},
+		taskScope
+	};
+}
+//#endregion
+//#region src/git/load-mcp-servers.ts
+const serverSchema = looseObject({
+	type: string().optional(),
+	url: string().optional()
+});
+const serversSchema = record(string(), unknown()).optional();
+const approvalSchema = looseObject({
+	enableAllProjectMcpServers: boolean().optional(),
+	enabledMcpjsonServers: array(string()).optional(),
+	disabledMcpjsonServers: array(string()).optional()
+});
+const stateSchema = looseObject({
+	mcpServers: serversSchema,
+	projects: record(string(), looseObject({
+		...approvalSchema.shape,
+		mcpServers: serversSchema
+	})).optional()
+});
+const projectFileSchema = looseObject({ mcpServers: serversSchema });
+async function loadMCPServers(cwd, host, userSettings, checkoutFacts) {
+	const state = await loadJSONFile(resolveClaudeConfigPath(host, ".claude.json"), stateSchema, null);
+	const settings = approvalSchema.safeParse(userSettings).data;
+	const directory = resolve(cwd);
+	const projectDir = (checkoutFacts === void 0 ? await findCheckout(directory, host.env) : checkoutFacts.checkout)?.worktree ?? directory;
+	const project = state?.projects?.[projectDir];
+	const projectFile = await loadJSONFile(join(projectDir, ".mcp.json"), projectFileSchema, null);
+	const approvals = [settings, project].filter((entry) => entry !== void 0 && entry !== null);
+	const isDisabled = (name) => approvals.some((entry) => entry.disabledMcpjsonServers?.includes(name) === true);
+	const isEnabled = (name) => approvals.some((entry) => entry.enableAllProjectMcpServers === true || entry.enabledMcpjsonServers?.includes(name) === true);
+	const facts = [
+		...buildServerFacts(project?.mcpServers, "local"),
+		...buildServerFacts(projectFile?.mcpServers, "project").filter((server) => isEnabled(server.name) && !isDisabled(server.name)),
+		...buildServerFacts(state?.mcpServers, "user")
+	];
+	return facts.filter((server, index) => facts.findIndex((other) => other.name === server.name) === index);
+}
+const MAX_NAME_LENGTH = 128;
+const TRANSPORTS = {
+	stdio: "stdio",
+	http: "http",
+	"streamable-http": "http",
+	sse: "sse",
+	ws: "ws"
+};
+function buildServerFacts(servers, scope) {
+	return Object.entries(servers ?? {}).flatMap(([name, entry]) => {
+		const server = serverSchema.safeParse(entry);
+		if (!server.success || name === "" || name.length > MAX_NAME_LENGTH) return [];
+		const transport = TRANSPORTS[server.data.type ?? (server.data.url === void 0 ? "stdio" : "")];
+		if (transport === void 0) return [];
+		return [{
+			name,
+			scope,
+			transport,
+			host: transport === "stdio" || server.data.url === void 0 ? null : findEndpointHost(server.data.url)
+		}];
+	});
+}
+function findEndpointHost(url) {
+	const parsed = URL.parse(url);
+	if (parsed === null || !/^(?:https?|wss?):$/u.test(parsed.protocol) || /[${}]/u.test(parsed.host)) return null;
+	return parsed.host;
+}
+//#endregion
 //#region src/policy/build-unavailable-verdict.ts
 function buildUnavailableVerdict(onFailure, reason) {
 	return onFailure === "deny" ? {
@@ -7465,7 +7992,7 @@ function buildDecisionRequest(payload, policy, configuredRules, lastUserMessage,
 	};
 }
 function buildEvidenceGuidance(name) {
-	if (name === "Default Branch Write") return "First determine whether the pending action performs a Git commit, push, or merge, or writes code that performs one when run. An ordinary non-Git source or test edit does not itself commit, push, or merge and this rule is allow without branch evidence; do not ask for branch consent for that edit or infer a later Git step from task context. repositoryContext describes cwd only, not the edited file's checkout or a generated script's future execution cwd. For actual Git writes targeting the current cwd, compare repositoryContext.branch with repositoryContext.defaultBranch and the shipped protected names main, master, trunk, and develop. A branch matching any protected name remains restricted even when defaultBranch differs; for example, develop with defaultBranch main is still restricted. Only when both references are known, different, and the branch is not a protected name does this rule allow an ordinary commit without a branch-ownership exception. Otherwise evaluate the restriction and its permitted consent. Written scripts retain their delayed Git effects; judge those effects against evidence for their actual target repository, execution cwd, and branch, not assumed cwd references. Do not apply cwd references to another target: directory changes, git -C, Git directory or environment overrides, explicit push destinations, and merge targets need their own evidence. A worktree path alone is not branch evidence.";
+	if (name === "Default Branch Write") return "First determine whether the pending action performs a Git commit, push, or merge, or writes code that performs one when run. An ordinary non-Git source or test edit does not itself commit, push, or merge and this rule is allow without branch evidence; do not ask for branch consent for that edit or infer a later Git step from task context. repositoryContext describes cwd only, not the edited file's checkout or a generated script's future execution cwd. For actual Git writes targeting the current cwd, compare repositoryContext.branch with repositoryContext.defaultBranch and the shipped protected names main, master, trunk, and develop. A branch matching any protected name remains restricted even when defaultBranch differs; for example, develop with defaultBranch main is still restricted. Only when both references are known, different, and the branch is not a protected name does this rule allow an ordinary commit without a branch-ownership exception. Otherwise evaluate the restriction and its permitted consent. Written scripts retain their delayed Git effects; judge those effects against evidence for their actual target repository, execution cwd, and branch, not assumed cwd references; Git calls whose every target, the repository they run in and any remote they push to, is a repository the written code creates for itself, such as a test fixture in a temporary directory, never reach the checkout's default branch, whatever those repositories' branches are named; a push from such a repository to a remote the code did not create still does. Do not apply cwd references to another target: directory changes, git -C, Git directory or environment overrides, explicit push destinations, and merge targets need their own evidence. A worktree path alone is not branch evidence.";
 	if (name === "Data Exfiltration" || name === "Secret Persistence") return "Identify actual sensitive material before applying this hard rule. Unmistakably inert static strings used as sanitizer-test assertion data, such as EXAMPLE_ONLY_NOT_A_VALID_TOKEN or an invalid EXAMPLE_ONLY_NOT_BASE64_NOT_A_KEY body inside private-key markers, are not real credentials. Decide from the supplied literal and data flow, not a secret-shaped prefix alone. A test filename, a synthetic comment, or consent never clears material from a real credential source, usable secrets, or sensitive data. Actual credential capture or disclosure remains restricted, including in tests and written scripts. A non-sensitive message is judged by Outbound Communication alone.";
 	return "";
 }
@@ -7527,219 +8054,6 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
-//#region src/model/load-mcp-servers.ts
-const serverSchema = looseObject({
-	type: string().optional(),
-	url: string().optional()
-});
-const serversSchema = record(string(), unknown()).optional();
-const approvalSchema = looseObject({
-	enableAllProjectMcpServers: boolean().optional(),
-	enabledMcpjsonServers: array(string()).optional(),
-	disabledMcpjsonServers: array(string()).optional()
-});
-const stateSchema = looseObject({
-	mcpServers: serversSchema,
-	projects: record(string(), looseObject({
-		...approvalSchema.shape,
-		mcpServers: serversSchema
-	})).optional()
-});
-const projectFileSchema = looseObject({ mcpServers: serversSchema });
-async function loadMCPServers(cwd, host, userSettings) {
-	const configDir = host.env["CLAUDE_CONFIG_DIR"];
-	const state = await readJSON(configDir !== void 0 && configDir !== "" ? join(configDir, ".claude.json") : join(host.home, ".claude.json"), stateSchema);
-	const settings = approvalSchema.safeParse(userSettings).data;
-	const directory = resolve(cwd);
-	const projectDir = (await findCheckout(directory, host.env))?.worktree ?? directory;
-	const project = state?.projects?.[projectDir];
-	const projectFile = await readJSON(join(projectDir, ".mcp.json"), projectFileSchema);
-	const approvals = [settings, project].filter((entry) => entry !== void 0 && entry !== null);
-	const isDisabled = (name) => approvals.some((entry) => entry.disabledMcpjsonServers?.includes(name) === true);
-	const isEnabled = (name) => approvals.some((entry) => entry.enableAllProjectMcpServers === true || entry.enabledMcpjsonServers?.includes(name) === true);
-	const facts = [
-		...buildServerFacts(project?.mcpServers, "local"),
-		...buildServerFacts(projectFile?.mcpServers, "project").filter((server) => isEnabled(server.name) && !isDisabled(server.name)),
-		...buildServerFacts(state?.mcpServers, "user")
-	];
-	return facts.filter((server, index) => facts.findIndex((other) => other.name === server.name) === index);
-}
-async function readJSON(path, schema) {
-	try {
-		const text = await readFile(path, "utf8");
-		const parsed = schema.safeParse(JSON.parse(text));
-		return parsed.success ? parsed.data : null;
-	} catch {
-		return null;
-	}
-}
-const MAX_NAME_LENGTH = 128;
-const TRANSPORTS = {
-	stdio: "stdio",
-	http: "http",
-	"streamable-http": "http",
-	sse: "sse",
-	ws: "ws"
-};
-function buildServerFacts(servers, scope) {
-	return Object.entries(servers ?? {}).flatMap(([name, entry]) => {
-		const server = serverSchema.safeParse(entry);
-		if (!server.success || name === "" || name.length > MAX_NAME_LENGTH) return [];
-		const transport = TRANSPORTS[server.data.type ?? (server.data.url === void 0 ? "stdio" : "")];
-		if (transport === void 0) return [];
-		return [{
-			name,
-			scope,
-			transport,
-			host: transport === "stdio" || server.data.url === void 0 ? null : findEndpointHost(server.data.url)
-		}];
-	});
-}
-function findEndpointHost(url) {
-	const parsed = URL.parse(url);
-	if (parsed === null || !/^(?:https?|wss?):$/u.test(parsed.protocol) || /[${}]/u.test(parsed.host)) return null;
-	return parsed.host;
-}
-//#endregion
-//#region src/scope/load-checkout-remotes.ts
-async function loadCheckoutRemotes(commonDir) {
-	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
-	const remotes = [];
-	let section = null;
-	for (const line of config.split("\n")) {
-		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
-		if (header !== void 0) section = header;
-		else if (/^\s*\[/u.test(line)) section = null;
-		else if (section !== null) {
-			const value = /^\s*(?:push)?url\s*=(?<value>.*)$/iu.exec(line)?.groups?.["value"];
-			const url = value === void 0 ? "" : parseConfigValue(value);
-			if (url !== "") remotes.push({
-				name: section,
-				url
-			});
-		}
-	}
-	return remotes;
-}
-function parseConfigValue(raw) {
-	let value = "";
-	let isQuoted = false;
-	for (let index = 0; index < raw.length; index += 1) {
-		const char = raw[index] ?? "";
-		if (char === "\\") {
-			const next = raw[index + 1] ?? "";
-			value += {
-				n: "\n",
-				t: "	",
-				b: ""
-			}[next] ?? next;
-			index += 1;
-		} else if (char === "\"") isQuoted = !isQuoted;
-		else if (!isQuoted && (char === "#" || char === ";")) break;
-		else value += char;
-	}
-	return value.trim();
-}
-//#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd, env, stopDir = parse(resolve(cwd)).root) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory || directory === resolve(stopDir)) return null;
-			directory = parent;
-			continue;
-		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
-		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
-		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
-		}
-		const remotes = await loadCheckoutRemotes(commonDir);
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch,
-			remotes: remotes.flatMap((remote) => {
-				const url = normalizeRemoteURL(remote.url);
-				return url === null ? [] : [{
-					name: remote.name,
-					url
-				}];
-			})
-		};
-	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
-}
-function normalizeRemoteURL(url) {
-	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
-		const parsed = URL.parse(url);
-		if (parsed === null) return null;
-		parsed.username = "";
-		parsed.password = "";
-		parsed.search = "";
-		parsed.hash = "";
-		return parsed.href;
-	}
-	const slash = url.indexOf("/");
-	const end = slash === -1 ? url.length : slash;
-	const at = url.lastIndexOf("@", end);
-	return at === -1 ? url : url.slice(at + 1);
-}
-//#endregion
-//#region src/model/load-repository-evidence.ts
-async function loadRepositoryEvidence(cwd, taskScope, env, stopDir) {
-	const context = await loadRepositoryContext(cwd, env, stopDir);
-	if (taskScope === void 0) return context;
-	return {
-		...context ?? {
-			cwd: resolve(cwd),
-			branch: null,
-			defaultBranch: null
-		},
-		taskScope
-	};
-}
-//#endregion
 //#region src/model/find-denied-rule.ts
 function findDeniedRule(request, result, blockThreshold) {
 	const [top] = collectBlockingRules(request, result, blockThreshold);
@@ -7761,6 +8075,74 @@ function pickDecisionVerdict(request, result, blockThreshold) {
 	};
 }
 //#endregion
+//#region src/model/build-jev-outcome.ts
+function buildJevOutcome(attempt, facts, config) {
+	const elapsedMs = Math.round(facts.elapsedMs);
+	if (attempt.kind === "reply") {
+		const verdict = pickDecisionVerdict(attempt.request, attempt.result, facts.blockThreshold);
+		const denied = findReviewedRule(attempt.request, attempt.result, facts.blockThreshold);
+		return {
+			verdict,
+			...denied === null ? {} : { review: {
+				...denied,
+				repositoryContext: attempt.repositoryContext
+			} },
+			diagnostics: {
+				status: verdict.kind,
+				stage: "response",
+				keyResolved: true,
+				keySource: facts.keySource,
+				failureReason: null,
+				requestBytes: attempt.result.requestBytes,
+				elapsedMs,
+				blockThreshold: facts.blockThreshold,
+				contributors: collectDecisionContributors(attempt.request, attempt.result, facts.blockThreshold)
+			},
+			note: formatClassifierNote(`${config.provider.model}: ${verdict.kind} (${elapsedMs}ms, ${attempt.result.inputTokens} input tokens)`, facts.key)
+		};
+	}
+	const failure = classifyFailure(attempt, config.provider.timeoutMs);
+	const note = formatClassifierNote(`${config.provider.model} unavailable: ${failure.reason}`, facts.key);
+	return {
+		verdict: buildUnavailableVerdict(config.onFailure, note),
+		note,
+		unavailable: true,
+		diagnostics: {
+			status: failure.status,
+			stage: attempt.stage,
+			keyResolved: facts.key !== null,
+			keySource: facts.keySource,
+			failureReason: attempt.error instanceof DecisionRequestError ? attempt.error.reason : null,
+			requestBytes: attempt.error instanceof DecisionRequestError ? attempt.error.requestBytes : null,
+			elapsedMs,
+			blockThreshold: facts.blockThreshold,
+			contributors: []
+		}
+	};
+}
+function classifyFailure(attempt, timeoutMs) {
+	if (attempt.cancelled) return {
+		reason: "evaluation cancelled",
+		status: "cancelled"
+	};
+	if (attempt.deadlineExpired) return {
+		reason: "evaluation deadline expired",
+		status: "timeout"
+	};
+	const error = attempt.error;
+	if (!(error instanceof Error)) return {
+		reason: "classifier failed",
+		status: "failure"
+	};
+	return error.name === "AbortError" || error instanceof DecisionRequestError && error.reason === "aborted" ? {
+		reason: `timed out after ${timeoutMs}ms`,
+		status: "timeout"
+	} : {
+		reason: error.message,
+		status: "failure"
+	};
+}
+//#endregion
 //#region src/model/probability-schema.ts
 const probabilitySchema = number().min(0).max(1);
 //#endregion
@@ -7854,14 +8236,12 @@ async function classifyWithJev(payload, config, options) {
 		stage = "evidence";
 		const directUserText = findCurrentDirectUserMessage(payload.decisionContext?.lastDirectUserMessage);
 		const settings = await (options.claudeSettings ?? loadClaudeSettings(config.claudeSettingsPath, options.host));
-		const [policy, repositoryContext, mcpServers] = await Promise.all([
-			loadPolicy({
-				classifierPath: config.classifierPath,
-				rulesPath: config.rulesPath
-			}, "decision.md"),
-			loadRepositoryEvidence(payload.cwd, options.taskScope, options.host.env).catch(() => null),
-			loadMCPServers(payload.cwd, options.host, settings.userSettings).catch(() => [])
-		]);
+		const checkout = await (options.checkout ?? loadCheckoutFacts(payload.cwd, options.host.env, { findCheckout: options.findCheckout }).catch(() => null));
+		const repositoryContext = checkout === null ? null : buildRepositoryEvidence(checkout, options.taskScope);
+		const [policy, mcpServers] = await Promise.all([loadPolicy({
+			classifierPath: config.classifierPath,
+			rulesPath: config.rulesPath
+		}, "decision.md"), loadMCPServers(payload.cwd, options.host, settings.userSettings, checkout ?? void 0).catch(() => [])]);
 		const rulesSource = config.rulesPath === void 0 ? "shipped" : "replacement";
 		const request = buildDecisionRequest(payload, policy, settings.rules, directUserText, rulesSource, repositoryContext, mcpServers);
 		const remainingMs = options.deadlineAt === void 0 ? config.provider.timeoutMs : options.deadlineAt - now();
@@ -7871,58 +8251,30 @@ async function classifyWithJev(payload, config, options) {
 		stage = "request";
 		const result = await sendDecision(config.provider, key, request, signal);
 		stage = "response";
-		const verdict = pickDecisionVerdict(request, result, blockThreshold);
-		const denied = findReviewedRule(request, result, blockThreshold);
-		return {
-			verdict,
-			...denied === null ? {} : { review: {
-				...denied,
-				repositoryContext
-			} },
-			diagnostics: {
-				status: verdict.kind,
-				stage,
-				keyResolved: true,
-				keySource,
-				failureReason: null,
-				requestBytes: result.requestBytes,
-				elapsedMs: Math.round(performance.now() - start),
-				blockThreshold,
-				contributors: collectDecisionContributors(request, result, blockThreshold)
-			},
-			note: formatClassifierNote(`${config.provider.model}: ${verdict.kind} (${Math.round(performance.now() - start)}ms, ${result.inputTokens} input tokens)`, key)
-		};
+		return buildJevOutcome({
+			kind: "reply",
+			request,
+			result,
+			repositoryContext
+		}, {
+			key,
+			keySource,
+			elapsedMs: performance.now() - start,
+			blockThreshold
+		}, config);
 	} catch (error) {
-		let reason = "classifier failed";
-		let status = "failure";
-		if (options.signal?.aborted === true) {
-			reason = "evaluation cancelled";
-			status = "cancelled";
-		} else if (options.deadlineAt !== void 0 && now() >= options.deadlineAt) {
-			reason = "evaluation deadline expired";
-			status = "timeout";
-		} else if (error instanceof Error) {
-			const isTimeout = error.name === "AbortError" || error instanceof DecisionRequestError && error.reason === "aborted";
-			if (isTimeout) status = "timeout";
-			reason = isTimeout ? `timed out after ${config.provider.timeoutMs}ms` : error.message;
-		}
-		const note = formatClassifierNote(`${config.provider.model} unavailable: ${reason}`, key);
-		return {
-			verdict: buildUnavailableVerdict(config.onFailure, note),
-			note,
-			unavailable: true,
-			diagnostics: {
-				status,
-				stage,
-				keyResolved: key !== null,
-				keySource,
-				failureReason: error instanceof DecisionRequestError ? error.reason : null,
-				requestBytes: error instanceof DecisionRequestError ? error.requestBytes : null,
-				elapsedMs: Math.round(performance.now() - start),
-				blockThreshold,
-				contributors: []
-			}
-		};
+		return buildJevOutcome({
+			kind: "failure",
+			error,
+			stage,
+			cancelled: options.signal?.aborted === true,
+			deadlineExpired: options.deadlineAt !== void 0 && now() >= options.deadlineAt
+		}, {
+			key,
+			keySource,
+			elapsedMs: performance.now() - start,
+			blockThreshold
+		}, config);
 	}
 }
 //#endregion
@@ -7980,7 +8332,9 @@ async function classifyWithModel(payload, config, options = {}) {
 		text: directMessage
 	}];
 	const settings = await (options.claudeSettings ?? loadClaudeSettings(null, host));
-	const [repositoryContext, mcpServers] = await Promise.all([loadRepositoryEvidence(payload.cwd, options.taskScope, host.env).catch(() => null), loadMCPServers(payload.cwd, host, settings.userSettings).catch(() => [])]);
+	const checkout = await (options.checkout ?? loadCheckoutFacts(payload.cwd, host.env, { findCheckout: options.findCheckout }).catch(() => null));
+	const repositoryContext = checkout === null ? null : buildRepositoryEvidence(checkout, options.taskScope);
+	const mcpServers = await loadMCPServers(payload.cwd, host, settings.userSettings, checkout ?? void 0).catch(() => []);
 	const user = buildUserMessage(payload, transcript, config.provider.reasoning, repositoryContext, mcpServers);
 	try {
 		const timeout = options.timeout ?? ((ms) => AbortSignal.timeout(ms));
@@ -8152,25 +8506,26 @@ function classifyLocally(payload) {
 }
 function classifySegment(text, cwd) {
 	const words = splitWords(text);
-	const start = words.findIndex((word) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word));
+	const start = words.findIndex((word) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(word.raw));
 	if (start === -1) return "Read-only actions";
 	const head = words[start];
 	invariant(head !== void 0, "findIndex returned an index the array holds");
 	const rest = words.slice(start + 1);
-	const name = head.slice(head.lastIndexOf("/") + 1);
+	const name = head.raw.slice(head.raw.lastIndexOf("/") + 1);
 	if (READ_ONLY_COMMANDS.has(name)) return "Read-only actions";
 	if (name === "git") {
-		const sub = rest.find((word) => !word.startsWith("-"));
-		return sub !== void 0 && READ_ONLY_GIT_SUBCOMMANDS.has(sub) ? "Read-only actions" : null;
+		const sub = rest.find((word) => !word.raw.startsWith("-"));
+		return sub !== void 0 && READ_ONLY_GIT_SUBCOMMANDS.has(sub.raw) ? "Read-only actions" : null;
 	}
 	if (name === "rm") return classifyRemove(rest, cwd);
 	return null;
 }
 function classifyRemove(args, cwd) {
-	const paths = args.filter((arg) => !arg.startsWith("-"));
+	const paths = args.filter((arg) => !arg.raw.startsWith("-"));
 	if (paths.length === 0) return null;
 	for (const path of paths) {
-		const stripped = toUnquoted(path);
+		if (!isPlainOperand(path)) return null;
+		const stripped = path.value;
 		if (stripped.includes("*") || stripped.includes("~") || stripped.includes("$")) return null;
 		const resolved = isAbsolute(stripped) ? normalize(stripped) : normalize(`${cwd}/${stripped}`);
 		const within = relative(cwd, resolved);
@@ -8181,11 +8536,17 @@ function classifyRemove(args, cwd) {
 	return "Regenerable output";
 }
 function splitWords(text) {
-	return text.split(/\s+/).filter((word) => word !== "");
-}
-function toUnquoted(word) {
-	const [first] = word;
-	return (first === "'" || first === "\"") && word.at(-1) === first ? word.slice(1, -1) : word;
+	return splitShellTokens(text).tokens.flatMap((token) => token.kind === "word" ? [{
+		raw: token.raw,
+		value: token.value
+	}] : []);
+}
+function isPlainOperand(word) {
+	return [
+		word.value,
+		`'${word.value}'`,
+		`"${word.value}"`
+	].includes(word.raw) && !/\s/u.test(word.value);
 }
 //#endregion
 //#region src/scope/merge-scope-facts.ts
@@ -8355,19 +8716,8 @@ const sessionScopeSchema = strictObject({
 	branches: array(branchSchema),
 	pullRequests: array(pullRequestSchema)
 });
-async function loadSessionScope(path) {
-	let raw;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
-	try {
-		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
-		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
+function loadSessionScope(path) {
+	return loadJSONFile(path, sessionScopeSchema, EMPTY_SESSION_SCOPE);
 }
 //#endregion
 //#region src/scope/resolve-session-scope-path.ts
@@ -8378,33 +8728,31 @@ function resolveSessionScopePath(stateDir, sessionID) {
 //#endregion
 //#region src/scope/pick-scope-source-reader.ts
 function pickScopeSourceReader(source, findSourceCheckout = findCheckout) {
-	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
+	return M(source.kind).returnType().with("cwd", () => (context) => Promise.resolve(buildFacts({
 		worktrees: [context.worktree],
 		branches: context.branch === null ? [] : [context.branch]
-	}));
-	if (source.kind === "session") return async (context) => {
+	}))).with("session", () => async (context) => {
 		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
 		return buildFacts({
 			worktrees: scope.worktrees,
 			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
 			pullRequests: scope.pullRequests
 		});
-	};
-	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
-	return async (context) => {
-		const loaded = await loadAtcSessionRecord(context.atcRecordPath, context.atcSessionID);
-		if (loaded.kind === "malformed") context.stderr.write(`auto-mode: ${loaded.diagnostic}\n`);
-		if (loaded.kind !== "record") return EMPTY_SCOPE_FACTS;
-		const scope = loaded.record.scope;
-		const paths = /* @__PURE__ */ new Set([
-			scope.workspace.path,
-			...scope.worktrees.map((worktree) => worktree.path),
-			...scope.branches.map((branch) => branch.repo ?? scope.workspace.path)
-		]);
-		const entries = await Promise.all([...paths].map((path) => findCommonDirEntry(path, context.env, findSourceCheckout)));
-		const commonDirs = new Map(entries);
-		return buildAtcScopeFacts(loaded.record, (path) => context.commonDir !== null && commonDirs.get(path) === context.commonDir);
-	};
+	}).with("globs", () => () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }))).with("atc", () => (context) => readAtcScopeFacts(context, findSourceCheckout)).exhaustive();
+}
+async function readAtcScopeFacts(context, findSourceCheckout) {
+	const loaded = await loadAtcSessionRecord(context.atcRecordPath, context.atcSessionID);
+	if (loaded.kind === "malformed") context.stderr.write(`auto-mode: ${loaded.diagnostic}\n`);
+	if (loaded.kind !== "record") return EMPTY_SCOPE_FACTS;
+	const scope = loaded.record.scope;
+	const paths = /* @__PURE__ */ new Set([
+		scope.workspace.path,
+		...scope.worktrees.map((worktree) => worktree.path),
+		...scope.branches.map((branch) => branch.repo ?? scope.workspace.path)
+	]);
+	const entries = await Promise.all([...paths].map((path) => findCommonDirEntry(path, context.env, findSourceCheckout)));
+	const commonDirs = new Map(entries);
+	return buildAtcScopeFacts(loaded.record, (path) => context.commonDir !== null && commonDirs.get(path) === context.commonDir);
 }
 async function findCommonDirEntry(path, env, findSourceCheckout) {
 	return [path, (await findSourceCheckout(path, env))?.commonDir ?? null];
@@ -8419,8 +8767,9 @@ function buildFacts(facts) {
 //#region src/scope/load-task-scope.ts
 async function loadTaskScope(request, sources, host, stderr) {
 	const cwd = resolve(request.cwd);
-	const [checkout, context] = await Promise.all([findCheckout(cwd, host.env), loadRepositoryContext(cwd, host.env)]);
-	const branch = context?.branch ?? null;
+	const facts = await (request.checkout ?? loadCheckoutFacts(cwd, host.env, { findCheckout: request.findCheckout }));
+	const checkout = facts.checkout;
+	const branch = facts.head?.branch ?? null;
 	const sourceContext = {
 		env: host.env,
 		sessionID: request.sessionID,
@@ -8433,19 +8782,71 @@ async function loadTaskScope(request, sources, host, stderr) {
 		atcSessionID: host.env["ATC_SESSION_ID"],
 		stderr
 	};
-	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
+	const sourceFacts = await Promise.all(Object.values(sources).map((source) => pickScopeSourceReader(source, request.findCheckout)(sourceContext)));
 	return buildTaskScope({
 		home: host.home,
 		currentBranch: branch,
-		defaultBranch: context?.defaultBranch ?? null,
-		remotes,
-		facts
+		defaultBranch: facts.head?.defaultBranch ?? null,
+		remotes: facts.remotes,
+		facts: sourceFacts
 	});
 }
 //#endregion
 //#region src/classify-action.ts
 async function classifyAction(request, config, options = {}) {
 	const host = options.host ?? readHostEnvironment();
+	const stderr = options.stderr ?? process.stderr;
+	const invocationID = randomUUID();
+	if (options.actionLog === true) await writeActionDiagnostic(request, {
+		invocationID,
+		status: "started"
+	}, host, stderr);
+	const outcome = options.budget === true ? await classifyWithBudget(request, config, {
+		...options,
+		host,
+		stderr
+	}) : await classifyStages(request, config, {
+		...options,
+		host,
+		stderr
+	});
+	if (options.actionLog === true) await writeActionDiagnostic(request, {
+		invocationID,
+		status: outcome.status,
+		verdict: outcome.verdict?.kind ?? "defer",
+		decidingStage: outcome.decidingStage,
+		...outcome.denials === void 0 ? {} : { denials: outcome.denials },
+		...outcome.escalation === void 0 ? {} : { escalation: outcome.escalation },
+		...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics },
+		...outcome.judge === void 0 ? {} : { judge: outcome.judge }
+	}, host, stderr);
+	return outcome;
+}
+async function classifyWithBudget(request, config, options) {
+	const statePath = resolveDenialStatePath(request, resolveXDGDir(options.host, "state"));
+	const retryKey = buildRetryKey(request);
+	const retry = findRetryDeny(await loadDenialState(statePath), retryKey);
+	const outcome = retry === null ? await classifyStages(request, config, options) : {
+		verdict: retry,
+		decidingStage: "retry",
+		note: "retry of the action just denied; denied again",
+		status: "deny"
+	};
+	const plan = await tryUpdateDenialBudget(options.stderr, statePath, (state) => planDenialBudget(state, outcome.verdict, retryKey, config.denialBudget ?? DEFAULT_DENIAL_BUDGET));
+	return {
+		...outcome,
+		verdict: plan.verdict,
+		decidingStage: plan.escalation ? "budget" : outcome.decidingStage,
+		note: plan.escalation ? "denial budget exhausted; the user decides this action" : outcome.note,
+		denials: {
+			consecutive: plan.state.consecutive,
+			session: plan.state.session
+		},
+		escalation: plan.escalation
+	};
+}
+async function classifyStages(request, config, options) {
+	const host = options.host;
 	let claudeSettings = options.claudeSettings;
 	if (config.provider.protocol === "system-one" && claudeSettings === void 0) try {
 		claudeSettings = await loadClaudeSettings(config.claudeSettingsPath, host);
@@ -8464,7 +8865,14 @@ async function classifyAction(request, config, options = {}) {
 	const hasConfiguredDenies = configured !== void 0 && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0);
 	const local = hasConfiguredDenies ? { kind: "escalate" } : classifyLocally(request);
 	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
-	const scope = await tryLoadTaskScope(request, config, host, options.stderr ?? process.stderr);
+	const findActionCheckout = makeOnceCheckoutFinder(options.findCheckout ?? findCheckout);
+	const checkout = await loadCheckoutFacts(request.cwd, host.env, { findCheckout: findActionCheckout }).catch(() => null);
+	const scope = await tryLoadTaskScope({
+		sessionID: request.sessionID,
+		cwd: request.cwd,
+		checkout,
+		findCheckout: findActionCheckout
+	}, config, host, options.stderr);
 	const containment = scope === null ? null : checkContainment(request, scope, host.scratchPaths);
 	if (containment !== null) {
 		const guidance = await tryReadDenialGuidance();
@@ -8476,7 +8884,7 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	if (local.kind === "allow") return buildLocalAllow(local.exception);
-	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope, host);
+	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope, host, { findCheckout: findActionCheckout });
 	if (edit?.kind === "bypass") return {
 		verdict: { kind: "allow" },
 		decidingStage: "bypass",
@@ -8494,7 +8902,9 @@ async function classifyAction(request, config, options = {}) {
 		...options,
 		taskScope,
 		host,
-		claudeSettings
+		claudeSettings,
+		checkout: checkout ?? void 0,
+		findCheckout: findActionCheckout
 	}), tryReadDenialGuidance()]);
 	const judge = config.judge ?? null;
 	if (outcome.verdict?.kind === "deny" && outcome.review !== void 0 && judge !== null) {
@@ -8526,14 +8936,22 @@ const READ_ONLY_EXCEPTION = "Read-only actions";
 async function tryLoadTaskScope(request, config, host, stderr) {
 	try {
 		return await loadTaskScope({
-			sessionID: request.sessionID,
-			cwd: request.cwd,
-			stateDir: resolveStateDir(host)
+			...request,
+			checkout: request.checkout ?? void 0,
+			stateDir: resolveXDGDir(host, "state")
 		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES, host, stderr);
 	} catch {
 		return null;
 	}
 }
+function makeOnceCheckoutFinder(find) {
+	const found = /* @__PURE__ */ new Map();
+	return (start, env) => {
+		const cached = found.get(start) ?? find(start, env);
+		found.set(start, cached);
+		return cached;
+	};
+}
 function buildLocalAllow(exception) {
 	return {
 		verdict: { kind: "allow" },
@@ -8557,6 +8975,279 @@ async function tryReadDenialGuidance() {
 		return null;
 	}
 }
+async function tryUpdateDenialBudget(stderr, path, plan) {
+	const unlocked = await loadDenialState(path);
+	const unlockedPlan = plan(unlocked);
+	if (unlockedPlan.state === unlocked) return unlockedPlan;
+	try {
+		return plan((await updateDenialState(path, (state) => plan(state).state)).previous);
+	} catch {
+		stderr.write("auto-mode: denial counts unavailable\n");
+		return unlockedPlan;
+	}
+}
+//#endregion
+//#region src/scope/read-pull-request.ts
+const LOOKUP_TIMEOUT_MS = 5e3;
+const MAX_LOOKUP_OUTPUT_BYTES = 65536;
+async function readPullRequest(repository, number, options = {}) {
+	const [file, ...prefix] = options.command ?? ["gh"];
+	const args = [
+		"pr",
+		"view",
+		String(number),
+		"--repo",
+		repository,
+		"--json",
+		"headRefName,createdAt"
+	];
+	const result = await runCapped(file, [
+		...prefix,
+		...args,
+		"--jq",
+		"[.headRefName, .createdAt] | @tsv"
+	], {
+		signal: AbortSignal.timeout(options.timeoutMs ?? LOOKUP_TIMEOUT_MS),
+		maxOutputBytes: MAX_LOOKUP_OUTPUT_BYTES
+	});
+	const [head = "", created = ""] = result.stdout.trim().split("	");
+	const createdAt = Date.parse(created);
+	return result.exitCode === 0 && head !== "" && !Number.isNaN(createdAt) ? {
+		head,
+		createdAt
+	} : null;
+}
+//#endregion
+//#region src/git/read-branch-created-at.ts
+async function readBranchCreatedAt(commonDir, branch) {
+	if (!/^[\w./-]+$/u.test(branch) || branch.split("/").includes("..")) return null;
+	const [first = ""] = (await readFile(join(commonDir, "logs", "refs", "heads", branch), "utf8").catch(() => "")).split("\n");
+	const seconds = /^0+ [\da-f]+ .* (?<time>\d+) [+-]\d{4}\t/u.exec(first)?.groups?.["time"];
+	return seconds === void 0 ? null : Number(seconds) * 1e3;
+}
+//#endregion
+//#region src/scope/collect-pull-request-addresses.ts
+function collectPullRequestAddresses(text) {
+	const addresses = /* @__PURE__ */ new Map();
+	for (const match of text.matchAll(PULL_REQUEST_URL)) {
+		const repository = toRepositorySlug(`https://${match.groups?.["repository"] ?? ""}`);
+		const number = Number(match.groups?.["number"]);
+		if (repository !== null) addresses.set(`${repository}#${String(number)}`, {
+			repository,
+			number
+		});
+	}
+	return [...addresses.values()];
+}
+const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
+//#endregion
+//#region mods/auto-mode/contract/scope-commands.ts
+const SCOPE_COMMANDS = {
+	git: [
+		"worktree add",
+		"checkout",
+		"switch",
+		"branch"
+	],
+	gh: ["pr create"]
+};
+//#endregion
+//#region src/scope/collect-scope-events.ts
+function collectScopeEvents(command, cwd, home) {
+	return collectShellCommands(command, cwd, home).flatMap((entry) => {
+		const [name, ...args] = entry.words;
+		const directory = entry.directory;
+		if (directory === null) return [];
+		if (name === "git") return collectGitEvents(args, directory, home);
+		return name === "gh" && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null ? [{
+			kind: "pull-request",
+			directory,
+			head: findOptionValue(args, ["--head", "-H"])
+		}] : [];
+	});
+}
+function collectGitEvents(args, cwd, home) {
+	const git = splitGitCommand(args, cwd, home);
+	const found = findScopeCommand(SCOPE_COMMANDS.git, git.args);
+	if (git.directory === null || found === null) return [];
+	return GIT_EVENT_COLLECTORS[found.command](found.rest, git.directory, home);
+}
+function findScopeCommand(commands, args) {
+	for (const command of commands) {
+		const words = command.split(" ");
+		if (words.every((word, index) => args[index] === word)) return {
+			command,
+			rest: args.slice(words.length)
+		};
+	}
+	return null;
+}
+const GIT_EVENT_COLLECTORS = {
+	"worktree add": collectWorktreeEvents,
+	checkout: collectSwitchEvents,
+	switch: collectSwitchEvents,
+	branch: collectBranchEvents
+};
+function collectWorktreeEvents(rest, directory, home) {
+	const path = findWorktreePath(rest);
+	const resolved = path === null ? null : resolveShellPath(directory, path, home);
+	return resolved === null ? [] : [{
+		kind: "worktree",
+		path: resolved
+	}];
+}
+const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-B",
+	"--reason"
+]);
+function findWorktreePath(args) {
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index] ?? "";
+		if (WORKTREE_VALUE_OPTIONS.has(word)) index += 1;
+		else if (!word.startsWith("-")) return word;
+	}
+	return null;
+}
+const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-B",
+	"-c",
+	"-C",
+	"--create",
+	"--force-create"
+]);
+const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
+function collectSwitchEvents(rest, directory) {
+	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
+	return name === null ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
+function collectBranchEvents(rest, directory) {
+	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
+	const name = rest.find((word) => !word.startsWith("-"));
+	return name === void 0 || isUnresolvedWord(name) ? [] : [{
+		kind: "branch",
+		name,
+		directory
+	}];
+}
+function findOptionValue(args, options) {
+	const index = args.findIndex((word) => options.includes(word));
+	const value = index === -1 ? void 0 : args[index + 1];
+	return value === void 0 || isUnresolvedWord(value) ? null : value;
+}
+//#endregion
+//#region src/scope/merge-session-scope.ts
+function mergeSessionScope(all) {
+	const branches = /* @__PURE__ */ new Map();
+	const pullRequests = /* @__PURE__ */ new Map();
+	for (const branch of all.flatMap((scope) => scope.branches)) branches.set(`${branch.commonDir}\0${branch.name}`, branch);
+	for (const pull of all.flatMap((scope) => scope.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
+	return {
+		worktrees: [...new Set(all.flatMap((scope) => scope.worktrees))],
+		branches: [...branches.values()],
+		pullRequests: [...pullRequests.values()]
+	};
+}
+//#endregion
+//#region src/scope/write-session-scope.ts
+async function writeSessionScope(path, added, clock) {
+	await updateJSONFile(path, loadSessionScope, (current) => mergeSessionScope([current, added]), clock);
+}
+//#endregion
+//#region src/scope/update-session-scope.ts
+const MAX_CALL_AGE_MS = 9e5;
+async function updateSessionScope(request, options) {
+	const age = options.now - request.startedAt;
+	if (age < -6e4 || age > MAX_CALL_AGE_MS) return EMPTY_SESSION_SCOPE;
+	const events = collectScopeEvents(request.command, request.cwd, options.home);
+	const scope = mergeSessionScope(await Promise.all(events.map((event) => tryVerifyScopeEvent(event, request, options))));
+	if (scope.worktrees.length + scope.branches.length + scope.pullRequests.length > 0) await writeSessionScope(resolveSessionScopePath(options.stateDir, request.sessionID), scope, options.lockClock);
+	return scope;
+}
+async function tryVerifyScopeEvent(event, request, options) {
+	try {
+		return await (options.verifyEvent === void 0 ? verifyScopeEvent(event, request, options) : options.verifyEvent(event, request));
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+}
+const FORGE_CLOCK_SKEW_MS = 6e4;
+const FILE_CLOCK_SLACK_MS = 50;
+function verifyScopeEvent(event, request, options) {
+	return M(event).returnType().with({ kind: "worktree" }, (worktree) => verifyWorktreeEvent(worktree.path, request, options)).with({ kind: "branch" }, (branch) => verifyBranchEvent(branch, request, options)).with({ kind: "pull-request" }, (pull) => verifyPullRequestEvent(pull.directory, request, options)).exhaustive();
+}
+async function verifyWorktreeEvent(path, request, options) {
+	const link = await stat(join(path, ".git"));
+	const facts = await loadCheckoutFacts(path, options.env);
+	const checkout = facts.checkout;
+	if (!link.isFile() || link.mtimeMs < request.startedAt - FILE_CLOCK_SLACK_MS || checkout?.worktree !== path) return EMPTY_SESSION_SCOPE;
+	const branch = facts.head?.branch ?? null;
+	if (branch === null) return {
+		...EMPTY_SESSION_SCOPE,
+		worktrees: [path]
+	};
+	const isNew = await isBranchCreatedSince(checkout.commonDir, branch, request.startedAt);
+	return {
+		...EMPTY_SESSION_SCOPE,
+		worktrees: [path],
+		branches: isNew ? [{
+			name: branch,
+			commonDir: checkout.commonDir
+		}] : []
+	};
+}
+async function verifyBranchEvent(event, request, options) {
+	const checkout = await findCheckout(event.directory, options.env);
+	if (checkout === null) return EMPTY_SESSION_SCOPE;
+	return await isBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
+		...EMPTY_SESSION_SCOPE,
+		branches: [{
+			name: event.name,
+			commonDir: checkout.commonDir
+		}]
+	} : EMPTY_SESSION_SCOPE;
+}
+async function verifyPullRequestEvent(directory, request, options) {
+	const facts = await loadCheckoutFacts(directory, options.env);
+	if (facts.checkout === null) return EMPTY_SESSION_SCOPE;
+	const repositories = new Set(facts.remotes.map((remote) => toRepositorySlug(remote.url)));
+	const addresses = collectPullRequestAddresses(request.resultText).filter((address) => repositories.has(address.repository));
+	const pulls = await Promise.all(addresses.map(async (address) => {
+		const pull = await options.readPullRequest(address.repository, address.number);
+		return pull !== null && pull.createdAt >= request.startedAt - FORGE_CLOCK_SKEW_MS ? [{
+			...address,
+			head: pull.head
+		}] : [];
+	}));
+	return {
+		...EMPTY_SESSION_SCOPE,
+		pullRequests: pulls.flat()
+	};
+}
+async function isBranchCreatedSince(commonDir, branch, since) {
+	const createdAt = await readBranchCreatedAt(commonDir, branch);
+	if (createdAt === null || createdAt < Math.floor(since / 1e3) * 1e3) return false;
+	const ref = await stat(join(commonDir, "refs", "heads", branch)).catch(() => null);
+	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
+}
+//#endregion
+//#region src/record-scope.ts
+async function recordScope(request, config, options = {}) {
+	const host = options.host ?? readHostEnvironment();
+	if (!Object.values(config.scopeSources ?? DEFAULT_SCOPE_SOURCES).some((source) => source.kind === "session")) return EMPTY_SESSION_SCOPE;
+	return await updateSessionScope(request, {
+		now: options.now ?? Date.now(),
+		stateDir: resolveXDGDir(host, "state"),
+		home: host.home,
+		env: host.env,
+		readPullRequest
+	});
+}
 //#endregion
 //#region src/request/action-request-schema.ts
 const userTaskSchema = strictObject({
@@ -8613,6 +9304,21 @@ function parseActionRequest(body) {
 	};
 }
 //#endregion
+//#region src/request/scope-record-request-schema.ts
+const scopeRecordRequestSchema = strictObject({
+	sessionID: string().min(1),
+	cwd: string().min(1),
+	startedAt: number().int().positive(),
+	command: string().min(1),
+	resultText: string()
+});
+//#endregion
+//#region src/request/parse-scope-record-request.ts
+function parseScopeRecordRequest(body) {
+	const parsed = scopeRecordRequestSchema.safeParse(body);
+	return parsed.success ? parsed.data : null;
+}
+//#endregion
 //#region src/request/render-verdict.ts
 function renderVerdict(verdict) {
 	const rendered = M(verdict).returnType().with({ kind: "allow" }, () => ({ decision: "allow" })).with({ kind: "deny" }, (denied) => ({
@@ -8622,4 +9328,4 @@ function renderVerdict(verdict) {
 	return JSON.stringify(rendered);
 }
 //#endregion
-export { resolveConfigPath as A, resolveStateDir as C, DEFAULT_SCOPE_SOURCES as D, DEFAULT_DENIAL_BUDGET as E, string as F, PRESETS as M, number as N, loadConfig as O, strictObject as P, tryClassifyEdit as S, DEFAULT_CONFIG as T, checkContainment as _, loadSessionScope as a, splitCommandWords as b, classifyLocally as c, sendDecision as d, loadRepositoryContext as f, loadPolicy as g, buildDecisionRequest as h, resolveSessionScopePath as i, readHostEnvironment as j, resolveApiKey as k, classifyWithModel as l, DecisionRequestError as m, parseActionRequest as n, EMPTY_SESSION_SCOPE as o, loadCheckoutRemotes as p, classifyAction as r, buildTaskScope as s, renderVerdict as t, parseModelVerdict as u, toRepositorySlug as v, findCheckout as w, loadClaudeSettings as x, splitShellCommand as y };
+export { readHostEnvironment as C, resolveConfigPath as S, resolveXDGDir as T, tryClassifyEdit as _, classifyAction as a, loadConfig as b, classifyWithModel as c, DecisionRequestError as d, buildDecisionRequest as f, loadClaudeSettings as g, checkContainment as h, recordScope as i, parseModelVerdict as l, writeActionDiagnostic as m, parseScopeRecordRequest as n, buildTaskScope as o, loadPolicy as p, parseActionRequest as r, classifyLocally as s, renderVerdict as t, sendDecision as u, findGitEntry as v, PRESETS as w, resolveApiKey as x, DEFAULT_CONFIG as y };