auto-mode 0.19.2 → 0.20.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as readHostEnvironment, T as resolveXDGDir, a as classifyAction, b as loadConfig, i as recordScope, m as writeActionDiagnostic, n as parseScopeRecordRequest, p as loadPolicy, r as parseActionRequest, t as renderVerdict, v as findGitEntry } from "./render-verdict-DBcgB5CC.js";
+import { C as readHostEnvironment, T as resolveXDGDir, a as classifyAction, b as loadConfig, i as recordScope, m as writeActionDiagnostic, n as parseScopeRecordRequest, p as loadPolicy, r as parseActionRequest, t as renderVerdict, v as findGitEntry } from "./render-verdict-0NxrIuIc.js";
 import { chmod, mkdir, open, realpath, stat } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";

package/dist/index.d.ts

@@ -37,8 +37,18 @@ interface MCPServerFact {
   readonly transport: 'stdio' | 'http' | 'sse' | 'ws';
   readonly host: string | null;
 }
+interface NamedTarget {
+  readonly kind: string;
+  readonly target: string;
+  readonly namedAs: string;
+}
+interface ContainmentEvidence {
+  readonly reason: string;
+  readonly targets: readonly NamedTarget[];
+}
 interface JudgeEvidence extends DeniedRule {
   readonly repositoryContext: RepositoryContext | null;
+  readonly containment?: ContainmentEvidence | undefined;
 }
 //#endregion
 //#region src/config/types.d.ts
@@ -4629,6 +4639,7 @@ interface ActionOutcome {
   readonly unavailable?: boolean;
   readonly diagnostics?: DecisionDiagnostics;
   readonly judge?: JudgeDiagnostics;
+  readonly grant?: JudgeDiagnostics;
   readonly denials?: {
     readonly consecutive: number;
     readonly session: number;
@@ -4648,9 +4659,16 @@ export declare function classifyAction(request: ActionRequest, config: Config$1,
 export declare function loadClaudeRules(path: string | null | undefined, host: Readonly<HostEnvironment>): Promise<ClaudeRules>;
 //#endregion
 //#region src/containment/collect-scope-findings.d.ts
+type ScopeGrant = {
+  readonly kind: 'path' | 'branch';
+} | {
+  readonly kind: 'pull-request';
+  readonly number: number;
+};
 interface ScopeFinding {
-  readonly kind: 'path' | 'branch' | 'remote-write' | 'credential' | 'prune';
+  readonly kind: 'path' | 'branch' | 'remote-write' | 'credential' | 'prune' | 'discard';
   readonly target: string;
+  readonly grant?: ScopeGrant;
 }
 //#endregion
 //#region src/containment/check-containment.d.ts

package/dist/index.js

@@ -1,4 +1,4 @@
-import { S as resolveConfigPath, _ as tryClassifyEdit, a as classifyAction, b as loadConfig, c as classifyWithModel, d as DecisionRequestError, f as buildDecisionRequest, g as loadClaudeSettings, h as checkContainment, i as recordScope, l as parseModelVerdict, n as parseScopeRecordRequest, o as buildTaskScope, p as loadPolicy, r as parseActionRequest, s as classifyLocally, t as renderVerdict, u as sendDecision, w as PRESETS, x as resolveApiKey, y as DEFAULT_CONFIG } from "./render-verdict-DBcgB5CC.js";
+import { S as resolveConfigPath, _ as tryClassifyEdit, a as classifyAction, b as loadConfig, c as classifyWithModel, d as DecisionRequestError, f as buildDecisionRequest, g as loadClaudeSettings, h as checkContainment, i as recordScope, l as parseModelVerdict, n as parseScopeRecordRequest, o as buildTaskScope, p as loadPolicy, r as parseActionRequest, s as classifyLocally, t as renderVerdict, u as sendDecision, w as PRESETS, x as resolveApiKey, y as DEFAULT_CONFIG } from "./render-verdict-0NxrIuIc.js";
 //#region src/config/load-claude-rules.ts
 async function loadClaudeRules(path, host) {
 	return (await loadClaudeSettings(path, host)).rules;

package/dist/{render-verdict-DBcgB5CC.js → render-verdict-0NxrIuIc.js}

@@ -6032,6 +6032,11 @@ async function tryClassifyEdit(request, scope, host, reader = {}) {
 	}
 }
 //#endregion
+//#region mods/auto-mode/contract/find-current-direct-user-message.ts
+function findCurrentDirectUserMessage(message) {
+	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
+}
+//#endregion
 //#region src/budget/build-retry-key.ts
 const DESCRIPTIVE_FIELDS = { Bash: [
 	"description",
@@ -6556,13 +6561,14 @@ const CREDENTIAL_PATHS = [
 	".config/gh"
 ];
 function collectPathFindings(path, scope, scratchPaths) {
-	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
+	if (CREDENTIAL_PATHS.some((entry) => isUnder$1(path, join(scope.home, entry)))) return [{
 		kind: "credential",
 		target: path
 	}];
 	return isInScope(path, scope, scratchPaths) ? [] : [{
 		kind: "path",
-		target: path
+		target: path,
+		grant: { kind: "path" }
 	}];
 }
 function collectToolFindings(action, scope) {
@@ -6572,7 +6578,15 @@ function collectToolFindings(action, scope) {
 	const owner = action.input["owner"];
 	const name = action.input["repo"];
 	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
-	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+	if (!verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope)) return [];
+	return typeof number === "number" ? [{
+		kind: "remote-write",
+		target: action.tool,
+		grant: {
+			kind: "pull-request",
+			number
+		}
+	}] : [{
 		kind: "remote-write",
 		target: action.tool
 	}];
@@ -6593,13 +6607,120 @@ const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
 ]);
 function collectCommandFindings(command, cwd, scope, scratchPaths) {
 	const findings = [];
-	for (const entry of collectShellCommands(command, cwd, scope.home)) {
+	const entries = collectShellCommands(command, cwd, scope.home);
+	const piped = collectPipedSegments(command);
+	const segments = splitShellCommand(command).segments;
+	for (const [index, entry] of entries.entries()) {
 		const [name, ...args] = entry.words;
+		const fixed = findFixedXargsCommand(entry.words, segments[index]?.text ?? "");
+		if (fixed !== null) findings.push(...collectProgramFindings(fixed.name, fixed.args, entry.directory, cwd, scope, scratchPaths));
+		else if (isBranchSweep(entries.slice(0, index + 1), piped.slice(0, index + 1))) findings.push({
+			kind: "discard",
+			target: "git branch delete by exclusion"
+		});
 		for (const target of entry.writeTargets) findings.push(...collectTargetFindings(entry.directory, target, scope, scratchPaths));
 		if (name !== void 0 && name !== "cd") findings.push(...collectProgramFindings(name, args, entry.directory, cwd, scope, scratchPaths));
 	}
 	return findings;
 }
+function collectPipedSegments(command) {
+	const piped = [];
+	let separator = null;
+	let isInSegment = false;
+	for (const token of splitShellTokens(command).tokens) if (token.kind === "separator") {
+		separator = token.operator;
+		isInSegment = false;
+	} else if (!isInSegment) {
+		piped.push(separator === "|");
+		isInSegment = true;
+	}
+	return piped;
+}
+const XARGS_FLAG = /^(?:-[0oprtx]+|--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty))$/u;
+const XARGS_VALUE_OPTION = /^-[EPads]$/u;
+const XARGS_ATTACHED_VALUE = /^(?:-[EPads].|--(?:eof|max-procs|delimiter|arg-file|max-chars|process-slot-var)=)/u;
+const XARGS_REPLACE = /^(?:-I(?<attached>.+)|-i(?<short>.*)|--replace(?:=(?<long>.*))?)$/u;
+const PLAIN_WORD = /^(?:[\w./:@%+=-]|\{\})+$/u;
+function findFixedXargsCommand(words, text) {
+	if (words[0] !== "xargs" || !splitShellTokens(text).tokens.every((token) => token.kind !== "word" || token.raw === token.value && PLAIN_WORD.test(token.value))) return null;
+	let token = null;
+	let start = 1;
+	while (words[start]?.startsWith("-") === true) {
+		const word = words[start] ?? "";
+		const replace = XARGS_REPLACE.exec(word)?.groups;
+		if (word === "--") {
+			start += 1;
+			break;
+		}
+		if (word === "-I") {
+			token = words[start + 1] ?? null;
+			start += 2;
+		} else if (replace !== void 0) {
+			const short = replace["short"];
+			token = replace["attached"] ?? replace["long"] ?? (short === void 0 || short === "" ? "{}" : short);
+			start += 1;
+		} else if (word.startsWith("-J")) {
+			token = null;
+			start += word === "-J" ? 2 : 1;
+		} else if (XARGS_VALUE_OPTION.test(word)) start += 2;
+		else if (XARGS_FLAG.test(word) || XARGS_ATTACHED_VALUE.test(word)) start += 1;
+		else return null;
+	}
+	const [name, ...args] = words.slice(start);
+	if (token === null || token === "" || name === void 0 || [name, ...args].some((word) => word.includes(token))) return null;
+	return {
+		name,
+		args
+	};
+}
+const XARGS_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-I",
+	"-J",
+	"-L",
+	"-n",
+	"-P",
+	"-s",
+	"-d",
+	"-E"
+]);
+function isBranchSweep(entries, piped) {
+	const deleter = entries.at(-1)?.words ?? [];
+	if (deleter[0] !== "xargs" || piped.at(-1) !== true) return false;
+	let start = 1;
+	while (deleter[start]?.startsWith("-") === true) {
+		if (/^(?:-a|--arg-file)/u.test(deleter[start] ?? "")) return false;
+		start += XARGS_VALUE_OPTIONS.has(deleter[start] ?? "") ? 2 : 1;
+	}
+	const [program, subcommand, ...rest] = deleter.slice(start);
+	if (program !== "git" || subcommand !== "branch" || !rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) return false;
+	let first = entries.length - 2;
+	while (first > 0 && piped[first] === true) first -= 1;
+	const [listing, ...filters] = entries.slice(first, -1).map((entry) => entry.words);
+	return listing !== void 0 && isWholeBranchListing(listing) && filters.every((filter) => isExcludingFilter(filter));
+}
+function isWholeBranchListing(words) {
+	const [program, subcommand, ...rest] = words;
+	if (program !== "git") return false;
+	if (subcommand === "branch") return rest.every((word) => /^(?:-a|-r|-v|-vv|--all|--remotes|--no-color|--format=.*)$/u.test(word));
+	if (subcommand !== "for-each-ref") return false;
+	return rest.filter((_word, index) => !/^--(?:format|sort)$/u.test(rest[index - 1] ?? "")).every((word) => /^--(?:format|sort)(?:=.*)?$/u.test(word) || /^refs\/heads\/?$/u.test(word));
+}
+const NAME_EDITORS = /* @__PURE__ */ new Set([
+	"tr",
+	"cut",
+	"sort"
+]);
+function isExcludingFilter(words) {
+	const [program, ...args] = words;
+	if (program === "grep" || program === "egrep") return args.some((word) => /^-[a-zA-Z]*v[a-zA-Z]*$|^--invert-match$/u.test(word));
+	if (program === "sed") return isSubstitutionOnly(args);
+	if (program === "uniq") return args.every((word) => !/^-[a-zA-Z]*[dDu]/u.test(word));
+	return program !== void 0 && NAME_EDITORS.has(program);
+}
+function isSubstitutionOnly(args) {
+	const scripts = args.filter((word) => word !== "-e" && word !== "-E" && word !== "-r");
+	return scripts.length > 0 && scripts.every((script) => /^s(?<delimiter>[^\w\s;])(?:(?!\k<delimiter>).)*\k<delimiter>(?:(?!\k<delimiter>).)*\k<delimiter>g?$/u.test(script));
+}
 function collectProgramFindings(name, args, directory, cwd, scope, scratchPaths) {
 	const resolve = (path) => collectTargetFindings(directory, path, scope, scratchPaths);
 	const operands = args.filter((word) => !word.startsWith("-"));
@@ -6754,7 +6875,13 @@ function collectGitFindings(args, directory, cwd, scope, scratchPaths) {
 	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope, scratchPaths));
 	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
 		kind: "branch",
-		target: branch
+		target: branch,
+		grant: { kind: "branch" }
+	});
+	const [resetTarget] = operands;
+	if (subcommand === "reset" && rest.includes("--hard") && resetTarget !== void 0 && resetTarget !== "HEAD" && resetTarget !== "@" && !isUnresolvedWord(resetTarget)) findings.push({
+		kind: "discard",
+		target: `git reset --hard ${resetTarget}`
 	});
 	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
 	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
@@ -6784,7 +6911,8 @@ function collectPushFindings(rest, operands, currentBranch, scope) {
 		const branch = named === "HEAD" ? currentBranch : named;
 		if (branch !== null && !isUnresolvedWord(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
 			kind: "branch",
-			target: branch
+			target: branch,
+			grant: { kind: "branch" }
 		});
 	}
 	return findings;
@@ -6829,10 +6957,19 @@ function collectGhFindings(args, scope) {
 	const group = args[0] ?? "";
 	const verb = args[1] ?? "";
 	if (group === "pr" && GH_PR_WRITES.has(verb)) {
-		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
-		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
-		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
-		return verb !== "merge" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+		const pull = findPullRequestSelector(verb, args.slice(2));
+		const number = pull?.number ?? NaN;
+		const isOwned = verb !== "merge" && isOwnedPullRequest(number, pull?.repo, scope);
+		const isAdmin = args.some((word) => /^--admin(?:=|$)/u.test(word));
+		if (isOwned) return [];
+		return Number.isInteger(number) && !isAdmin ? [{
+			kind: "remote-write",
+			target: `gh pr ${verb}`,
+			grant: {
+				kind: "pull-request",
+				number
+			}
+		}] : [{
 			kind: "remote-write",
 			target: `gh pr ${verb}`
 		}];
@@ -6860,6 +6997,79 @@ function collectGhFindings(args, scope) {
 	}];
 	return [];
 }
+const GH_PR_VALUE_OPTIONS = {
+	comment: /* @__PURE__ */ new Set([
+		"-b",
+		"--body",
+		"-F",
+		"--body-file",
+		"--attach"
+	]),
+	merge: /* @__PURE__ */ new Set([
+		"-A",
+		"--author-email",
+		"-b",
+		"--body",
+		"-F",
+		"--body-file",
+		"--match-head-commit",
+		"-t",
+		"--subject"
+	]),
+	edit: /* @__PURE__ */ new Set([
+		"--add-assignee",
+		"--add-label",
+		"--add-project",
+		"--add-reviewer",
+		"--attach",
+		"-B",
+		"--base",
+		"-b",
+		"--body",
+		"-F",
+		"--body-file",
+		"-m",
+		"--milestone",
+		"--remove-assignee",
+		"--remove-label",
+		"--remove-project",
+		"--remove-reviewer",
+		"-t",
+		"--title"
+	]),
+	close: /* @__PURE__ */ new Set(["-c", "--comment"]),
+	review: /* @__PURE__ */ new Set([
+		"-b",
+		"--body",
+		"-F",
+		"--body-file"
+	]),
+	ready: /* @__PURE__ */ new Set(),
+	reopen: /* @__PURE__ */ new Set(["-c", "--comment"])
+};
+const GH_REPO_OPTIONS = /* @__PURE__ */ new Set(["-R", "--repo"]);
+function findPullRequestSelector(verb, args) {
+	const valueOptions = GH_PR_VALUE_OPTIONS[verb] ?? /* @__PURE__ */ new Set();
+	let repo;
+	let selector;
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index] ?? "";
+		if (GH_REPO_OPTIONS.has(word)) repo = args[index + 1];
+		else if (word.startsWith("--repo=")) repo = word.slice(7);
+		if (GH_REPO_OPTIONS.has(word) || valueOptions.has(word)) index += 1;
+		else if (selector === void 0 && !word.startsWith("-")) selector = word;
+	}
+	if (selector === void 0) return null;
+	const url = /^https?:\/\/(?<repo>[^/]+\/[^/]+\/[^/]+)\/pull\/(?<number>\d+)(?:[/?#]|$)/u.exec(selector)?.groups;
+	if (url !== void 0) return {
+		number: Number(url["number"]),
+		repo: url["repo"]
+	};
+	return {
+		number: /^#?\d+$/u.test(selector) ? Number(selector.replace("#", "")) : null,
+		repo
+	};
+}
 function isOwnedPullRequest(number, repo, scope) {
 	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
 	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
@@ -6934,14 +7144,14 @@ function collectInPlaceFiles(args) {
 	return files;
 }
 function isInScope(path, scope, scratchPaths) {
-	if (scratchPaths.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+	if (scratchPaths.some((entry) => isUnder$1(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
 	return scope.worktrees.some((worktree) => {
-		const isNested = isUnder(path, join(worktree, ".worktrees"));
-		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
-		return isUnder(path, worktree) && (!isNested || isOtherOwned);
+		const isNested = isUnder$1(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder$1(path, other));
+		return isUnder$1(path, worktree) && (!isNested || isOtherOwned);
 	});
 }
-function isUnder(path, root) {
+function isUnder$1(path, root) {
 	return path === root || path.startsWith(`${root}/`);
 }
 //#endregion
@@ -6965,27 +7175,103 @@ const KIND_LABELS = {
 	branch: "branch",
 	"remote-write": "remote target",
 	credential: "credential or global setting",
-	prune: "shared resource"
+	prune: "shared resource",
+	discard: "discarded work"
 };
 function formatContainmentReason(findings, scope) {
 	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
 	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
 	const branches = scope.branches.length === 0 ? "" : ` and ${formatList("branch", "branches", scope.branches)}`;
-	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`${formatList("worktree", "worktrees", scope.worktrees)}${branches}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
+	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`${formatList("worktree", "worktrees", scope.worktrees)}${branches}`}. ${formatAdvice(findings)}`;
+}
+const DISCARD_ADVICE = "A hard reset onto another commit, or a branch deletion that names no branch, discards commits and changes the task may not have made. Sync a branch with git merge --ff-only or git rebase, and delete branches by name, or ask the user to run this action.";
+const SCOPE_ADVICE = "Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.";
+function formatAdvice(findings) {
+	const discards = findings.filter((finding) => finding.kind === "discard").length;
+	if (discards === 0) return SCOPE_ADVICE;
+	return discards === findings.length ? DISCARD_ADVICE : `${DISCARD_ADVICE} ${SCOPE_ADVICE}`;
 }
 function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region src/scope/protected-branch-names.ts
+const PROTECTED_BRANCH_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
+]);
+//#endregion
+//#region src/containment/find-user-named-grant.ts
+function findUserNamedGrant(findings, message, context) {
+	const words = splitMessageWords(message);
+	const named = [];
+	for (const finding of findings) {
+		const namedAs = findNamingWord(finding, words, context);
+		if (namedAs === null) return null;
+		named.push({
+			kind: finding.kind,
+			target: finding.target,
+			namedAs
+		});
+	}
+	return named.length === 0 ? null : named;
+}
+function splitMessageWords(message) {
+	return [...[...message.matchAll(/(?<quote>["'`])(?<text>[^"'`\n]+?)\k<quote>/gu)].map((match) => match.groups?.["text"] ?? ""), ...message.split(/[\s"'`()<>[\]{},;*]+/u)].map((word) => word.trim().replace(/[.:!?]+$/u, "")).filter((word) => word !== "");
+}
+function findNamingWord(finding, words, context) {
+	const grant = finding.grant;
+	if (grant === void 0) return null;
+	if (grant.kind === "pull-request") return findPullRequestWord(grant.number, words);
+	if (grant.kind === "path") return findPathWord(finding.target, words, context.home);
+	if (PROTECTED_BRANCH_NAMES.has(finding.target) || finding.target === context.defaultBranch) return null;
+	return words.find((word) => word === finding.target) ?? null;
+}
+const PULL_REQUEST_NOUNS = /^(?:pr|pull|request)$/iu;
+function findPullRequestWord(number, words) {
+	for (const [index, word] of words.entries()) {
+		if (word === `#${number}` || new RegExp(`^(?:pr|pull)#?${number}$`, "iu").test(word) || word.endsWith(`/pull/${number}`)) return word;
+		const previous = words[index - 1] ?? "";
+		if (word === String(number) && PULL_REQUEST_NOUNS.test(previous)) return `${previous} ${word}`;
+	}
+	return null;
+}
+function findPathWord(path, words, home) {
+	const worktree = findWorktreeName(path);
+	for (const word of words) {
+		if (worktree !== null && word.split("/").includes(worktree)) return word;
+		const named = resolveMessagePath(word, home);
+		if (named !== null && isUnder(path, named) && !isUnder(home, named) && findWorktreeName(named) === worktree) return word;
+	}
+	return null;
+}
+function findWorktreeName(path) {
+	return [...path.matchAll(/\/\.(?:claude\/)?worktrees\/(?<name>[^/]+)/gu)].at(-1)?.groups?.["name"] ?? null;
+}
+function resolveMessagePath(word, home) {
+	const expanded = word.startsWith("~/") ? join(home, word.slice(2)) : word;
+	if (!expanded.startsWith("/")) return null;
+	const path = normalize(expanded);
+	return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
+function isUnder(path, root) {
+	return path === root || root === "/" || path.startsWith(`${root}/`);
+}
+//#endregion
 //#region src/diagnostics/write-action-diagnostic.ts
 async function writeActionDiagnostic(payload, entry, host, warnings) {
 	const path = host.env["AUTO_MODE_DIAGNOSTICS_PATH"] ?? join(resolveXDGDir(host, "state"), "actions.jsonl");
 	if (path === "") return;
+	const agentID = payload.decisionContext?.agentID ?? null;
+	const agentKey = agentID === null ? payload.sessionID : `${payload.sessionID}\0${agentID}`;
 	const record = {
-		schemaVersion: 4,
+		schemaVersion: 6,
 		time: (/* @__PURE__ */ new Date()).toISOString(),
 		invocationID: entry.invocationID,
 		sessionHash: toHash(payload.sessionID),
+		agentHash: toHash(agentKey),
 		actionHash: payload.toolUseID === void 0 ? null : toHash(payload.toolUseID),
 		status: entry.status,
 		verdict: entry.verdict ?? null,
@@ -6993,7 +7279,8 @@ async function writeActionDiagnostic(payload, entry, host, warnings) {
 		denials: entry.denials ?? null,
 		escalation: entry.escalation ?? false,
 		diagnostics: entry.diagnostics ?? null,
-		judge: entry.judge ?? null
+		judge: entry.judge ?? null,
+		grant: entry.grant ?? null
 	};
 	try {
 		await mkdir(dirname(path), {
@@ -7009,6 +7296,52 @@ function toHash(value) {
 	return createHash("sha256").update(value).digest("hex").slice(0, 16);
 }
 //#endregion
+//#region src/git/build-repository-context.ts
+function buildRepositoryContext(facts) {
+	if (facts.head === null) return null;
+	return {
+		cwd: facts.cwd,
+		branch: facts.head.branch,
+		defaultBranch: facts.head.defaultBranch,
+		remotes: facts.remotes.flatMap((remote) => {
+			const url = normalizeRemoteURL(remote.url);
+			return url === null ? [] : [{
+				name: remote.name,
+				url
+			}];
+		})
+	};
+}
+function normalizeRemoteURL(url) {
+	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
+		const parsed = URL.parse(url);
+		if (parsed === null) return null;
+		parsed.username = "";
+		parsed.password = "";
+		parsed.search = "";
+		parsed.hash = "";
+		return parsed.href;
+	}
+	const slash = url.indexOf("/");
+	const end = slash === -1 ? url.length : slash;
+	const at = url.lastIndexOf("@", end);
+	return at === -1 ? url : url.slice(at + 1);
+}
+//#endregion
+//#region src/git/build-repository-evidence.ts
+function buildRepositoryEvidence(facts, taskScope) {
+	const context = buildRepositoryContext(facts);
+	if (taskScope === void 0) return context;
+	return {
+		...context ?? {
+			cwd: facts.cwd,
+			branch: null,
+			defaultBranch: null
+		},
+		taskScope
+	};
+}
+//#endregion
 //#region src/git/load-checkout-remotes.ts
 async function loadCheckoutRemotes(commonDir) {
 	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
@@ -7083,11 +7416,6 @@ function parseReference(content, prefix) {
 	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
 }
 //#endregion
-//#region mods/auto-mode/contract/find-current-direct-user-message.ts
-function findCurrentDirectUserMessage(message) {
-	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
-}
-//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir(startDir = import.meta.dirname, stopDir = parse(startDir).root) {
 	let dir = startDir;
@@ -7121,6 +7449,10 @@ function buildJudgeMessage(input) {
 			text: input.rule.text
 		},
 		action: input.action,
+		...input.containment === void 0 ? {} : {
+			containment: input.containment.reason,
+			namedTargets: input.containment.targets
+		},
 		lastDirectUserMessage: input.lastUserMessage,
 		repository: input.repositoryContext
 	};
@@ -7496,11 +7828,11 @@ function getReasonTemplate(rule) {
 		clears: "The replacement policy defines what clears it."
 	})).exhaustive();
 }
-function buildJudgedVerdict(rule, basis, reply, overturns) {
+function buildJudgedVerdict(rule, basis, reply, overturns, heldReason) {
 	const template = {
 		kind: "deny",
 		rule: rule.name,
-		reason: buildDenyReason(rule, basis)
+		reason: heldReason ?? buildDenyReason(rule, basis)
 	};
 	if (reply === null || reply.kind === "unreadable") return {
 		verdict: template,
@@ -7696,6 +8028,7 @@ async function sendJudgeMessage(provider, request, transport, signal) {
 async function classifyWithJudge(payload, evidence, judge, options) {
 	const start = performance.now();
 	const now = options.now ?? Date.now;
+	const overturns = evidence.containment === void 0 ? options.overturns : "consent";
 	let failure = null;
 	let verdict;
 	try {
@@ -7714,7 +8047,8 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 				input: payload.toolInput
 			},
 			lastUserMessage: directMessage,
-			repositoryContext: evidence.repositoryContext
+			repositoryContext: evidence.repositoryContext,
+			containment: evidence.containment
 		});
 		const remainingMs = options.deadlineAt === void 0 ? judge.timeoutMs : options.deadlineAt - now();
 		failure = "timeout";
@@ -7733,9 +8067,9 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 			throw error;
 		}));
 		failure = reply.kind === "unreadable" ? "unreadable" : null;
-		verdict = buildJudgedVerdict(evidence.rule, evidence.basis, reply, options.overturns);
+		verdict = buildJudgedVerdict(evidence.rule, evidence.basis, reply, overturns, evidence.containment?.reason);
 	} catch {
-		verdict = buildJudgedVerdict(evidence.rule, evidence.basis, null, options.overturns);
+		verdict = buildJudgedVerdict(evidence.rule, evidence.basis, null, overturns, evidence.containment?.reason);
 	}
 	return {
 		...verdict,
@@ -7763,52 +8097,6 @@ function buildTaskScopeSummary(scope) {
 	};
 }
 //#endregion
-//#region src/git/build-repository-context.ts
-function buildRepositoryContext(facts) {
-	if (facts.head === null) return null;
-	return {
-		cwd: facts.cwd,
-		branch: facts.head.branch,
-		defaultBranch: facts.head.defaultBranch,
-		remotes: facts.remotes.flatMap((remote) => {
-			const url = normalizeRemoteURL(remote.url);
-			return url === null ? [] : [{
-				name: remote.name,
-				url
-			}];
-		})
-	};
-}
-function normalizeRemoteURL(url) {
-	if (/^[a-z][a-z0-9+.-]*:\/\//iu.test(url)) {
-		const parsed = URL.parse(url);
-		if (parsed === null) return null;
-		parsed.username = "";
-		parsed.password = "";
-		parsed.search = "";
-		parsed.hash = "";
-		return parsed.href;
-	}
-	const slash = url.indexOf("/");
-	const end = slash === -1 ? url.length : slash;
-	const at = url.lastIndexOf("@", end);
-	return at === -1 ? url : url.slice(at + 1);
-}
-//#endregion
-//#region src/git/build-repository-evidence.ts
-function buildRepositoryEvidence(facts, taskScope) {
-	const context = buildRepositoryContext(facts);
-	if (taskScope === void 0) return context;
-	return {
-		...context ?? {
-			cwd: facts.cwd,
-			branch: null,
-			defaultBranch: null
-		},
-		taskScope
-	};
-}
-//#endregion
 //#region src/git/load-mcp-servers.ts
 const serverSchema = looseObject({
 	type: string().optional(),
@@ -8365,6 +8653,11 @@ function toMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region src/policy/read-containment-rule.ts
+async function readContainmentRule(policyDir = resolveShippedPolicyDir()) {
+	return (await readFile(join(policyDir, "containment.md"), "utf8")).trim();
+}
+//#endregion
 //#region src/policy/read-denial-guidance.ts
 async function readDenialGuidance(policyDir = resolveShippedPolicyDir()) {
 	return (await readFile(join(policyDir, "denial.md"), "utf8")).trim();
@@ -8564,7 +8857,7 @@ function mergeScopeFacts(all) {
 //#region src/scope/build-task-scope.ts
 function buildTaskScope(input) {
 	const merged = mergeScopeFacts(input.facts);
-	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && PROTECTED_BRANCH_NAMES.has(branch)));
 	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
 	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
 		number: pull.number,
@@ -8580,12 +8873,6 @@ function buildTaskScope(input) {
 		pathGlobs: merged.pathGlobs
 	};
 }
-const DEFAULT_NAMES = /* @__PURE__ */ new Set([
-	"main",
-	"master",
-	"trunk",
-	"develop"
-]);
 //#endregion
 //#region src/scope/build-atc-scope-facts.ts
 function buildAtcScopeFacts(record, isInRepository) {
@@ -8818,7 +9105,8 @@ async function classifyAction(request, config, options = {}) {
 		...outcome.denials === void 0 ? {} : { denials: outcome.denials },
 		...outcome.escalation === void 0 ? {} : { escalation: outcome.escalation },
 		...outcome.diagnostics === void 0 ? {} : { diagnostics: outcome.diagnostics },
-		...outcome.judge === void 0 ? {} : { judge: outcome.judge }
+		...outcome.judge === void 0 ? {} : { judge: outcome.judge },
+		...outcome.grant === void 0 ? {} : { grant: outcome.grant }
 	}, host, stderr);
 	return outcome;
 }
@@ -8874,17 +9162,51 @@ async function classifyStages(request, config, options) {
 		findCheckout: findActionCheckout
 	}, config, host, options.stderr);
 	const containment = scope === null ? null : checkContainment(request, scope, host.scratchPaths);
-	if (containment !== null) {
-		const guidance = await tryReadDenialGuidance();
+	const stageOptions = {
+		...options,
+		claudeSettings,
+		findCheckout: findActionCheckout
+	};
+	const facts = {
+		local,
+		scope,
+		checkout,
+		hasConfiguredDenies
+	};
+	if (scope === null || containment === null) return classifyPastContainment(request, config, stageOptions, facts);
+	const containmentNote = `denied by the containment check: ${containment.findings.map((finding) => finding.target).join(", ")}`;
+	const [grant, guidance] = await Promise.all([classifyUserNamedGrant(request, config, options, {
+		containment,
+		scope,
+		checkout
+	}), tryReadDenialGuidance()]);
+	if (grant === null || grant.verdict.kind === "deny") {
+		const deny = grant?.verdict.kind === "deny" ? grant.verdict : {
+			rule: containment.rule,
+			reason: containment.reason
+		};
 		return {
-			verdict: buildGuidedDeny(containment.rule, containment.reason, guidance),
+			verdict: buildGuidedDeny(deny.rule, deny.reason, guidance),
 			decidingStage: "containment",
-			note: `denied by the containment check: ${containment.findings.map((finding) => finding.target).join(", ")}`,
-			status: "deny"
+			note: grant === null ? containmentNote : `${containmentNote}; judge ${grant.status} (${grant.diagnostics.elapsedMs}ms)`,
+			status: "deny",
+			...grant === null ? {} : { grant: grant.diagnostics }
 		};
 	}
-	if (local.kind === "allow") return buildLocalAllow(local.exception);
-	const edit = hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope, host, { findCheckout: findActionCheckout });
+	const outcome = await classifyPastContainment(request, config, stageOptions, facts);
+	return {
+		...outcome,
+		note: `containment cleared by the judge for the targets the user named (${grant.diagnostics.elapsedMs}ms); ${outcome.note}`,
+		grant: grant.diagnostics
+	};
+}
+async function classifyPastContainment(request, config, options, facts) {
+	const host = options.host;
+	const scope = facts.scope;
+	const findActionCheckout = options.findCheckout;
+	const claudeSettings = options.claudeSettings;
+	if (facts.local.kind === "allow") return buildLocalAllow(facts.local.exception);
+	const edit = facts.hasConfiguredDenies || scope === null ? null : await tryClassifyEdit(request, scope, host, { findCheckout: findActionCheckout });
 	if (edit?.kind === "bypass") return {
 		verdict: { kind: "allow" },
 		decidingStage: "bypass",
@@ -8903,7 +9225,7 @@ async function classifyStages(request, config, options) {
 		taskScope,
 		host,
 		claudeSettings,
-		checkout: checkout ?? void 0,
+		checkout: facts.checkout ?? void 0,
 		findCheckout: findActionCheckout
 	}), tryReadDenialGuidance()]);
 	const judge = config.judge ?? null;
@@ -8933,6 +9255,37 @@ async function classifyStages(request, config, options) {
 	};
 }
 const READ_ONLY_EXCEPTION = "Read-only actions";
+async function classifyUserNamedGrant(request, config, options, facts) {
+	const containment = facts.containment;
+	const judge = config.judge ?? null;
+	const message = findCurrentDirectUserMessage(request.decisionContext?.lastDirectUserMessage);
+	if (judge === null || message === null || options.localOnly === true) return null;
+	const targets = findUserNamedGrant(containment.findings, message, {
+		home: facts.scope.home,
+		defaultBranch: facts.checkout?.head?.defaultBranch ?? null
+	});
+	if (targets === null) return null;
+	const text = await readContainmentRule().catch(() => null);
+	if (text === null) return null;
+	return classifyWithJudge(request, {
+		rule: {
+			name: containment.rule,
+			tier: "soft",
+			source: "shipped",
+			text
+		},
+		basis: "matched",
+		repositoryContext: facts.checkout === null ? null : buildRepositoryEvidence(facts.checkout, buildTaskScopeSummary(facts.scope)),
+		containment: {
+			reason: containment.reason,
+			targets
+		}
+	}, judge, {
+		...options,
+		rulesPath: config.rulesPath,
+		overturns: "consent"
+	});
+}
 async function tryLoadTaskScope(request, config, host, stderr) {
 	try {
 		return await loadTaskScope({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",

package/policy/containment.md

@@ -0,0 +1,17 @@
+### Outside Task Scope
+Writing to a target the task does not own: a path outside the task's worktrees,
+a branch the task did not make, or a pull request the task did not open.
+auto-mode's containment check found each target. The evidence field
+`containment` holds the check's finding, which names every target and what the
+task owns, and `namedTargets`, which pairs each target with the word of the last
+direct user message that names it. The task scope is a fact the check read, not
+a reading of the action, so this rule never clears as a misread.
+
+A name alone is not consent. The message must ask for this operation — write,
+edit, create, delete, remove, move, push, merge, or comment — on every listed
+target. A target the message names only as a source to read, copy, port, or
+compare from, as a place to look, or as a reference is not consent. Neither is a
+request to check or report on it, a different or narrower operation on it, or a
+word that happens to match the target's name but means something else.
+
+**Must name:** the operation and every target.