auto-mode 0.21.0 → 1.0.0

package/dist/{render-verdict-CE3ojHJk.js → parse-action-request-i-A64CGg.js}

@@ -1,11 +1,51 @@
 import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
+import { createHash, randomUUID } from "node:crypto";
 import { appendFile, link, lstat, mkdir, readFile, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
+import { setTimeout } from "node:timers/promises";
 import { spawn } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
-import { createHash, randomUUID } from "node:crypto";
-import { setTimeout } from "node:timers/promises";
 import { existsSync } from "node:fs";
+//#region mods/auto-mode/contract/find-current-direct-user-message.ts
+function findCurrentDirectUserMessage(message) {
+	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
+}
+//#endregion
+//#region src/budget/build-retry-key.ts
+const DESCRIPTIVE_FIELDS = { Bash: [
+	"description",
+	"timeout",
+	"run_in_background"
+] };
+function buildRetryKey(request) {
+	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
+	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
+	const message = request.decisionContext?.lastDirectUserMessage ?? null;
+	const canonical = JSON.stringify(sortKeys({
+		cwd: request.cwd,
+		toolName: request.toolName,
+		toolInput: input,
+		lastDirectUserMessage: message?.text ?? null,
+		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
+	}));
+	return createHash("sha256").update(canonical).digest("hex");
+}
+function sortKeys(value) {
+	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
+	return value;
+}
+//#endregion
+//#region src/budget/find-retry-deny.ts
+function findRetryDeny(state, retryKey) {
+	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
+	return {
+		kind: "deny",
+		rule: state.lastDenied.rule,
+		reason: state.lastDenied.reason
+	};
+}
+//#endregion
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
 	const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -5530,6 +5570,196 @@ function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
 //#endregion
+//#region src/state/load-json-file.ts
+async function loadJSONFile(path, schema, fallback) {
+	try {
+		const text = await readFile(path, "utf8");
+		const parsed = schema.safeParse(JSON.parse(text));
+		return parsed.success ? parsed.data : fallback;
+	} catch {
+		return fallback;
+	}
+}
+//#endregion
+//#region src/budget/types.ts
+const EMPTY_DENIAL_STATE = {
+	consecutive: 0,
+	session: 0,
+	lastDenied: null
+};
+//#endregion
+//#region src/budget/load-denial-state.ts
+const count = number().int().nonnegative();
+const stateSchema$1 = strictObject({
+	consecutive: count,
+	session: count,
+	lastDenied: strictObject({
+		retryKey: string().min(1),
+		rule: string(),
+		reason: string()
+	}).nullable()
+});
+function loadDenialState(path) {
+	return loadJSONFile(path, stateSchema$1, EMPTY_DENIAL_STATE);
+}
+//#endregion
+//#region src/budget/plan-denial-budget.ts
+function planDenialBudget(state, verdict, retryKey, budget) {
+	if (verdict === null) return {
+		verdict: null,
+		state,
+		escalation: false
+	};
+	if (verdict.kind === "allow") return {
+		verdict,
+		state: {
+			...state,
+			consecutive: 0,
+			lastDenied: null
+		},
+		escalation: false
+	};
+	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
+		verdict: null,
+		state: EMPTY_DENIAL_STATE,
+		escalation: true
+	};
+	const next = {
+		consecutive: state.consecutive + 1,
+		session: state.session + 1,
+		lastDenied: {
+			retryKey,
+			rule: verdict.rule,
+			reason: verdict.reason
+		}
+	};
+	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
+	return {
+		verdict: {
+			...verdict,
+			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
+		},
+		state: next,
+		escalation: false
+	};
+}
+function formatDenialsLeft(left) {
+	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
+	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
+}
+//#endregion
+//#region src/budget/resolve-denial-state-path.ts
+function resolveDenialStatePath(request, stateDir) {
+	const agentID = request.decisionContext?.agentID ?? "";
+	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
+	return join(stateDir, "denials", `${key}.json`);
+}
+//#endregion
+//#region src/state/update-json-file.ts
+const SYSTEM_CLOCK = {
+	now: Date.now,
+	wait: (ms) => setTimeout(ms)
+};
+async function updateJSONFile(path, load, update, clock = SYSTEM_CLOCK) {
+	await mkdir(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const lock = `${path}.lock`;
+	const owner = await claimLock(lock, clock);
+	try {
+		const previous = await load(path);
+		const next = update(previous);
+		if (next !== previous) {
+			const staged = `${path}.${randomUUID()}.tmp`;
+			await writeFile(staged, `${JSON.stringify(next)}\n`, { mode: 384 });
+			await rename(staged, path);
+		}
+		return {
+			previous,
+			next
+		};
+	} finally {
+		await removeOwnLock(lock, owner);
+	}
+}
+const STALE_LOCK_MS = 1e4;
+const LOCK_WAIT_MS = 3e3;
+const LOCK_POLL_MS = 10;
+async function claimLock(lock, clock) {
+	const deadline = clock.now() + LOCK_WAIT_MS;
+	const owner = randomUUID();
+	const staged = `${lock}.${owner}`;
+	await writeFile(staged, owner, {
+		flag: "wx",
+		mode: 384
+	});
+	try {
+		for (;;) {
+			try {
+				await link(staged, lock);
+				return owner;
+			} catch (error) {
+				if (!hasErrorCode(error, "EEXIST")) throw error;
+			}
+			const held = await stat(lock).catch(() => null);
+			if (held !== null && isStale(held, clock)) {
+				if (await claimStaleLock(lock, staged, held, clock)) return owner;
+			}
+			if (clock.now() > deadline) throw new Error("state file lock unavailable");
+			await clock.wait(LOCK_POLL_MS);
+		}
+	} finally {
+		await rm(staged, { force: true });
+	}
+}
+function hasErrorCode(error, code) {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+function isStale(file, clock) {
+	return clock.now() - file.mtimeMs > STALE_LOCK_MS;
+}
+async function claimStaleLock(lock, staged, held, clock) {
+	const prefix = `${lock}.${String(held.ino)}-${String(held.mtimeMs)}`;
+	const generation = await claimTakeoverMarker(prefix, clock);
+	if (generation === null) return false;
+	try {
+		const current = await stat(lock).catch(() => null);
+		if (current?.ino !== held.ino || current.mtimeMs !== held.mtimeMs) return false;
+		await rename(staged, lock);
+		return true;
+	} finally {
+		await Promise.all(Array.from({ length: generation + 1 }, (_, index) => rm(buildTakeoverMarkerPath(prefix, index), { force: true })));
+	}
+}
+async function claimTakeoverMarker(prefix, clock) {
+	for (let generation = 0;; generation += 1) {
+		const marker = buildTakeoverMarkerPath(prefix, generation);
+		try {
+			await writeFile(marker, "", {
+				flag: "wx",
+				mode: 384
+			});
+			return generation;
+		} catch (error) {
+			if (!hasErrorCode(error, "EEXIST")) throw error;
+		}
+		const existing = await stat(marker).catch(() => null);
+		if (existing === null || !isStale(existing, clock)) return null;
+	}
+}
+function buildTakeoverMarkerPath(prefix, generation) {
+	return `${prefix}-${String(generation)}.takeover`;
+}
+async function removeOwnLock(lock, owner) {
+	if (await readFile(lock, "utf8").catch(() => null) === owner) await rm(lock, { force: true });
+}
+//#endregion
+//#region src/budget/update-denial-state.ts
+function updateDenialState(path, update, clock) {
+	return updateJSONFile(path, loadDenialState, update, clock);
+}
+//#endregion
 //#region src/state/resolve-xdg-dir.ts
 const BASE_DIRS = {
 	config: {
@@ -5547,6 +5777,12 @@ function resolveXDGDir(host, kind) {
 	const root = base === void 0 || base === "" ? join(host.home, ...dir.fallback) : base;
 	return join(root, "auto-mode");
 }
+const CLI_LIMITS = {
+	keyCommandMs: 5e3,
+	jevMs: 5e3,
+	judgeMs: 12e4,
+	evaluationMs: 265e3
+};
 //#endregion
 //#region src/config/presets.ts
 const MESSAGES_DEFAULTS = {
@@ -5556,32 +5792,34 @@ const MESSAGES_DEFAULTS = {
 	maxTokens: 3e3,
 	timeoutMs: 45e3
 };
+const JEV_PROVIDER = {
+	protocol: "system-one",
+	baseURL: "https://api.typesafe.ai",
+	model: "jev-1.13.0",
+	apiKeyEnv: "TYPESAFE_API_KEY",
+	reasoning: false,
+	maxTokens: 3e3,
+	timeoutMs: CLI_LIMITS.jevMs
+};
+const SPARK_PROVIDER = {
+	...MESSAGES_DEFAULTS,
+	baseURL: "https://api.meta.ai",
+	model: "muse-spark-1.3-contributor",
+	apiKeyEnv: "META_API_KEY",
+	maxTokens: 3e3,
+	timeoutMs: 45e3
+};
 const PRESETS = {
-	jev: {
-		protocol: "system-one",
-		baseURL: "https://api.typesafe.ai",
-		model: "jev-1.13.0",
-		apiKeyEnv: "TYPESAFE_API_KEY",
-		reasoning: false,
-		maxTokens: 3e3,
-		timeoutMs: 5e3
-	},
+	jev: JEV_PROVIDER,
 	"claude-code": {
 		protocol: "claude-code",
 		baseURL: "https://api.anthropic.com",
 		model: "claude-sonnet-5-5",
 		reasoning: false,
 		maxTokens: 3e3,
-		timeoutMs: 12e4
-	},
-	spark: {
-		...MESSAGES_DEFAULTS,
-		baseURL: "https://api.meta.ai",
-		model: "muse-spark-1.3-contributor",
-		apiKeyEnv: "META_API_KEY",
-		maxTokens: 3e3,
-		timeoutMs: 45e3
+		timeoutMs: CLI_LIMITS.judgeMs
 	},
+	spark: SPARK_PROVIDER,
 	claude: {
 		...MESSAGES_DEFAULTS,
 		model: "claude-haiku-4-5-20251001",
@@ -5670,7 +5908,7 @@ function toTimerDelay(ms) {
 }
 //#endregion
 //#region src/config/read-api-key-from-command.ts
-const KEY_COMMAND_TIMEOUT_MS = 5e3;
+const KEY_COMMAND_TIMEOUT_MS = CLI_LIMITS.keyCommandMs;
 const MAX_KEY_OUTPUT_BYTES = 65536;
 async function readApiKeyFromCommand(command, options = {}) {
 	const now = options.now ?? Date.now;
@@ -5763,6 +6001,7 @@ const denialBudgetSchema = strictObject({
 const configFileSchema = strictObject({
 	classifiers: record(text, unknown()).optional(),
 	scopeSources: record(text, unknown()).optional(),
+	protectedBranches: array(text).optional(),
 	decision: strictObject({
 		classifier: text.optional(),
 		judge: text.nullable().optional(),
@@ -5802,6 +6041,7 @@ function buildConfig(json, path, home) {
 		judge,
 		judgeOverturns: decision.judgeOverturns ?? "any",
 		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
+		...file.protectedBranches === void 0 ? {} : { protectedBranches: file.protectedBranches },
 		classifierPath: expandHomePath(policy.frameworkPath ?? void 0, home),
 		rulesPath: expandHomePath(policy.rulesPath ?? void 0, home),
 		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
@@ -6032,236 +6272,6 @@ async function tryClassifyEdit(request, scope, host, reader = {}) {
 	}
 }
 //#endregion
-//#region mods/auto-mode/contract/find-current-direct-user-message.ts
-function findCurrentDirectUserMessage(message) {
-	return message === null || message === void 0 || message.freshness === "stale" ? null : message.text;
-}
-//#endregion
-//#region src/budget/build-retry-key.ts
-const DESCRIPTIVE_FIELDS = { Bash: [
-	"description",
-	"timeout",
-	"run_in_background"
-] };
-function buildRetryKey(request) {
-	const ignored = Object.hasOwn(DESCRIPTIVE_FIELDS, request.toolName) ? DESCRIPTIVE_FIELDS[request.toolName] ?? [] : [];
-	const input = Object.fromEntries(Object.entries(request.toolInput).filter(([key]) => !ignored.includes(key)));
-	const message = request.decisionContext?.lastDirectUserMessage ?? null;
-	const canonical = JSON.stringify(sortKeys({
-		cwd: request.cwd,
-		toolName: request.toolName,
-		toolInput: input,
-		lastDirectUserMessage: message?.text ?? null,
-		...message?.freshness === "stale" ? { lastDirectUserMessageFreshness: "stale" } : {}
-	}));
-	return createHash("sha256").update(canonical).digest("hex");
-}
-function sortKeys(value) {
-	if (Array.isArray(value)) return value.map((item) => sortKeys(item));
-	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).toSorted(([a], [b]) => a < b ? -1 : 1).map(([key, item]) => [key, sortKeys(item)]));
-	return value;
-}
-//#endregion
-//#region src/budget/find-retry-deny.ts
-function findRetryDeny(state, retryKey) {
-	if (state.lastDenied === null || state.lastDenied.retryKey !== retryKey) return null;
-	return {
-		kind: "deny",
-		rule: state.lastDenied.rule,
-		reason: state.lastDenied.reason
-	};
-}
-//#endregion
-//#region src/state/load-json-file.ts
-async function loadJSONFile(path, schema, fallback) {
-	try {
-		const text = await readFile(path, "utf8");
-		const parsed = schema.safeParse(JSON.parse(text));
-		return parsed.success ? parsed.data : fallback;
-	} catch {
-		return fallback;
-	}
-}
-//#endregion
-//#region src/budget/types.ts
-const EMPTY_DENIAL_STATE = {
-	consecutive: 0,
-	session: 0,
-	lastDenied: null
-};
-//#endregion
-//#region src/budget/load-denial-state.ts
-const count = number().int().nonnegative();
-const stateSchema$1 = strictObject({
-	consecutive: count,
-	session: count,
-	lastDenied: strictObject({
-		retryKey: string().min(1),
-		rule: string(),
-		reason: string()
-	}).nullable()
-});
-function loadDenialState(path) {
-	return loadJSONFile(path, stateSchema$1, EMPTY_DENIAL_STATE);
-}
-//#endregion
-//#region src/budget/plan-denial-budget.ts
-function planDenialBudget(state, verdict, retryKey, budget) {
-	if (verdict === null) return {
-		verdict: null,
-		state,
-		escalation: false
-	};
-	if (verdict.kind === "allow") return {
-		verdict,
-		state: {
-			...state,
-			consecutive: 0,
-			lastDenied: null
-		},
-		escalation: false
-	};
-	if (state.consecutive >= budget.consecutive || state.session >= budget.perSession) return {
-		verdict: null,
-		state: EMPTY_DENIAL_STATE,
-		escalation: true
-	};
-	const next = {
-		consecutive: state.consecutive + 1,
-		session: state.session + 1,
-		lastDenied: {
-			retryKey,
-			rule: verdict.rule,
-			reason: verdict.reason
-		}
-	};
-	const left = Math.min(budget.consecutive - next.consecutive, budget.perSession - next.session);
-	return {
-		verdict: {
-			...verdict,
-			reason: `${verdict.reason} ${formatDenialsLeft(left)}`
-		},
-		state: next,
-		escalation: false
-	};
-}
-function formatDenialsLeft(left) {
-	if (left > 0) return `Denials left before auto-mode asks the user: ${left}.`;
-	return "This is the last denial before auto-mode asks the user. Stop now, without finishing the rest of the task, and tell the user what consent you need to continue.";
-}
-//#endregion
-//#region src/budget/resolve-denial-state-path.ts
-function resolveDenialStatePath(request, stateDir) {
-	const agentID = request.decisionContext?.agentID ?? "";
-	const key = createHash("sha256").update(`${request.sessionID}\0${agentID}`).digest("hex").slice(0, 32);
-	return join(stateDir, "denials", `${key}.json`);
-}
-//#endregion
-//#region src/state/update-json-file.ts
-const SYSTEM_CLOCK = {
-	now: Date.now,
-	wait: (ms) => setTimeout(ms)
-};
-async function updateJSONFile(path, load, update, clock = SYSTEM_CLOCK) {
-	await mkdir(dirname(path), {
-		recursive: true,
-		mode: 448
-	});
-	const lock = `${path}.lock`;
-	const owner = await claimLock(lock, clock);
-	try {
-		const previous = await load(path);
-		const next = update(previous);
-		if (next !== previous) {
-			const staged = `${path}.${randomUUID()}.tmp`;
-			await writeFile(staged, `${JSON.stringify(next)}\n`, { mode: 384 });
-			await rename(staged, path);
-		}
-		return {
-			previous,
-			next
-		};
-	} finally {
-		await removeOwnLock(lock, owner);
-	}
-}
-const STALE_LOCK_MS = 1e4;
-const LOCK_WAIT_MS = 3e3;
-const LOCK_POLL_MS = 10;
-async function claimLock(lock, clock) {
-	const deadline = clock.now() + LOCK_WAIT_MS;
-	const owner = randomUUID();
-	const staged = `${lock}.${owner}`;
-	await writeFile(staged, owner, {
-		flag: "wx",
-		mode: 384
-	});
-	try {
-		for (;;) {
-			try {
-				await link(staged, lock);
-				return owner;
-			} catch (error) {
-				if (!hasErrorCode(error, "EEXIST")) throw error;
-			}
-			const held = await stat(lock).catch(() => null);
-			if (held !== null && isStale(held, clock)) {
-				if (await claimStaleLock(lock, staged, held, clock)) return owner;
-			}
-			if (clock.now() > deadline) throw new Error("state file lock unavailable");
-			await clock.wait(LOCK_POLL_MS);
-		}
-	} finally {
-		await rm(staged, { force: true });
-	}
-}
-function hasErrorCode(error, code) {
-	return error instanceof Error && "code" in error && error.code === code;
-}
-function isStale(file, clock) {
-	return clock.now() - file.mtimeMs > STALE_LOCK_MS;
-}
-async function claimStaleLock(lock, staged, held, clock) {
-	const prefix = `${lock}.${String(held.ino)}-${String(held.mtimeMs)}`;
-	const generation = await claimTakeoverMarker(prefix, clock);
-	if (generation === null) return false;
-	try {
-		const current = await stat(lock).catch(() => null);
-		if (current?.ino !== held.ino || current.mtimeMs !== held.mtimeMs) return false;
-		await rename(staged, lock);
-		return true;
-	} finally {
-		await Promise.all(Array.from({ length: generation + 1 }, (_, index) => rm(buildTakeoverMarkerPath(prefix, index), { force: true })));
-	}
-}
-async function claimTakeoverMarker(prefix, clock) {
-	for (let generation = 0;; generation += 1) {
-		const marker = buildTakeoverMarkerPath(prefix, generation);
-		try {
-			await writeFile(marker, "", {
-				flag: "wx",
-				mode: 384
-			});
-			return generation;
-		} catch (error) {
-			if (!hasErrorCode(error, "EEXIST")) throw error;
-		}
-		const existing = await stat(marker).catch(() => null);
-		if (existing === null || !isStale(existing, clock)) return null;
-	}
-}
-function buildTakeoverMarkerPath(prefix, generation) {
-	return `${prefix}-${String(generation)}.takeover`;
-}
-async function removeOwnLock(lock, owner) {
-	if (await readFile(lock, "utf8").catch(() => null) === owner) await rm(lock, { force: true });
-}
-//#endregion
-//#region src/budget/update-denial-state.ts
-function updateDenialState(path, update, clock) {
-	return updateJSONFile(path, loadDenialState, update, clock);
-}
-//#endregion
 //#region src/config/resolve-claude-config-path.ts
 const DEFAULT_DIRS = {
 	"settings.json": [".claude"],
@@ -6328,14 +6338,6 @@ function parseRules(body) {
 	};
 }
 //#endregion
-//#region src/git/to-repository-slug.ts
-function toRepositorySlug(reference) {
-	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
-	if (match?.groups === void 0) return null;
-	const parts = match.groups;
-	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
-}
-//#endregion
 //#region src/shell/is-unresolved-word.ts
 function isUnresolvedWord(word) {
 	return /[$`]/u.test(word);
@@ -6352,72 +6354,403 @@ function resolveShellPath(directory, path, home) {
 //#endregion
 //#region src/shell/split-shell-tokens.ts
 function splitShellTokens(text) {
-	const tokens = [];
-	let hasSubstitution = false;
-	let index = 0;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (/\s/u.test(ch) && ch !== "\n") {
-			index += 1;
-			continue;
-		}
-		const separator = findOperator(SEPARATORS, text, index);
-		if (separator !== void 0 && !text.startsWith("&>", index)) {
-			tokens.push({
-				kind: "separator",
-				operator: separator,
-				start: index,
-				end: index + separator.length
-			});
-			index += separator.length;
-			continue;
-		}
-		const word = readWord(text, index);
-		hasSubstitution ||= word.hasSubstitution;
-		const operator = findOperator(REDIRECTS, text, word.end);
-		const isDescriptor = operator !== void 0 && /^\d+$/u.test(word.raw);
-		if (word.raw !== "" && !isDescriptor) {
-			if (word.isUnterminated) return {
-				tokens: [...tokens, buildWordToken(word, index)],
-				hasSubstitution,
-				isUnterminated: true
-			};
-			tokens.push(buildWordToken(word, index));
-			index = word.end;
-			continue;
-		}
-		if (operator === void 0) {
-			index += 1;
-			continue;
-		}
-		const redirect = readRedirect(text, word.end, operator);
-		hasSubstitution ||= redirect.hasSubstitution;
-		tokens.push({
-			kind: "redirect",
-			operator: `${word.raw}${operator}`,
-			target: redirect.target,
-			start: index,
-			end: redirect.end
-		});
-		if (redirect.isUnterminated) return {
-			tokens,
-			hasSubstitution,
-			isUnterminated: true
-		};
-		index = redirect.end;
+	const scanned = collectTextTokens(text, []);
+	const literals = [];
+	let recovered = scanned;
+	while (recovered.unclosedAt !== null && !literals.includes(recovered.unclosedAt)) {
+		literals.push(recovered.unclosedAt);
+		recovered = collectTextTokens(text, literals);
 	}
 	return {
-		tokens,
-		hasSubstitution,
-		isUnterminated: false
+		tokens: scanned.tokens,
+		substitutions: recovered.substitutions,
+		hasSubstitution: scanned.hasSubstitution,
+		isUnterminated: scanned.unclosedAt !== null
 	};
 }
-const SEPARATORS = [
-	"&&",
-	"||",
-	";",
-	"|",
-	"&",
+function collectTextTokens(text, literalOffsets) {
+	const literals = new Set(literalOffsets);
+	const top = buildLevel(text.length, null);
+	let level = top;
+	let hasSubstitution = false;
+	let unclosedAt = null;
+	const commandSubstitutions = /* @__PURE__ */ new Map();
+	const withLevel = (limit, closer, run) => {
+		const outer = level;
+		const inner = buildLevel(limit, closer);
+		level = inner;
+		const result = run();
+		level = outer;
+		return {
+			result,
+			substitutions: inner.substitutions
+		};
+	};
+	const collectTokens = (start, isArithmeticStart = false) => {
+		const tokens = [];
+		const heredocs = [];
+		let arithmeticDepth = isArithmeticStart ? 1 : 0;
+		let index = start;
+		while (index < level.limit) {
+			const ch = text.charAt(index);
+			const isLiteral = literals.has(index);
+			if (!isLiteral && ch === level.closer && level.depth === 0) return {
+				tokens,
+				end: index
+			};
+			if (text.startsWith("\\\n", index)) {
+				index += 2;
+				continue;
+			}
+			if (/\s/u.test(ch) && ch !== "\n") {
+				index += 1;
+				continue;
+			}
+			if (ch === "#") {
+				const newline = text.indexOf("\n", index);
+				const end = newline === -1 || newline > level.limit ? level.limit : newline;
+				tokens.push({
+					kind: "comment",
+					text: text.slice(index, end),
+					start: index,
+					end
+				});
+				index = end;
+				continue;
+			}
+			const separator = isLiteral ? void 0 : findOperator(SEPARATORS, text, index);
+			if (separator !== void 0 && !text.startsWith("&>", index)) {
+				tokens.push({
+					kind: "separator",
+					operator: separator,
+					start: index,
+					end: index + separator.length
+				});
+				index += separator.length;
+				if (separator === "\n" && heredocs.length > 0) {
+					const read = readHeredocs(index, heredocs.splice(0));
+					tokens.push(...read.tokens);
+					index = read.end;
+				}
+				continue;
+			}
+			const balance = level.balance;
+			const word = readWord(index);
+			const operator = findOperator(REDIRECTS, text, word.end);
+			const isDescriptor = operator !== void 0 && /^\d+$/u.test(word.raw);
+			if (word.raw !== "" && !isDescriptor) {
+				tokens.push(buildWordToken(word, index));
+				if (arithmeticDepth > 0 || word.raw.startsWith("((")) arithmeticDepth += level.balance - balance;
+				if (word.isUnterminated) return {
+					tokens,
+					end: -1
+				};
+				index = word.end;
+				continue;
+			}
+			if (operator === void 0) {
+				index += 1;
+				continue;
+			}
+			const opensHeredoc = (operator === "<<" || operator === "<<-") && arithmeticDepth <= 0;
+			const redirect = readRedirect(word.end, operator, opensHeredoc);
+			tokens.push({
+				kind: "redirect",
+				operator: `${word.raw}${operator}`,
+				target: redirect.target,
+				start: index,
+				end: redirect.end
+			});
+			if (redirect.isUnterminated) return {
+				tokens,
+				end: -1
+			};
+			if (opensHeredoc && redirect.raw !== "") heredocs.push(buildHeredoc(redirect.raw, operator === "<<-", index));
+			if (arithmeticDepth > 0) arithmeticDepth += level.balance - balance;
+			index = redirect.end;
+		}
+		return {
+			tokens,
+			end: level.closer === null ? index : -1
+		};
+	};
+	const readWord = (start) => {
+		let value = "";
+		let paren = null;
+		let parenEnd = -1;
+		let index = start;
+		while (index < level.limit) {
+			const ch = text.charAt(index);
+			if (literals.has(index)) {
+				value += ch;
+				index += 1;
+				continue;
+			}
+			if (ch === "\\") {
+				value += text.slice(index, index + 2);
+				index += 2;
+				continue;
+			}
+			if (ch === "'" || ch === "\"" || text.startsWith("$'", index) && !literals.has(index + 1)) {
+				const isANSI = ch === "$";
+				const quoteAt = isANSI ? index + 1 : index;
+				const quoted = readQuoted(quoteAt, isANSI);
+				value += `${isANSI ? "$" : ""}${quoted.value}`;
+				index = quoted.end;
+				if (quoted.isUnterminated) return buildScannedWord(text, start, index, value, paren, true);
+				continue;
+			}
+			if (text.startsWith("$$", index)) {
+				value += "$$";
+				index += 2;
+				continue;
+			}
+			const expansion = readExpansion(index, false);
+			if (expansion !== null) {
+				value += text.slice(index, expansion.end);
+				index = expansion.end;
+				if (expansion.isUnterminated) return buildScannedWord(text, start, index, value, paren, true);
+				continue;
+			}
+			if (/\s/u.test(ch) || /[;&|<>]/u.test(ch) || ch === "#" && index === parenEnd) break;
+			if (ch === "(" || ch === ")") {
+				if (level.closer === ")" && ch === ")" && level.depth === 0) break;
+				if (level.closer === ")") level.depth += ch === "(" ? 1 : -1;
+				level.balance += ch === "(" ? 1 : -1;
+				paren ??= {
+					value: value.length,
+					raw: index - start
+				};
+				parenEnd = index + 1;
+			}
+			value += ch;
+			index += 1;
+		}
+		return buildScannedWord(text, start, Math.min(index, level.limit), value, paren, false);
+	};
+	const readQuoted = (start, isANSI) => {
+		const quote = text.charAt(start);
+		let value = "";
+		let index = start + 1;
+		while (index < level.limit) {
+			const ch = text.charAt(index);
+			if (literals.has(index)) {
+				value += ch;
+				index += 1;
+			} else if (ch === quote) return {
+				value,
+				end: index + 1,
+				isUnterminated: false
+			};
+			else if (ch === "\\" && (quote === "\"" || isANSI)) {
+				value += text.slice(index, index + 2);
+				index += 2;
+			} else {
+				const expansion = quote === "\"" ? readExpansion(index, true) : null;
+				const end = expansion?.end ?? index + 1;
+				value += text.slice(index, end);
+				index = end;
+				if (expansion?.isUnterminated === true) return {
+					value,
+					end: index,
+					isUnterminated: true
+				};
+			}
+		}
+		unclosedAt ??= start;
+		return {
+			value,
+			end: level.limit,
+			isUnterminated: true
+		};
+	};
+	const readExpansion = (index, isInDoubleQuotes) => {
+		if (text.startsWith("$(", index) || text.charAt(index) === "`") {
+			hasSubstitution = true;
+			const isBacktick = text.charAt(index) === "`";
+			const bodyStart = index + (isBacktick ? 1 : 2);
+			if (isBacktick) return collectExpansionBody(index, bodyStart, findBacktickEnd(bodyStart));
+			return readCommandSubstitution(index, bodyStart);
+		}
+		if (text.startsWith("${", index)) return collectExpansionBody(index, -1, findParameterEnd(index + 2, isInDoubleQuotes));
+		return null;
+	};
+	const readCommandSubstitution = (index, bodyStart) => {
+		const key = `${index}:${level.limit}`;
+		const scan = commandSubstitutions.get(key);
+		if (scan !== void 0) {
+			level.substitutions.push(...scan.substitutions);
+			unclosedAt ??= scan.unclosedAt;
+			return {
+				end: scan.end,
+				isUnterminated: scan.isUnterminated
+			};
+		}
+		const collected = level.substitutions.length;
+		const wasUnclosed = unclosedAt !== null;
+		const read = readCommandSubstitutionBody(index, bodyStart);
+		commandSubstitutions.set(key, {
+			...read,
+			substitutions: level.substitutions.slice(collected),
+			unclosedAt: wasUnclosed ? null : unclosedAt
+		});
+		return read;
+	};
+	const readCommandSubstitutionBody = (index, bodyStart) => {
+		if (text.charAt(bodyStart) === "(") {
+			const arithmetic = withLevel(level.limit, ")", () => collectTokens(bodyStart + 1, true).end);
+			if (arithmetic.result !== -1 && text.charAt(arithmetic.result + 1) === ")") {
+				level.substitutions.push(...arithmetic.substitutions);
+				return {
+					end: arithmetic.result + 2,
+					isUnterminated: false
+				};
+			}
+		}
+		const end = withLevel(level.limit, ")", () => collectTokens(bodyStart).end).result;
+		return collectExpansionBody(index, bodyStart, end);
+	};
+	const collectExpansionBody = (index, bodyStart, end) => {
+		if (end === -1) {
+			unclosedAt ??= index;
+			return {
+				end: level.limit,
+				isUnterminated: true
+			};
+		}
+		if (bodyStart !== -1) level.substitutions.push(text.slice(bodyStart, end));
+		return {
+			end: end + 1,
+			isUnterminated: false
+		};
+	};
+	const findBacktickEnd = (start) => {
+		for (let index = start; index < level.limit; index += 1) {
+			if (literals.has(index)) continue;
+			if (text.charAt(index) === "\\") index += 1;
+			else if (text.charAt(index) === "`") return index;
+		}
+		return -1;
+	};
+	const findParameterEnd = (start, isInDoubleQuotes) => {
+		let isDoubleQuoted = false;
+		let isSingleQuoted = false;
+		let index = start;
+		while (index < level.limit) {
+			const ch = text.charAt(index);
+			if (literals.has(index)) {
+				index += 1;
+				continue;
+			}
+			if (ch === "\\") {
+				index += 2;
+				continue;
+			}
+			const expansion = readExpansion(index, isInDoubleQuotes || isDoubleQuoted);
+			if (expansion !== null) {
+				if (expansion.isUnterminated) return -1;
+				index = expansion.end;
+				continue;
+			}
+			if (ch === "'" && !isInDoubleQuotes && !isDoubleQuoted) {
+				const close = text.indexOf("'", index + 1);
+				if (close === -1 || close >= level.limit) return -1;
+				index = close + 1;
+				continue;
+			}
+			if (ch === "'" && !isDoubleQuoted) isSingleQuoted = !isSingleQuoted;
+			else if (ch === "\"" && !isSingleQuoted) isDoubleQuoted = !isDoubleQuoted;
+			else if (!isDoubleQuoted && !isSingleQuoted && ch === "}") return index;
+			index += 1;
+		}
+		return -1;
+	};
+	const readRedirect = (start, operator, opensHeredoc) => {
+		let index = start + operator.length;
+		if (operator.endsWith("(")) {
+			hasSubstitution = true;
+			return {
+				target: null,
+				raw: "",
+				...collectExpansionBody(start, index, withLevel(level.limit, ")", () => collectTokens(index).end).result)
+			};
+		}
+		while (index < level.limit) if (text.startsWith("\\\n", index)) index += 2;
+		else if (/\s/u.test(text.charAt(index)) && text.charAt(index) !== "\n") index += 1;
+		else break;
+		const collected = level.substitutions.length;
+		const hadSubstitution = hasSubstitution;
+		const word = readWord(index);
+		if (opensHeredoc) {
+			level.substitutions.splice(collected);
+			hasSubstitution = hadSubstitution;
+		}
+		if (word.raw === "") return {
+			target: null,
+			raw: "",
+			end: index,
+			isUnterminated: false
+		};
+		return {
+			target: word.paren === null ? word.value : word.value.slice(0, word.paren.value),
+			raw: word.paren === null ? word.raw : word.raw.slice(0, word.paren.raw),
+			end: word.end,
+			isUnterminated: word.isUnterminated
+		};
+	};
+	const readHeredocs = (start, heredocs) => {
+		const tokens = [];
+		let bodyStart = start;
+		let end = start;
+		for (const heredoc of heredocs) {
+			const [bodyEnd, next] = findHeredocEnd(text, bodyStart, level.limit, heredoc);
+			const substitutions = heredoc.isQuoted ? [] : collectHeredocSubstitutions(bodyStart, bodyEnd);
+			tokens.push({
+				kind: "heredoc",
+				body: text.slice(bodyStart, bodyEnd),
+				isQuoted: heredoc.isQuoted,
+				opener: heredoc.opener,
+				substitutions,
+				start: bodyStart,
+				end: next
+			});
+			level.substitutions.push(...substitutions);
+			end = next;
+			bodyStart = Math.min(next + 1, level.limit);
+		}
+		return {
+			tokens,
+			end
+		};
+	};
+	const collectHeredocSubstitutions = (start, end) => withLevel(end, null, () => {
+		let index = start;
+		while (index < end) if (literals.has(index)) index += 1;
+		else if (text.charAt(index) === "\\") index += 2;
+		else index = readExpansion(index, true)?.end ?? index + 1;
+	}).substitutions;
+	return {
+		tokens: collectTokens(0).tokens,
+		substitutions: top.substitutions,
+		hasSubstitution,
+		unclosedAt
+	};
+}
+function buildLevel(limit, closer) {
+	return {
+		substitutions: [],
+		limit,
+		closer,
+		depth: 0,
+		balance: 0
+	};
+}
+const SEPARATORS = [
+	"&&",
+	"||",
+	";",
+	"|",
+	"&",
 	"\n"
 ];
 const REDIRECTS = [
@@ -6448,63 +6781,119 @@ function buildWordToken(word, start) {
 		end: word.end
 	};
 }
-function readWord(text, start) {
-	let value = "";
+function buildScannedWord(text, start, end, value, paren, isUnterminated) {
+	return {
+		value,
+		raw: text.slice(start, end),
+		end,
+		paren,
+		isUnterminated
+	};
+}
+function buildHeredoc(raw, stripsTabs, opener) {
+	let delimiter = "";
 	let quote = null;
-	let hasSubstitution = false;
-	let parenAt = null;
-	let index = start;
-	while (index < text.length) {
-		const ch = text.charAt(index);
-		if (quote !== null) {
-			if (quote === "\"" && (text.startsWith("$(", index) || ch === "`")) hasSubstitution = true;
-			if (ch === quote) quote = null;
-			else value += ch;
+	let isQuoted = false;
+	let index = 0;
+	while (index < raw.length) {
+		const ch = raw.charAt(index);
+		const next = raw.charAt(index + 1);
+		if (quote === "$'" && ch === "\\") {
+			const escape = parseANSIEscape(raw, index);
+			delimiter += escape.text;
+			index = escape.end;
+		} else if (quote === "$'" && ch === "'") {
+			quote = null;
 			index += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
+		} else if (quote === "$'") {
+			delimiter += ch;
 			index += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			value += text.slice(index, index + 2);
+		} else if (quote === null && ch === "$" && (next === "'" || next === "\"")) {
+			quote = next === "'" ? "$'" : "\"";
+			isQuoted = true;
 			index += 2;
-			continue;
+		} else if (quote === "'") {
+			quote = ch === "'" ? null : quote;
+			delimiter += ch === "'" ? "" : ch;
+			index += 1;
+		} else if (ch === quote) {
+			quote = null;
+			index += 1;
+		} else if (ch === "\\" && (quote === null || /[$`"\\\n]/u.test(next))) {
+			isQuoted ||= next !== "\n";
+			delimiter += next === "\n" ? "" : next;
+			index += 2;
+		} else if (quote === null && (ch === "'" || ch === "\"")) {
+			quote = ch;
+			isQuoted = true;
+			index += 1;
+		} else {
+			delimiter += ch;
+			index += 1;
 		}
-		if (/\s/u.test(ch) || /[;&|<>]/u.test(ch)) break;
-		if (text.startsWith("$(", index) || ch === "`") hasSubstitution = true;
-		if ((ch === "(" || ch === ")") && parenAt === null) parenAt = value.length;
-		value += ch;
-		index += 1;
 	}
 	return {
-		value,
-		raw: text.slice(start, Math.min(index, text.length)),
-		end: Math.min(index, text.length),
-		parenAt,
-		hasSubstitution,
-		isUnterminated: quote !== null
-	};
-}
-function readRedirect(text, start, operator) {
-	let index = start + operator.length;
-	while (index < text.length && /\s/u.test(text.charAt(index)) && text.charAt(index) !== "\n") index += 1;
-	const word = readWord(text, index);
-	const isProcess = operator.endsWith("(");
-	if (word.raw === "") return {
-		target: null,
-		end: index,
-		hasSubstitution: isProcess,
-		isUnterminated: false
+		delimiter,
+		isQuoted,
+		stripsTabs,
+		opener
+	};
+}
+const ANSI_ESCAPES = {
+	a: "\x07",
+	b: "\b",
+	e: "\x1B",
+	E: "\x1B",
+	f: "\f",
+	n: "\n",
+	r: "\r",
+	t: "	",
+	v: "\v",
+	"\\": "\\",
+	"'": "'",
+	"\"": "\"",
+	"?": "?"
+};
+function parseANSIEscape(raw, index) {
+	const next = raw.charAt(index + 1);
+	const named = ANSI_ESCAPES[next];
+	const hex = /^x(?<digits>[0-9A-Fa-f]{1,2})/u.exec(raw.slice(index + 1));
+	const octal = /^[0-7]{1,3}/u.exec(raw.slice(index + 1));
+	if (named !== void 0) return {
+		text: named,
+		end: index + 2
+	};
+	if (hex !== null) return {
+		text: String.fromCodePoint(Number.parseInt(hex.groups?.["digits"] ?? "", 16)),
+		end: index + 1 + hex[0].length
+	};
+	if (octal !== null) return {
+		text: String.fromCodePoint(Number.parseInt(octal[0], 8)),
+		end: index + 1 + octal[0].length
 	};
 	return {
-		target: word.parenAt === null ? word.value : word.value.slice(0, word.parenAt),
-		end: word.end,
-		hasSubstitution: isProcess || word.hasSubstitution,
-		isUnterminated: word.isUnterminated
-	};
+		text: raw.slice(index, index + 2),
+		end: index + 2
+	};
+}
+function findHeredocEnd(text, bodyStart, limit, heredoc) {
+	let lineStart = bodyStart;
+	while (lineStart < limit) {
+		let lineEnd = findLineEnd(text, lineStart, limit);
+		let line = text.slice(lineStart, lineEnd);
+		while (!heredoc.isQuoted && /(?<!\\)(?:\\\\)*\\$/u.test(line) && lineEnd < limit) {
+			const nextEnd = findLineEnd(text, lineEnd + 1, limit);
+			line = `${line.slice(0, -1)}${text.slice(lineEnd + 1, nextEnd)}`;
+			lineEnd = nextEnd;
+		}
+		if ((heredoc.stripsTabs ? line.replace(/^\t+/u, "") : line) === heredoc.delimiter) return [lineStart, lineEnd];
+		lineStart = lineEnd + 1;
+	}
+	return [limit, limit];
+}
+function findLineEnd(text, start, limit) {
+	const newline = text.indexOf("\n", start);
+	return newline === -1 || newline > limit ? limit : newline;
 }
 //#endregion
 //#region src/shell/split-command-words.ts
@@ -6530,9 +6919,13 @@ function splitShellCommand(command) {
 	let start = null;
 	let end = 0;
 	for (const token of [...scanned.tokens, null]) if (token === null || token.kind === "separator") {
-		if (start !== null) segments.push({ text: command.slice(start, end) });
+		if (start !== null) segments.push({
+			text: command.slice(start, end),
+			start,
+			end
+		});
 		start = null;
-	} else {
+	} else if (token.kind !== "comment" && token.kind !== "heredoc") {
 		start ??= token.start;
 		end = token.end;
 	}
@@ -6568,52 +6961,110 @@ function collectWriteTargets(text) {
 	return splitShellTokens(text).tokens.flatMap((token) => token.kind === "redirect" && token.target !== null && token.target !== "" && WRITE_REDIRECTS.has(token.operator.replace(/^\d+/u, "")) ? [token.target] : []);
 }
 //#endregion
-//#region src/shell/split-git-command.ts
-function splitGitCommand(args, directory, home) {
-	let gitDirectory = directory;
+//#region src/shell/collect-shell-scripts.ts
+function collectShellScripts(command) {
+	const segments = splitShellCommand(command).segments;
+	const tokens = splitShellTokens(command).tokens;
+	return [...segments.flatMap((range, segment) => splitShellTokens(range.text).substitutions.map((body) => ({
+		text: body,
+		segment
+	}))), ...tokens.flatMap((token) => {
+		if (token.kind !== "heredoc") return [];
+		const segment = segments.findIndex((range) => range.start <= token.opener && token.opener < range.end);
+		const range = segments[segment];
+		const descriptor = range === void 0 ? null : findScriptDescriptor(range.text);
+		return (range !== void 0 && descriptor !== null && findDescriptorSource(tokens, range.start, range.end, descriptor) === token.opener && (token.isQuoted || token.substitutions.length === 0) ? [...token.substitutions, token.body] : token.substitutions).map((body) => ({
+			text: body,
+			segment
+		}));
+	})];
+}
+function findDescriptorSource(tokens, start, end, descriptor) {
+	const descriptors = /* @__PURE__ */ new Map();
+	for (const token of tokens) {
+		if (token.kind !== "redirect" || token.operator.endsWith("(") || token.start < start || token.start >= end) continue;
+		const number = /^\d*/u.exec(token.operator)?.[0] ?? "";
+		const operator = token.operator.slice(number.length);
+		const implied = operator.startsWith("<") ? "0" : "1";
+		const assigned = number === "" ? implied : String(Number(number));
+		const move = /^(?<source>\d+)(?<close>-?)$/u.exec(token.target ?? "")?.groups;
+		const path = operator === "<" || operator === "<>" ? findPathDescriptor(token.target ?? "") : null;
+		if (operator.endsWith("&") && move !== void 0) {
+			const source = String(Number(move["source"]));
+			descriptors.set(assigned, descriptors.get(source) ?? null);
+			if (move["close"] === "-") descriptors.delete(source);
+		} else if (path === null) descriptors.set(assigned, token.start);
+		else descriptors.set(assigned, descriptors.get(path) ?? null);
+	}
+	return descriptors.get(descriptor) ?? null;
+}
+const STANDARD_PATHS = /* @__PURE__ */ new Map([
+	["/dev/stdin", "0"],
+	["/dev/stdout", "1"],
+	["/dev/stderr", "2"]
+]);
+function findPathDescriptor(path) {
+	const descriptor = /^\/(?:dev|proc\/self)\/fd\/(?<number>\d+)$/u.exec(path)?.groups?.["number"];
+	if (descriptor !== void 0) return String(Number(descriptor));
+	return STANDARD_PATHS.get(path) ?? null;
+}
+const SHELLS = /* @__PURE__ */ new Set([
+	"bash",
+	"sh",
+	"zsh",
+	"dash",
+	"ksh"
+]);
+const VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"--rcfile",
+	"--init-file",
+	"--emulate"
+]);
+const VALUE_OPTION_GROUP = /^[-+][^-]*[oO]$/u;
+function findScriptDescriptor(segment) {
+	const [program = "", ...args] = splitCommandWords(segment);
+	if (!SHELLS.has(basename(program))) return null;
+	let readsInput = false;
 	let index = 0;
-	while (index < args.length && args[index]?.startsWith("-") === true) {
-		const option = args[index];
-		if (option === "-C") gitDirectory = resolveShellPath(gitDirectory, args[index + 1] ?? "", home);
-		index += option === "-C" || option === "-c" ? 2 : 1;
+	while (index < args.length) {
+		const arg = args[index] ?? "";
+		if (/^-[^-]*c/u.test(arg)) return null;
+		if (arg === "--" || arg === "-") {
+			const script = args[index + 1];
+			return readsInput || script === void 0 ? "0" : findPathDescriptor(script);
+		}
+		if (!/^[-+]/u.test(arg)) return readsInput ? "0" : findPathDescriptor(arg);
+		readsInput ||= /^-[^-]*s/u.test(arg);
+		index += VALUE_OPTIONS.has(arg) || VALUE_OPTION_GROUP.test(arg) ? 2 : 1;
 	}
-	return {
-		directory: gitDirectory,
-		args: args.slice(index)
-	};
+	return "0";
 }
 //#endregion
-//#region src/containment/collect-scope-findings.ts
-function collectScopeFindings(action, scope, scratchPaths = SCRATCH_PATHS) {
-	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
-	const command = action.input["command"];
-	const findings = [
-		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope, scratchPaths) : [],
-		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
-		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope, scratchPaths) : []
-	];
-	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
+//#region src/git/to-repository-slug.ts
+function toRepositorySlug(reference) {
+	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
+	if (match?.groups === void 0) return null;
+	const parts = match.groups;
+	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
 }
-const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
-	"Edit",
-	"MultiEdit",
-	"Write",
-	"NotebookEdit"
-]);
+//#endregion
+//#region src/containment/is-in-scope.ts
+function isInScope(path, scope, scratchPaths) {
+	if (scratchPaths.some((entry) => isUnder$2(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+	return scope.worktrees.some((worktree) => {
+		const isNested = isUnder$2(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder$2(path, other));
+		return isUnder$2(path, worktree) && (!isNested || isOtherOwned);
+	});
+}
+function isUnder$2(path, root) {
+	return path === root || path.startsWith(`${root}/`);
+}
+//#endregion
+//#region src/containment/collect-target-findings.ts
 function collectTargetFindings(directory, target, scope, scratchPaths) {
 	const path = resolveShellPath(directory, target, scope.home);
-	return path === null ? [] : collectPathFindings(path, scope, scratchPaths);
-}
-const CREDENTIAL_PATHS = [
-	".ssh",
-	".aws",
-	".gnupg",
-	".gitconfig",
-	".netrc",
-	".npmrc",
-	".config/gh"
-];
-function collectPathFindings(path, scope, scratchPaths) {
+	if (path === null) return [];
 	if (CREDENTIAL_PATHS.some((entry) => isUnder$1(path, join(scope.home, entry)))) return [{
 		kind: "credential",
 		target: path
@@ -6624,213 +7075,46 @@ function collectPathFindings(path, scope, scratchPaths) {
 		grant: { kind: "path" }
 	}];
 }
-function collectToolFindings(action, scope) {
-	const verb = action.tool.split("__").at(-1) ?? "";
-	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
-	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
-	const owner = action.input["owner"];
-	const name = action.input["repo"];
-	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
-	if (!verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope)) return [];
-	return typeof number === "number" ? [{
-		kind: "remote-write",
-		target: action.tool,
-		grant: {
-			kind: "pull-request",
-			number
-		}
-	}] : [{
-		kind: "remote-write",
-		target: action.tool
-	}];
+const CREDENTIAL_PATHS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".gitconfig",
+	".netrc",
+	".npmrc",
+	".config/gh"
+];
+function isUnder$1(path, root) {
+	return path === root || path.startsWith(`${root}/`);
 }
-const PATH_WRITERS = /* @__PURE__ */ new Set([
-	"rm",
-	"rmdir",
-	"shred",
-	"truncate",
-	"chmod",
-	"chown"
-]);
-const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
-	"cp",
-	"mv",
-	"rsync",
-	"ln"
-]);
-function collectCommandFindings(command, cwd, scope, scratchPaths) {
-	const findings = [];
-	const entries = collectShellCommands(command, cwd, scope.home);
-	const piped = collectPipedSegments(command);
-	const segments = splitShellCommand(command).segments;
-	for (const [index, entry] of entries.entries()) {
-		const [name, ...args] = entry.words;
-		const fixed = findFixedXargsCommand(entry.words, segments[index]?.text ?? "");
-		if (fixed !== null) findings.push(...collectProgramFindings(fixed.name, fixed.args, entry.directory, cwd, scope, scratchPaths));
-		else if (isBranchSweep(entries.slice(0, index + 1), piped.slice(0, index + 1))) findings.push({
-			kind: "discard",
-			target: "git branch delete by exclusion"
-		});
-		for (const target of entry.writeTargets) findings.push(...collectTargetFindings(entry.directory, target, scope, scratchPaths));
-		if (name !== void 0 && name !== "cd") findings.push(...collectProgramFindings(name, args, entry.directory, cwd, scope, scratchPaths));
-	}
-	return findings;
+//#endregion
+//#region src/containment/is-owned-pull-request.ts
+function isOwnedPullRequest(number, repo, scope) {
+	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
+	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
+	return scope.pullRequests.some((pull) => pull.number === number && (wanted === void 0 ? slugs.size === 1 && slugs.has(pull.repository) : pull.repository === wanted || pull.repository.endsWith(`/${wanted}`)));
 }
-function collectPipedSegments(command) {
-	const piped = [];
-	let separator = null;
-	let isInSegment = false;
-	for (const token of splitShellTokens(command).tokens) if (token.kind === "separator") {
-		separator = token.operator;
-		isInSegment = false;
-	} else if (!isInSegment) {
-		piped.push(separator === "|");
-		isInSegment = true;
-	}
-	return piped;
-}
-const XARGS_FLAG = /^(?:-[0oprtx]+|--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty))$/u;
-const XARGS_VALUE_OPTION = /^-[EPads]$/u;
-const XARGS_ATTACHED_VALUE = /^(?:-[EPads].|--(?:eof|max-procs|delimiter|arg-file|max-chars|process-slot-var)=)/u;
-const XARGS_REPLACE = /^(?:-I(?<attached>.+)|-i(?<short>.*)|--replace(?:=(?<long>.*))?)$/u;
-const PLAIN_WORD = /^(?:[\w./:@%+=-]|\{\})+$/u;
-function findFixedXargsCommand(words, text) {
-	if (words[0] !== "xargs" || !splitShellTokens(text).tokens.every((token) => token.kind !== "word" || token.raw === token.value && PLAIN_WORD.test(token.value))) return null;
-	let token = null;
-	let start = 1;
-	while (words[start]?.startsWith("-") === true) {
-		const word = words[start] ?? "";
-		const replace = XARGS_REPLACE.exec(word)?.groups;
-		if (word === "--") {
-			start += 1;
-			break;
-		}
-		if (word === "-I") {
-			token = words[start + 1] ?? null;
-			start += 2;
-		} else if (replace !== void 0) {
-			const short = replace["short"];
-			token = replace["attached"] ?? replace["long"] ?? (short === void 0 || short === "" ? "{}" : short);
-			start += 1;
-		} else if (word.startsWith("-J")) {
-			token = null;
-			start += word === "-J" ? 2 : 1;
-		} else if (XARGS_VALUE_OPTION.test(word)) start += 2;
-		else if (XARGS_FLAG.test(word) || XARGS_ATTACHED_VALUE.test(word)) start += 1;
-		else return null;
-	}
-	const [name, ...args] = words.slice(start);
-	if (token === null || token === "" || name === void 0 || [name, ...args].some((word) => word.includes(token))) return null;
-	return {
-		name,
-		args
-	};
-}
-const XARGS_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-I",
-	"-J",
-	"-L",
-	"-n",
-	"-P",
-	"-s",
-	"-d",
-	"-E"
-]);
-function isBranchSweep(entries, piped) {
-	const deleter = entries.at(-1)?.words ?? [];
-	if (deleter[0] !== "xargs" || piped.at(-1) !== true) return false;
-	let start = 1;
-	while (deleter[start]?.startsWith("-") === true) {
-		if (/^(?:-a|--arg-file)/u.test(deleter[start] ?? "")) return false;
-		start += XARGS_VALUE_OPTIONS.has(deleter[start] ?? "") ? 2 : 1;
-	}
-	const [program, subcommand, ...rest] = deleter.slice(start);
-	if (program !== "git" || subcommand !== "branch" || !rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) return false;
-	let first = entries.length - 2;
-	while (first > 0 && piped[first] === true) first -= 1;
-	const [listing, ...filters] = entries.slice(first, -1).map((entry) => entry.words);
-	return listing !== void 0 && isWholeBranchListing(listing) && filters.every((filter) => isExcludingFilter(filter));
-}
-function isWholeBranchListing(words) {
-	const [program, subcommand, ...rest] = words;
-	if (program !== "git") return false;
-	if (subcommand === "branch") return rest.every((word) => /^(?:-a|-r|-v|-vv|--all|--remotes|--no-color|--format=.*)$/u.test(word));
-	if (subcommand !== "for-each-ref") return false;
-	return rest.filter((_word, index) => !/^--(?:format|sort)$/u.test(rest[index - 1] ?? "")).every((word) => /^--(?:format|sort)(?:=.*)?$/u.test(word) || /^refs\/heads\/?$/u.test(word));
-}
-const NAME_EDITORS = /* @__PURE__ */ new Set([
-	"tr",
-	"cut",
-	"sort"
-]);
-function isExcludingFilter(words) {
-	const [program, ...args] = words;
-	if (program === "grep" || program === "egrep") return args.some((word) => /^-[a-zA-Z]*v[a-zA-Z]*$|^--invert-match$/u.test(word));
-	if (program === "sed") return isSubstitutionOnly(args);
-	if (program === "uniq") return args.every((word) => !/^-[a-zA-Z]*[dDu]/u.test(word));
-	return program !== void 0 && NAME_EDITORS.has(program);
-}
-function isSubstitutionOnly(args) {
-	const scripts = args.filter((word) => word !== "-e" && word !== "-E" && word !== "-r");
-	return scripts.length > 0 && scripts.every((script) => /^s(?<delimiter>[^\w\s;])(?:(?!\k<delimiter>).)*\k<delimiter>(?:(?!\k<delimiter>).)*\k<delimiter>g?$/u.test(script));
-}
-function collectProgramFindings(name, args, directory, cwd, scope, scratchPaths) {
-	const resolve = (path) => collectTargetFindings(directory, path, scope, scratchPaths);
-	const operands = args.filter((word) => !word.startsWith("-"));
-	if (name === "git") return collectGitFindings(args, directory, cwd, scope, scratchPaths);
-	if (name === "gh") return collectGhFindings(args, scope);
-	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
-	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
-	if (name === "find" && args.some((word) => word === "-delete" || word === "-exec")) return operands.slice(0, 1).flatMap((path) => resolve(path));
-	if ((name === "perl" || name === "sed") && args.some((word) => /^-\w*i/u.test(word))) return collectInPlaceFiles(args).flatMap((path) => resolve(path));
-	if (name === "ssh-keygen") return collectKeygenFiles(args).flatMap((path) => resolve(path));
-	if (name === "ssh") {
-		const logIndex = args.indexOf("-E");
-		const log = logIndex === -1 ? void 0 : args[logIndex + 1];
-		return [...log === void 0 ? [] : resolve(log), ...collectSSHFindings(args)];
-	}
-	if (name === "scp") {
-		const destination = collectSSHOperands(args).at(-1);
-		if (destination === void 0 || /^[^/]+:/u.test(destination)) return destination === void 0 ? [] : [{
-			kind: "remote-write",
-			target: "scp"
-		}];
-		return resolve(destination);
-	}
-	if (name === "curl") return collectCurlFindings(args);
-	const launcher = [name, ...args].findIndex((word) => word.includes("auto-mode"));
-	if (launcher !== -1 && [name, ...args].slice(launcher + 1).includes("record")) return [{
-		kind: "credential",
-		target: "auto-mode record"
-	}];
-	const finding = findProgramFinding(name, args);
-	return finding === null ? [] : [finding];
-}
-function collectCopyFindings(name, args, operands) {
-	const optionIndex = args.findIndex((word) => word === "-t" || word === "--target-directory");
-	let targetDirectory = args.find((word) => word.startsWith("--target-directory="))?.slice(19);
-	if (targetDirectory === void 0 && optionIndex !== -1) targetDirectory = args[optionIndex + 1];
-	if (targetDirectory !== void 0) {
-		const sources = operands.filter((word) => word !== targetDirectory);
-		return [targetDirectory, ...name === "mv" ? sources : []];
-	}
-	if (operands.length < 2) return [];
-	return [operands.at(-1) ?? "", ...name === "mv" ? operands.slice(0, -1) : []];
-}
-const KEYGEN_READ_OPTIONS = /* @__PURE__ */ new Set([
-	"-l",
-	"-y",
-	"-F",
-	"-B",
-	"-R"
-]);
-function collectKeygenFiles(args) {
-	if (args.some((word) => KEYGEN_READ_OPTIONS.has(word))) return [];
-	const index = args.indexOf("-f");
-	const file = index === -1 ? void 0 : args[index + 1];
-	return file === void 0 ? [] : [file];
-}
-const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+//#endregion
+//#region src/containment/program-table.ts
+const PATH_OPERANDS = { writes: [{ operands: ["all"] }] };
+const TARGET_DIRECTORY = ["-t", "--target-directory"];
+const COPY = {
+	valueOptions: TARGET_DIRECTORY,
+	writes: [{
+		options: TARGET_DIRECTORY,
+		operands: ["destination"]
+	}]
+};
+const IN_PLACE_SCRIPT = /^-\w*e$/u;
+const IN_PLACE_EDIT = {
+	valueOptions: [IN_PLACE_SCRIPT],
+	writes: [{
+		flags: [/^-\w*i/u],
+		operands: ["after-script"],
+		scriptOptions: [IN_PLACE_SCRIPT]
+	}]
+};
+const SSH_VALUE_OPTIONS = [
 	"-b",
 	"-c",
 	"-D",
@@ -6840,9 +7124,7 @@ const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"-J",
 	"-l",
 	"-L",
-	"-m"
-]);
-const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-m",
 	"-o",
 	"-p",
 	"-P",
@@ -6851,17 +7133,20 @@ const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
 	"-S",
 	"-W",
 	"-w"
-]);
-function collectSSHOperands(args) {
-	const operands = [];
-	for (let index = 0; index < args.length; index += 1) {
-		const word = args[index] ?? "";
-		if (operands.length > 0 || !word.startsWith("-")) operands.push(word);
-		else if (SSH_VALUE_OPTIONS.has(word) || SSH_MORE_VALUE_OPTIONS.has(word)) index += 1;
-	}
-	return operands;
-}
-const SSH_READS = /* @__PURE__ */ new Set([
+];
+const SCP_VALUE_OPTIONS = [
+	"-c",
+	"-D",
+	"-F",
+	"-i",
+	"-J",
+	"-l",
+	"-o",
+	"-P",
+	"-S",
+	"-X"
+];
+const SSH_READS = [
 	"cat",
 	"df",
 	"du",
@@ -6876,336 +7161,880 @@ const SSH_READS = /* @__PURE__ */ new Set([
 	"uname",
 	"uptime",
 	"whoami"
-]);
-function collectSSHFindings(args) {
-	const [host, ...remote] = collectSSHOperands(args);
-	if (host === void 0) return [];
-	const command = remote.join(" ");
-	const [program] = command.trim().split(/\s+/u);
-	return SSH_READS.has(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command) ? [] : [{
+];
+const CURL_UPLOAD = {
+	kind: "remote-write",
+	target: "curl upload"
+};
+const CREDENTIAL_WRITE = { writes: [{ finding: { kind: "credential" } }] };
+const DOCKER_PRUNE = { writes: [{ finding: {
+	kind: "prune",
+	quote: "call"
+} }] };
+const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
+const KUBECTL_WRITE = { writes: [{ finding: {
+	kind: "remote-write",
+	target: "kubectl write"
+} }] };
+const TERRAFORM_WRITE = { writes: [{ finding: {
+	kind: "remote-write",
+	target: "terraform write"
+} }] };
+const PRODUCTION_DEPLOY = {
+	words: [/\bdeploy\b/u, /prod/u],
+	finding: {
 		kind: "remote-write",
-		target: "ssh"
-	}];
+		target: "production deploy"
+	}
+};
+const CHECKOUT_WRITE = { writes: [{ directory: true }] };
+const REFSPEC_WRITE = {
+	operands: ["after-first"],
+	role: "refspec"
+};
+const GIT = {
+	directoryOptions: ["-C"],
+	valueOptions: ["-c"],
+	subcommands: {
+		clean: CHECKOUT_WRITE,
+		checkout: CHECKOUT_WRITE,
+		switch: CHECKOUT_WRITE,
+		merge: CHECKOUT_WRITE,
+		commit: CHECKOUT_WRITE,
+		rm: CHECKOUT_WRITE,
+		stash: CHECKOUT_WRITE,
+		reset: { writes: [{ directory: true }, {
+			flags: ["--hard"],
+			operands: ["first"],
+			role: "commit",
+			finding: {
+				kind: "discard",
+				target: "git reset --hard"
+			}
+		}] },
+		push: { writes: [
+			{ directory: true },
+			{
+				flags: ["--all", "--mirror"],
+				finding: {
+					kind: "branch",
+					target: "--all"
+				}
+			},
+			{
+				operands: ["first"],
+				role: "remote"
+			},
+			{
+				...REFSPEC_WRITE,
+				readFlags: ["--tags"],
+				whenNone: "HEAD"
+			},
+			{
+				...REFSPEC_WRITE,
+				flags: ["--tags"]
+			}
+		] },
+		worktree: { subcommands: { remove: { writes: [{ operands: ["first"] }] } } },
+		branch: { writes: [{
+			flags: [
+				"-d",
+				"-D",
+				"--delete"
+			],
+			operands: ["all"],
+			role: "branch"
+		}] },
+		config: { writes: [{
+			flags: ["--global"],
+			readFlags: [
+				"--get",
+				"--get-all",
+				"--get-regexp",
+				"--list",
+				"-l"
+			],
+			finding: {
+				kind: "credential",
+				quote: "operand"
+			}
+		}] }
+	}
+};
+const GH_REPO_OPTIONS = ["-R", "--repo"];
+const PULL_REQUEST_WRITE = {
+	operands: ["first"],
+	role: "pull-request",
+	repoOptions: GH_REPO_OPTIONS,
+	finding: { kind: "remote-write" }
+};
+const GH_PULL_REQUEST = { subcommands: {
+	comment: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"-b",
+			"--body",
+			"-F",
+			"--body-file",
+			"--attach"
+		],
+		writes: [PULL_REQUEST_WRITE]
+	},
+	merge: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"-A",
+			"--author-email",
+			"-b",
+			"--body",
+			"-F",
+			"--body-file",
+			"--match-head-commit",
+			"-t",
+			"--subject"
+		],
+		writes: [{
+			...PULL_REQUEST_WRITE,
+			role: "pull-request-merge",
+			ungrantFlags: [/^--admin(?:=|$)/u]
+		}]
+	},
+	edit: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"--add-assignee",
+			"--add-label",
+			"--add-project",
+			"--add-reviewer",
+			"--attach",
+			"-B",
+			"--base",
+			"-b",
+			"--body",
+			"-F",
+			"--body-file",
+			"-m",
+			"--milestone",
+			"--remove-assignee",
+			"--remove-label",
+			"--remove-project",
+			"--remove-reviewer",
+			"-t",
+			"--title"
+		],
+		writes: [PULL_REQUEST_WRITE]
+	},
+	close: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"-c",
+			"--comment"
+		],
+		writes: [PULL_REQUEST_WRITE]
+	},
+	review: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"-b",
+			"--body",
+			"-F",
+			"--body-file"
+		],
+		writes: [PULL_REQUEST_WRITE]
+	},
+	ready: {
+		valueOptions: GH_REPO_OPTIONS,
+		writes: [PULL_REQUEST_WRITE]
+	},
+	reopen: {
+		valueOptions: [
+			...GH_REPO_OPTIONS,
+			"-c",
+			"--comment"
+		],
+		writes: [PULL_REQUEST_WRITE]
+	}
+} };
+const GH_API_FIELDS = [
+	"-f",
+	"-F",
+	"--field",
+	"--raw-field",
+	"--input"
+];
+const FORGE_WRITE = {
+	operands: ["first"],
+	role: "forge-path",
+	credentialPattern: /secret|collaborator|protection|key|permission/u,
+	finding: { kind: "remote-write" }
+};
+const GH_API = {
+	valueOptions: [
+		...GH_API_FIELDS,
+		"-X",
+		"--method",
+		"-H",
+		"--header",
+		"-q",
+		"--jq",
+		"-t",
+		"--template",
+		"--hostname",
+		"-p",
+		"--preview",
+		"--cache"
+	],
+	subcommands: { graphql: { writes: [{
+		words: [/\bmutation\b/u],
+		finding: {
+			kind: "remote-write",
+			target: "gh api graphql mutation"
+		}
+	}] } },
+	writes: [{
+		...FORGE_WRITE,
+		optionValue: {
+			options: ["-X", "--method"],
+			value: /^(?:POST|PUT|PATCH|DELETE)$/iu
+		}
+	}, {
+		...FORGE_WRITE,
+		flags: GH_API_FIELDS,
+		readFlags: ["-X", "--method"]
+	}]
+};
+const GH_READS = {
+	list: {},
+	view: {},
+	clone: {},
+	status: {},
+	checks: {},
+	diff: {}
+};
+const GH_REMOTE_GROUP = {
+	subcommands: GH_READS,
+	otherSubcommand: { entry: { writes: [{ finding: { kind: "remote-write" } }] } }
+};
+const GH_CREDENTIAL_GROUP = {
+	subcommands: GH_READS,
+	otherSubcommand: { entry: CREDENTIAL_WRITE }
+};
+const PROGRAM_TABLE = {
+	git: GIT,
+	gh: { subcommands: {
+		pr: GH_PULL_REQUEST,
+		issue: GH_REMOTE_GROUP,
+		api: GH_API,
+		auth: { subcommands: {
+			refresh: CREDENTIAL_WRITE,
+			login: CREDENTIAL_WRITE,
+			logout: CREDENTIAL_WRITE
+		} },
+		secret: GH_CREDENTIAL_GROUP,
+		variable: GH_CREDENTIAL_GROUP,
+		"ssh-key": GH_CREDENTIAL_GROUP,
+		"gpg-key": GH_CREDENTIAL_GROUP,
+		gist: GH_REMOTE_GROUP,
+		release: GH_REMOTE_GROUP,
+		repo: GH_REMOTE_GROUP,
+		ruleset: GH_REMOTE_GROUP,
+		label: GH_REMOTE_GROUP,
+		workflow: GH_REMOTE_GROUP
+	} },
+	rm: PATH_OPERANDS,
+	rmdir: PATH_OPERANDS,
+	shred: PATH_OPERANDS,
+	truncate: PATH_OPERANDS,
+	chmod: PATH_OPERANDS,
+	chown: PATH_OPERANDS,
+	cp: COPY,
+	ln: COPY,
+	mv: {
+		valueOptions: TARGET_DIRECTORY,
+		writes: [{
+			options: TARGET_DIRECTORY,
+			operands: ["destination", "sources"]
+		}]
+	},
+	rsync: { writes: [{ operands: ["destination"] }] },
+	find: { writes: [{
+		flags: ["-delete", "-exec"],
+		operands: ["first"]
+	}] },
+	sed: IN_PLACE_EDIT,
+	perl: IN_PLACE_EDIT,
+	"ssh-keygen": {
+		valueOptions: ["-f"],
+		writes: [{
+			readFlags: [
+				"-l",
+				"-y",
+				"-F",
+				"-B",
+				"-R"
+			],
+			options: ["-f"]
+		}]
+	},
+	ssh: {
+		valueOptions: SSH_VALUE_OPTIONS,
+		optionsEndAtOperand: true,
+		writes: [{ options: ["-E"] }, {
+			operands: ["all"],
+			role: "remote-command",
+			reads: SSH_READS,
+			finding: { kind: "remote-write" }
+		}]
+	},
+	scp: {
+		valueOptions: SCP_VALUE_OPTIONS,
+		optionsEndAtOperand: true,
+		writes: [{
+			operands: ["destination"],
+			role: "remote-path",
+			finding: { kind: "remote-write" }
+		}]
+	},
+	curl: {
+		valueOptions: ["-X", "--request"],
+		writes: [{
+			flags: [/^-[a-zA-Z]*[dFT]$/u, /^--(?:data\S*|form|upload-file|json)$/u],
+			operands: ["all"],
+			role: "url",
+			finding: CURL_UPLOAD
+		}, {
+			optionValue: {
+				options: ["-X", "--request"],
+				value: /^(?:POST|PUT|PATCH|DELETE)$/u
+			},
+			operands: ["all"],
+			role: "url",
+			finding: CURL_UPLOAD
+		}]
+	},
+	op: { subcommands: {
+		item: { subcommands: {
+			edit: CREDENTIAL_WRITE,
+			create: CREDENTIAL_WRITE,
+			delete: CREDENTIAL_WRITE
+		} },
+		vault: { subcommands: {
+			edit: CREDENTIAL_WRITE,
+			create: CREDENTIAL_WRITE,
+			delete: CREDENTIAL_WRITE
+		} },
+		document: { subcommands: {
+			edit: CREDENTIAL_WRITE,
+			create: CREDENTIAL_WRITE,
+			delete: CREDENTIAL_WRITE
+		} }
+	} },
+	aws: { subcommands: { iam: { otherSubcommand: {
+		pattern: IAM_WRITE,
+		entry: CREDENTIAL_WRITE
+	} } } },
+	docker: {
+		valueOptions: [
+			"--config",
+			"-c",
+			"--context",
+			"-H",
+			"--host",
+			"-l",
+			"--log-level",
+			"--tlscacert",
+			"--tlscert",
+			"--tlskey"
+		],
+		subcommands: {
+			volume: { subcommands: {
+				prune: DOCKER_PRUNE,
+				rm: DOCKER_PRUNE
+			} },
+			system: { subcommands: { prune: DOCKER_PRUNE } },
+			image: { subcommands: { prune: DOCKER_PRUNE } },
+			container: { subcommands: { prune: DOCKER_PRUNE } },
+			compose: {
+				valueOptions: [
+					"--ansi",
+					"--env-file",
+					"-f",
+					"--file",
+					"--parallel",
+					"--profile",
+					"--progress",
+					"--project-directory",
+					"-p",
+					"--project-name"
+				],
+				subcommands: { down: { writes: [{
+					flags: ["-v", "--volumes"],
+					finding: {
+						kind: "prune",
+						quote: "call"
+					}
+				}] } }
+			}
+		}
+	},
+	kubectl: {
+		valueOptions: [
+			"--as",
+			"--as-group",
+			"--cache-dir",
+			"--certificate-authority",
+			"--client-certificate",
+			"--client-key",
+			"--cluster",
+			"--context",
+			"--kubeconfig",
+			"-n",
+			"--namespace",
+			"--request-timeout",
+			"-s",
+			"--server",
+			"--tls-server-name",
+			"--token",
+			"--user"
+		],
+		subcommands: {
+			apply: KUBECTL_WRITE,
+			delete: KUBECTL_WRITE,
+			replace: KUBECTL_WRITE,
+			patch: KUBECTL_WRITE,
+			scale: KUBECTL_WRITE
+		}
+	},
+	terraform: { subcommands: {
+		apply: TERRAFORM_WRITE,
+		destroy: TERRAFORM_WRITE,
+		import: TERRAFORM_WRITE
+	} },
+	codex: { subcommands: { exec: {
+		valueOptions: ["-o", "--output-last-message"],
+		writes: [{ options: ["-o", "--output-last-message"] }]
+	} } },
+	psql: { writes: [{
+		words: [/\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu],
+		finding: {
+			kind: "remote-write",
+			target: "database write"
+		}
+	}] },
+	npm: {
+		subcommands: { publish: { writes: [{ finding: { kind: "remote-write" } }] } },
+		writes: [PRODUCTION_DEPLOY]
+	},
+	bun: { writes: [PRODUCTION_DEPLOY] },
+	pnpm: { writes: [PRODUCTION_DEPLOY] },
+	yarn: { writes: [PRODUCTION_DEPLOY] }
+};
+//#endregion
+//#region src/containment/collect-program-findings.ts
+function collectProgramFindings(name, args, context, table = PROGRAM_TABLE) {
+	const entry = findEntry(table, name);
+	return entry === void 0 ? [] : collectEntryFindings(entry, [name], args, {
+		...context,
+		call: [name, ...args]
+	});
 }
-const LOCAL_HOSTS = /* @__PURE__ */ new Set([
-	"localhost",
-	"127.0.0.1",
-	"[::1]",
-	"0.0.0.0"
-]);
-function collectCurlFindings(args) {
-	const joined = args.join(" ");
-	const isUpload = args.some((word) => /^-[a-zA-Z]*[dFT]$|^--(?:data\S*|form|upload-file|json)$/u.test(word));
-	const isWriteMethod = /(?:-X\s*|--request\s+)(?:POST|PUT|PATCH|DELETE)/u.test(joined);
-	if (!isUpload && !isWriteMethod) return [];
-	const hosts = args.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
-	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host)) ? [] : [{
-		kind: "remote-write",
-		target: "curl upload"
-	}];
+function findEntry(entries, name) {
+	return entries !== void 0 && Object.hasOwn(entries, name) ? entries[name] : void 0;
 }
-const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
-	"clean",
-	"reset",
-	"checkout",
-	"switch",
-	"merge",
-	"commit",
-	"rm",
-	"stash",
-	"push"
-]);
-function collectGitFindings(args, directory, cwd, scope, scratchPaths) {
-	const git = splitGitCommand(args, directory, scope.home);
-	const gitDirectory = git.directory;
-	const [subcommand = "", ...rest] = git.args;
-	const operands = rest.filter((word) => !word.startsWith("-"));
-	const findings = [];
-	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope, scratchPaths)) findings.push({
+function collectEntryFindings(entry, command, words, context) {
+	const call = splitProgramCall(entry, words, context.directory, context.scope.home);
+	const entryContext = {
+		...context,
+		directory: call.directory
+	};
+	if (call.subcommand !== null) return collectEntryFindings(call.subcommand.entry, [...command, call.subcommand.name], call.subcommand.words, entryContext);
+	return (entry.writes ?? []).filter((rule) => isRuleApplied(rule, call, context.call)).flatMap((rule) => collectRuleFindings(rule, call, command, entryContext));
+}
+function splitProgramCall(entry, words, start, home) {
+	const options = [];
+	const operands = [];
+	const directoryOptions = entry.directoryOptions ?? [];
+	let directory = start;
+	let isOptionsEnd = false;
+	for (let index = 0; index < words.length; index += 1) {
+		const word = words[index] ?? "";
+		if (isOptionsEnd || !word.startsWith("-") || word === "-") {
+			const subcommand = operands.length === 0 ? findSubcommand(entry, word) : void 0;
+			if (subcommand !== void 0) return {
+				options,
+				operands,
+				directory,
+				subcommand: {
+					name: word,
+					entry: subcommand,
+					words: words.slice(index + 1)
+				}
+			};
+			operands.push(word);
+			isOptionsEnd ||= entry.optionsEndAtOperand === true;
+		} else if (word === "--") isOptionsEnd = true;
+		else {
+			const split = splitOption([...directoryOptions, ...entry.valueOptions ?? []], word, words[index + 1]);
+			for (const option of split.options) if (directoryOptions.includes(option.name)) directory = resolveShellPath(directory, option.value ?? "", home);
+			options.push(...split.options);
+			index += split.isValueNext ? 1 : 0;
+		}
+	}
+	return {
+		options,
+		operands,
+		directory,
+		subcommand: null
+	};
+}
+function findSubcommand(entry, word) {
+	const other = entry.otherSubcommand;
+	return findEntry(entry.subcommands, word) ?? (other !== void 0 && (other.pattern?.test(word) ?? true) ? other.entry : void 0);
+}
+function splitOption(valueOptions, word, next) {
+	for (const pattern of valueOptions) if (typeof pattern !== "string") {
+		if (pattern.test(word)) return {
+			options: [{
+				name: word,
+				value: next
+			}],
+			isValueNext: true
+		};
+	} else if (word === pattern) return {
+		options: [{
+			name: pattern,
+			value: next
+		}],
+		isValueNext: true
+	};
+	else if (pattern.startsWith("--") ? word.startsWith(`${pattern}=`) : word.startsWith(pattern)) return {
+		options: [{
+			name: pattern,
+			value: word.slice(pattern.length).replace(/^=/u, "")
+		}],
+		isValueNext: false
+	};
+	return splitOptionCluster(valueOptions, word, next);
+}
+function splitOptionCluster(valueOptions, word, next) {
+	const letters = /^-[^-]./u.test(word) ? word.slice(1).match(/./gu) ?? [] : [];
+	const at = letters.findIndex((letter) => valueOptions.includes(`-${letter}`));
+	if (at === -1) return {
+		options: [{
+			name: word,
+			value: void 0
+		}],
+		isValueNext: false
+	};
+	const attached = word.slice(at + 2);
+	return {
+		options: [...letters.slice(0, at).map((letter) => ({
+			name: `-${letter}`,
+			value: void 0
+		})), {
+			name: `-${letters[at] ?? ""}`,
+			value: attached === "" ? next : attached
+		}],
+		isValueNext: attached === ""
+	};
+}
+function isRuleApplied(rule, call, words) {
+	const optionValue = rule.optionValue;
+	return (rule.flags === void 0 || hasOption(call, rule.flags)) && !hasOption(call, rule.readFlags ?? []) && (rule.words ?? []).every((pattern) => words.some((word) => pattern.test(word))) && (optionValue === void 0 || call.options.some((option) => optionValue.options.includes(option.name) && option.value !== void 0 && optionValue.value.test(option.value)));
+}
+function hasOption(call, patterns) {
+	return call.options.some((option) => patterns.some((pattern) => typeof pattern === "string" ? option.name === pattern : pattern.test(option.name)));
+}
+function collectRuleFindings(rule, call, command, context) {
+	const finding = rule.finding === void 0 ? null : buildFinding(rule.finding, command, call, context.call);
+	const directory = context.directory;
+	if (rule.directory === true) return directory === null || isInScope(directory, context.scope, context.scratchPaths) ? [] : [{
 		kind: "path",
-		target: gitDirectory
-	});
-	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope, scratchPaths));
-	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
+		target: directory
+	}];
+	if (rule.options === void 0 && rule.operands === void 0) return finding === null ? [] : [finding];
+	const targets = [...call.options.flatMap((option) => rule.options?.includes(option.name) === true && option.value !== void 0 ? [option.value] : []), ...(rule.operands ?? []).flatMap((selector) => pickOperands(selector, rule, call))];
+	return collectRoleFindings(rule, targets.length === 0 && rule.whenNone !== void 0 ? [rule.whenNone] : targets, finding, call, context);
+}
+function buildFinding(finding, command, call, words) {
+	const quoted = {
+		call: words,
+		operand: [...command, ...call.operands.slice(0, 1)],
+		command
+	};
+	return {
+		kind: finding.kind,
+		target: finding.target ?? quoted[finding.quote ?? "command"].join(" ")
+	};
+}
+function collectRoleFindings(rule, targets, finding, call, context) {
+	const scope = context.scope;
+	const resolve = (target) => collectTargetFindings(context.directory, target, scope, context.scratchPaths);
+	const role = rule.role ?? "path";
+	if (role === "path") return targets.flatMap((target) => resolve(target));
+	if (role === "branch") return targets.filter((branch) => !scope.branches.includes(branch)).map((branch) => ({
 		kind: "branch",
 		target: branch,
 		grant: { kind: "branch" }
-	});
-	const [resetTarget] = operands;
-	if (subcommand === "reset" && rest.includes("--hard") && resetTarget !== void 0 && resetTarget !== "HEAD" && resetTarget !== "@" && !isUnresolvedWord(resetTarget)) findings.push({
-		kind: "discard",
-		target: `git reset --hard ${resetTarget}`
-	});
-	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
-	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
-		kind: "credential",
-		target: `git config ${operands[0] ?? ""}`
-	});
-	if (subcommand === "push") {
-		const currentBranch = gitDirectory === cwd ? scope.currentBranch : null;
-		findings.push(...collectPushFindings(rest, operands, currentBranch, scope));
-	}
-	return findings;
-}
-function collectPushFindings(rest, operands, currentBranch, scope) {
-	const [remote, ...refspecs] = operands;
-	const findings = [];
-	if (rest.includes("--all") || rest.includes("--mirror")) findings.push({
-		kind: "branch",
-		target: "--all"
-	});
-	if (remote !== void 0 && !isUnresolvedWord(remote) && !isOwnedRemote(remote, scope)) findings.push({
+	}));
+	if (role === "remote") return targets.filter((remote) => !isUnresolvedWord(remote) && !isOwnedRemote(remote, scope)).map((remote) => ({
 		kind: "remote-write",
 		target: remote
-	});
-	const destinations = refspecs.length === 0 && !rest.includes("--tags") ? ["HEAD"] : refspecs;
-	for (const refspec of destinations) {
-		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
-		const branch = named === "HEAD" ? currentBranch : named;
-		if (branch !== null && !isUnresolvedWord(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
-			kind: "branch",
-			target: branch,
-			grant: { kind: "branch" }
-		});
+	}));
+	if (role === "refspec") {
+		const current = context.directory === context.cwd ? scope.currentBranch : null;
+		return targets.flatMap((refspec) => collectRefspecFindings(refspec, current, scope));
 	}
-	return findings;
+	return finding === null ? [] : collectNamedFindings(role, rule, targets, finding, call, context);
 }
 function isOwnedRemote(remote, scope) {
 	if (scope.remotes.some((entry) => entry.name === remote)) return true;
 	const slug = toRepositorySlug(remote);
 	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
 }
-const GH_PR_WRITES = /* @__PURE__ */ new Set([
-	"comment",
-	"merge",
-	"edit",
-	"close",
-	"review",
-	"ready",
-	"reopen"
-]);
-const GH_REMOTE_WRITES = /* @__PURE__ */ new Set([
-	"gist",
-	"release",
-	"repo",
-	"ruleset",
-	"label",
-	"workflow"
-]);
-const GH_CREDENTIAL_WRITES = /* @__PURE__ */ new Set([
-	"secret",
-	"variable",
-	"ssh-key",
-	"gpg-key"
+function collectRefspecFindings(refspec, current, scope) {
+	const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
+	const branch = named === "HEAD" ? current : named;
+	return branch === null || isUnresolvedWord(branch) || branch.startsWith("refs/tags/") || scope.branches.includes(branch) ? [] : [{
+		kind: "branch",
+		target: branch,
+		grant: { kind: "branch" }
+	}];
+}
+function collectNamedFindings(role, rule, targets, finding, call, context) {
+	if (role === "remote-path") return targets.flatMap((target) => /^[^/]+:/u.test(target) ? [finding] : collectTargetFindings(context.directory, target, context.scope, context.scratchPaths));
+	if (role === "url") return isLocalUpload(targets) ? [] : [finding];
+	if (role === "remote-command") return isRemoteRead(targets, rule.reads ?? []) ? [] : [finding];
+	if (role === "commit") return targets.filter((commit) => commit !== "HEAD" && commit !== "@" && !isUnresolvedWord(commit)).map((commit) => ({
+		kind: finding.kind,
+		target: `${finding.target} ${commit}`
+	}));
+	if (role === "pull-request" || role === "pull-request-merge") return collectPullRequestFindings(rule, targets[0], finding, call, context.scope);
+	return collectForgeFindings(rule, targets[0] ?? "", finding, context.scope);
+}
+function collectPullRequestFindings(rule, selector, finding, call, scope) {
+	const repoOptions = rule.repoOptions ?? [];
+	const url = /^https?:\/\/(?<repo>[^/]+\/[^/]+\/[^/]+)\/pull\/(?<number>\d+)(?:[/?#]|$)/u.exec(selector ?? "")?.groups;
+	const repo = url?.["repo"] ?? call.options.findLast((option) => repoOptions.includes(option.name))?.value;
+	let number = NaN;
+	if (url !== void 0) number = Number(url["number"]);
+	else if (selector !== void 0 && /^#?\d+$/u.test(selector)) number = Number(selector.replace("#", ""));
+	if (rule.role === "pull-request" && isOwnedPullRequest(number, repo, scope)) return [];
+	return Number.isInteger(number) && !hasOption(call, rule.ungrantFlags ?? []) ? [{
+		...finding,
+		grant: {
+			kind: "pull-request",
+			number
+		}
+	}] : [finding];
+}
+function collectForgeFindings(rule, path, finding, scope) {
+	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(path)?.groups;
+	if (pull !== void 0 && isOwnedPullRequest(Number(pull["number"]), pull["repo"] ?? "", scope) && !path.includes("/merge")) return [];
+	return [{
+		kind: rule.credentialPattern?.test(path) === true ? "credential" : finding.kind,
+		target: `${finding.target} ${path}`
+	}];
+}
+function pickOperands(selector, rule, call) {
+	const operands = call.operands;
+	const isNamed = hasOption(call, rule.options ?? []);
+	if (selector === "all") return operands;
+	if (selector === "first") return operands.slice(0, 1);
+	if (selector === "after-first") return operands.slice(1);
+	if (selector === "after-script") return hasOption(call, rule.scriptOptions ?? []) ? operands : operands.slice(1);
+	if (isNamed) return selector === "sources" ? operands : [];
+	if (operands.length < 2) return [];
+	return selector === "destination" ? operands.slice(-1) : operands.slice(0, -1);
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"0.0.0.0"
 ]);
-const GH_READS = /* @__PURE__ */ new Set([
-	"list",
-	"view",
-	"clone",
-	"status",
-	"checks",
-	"diff"
+function isLocalUpload(words) {
+	const hosts = words.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
+	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host));
+}
+function isRemoteRead(words, reads) {
+	const [host, ...remote] = words;
+	if (host === void 0) return true;
+	const command = remote.join(" ");
+	const [program] = command.trim().split(/\s+/u);
+	return reads.includes(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command);
+}
+//#endregion
+//#region src/containment/collect-scope-findings.ts
+function collectScopeFindings(action, scope, scratchPaths = SCRATCH_PATHS) {
+	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
+	const command = action.input["command"];
+	const findings = [
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope, scratchPaths) : [],
+		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, action.cwd, scope, scratchPaths) : []
+	];
+	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
+}
+const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit"
 ]);
-function collectGhFindings(args, scope) {
-	const group = args[0] ?? "";
-	const verb = args[1] ?? "";
-	if (group === "pr" && GH_PR_WRITES.has(verb)) {
-		const pull = findPullRequestSelector(verb, args.slice(2));
-		const number = pull?.number ?? NaN;
-		const isOwned = verb !== "merge" && isOwnedPullRequest(number, pull?.repo, scope);
-		const isAdmin = args.some((word) => /^--admin(?:=|$)/u.test(word));
-		if (isOwned) return [];
-		return Number.isInteger(number) && !isAdmin ? [{
-			kind: "remote-write",
-			target: `gh pr ${verb}`,
-			grant: {
-				kind: "pull-request",
-				number
-			}
-		}] : [{
-			kind: "remote-write",
-			target: `gh pr ${verb}`
-		}];
+function collectToolFindings(action, scope) {
+	const verb = action.tool.split("__").at(-1) ?? "";
+	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
+	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
+	const owner = action.input["owner"];
+	const name = action.input["repo"];
+	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
+	if (!verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope)) return [];
+	return typeof number === "number" ? [{
+		kind: "remote-write",
+		target: action.tool,
+		grant: {
+			kind: "pull-request",
+			number
+		}
+	}] : [{
+		kind: "remote-write",
+		target: action.tool
+	}];
+}
+function collectCommandFindings(command, directory, cwd, scope, scratchPaths) {
+	const findings = [];
+	const entries = collectShellCommands(command, directory, scope.home);
+	const piped = collectPipedSegments(command);
+	const segments = splitShellCommand(command).segments;
+	const scripts = collectShellScripts(command);
+	for (const [index, entry] of entries.entries()) {
+		const [name, ...args] = entry.words;
+		const fixed = findFixedXargsCommand(entry.words, segments[index]?.text ?? "");
+		if (fixed !== null) findings.push(...collectCallFindings(fixed.name, fixed.args, entry.directory, cwd, scope, scratchPaths));
+		else if (isBranchSweep(entries.slice(0, index + 1), piped.slice(0, index + 1))) findings.push({
+			kind: "discard",
+			target: "git branch delete by exclusion"
+		});
+		for (const target of entry.writeTargets) findings.push(...collectTargetFindings(entry.directory, target, scope, scratchPaths));
+		if (name !== void 0 && name !== "cd") findings.push(...collectCallFindings(name, args, entry.directory, cwd, scope, scratchPaths));
+		for (const script of scripts.filter((candidate) => candidate.segment === index)) findings.push(...collectCommandFindings(script.text, entry.directory, cwd, scope, scratchPaths));
+	}
+	return findings;
+}
+function collectPipedSegments(command) {
+	const piped = [];
+	let separator = null;
+	let isInSegment = false;
+	for (const token of splitShellTokens(command).tokens) if (token.kind === "separator") {
+		separator = token.operator;
+		isInSegment = false;
+	} else if (!isInSegment && token.kind !== "comment" && token.kind !== "heredoc") {
+		piped.push(separator === "|");
+		isInSegment = true;
+	}
+	return piped;
+}
+const XARGS_FLAG = /^(?:-[0oprtx]+|--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty))$/u;
+const XARGS_VALUE_OPTION = /^-[EPads]$/u;
+const XARGS_ATTACHED_VALUE = /^(?:-[EPads].|--(?:eof|max-procs|delimiter|arg-file|max-chars|process-slot-var)=)/u;
+const XARGS_REPLACE = /^(?:-I(?<attached>.+)|-i(?<short>.*)|--replace(?:=(?<long>.*))?)$/u;
+const PLAIN_WORD = /^(?:[\w./:@%+=-]|\{\})+$/u;
+function findFixedXargsCommand(words, text) {
+	if (words[0] !== "xargs" || !splitShellTokens(text).tokens.every((token) => token.kind !== "word" || token.raw === token.value && PLAIN_WORD.test(token.value))) return null;
+	let token = null;
+	let start = 1;
+	while (words[start]?.startsWith("-") === true) {
+		const word = words[start] ?? "";
+		const replace = XARGS_REPLACE.exec(word)?.groups;
+		if (word === "--") {
+			start += 1;
+			break;
+		}
+		if (word === "-I") {
+			token = words[start + 1] ?? null;
+			start += 2;
+		} else if (replace !== void 0) {
+			const short = replace["short"];
+			token = replace["attached"] ?? replace["long"] ?? (short === void 0 || short === "" ? "{}" : short);
+			start += 1;
+		} else if (word.startsWith("-J")) {
+			token = null;
+			start += word === "-J" ? 2 : 1;
+		} else if (XARGS_VALUE_OPTION.test(word)) start += 2;
+		else if (XARGS_FLAG.test(word) || XARGS_ATTACHED_VALUE.test(word)) start += 1;
+		else return null;
 	}
-	if (group === "issue" && verb !== "" && !GH_READS.has(verb)) return [{
-		kind: "remote-write",
-		target: `gh issue ${verb}`
-	}];
-	if (group === "api") return collectGhAPIFindings(args.slice(1), scope);
-	if (group === "auth" && [
-		"refresh",
-		"login",
-		"logout"
-	].includes(verb)) return [{
-		kind: "credential",
-		target: `gh auth ${verb}`
-	}];
-	if (GH_CREDENTIAL_WRITES.has(group) && !GH_READS.has(verb)) return [{
-		kind: "credential",
-		target: `gh ${group} ${verb}`
-	}];
-	if (GH_REMOTE_WRITES.has(group) && !GH_READS.has(verb)) return [{
-		kind: "remote-write",
-		target: `gh ${group} ${verb}`
-	}];
-	return [];
-}
-const GH_PR_VALUE_OPTIONS = {
-	comment: /* @__PURE__ */ new Set([
-		"-b",
-		"--body",
-		"-F",
-		"--body-file",
-		"--attach"
-	]),
-	merge: /* @__PURE__ */ new Set([
-		"-A",
-		"--author-email",
-		"-b",
-		"--body",
-		"-F",
-		"--body-file",
-		"--match-head-commit",
-		"-t",
-		"--subject"
-	]),
-	edit: /* @__PURE__ */ new Set([
-		"--add-assignee",
-		"--add-label",
-		"--add-project",
-		"--add-reviewer",
-		"--attach",
-		"-B",
-		"--base",
-		"-b",
-		"--body",
-		"-F",
-		"--body-file",
-		"-m",
-		"--milestone",
-		"--remove-assignee",
-		"--remove-label",
-		"--remove-project",
-		"--remove-reviewer",
-		"-t",
-		"--title"
-	]),
-	close: /* @__PURE__ */ new Set(["-c", "--comment"]),
-	review: /* @__PURE__ */ new Set([
-		"-b",
-		"--body",
-		"-F",
-		"--body-file"
-	]),
-	ready: /* @__PURE__ */ new Set(),
-	reopen: /* @__PURE__ */ new Set(["-c", "--comment"])
-};
-const GH_REPO_OPTIONS = /* @__PURE__ */ new Set(["-R", "--repo"]);
-function findPullRequestSelector(verb, args) {
-	const valueOptions = GH_PR_VALUE_OPTIONS[verb] ?? /* @__PURE__ */ new Set();
-	let repo;
-	let selector;
-	for (let index = 0; index < args.length; index += 1) {
-		const word = args[index] ?? "";
-		if (GH_REPO_OPTIONS.has(word)) repo = args[index + 1];
-		else if (word.startsWith("--repo=")) repo = word.slice(7);
-		if (GH_REPO_OPTIONS.has(word) || valueOptions.has(word)) index += 1;
-		else if (selector === void 0 && !word.startsWith("-")) selector = word;
-	}
-	if (selector === void 0) return null;
-	const url = /^https?:\/\/(?<repo>[^/]+\/[^/]+\/[^/]+)\/pull\/(?<number>\d+)(?:[/?#]|$)/u.exec(selector)?.groups;
-	if (url !== void 0) return {
-		number: Number(url["number"]),
-		repo: url["repo"]
-	};
+	const [name, ...args] = words.slice(start);
+	if (token === null || token === "" || name === void 0 || [name, ...args].some((word) => word.includes(token))) return null;
 	return {
-		number: /^#?\d+$/u.test(selector) ? Number(selector.replace("#", "")) : null,
-		repo
+		name,
+		args
 	};
 }
-function isOwnedPullRequest(number, repo, scope) {
-	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
-	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
-	return scope.pullRequests.some((pull) => pull.number === number && (wanted === void 0 ? slugs.size === 1 && slugs.has(pull.repository) : pull.repository === wanted || pull.repository.endsWith(`/${wanted}`)));
+const XARGS_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-I",
+	"-J",
+	"-L",
+	"-n",
+	"-P",
+	"-s",
+	"-d",
+	"-E"
+]);
+function isBranchSweep(entries, piped) {
+	const deleter = entries.at(-1)?.words ?? [];
+	if (deleter[0] !== "xargs" || piped.at(-1) !== true) return false;
+	let start = 1;
+	while (deleter[start]?.startsWith("-") === true) {
+		if (/^(?:-a|--arg-file)/u.test(deleter[start] ?? "")) return false;
+		start += XARGS_VALUE_OPTIONS.has(deleter[start] ?? "") ? 2 : 1;
+	}
+	const [program, subcommand, ...rest] = deleter.slice(start);
+	if (program !== "git" || subcommand !== "branch" || !rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) return false;
+	let first = entries.length - 2;
+	while (first > 0 && piped[first] === true) first -= 1;
+	const [listing, ...filters] = entries.slice(first, -1).map((entry) => entry.words);
+	return listing !== void 0 && isWholeBranchListing(listing) && filters.every((filter) => isExcludingFilter(filter));
 }
-function collectGhAPIFindings(args, scope) {
-	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
-	if (endpoint === "graphql") return args.some((word) => /\bmutation\b/u.test(word)) ? [{
-		kind: "remote-write",
-		target: "gh api graphql mutation"
-	}] : [];
-	const methodIndex = args.findIndex((word) => word === "-X" || word === "--method");
-	const method = methodIndex === -1 ? null : (args[methodIndex + 1] ?? "").toUpperCase();
-	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
-	if (method === "GET" || method === null && !hasFields) return [];
-	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
-	if (pull !== void 0 && isOwnedPullRequest(Number(pull["number"]), pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
-	return [{
-		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
-		target: `gh api ${endpoint}`
-	}];
+function isWholeBranchListing(words) {
+	const [program, subcommand, ...rest] = words;
+	if (program !== "git") return false;
+	if (subcommand === "branch") return rest.every((word) => /^(?:-a|-r|-v|-vv|--all|--remotes|--no-color|--format=.*)$/u.test(word));
+	if (subcommand !== "for-each-ref") return false;
+	return rest.filter((_word, index) => !/^--(?:format|sort)$/u.test(rest[index - 1] ?? "")).every((word) => /^--(?:format|sort)(?:=.*)?$/u.test(word) || /^refs\/heads\/?$/u.test(word));
 }
-const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
-function findProgramFinding(name, args) {
-	const joined = args.join(" ");
-	if (name === "op" && /^(?:item|vault|document) (?:edit|create|delete)\b/u.test(joined)) return {
-		kind: "credential",
-		target: `op ${args[0] ?? ""} ${args[1] ?? ""}`
-	};
-	if (name === "aws" && args[0] === "iam" && IAM_WRITE.test(args[1] ?? "")) return {
-		kind: "credential",
-		target: `aws iam ${args[1] ?? ""}`
-	};
-	if (name === "docker" && /\b(?:volume|system|image|container) prune\b|\bvolume rm\b|\bdown\b.*(?:-v|--volumes)\b/u.test(joined)) return {
-		kind: "prune",
-		target: `docker ${joined}`
-	};
-	if (name === "npm" && args[0] === "publish") return {
-		kind: "remote-write",
-		target: "npm publish"
-	};
-	if (name === "kubectl" && /\b(?:apply|delete|replace|patch|scale)\b/u.test(joined)) return {
-		kind: "remote-write",
-		target: "kubectl write"
-	};
-	if (name === "terraform" && /\b(?:apply|destroy|import)\b/u.test(joined)) return {
-		kind: "remote-write",
-		target: "terraform write"
-	};
-	if (name === "psql" && /\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu.test(joined)) return {
-		kind: "remote-write",
-		target: "database write"
-	};
-	if (/^(?:bun|npm|pnpm|yarn)$/u.test(name) && /\bdeploy\b/u.test(joined) && /prod/u.test(joined)) return {
-		kind: "remote-write",
-		target: "production deploy"
-	};
-	return null;
+const NAME_EDITORS = /* @__PURE__ */ new Set([
+	"tr",
+	"cut",
+	"sort"
+]);
+function isExcludingFilter(words) {
+	const [program, ...args] = words;
+	if (program === "grep" || program === "egrep") return args.some((word) => /^-[a-zA-Z]*v[a-zA-Z]*$|^--invert-match$/u.test(word));
+	if (program === "sed") return isSubstitutionOnly(args);
+	if (program === "uniq") return args.every((word) => !/^-[a-zA-Z]*[dDu]/u.test(word));
+	return program !== void 0 && NAME_EDITORS.has(program);
 }
-function collectInPlaceFiles(args) {
-	const files = [];
-	let skipNext = false;
-	let sawScript = false;
-	for (const word of args) if (skipNext) {
-		skipNext = false;
-		sawScript = true;
-	} else if (/^-\w*e$/u.test(word)) skipNext = true;
-	else if (!word.startsWith("-")) {
-		if (sawScript) files.push(word);
-		else sawScript = true;
-	}
-	return files;
+function isSubstitutionOnly(args) {
+	const scripts = args.filter((word) => word !== "-e" && word !== "-E" && word !== "-r");
+	return scripts.length > 0 && scripts.every((script) => /^s(?<delimiter>[^\w\s;])(?:(?!\k<delimiter>).)*\k<delimiter>(?:(?!\k<delimiter>).)*\k<delimiter>g?$/u.test(script));
 }
-function isInScope(path, scope, scratchPaths) {
-	if (scratchPaths.some((entry) => isUnder$1(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
-	return scope.worktrees.some((worktree) => {
-		const isNested = isUnder$1(path, join(worktree, ".worktrees"));
-		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder$1(path, other));
-		return isUnder$1(path, worktree) && (!isNested || isOtherOwned);
-	});
+function collectCallFindings(name, args, directory, cwd, scope, scratchPaths) {
+	return [...collectProgramFindings(name, args, {
+		directory,
+		cwd,
+		scope,
+		scratchPaths
+	}), ...collectRecordFindings(name, args)];
 }
-function isUnder$1(path, root) {
-	return path === root || path.startsWith(`${root}/`);
+function collectRecordFindings(name, args) {
+	const words = [name, ...args];
+	const launcher = words.findIndex((word) => word.includes("auto-mode"));
+	return launcher !== -1 && words.slice(launcher + 1).includes("record") ? [{
+		kind: "credential",
+		target: "auto-mode record"
+	}] : [];
 }
 //#endregion
 //#region src/containment/check-containment.ts
@@ -7248,6 +8077,83 @@ function formatList(one, many, values) {
 	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
 }
 //#endregion
+//#region src/scope/is-protected-branch.ts
+function isProtectedBranch(branch, patterns) {
+	return patterns.some((pattern) => buildBranchPattern(pattern).test(branch));
+}
+function buildBranchPattern(pattern) {
+	let source = "";
+	let index = 0;
+	while (index < pattern.length) {
+		const char = pattern[index] ?? "";
+		if (pattern.startsWith("**/", index)) {
+			source += "(?:.*/)?";
+			index += 3;
+		} else if (pattern.startsWith("**", index)) {
+			source += ".*";
+			index += 2;
+		} else if (char === "*") {
+			source += "[^/]*";
+			index += 1;
+		} else if (char === "?") {
+			source += "[^/]";
+			index += 1;
+		} else if (char === "[") {
+			const bracket = buildBracketPattern(pattern, index);
+			source += bracket?.source ?? String.raw`\[`;
+			index = bracket?.end ?? index + 1;
+		} else if (char === "\\" && index + 1 < pattern.length) {
+			source += toLiteralPattern(pattern[index + 1] ?? "");
+			index += 2;
+		} else {
+			source += toLiteralPattern(char);
+			index += 1;
+		}
+	}
+	return new RegExp(`^${source}$`, "u");
+}
+function buildBracketPattern(pattern, start) {
+	let index = start + 1;
+	const negated = pattern[index] === "!" || pattern[index] === "^";
+	if (negated) index += 1;
+	let members = "";
+	while (index < pattern.length) {
+		if (pattern[index] === "]") return {
+			source: buildClassSource(members, negated),
+			end: index + 1
+		};
+		const low = readClassChar(pattern, index);
+		index = low.end;
+		if (pattern[index] === "-" && index + 1 < pattern.length && pattern[index + 1] !== "]") {
+			const high = readClassChar(pattern, index + 1);
+			index = high.end;
+			members += buildRangeSource(low.char, high.char);
+		} else members += toClassMember(low.char);
+	}
+	return null;
+}
+function readClassChar(pattern, index) {
+	const start = pattern[index] === "\\" && index + 1 < pattern.length ? index + 1 : index;
+	const char = String.fromCodePoint(pattern.codePointAt(start) ?? 0);
+	return {
+		char,
+		end: start + char.length
+	};
+}
+function buildRangeSource(low, high) {
+	return (low.codePointAt(0) ?? 0) <= (high.codePointAt(0) ?? 0) ? `${toClassMember(low)}-${toClassMember(high)}` : "";
+}
+function buildClassSource(members, negated) {
+	if (negated) return `[^/${members}]`;
+	return members === "" ? "(?!)" : `(?!/)[${members}]`;
+}
+function toClassMember(char) {
+	return /[\\\][^-]/u.test(char) ? `\\${char}` : char;
+}
+function toLiteralPattern(char) {
+	return char.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+//#endregion
 //#region src/scope/protected-branch-names.ts
 const PROTECTED_BRANCH_NAMES = /* @__PURE__ */ new Set([
 	"main",
@@ -7279,7 +8185,7 @@ function findNamingWord(finding, words, context) {
 	if (grant === void 0) return null;
 	if (grant.kind === "pull-request") return findPullRequestWord(grant.number, words);
 	if (grant.kind === "path") return findPathWord(finding.target, words, context.home);
-	if (PROTECTED_BRANCH_NAMES.has(finding.target) || finding.target === context.defaultBranch) return null;
+	if (PROTECTED_BRANCH_NAMES.has(finding.target) || finding.target === context.defaultBranch || isProtectedBranch(finding.target, context.protectedBranches ?? [])) return null;
 	return words.find((word) => word === finding.target) ?? null;
 }
 const PULL_REQUEST_NOUNS = /^(?:pr|pull|request)$/iu;
@@ -7924,10 +8830,19 @@ const VERDICT = /<verdict>\s*(?<verdict>[^<]*?)\s*<\/verdict>/giu;
 const REASON$1 = /<reason>(?<reason>[\s\S]*?)<\/reason>/giu;
 const BASIS = /<basis>\s*(?<basis>[^<]*?)\s*<\/basis>/giu;
 function parseJudgeReply(text) {
-	const verdicts = [...text.matchAll(VERDICT)].map((match) => match.groups?.["verdict"]?.toLowerCase());
+	const verdictMatches = [...text.matchAll(VERDICT)];
+	const verdicts = verdictMatches.map((match) => match.groups?.["verdict"]?.toLowerCase());
 	const reasons = [...text.matchAll(REASON$1)].map((match) => match.groups?.["reason"]?.trim());
+	const [verdictMatch] = verdictMatches;
 	const [verdict] = verdicts;
 	const [reason] = reasons;
+	if (verdictMatch !== void 0 && verdicts.length === 1 && verdict === "confirm" && reasons.length === 0) {
+		const unclosedReason = findUnclosedReason(text, verdictMatch.index + verdictMatch[0].length);
+		return unclosedReason === void 0 ? { kind: "unreadable" } : {
+			kind: "confirm",
+			reason: unclosedReason
+		};
+	}
 	if (verdicts.length !== 1 || reasons.length !== 1 || reason === void 0 || reason === "" || verdict !== "confirm" && verdict !== "overturn") return { kind: "unreadable" };
 	if (verdict === "confirm") return {
 		kind: "confirm",
@@ -7942,6 +8857,15 @@ function parseJudgeReply(text) {
 		reason
 	};
 }
+const REASON_OPENING = /<reason>/giu;
+const REASON_CLOSING = /<\/reason>/iu;
+function findUnclosedReason(text, verdictEnd) {
+	const openings = [...text.matchAll(REASON_OPENING)];
+	const [opening] = openings;
+	if (openings.length !== 1 || opening === void 0 || opening.index < verdictEnd || REASON_CLOSING.test(text)) return;
+	const reason = text.slice(opening.index + opening[0].length).trim();
+	return reason === "" ? void 0 : reason;
+}
 //#endregion
 //#region src/messages/anthropic-client.ts
 async function sendMessage(provider, apiKey, request, signal) {
@@ -8038,11 +8962,16 @@ async function runClaudeCode(provider, request, env, signal) {
 		cwd: tmpdir(),
 		env: buildChildEnv(env)
 	});
-	const body = CLAUDE_OUTPUT.safeParse(parseOutputJSON(result.stdout));
+	const output = parseOutputJSON(result.stdout);
+	const body = CLAUDE_OUTPUT.safeParse(output);
 	if (result.exitCode !== 0 || !body.success || body.data.is_error || body.data.result === void 0) throw new Error(`claude -p failed with exit code ${String(result.exitCode)}`);
+	const usage = MODEL_USAGE_OUTPUT.safeParse(output).data?.modelUsage;
+	const stops = SAFETY_STOPS_OUTPUT.safeParse(output).data?.safety_stops;
 	return {
 		text: body.data.result,
-		model: provider.model
+		model: pickAnsweringModel(usage, provider.model),
+		safetyStops: stops ?? null,
+		fallback: isFallbackReply(usage, stops)
 	};
 }
 function buildChildEnv(env) {
@@ -8061,6 +8990,8 @@ const CLAUDE_OUTPUT = object({
 	is_error: boolean(),
 	result: string().optional()
 });
+const MODEL_USAGE_OUTPUT = object({ modelUsage: record(string(), object({ outputTokens: number() })) });
+const SAFETY_STOPS_OUTPUT = object({ safety_stops: number() });
 function parseOutputJSON(text) {
 	try {
 		return JSON.parse(text);
@@ -8068,13 +8999,27 @@ function parseOutputJSON(text) {
 		return null;
 	}
 }
+function pickAnsweringModel(usage, requested) {
+	const [top] = Object.entries(usage ?? {}).filter(([, entry]) => entry.outputTokens > 0).toSorted(([, left], [, right]) => right.outputTokens - left.outputTokens);
+	return top === void 0 ? requested : top[0];
+}
+function isFallbackReply(usage, stops) {
+	if (stops !== void 0) return stops > 0;
+	const entries = Object.values(usage ?? {});
+	return entries.some((entry) => entry.outputTokens === 0) && entries.some((entry) => entry.outputTokens > 0);
+}
 //#endregion
 //#region src/judge/send-judge-message.ts
 async function sendJudgeMessage(provider, request, transport, signal) {
-	if (provider.protocol === "claude-code") return (await runClaudeCode(provider, request, transport.env, signal)).text;
+	if (provider.protocol === "claude-code") return runClaudeCode(provider, request, transport.env, signal);
 	if (provider.protocol === "system-one") throw new Error("Jev returns typed answers and cannot write a judge reason");
 	if (transport.apiKey === null) throw new Error("no API key for the judge");
-	return (await sendMessage(provider, transport.apiKey, request, signal)).text;
+	return {
+		text: (await sendMessage(provider, transport.apiKey, request, signal)).text,
+		model: provider.model,
+		safetyStops: null,
+		fallback: false
+	};
 }
 //#endregion
 //#region src/judge/classify-with-judge.ts
@@ -8083,6 +9028,7 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 	const now = options.now ?? Date.now;
 	const overturns = evidence.containment === void 0 ? options.overturns : "consent";
 	let failure = null;
+	let answered = null;
 	let verdict;
 	try {
 		failure = "credential";
@@ -8109,7 +9055,7 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 		const timer = (options.timeout ?? ((ms) => AbortSignal.timeout(ms)))(toTimerDelay(Math.min(judge.timeoutMs, remainingMs)));
 		const signal = options.signal === void 0 ? timer : AbortSignal.any([timer, options.signal]);
 		failure = "request";
-		const reply = parseJudgeReply(await sendJudgeMessage(judge, {
+		answered = await sendJudgeMessage(judge, {
 			system,
 			user
 		}, {
@@ -8118,7 +9064,8 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 		}, signal).catch((error) => {
 			if (signal.aborted) failure = "timeout";
 			throw error;
-		}));
+		});
+		const reply = parseJudgeReply(answered.text);
 		failure = reply.kind === "unreadable" ? "unreadable" : null;
 		verdict = buildJudgedVerdict(evidence.rule, evidence.basis, reply, overturns, evidence.containment?.reason);
 	} catch {
@@ -8131,6 +9078,8 @@ async function classifyWithJudge(payload, evidence, judge, options) {
 			failureReason: failure,
 			overturnBasis: verdict.overturnBasis,
 			model: judge.model,
+			answeringModel: answered?.model ?? null,
+			safetyStops: answered?.safetyStops ?? null,
 			rule: evidence.rule.source === "shipped" ? evidence.rule.name : evidence.rule.source,
 			tier: evidence.rule.tier,
 			elapsedMs: Math.round(performance.now() - start)
@@ -8268,6 +9217,21 @@ function buildTaskContext(context) {
 	return result;
 }
 //#endregion
+//#region src/shell/split-git-command.ts
+function splitGitCommand(args, directory, home) {
+	let gitDirectory = directory;
+	let index = 0;
+	while (index < args.length && args[index]?.startsWith("-") === true) {
+		const option = args[index];
+		if (option === "-C") gitDirectory = resolveShellPath(gitDirectory, args[index + 1] ?? "", home);
+		index += option === "-C" || option === "-c" ? 2 : 1;
+	}
+	return {
+		directory: gitDirectory,
+		args: args.slice(index)
+	};
+}
+//#endregion
 //#region src/model/collect-hook-bypasses.ts
 function collectHookBypasses(command) {
 	return splitShellCommand(command).segments.flatMap((segment) => collectSegmentBypasses(segment.text));
@@ -8308,6 +9272,7 @@ const COMMIT_VALUED_LONG = /* @__PURE__ */ new Set([
 	"file",
 	"fixup",
 	"message",
+	"pathspec-from-file",
 	"reedit-message",
 	"reuse-message",
 	"squash",
@@ -8323,7 +9288,7 @@ function findNoVerifyOption(args, subcommand) {
 			const [option = "", ...value] = arg.slice(2).split("=");
 			if (option.startsWith("no-ve") && "no-verify".startsWith(option)) found = arg;
 			else if (option.startsWith("veri") && "verify".startsWith(option)) found = null;
-			if (subcommand === "commit" && value.length === 0 && COMMIT_VALUED_LONG.has(option)) index += 1;
+			if (subcommand === "commit" && value.length === 0 && COMMIT_VALUED_LONG.has(findCommitOption(option) ?? "")) index += 1;
 		} else if (subcommand === "commit" && arg.startsWith("-") && arg !== "-") {
 			const cluster = parseCommitCluster(arg);
 			if (cluster.hasNoVerify) found = arg;
@@ -8333,6 +9298,42 @@ function findNoVerifyOption(args, subcommand) {
 	}
 	return found;
 }
+const COMMIT_FLAG_LONG = /* @__PURE__ */ new Set([
+	"ahead-behind",
+	"all",
+	"allow-empty",
+	"allow-empty-message",
+	"amend",
+	"branch",
+	"dry-run",
+	"edit",
+	"gpg-sign",
+	"include",
+	"interactive",
+	"long",
+	"no-post-rewrite",
+	"no-verify",
+	"null",
+	"only",
+	"patch",
+	"pathspec-file-nul",
+	"porcelain",
+	"post-rewrite",
+	"quiet",
+	"reset-author",
+	"short",
+	"signoff",
+	"status",
+	"untracked-files",
+	"verbose",
+	"verify"
+]);
+function findCommitOption(option) {
+	const names = [...COMMIT_VALUED_LONG, ...COMMIT_FLAG_LONG];
+	if (names.includes(option)) return option;
+	const matches = names.filter((name) => name.startsWith(option));
+	return matches.length === 1 ? matches[0] ?? null : null;
+}
 function parseCommitCluster(arg) {
 	let hasNoVerify = false;
 	for (let index = 1; index < arg.length; index += 1) {
@@ -9211,7 +10212,7 @@ function mergeScopeFacts(all) {
 //#region src/scope/build-task-scope.ts
 function buildTaskScope(input) {
 	const merged = mergeScopeFacts(input.facts);
-	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && PROTECTED_BRANCH_NAMES.has(branch)));
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && PROTECTED_BRANCH_NAMES.has(branch)) && !isProtectedBranch(branch, input.protectedBranches ?? []));
 	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
 	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
 		number: pull.number,
@@ -9428,6 +10429,7 @@ async function loadTaskScope(request, sources, host, stderr) {
 		home: host.home,
 		currentBranch: branch,
 		defaultBranch: facts.head?.defaultBranch ?? null,
+		protectedBranches: request.protectedBranches,
 		remotes: facts.remotes,
 		facts: sourceFacts
 	});
@@ -9616,7 +10618,8 @@ async function classifyUserNamedGrant(request, config, options, facts) {
 	if (judge === null || message === null || options.localOnly === true) return null;
 	const targets = findUserNamedGrant(containment.findings, message, {
 		home: facts.scope.home,
-		defaultBranch: facts.checkout?.head?.defaultBranch ?? null
+		defaultBranch: facts.checkout?.head?.defaultBranch ?? null,
+		protectedBranches: config.protectedBranches
 	});
 	if (targets === null) return null;
 	const text = await readContainmentRule().catch(() => null);
@@ -9645,7 +10648,8 @@ async function tryLoadTaskScope(request, config, host, stderr) {
 		return await loadTaskScope({
 			...request,
 			checkout: request.checkout ?? void 0,
-			stateDir: resolveXDGDir(host, "state")
+			stateDir: resolveXDGDir(host, "state"),
+			protectedBranches: config.protectedBranches
 		}, config.scopeSources ?? DEFAULT_SCOPE_SOURCES, host, stderr);
 	} catch {
 		return null;
@@ -9694,268 +10698,6 @@ async function tryUpdateDenialBudget(stderr, path, plan) {
 	}
 }
 //#endregion
-//#region src/scope/read-pull-request.ts
-const LOOKUP_TIMEOUT_MS = 5e3;
-const MAX_LOOKUP_OUTPUT_BYTES = 65536;
-async function readPullRequest(repository, number, options = {}) {
-	const [file, ...prefix] = options.command ?? ["gh"];
-	const args = [
-		"pr",
-		"view",
-		String(number),
-		"--repo",
-		repository,
-		"--json",
-		"headRefName,createdAt"
-	];
-	const result = await runCapped(file, [
-		...prefix,
-		...args,
-		"--jq",
-		"[.headRefName, .createdAt] | @tsv"
-	], {
-		signal: AbortSignal.timeout(options.timeoutMs ?? LOOKUP_TIMEOUT_MS),
-		maxOutputBytes: MAX_LOOKUP_OUTPUT_BYTES
-	});
-	const [head = "", created = ""] = result.stdout.trim().split("	");
-	const createdAt = Date.parse(created);
-	return result.exitCode === 0 && head !== "" && !Number.isNaN(createdAt) ? {
-		head,
-		createdAt
-	} : null;
-}
-//#endregion
-//#region src/git/read-branch-created-at.ts
-async function readBranchCreatedAt(commonDir, branch) {
-	if (!/^[\w./-]+$/u.test(branch) || branch.split("/").includes("..")) return null;
-	const [first = ""] = (await readFile(join(commonDir, "logs", "refs", "heads", branch), "utf8").catch(() => "")).split("\n");
-	const seconds = /^0+ [\da-f]+ .* (?<time>\d+) [+-]\d{4}\t/u.exec(first)?.groups?.["time"];
-	return seconds === void 0 ? null : Number(seconds) * 1e3;
-}
-//#endregion
-//#region src/scope/collect-pull-request-addresses.ts
-function collectPullRequestAddresses(text) {
-	const addresses = /* @__PURE__ */ new Map();
-	for (const match of text.matchAll(PULL_REQUEST_URL)) {
-		const repository = toRepositorySlug(`https://${match.groups?.["repository"] ?? ""}`);
-		const number = Number(match.groups?.["number"]);
-		if (repository !== null) addresses.set(`${repository}#${String(number)}`, {
-			repository,
-			number
-		});
-	}
-	return [...addresses.values()];
-}
-const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
-//#endregion
-//#region mods/auto-mode/contract/scope-commands.ts
-const SCOPE_COMMANDS = {
-	git: [
-		"worktree add",
-		"checkout",
-		"switch",
-		"branch"
-	],
-	gh: ["pr create"]
-};
-//#endregion
-//#region src/scope/collect-scope-events.ts
-function collectScopeEvents(command, cwd, home) {
-	return collectShellCommands(command, cwd, home).flatMap((entry) => {
-		const [name, ...args] = entry.words;
-		const directory = entry.directory;
-		if (directory === null) return [];
-		if (name === "git") return collectGitEvents(args, directory, home);
-		return name === "gh" && findScopeCommand(SCOPE_COMMANDS.gh, args) !== null ? [{
-			kind: "pull-request",
-			directory,
-			head: findOptionValue(args, ["--head", "-H"])
-		}] : [];
-	});
-}
-function collectGitEvents(args, cwd, home) {
-	const git = splitGitCommand(args, cwd, home);
-	const found = findScopeCommand(SCOPE_COMMANDS.git, git.args);
-	if (git.directory === null || found === null) return [];
-	return GIT_EVENT_COLLECTORS[found.command](found.rest, git.directory, home);
-}
-function findScopeCommand(commands, args) {
-	for (const command of commands) {
-		const words = command.split(" ");
-		if (words.every((word, index) => args[index] === word)) return {
-			command,
-			rest: args.slice(words.length)
-		};
-	}
-	return null;
-}
-const GIT_EVENT_COLLECTORS = {
-	"worktree add": collectWorktreeEvents,
-	checkout: collectSwitchEvents,
-	switch: collectSwitchEvents,
-	branch: collectBranchEvents
-};
-function collectWorktreeEvents(rest, directory, home) {
-	const path = findWorktreePath(rest);
-	const resolved = path === null ? null : resolveShellPath(directory, path, home);
-	return resolved === null ? [] : [{
-		kind: "worktree",
-		path: resolved
-	}];
-}
-const WORKTREE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"--reason"
-]);
-function findWorktreePath(args) {
-	for (let index = 0; index < args.length; index += 1) {
-		const word = args[index] ?? "";
-		if (WORKTREE_VALUE_OPTIONS.has(word)) index += 1;
-		else if (!word.startsWith("-")) return word;
-	}
-	return null;
-}
-const BRANCH_CREATE_OPTIONS = /* @__PURE__ */ new Set([
-	"-b",
-	"-B",
-	"-c",
-	"-C",
-	"--create",
-	"--force-create"
-]);
-const BRANCH_OTHER_OPTIONS = /^-(?:d|D|m|M|c|C|l|a|r|v|vv|u)$|^--(?:delete|move|copy|list|all|remotes|verbose|show-current|contains|no-contains|merged|no-merged|points-at|format|sort|set-upstream-to|unset-upstream|edit-description)/u;
-function collectSwitchEvents(rest, directory) {
-	const name = findOptionValue(rest, [...BRANCH_CREATE_OPTIONS]);
-	return name === null ? [] : [{
-		kind: "branch",
-		name,
-		directory
-	}];
-}
-function collectBranchEvents(rest, directory) {
-	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
-	const name = rest.find((word) => !word.startsWith("-"));
-	return name === void 0 || isUnresolvedWord(name) ? [] : [{
-		kind: "branch",
-		name,
-		directory
-	}];
-}
-function findOptionValue(args, options) {
-	const index = args.findIndex((word) => options.includes(word));
-	const value = index === -1 ? void 0 : args[index + 1];
-	return value === void 0 || isUnresolvedWord(value) ? null : value;
-}
-//#endregion
-//#region src/scope/merge-session-scope.ts
-function mergeSessionScope(all) {
-	const branches = /* @__PURE__ */ new Map();
-	const pullRequests = /* @__PURE__ */ new Map();
-	for (const branch of all.flatMap((scope) => scope.branches)) branches.set(`${branch.commonDir}\0${branch.name}`, branch);
-	for (const pull of all.flatMap((scope) => scope.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
-	return {
-		worktrees: [...new Set(all.flatMap((scope) => scope.worktrees))],
-		branches: [...branches.values()],
-		pullRequests: [...pullRequests.values()]
-	};
-}
-//#endregion
-//#region src/scope/write-session-scope.ts
-async function writeSessionScope(path, added, clock) {
-	await updateJSONFile(path, loadSessionScope, (current) => mergeSessionScope([current, added]), clock);
-}
-//#endregion
-//#region src/scope/update-session-scope.ts
-const MAX_CALL_AGE_MS = 9e5;
-async function updateSessionScope(request, options) {
-	const age = options.now - request.startedAt;
-	if (age < -6e4 || age > MAX_CALL_AGE_MS) return EMPTY_SESSION_SCOPE;
-	const events = collectScopeEvents(request.command, request.cwd, options.home);
-	const scope = mergeSessionScope(await Promise.all(events.map((event) => tryVerifyScopeEvent(event, request, options))));
-	if (scope.worktrees.length + scope.branches.length + scope.pullRequests.length > 0) await writeSessionScope(resolveSessionScopePath(options.stateDir, request.sessionID), scope, options.lockClock);
-	return scope;
-}
-async function tryVerifyScopeEvent(event, request, options) {
-	try {
-		return await (options.verifyEvent === void 0 ? verifyScopeEvent(event, request, options) : options.verifyEvent(event, request));
-	} catch {
-		return EMPTY_SESSION_SCOPE;
-	}
-}
-const FORGE_CLOCK_SKEW_MS = 6e4;
-const FILE_CLOCK_SLACK_MS = 50;
-function verifyScopeEvent(event, request, options) {
-	return M(event).returnType().with({ kind: "worktree" }, (worktree) => verifyWorktreeEvent(worktree.path, request, options)).with({ kind: "branch" }, (branch) => verifyBranchEvent(branch, request, options)).with({ kind: "pull-request" }, (pull) => verifyPullRequestEvent(pull.directory, request, options)).exhaustive();
-}
-async function verifyWorktreeEvent(path, request, options) {
-	const link = await stat(join(path, ".git"));
-	const facts = await loadCheckoutFacts(path, options.env);
-	const checkout = facts.checkout;
-	if (!link.isFile() || link.mtimeMs < request.startedAt - FILE_CLOCK_SLACK_MS || checkout?.worktree !== path) return EMPTY_SESSION_SCOPE;
-	const branch = facts.head?.branch ?? null;
-	if (branch === null) return {
-		...EMPTY_SESSION_SCOPE,
-		worktrees: [path]
-	};
-	const isNew = await isBranchCreatedSince(checkout.commonDir, branch, request.startedAt);
-	return {
-		...EMPTY_SESSION_SCOPE,
-		worktrees: [path],
-		branches: isNew ? [{
-			name: branch,
-			commonDir: checkout.commonDir
-		}] : []
-	};
-}
-async function verifyBranchEvent(event, request, options) {
-	const checkout = await findCheckout(event.directory, options.env);
-	if (checkout === null) return EMPTY_SESSION_SCOPE;
-	return await isBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
-		...EMPTY_SESSION_SCOPE,
-		branches: [{
-			name: event.name,
-			commonDir: checkout.commonDir
-		}]
-	} : EMPTY_SESSION_SCOPE;
-}
-async function verifyPullRequestEvent(directory, request, options) {
-	const facts = await loadCheckoutFacts(directory, options.env);
-	if (facts.checkout === null) return EMPTY_SESSION_SCOPE;
-	const repositories = new Set(facts.remotes.map((remote) => toRepositorySlug(remote.url)));
-	const addresses = collectPullRequestAddresses(request.resultText).filter((address) => repositories.has(address.repository));
-	const pulls = await Promise.all(addresses.map(async (address) => {
-		const pull = await options.readPullRequest(address.repository, address.number);
-		return pull !== null && pull.createdAt >= request.startedAt - FORGE_CLOCK_SKEW_MS ? [{
-			...address,
-			head: pull.head
-		}] : [];
-	}));
-	return {
-		...EMPTY_SESSION_SCOPE,
-		pullRequests: pulls.flat()
-	};
-}
-async function isBranchCreatedSince(commonDir, branch, since) {
-	const createdAt = await readBranchCreatedAt(commonDir, branch);
-	if (createdAt === null || createdAt < Math.floor(since / 1e3) * 1e3) return false;
-	const ref = await stat(join(commonDir, "refs", "heads", branch)).catch(() => null);
-	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
-}
-//#endregion
-//#region src/record-scope.ts
-async function recordScope(request, config, options = {}) {
-	const host = options.host ?? readHostEnvironment();
-	if (!Object.values(config.scopeSources ?? DEFAULT_SCOPE_SOURCES).some((source) => source.kind === "session")) return EMPTY_SESSION_SCOPE;
-	return await updateSessionScope(request, {
-		now: options.now ?? Date.now(),
-		stateDir: resolveXDGDir(host, "state"),
-		home: host.home,
-		env: host.env,
-		readPullRequest
-	});
-}
-//#endregion
 //#region src/request/action-request-schema.ts
 const userTaskSchema = strictObject({
 	text: string(),
@@ -10011,28 +10753,4 @@ function parseActionRequest(body) {
 	};
 }
 //#endregion
-//#region src/request/scope-record-request-schema.ts
-const scopeRecordRequestSchema = strictObject({
-	sessionID: string().min(1),
-	cwd: string().min(1),
-	startedAt: number().int().positive(),
-	command: string().min(1),
-	resultText: string()
-});
-//#endregion
-//#region src/request/parse-scope-record-request.ts
-function parseScopeRecordRequest(body) {
-	const parsed = scopeRecordRequestSchema.safeParse(body);
-	return parsed.success ? parsed.data : null;
-}
-//#endregion
-//#region src/request/render-verdict.ts
-function renderVerdict(verdict) {
-	const rendered = M(verdict).returnType().with({ kind: "allow" }, () => ({ decision: "allow" })).with({ kind: "deny" }, (denied) => ({
-		decision: "deny",
-		reason: `[${denied.rule}] ${denied.reason}`
-	})).exhaustive();
-	return JSON.stringify(rendered);
-}
-//#endregion
-export { readHostEnvironment as C, resolveConfigPath as S, resolveXDGDir as T, tryClassifyEdit as _, classifyAction as a, loadConfig as b, classifyWithModel as c, DecisionRequestError as d, buildDecisionRequest as f, loadClaudeSettings as g, checkContainment as h, recordScope as i, parseModelVerdict as l, writeActionDiagnostic as m, parseScopeRecordRequest as n, buildTaskScope as o, loadPolicy as p, parseActionRequest as r, classifyLocally as s, renderVerdict as t, sendDecision as u, findGitEntry as v, PRESETS as w, resolveApiKey as x, DEFAULT_CONFIG as y };
+export { resolveXDGDir as C, string as D, strictObject as E, CLI_LIMITS as S, number as T, findGitEntry as _, EMPTY_SESSION_SCOPE as a, readHostEnvironment as b, loadPolicy as c, writeActionDiagnostic as d, toRepositorySlug as f, findCheckout as g, isUnresolvedWord as h, loadSessionScope as i, resolveShippedPolicyDir as l, resolveShellPath as m, classifyAction as n, splitGitCommand as o, collectShellCommands as p, resolveSessionScopePath as r, M as s, parseActionRequest as t, loadCheckoutFacts as u, DEFAULT_SCOPE_SOURCES as v, updateJSONFile as w, runCapped as x, loadConfig as y };