auto-mode 0.9.0 → 0.11.0

package/dist/{render-verdict-CK9sRJpa.js → render-verdict-BiGjYb1x.js}

@@ -1,7 +1,8 @@
 import { readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, normalize, parse, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, matchesGlob, normalize, parse, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 //#region node_modules/.bun/zod@4.6.2/node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
@@ -2922,7 +2923,7 @@ function bucketFor(state, inst) {
 	return bucket;
 }
 let handoff;
-const open = [];
+const open$1 = [];
 const memo = {
 	alloc(_inst, payload, empty) {
 		const bucket = handoff;
@@ -2933,7 +2934,7 @@ const memo = {
 			issues: null
 		};
 		bucket.set(payload.value, entry);
-		open.push(entry);
+		open$1.push(entry);
 		return empty;
 	},
 	guard(inst) {
@@ -2999,10 +3000,10 @@ const memo = {
 					return payload;
 				}
 				handoff = bucket;
-				const depth = open.length;
+				const depth = open$1.length;
 				const result = base(payload, ctx);
 				handoff = void 0;
-				const entry = open.length > depth ? open.pop() : void 0;
+				const entry = open$1.length > depth ? open$1.pop() : void 0;
 				if (result instanceof Promise) return result.then((r) => {
 					if (entry) entry.issues = r.issues.length ? cloneIssues(r.issues) : NO_ISSUES;
 					return r;
@@ -5526,49 +5527,6 @@ function refine(fn, _params = {}) {
 function superRefine(fn, params) {
 	return /* @__PURE__ */ _superRefine(fn, params);
 }
-//#endregion
-//#region src/config/load-claude-rules.ts
-async function loadClaudeRules(path) {
-	const empty = {
-		environment: [],
-		allow: [],
-		soft_deny: [],
-		hard_deny: []
-	};
-	if (path === null) return empty;
-	const configDir = process.env["CLAUDE_CONFIG_DIR"];
-	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
-	const settingsPath = path ?? join(base, "settings.json");
-	let raw;
-	try {
-		raw = await readFile(settingsPath, "utf8");
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
-		throw new Error("Claude settings unreadable", { cause: error });
-	}
-	const entries = array(string()).optional();
-	const schema = object({ autoMode: object({
-		environment: entries,
-		allow: entries,
-		soft_deny: entries,
-		hard_deny: entries
-	}).optional() });
-	let body;
-	try {
-		body = JSON.parse(raw);
-	} catch {
-		throw new Error("Claude settings contain invalid JSON");
-	}
-	const parsed = schema.safeParse(body);
-	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
-	const rules = parsed.data;
-	return {
-		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
-		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
-		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
-		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
-	};
-}
 const PRESETS = {
 	jev: {
 		protocol: "system-one",
@@ -5681,11 +5639,16 @@ const DEFAULT_DENIAL_BUDGET = {
 	consecutive: 3,
 	perSession: 20
 };
+const DEFAULT_SCOPE_SOURCES = {
+	cwd: { kind: "cwd" },
+	session: { kind: "session" }
+};
 const DEFAULT_CONFIG = {
 	provider: DEFAULT_PROVIDER,
 	onFailure: "defer",
 	minConfidence: .8,
-	denialBudget: DEFAULT_DENIAL_BUDGET
+	denialBudget: DEFAULT_DENIAL_BUDGET,
+	scopeSources: DEFAULT_SCOPE_SOURCES
 };
 function resolveConfigPath() {
 	const xdg = process.env["XDG_CONFIG_HOME"];
@@ -5737,14 +5700,15 @@ function buildConfig(json, path) {
 	const warnings = [];
 	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
 	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
-	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`));
+	const configuredSources = file.scopeSources === void 0 ? null : scopeSources.entries;
+	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`), ...collectScopeWarnings(configuredSources).map((line) => `${path}: scopeSources ${line}`));
 	const decision = file.decision ?? {};
 	const policy = file.policy ?? {};
 	const judgeID = decision.judge ?? null;
 	return {
 		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
 		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
-		scopeSources: scopeSources.entries,
+		scopeSources: configuredSources ?? DEFAULT_SCOPE_SOURCES,
 		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
 		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
 		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
@@ -5757,6 +5721,11 @@ function buildConfig(json, path) {
 		warnings
 	};
 }
+function collectScopeWarnings(entries) {
+	if (entries === null) return [];
+	const sources = Object.values(entries);
+	return [...sources.some((source) => source.kind === "cwd") ? [] : ["has no cwd entry, so the task owns only what the other sources name"], ...sources.flatMap((source) => source.paths ?? []).filter((glob) => glob.includes(".worktrees")).map((glob) => `glob ${glob} covers worktrees that other tasks own`)];
+}
 function buildRegistry(raw, parseEntry) {
 	const entries = /* @__PURE__ */ new Map();
 	const dropped = [];
@@ -5825,7 +5794,7 @@ function parseScopeSourceEntry(id, entry) {
 	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
 	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
 		kind,
-		paths: parsed.data.paths
+		paths: parsed.data.paths.map((glob) => expandHomePath(glob) ?? glob)
 	};
 	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
 }
@@ -5856,6 +5825,940 @@ function resolveApiKey(provider, options = {}) {
 	return readApiKeyFromCommand(provider.apiKeyCommand, options);
 }
 //#endregion
+//#region src/config/load-claude-rules.ts
+async function loadClaudeRules(path) {
+	const empty = {
+		environment: [],
+		allow: [],
+		soft_deny: [],
+		hard_deny: []
+	};
+	if (path === null) return empty;
+	const configDir = process.env["CLAUDE_CONFIG_DIR"];
+	const base = configDir === void 0 || configDir === "" ? join(homedir(), ".claude") : configDir;
+	const settingsPath = path ?? join(base, "settings.json");
+	let raw;
+	try {
+		raw = await readFile(settingsPath, "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return empty;
+		throw new Error("Claude settings unreadable", { cause: error });
+	}
+	const entries = array(string()).optional();
+	const schema = object({ autoMode: object({
+		environment: entries,
+		allow: entries,
+		soft_deny: entries,
+		hard_deny: entries
+	}).optional() });
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		throw new Error("Claude settings contain invalid JSON");
+	}
+	const parsed = schema.safeParse(body);
+	if (!parsed.success) throw new Error("Claude autoMode settings are invalid");
+	const rules = parsed.data;
+	return {
+		environment: (rules.autoMode?.environment ?? []).filter((entry) => entry !== "$defaults"),
+		allow: (rules.autoMode?.allow ?? []).filter((entry) => entry !== "$defaults"),
+		soft_deny: (rules.autoMode?.soft_deny ?? []).filter((entry) => entry !== "$defaults"),
+		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
+	};
+}
+//#endregion
+//#region src/model/load-repository-context.ts
+async function loadRepositoryContext(cwd) {
+	if ([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR"
+	].some((name) => process.env[name] !== void 0)) return null;
+	let directory = resolve(cwd);
+	for (;;) {
+		const gitPath = join(directory, ".git");
+		try {
+			await stat(gitPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
+			const parent = dirname(directory);
+			if (parent === directory) return null;
+			directory = parent;
+			continue;
+		}
+		let gitDir = gitPath;
+		let head;
+		try {
+			try {
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			} catch {
+				const link = await readFile(gitPath, "utf8");
+				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
+				if (path === void 0) return null;
+				gitDir = resolve(directory, path.trim());
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			}
+		} catch {
+			return null;
+		}
+		let commonDir = gitDir;
+		try {
+			const common = await readFile(join(gitDir, "commondir"), "utf8");
+			commonDir = resolve(gitDir, common.trim());
+		} catch {
+			commonDir = gitDir;
+		}
+		let defaultBranch = null;
+		try {
+			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
+		} catch {
+			defaultBranch = null;
+		}
+		return {
+			cwd: resolve(cwd),
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch
+		};
+	}
+}
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+}
+//#endregion
+//#region src/containment/to-repository-slug.ts
+function toRepositorySlug(reference) {
+	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
+	if (match?.groups === void 0) return null;
+	const parts = match.groups;
+	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
+}
+//#endregion
+//#region src/scope/merge-scope-facts.ts
+function mergeScopeFacts(all) {
+	const pullRequests = /* @__PURE__ */ new Map();
+	for (const pull of all.flatMap((facts) => facts.pullRequests)) pullRequests.set(`${pull.repository}#${String(pull.number)}`, pull);
+	return {
+		worktrees: [...new Set(all.flatMap((facts) => facts.worktrees))],
+		branches: [...new Set(all.flatMap((facts) => facts.branches))],
+		pullRequests: [...pullRequests.values()],
+		pathGlobs: [...new Set(all.flatMap((facts) => facts.pathGlobs))]
+	};
+}
+//#endregion
+//#region src/scope/build-task-scope.ts
+function buildTaskScope(input) {
+	const merged = mergeScopeFacts(input.facts);
+	const branches = merged.branches.filter((branch) => branch !== input.defaultBranch && !(input.defaultBranch === null && DEFAULT_NAMES.has(branch)));
+	const repositories = new Set(input.remotes.map((remote) => toRepositorySlug(remote.url)));
+	const pullRequests = merged.pullRequests.filter((pull) => branches.includes(pull.head) && repositories.has(pull.repository)).map((pull) => ({
+		number: pull.number,
+		repository: pull.repository
+	}));
+	return {
+		home: input.home,
+		worktrees: merged.worktrees,
+		branches,
+		currentBranch: input.currentBranch,
+		remotes: input.remotes,
+		pullRequests,
+		pathGlobs: merged.pathGlobs
+	};
+}
+const DEFAULT_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
+]);
+//#endregion
+//#region src/scope/find-checkout.ts
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start) {
+	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
+}
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
+}
+//#endregion
+//#region src/scope/load-checkout-remotes.ts
+async function loadCheckoutRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
+			if (url !== void 0) remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+//#endregion
+//#region src/scope/types.ts
+const EMPTY_SCOPE_FACTS = {
+	worktrees: [],
+	branches: [],
+	pullRequests: [],
+	pathGlobs: []
+};
+const EMPTY_SESSION_SCOPE = {
+	worktrees: [],
+	branches: [],
+	pullRequests: []
+};
+//#endregion
+//#region src/scope/load-session-scope.ts
+const name = string().min(1);
+const pullRequestSchema = strictObject({
+	number: number().int().positive(),
+	head: name,
+	repository: name
+});
+const branchSchema = strictObject({
+	name,
+	commonDir: name
+});
+const sessionScopeSchema = strictObject({
+	worktrees: array(name),
+	branches: array(branchSchema),
+	pullRequests: array(pullRequestSchema)
+});
+async function loadSessionScope(path) {
+	let raw;
+	try {
+		raw = await readFile(path, "utf8");
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+	try {
+		const parsed = sessionScopeSchema.safeParse(JSON.parse(raw));
+		return parsed.success ? parsed.data : EMPTY_SESSION_SCOPE;
+	} catch {
+		return EMPTY_SESSION_SCOPE;
+	}
+}
+//#endregion
+//#region src/scope/resolve-session-scope-path.ts
+function resolveSessionScopePath(stateDir, sessionID) {
+	const key = createHash("sha256").update(sessionID).digest("hex").slice(0, 32);
+	return join(stateDir, "session-scope", `${key}.json`);
+}
+//#endregion
+//#region src/scope/pick-scope-source-reader.ts
+function pickScopeSourceReader(source) {
+	if (source.kind === "cwd") return (context) => Promise.resolve(buildFacts({
+		worktrees: [context.worktree],
+		branches: context.branch === null ? [] : [context.branch]
+	}));
+	if (source.kind === "session") return async (context) => {
+		const scope = await loadSessionScope(resolveSessionScopePath(context.stateDir, context.sessionID));
+		return buildFacts({
+			worktrees: scope.worktrees,
+			branches: scope.branches.filter((branch) => branch.commonDir === context.commonDir).map((branch) => branch.name),
+			pullRequests: scope.pullRequests
+		});
+	};
+	if (source.kind === "globs") return () => Promise.resolve(buildFacts({ pathGlobs: source.paths ?? [] }));
+	return () => Promise.resolve(EMPTY_SCOPE_FACTS);
+}
+function buildFacts(facts) {
+	return {
+		...EMPTY_SCOPE_FACTS,
+		...facts
+	};
+}
+//#endregion
+//#region src/scope/load-task-scope.ts
+async function loadTaskScope(request, sources) {
+	const cwd = resolve(request.cwd);
+	const [checkout, context] = await Promise.all([findCheckout(cwd), loadRepositoryContext(cwd)]);
+	const branch = context?.branch ?? null;
+	const sourceContext = {
+		sessionID: request.sessionID,
+		cwd,
+		worktree: checkout?.worktree ?? cwd,
+		commonDir: checkout?.commonDir ?? null,
+		branch,
+		stateDir: request.stateDir
+	};
+	const [remotes, ...facts] = await Promise.all([checkout === null ? [] : loadCheckoutRemotes(checkout.commonDir), ...Object.values(sources).map((source) => pickScopeSourceReader(source)(sourceContext))]);
+	return buildTaskScope({
+		home: homedir(),
+		currentBranch: branch,
+		defaultBranch: context?.defaultBranch ?? null,
+		remotes,
+		facts
+	});
+}
+//#endregion
+//#region src/state/resolve-state-dir.ts
+function resolveStateDir() {
+	const stateHome = process.env["XDG_STATE_HOME"];
+	const base = stateHome === void 0 || stateHome === "" ? join(homedir(), ".local", "state") : stateHome;
+	return join(base, "auto-mode");
+}
+//#endregion
+//#region src/rules/split-command-words.ts
+function splitCommandWords(text) {
+	const words = splitWords$1(text);
+	let index = 0;
+	while (index < words.length) {
+		const word = words[index] ?? "";
+		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
+		else if (word === "env") {
+			index += 1;
+			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
+		} else if (word === "timeout") index += 2;
+		else break;
+	}
+	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
+}
+function splitWords$1(text) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	let started = false;
+	for (const ch of text) if (quote !== null) {
+		if (ch === quote) quote = null;
+		else current += ch;
+	} else if (ch === "'" || ch === "\"") {
+		quote = ch;
+		started = true;
+	} else if (/\s/u.test(ch)) {
+		if (started) words.push(current);
+		current = "";
+		started = false;
+	} else {
+		current += ch;
+		started = true;
+	}
+	if (started) words.push(current);
+	return words;
+}
+//#endregion
+//#region src/rules/split-shell-command.ts
+function splitShellCommand(command) {
+	const segments = [];
+	let current = "";
+	let quote = null;
+	let unparsed = false;
+	let i = 0;
+	const collectSegment = () => {
+		const text = current.trim();
+		if (text !== "") segments.push({ text });
+		current = "";
+	};
+	while (i < command.length) {
+		const ch = command.charAt(i);
+		if (quote !== null) {
+			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (ch === quote) quote = null;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			quote = ch;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "\\") {
+			current += command.slice(i, i + 2);
+			i += 2;
+			continue;
+		}
+		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
+			unparsed = true;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
+			collectSegment();
+			i += 2;
+			continue;
+		}
+		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
+			collectSegment();
+			i += 1;
+			continue;
+		}
+		current += ch;
+		i += 1;
+	}
+	collectSegment();
+	return {
+		segments,
+		hasUnparsedConstruct: unparsed || quote !== null
+	};
+}
+//#endregion
+//#region src/containment/collect-scope-findings.ts
+function collectScopeFindings(action, scope) {
+	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
+	const command = action.input["command"];
+	const findings = [
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
+		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
+	];
+	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
+}
+const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit"
+]);
+function collectTargetFindings(directory, target, scope) {
+	const path = resolvePath(directory, target, scope.home);
+	return path === null ? [] : collectPathFindings(path, scope);
+}
+const CREDENTIAL_PATHS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".gitconfig",
+	".netrc",
+	".npmrc",
+	".config/gh"
+];
+function collectPathFindings(path, scope) {
+	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
+		kind: "credential",
+		target: path
+	}];
+	return isInScope(path, scope) ? [] : [{
+		kind: "path",
+		target: path
+	}];
+}
+function collectToolFindings(action, scope) {
+	const verb = action.tool.split("__").at(-1) ?? "";
+	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
+	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
+	const owner = action.input["owner"];
+	const name = action.input["repo"];
+	const repo = typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : void 0;
+	return !verb.includes("merge") && typeof number === "number" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+		kind: "remote-write",
+		target: action.tool
+	}];
+}
+const PATH_WRITERS = /* @__PURE__ */ new Set([
+	"rm",
+	"rmdir",
+	"shred",
+	"truncate",
+	"chmod",
+	"chown"
+]);
+const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
+	"cp",
+	"mv",
+	"rsync",
+	"ln"
+]);
+function collectCommandFindings(command, cwd, scope) {
+	const findings = [];
+	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
+	let directory = cwd;
+	for (const segment of splitShellCommand(command).segments) {
+		const [name, ...args] = splitCommandWords(segment.text);
+		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
+		if (name === void 0) continue;
+		if (name === "cd" && hasPipe) directory = null;
+		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
+		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope));
+	}
+	return findings;
+}
+function collectProgramFindings(name, args, directory, cwd, scope) {
+	const resolve = (path) => collectTargetFindings(directory, path, scope);
+	const operands = args.filter((word) => !word.startsWith("-"));
+	if (name === "git") return collectGitFindings(args, directory, cwd, scope);
+	if (name === "gh") return collectGhFindings(args, scope);
+	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
+	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
+	if (name === "find" && args.some((word) => word === "-delete" || word === "-exec")) return operands.slice(0, 1).flatMap((path) => resolve(path));
+	if ((name === "perl" || name === "sed") && args.some((word) => /^-\w*i/u.test(word))) return collectInPlaceFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh-keygen") return collectKeygenFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh") {
+		const logIndex = args.indexOf("-E");
+		const log = logIndex === -1 ? void 0 : args[logIndex + 1];
+		return [...log === void 0 ? [] : resolve(log), ...collectSSHFindings(args)];
+	}
+	if (name === "scp") {
+		const destination = collectSSHOperands(args).at(-1);
+		if (destination === void 0 || /^[^/]+:/u.test(destination)) return destination === void 0 ? [] : [{
+			kind: "remote-write",
+			target: "scp"
+		}];
+		return resolve(destination);
+	}
+	if (name === "curl") return collectCurlFindings(args);
+	const launcher = [name, ...args].findIndex((word) => word.includes("auto-mode"));
+	if (launcher !== -1 && [name, ...args].slice(launcher + 1).includes("record")) return [{
+		kind: "credential",
+		target: "auto-mode record"
+	}];
+	const finding = findProgramFinding(name, args);
+	return finding === null ? [] : [finding];
+}
+function collectCopyFindings(name, args, operands) {
+	const optionIndex = args.findIndex((word) => word === "-t" || word === "--target-directory");
+	let targetDirectory = args.find((word) => word.startsWith("--target-directory="))?.slice(19);
+	if (targetDirectory === void 0 && optionIndex !== -1) targetDirectory = args[optionIndex + 1];
+	if (targetDirectory !== void 0) {
+		const sources = operands.filter((word) => word !== targetDirectory);
+		return [targetDirectory, ...name === "mv" ? sources : []];
+	}
+	if (operands.length < 2) return [];
+	return [operands.at(-1) ?? "", ...name === "mv" ? operands.slice(0, -1) : []];
+}
+const KEYGEN_READ_OPTIONS = /* @__PURE__ */ new Set([
+	"-l",
+	"-y",
+	"-F",
+	"-B",
+	"-R"
+]);
+function collectKeygenFiles(args) {
+	if (args.some((word) => KEYGEN_READ_OPTIONS.has(word))) return [];
+	const index = args.indexOf("-f");
+	const file = index === -1 ? void 0 : args[index + 1];
+	return file === void 0 ? [] : [file];
+}
+const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-c",
+	"-D",
+	"-E",
+	"-F",
+	"-i",
+	"-J",
+	"-l",
+	"-L",
+	"-m"
+]);
+const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-o",
+	"-p",
+	"-P",
+	"-Q",
+	"-R",
+	"-S",
+	"-W",
+	"-w"
+]);
+function collectSSHOperands(args) {
+	const operands = [];
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index] ?? "";
+		if (operands.length > 0 || !word.startsWith("-")) operands.push(word);
+		else if (SSH_VALUE_OPTIONS.has(word) || SSH_MORE_VALUE_OPTIONS.has(word)) index += 1;
+	}
+	return operands;
+}
+const SSH_READS = /* @__PURE__ */ new Set([
+	"cat",
+	"df",
+	"du",
+	"free",
+	"head",
+	"id",
+	"ls",
+	"ps",
+	"pwd",
+	"stat",
+	"tail",
+	"uname",
+	"uptime",
+	"whoami"
+]);
+function collectSSHFindings(args) {
+	const [host, ...remote] = collectSSHOperands(args);
+	if (host === void 0) return [];
+	const command = remote.join(" ");
+	const [program] = command.trim().split(/\s+/u);
+	return SSH_READS.has(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command) ? [] : [{
+		kind: "remote-write",
+		target: "ssh"
+	}];
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"0.0.0.0"
+]);
+function collectCurlFindings(args) {
+	const joined = args.join(" ");
+	const isUpload = args.some((word) => /^-[a-zA-Z]*[dFT]$|^--(?:data\S*|form|upload-file|json)$/u.test(word));
+	const isWriteMethod = /(?:-X\s*|--request\s+)(?:POST|PUT|PATCH|DELETE)/u.test(joined);
+	if (!isUpload && !isWriteMethod) return [];
+	const hosts = args.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
+	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host)) ? [] : [{
+		kind: "remote-write",
+		target: "curl upload"
+	}];
+}
+const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
+	"clean",
+	"reset",
+	"checkout",
+	"switch",
+	"merge",
+	"commit",
+	"rm",
+	"stash",
+	"push"
+]);
+function collectGitFindings(args, directory, cwd, scope) {
+	let gitDirectory = directory;
+	let index = 0;
+	while (index < args.length && args[index]?.startsWith("-") === true) {
+		const option = args[index];
+		if (option === "-C") gitDirectory = resolvePath(gitDirectory, args[index + 1] ?? "", scope.home);
+		index += option === "-C" || option === "-c" ? 2 : 1;
+	}
+	const subcommand = args[index] ?? "";
+	const rest = args.slice(index + 1);
+	const operands = rest.filter((word) => !word.startsWith("-"));
+	const findings = [];
+	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope)) findings.push({
+		kind: "path",
+		target: gitDirectory
+	});
+	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope));
+	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
+		kind: "branch",
+		target: branch
+	});
+	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
+	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
+		kind: "credential",
+		target: `git config ${operands[0] ?? ""}`
+	});
+	if (subcommand === "push") {
+		const currentBranch = gitDirectory === cwd ? scope.currentBranch : null;
+		findings.push(...collectPushFindings(rest, operands, currentBranch, scope));
+	}
+	return findings;
+}
+function collectPushFindings(rest, operands, currentBranch, scope) {
+	const [remote, ...refspecs] = operands;
+	const findings = [];
+	if (rest.includes("--all") || rest.includes("--mirror")) findings.push({
+		kind: "branch",
+		target: "--all"
+	});
+	if (remote !== void 0 && !isUnresolved(remote) && !isOwnedRemote(remote, scope)) findings.push({
+		kind: "remote-write",
+		target: remote
+	});
+	const destinations = refspecs.length === 0 && !rest.includes("--tags") ? ["HEAD"] : refspecs;
+	for (const refspec of destinations) {
+		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
+		const branch = named === "HEAD" ? currentBranch : named;
+		if (branch !== null && !isUnresolved(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
+			kind: "branch",
+			target: branch
+		});
+	}
+	return findings;
+}
+function isUnresolved(word) {
+	return /[$`]/u.test(word);
+}
+function isOwnedRemote(remote, scope) {
+	if (scope.remotes.some((entry) => entry.name === remote)) return true;
+	const slug = toRepositorySlug(remote);
+	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
+}
+const GH_PR_WRITES = /* @__PURE__ */ new Set([
+	"comment",
+	"merge",
+	"edit",
+	"close",
+	"review",
+	"ready",
+	"reopen"
+]);
+const GH_REMOTE_WRITES = /* @__PURE__ */ new Set([
+	"gist",
+	"release",
+	"repo",
+	"ruleset",
+	"label",
+	"workflow"
+]);
+const GH_CREDENTIAL_WRITES = /* @__PURE__ */ new Set([
+	"secret",
+	"variable",
+	"ssh-key",
+	"gpg-key"
+]);
+const GH_READS = /* @__PURE__ */ new Set([
+	"list",
+	"view",
+	"clone",
+	"status",
+	"checks",
+	"diff"
+]);
+function collectGhFindings(args, scope) {
+	const group = args[0] ?? "";
+	const verb = args[1] ?? "";
+	if (group === "pr" && GH_PR_WRITES.has(verb)) {
+		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
+		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
+		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
+		return verb !== "merge" && isOwnedPullRequest(number, repo, scope) ? [] : [{
+			kind: "remote-write",
+			target: `gh pr ${verb}`
+		}];
+	}
+	if (group === "issue" && verb !== "" && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh issue ${verb}`
+	}];
+	if (group === "api") return collectGhAPIFindings(args.slice(1), scope);
+	if (group === "auth" && [
+		"refresh",
+		"login",
+		"logout"
+	].includes(verb)) return [{
+		kind: "credential",
+		target: `gh auth ${verb}`
+	}];
+	if (GH_CREDENTIAL_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "credential",
+		target: `gh ${group} ${verb}`
+	}];
+	if (GH_REMOTE_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh ${group} ${verb}`
+	}];
+	return [];
+}
+function isOwnedPullRequest(number, repo, scope) {
+	const wanted = repo?.toLowerCase().replace(/\.git$/u, "");
+	const slugs = new Set(scope.remotes.map((remote) => toRepositorySlug(remote.url)));
+	return scope.pullRequests.some((pull) => pull.number === number && (wanted === void 0 ? slugs.size === 1 && slugs.has(pull.repository) : pull.repository === wanted || pull.repository.endsWith(`/${wanted}`)));
+}
+function collectGhAPIFindings(args, scope) {
+	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
+	if (endpoint === "graphql") return args.some((word) => /\bmutation\b/u.test(word)) ? [{
+		kind: "remote-write",
+		target: "gh api graphql mutation"
+	}] : [];
+	const methodIndex = args.findIndex((word) => word === "-X" || word === "--method");
+	const method = methodIndex === -1 ? null : (args[methodIndex + 1] ?? "").toUpperCase();
+	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
+	if (method === "GET" || method === null && !hasFields) return [];
+	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
+	if (pull !== void 0 && isOwnedPullRequest(Number(pull["number"]), pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
+	return [{
+		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
+		target: `gh api ${endpoint}`
+	}];
+}
+const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
+function findProgramFinding(name, args) {
+	const joined = args.join(" ");
+	if (name === "op" && /^(?:item|vault|document) (?:edit|create|delete)\b/u.test(joined)) return {
+		kind: "credential",
+		target: `op ${args[0] ?? ""} ${args[1] ?? ""}`
+	};
+	if (name === "aws" && args[0] === "iam" && IAM_WRITE.test(args[1] ?? "")) return {
+		kind: "credential",
+		target: `aws iam ${args[1] ?? ""}`
+	};
+	if (name === "docker" && /\b(?:volume|system|image|container) prune\b|\bvolume rm\b|\bdown\b.*(?:-v|--volumes)\b/u.test(joined)) return {
+		kind: "prune",
+		target: `docker ${joined}`
+	};
+	if (name === "npm" && args[0] === "publish") return {
+		kind: "remote-write",
+		target: "npm publish"
+	};
+	if (name === "kubectl" && /\b(?:apply|delete|replace|patch|scale)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "kubectl write"
+	};
+	if (name === "terraform" && /\b(?:apply|destroy|import)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "terraform write"
+	};
+	if (name === "psql" && /\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu.test(joined)) return {
+		kind: "remote-write",
+		target: "database write"
+	};
+	if (/^(?:bun|npm|pnpm|yarn)$/u.test(name) && /\bdeploy\b/u.test(joined) && /prod/u.test(joined)) return {
+		kind: "remote-write",
+		target: "production deploy"
+	};
+	return null;
+}
+function collectRedirectTargets(text) {
+	const targets = [];
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			quote = ch === quote ? null : quote;
+			index += 1;
+		} else if (ch === "'" || ch === "\"") {
+			quote = ch;
+			index += 1;
+		} else if (ch === ">" && text.charAt(index - 1) !== "<") {
+			let next = index + 1;
+			if (text.charAt(next) === ">" || text.charAt(next) === "|") next += 1;
+			if (text.charAt(next) === "&") {
+				index = next + 1;
+				continue;
+			}
+			const [target, end] = readWord(text, next);
+			if (target !== "") targets.push(target);
+			index = end;
+		} else index += 1;
+	}
+	return targets;
+}
+function readWord(text, start) {
+	let index = start;
+	while (/\s/u.test(text.charAt(index))) index += 1;
+	let word = "";
+	let quote = null;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			if (ch === quote) quote = null;
+			else word += ch;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (/[\s;&|<>()]/u.test(ch)) break;
+		else word += ch;
+		index += 1;
+	}
+	return [word, index];
+}
+function collectInPlaceFiles(args) {
+	const files = [];
+	let skipNext = false;
+	let sawScript = false;
+	for (const word of args) if (skipNext) {
+		skipNext = false;
+		sawScript = true;
+	} else if (/^-\w*e$/u.test(word)) skipNext = true;
+	else if (!word.startsWith("-")) {
+		if (sawScript) files.push(word);
+		else sawScript = true;
+	}
+	return files;
+}
+function resolvePath(cwd, path, home) {
+	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
+	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
+	if (cwd === null && !isAbsolute(expanded)) return null;
+	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
+	return normalize(absolute).replace(/(?<=.)\/$/u, "");
+}
+const SCRATCH_PATHS = [
+	"/tmp",
+	"/dev/null",
+	"/dev/stdout",
+	"/dev/stderr"
+];
+function isInScope(path, scope) {
+	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry)) || scope.pathGlobs.some((glob) => matchesGlob(path, glob))) return true;
+	return scope.worktrees.some((worktree) => {
+		const isNested = isUnder(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
+		return isUnder(path, worktree) && (!isNested || isOtherOwned);
+	});
+}
+function isUnder(path, root) {
+	return path === root || path.startsWith(`${root}/`);
+}
+//#endregion
+//#region src/containment/check-containment.ts
+const CONTAINMENT_RULE = "Outside Task Scope";
+async function checkContainment(request, sources) {
+	let scope;
+	try {
+		scope = await loadTaskScope({
+			sessionID: request.sessionID,
+			cwd: request.cwd,
+			stateDir: resolveStateDir()
+		}, sources);
+	} catch {
+		return null;
+	}
+	const findings = collectScopeFindings({
+		tool: request.toolName,
+		cwd: request.cwd,
+		input: request.toolInput
+	}, scope);
+	if (findings.length === 0) return null;
+	return {
+		rule: CONTAINMENT_RULE,
+		reason: formatContainmentReason(findings, scope),
+		findings
+	};
+}
+const KIND_LABELS = {
+	path: "path",
+	branch: "branch",
+	"remote-write": "remote target",
+	credential: "credential or global setting",
+	prune: "shared resource"
+};
+function formatContainmentReason(findings, scope) {
+	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
+	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
+	const branches = scope.branches.length === 0 ? "" : ` and ${formatList("branch", "branches", scope.branches)}`;
+	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`${formatList("worktree", "worktrees", scope.worktrees)}${branches}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
+}
+function formatList(one, many, values) {
+	return `the ${values.length === 1 ? one : many} ${values.join(", ")}`;
+}
+//#endregion
 //#region src/policy/resolve-shipped-policy-dir.ts
 function resolveShippedPolicyDir() {
 	let dir = import.meta.dirname;
@@ -6124,68 +7027,6 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory) return null;
-			directory = parent;
-			continue;
-		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
-		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
-		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
-		}
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
-		};
-	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
-}
-//#endregion
 //#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
 const t = Symbol.for("@ts-pattern/matcher");
 const e = Symbol.for("@ts-pattern/isVariadic");
@@ -6969,64 +7810,6 @@ const REGENERABLE_DIRS = /* @__PURE__ */ new Set([
 	"venv"
 ]);
 //#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
-	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			collectSegment();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			collectSegment();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
-	}
-	collectSegment();
-	return {
-		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
-	};
-}
-//#endregion
 //#region src/rules/classify-locally.ts
 const ESCALATE = { kind: "escalate" };
 function classifyLocally(payload) {
@@ -7104,12 +7887,18 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
-	if (local.kind === "allow") return {
-		verdict: { kind: "allow" },
-		decidingStage: "local",
-		note: `allowed by ${local.exception} (local)`,
-		status: "allow"
-	};
+	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
+	const containment = await checkContainment(request, config.scopeSources ?? DEFAULT_SCOPE_SOURCES);
+	if (containment !== null) {
+		const guidance = await tryReadDenialGuidance();
+		return {
+			verdict: buildGuidedDeny(containment.rule, containment.reason, guidance),
+			decidingStage: "containment",
+			note: `denied by the containment check: ${containment.findings.map((finding) => finding.target).join(", ")}`,
+			status: "deny"
+		};
+	}
+	if (local.kind === "allow") return buildLocalAllow(local.exception);
 	if (options.localOnly === true) return {
 		verdict: null,
 		decidingStage: "local",
@@ -7124,6 +7913,15 @@ async function classifyAction(request, config, options = {}) {
 		status: outcome.diagnostics?.status ?? outcome.verdict?.kind ?? "failure"
 	};
 }
+const READ_ONLY_EXCEPTION = "Read-only actions";
+function buildLocalAllow(exception) {
+	return {
+		verdict: { kind: "allow" },
+		decidingStage: "local",
+		note: `allowed by ${exception} (local)`,
+		status: "allow"
+	};
+}
 function buildGuidedDeny(rule, reason, guidance) {
 	const sentence = /[.!?]$/u.test(reason) ? reason : `${reason}.`;
 	return {
@@ -7197,4 +7995,4 @@ function renderVerdict(verdict) {
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, string as g, strictObject as h, classifyLocally as i, DEFAULT_DENIAL_BUDGET as l, number as m, parseActionRequest as n, parseModelVerdict as o, PRESETS as p, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };
+export { resolveConfigPath as C, string as D, strictObject as E, resolveApiKey as S, number as T, loadRepositoryContext as _, classifyWithModel as a, DEFAULT_SCOPE_SOURCES as b, splitShellCommand as c, resolveSessionScopePath as d, loadSessionScope as f, toRepositorySlug as g, findCheckout as h, classifyLocally as i, splitCommandWords as l, loadCheckoutRemotes as m, parseActionRequest as n, parseModelVerdict as o, EMPTY_SESSION_SCOPE as p, classifyAction as r, loadPolicy as s, renderVerdict as t, resolveStateDir as u, DEFAULT_CONFIG as v, PRESETS as w, loadConfig as x, DEFAULT_DENIAL_BUDGET as y };