auto-mode 2.0.2 → 3.0.0

package/dist/{classify-edit-C-CQMndB.js → classify-edit-B660kX2I.js}

@@ -1,4 +1,4 @@
-import { t as getEditFields } from "./get-edit-fields-BtAvHIsq.js";
+import { t as findEditFields } from "./find-edit-fields-CzkhPA4j.js";
 import { basename, relative, sep } from "node:path";
 import { Buffer } from "node:buffer";
 //#region node_modules/.bun/re2js@2.8.6/node_modules/re2js/build/index.js
@@ -6362,15 +6362,15 @@ var RE2JS = class RE2JS {
 	}
 };
 //#endregion
-//#region src/secrets/get-secret-rule-set.ts
-const RULE_SET$1 = {
-	source: {
+//#region src/secrets/betterleaks-rules.ts
+const BETTERLEAKS_RULES = {
+	"source": {
 		"repository": "https://github.com/betterleaks/betterleaks",
 		"version": "v1.9.0",
 		"commit": "81aff7a638638aae3a659845d089043e1d8fe9ac"
 	},
-	notice: "MIT License\n\nCopyright (c) 2026 Zachary Rice\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
-	prefilter: [
+	"notice": "MIT License\n\nCopyright (c) 2026 Zachary Rice\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+	"prefilter": [
 		{
 			"source": "gitleaks\\.toml",
 			"flags": "",
@@ -6497,7 +6497,7 @@ const RULE_SET$1 = {
 			"engine": "js"
 		}
 	],
-	filter: [{
+	"filter": [{
 		"kind": "matches",
 		"field": "secret",
 		"patterns": [
@@ -6574,7 +6574,7 @@ const RULE_SET$1 = {
 		"values": ["abcdefghijklmnopqrstuvwxyz", "014df517-39d1-4453-b7b3-9930c563627c"],
 		"negate": false
 	}],
-	rules: [
+	"rules": [
 		{
 			"id": "1password-secret-key",
 			"pattern": {
@@ -16875,7 +16875,7 @@ const RULE_SET$1 = {
 			"report": true
 		}
 	],
-	unported: [
+	"unported": [
 		{
 			"rule": "adafruit-api-key",
 			"part": "tokenRatio"
@@ -17570,8 +17570,10 @@ const RULE_SET$1 = {
 		}
 	]
 };
+//#endregion
+//#region src/secrets/get-secret-rule-set.ts
 function getSecretRuleSet() {
-	return RULE_SET$1;
+	return BETTERLEAKS_RULES;
 }
 //#endregion
 //#region src/secrets/find-secret.ts
@@ -17587,6 +17589,25 @@ function findSecret(content, rules = REPORTED_RULES) {
 	}
 	return null;
 }
+function hasPatternMatch(pattern, text) {
+	return pattern.engine === "re2" ? getRE2(pattern).matcher(text).find() : getRegExp(pattern).test(text);
+}
+const compiledRE2 = /* @__PURE__ */ new WeakMap();
+function getRE2(pattern) {
+	const cached = compiledRE2.get(pattern);
+	if (cached !== void 0) return cached;
+	const compiled = RE2JS.compile(pattern.source);
+	compiledRE2.set(pattern, compiled);
+	return compiled;
+}
+const compiledRegExps = /* @__PURE__ */ new WeakMap();
+function getRegExp(pattern) {
+	const cached = compiledRegExps.get(pattern);
+	if (cached !== void 0) return cached;
+	const compiled = new RegExp(pattern.source, pattern.flags);
+	compiledRegExps.set(pattern, compiled);
+	return compiled;
+}
 function findRuleSecret(rule, content) {
 	const path = content.path ?? "";
 	if (rule.path !== null && !hasPatternMatch(rule.path, path)) return null;
@@ -17698,30 +17719,11 @@ function countEntropy(text) {
 	}
 	return entropy;
 }
-function hasPatternMatch(pattern, text) {
-	return pattern.engine === "re2" ? getRE2(pattern).matcher(text).find() : getRegExp(pattern).test(text);
-}
-const compiledRegExps = /* @__PURE__ */ new WeakMap();
-const compiledRE2 = /* @__PURE__ */ new WeakMap();
-function getRegExp(pattern) {
-	const cached = compiledRegExps.get(pattern);
-	if (cached !== void 0) return cached;
-	const compiled = new RegExp(pattern.source, pattern.flags);
-	compiledRegExps.set(pattern, compiled);
-	return compiled;
-}
-function getRE2(pattern) {
-	const cached = compiledRE2.get(pattern);
-	if (cached !== void 0) return cached;
-	const compiled = RE2JS.compile(pattern.source);
-	compiledRE2.set(pattern, compiled);
-	return compiled;
-}
 //#endregion
 //#region src/bypass/classify-edit.ts
 const MAX_SCANNED_BYTES = 262144;
 function classifyEdit(action, scope) {
-	const fields = getEditFields(action.toolName);
+	const fields = findEditFields(action.toolName);
 	if (fields === null) return {
 		kind: "jev",
 		reason: "not a file-tool edit"
@@ -17766,48 +17768,6 @@ function classifyEdit(action, scope) {
 		reason: `secret scan matched ${secret.rule}`
 	};
 }
-const CONTEXT_LINES = 12;
-function buildScanText(action, field) {
-	const content = action.toolInput[field] ?? "";
-	if (typeof content !== "string") return { reason: "edit content is not text" };
-	if (action.toolName !== "Edit") return content;
-	const old = action.toolInput["old_string"];
-	if (typeof old !== "string" || old === "" || action.current === null) return { reason: "the edit cannot be read in the context of its file" };
-	const parts = action.current.split(old);
-	if (parts.length === 1) return { reason: "the edit text is not in the file" };
-	const replaced = action.toolInput["replace_all"] === true ? parts.length - 1 : 1;
-	const spans = [];
-	let produced = parts[0] ?? "";
-	for (let index = 1; index < parts.length; index += 1) {
-		const isReplaced = index <= replaced;
-		if (isReplaced) spans.push({
-			start: produced.length,
-			end: produced.length + content.length
-		});
-		produced += `${isReplaced ? content : old}${parts[index] ?? ""}`;
-	}
-	return collectContext(produced, spans);
-}
-function collectContext(text, spans) {
-	const lines = text.split("\n");
-	const starts = [];
-	let offset = 0;
-	for (const line of lines) {
-		starts.push(offset);
-		offset += line.length + 1;
-	}
-	const keep = /* @__PURE__ */ new Set();
-	for (const span of spans) {
-		const first = starts.findLastIndex((start) => start <= span.start);
-		const last = starts.findLastIndex((start) => start <= span.end);
-		for (let line = first - CONTEXT_LINES; line <= last + CONTEXT_LINES; line += 1) keep.add(line);
-	}
-	return lines.filter((_, index) => keep.has(index)).join("\n");
-}
-function toWorktreePath(path, worktrees) {
-	const worktree = findWorktree(path, worktrees);
-	return worktree === null ? path : relative(worktree, path).split(sep).join("/");
-}
 function findWorktree(target, worktrees) {
 	return worktrees.filter((worktree) => isWithin(target, worktree)).toSorted((left, right) => right.length - left.length)[0] ?? null;
 }
@@ -17850,5 +17810,47 @@ function findExclusion(path) {
 	const name = basename(path);
 	return EXCLUDED_NAMES.find(([pattern]) => pattern.test(name))?.[1] ?? null;
 }
+function toWorktreePath(path, worktrees) {
+	const worktree = findWorktree(path, worktrees);
+	return worktree === null ? path : relative(worktree, path).split(sep).join("/");
+}
+function buildScanText(action, field) {
+	const content = action.toolInput[field] ?? "";
+	if (typeof content !== "string") return { reason: "edit content is not text" };
+	if (action.toolName !== "Edit") return content;
+	const old = action.toolInput["old_string"];
+	if (typeof old !== "string" || old === "" || action.current === null) return { reason: "the edit cannot be read in the context of its file" };
+	const parts = action.current.split(old);
+	if (parts.length === 1) return { reason: "the edit text is not in the file" };
+	const replaced = action.toolInput["replace_all"] === true ? parts.length - 1 : 1;
+	const spans = [];
+	let produced = parts[0] ?? "";
+	for (let index = 1; index < parts.length; index += 1) {
+		const isReplaced = index <= replaced;
+		if (isReplaced) spans.push({
+			start: produced.length,
+			end: produced.length + content.length
+		});
+		produced += `${isReplaced ? content : old}${parts[index] ?? ""}`;
+	}
+	return collectContext(produced, spans);
+}
+const CONTEXT_LINES = 12;
+function collectContext(text, spans) {
+	const lines = text.split("\n");
+	const starts = [];
+	let offset = 0;
+	for (const line of lines) {
+		starts.push(offset);
+		offset += line.length + 1;
+	}
+	const keep = /* @__PURE__ */ new Set();
+	for (const span of spans) {
+		const first = starts.findLastIndex((start) => start <= span.start);
+		const last = starts.findLastIndex((start) => start <= span.end);
+		for (let line = first - CONTEXT_LINES; line <= last + CONTEXT_LINES; line += 1) keep.add(line);
+	}
+	return lines.filter((_, index) => keep.has(index)).join("\n");
+}
 //#endregion
 export { classifyEdit };

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as pickJudgeLane, E as updateJSONFile, S as CLI_LIMITS, T as resolveXDGDir, _ as findCheckout, a as resolveSessionScopePath, b as loadConfig, c as splitGitCommand, d as loadCheckoutFacts, f as writeActionDiagnostic, g as isUnresolvedWord, h as resolveShellPath, i as classifyAction, l as loadPolicy, m as collectShellCommands, n as readRuntime, o as loadSessionScope, p as toRepositorySlug, s as EMPTY_SESSION_SCOPE, t as parseActionRequest, u as resolveShippedPolicyDir, v as findGitEntry, w as M, x as runCapped, y as DEFAULT_SCOPE_SOURCES } from "./parse-action-request-CPpuEqFq.js";
+import { C as pickJudgeLane, E as updateJSONFile, S as CLI_LIMITS, T as resolveXDGDir, _ as readCheckout, a as resolveSessionScopePath, b as loadConfig, c as splitGitCommand, d as loadCheckoutFacts, f as writeActionDiagnostic, g as isUnresolvedWord, h as resolveShellPath, i as classifyAction, l as loadPolicy, m as collectShellCommands, n as readRuntime, o as loadSessionScope, p as toRepositorySlug, s as EMPTY_SESSION_SCOPE, t as parseActionRequest, u as resolveShippedPolicyDir, v as readGitEntry, w as M, x as runCapped, y as DEFAULT_SCOPE_SOURCES } from "./parse-action-request-C55m5DlM.js";
 import { a as literal, d as string, i as discriminatedUnion, r as boolean, s as number, u as strictObject } from "./schemas-B_w83Dze.js";
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, mkdir, open, readFile, realpath, stat } from "node:fs/promises";
@@ -2570,10 +2570,10 @@ function resolveCaptureDir(capture, host) {
 	return capture.directory ?? join(resolveXDGDir(host, "state"), "captures");
 }
 //#endregion
-//#region src/capture/find-enclosing-work-tree.ts
-async function findEnclosingWorkTree(path) {
+//#region src/capture/read-enclosing-work-tree.ts
+async function readEnclosingWorkTree(path) {
 	const real = await resolveExistingPrefix(resolve(path));
-	const entry = await findGitEntry(real);
+	const entry = await readGitEntry(real);
 	return entry === null ? null : entry.directory;
 }
 async function resolveExistingPrefix(path) {
@@ -2593,7 +2593,7 @@ async function tryWriteRequestCapture(directory, record) {
 		reason: `the capture dir ${directory} is not an absolute path`
 	};
 	try {
-		const before = await findEnclosingWorkTree(directory);
+		const before = await readEnclosingWorkTree(directory);
 		if (before !== null) return {
 			kind: "refused",
 			reason: `the capture dir is inside the git work tree ${before}`
@@ -2603,7 +2603,7 @@ async function tryWriteRequestCapture(directory, record) {
 			mode: 448
 		});
 		const real = await realpath(directory);
-		const after = await findEnclosingWorkTree(real);
+		const after = await readEnclosingWorkTree(real);
 		if (after !== null) return {
 			kind: "refused",
 			reason: `the capture dir is inside the git work tree ${after}`
@@ -2804,6 +2804,7 @@ async function readBranchCreatedAt(commonDir, branch) {
 }
 //#endregion
 //#region src/scope/collect-pull-request-addresses.ts
+const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
 function collectPullRequestAddresses(text) {
 	const addresses = /* @__PURE__ */ new Map();
 	for (const match of text.matchAll(PULL_REQUEST_URL)) {
@@ -2816,7 +2817,6 @@ function collectPullRequestAddresses(text) {
 	}
 	return [...addresses.values()];
 }
-const PULL_REQUEST_URL = /https:\/\/(?<repository>[^/\s]+\/[^/\s]+\/[^/\s]+)\/pull\/(?<number>[1-9]\d*)\b/gu;
 //#endregion
 //#region mods/auto-mode/contract/scope-commands.ts
 const SCOPE_COMMANDS = {
@@ -2843,6 +2843,12 @@ function collectScopeEvents(command, cwd, home) {
 		}] : [];
 	});
 }
+const GIT_EVENT_COLLECTORS = {
+	"worktree add": collectWorktreeEvents,
+	checkout: collectSwitchEvents,
+	switch: collectSwitchEvents,
+	branch: collectBranchEvents
+};
 function collectGitEvents(args, cwd, home) {
 	const git = splitGitCommand(args, cwd, home);
 	const found = findScopeCommand(SCOPE_COMMANDS.git, git.args);
@@ -2859,12 +2865,6 @@ function findScopeCommand(commands, args) {
 	}
 	return null;
 }
-const GIT_EVENT_COLLECTORS = {
-	"worktree add": collectWorktreeEvents,
-	checkout: collectSwitchEvents,
-	switch: collectSwitchEvents,
-	branch: collectBranchEvents
-};
 function collectWorktreeEvents(rest, directory, home) {
 	const path = findWorktreePath(rest);
 	const resolved = path === null ? null : resolveShellPath(directory, path, home);
@@ -2903,6 +2903,11 @@ function collectSwitchEvents(rest, directory) {
 		directory
 	}];
 }
+function findOptionValue(args, options) {
+	const index = args.findIndex((word) => options.includes(word));
+	const value = index === -1 ? void 0 : args[index + 1];
+	return value === void 0 || isUnresolvedWord(value) ? null : value;
+}
 function collectBranchEvents(rest, directory) {
 	if (rest.some((word) => BRANCH_OTHER_OPTIONS.test(word))) return [];
 	const name = rest.find((word) => !word.startsWith("-"));
@@ -2912,11 +2917,6 @@ function collectBranchEvents(rest, directory) {
 		directory
 	}];
 }
-function findOptionValue(args, options) {
-	const index = args.findIndex((word) => options.includes(word));
-	const value = index === -1 ? void 0 : args[index + 1];
-	return value === void 0 || isUnresolvedWord(value) ? null : value;
-}
 //#endregion
 //#region src/scope/merge-session-scope.ts
 function mergeSessionScope(all) {
@@ -2953,11 +2953,10 @@ async function tryVerifyScopeEvent(event, request, options) {
 		return EMPTY_SESSION_SCOPE;
 	}
 }
-const FORGE_CLOCK_SKEW_MS = 6e4;
-const FILE_CLOCK_SLACK_MS = 50;
 function verifyScopeEvent(event, request, options) {
 	return M(event).returnType().with({ kind: "worktree" }, (worktree) => verifyWorktreeEvent(worktree.path, request, options)).with({ kind: "branch" }, (branch) => verifyBranchEvent(branch, request, options)).with({ kind: "pull-request" }, (pull) => verifyPullRequestEvent(pull.directory, request, options)).exhaustive();
 }
+const FILE_CLOCK_SLACK_MS = 50;
 async function verifyWorktreeEvent(path, request, options) {
 	const link = await stat(join(path, ".git"));
 	const facts = await loadCheckoutFacts(path, options.env);
@@ -2968,7 +2967,7 @@ async function verifyWorktreeEvent(path, request, options) {
 		...EMPTY_SESSION_SCOPE,
 		worktrees: [path]
 	};
-	const isNew = await isBranchCreatedSince(checkout.commonDir, branch, request.startedAt);
+	const isNew = await probeBranchCreatedSince(checkout.commonDir, branch, request.startedAt);
 	return {
 		...EMPTY_SESSION_SCOPE,
 		worktrees: [path],
@@ -2978,10 +2977,16 @@ async function verifyWorktreeEvent(path, request, options) {
 		}] : []
 	};
 }
+async function probeBranchCreatedSince(commonDir, branch, since) {
+	const createdAt = await readBranchCreatedAt(commonDir, branch);
+	if (createdAt === null || createdAt < Math.floor(since / 1e3) * 1e3) return false;
+	const ref = await stat(join(commonDir, "refs", "heads", branch)).catch(() => null);
+	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
+}
 async function verifyBranchEvent(event, request, options) {
-	const checkout = await findCheckout(event.directory, options.env);
+	const checkout = await readCheckout(event.directory, options.env);
 	if (checkout === null) return EMPTY_SESSION_SCOPE;
-	return await isBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
+	return await probeBranchCreatedSince(checkout.commonDir, event.name, request.startedAt) ? {
 		...EMPTY_SESSION_SCOPE,
 		branches: [{
 			name: event.name,
@@ -2989,6 +2994,7 @@ async function verifyBranchEvent(event, request, options) {
 		}]
 	} : EMPTY_SESSION_SCOPE;
 }
+const FORGE_CLOCK_SKEW_MS = 6e4;
 async function verifyPullRequestEvent(directory, request, options) {
 	const facts = await loadCheckoutFacts(directory, options.env);
 	if (facts.checkout === null) return EMPTY_SESSION_SCOPE;
@@ -3006,12 +3012,6 @@ async function verifyPullRequestEvent(directory, request, options) {
 		pullRequests: pulls.flat()
 	};
 }
-async function isBranchCreatedSince(commonDir, branch, since) {
-	const createdAt = await readBranchCreatedAt(commonDir, branch);
-	if (createdAt === null || createdAt < Math.floor(since / 1e3) * 1e3) return false;
-	const ref = await stat(join(commonDir, "refs", "heads", branch)).catch(() => null);
-	return ref !== null && ref.mtimeMs >= since - FILE_CLOCK_SLACK_MS;
-}
 //#endregion
 //#region src/record-scope.ts
 async function recordScope(request, config, runtime) {
@@ -3145,20 +3145,6 @@ async function runCLI(argv, io) {
 	}
 	return exitCode;
 }
-function runCommandAfterTerminator(io, values, rest) {
-	const [command, ...positionals] = rest;
-	if (values.help === true || command === void 0) return Promise.resolve(printUsage(io.stdout));
-	const runCommand = COMMANDS.get(command);
-	if (runCommand === void 0) {
-		io.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
-		return Promise.resolve(2);
-	}
-	return runCommand(io, values, positionals);
-}
-function printUsage(stdout) {
-	stdout.write(USAGE);
-	return 0;
-}
 async function runClassification(io, values) {
 	try {
 		return await run(io, {
@@ -3172,61 +3158,6 @@ async function runClassification(io, values) {
 		return 0;
 	}
 }
-async function printPrompt(io, values) {
-	const config = await loadConfig(void 0, io.runtime.host);
-	printWarnings(io.stderr, config.warnings);
-	const prompt = await loadPolicy({
-		classifierPath: values.classifier ?? config.classifierPath,
-		rulesPath: values.rules ?? config.rulesPath
-	}, "decision.md");
-	io.stdout.write(`${prompt}\n`);
-	return 0;
-}
-function printModPath(io) {
-	try {
-		io.stdout.write(`${resolveShippedModDir()}\n`);
-		return Promise.resolve(0);
-	} catch (error) {
-		io.stderr.write(`auto-mode: ${error instanceof Error ? error.message : String(error)}\n`);
-		return Promise.resolve(1);
-	}
-}
-function requireValidCommandLine(ctx) {
-	if (ctx.validationError !== void 0) throw ctx.validationError;
-}
-function isUsageError(error) {
-	return error instanceof AggregateError && error.errors.every((reason) => isArgsValidationError(reason) || isCommandNotFoundError(reason) || isCommandResolutionError(reason));
-}
-function formatUsageError(error) {
-	return error.errors.map((reason) => {
-		if (isCommandNotFoundError(reason)) return `unknown command '${reason.commandName}'`;
-		return reason instanceof Error ? reason.message : String(reason);
-	}).join("\n");
-}
-function buildJudgeServerSession(io, config, sessionID) {
-	const judge = config.judge ?? null;
-	if (io.judgeServerCommand === void 0 || judge === null || pickJudgeLane(judge).transport !== "agent-sdk") return;
-	const command = io.judgeServerCommand;
-	const entry = command[1] ?? command[0];
-	return makeJudgeServerSession({
-		socketPath: resolveJudgeSocketPath(io.runtime.host, sessionID, entry),
-		command: io.judgeServerCommand,
-		env: io.runtime.host.env,
-		timeoutMs: judge.timeoutMs
-	});
-}
-async function runJudgeServer(io, socketPath) {
-	if (socketPath === void 0) {
-		io.stderr.write(`auto-mode: judge-server needs a socket path\n\n${USAGE}`);
-		return 2;
-	}
-	await (await (await import("./start-judge-server-D-zcMyFZ.js")).startJudgeServer({
-		socketPath,
-		env: io.runtime.host.env,
-		idleMs: JUDGE_IDLE_MS
-	}))?.closed;
-	return 0;
-}
 const JUDGE_IDLE_MS = 9e5;
 async function run(io, options) {
 	const raw = await io.stdin();
@@ -3292,6 +3223,18 @@ function printNote(stderr, explain, message) {
 function printWarnings(stderr, warnings = []) {
 	for (const warning of warnings) stderr.write(`auto-mode: ${warning}\n`);
 }
+function buildJudgeServerSession(io, config, sessionID) {
+	const judge = config.judge ?? null;
+	if (io.judgeServerCommand === void 0 || judge === null || pickJudgeLane(judge).transport !== "agent-sdk") return;
+	const command = io.judgeServerCommand;
+	const entry = command[1] ?? command[0];
+	return makeJudgeServerSession({
+		socketPath: resolveJudgeSocketPath(io.runtime.host, sessionID, entry),
+		command: io.judgeServerCommand,
+		env: io.runtime.host.env,
+		timeoutMs: judge.timeoutMs
+	});
+}
 function printVerdict(stdout, verdict) {
 	stdout.write(renderVerdict(verdict));
 }
@@ -3299,6 +3242,16 @@ function printCaptureNote(stderr, captured) {
 	if (captured.kind === "refused") stderr.write(`auto-mode: capture skipped: ${captured.reason}\n`);
 	if (captured.kind === "failed") stderr.write("auto-mode: capture unavailable\n");
 }
+async function printPrompt(io, values) {
+	const config = await loadConfig(void 0, io.runtime.host);
+	printWarnings(io.stderr, config.warnings);
+	const prompt = await loadPolicy({
+		classifierPath: values.classifier ?? config.classifierPath,
+		rulesPath: values.rules ?? config.rulesPath
+	}, "decision.md");
+	io.stdout.write(`${prompt}\n`);
+	return 0;
+}
 async function runRecord(io) {
 	const raw = await io.stdin();
 	let body;
@@ -3316,6 +3269,53 @@ async function runRecord(io) {
 	}
 	return 0;
 }
+function printModPath(io) {
+	try {
+		io.stdout.write(`${resolveShippedModDir()}\n`);
+		return Promise.resolve(0);
+	} catch (error) {
+		io.stderr.write(`auto-mode: ${error instanceof Error ? error.message : String(error)}\n`);
+		return Promise.resolve(1);
+	}
+}
+async function runJudgeServer(io, socketPath) {
+	if (socketPath === void 0) {
+		io.stderr.write(`auto-mode: judge-server needs a socket path\n\n${USAGE}`);
+		return 2;
+	}
+	await (await (await import("./start-judge-server-BlhDO_4A.js")).startJudgeServer({
+		socketPath,
+		env: io.runtime.host.env,
+		idleMs: JUDGE_IDLE_MS
+	}))?.closed;
+	return 0;
+}
+function printUsage(stdout) {
+	stdout.write(USAGE);
+	return 0;
+}
+function runCommandAfterTerminator(io, values, rest) {
+	const [command, ...positionals] = rest;
+	if (values.help === true || command === void 0) return Promise.resolve(printUsage(io.stdout));
+	const runCommand = COMMANDS.get(command);
+	if (runCommand === void 0) {
+		io.stderr.write(`auto-mode: unknown command '${command}'\n\n${USAGE}`);
+		return Promise.resolve(2);
+	}
+	return runCommand(io, values, positionals);
+}
+function requireValidCommandLine(ctx) {
+	if (ctx.validationError !== void 0) throw ctx.validationError;
+}
+function isUsageError(error) {
+	return error instanceof AggregateError && error.errors.every((reason) => isArgsValidationError(reason) || isCommandNotFoundError(reason) || isCommandResolutionError(reason));
+}
+function formatUsageError(error) {
+	return error.errors.map((reason) => {
+		if (isCommandNotFoundError(reason)) return `unknown command '${reason.commandName}'`;
+		return reason instanceof Error ? reason.message : String(reason);
+	}).join("\n");
+}
 //#endregion
 //#region src/cli.ts
 process.exitCode = await runCLI(process.argv.slice(2), {

package/dist/{get-edit-fields-BtAvHIsq.js → find-edit-fields-CzkhPA4j.js}

@@ -1,4 +1,4 @@
-//#region src/bypass/get-edit-fields.ts
+//#region src/bypass/find-edit-fields.ts
 const EDIT_FIELDS = {
 	Edit: {
 		path: "file_path",
@@ -13,8 +13,8 @@ const EDIT_FIELDS = {
 		content: "new_source"
 	}
 };
-function getEditFields(toolName) {
+function findEditFields(toolName) {
 	return EDIT_FIELDS[toolName] ?? null;
 }
 //#endregion
-export { getEditFields as t };
+export { findEditFields as t };

package/dist/index.d.ts

@@ -45,7 +45,7 @@ interface Checkout {
   readonly gitDir: string;
   readonly commonDir: string;
 }
-type CheckoutFinder = (start: string, env: HostEnvironment['env']) => Promise<Checkout | null>;
+type CheckoutReader = (start: string, env: HostEnvironment['env']) => Promise<Checkout | null>;
 //#endregion
 //#region src/types.d.ts
 type DecidingStage = 'local' | 'containment' | 'bypass' | 'jev' | 'judge' | 'retry' | 'budget';
@@ -78,7 +78,7 @@ interface Runtime {
   readonly now: () => number;
   readonly timeout: (timeoutMs: number) => AbortSignal;
   readonly fetch: (url: string, init: Readonly<RequestInit>) => Promise<Response>;
-  readonly findCheckout: CheckoutFinder;
+  readonly readCheckout: CheckoutReader;
 }
 interface ClaudeRules {
   readonly environment: readonly string[];

package/dist/index.js

@@ -1,4 +1,4 @@
-import { b as loadConfig$1, i as classifyAction$1, n as readRuntime, r as readHostEnvironment, t as parseActionRequest } from "./parse-action-request-CPpuEqFq.js";
+import { b as loadConfig$1, i as classifyAction$1, n as readRuntime, r as readHostEnvironment, t as parseActionRequest } from "./parse-action-request-C55m5DlM.js";
 //#region src/index.ts
 function classifyAction(request, config, options = {}) {
 	return classifyAction$1(request, config, {