copyrun 0.1.0 → 0.2.0

package/dist/mission.js

@@ -0,0 +1,472 @@
+#!/usr/bin/env node
+
+// src/mission-hook.ts
+import { readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { basename, join as join4 } from "path";
+
+// src/config.ts
+import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join as join2 } from "path";
+
+// src/managed.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var GATED_CAPABILITIES = ["shell", "install", "network", "settings"];
+var SLUG = /^[a-z0-9][a-z0-9-]{0,39}$/;
+var HANDLE = /^[a-z0-9][a-z0-9-]{0,38}$/;
+function parseManaged(v) {
+  const problems = [];
+  const config = {};
+  if (!v || typeof v !== "object" || Array.isArray(v)) return { config, problems: ["not a JSON object"] };
+  const o = v;
+  const bool = (k) => {
+    if (o[k] === void 0) return;
+    if (typeof o[k] !== "boolean") problems.push(`${k} must be true or false`);
+    else config[k] = o[k];
+  };
+  if (o.apiHost !== void 0) {
+    try {
+      const u = new URL(String(o.apiHost));
+      const local = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+      if (u.protocol !== "https:" && !(local && u.protocol === "http:")) problems.push("apiHost must be an https URL");
+      else config.apiHost = u.origin;
+    } catch {
+      problems.push("apiHost must be a URL");
+    }
+  }
+  if (o.org !== void 0) {
+    const s = typeof o.org === "string" ? o.org.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("org must be an org slug");
+    else config.org = s;
+  }
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
+  if (o.autopilotOrg !== void 0) {
+    const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
+    else config.autopilotOrg = s;
+  }
+  if (o.autopilotContent !== void 0) {
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
+    else config.autopilotContent = o.autopilotContent;
+  }
+  if (o.allowedCloneSources !== void 0) {
+    const a = o.allowedCloneSources;
+    if (a === "any" || a === "org-playbook") config.allowedCloneSources = a;
+    else if (Array.isArray(a) && a.every((x) => typeof x === "string" && HANDLE.test(x.trim().replace(/^@/, "").toLowerCase())))
+      config.allowedCloneSources = [...new Set(a.map((x) => x.trim().replace(/^@/, "").toLowerCase()))];
+    else problems.push('allowedCloneSources must be "any", "org-playbook" or a list of handles and org slugs');
+  }
+  if (o.extraRedactTerms !== void 0) {
+    if (!Array.isArray(o.extraRedactTerms) || !o.extraRedactTerms.every((t) => typeof t === "string")) problems.push("extraRedactTerms must be a list of strings");
+    else config.extraRedactTerms = [...new Set(o.extraRedactTerms.map((t) => t.trim()).filter((t) => t.length >= 2 && t.length <= 100))].slice(0, 200);
+  }
+  if (o.profile !== void 0) {
+    if (o.profile !== "finance" && o.profile !== "hipaa") problems.push('profile must be "finance" or "hipaa"');
+    else config.profile = o.profile;
+  }
+  if (o.archive !== void 0) {
+    const a = o.archive;
+    const org = a && typeof a.org === "string" ? a.org.trim().toLowerCase() : "";
+    if (!a || typeof a !== "object" || !SLUG.test(org) || a.required !== void 0 && typeof a.required !== "boolean") problems.push("archive must be { org: <slug>, required: true|false }");
+    else config.archive = { org, required: a.required === true };
+  }
+  if (o.restrictOrgs !== void 0) {
+    const list = typeof o.restrictOrgs === "string" ? o.restrictOrgs.split(",") : o.restrictOrgs;
+    if (!Array.isArray(list) || !list.every((x) => typeof x === "string" && SLUG.test(x.trim().toLowerCase()))) problems.push("restrictOrgs must be a list of org slugs");
+    else config.restrictOrgs = [...new Set(list.map((x) => x.trim().toLowerCase()))];
+  }
+  if (o.restrictMode !== void 0) {
+    if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
+    else config.restrictMode = o.restrictMode;
+  }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
+  if (o.allowCloneYesWith !== void 0) {
+    const l = o.allowCloneYesWith;
+    if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
+    else config.allowCloneYesWith = [...new Set(l)];
+  }
+  return { config, problems };
+}
+function systemManagedPaths(platform = process.platform, env = process.env) {
+  if (platform === "darwin")
+    return [
+      { path: "/Library/Application Support/copyrun/managed.json", kind: "json" },
+      // a configuration profile (Jamf, Kandji, Intune for Mac) lands here; it wins over the file
+      { path: "/Library/Managed Preferences/ai.copyrun.cli.plist", kind: "plist" }
+    ];
+  if (platform === "win32") return [{ path: join(env.ProgramData || env.PROGRAMDATA || "C:\\ProgramData", "copyrun", "managed.json"), kind: "json" }];
+  return [{ path: "/etc/copyrun/managed.json", kind: "json" }];
+}
+function plutil(p) {
+  try {
+    return execFileSync("/usr/bin/plutil", ["-convert", "json", "-o", "-", p], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 });
+  } catch {
+    return void 0;
+  }
+}
+function loadManaged(deps = {}) {
+  const env = deps.env ?? process.env;
+  const exists = deps.exists ?? existsSync;
+  const read = deps.read ?? ((p) => readFileSync(p, "utf8"));
+  const plist = deps.plistToJson ?? plutil;
+  const system = systemManagedPaths(deps.platform ?? process.platform, env).filter((f) => exists(f.path));
+  const files = system.length ? system : env.COPYRUN_MANAGED_CONFIG ? [{ path: env.COPYRUN_MANAGED_CONFIG, kind: "json" }] : [];
+  const state = { config: {}, sources: [], errors: [] };
+  for (const f of files) {
+    let text;
+    try {
+      text = f.kind === "plist" ? plist(f.path) : read(f.path);
+    } catch (e) {
+      state.errors.push(`${f.path}: can't be read (${e.message})`);
+      continue;
+    }
+    if (text === void 0) {
+      if (f.kind === "plist" && files.some((x) => x.kind === "json")) continue;
+      state.errors.push(`${f.path}: can't be read (plutil unavailable)`);
+      continue;
+    }
+    let json;
+    try {
+      json = JSON.parse(text);
+    } catch {
+      state.errors.push(`${f.path}: not valid JSON`);
+      continue;
+    }
+    const { config, problems } = parseManaged(json);
+    if (problems.length) state.errors.push(`${f.path}: ${problems.join("; ")}`);
+    state.config = { ...state.config, ...config };
+    state.sources.push(f.path);
+  }
+  if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
+  if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
+  return state;
+}
+var cached;
+function managed() {
+  return cached ??= loadManaged();
+}
+
+// src/config.ts
+var VERSION = "0.2.0";
+var DIR = process.env.COPYRUN_HOME ?? join2(homedir(), ".copyrun");
+function isLoopbackHost(hostname) {
+  const h = hostname.toLowerCase();
+  return h === "localhost" || h.endsWith(".localhost") || h === "127.0.0.1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h) || h === "[::1]" || h === "::1";
+}
+function apiProblem(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return `"${url}" isn't a URL (--api / COPYRUN_API).`;
+  }
+  if (u.protocol === "https:" || u.protocol === "http:" && isLoopbackHost(u.hostname)) return void 0;
+  return `copyrun won't talk to ${u.origin}: the server must be https (plain http only for localhost). Your device token and runs would travel unencrypted.`;
+}
+function apiBase(flag) {
+  const pinned = managed().config.apiHost;
+  if (pinned) return pinned;
+  const base = (flag ?? process.env.COPYRUN_API ?? "https://copyrun.ai").replace(/\/$/, "");
+  const problem = apiProblem(base);
+  if (problem) throw new Error(problem);
+  return base;
+}
+
+// src/live-logic.ts
+import { createHash } from "crypto";
+function gateHeaders(env) {
+  const h = {};
+  const prelaunch = env.COPYRUN_PRELAUNCH_KEY?.trim();
+  if (prelaunch) h["x-copyrun-prelaunch"] = prelaunch;
+  const beta = env.COPYRUN_BETA?.trim();
+  if (beta && beta.includes(":")) h["x-copyrun-beta"] = beta;
+  return h;
+}
+var TEST_RE = /(^|[\s;&|])(npm|pnpm|yarn|bun)\s+(run\s+)?test\b|(^|[\s;&|])(vitest|jest|pytest|mocha|cargo test|go test|node --test|rspec|phpunit|mix test|dotnet test|gradle test|mvn test|make test)\b/;
+var FAILED_RE = /(\d+\s+(failed|failing)\b|FAIL\b|Tests:\s+\d+ failed|AssertionError|Traceback \(most recent call last\)|error TS\d+|npm ERR!)/;
+var EXT_RE = /\.([a-z0-9]{1,12})$/i;
+var str = (v) => typeof v === "string" ? v : void 0;
+function extOf(path) {
+  if (!path) return void 0;
+  const base = path.replace(/\\/g, "/").split("/").pop() ?? "";
+  const m = base.match(EXT_RE);
+  return m ? m[1].toLowerCase() : void 0;
+}
+function summarizeHook(input) {
+  if (input.hook_event_name === "Stop") return { kind: "stop" };
+  const name = input.tool_name;
+  if (!name) return void 0;
+  const ti = input.tool_input && typeof input.tool_input === "object" ? input.tool_input : {};
+  const file = str(ti.file_path) ?? str(ti.notebook_path) ?? str(ti.path);
+  const ext = extOf(file);
+  switch (name) {
+    case "Read":
+      return { kind: "read", ...ext ? { ext } : {} };
+    case "Write":
+      return { kind: "write", ...ext ? { ext } : {} };
+    case "Edit":
+    case "MultiEdit":
+    case "NotebookEdit":
+      return { kind: "edit", ...ext ? { ext } : {} };
+    case "Bash": {
+      const command = str(ti.command) ?? "";
+      if (!TEST_RE.test(command)) return { kind: "bash" };
+      const out = testOutput(input.tool_response);
+      return { kind: "test", ...out === void 0 ? {} : { ok: !FAILED_RE.test(out) } };
+    }
+    case "Grep":
+    case "Glob":
+    case "LS":
+      return { kind: "search" };
+    case "WebFetch":
+    case "WebSearch":
+      return { kind: "web" };
+    case "Task":
+    case "Agent":
+      return { kind: "agent" };
+    case "Skill":
+      return { kind: "skill" };
+    default:
+      return { kind: "tool" };
+  }
+}
+function testOutput(resp) {
+  if (typeof resp === "string") return resp.slice(-4e3);
+  if (resp && typeof resp === "object") {
+    const r = resp;
+    if (r.interrupted === true) return "FAIL interrupted";
+    const parts = [str(r.stdout), str(r.stderr), str(r.output)].filter((s) => !!s);
+    if (parts.length) return parts.join("\n").slice(-4e3);
+  }
+  return void 0;
+}
+
+// src/mission-logic.ts
+import { createHash as createHash2 } from "crypto";
+var BEAT_TIMEOUT_MS = 1500;
+var missionKey = (sessionId) => createHash2("sha256").update(`copyrun-mission-v1:${sessionId}`).digest("hex").slice(0, 32);
+function transcriptTokens(jsonl) {
+  const byId = /* @__PURE__ */ new Map();
+  let n = 0;
+  for (const line of jsonl.split("\n")) {
+    if (!line.includes('"usage"')) continue;
+    let o;
+    try {
+      o = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    const u = o.message?.usage;
+    if (o.type !== "assistant" || !u) continue;
+    const num = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+    const cached2 = num(u.cache_read_input_tokens);
+    const t = { input: num(u.input_tokens) + num(u.cache_creation_input_tokens) + cached2, cached: cached2, output: num(u.output_tokens) };
+    byId.set(typeof o.message?.id === "string" ? o.message.id : `#${n++}`, t);
+  }
+  if (!byId.size) return void 0;
+  const sum = { input: 0, cached: 0, output: 0 };
+  for (const t of byId.values()) {
+    sum.input += t.input;
+    sum.cached += t.cached;
+    sum.output += t.output;
+  }
+  return sum.input + sum.output > 0 ? sum : void 0;
+}
+var TOKENS_MAX_BYTES = 64 * 1024 * 1024;
+var EVENT = { SessionStart: "start", UserPromptSubmit: "prompt", PreToolUse: "step", Notification: "waiting", Stop: "stop", SessionEnd: "end" };
+function beatOf(input, agent2, project) {
+  const event = input.hook_event_name ? EVENT[input.hook_event_name] : void 0;
+  if (!event || !input.session_id) return void 0;
+  const step = event === "step" ? summarizeHook({ ...input, hook_event_name: "PreToolUse" }) : void 0;
+  const kind = step?.kind === "stop" || step?.kind === "start" ? void 0 : step?.kind;
+  const name = projectName(project);
+  return { session: missionKey(input.session_id), agent: agent2, event, ...name ? { project: name } : {}, ...kind ? { kind } : {}, ...step?.ext ? { ext: step.ext } : {}, ...event === "waiting" && needsPermission(input) ? { page: true } : {} };
+}
+var projectName = (p) => p?.replace(/[^\w .@()+-]/g, "").trim().slice(0, 80) || void 0;
+function needsPermission(input) {
+  if (typeof input.notification_type === "string") return input.notification_type === "permission_prompt";
+  return typeof input.message === "string" && /\bpermission\b/i.test(input.message);
+}
+var SHELL_TEST = /(^|[\s;&|])(npm|pnpm|yarn|bun)\s+(run\s+)?test\b|(^|[\s;&|])(vitest|jest|pytest|mocha|cargo test|go test|node --test|rspec|phpunit|mix test|dotnet test|gradle test|mvn test|make test)\b/;
+var extOfPath = (p) => {
+  const m = typeof p === "string" ? /\.([A-Za-z0-9]{1,12})$/.exec(p) : null;
+  return m ? m[1].toLowerCase() : void 0;
+};
+function cursorBeatOf(input, project) {
+  const id = typeof input.conversation_id === "string" ? input.conversation_id : typeof input.session_id === "string" ? input.session_id : void 0;
+  const name = typeof input.hook_event_name === "string" ? input.hook_event_name : void 0;
+  if (!id || !name) return void 0;
+  const base = { session: missionKey(`cursor:${id}`), agent: "cursor", ...projectName(project) ? { project: projectName(project) } : {} };
+  switch (name) {
+    case "beforeSubmitPrompt":
+      return { ...base, event: "prompt" };
+    case "beforeShellExecution":
+      return { ...base, event: "step", kind: typeof input.command === "string" && SHELL_TEST.test(input.command) ? "test" : "bash" };
+    case "beforeMCPExecution":
+      return { ...base, event: "step", kind: "tool" };
+    case "beforeReadFile": {
+      const ext = extOfPath(input.file_path);
+      return { ...base, event: "step", kind: "read", ...ext ? { ext } : {} };
+    }
+    case "afterFileEdit": {
+      const ext = extOfPath(input.file_path);
+      return { ...base, event: "step", kind: "edit", ...ext ? { ext } : {} };
+    }
+    case "stop":
+      return { ...base, event: "stop" };
+    default:
+      return void 0;
+  }
+}
+var CURSOR_PERMISSION_EVENTS = ["beforeShellExecution", "beforeMCPExecution", "beforeReadFile"];
+var isCursorPermissionEvent = (event) => CURSOR_PERMISSION_EVENTS.includes(event);
+var cursorAllowOutput = (event) => isCursorPermissionEvent(event) ? JSON.stringify({ continue: true, permission: "allow" }) : void 0;
+function cursorStopOutput(event, by) {
+  if (!isCursorPermissionEvent(event)) return void 0;
+  const who = by ? `@${by}` : "you";
+  const user = `Stopped from copyrun mission control by ${who}.`;
+  const agentMsg = `${user} Stop working now: don't retry or work around this, and wait for the person's next message.`;
+  return JSON.stringify({ continue: true, permission: "deny", user_message: user, agent_message: agentMsg });
+}
+function stopOutput(by, agent2) {
+  const who = by ? `@${by}` : "you";
+  const reason = `Stopped from copyrun mission control by ${who}. Stop working now: don't retry or work around this, and wait for the person's next message.`;
+  const deny = { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } };
+  return JSON.stringify(agent2 === "codex" ? deny : { continue: false, stopReason: `Stopped from copyrun mission control by ${who}.`, ...deny });
+}
+var codexQuietOutput = (event) => event === "Stop" ? "{}" : void 0;
+
+// src/local-project.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync } from "fs";
+import { dirname, isAbsolute, join as join3, resolve } from "path";
+var gitRootOf = (cwd) => {
+  try {
+    return existsSync2(cwd) ? gitRoot(cwd)?.root : void 0;
+  } catch {
+    return void 0;
+  }
+};
+function gitRoot(cwd) {
+  let dir = resolve(cwd);
+  for (let i = 0; i < 40; i++) {
+    const g = join3(dir, ".git");
+    try {
+      const st = statSync(g);
+      if (st.isDirectory()) return { root: dir, gitDir: g };
+      if (st.isFile()) {
+        const m = readFileSync2(g, "utf8").match(/^gitdir:\s*(.+)$/m);
+        if (m) {
+          const wt = isAbsolute(m[1].trim()) ? m[1].trim() : resolve(dir, m[1].trim());
+          let common = wt;
+          try {
+            const c = readFileSync2(join3(wt, "commondir"), "utf8").trim();
+            common = isAbsolute(c) ? c : resolve(wt, c);
+          } catch {
+          }
+          return { root: dir, gitDir: common };
+        }
+      }
+    } catch {
+    }
+    const up = dirname(dir);
+    if (up === dir) return void 0;
+    dir = up;
+  }
+  return void 0;
+}
+
+// src/mission-hook.ts
+var agent = process.argv.includes("cursor") ? "cursor" : process.argv.includes("codex") ? "codex" : "claude-code";
+var argEvent = process.argv[process.argv.indexOf("--event") + 1];
+var eventName = process.argv.includes("--event") ? argEvent : void 0;
+var answered = false;
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function readStdin() {
+  return new Promise((resolve2) => {
+    let data = "";
+    const t = setTimeout(() => resolve2(data), 1e3);
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (d) => {
+      data += d;
+      if (data.length > 2e6) process.stdin.destroy();
+    });
+    process.stdin.on("end", () => (clearTimeout(t), resolve2(data)));
+    process.stdin.on("error", () => (clearTimeout(t), resolve2(data)));
+  });
+}
+async function main() {
+  if (process.env.COPYRUN_REPLAY || managed().config.disableMission) return;
+  const cfg = readJson(join4(DIR, "config.json")) ?? {};
+  if (cfg.mission !== true) return;
+  const api = apiBase();
+  const token = cfg.device && cfg.device.api === api && typeof cfg.device.token === "string" ? cfg.device.token : void 0;
+  if (!token) return;
+  const input = JSON.parse(await readStdin());
+  if (typeof input.hook_event_name === "string" && input.hook_event_name) eventName ??= input.hook_event_name;
+  else if (eventName) input.hook_event_name = eventName;
+  const roots = Array.isArray(input.workspace_roots) ? input.workspace_roots.filter((r) => typeof r === "string") : [];
+  const cwd = typeof input.cwd === "string" && input.cwd || roots[0] || process.cwd();
+  const project = basename(gitRootOf(cwd) ?? cwd);
+  const beat = agent === "cursor" ? cursorBeatOf(input, project) : beatOf(input, agent, project);
+  if (!beat) return;
+  if (agent === "codex") {
+    const quiet = codexQuietOutput(eventName);
+    if (quiet) {
+      answered = true;
+      process.stdout.write(quiet + "\n");
+    }
+  }
+  if (agent === "claude-code" && (beat.event === "stop" || beat.event === "end") && typeof input.transcript_path === "string") {
+    try {
+      if (statSync2(input.transcript_path).size <= TOKENS_MAX_BYTES) {
+        const tokens = transcriptTokens(readFileSync3(input.transcript_path, "utf8"));
+        if (tokens) beat.tokens = tokens;
+      }
+    } catch {
+    }
+  }
+  const res = await fetch(`${api}/api/v1/me/mission/beat`, {
+    method: "POST",
+    headers: { ...gateHeaders(process.env), authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": `copyrun-cli/${VERSION} mission-hook` },
+    body: JSON.stringify(beat),
+    signal: AbortSignal.timeout(BEAT_TIMEOUT_MS)
+  });
+  if (!res.ok || beat.event !== "step") return;
+  const body = await res.json().catch(() => ({}));
+  if (body.stop !== true) return;
+  const by = typeof body.by === "string" ? body.by : void 0;
+  const out = agent === "cursor" ? cursorStopOutput(eventName ?? "", by) : stopOutput(by, agent);
+  if (out) {
+    answered = true;
+    process.stdout.write(out + "\n");
+  }
+}
+main().catch(() => {
+}).finally(() => {
+  const allow = agent === "cursor" && !answered ? cursorAllowOutput(eventName ?? "") : void 0;
+  if (allow) process.stdout.write(allow + "\n");
+  process.exit(0);
+});

package/dist/nudge.js

@@ -125,14 +125,14 @@ function parseManaged(v) {
     if (!SLUG.test(s)) problems.push("org must be an org slug");
     else config.org = s;
   }
-  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableAutopilot", "copyLink"]) bool(k);
+  for (const k of ["forbidPublic", "forbidAnonymous", "forbidUnlisted", "requireShape", "disableNudge", "disableLive", "disableReceipts", "disableAutopilot", "copyLink", "disableAsk", "disableMission", "disableCopy"]) bool(k);
   if (o.autopilotOrg !== void 0) {
     const s = typeof o.autopilotOrg === "string" ? o.autopilotOrg.trim().toLowerCase() : "";
     if (!SLUG.test(s)) problems.push("autopilotOrg must be an org slug");
     else config.autopilotOrg = s;
   }
   if (o.autopilotContent !== void 0) {
-    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions") problems.push('autopilotContent must be "full" or "actions"');
+    if (o.autopilotContent !== "full" && o.autopilotContent !== "actions" && o.autopilotContent !== "commands") problems.push('autopilotContent must be "full", "actions" or "commands"');
     else config.autopilotContent = o.autopilotContent;
   }
   if (o.allowedCloneSources !== void 0) {
@@ -165,6 +165,20 @@ function parseManaged(v) {
     if (o.restrictMode !== "block-all-uploads") problems.push('restrictMode must be "block-all-uploads"');
     else config.restrictMode = o.restrictMode;
   }
+  if (o.askBefore !== void 0) {
+    if (!Array.isArray(o.askBefore) || !o.askBefore.every((t) => typeof t === "string")) problems.push("askBefore must be a list of change areas and path patterns");
+    else config.askBefore = [...new Set(o.askBefore.map((t) => t.trim()).filter((t) => t && t.length <= 200))].slice(0, 50);
+  }
+  if (o.askTimeoutMinutes !== void 0) {
+    const n = o.askTimeoutMinutes;
+    if (typeof n !== "number" || !Number.isFinite(n) || n < 1 || n > 15) problems.push("askTimeoutMinutes must be a number from 1 to 15");
+    else config.askTimeoutMinutes = Math.round(n);
+  }
+  if (o.askOrg !== void 0) {
+    const s = typeof o.askOrg === "string" ? o.askOrg.trim().toLowerCase() : "";
+    if (!SLUG.test(s)) problems.push("askOrg must be an org slug");
+    else config.askOrg = s;
+  }
   if (o.allowCloneYesWith !== void 0) {
     const l = o.allowCloneYesWith;
     if (!Array.isArray(l) || !l.every((x) => GATED_CAPABILITIES.includes(x))) problems.push('allowCloneYesWith must list only "shell", "install", "network" and/or "settings"');
@@ -224,6 +238,7 @@ function loadManaged(deps = {}) {
   }
   if (state.config.allowedCloneSources === "org-playbook" && !state.config.org) state.errors.push('allowedCloneSources "org-playbook" needs org');
   if (state.config.autopilotOrg && state.config.org && state.config.autopilotOrg !== state.config.org) state.errors.push("autopilotOrg must be the same org as org");
+  if (state.config.askOrg && state.config.org && state.config.askOrg !== state.config.org) state.errors.push("askOrg must be the same org as org");
   return state;
 }
 var cached;