geneseed 3.11.0 → 3.12.0

package/js/build/driver.mjs

@@ -65,6 +65,9 @@ import {
 // registry to find every install it must re-emit, and a CLI verb may not reach into a driver
 // for a reader. See js/inspect/registry.mjs.
 import { registryRecord, registryRoots } from '../inspect/registry.mjs';
+// The loop engine's trust presets — the `--trust` choices. `score.mjs` imports nothing, which is
+// what lets it sit inside this driver's total `child_process` ban.
+import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
 
 // P2. `--sync-themes` crossed into its own module rather than into this file: it is 90 lines
 // of textual surgery over committed files with a corpus of its own, and it is the half of the
@@ -111,8 +114,8 @@ export function resolveOut(raw) {
  */
 function configDefaults() {
   const d = {
-    theme: 'neutral', posture: 'peer', mode: 'direct', doctrines: [...PACK_ORDER],
-    excludeRules: [],
+    theme: 'neutral', posture: 'peer', mode: 'direct', trust: DEFAULT_PRESET,
+    doctrines: [...PACK_ORDER], excludeRules: [],
   };
   if (!existsSync(CONFIG)) return d;
   try {
@@ -163,7 +166,7 @@ function configDefaults() {
  * flag is added to one and not the other, and nothing downstream would say so.
  */
 const VALUED = {
-  '--theme': 'theme', '--posture': 'posture', '--mode': 'mode',
+  '--theme': 'theme', '--posture': 'posture', '--mode': 'mode', '--trust': 'trust',
   '--doctrines': 'doctrines', '--exclude-rules': 'excludeRules',
   '--out': 'out', '--target': 'out', '--emit': 'emit',
   '--footprint': 'footprint', '--root': 'root', '--config-dir': 'cfgDir',
@@ -194,13 +197,13 @@ const FLAG_BY_NAME = Object.fromEntries(
 );
 
 /**
- * The four flags `choice` validates, as ONE table for the same anti-drift reason.
+ * The five flags `choice` validates, as ONE table for the same anti-drift reason.
  *
- * A function and not a constant because two of the four read the checkout: `discoverNames`
+ * A function and not a constant because two of the five read the checkout: `discoverNames`
  * scans `postures/` and `modes/`, so the answer depends on the source tree this driver is
  * standing in and cannot be frozen at import.
  *
- * `--doctrines` is DELIBERATELY not a fifth row. Every consumer of this table treats an
+ * `--doctrines` is DELIBERATELY not a sixth row. Every consumer of this table treats an
  * entry as one value drawn from a closed list — `choice` refuses anything else, and
  * `usage`'s metavar prints the list as the whole legal surface. `--doctrines` takes a comma
  * LIST plus the sentinel `none`, so a row here would have refused `craft,rigor` outright and
@@ -213,6 +216,7 @@ function choicesFor() {
     '--footprint': ['lean', 'full'],
     '--posture': discoverNames('postures', 'peer'),
     '--mode': discoverNames('modes', 'direct'),
+    '--trust': Object.keys(PRESETS),
   };
 }
 
@@ -340,6 +344,7 @@ function usage() {
 function parseArgs(argv, defaults) {
   const args = {
     theme: defaults.theme, posture: defaults.posture, mode: defaults.mode,
+    trust: defaults.trust,
     doctrines: defaults.doctrines,
     excludeRules: defaults.excludeRules,
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
@@ -1035,7 +1040,7 @@ export function buildInto({ theme, out, footprint = 'lean' }) {
 }
 
 export function emitGlobalInto(host, {
-  theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null,
+  theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null, trust = null,
 }) {
   // `build.HOSTS.get(host, build.HOSTS["opencode"])` — an unknown host falls back rather than
   // raising, because the host comes from a marker file a user can edit.
@@ -1058,7 +1063,8 @@ export function emitGlobalInto(host, {
       // at `[]`, so the key is OMITTED instead of passed through — `makeCfg`'s own default is
       // the fail-closed answer and an explicit `doctrines: null` would not reach it.
       makeCfg({
-        posture: posture || 'peer', mode: mode || 'direct', ...(doctrines ? { doctrines } : {}),
+        posture: posture || 'peer', mode: mode || 'direct', trust: trust || DEFAULT_PRESET,
+        ...(doctrines ? { doctrines } : {}),
       }),
       { theme, footprint, root: null, cfgDir }, out,
     ),

package/js/build/generate.mjs

@@ -34,11 +34,12 @@ import path from 'node:path';
 
 import { main as driverMain } from './driver.mjs';
 import { makeCfg, PACK_ORDER } from './source.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
   excludedRulesOfDir, footprintOfDir, installState, installTargets, modeOfDir, postureOfDir,
-  readMaybe, themeOfDir,
+  readMaybe, themeOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from '../hosts/opencode.mjs';
 import { renderAll } from './render.mjs';
@@ -93,7 +94,7 @@ function sysExit(msg) {
  */
 const BUILD_FORWARD = [
   ['theme', '--theme'], ['emit', '--emit'], ['footprint', '--footprint'],
-  ['posture', '--posture'], ['mode', '--mode'], ['doctrines', '--doctrines'],
+  ['posture', '--posture'], ['mode', '--mode'], ['trust', '--trust'], ['doctrines', '--doctrines'],
   ['excludeRules', '--exclude-rules'], ['out', '--out'], ['root', '--root'],
   ['configDir', '--config-dir'],
 ];
@@ -114,7 +115,7 @@ export function cmdBuild(args) {
  * The elision rules are not symmetric and the Python says why: `footprint` is ALWAYS passed,
  * because omitting it when it matched the generator's default silently coupled the answer to
  * whatever that default happened to be — the moment the default moved, picking the old one
- * produced the new one. `posture` and `mode` still elide at theirs, and neither has moved.
+ * produced the new one. `posture`, `mode` and `trust` still elide at theirs, and none has moved.
  *
  * ⚠ `doctrines` DOES NOT ELIDE, AND THAT IS THE SAFETY DECISION, NOT A STYLE ONE. It used to
  * elide on the full set, by analogy with posture and mode — but those two compare against a
@@ -137,7 +138,7 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null) {
+  excludeRules = null, trust = DEFAULT_PRESET) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -146,6 +147,7 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   if (footprint) argv.push('--footprint', footprint);
   if (posture && posture !== 'peer') argv.push('--posture', posture);
   if (mode && mode !== 'direct') argv.push('--mode', mode);
+  if (trust && trust !== DEFAULT_PRESET) argv.push('--trust', trust);
   if (Array.isArray(doctrines)) {
     // Emitted in `allPacks` order, not the order handed in: a caller may legitimately pass an
     // unsorted list, and the flag has to be canonical for the same reason the driver
@@ -199,6 +201,8 @@ export function installProfile(host, scope, root) {
   const footprint = footprintOfDir(root);
   const posture = postureOfDir(root) || defaultPosture();
   const mode = modeOfDir(root) || defaultMode();
+  // Read off the deployed loop skill; no config fallback — `DEFAULT_PRESET` is the engine's.
+  const trust = trustOfDir(root) || DEFAULT_PRESET;
   // A rebuild that defaulted the pack selection would re-emit an install into a constitution
   // its owner did not choose — and in one direction that is not merely surprising: dropping
   // the process pack takes the commit/push consent RULES out of AGENT.md while
@@ -213,7 +217,7 @@ export function installProfile(host, scope, root) {
   const excludeRules = excludedRulesOfDir(root);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules);
+    PACK_ORDER, excludeRules, trust);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
@@ -221,7 +225,7 @@ export function installProfile(host, scope, root) {
   if (scope === 'global') argv.push('--config-dir', root);
   return {
     host, scope, root, state: installState(root, host, scope),
-    emit, theme, footprint, posture, mode, doctrines, excludeRules, argv,
+    emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, argv,
   };
 }
 

package/js/build/render.mjs

@@ -35,6 +35,7 @@ import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
 import { PACK_ORDER, readPackText, resolveRuleIds } from './source.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
 export const STRUCTURE = {
@@ -391,6 +392,10 @@ export function effectiveTheme(cfg, themeName, { footprint = 'full', lawsPrefix
   const theme = { ...loadTheme(cfg, themeName), ...(cfg.structure ?? STRUCTURE) };
   theme.POSTURE_BODY = registerBody(cfg, theme, 'postures', cfg.posture ?? 'peer', 'peer');
   theme.MODE_BODY = registerBody(cfg, theme, 'modes', cfg.mode ?? 'direct', 'direct');
+  // The loop skill's default trust preset (`--trust`), raw for `--preset` and capitalised for
+  // the `Default trust preset: **<Label>**` line `trustOfDir` reads back off an install.
+  theme.TRUST = cfg.trust ?? DEFAULT_PRESET;
+  theme.TRUST_LABEL = theme.TRUST[0].toUpperCase() + theme.TRUST.slice(1);
   // The doctrines pair is threaded, not read off `cfg`: `footprint` is a per-RENDER value
   // (`renderAll`'s option, and the same cfg renders both ways in one process), so parking it
   // on cfg would make the terse/full choice sticky across calls. An options object rather

package/js/build/source.mjs

@@ -26,6 +26,7 @@
  */
 import { readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /**
  * One doctrine pack file used to be read three times per render — the survives gate and the
@@ -256,7 +257,8 @@ export function knownRuleIds() {
  * `PACK_ORDER` for the whole process.
  */
 export function makeCfg({
-  posture = 'peer', mode = 'direct', doctrines = PACK_ORDER, excludeRules = [],
+  posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
+  excludeRules = [],
 } = {}) {
   return {
     root: ROOT,
@@ -268,6 +270,8 @@ export function makeCfg({
     workflowSrc: WORKFLOW_SRC,
     posture,
     mode,
+    // The loop skill's default preset (`--trust`); the skill is its only reader.
+    trust,
     doctrines: Array.isArray(doctrines) ? [...doctrines] : [...PACK_ORDER],
     // ⚠ THE SECOND DOCTRINE AXIS, AND ITS DEFAULT IS THE OPPOSITE WAY ROUND. `doctrines`
     // defaults to EVERYTHING because an unknown selection must bind the most; `excludeRules`

package/js/cli-table.json

@@ -133,6 +133,21 @@
           "type": null,
           "hidden": false
         },
+        {
+          "names": [
+            "--trust"
+          ],
+          "dest": "trust",
+          "metavar": null,
+          "help": "default loop trust preset: how much a loop may do before it stops to ask (default balanced)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
         {
           "names": [
             "--doctrines"
@@ -623,6 +638,226 @@
       "options": [],
       "mutex": []
     },
+    {
+      "name": "loop",
+      "help": "run a loop: check graphs, start one in LOOP.md, and step its state machine (next/score/record/decide)",
+      "description": "",
+      "positionals": [
+        {
+          "names": [],
+          "dest": "action",
+          "metavar": null,
+          "help": "",
+          "choices": [
+            "check",
+            "init",
+            "next",
+            "score",
+            "record",
+            "decide"
+          ],
+          "default": null,
+          "required": true,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        }
+      ],
+      "options": [
+        {
+          "names": ["--graph"],
+          "dest": "graph",
+          "metavar": null,
+          "help": "a loop template name or a .json graph file",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--brick"],
+          "dest": "brick",
+          "metavar": null,
+          "help": "check one brick file instead of the whole catalogue",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--title"],
+          "dest": "title",
+          "metavar": null,
+          "help": "the loop's title, written into LOOP.md",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--requirement"],
+          "dest": "requirement",
+          "metavar": null,
+          "help": "the requirement the loop exists to satisfy",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--preset"],
+          "dest": "preset",
+          "metavar": null,
+          "help": "the risk preset to run under (default: balanced)",
+          "choices": [
+            "prudent",
+            "balanced",
+            "aggressive"
+          ],
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--declared"],
+          "dest": "declared",
+          "metavar": null,
+          "help": "score the card just declared, before it runs",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--diff"],
+          "dest": "diff",
+          "metavar": null,
+          "help": "score the actual diff, read as numstat on stdin",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--actions"],
+          "dest": "actions",
+          "metavar": null,
+          "help": "comma-separated declared action kinds (new-file, logic, api, ...)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--write-set"],
+          "dest": "write_set",
+          "metavar": null,
+          "help": "comma-separated files the declared card expects to touch",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--intent"],
+          "dest": "intent",
+          "metavar": null,
+          "help": "a short label for what the declared card is doing",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--outcome"],
+          "dest": "outcome",
+          "metavar": null,
+          "help": "the brick's reported outcome, one of its declared outcomes",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--card"],
+          "dest": "card",
+          "metavar": null,
+          "help": "a JSON card to record alongside the outcome",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--verdict"],
+          "dest": "verdict",
+          "metavar": null,
+          "help": "the user's answer to an awaiting validation",
+          "choices": [
+            "ok",
+            "no",
+            "amend"
+          ],
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": ["--note"],
+          "dest": "note",
+          "metavar": null,
+          "help": "a note attached to the verdict, written into LOOP.md",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        }
+      ],
+      "mutex": []
+    },
     {
       "name": "mcp",
       "help": "list the MCP servers wired into each active install, and the presets available to add",

package/js/hosts/gitref.mjs

@@ -0,0 +1,99 @@
+/**
+ * js/hosts/gitref.mjs — "what branch, and is a loop running here", read straight off the
+ * filesystem. Never spawns git.
+ *
+ * ONE OWNER, fs/path ONLY, NOTHING ELSE. Before this module, `currentBranch` and the
+ * launched-loop evidence reader were duplicated in `js/hosts/hooks.mjs` (the hook's
+ * `loopExempt`) and `js/loop/cli.mjs` (the CLI's commit-message writer) — two copies of the
+ * same worktree-following walk that could silently drift apart. Both now import this one.
+ * `js/hosts/hooks.mjs` is NOT a safe shared home for it: it pulls in `node:child_process`
+ * (`spawnSync`, for the destructive-act guard's own concerns) and the hook-dispatch
+ * machinery (`jsonDumpsCompact`, the ledger), none of which `js/loop/cli.mjs` — under a hard
+ * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
+ * import. A module that is fs/path only is importable from anywhere.
+ *
+ * The OpenCode guard plugin (`adapters/opencode/plugins/geneseed-guard.js`) keeps its own
+ * standalone copy — it cannot import from `js/` at all — kept in step by hand, commented as
+ * this module's twin.
+ */
+import { existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from 'node:fs';
+import path from 'node:path';
+
+/**
+ * The directory holding `.git` for `cwd` — walking up from `cwd`. A worktree's `.git` is a
+ * FILE naming its gitdir elsewhere; LOOP.md always lives beside that FILE, not beside the
+ * gitdir it points to, so this is the directory the launched-loop evidence reader looks in.
+ * null on anything unexpected.
+ */
+export function gitRootOf(cwd) {
+  try {
+    let dir = path.resolve(cwd);
+    for (;;) {
+      if (existsSync(path.join(dir, '.git'))) return dir;
+      const up = path.dirname(dir);
+      if (up === dir) return null;
+      dir = up;
+    }
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The `.git` DIRECTORY for `root` — itself, or the gitdir a worktree's `.git` FILE names.
+ * Throws if `.git` is a file that does not name one: a malformed worktree link is a louder
+ * failure than a silent "no gitdir", and every caller here wants to know before it acts on it.
+ */
+export function gitDirOf(root) {
+  const dotgit = path.join(root, '.git');
+  if (statSync(dotgit).isFile()) {
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(dotgit, 'utf8'));
+    if (!m) throw new Error(`${dotgit} does not name a gitdir`);
+    return path.resolve(root, m[1]);
+  }
+  return dotgit;
+}
+
+/**
+ * The branch checked out in `cwd`, read from .git/HEAD without spawning git. null on
+ * anything unexpected (detached HEAD, no repo, a malformed worktree link, unreadable) — the
+ * caller then falls back to asking, never to allowing.
+ */
+export function currentBranch(cwd) {
+  try {
+    const root = gitRootOf(cwd);
+    if (!root) return null;
+    const ref = /^ref:\s*refs\/heads\/(.+?)\s*$/m.exec(readFileSync(path.join(gitDirOf(root), 'HEAD'), 'utf8'));
+    return ref ? ref[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+const LOOP_STATE_MARKER = '<!-- loop-state:begin -->';
+
+/**
+ * Whether `<root>/LOOP.md` carries the engine's state marker — `geneseed loop init`'s mark
+ * that a loop was actually LAUNCHED here, not merely that the branch is named `loop/...`,
+ * which anyone can type. `lstatSync` (never `statSync`, which follows a link) must find an
+ * ordinary file: a FIFO would block the read, and a symlink could point anywhere outside the
+ * repo — either makes "LOOP.md says so" a claim this reader cannot stand behind. Read at
+ * most the first 64 KB: the marker is not on the first line (it follows the title and the
+ * requirement), so it must appear within those 64 KB — a huge LOOP.md (notes, history) must
+ * never make this check slow.
+ */
+export function loopLaunched(root) {
+  let fd;
+  try {
+    const p = path.join(root, 'LOOP.md');
+    if (!lstatSync(p).isFile()) return false;
+    fd = openSync(p, 'r');
+    const buf = Buffer.alloc(65536);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    return buf.toString('utf8', 0, n).includes(LOOP_STATE_MARKER);
+  } catch {
+    return false;
+  } finally {
+    if (fd !== undefined) { try { closeSync(fd); } catch { /* already gone */ } }
+  }
+}

package/js/hosts/hooks.mjs

@@ -56,6 +56,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   GATE_LEDGER, resolveMemoryDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
+import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
 
 const ROOT = path.resolve(import.meta.dirname, '../..');
 
@@ -599,6 +600,88 @@ const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 const DESTRUCTIVE_GIT_RE =
   /\bgit\b[^\n]*\b(?:reset\s+--hard|clean\s+-[a-zA-Z]*f|branch\s+-D|checkout\s+--\s|push\s+[^\n]*--force)/;
 
+// `loopExempt` — a WHITELIST, not the blacklist this replaced. A false ask costs one prompt; a
+// false allow publishes. So the exemption holds only when the ENTIRE command is built from
+// forms read in full below, on a branch a loop was actually launched on (LOOP.md's state
+// marker, left by `geneseed loop init` — not just a name starting with `loop/`, which anyone
+// can type). `currentBranch`/`gitRootOf`/`loopLaunched` live in `./gitref.mjs` — the one
+// fs-only reader this file shares with `js/loop/cli.mjs`'s commit-message writer.
+
+// No newline, backtick, or `$(` substitution anywhere — these can smuggle a second command (or
+// a shared-branch target) past every check below, so the command is refused before it is even
+// split. `<`/`>` are refused too: a redirect can both hide a second effect and, as the review
+// found, trail off the end of an otherwise-whitelisted push (`HEAD:main>/dev/null`). A single
+// `&` — not doubled into `&&` — is refused too: a shell runs `a & b` as TWO commands just like
+// `a && b`, and the review found it unparsed by the splitter below, which only recognised the
+// doubled form. `(?<!&)&(?!&)` matches a lone `&` without also matching either half of `&&`.
+const UNSAFE_CHARS_RE = /[\n`<>]|\$\(|(?<!&)&(?!&)/;
+
+// The only three git shapes a loop's own automation ever needs: adding unquoted paths,
+// committing via `-F`/`--file` (so the message text, which may contain anything, never has to
+// be quoted on this command line at all — see `js/loop/cli.mjs`'s LOOP_COMMIT_MSG), and
+// read-only inspection. The token class `[\w./:@^~=+,-]` excludes quotes, braces, `!`, `*`,
+// `$` and `&` — a brace or glob expansion (`{a,b}`, `*`) is exactly how a shell can turn one
+// whitelisted-looking token into several unknown ones, so no pattern's path/arg tokens may
+// contain them. The SAME class is the `-F`/`--file` path, not the looser `[^\s'"]+` this once
+// was: with that loose class, `git commit -F {m,--amend}` brace-expands to `git commit -F m
+// --amend` and `git commit -F m*` glob-expands to whatever matches — either turns a commit of
+// the loop's own message file into an amend of the last one. `ARG_RE` already accepts a drive
+// letter (`C:/…`) via its `:`, so tightening it here costs nothing the loop's own writer uses.
+const ARG_RE = '[\\w./:@^~=+,-]+';
+const SEG_ADD_RE = new RegExp(`^git\\s+add(\\s+${ARG_RE})*$`);
+const SEG_COMMIT_RE = new RegExp(`^git\\s+commit(\\s+-q)?\\s+(-F\\s+|--file[=\\s])${ARG_RE}(\\s+-q)?$`);
+const SEG_READONLY_RE = new RegExp(`^git\\s+(status|diff|log|rev-parse|show)(\\s+${ARG_RE})*$`);
+
+/**
+ * `git push`, exactly: `[-u|--set-upstream] <remote> HEAD:<branch>` or
+ * `HEAD:refs/heads/<branch>` — the ONLY exempt form. Bare `git push`, a remote alone, a plain
+ * branch name, or bare `HEAD` are no longer enough: every one of those is redirectable by
+ * `push.default`/`remote.*.push`/an upstream config this read cannot see, which is exactly how
+ * the review's re-review turned "looks like it only pushes `loop/x`" into "pushes wherever the
+ * repo's config says". An EXPLICIT `HEAD:<ref>` refspec is immune to both — git ignores
+ * `push.default` once a refspec is given, and a mirror/`+`/`:`-prefixed form refuses to
+ * coexist with one. The remote's first character must be alphanumeric so a flag (`-f`,
+ * `--all`, `--delete`, …) can never be read as a remote name.
+ */
+function pushSegmentOk(seg, branch) {
+  const m = /^git\s+push(?:\s+(.*))?$/.exec(seg);
+  if (!m) return false;
+  const rest = (m[1] || '').trim();
+  if (!rest) return false;
+  const tokens = rest.split(/\s+/);
+  let i = 0;
+  if (tokens[i] === '-u' || tokens[i] === '--set-upstream') i += 1;
+  const remote = tokens[i];
+  if (remote === undefined || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(remote)) return false;
+  i += 1;
+  const ref = tokens[i];
+  i += 1;
+  if (ref === undefined || i !== tokens.length) return false;
+  return ref === `HEAD:${branch}` || ref === `HEAD:refs/heads/${branch}`;
+}
+
+/**
+ * Consent Before Push's loop/* exemption: true only when EVERY clause holds —
+ * (1) the command carries none of the characters that could smuggle a second effect past this
+ * read, (2)-(3) every `&&`/`;`/`||`/`|`-separated segment is one of the three whitelisted git
+ * shapes above, with every push segment also passing `pushSegmentOk`, and (4) the branch
+ * checked out in `cwd` starts with `loop/` AND its git root carries a launched LOOP.md. Splitting
+ * on the separators without respecting quotes is deliberate, not an oversight: (1) and the
+ * per-segment whitelist already refuse any segment a quoted separator could produce, because a
+ * quote character fails every one of the three segment patterns.
+ */
+export function loopExempt(command, cwd) {
+  if (typeof command !== 'string' || UNSAFE_CHARS_RE.test(command)) return false;
+  const branch = currentBranch(cwd);
+  if (!branch || !branch.startsWith('loop/')) return false;
+  const root = gitRootOf(cwd);
+  if (!root || !loopLaunched(root)) return false;
+  const segments = command.split(/&&|\|\||[;|]/).map((s) => s.trim()).filter(Boolean);
+  if (!segments.length) return false;
+  return segments.every((seg) => SEG_ADD_RE.test(seg) || SEG_COMMIT_RE.test(seg)
+    || SEG_READONLY_RE.test(seg) || pushSegmentOk(seg, branch));
+}
+
 /** The `permissionDecision: "ask"` document, in Python's compact `json.dumps` spelling. */
 function askDecision(reason) {
   return `${jsonDumpsCompact({
@@ -739,8 +822,12 @@ function gitDecide(args, payload) {
       + 'discarding git act needs confirmation bound to this specific command');
   }
   // `--no-consent`: the process pack (or process 5 alone) is off, so the commit/push ask has
-  // no rule behind it — but Law IV above is universal and has already run.
+  // no rule behind it — but Law IV above is universal and has already run. Checked before
+  // `loopExempt` so a non-git command, or one with consent off, never pays for the whitelist.
   if (args.noConsent || !GIT_GATE_RE.test(command)) return 0;
+  // Consent Before Push: a loop launched on its own `loop/*` branch is a named batch for a
+  // fixed set of commit/push forms on that branch only — never a merge into anything shared.
+  if (loopExempt(command, (payload && payload.cwd) || process.cwd())) return 0;
   return ask(args, 'git-gate', 'process-5', 'Geneseed (Consent Before Push) \u2014 every git '
     + 'commit/push needs explicit approval; to see the change first, use the explain-changes skill');
 }