ghostrail 0.0.0 → 0.1.0

package/README.md

@@ -20,7 +20,7 @@ A software factory is thin glue over three primitive layers: where work comes fr
 
 ```bash
 npm i -g ghostrail
-ghostrail init fix-bugs-local     # or: content-loop
+ghostrail init code-local     # or: content-loop
 export LINEAR_API_KEY=...          # a Linear personal API key; gh must be authed
 ghostrail run                      # one tick: claim, isolate, run, gate, open PRs
 ghostrail respond                  # fold new human PR comments back into branches
@@ -34,7 +34,7 @@ rules apply across every factory instance.
 ## Self-host and cutover
 
 Ghostrail builds itself: [`ghostrail.toml`](./ghostrail.toml) +
-[`prompts/fix-bug.md`](./prompts/fix-bug.md) point the factory at its own repo.
+[`prompts/resolve-issue.md`](./prompts/resolve-issue.md) point the factory at its own repo.
 To replace the bespoke bash factories in `echotime`, `tjwrite`, and `research`,
 see [`docs/cutover.md`](./docs/cutover.md) and the configs in
 [`examples/`](./examples/).
@@ -51,6 +51,33 @@ pnpm lint        # lint + format check (Biome)
 pnpm build       # compile to dist/
 ```
 
+## Releasing
+
+Releases publish from CI on a tag, so `main` and npm cannot drift.
+
+1. Bump `version` in `package.json` and add the release to [`CHANGELOG.md`](CHANGELOG.md).
+2. Merge that to `main`.
+3. Tag and push: `git tag v0.1.0 && git push origin v0.1.0`.
+
+[`.github/workflows/release.yml`](.github/workflows/release.yml) then verifies the
+tag matches `package.json`, runs lint/typecheck/tests/build, checks the package
+contents (the `bin` shebang, both templates and their prompts, the Dockerfile, and
+that every advertised command appears in `help`), and publishes with provenance.
+
+Auth is npm **Trusted Publishing** (OIDC): the workflow exchanges its GitHub
+Actions OIDC token for a short-lived registry token at publish time, so there is
+no long-lived `NPM_TOKEN` secret to leak or rotate.
+
+One-time setup on npmjs.com: open the `ghostrail` package → **Settings** →
+**Trusted Publisher** → GitHub Actions, and point it at this repository with
+workflow filename `release.yml`. Allowed action: `npm publish`.
+
+Provenance (the Sigstore attestation binding a tarball to its source commit and
+build) requires a **public** repository, so the workflow gates that flag on
+visibility: releases cut while the repo is private publish unattested, and the
+first release after it goes public attests automatically. Provenance is
+per-version, so earlier versions stay unattested — it cannot be backfilled.
+
 ## License
 
 [Apache-2.0](./LICENSE).

package/dist/agent/claude-code.d.ts

@@ -16,6 +16,8 @@ export interface ClaudeArgsOptions {
     maxBudgetUsd?: number;
     /** `--model`, when set. */
     model?: string;
+    /** Explicit settings file for the run, passed as `--settings`. */
+    settingsPath?: string;
 }
 /**
  * Build the `claude` CLI arguments (everything after the binary) for a headless
@@ -32,6 +34,14 @@ export declare function buildClaudeArgs(options: ClaudeArgsOptions): string[];
  * and parses. Budget and timeout come from the guardrails.
  */
 export declare class ClaudeCodeAgent implements Agent {
+    private readonly profileDir?;
+    /**
+     * @param profileDir Optional ghostrail Claude profile. When set, the run uses
+     * it as Claude's config home (via `HOME`/`CLAUDE_CONFIG_DIR`) and its
+     * settings.json, so factory runs get the pinned skills/CLAUDE.md and never the
+     * user's interactive config.
+     */
+    constructor(profileDir?: string | undefined);
     run(context: AgentContext): Promise<AgentOutcome>;
 }
 //# sourceMappingURL=claude-code.d.ts.map

package/dist/agent/claude-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/agent/claude-code.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAI1E,+EAA+E;AAC/E,eAAO,MAAM,WAAW,2BAA2B,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IAC/C,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAqBpE;AAYD;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,KAAK;IACrC,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CA+BxD"}
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/agent/claude-code.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAI1E,+EAA+E;AAC/E,eAAO,MAAM,WAAW,2BAA2B,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IAC/C,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwBpE;AAYD;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,KAAK;IAO/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IANxC;;;;;OAKG;gBAC0B,UAAU,CAAC,EAAE,MAAM,YAAA;IAE1C,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAqCxD"}

package/dist/agent/claude-code.js

@@ -1,3 +1,4 @@
+import { join } from "node:path";
 import { renderPrompt } from "./prompt.js";
 import { parseAgentResult } from "./result.js";
 /** Path, relative to the workspace root, where the agent writes its result. */
@@ -19,6 +20,9 @@ export function buildClaudeArgs(options) {
         "--add-dir",
         options.addDir,
     ];
+    if (options.settingsPath !== undefined) {
+        args.push("--settings", options.settingsPath);
+    }
     if (options.allowedTools.length > 0) {
         args.push("--allowedTools", options.allowedTools.join(","));
     }
@@ -43,6 +47,16 @@ async function readFile(backend, workspace, path) {
  * and parses. Budget and timeout come from the guardrails.
  */
 export class ClaudeCodeAgent {
+    profileDir;
+    /**
+     * @param profileDir Optional ghostrail Claude profile. When set, the run uses
+     * it as Claude's config home (via `HOME`/`CLAUDE_CONFIG_DIR`) and its
+     * settings.json, so factory runs get the pinned skills/CLAUDE.md and never the
+     * user's interactive config.
+     */
+    constructor(profileDir) {
+        this.profileDir = profileDir;
+    }
     async run(context) {
         const { backend, workspace, item, agent, guardrails } = context;
         const template = await readFile(backend, workspace, agent.prompt);
@@ -54,9 +68,15 @@ export class ClaudeCodeAgent {
             allowedTools: agent.allowedTools,
             addDir: ".",
             maxBudgetUsd: guardrails.budgetUsdPerItem,
+            ...(this.profileDir === undefined
+                ? {}
+                : { settingsPath: join(this.profileDir, ".claude", "settings.json") }),
         });
         const run = await backend.exec(workspace, ["claude", ...args], {
             timeoutMs: guardrails.timeoutMs,
+            ...(this.profileDir === undefined
+                ? {}
+                : { env: { HOME: this.profileDir, CLAUDE_CONFIG_DIR: join(this.profileDir, ".claude") } }),
         });
         if (run.timedOut) {
             return { status: "failed", error: "agent timed out" };

package/dist/agent/claude-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/agent/claude-code.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAmBpD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,OAAO,CAAC,MAAM;QACd,iBAAiB;QACjB,OAAO,CAAC,YAAY,IAAI,MAAM;QAC9B,mBAAmB;QACnB,OAAO,CAAC,cAAc,IAAI,aAAa;QACvC,WAAW;QACX,OAAO,CAAC,MAAM;KACf,CAAC;IACF,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,SAAoB,EACpB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,GAAG,CAAC,OAAqB;QAC7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,UAAU,CAAC,gBAAgB;SAC1C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YAC7D,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF"}
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/agent/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAqBpD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,OAAO,CAAC,MAAM;QACd,iBAAiB;QACjB,OAAO,CAAC,YAAY,IAAI,MAAM;QAC9B,mBAAmB;QACnB,OAAO,CAAC,cAAc,IAAI,aAAa;QACvC,WAAW;QACX,OAAO,CAAC,MAAM;KACf,CAAC;IACF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CACrB,OAAgB,EAChB,SAAoB,EACpB,IAAY;IAEZ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAOG;IAN7B;;;;;OAKG;IACH,YAA6B,UAAmB;QAAnB,eAAU,GAAV,UAAU,CAAS;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAC,OAAqB;QAC7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+BAA+B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,UAAU,CAAC,gBAAgB;YACzC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YAC7D,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;SAC7F,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;CACF"}

package/dist/agent/result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/agent/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAuC1D"}
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/agent/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAmD1D"}

package/dist/agent/result.js

@@ -25,8 +25,19 @@ export function parseAgentResult(raw) {
     const record = value;
     const status = record.status;
     switch (status) {
-        case "done":
-            return { status: "done", summary: asString(record.summary) };
+        case "done": {
+            // An optional conventional-commit type (feat/fix/docs/refactor/chore/...),
+            // lowercased word chars only; ignored if malformed.
+            const rawType = record.type;
+            const type = typeof rawType === "string" && /^[a-z]+$/.test(rawType.trim().toLowerCase())
+                ? rawType.trim().toLowerCase()
+                : undefined;
+            return {
+                status: "done",
+                summary: asString(record.summary),
+                ...(type === undefined ? {} : { type }),
+            };
+        }
         case "noop":
             return { status: "noop" };
         case "blocked": {

package/dist/agent/result.js.map

@@ -1 +1 @@
-{"version":3,"file":"result.js","sourceRoot":"","sources":["../../src/agent/result.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/D,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACtF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;QACD;YACE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;aACvE,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../src/agent/result.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,2EAA2E;YAC3E,oDAAoD;YACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;YAC5B,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC9B,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;gBACjC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;aACxC,CAAC;QACJ,CAAC;QACD,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC5D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACtF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;YAC1F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACrC,CAAC;QACD;YACE,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;aACvE,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC"}

package/dist/backend/container.d.ts

@@ -6,8 +6,26 @@ import type { Backend, ExecOptions, ExecResult, LogLine, ProvisionSpec, Workspac
  * container, so the image only needs a shell (not git); commands run via
  * `docker exec`. Teardown force-removes the container.
  */
+export interface ContainerBackendOptions {
+    /**
+     * Environment variable names to forward from the host into every `docker exec`
+     * (via `-e`), so secrets like ANTHROPIC_API_KEY / GH_TOKEN reach the agent and
+     * gate inside the container. Only names, never values, are configured; values
+     * are read from `env` at exec time.
+     */
+    forwardEnv?: readonly string[];
+    /** Source of forwarded values; defaults to the process environment. */
+    env?: Record<string, string | undefined>;
+}
 export declare class ContainerBackend implements Backend {
     readonly kind = "container";
+    private readonly forwardEnv;
+    private readonly env;
+    constructor(options?: ContainerBackendOptions);
+    /** The forwarded keys that are actually set, as a KEY=VALUE env map. */
+    private forwardedEnv;
+    /** Merge forwarded host env under the call's own env. */
+    private withForwardedEnv;
     /** True if the Docker CLI and daemon are reachable. */
     static isAvailable(): Promise<boolean>;
     provision(spec: ProvisionSpec): Promise<Workspace>;

package/dist/backend/container.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/backend/container.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,UAAU,EACV,OAAO,EACP,aAAa,EACb,SAAS,EACV,MAAM,YAAY,CAAC;AAQpB;;;;;;GAMG;AACH,qBAAa,gBAAiB,YAAW,OAAO;IAC9C,QAAQ,CAAC,IAAI,eAAQ;IAErB,uDAAuD;WAC1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAKtC,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAiCxD,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAItB,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAQhB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/backend/container.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,UAAU,EACV,OAAO,EACP,aAAa,EACb,SAAS,EACV,MAAM,YAAY,CAAC;AAQpB;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,qBAAa,gBAAiB,YAAW,OAAO;IAC9C,QAAQ,CAAC,IAAI,eAAQ;IACrB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqC;gBAE7C,OAAO,GAAE,uBAA4B;IAKjD,wEAAwE;IACxE,OAAO,CAAC,YAAY;IASpB,yDAAyD;IACzD,OAAO,CAAC,gBAAgB;IAMxB,uDAAuD;WAC1C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAKtC,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAuCxD,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAKtB,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAShB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAGpD"}

package/dist/backend/container.js

@@ -2,21 +2,39 @@ import { randomUUID } from "node:crypto";
 import { mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import process from "node:process";
 import { DEFAULT_CONTAINER_IMAGE, dockerCpArgs, dockerExecArgs, dockerRmArgs, dockerRunArgs, } from "./docker.js";
+import { CLONE_TOKEN_ENV, cloneCredentialArgs } from "./git-credentials.js";
 import { spawnCollect } from "./proc.js";
 const KIND = "container";
 async function docker(args, timeoutMs) {
     return spawnCollect(["docker", ...args], timeoutMs === undefined ? {} : { timeoutMs });
 }
-/**
- * The recommended default for a shared tool: a fresh, disposable container per
- * item, on its own branch, with a clean filesystem and nothing bleeding between
- * runs. The repo is cloned on the host onto the new branch and copied into the
- * container, so the image only needs a shell (not git); commands run via
- * `docker exec`. Teardown force-removes the container.
- */
 export class ContainerBackend {
     kind = KIND;
+    forwardEnv;
+    env;
+    constructor(options = {}) {
+        this.forwardEnv = options.forwardEnv ?? [];
+        this.env = options.env ?? process.env;
+    }
+    /** The forwarded keys that are actually set, as a KEY=VALUE env map. */
+    forwardedEnv() {
+        const out = {};
+        for (const key of this.forwardEnv) {
+            const value = this.env[key];
+            if (value !== undefined)
+                out[key] = value;
+        }
+        return out;
+    }
+    /** Merge forwarded host env under the call's own env. */
+    withForwardedEnv(options) {
+        const forwarded = this.forwardedEnv();
+        if (Object.keys(forwarded).length === 0)
+            return options;
+        return { ...options, env: { ...forwarded, ...options.env } };
+    }
     /** True if the Docker CLI and daemon are reachable. */
     static async isAvailable() {
         const result = await docker(["version", "--format", "{{.Server.Version}}"], 10_000);
@@ -29,7 +47,10 @@ export class ContainerBackend {
         const hostClone = join(tmpdir(), "ghostrail-cc", id);
         await mkdir(join(tmpdir(), "ghostrail-cc"), { recursive: true });
         try {
-            const clone = await spawnCollect(["git", "clone", "--quiet", spec.repoPath, hostClone]);
+            const token = this.env.GH_TOKEN ?? this.env.GITHUB_TOKEN;
+            const credArgs = cloneCredentialArgs(spec.repoPath, token !== undefined);
+            const cloneOpts = token === undefined ? {} : { env: { [CLONE_TOKEN_ENV]: token } };
+            const clone = await spawnCollect(["git", ...credArgs, "clone", "--quiet", spec.repoPath, hostClone], cloneOpts);
             if (clone.exitCode !== 0)
                 throw new Error(`git clone failed: ${clone.stderr.trim()}`);
             // "create" makes a new branch off the base; "attach" checks out an existing branch.
@@ -54,10 +75,12 @@ export class ContainerBackend {
         }
     }
     exec(workspace, command, options = {}) {
-        return docker(dockerExecArgs(workspace.ref, command, options), options.timeoutMs);
+        const opts = this.withForwardedEnv(options);
+        return docker(dockerExecArgs(workspace.ref, command, opts), opts.timeoutMs);
     }
     stream(workspace, command, onLog, options = {}) {
-        const args = dockerExecArgs(workspace.ref, command, options);
+        const opts = this.withForwardedEnv(options);
+        const args = dockerExecArgs(workspace.ref, command, opts);
         return spawnCollect(["docker", ...args], {
             onLog,
             ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),

package/dist/backend/container.js.map

@@ -1 +1 @@
-{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/backend/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAUzC,MAAM,IAAI,GAAG,WAAW,CAAC;AAEzB,KAAK,UAAU,MAAM,CAAC,IAAuB,EAAE,SAAkB;IAC/D,OAAO,YAAY,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,IAAI,CAAC;IAErB,uDAAuD;IACvD,MAAM,CAAC,KAAK,CAAC,WAAW;QACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACxF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtF,oFAAoF;YACpF,MAAM,YAAY,GAChB,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACpB,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE3F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEnF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CACF,SAAoB,EACpB,OAA0B,EAC1B,UAAuB,EAAE;QAEzB,OAAO,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,CACJ,SAAoB,EACpB,OAA0B,EAC1B,KAA8B,EAC9B,UAAuB,EAAE;QAEzB,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO,YAAY,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YACvC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAoB;QACjC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../src/backend/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAUzC,MAAM,IAAI,GAAG,WAAW,CAAC;AAEzB,KAAK,UAAU,MAAM,CAAC,IAAuB,EAAE,SAAkB;IAC/D,OAAO,YAAY,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACzF,CAAC;AAqBD,MAAM,OAAO,gBAAgB;IAClB,IAAI,GAAG,IAAI,CAAC;IACJ,UAAU,CAAoB;IAC9B,GAAG,CAAqC;IAEzD,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,CAAC;IAED,wEAAwE;IAChE,YAAY;QAClB,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yDAAyD;IACjD,gBAAgB,CAAC,OAAoB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QACxD,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/D,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,KAAK,CAAC,WAAW;QACtB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,aAAa,EAAE,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;YACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACnF,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAClE,SAAS,CACV,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACtF,oFAAoF;YACpF,MAAM,YAAY,GAChB,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACpB,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;YAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAE3F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACrD,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAEnF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CACF,SAAoB,EACpB,OAA0B,EAC1B,UAAuB,EAAE;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,CACJ,SAAoB,EACpB,OAA0B,EAC1B,KAA8B,EAC9B,UAAuB,EAAE;QAEzB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,YAAY,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YACvC,KAAK;YACL,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAoB;QACjC,MAAM,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;CACF"}

package/dist/backend/git-credentials.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Token-free git auth for cloning private GitHub repos. Instead of embedding a
+ * token in the clone URL (which would persist in the workspace's `origin`), we
+ * pass an inline git credential helper that reads the token from an environment
+ * variable at clone time. The persisted `origin` stays a clean URL, so the later
+ * push (in the container) authenticates through the image's baked `gh` helper.
+ */
+/** Env var the inline clone credential helper reads the token from. */
+export declare const CLONE_TOKEN_ENV = "GHOSTRAIL_GIT_TOKEN";
+/** True for an `https://github.com/...` URL, which needs a token to clone privately. */
+export declare function isGithubHttps(url: string): boolean;
+/**
+ * Extra `git` arguments (before the subcommand) that authenticate a GitHub https
+ * clone from {@link CLONE_TOKEN_ENV}. Empty when there is no token or the URL is
+ * not a GitHub https URL (local paths and other hosts clone unchanged).
+ */
+export declare function cloneCredentialArgs(url: string, hasToken: boolean): string[];
+//# sourceMappingURL=git-credentials.d.ts.map

package/dist/backend/git-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.d.ts","sourceRoot":"","sources":["../../src/backend/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uEAAuE;AACvE,eAAO,MAAM,eAAe,wBAAwB,CAAC;AASrD,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAG5E"}

package/dist/backend/git-credentials.js

@@ -0,0 +1,30 @@
+/**
+ * Token-free git auth for cloning private GitHub repos. Instead of embedding a
+ * token in the clone URL (which would persist in the workspace's `origin`), we
+ * pass an inline git credential helper that reads the token from an environment
+ * variable at clone time. The persisted `origin` stays a clean URL, so the later
+ * push (in the container) authenticates through the image's baked `gh` helper.
+ */
+/** Env var the inline clone credential helper reads the token from. */
+export const CLONE_TOKEN_ENV = "GHOSTRAIL_GIT_TOKEN";
+/**
+ * The inline helper git runs (via `sh`) to answer a GitHub https credential
+ * request: username `x-access-token`, password from {@link CLONE_TOKEN_ENV}. The
+ * token is never in the process arguments, only in the environment.
+ */
+const GITHUB_CREDENTIAL_HELPER = `!f() { test "$1" = get && printf 'username=x-access-token\\npassword=%s\\n' "$${CLONE_TOKEN_ENV}"; }; f`;
+/** True for an `https://github.com/...` URL, which needs a token to clone privately. */
+export function isGithubHttps(url) {
+    return /^https:\/\/github\.com\//i.test(url.trim());
+}
+/**
+ * Extra `git` arguments (before the subcommand) that authenticate a GitHub https
+ * clone from {@link CLONE_TOKEN_ENV}. Empty when there is no token or the URL is
+ * not a GitHub https URL (local paths and other hosts clone unchanged).
+ */
+export function cloneCredentialArgs(url, hasToken) {
+    if (!hasToken || !isGithubHttps(url))
+        return [];
+    return ["-c", `credential.https://github.com.helper=${GITHUB_CREDENTIAL_HELPER}`];
+}
+//# sourceMappingURL=git-credentials.js.map

package/dist/backend/git-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credentials.js","sourceRoot":"","sources":["../../src/backend/git-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,iFAAiF,eAAe,SAAS,CAAC;AAE3I,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,QAAiB;IAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChD,OAAO,CAAC,IAAI,EAAE,wCAAwC,wBAAwB,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/backend/local-worktree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-worktree.d.ts","sourceRoot":"","sources":["../../src/backend/local-worktree.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,UAAU,EACV,OAAO,EACP,aAAa,EACb,SAAS,EACV,MAAM,YAAY,CAAC;AAIpB;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,OAAO;IAClD,QAAQ,CAAC,IAAI,oBAAQ;IACrB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAEvD,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBxD,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAItB,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAIhB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD,OAAO,CAAC,WAAW;CAIpB"}
+{"version":3,"file":"local-worktree.d.ts","sourceRoot":"","sources":["../../src/backend/local-worktree.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,UAAU,EACV,OAAO,EACP,aAAa,EACb,SAAS,EACV,MAAM,YAAY,CAAC;AAIpB;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,OAAO;IAClD,QAAQ,CAAC,IAAI,oBAAQ;IACrB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAEvD,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IA+CxD,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAItB,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC;IAIhB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnD,OAAO,CAAC,WAAW;CAIpB"}

package/dist/backend/local-worktree.js

@@ -2,6 +2,8 @@ import { randomUUID } from "node:crypto";
 import { mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import process from "node:process";
+import { CLONE_TOKEN_ENV, cloneCredentialArgs } from "./git-credentials.js";
 import { spawnCollect } from "./proc.js";
 const KIND = "local-worktree";
 /**
@@ -17,6 +19,25 @@ export class LocalWorktreeBackend {
         const id = randomUUID();
         const dir = join(tmpdir(), "ghostrail-wt", id);
         await mkdir(join(tmpdir(), "ghostrail-wt"), { recursive: true });
+        if (spec.clone === true) {
+            // A fresh full clone (repoPath may be a remote URL); teardown just deletes it.
+            const token = process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
+            const credArgs = cloneCredentialArgs(spec.repoPath, token !== undefined);
+            const cloneOpts = token === undefined ? {} : { env: { [CLONE_TOKEN_ENV]: token } };
+            const clone = await spawnCollect(["git", ...credArgs, "clone", "--quiet", spec.repoPath, dir], cloneOpts);
+            if (clone.exitCode !== 0) {
+                throw new Error(`local-clone provision failed: ${clone.stderr.trim() || clone.stdout.trim()}`);
+            }
+            const checkoutArgs = spec.mode === "attach"
+                ? ["checkout", spec.branch]
+                : ["checkout", "-B", spec.branch, spec.baseBranch];
+            const checkout = await spawnCollect(["git", "-C", dir, ...checkoutArgs]);
+            if (checkout.exitCode !== 0) {
+                await rm(dir, { recursive: true, force: true });
+                throw new Error(`local-clone checkout failed: ${checkout.stderr.trim()}`);
+            }
+            return { id, backend: KIND, ref: dir, branch: spec.branch };
+        }
         // "create" makes a new branch off the base; "attach" checks out an existing branch.
         const addArgs = spec.mode === "attach"
             ? ["worktree", "add", dir, spec.branch]

package/dist/backend/local-worktree.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-worktree.js","sourceRoot":"","sources":["../../src/backend/local-worktree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAUzC,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC3D,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjE,oFAAoF;QACpF,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,QAAQ;YACpB,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,CACF,SAAoB,EACpB,OAA0B,EAC1B,UAAuB,EAAE;QAEzB,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,SAAoB,EACpB,OAA0B,EAC1B,KAA8B,EAC9B,UAAuB,EAAE;QAEzB,OAAO,YAAY,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAoB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAEO,WAAW,CAAC,SAAoB,EAAE,OAAoB;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;QACzF,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;CACF"}
+{"version":3,"file":"local-worktree.js","sourceRoot":"","sources":["../../src/backend/local-worktree.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAUzC,MAAM,IAAI,GAAG,gBAAgB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,OAAO,oBAAoB;IACtB,IAAI,GAAG,IAAI,CAAC;IACrB,4EAA4E;IAC3D,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE7D,KAAK,CAAC,SAAS,CAAC,IAAmB;QACjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,+EAA+E;YAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAC/D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YACnF,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,CAAC,KAAK,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAC5D,SAAS,CACV,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAChB,IAAI,CAAC,IAAI,KAAK,QAAQ;gBACpB,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;gBAC3B,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;YACzE,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9D,CAAC;QAED,oFAAoF;QACpF,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,KAAK,QAAQ;YACpB,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,oCAAoC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,CACF,SAAoB,EACpB,OAA0B,EAC1B,UAAuB,EAAE;QAEzB,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CACJ,SAAoB,EACpB,OAA0B,EAC1B,KAA8B,EAC9B,UAAuB,EAAE;QAEzB,OAAO,YAAY,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,SAAoB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5F,MAAM,YAAY,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAEO,WAAW,CAAC,SAAoB,EAAE,OAAoB;QAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC;QACzF,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;CACF"}

package/dist/backend/types.d.ts

@@ -10,7 +10,10 @@
  */
 /** How to create an isolated workspace for one item. */
 export interface ProvisionSpec {
-    /** Absolute path to the source git repository on the host. */
+    /**
+     * The source git repository: a local path OR a remote URL. A URL requires
+     * `clone: true`. `git clone`/`git worktree` accept either form of local path.
+     */
     repoPath: string;
     /** Existing ref to branch from (e.g. "main"). Ignored when `mode` is "attach". */
     baseBranch: string;
@@ -21,6 +24,14 @@ export interface ProvisionSpec {
      * an existing `branch` (e.g. a PR's head branch, for the respond pass).
      */
     mode?: "create" | "attach";
+    /**
+     * When true, provision a **fresh full clone** of `repoPath` (which may be a
+     * remote URL) into a throwaway directory, torn down after the run, so nothing
+     * persists. When false/absent, local-worktree adds a worktree off an existing
+     * local repo. The container backend always clones; this flag is for the local
+     * backend.
+     */
+    clone?: boolean;
     /** Container image, for backends that need one. Ignored by local-worktree. */
     image?: string;
 }

package/dist/backend/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/backend/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,0EAA0E;IAC1E,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,yFAAyF;IACzF,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/backend/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,0EAA0E;IAC1E,IAAI,CACF,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,yFAAyF;IACzF,MAAM,CACJ,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}

package/dist/claude-profile/classify.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Pure classification + composition for the ghostrail Claude profile: split a
+ * CLAUDE.md into sections, judge which belong in a headless factory run, flag
+ * interactive-only settings, and compose the factory CLAUDE.md + settings.
+ */
+export type Verdict = "keep" | "drop";
+export interface Section {
+    /** Heading text without the leading `#`s; "(preamble)" for text before the first heading. */
+    heading: string;
+    /** The section's full text, including its heading line. */
+    body: string;
+}
+export interface ClaudeMdSection extends Section {
+    verdict: Verdict;
+    /** Why a section was flagged to drop. */
+    reason?: string;
+}
+export interface SettingsKeyReport {
+    key: string;
+    /** Whether the key is carried into the factory settings (false = interactive-only). */
+    carried: boolean;
+    reason?: string;
+}
+/**
+ * Split a CLAUDE.md into sections at top-level (`#`/`##`) headings. Text before
+ * the first heading becomes a `(preamble)` section. Each section's `body`
+ * includes its heading line.
+ */
+export declare function splitSections(content: string): Section[];
+/** Judge each section keep/drop; a section is dropped if it names an interactive-only concern. */
+export declare function classifyClaudeMdSections(sections: readonly Section[]): ClaudeMdSection[];
+/** Report which top-level settings keys are carried into the factory profile. */
+export declare function classifySettingsKeys(settings: Record<string, unknown>): SettingsKeyReport[];
+/**
+ * Compose the factory CLAUDE.md: a fixed header followed by the bodies of the
+ * kept sections, collapsing blank runs.
+ */
+export declare function composeFactoryClaudeMd(sections: readonly ClaudeMdSection[], header?: string): string;
+/** The minimal, headless-safe factory settings.json (hooks land via the declarative block later). */
+export declare function composeFactorySettings(): Record<string, unknown>;
+//# sourceMappingURL=classify.d.ts.map

package/dist/claude-profile/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/claude-profile/classify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtC,MAAM,WAAW,OAAO;IACtB,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,uFAAuF;IACvF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkCD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAwBxD;AAED,kGAAkG;AAClG,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,eAAe,EAAE,CAQxF;AAED,iFAAiF;AACjF,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB,EAAE,CAM3F;AASD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,MAAM,GAAE,MAAuB,GAC9B,MAAM,CAMR;AAED,qGAAqG;AACrG,wBAAgB,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEhE"}

package/dist/claude-profile/classify.js

@@ -0,0 +1,103 @@
+/**
+ * Pure classification + composition for the ghostrail Claude profile: split a
+ * CLAUDE.md into sections, judge which belong in a headless factory run, flag
+ * interactive-only settings, and compose the factory CLAUDE.md + settings.
+ */
+/** Substrings (case-insensitive) that mark a CLAUDE.md section as interactive-only. */
+const INTERACTIVE_SIGNALS = [
+    "statusline",
+    "status line",
+    "keybinding",
+    "keyboard shortcut",
+    "slash command",
+    "/config",
+    "/fast",
+    " theme",
+    "type `!`",
+    "type !",
+    "interactive session",
+    "vs code",
+    "vscode",
+    "jetbrains",
+    "ide extension",
+];
+/** settings.json keys that are interactive-only and are not carried into the profile. */
+const INTERACTIVE_SETTINGS_KEYS = new Set([
+    "statusLine",
+    "theme",
+    "keybindings",
+    "spinnerTipsEnabled",
+    "autoUpdates",
+    "editorMode",
+    "verbose",
+    "preferredNotifChannel",
+    "messageIdleNotifThresholdMs",
+]);
+/**
+ * Split a CLAUDE.md into sections at top-level (`#`/`##`) headings. Text before
+ * the first heading becomes a `(preamble)` section. Each section's `body`
+ * includes its heading line.
+ */
+export function splitSections(content) {
+    const sections = [];
+    let heading;
+    let lines = [];
+    const flush = () => {
+        if (heading !== undefined) {
+            sections.push({ heading, body: lines.join("\n") });
+        }
+        else if (lines.join("\n").trim().length > 0) {
+            sections.push({ heading: "(preamble)", body: lines.join("\n") });
+        }
+    };
+    for (const line of content.split("\n")) {
+        if (/^#{1,2}\s/.test(line)) {
+            flush();
+            heading = line.replace(/^#{1,2}\s+/, "").trim();
+            lines = [line];
+        }
+        else {
+            lines.push(line);
+        }
+    }
+    flush();
+    return sections;
+}
+/** Judge each section keep/drop; a section is dropped if it names an interactive-only concern. */
+export function classifyClaudeMdSections(sections) {
+    return sections.map((section) => {
+        const hay = `${section.heading}\n${section.body}`.toLowerCase();
+        const signal = INTERACTIVE_SIGNALS.find((s) => hay.includes(s));
+        return signal === undefined
+            ? { ...section, verdict: "keep" }
+            : { ...section, verdict: "drop", reason: `mentions "${signal.trim()}" (interactive-only)` };
+    });
+}
+/** Report which top-level settings keys are carried into the factory profile. */
+export function classifySettingsKeys(settings) {
+    return Object.keys(settings).map((key) => INTERACTIVE_SETTINGS_KEYS.has(key)
+        ? { key, carried: false, reason: "interactive-only" }
+        : { key, carried: true });
+}
+const FACTORY_HEADER = `# Ghostrail factory profile
+
+This CLAUDE.md is composed by ghostrail for headless factory runs. It is not your
+interactive CLAUDE.md: it carries a curated subset of your global rules plus the
+target repo's own project CLAUDE.md at run time. Regenerate it with
+\`ghostrail claude-setup --write\`.`;
+/**
+ * Compose the factory CLAUDE.md: a fixed header followed by the bodies of the
+ * kept sections, collapsing blank runs.
+ */
+export function composeFactoryClaudeMd(sections, header = FACTORY_HEADER) {
+    const kept = sections.filter((s) => s.verdict === "keep").map((s) => s.body.trim());
+    return `${[header, ...kept]
+        .join("\n\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim()}\n`;
+}
+/** The minimal, headless-safe factory settings.json (hooks land via the declarative block later). */
+export function composeFactorySettings() {
+    return { hooks: {} };
+}
+//# sourceMappingURL=classify.js.map