jackherd 1.20.0 → 1.22.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 What changed for people who use jackherd, newest first.
 
+## 1.22.0
+
+- **The approval gate no longer asks about a Bash call that only reads.** In a lane, and for a subagent of the coordinator, a Bash command passes at once, with no request and no question, when every simple command in it (across `;`, `&&`, `||`, `|` and newlines) is a reading command: `cd` inside the working directory, `echo`, `printf`, `cat`, `head`, `tail` (not `-f`), `wc`, `ls`, `grep`, `rg`, `sed -n` with a print script, `git grep`/`show`/`log`/`diff`/`status`/`ls-files`/`ls-tree`/`rev-parse`/`merge-base`/`blame`, `find` without `-exec`/`-delete`/`-fprint*`, `sort`, `uniq`, `cut` and `true`. A plain `NAME=value` assignment and `$NAME` as a command word are followed. Anything the check does not model (command substitution, a redirection to a file, a heredoc, a subshell, an unknown command or variable) keeps today's question. A word with an unquoted `*`, `?`, `[`, `]`, `{` or `}` is not passed either, since the shell would expand it after the check, and an abbreviated long option (`sort --outp=out`) counts as the option it abbreviates. Run `jh sync` to get the hook.
+
+## 1.21.0
+
+- **`jh init` and `jh sync` prepare the main checkout for the herdr plugin `zerodice0.worktree-bootstrap`.** When herdr lists the plugin as enabled, they write `.herdr/worktree-copy.list` from `lanes.copy`, `.herdr/worktree-setup.json` with `commands.install` (run with the Node version of `.nvmrc` when the checkout has one) and `/.herdr/` into the git exclude file. A second run rewrites nothing. A `lanes.copy` path git does not ignore is named in a warning, since the plugin skips it. Without herdr or the plugin nothing is written. The orchestrate lane setup also names the plugin's `sync` for a worktree that existed before. Run `jh sync` to get the skill text.
+
 ## 1.20.0
 
 - **`jh lane port` picks a lane's dev-server port.** It prints the lowest port from 3100 that nothing listens on and that no running lane holds in the port column of the board (`--board <board.md>` names the board, else it is picked as for `jh herd`). Rows of cleaned-up lanes reserve nothing, so ports no longer climb. `lanes.basePort` in `.jackherd/config.json` moves the start. Run `jh sync` to get the skill text.

package/README.md

@@ -1,9 +1,9 @@
 <p>
-<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.20.0/assets/branding/jackherd-logo-outline.svg" width="340">
+<img alt="jackherd: a black and white Shih Tzu in a turquoise bandana, three lanes running from him to three agent nodes" src="https://unpkg.com/jackherd@1.22.0/assets/branding/jackherd-logo-outline.svg" width="340">
 <br>
 </p>
 
-[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies) [![macOS](https://img.shields.io/badge/macOS-supported-brightgreen?logo=apple)](https://unpkg.com/jackherd/INSTALL.md) [![Linux](https://img.shields.io/badge/Linux-supported-brightgreen?logo=linux&logoColor=white)](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg">
+[![npm](https://img.shields.io/npm/v/jackherd)](https://www.npmjs.com/package/jackherd) [![license: MIT](https://img.shields.io/npm/l/jackherd)](https://www.npmjs.com/package/jackherd) [![2 dependencies](https://img.shields.io/badge/dependencies-2-brightgreen)](https://www.npmjs.com/package/jackherd?activeTab=dependencies) [![macOS](https://img.shields.io/badge/macOS-supported-brightgreen?logo=apple)](https://unpkg.com/jackherd/INSTALL.md) [![Linux](https://img.shields.io/badge/Linux-supported-brightgreen?logo=linux&logoColor=white)](https://unpkg.com/jackherd/INSTALL.md)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg">
 
 # Jack herds your coding agents.
 
@@ -15,29 +15,29 @@ For developers who'd rather decide than supervise.
 curl -fsSL https://unpkg.com/jackherd/install.sh | sh
 ```
 
-Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg">
+Then `/jh-start` in a repository, and Jack offers your first plan. → [Quickstart](#quickstart)<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg">
 
 <p>
-<img src="https://unpkg.com/jackherd@1.20.0/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
+<img src="https://unpkg.com/jackherd@1.22.0/docs/workflow-dark.svg" width="720" alt="jackherd in herdr: a lane hits a question, Jack asks you as a choice, you pick, and the lane works on while the herd view counts its progress.">
 <br>
-<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg">
+<sub>Jack and his lanes in <a href="https://herdr.dev/">herdr</a>, a terminal for coding agents (recommended). Without it, one Claude Code session builds with subagents.</sub><br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg">
 </p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/lanes.svg" width="24" height="34" align="middle" alt=""> <b>Parallel where it pays.</b><br>Phases that don't collide run side by side, each lane on its own branch and worktree. Jack keeps the merge order and has the others rebase.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Commits, pushes and merges wait for your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours. The guards catch mistakes, not intent; a hard boundary takes branch protection.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/decide.svg" width="24" height="34" align="middle" alt=""> <b>You make the calls.</b><br>Commits, pushes and merges wait for your approval. Jack merges on green checks only where you said so: one pull request, or a plan's for up to 24 hours. The guards catch mistakes, not intent; a hard boundary takes branch protection.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A lane gets stuck, a check goes red, a decision needs you: Jack steps in and brings you only what's yours to decide. The herd view shows where every lane stands.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/bark.svg" width="24" height="34" align="middle" alt=""> <b>Jack barks.</b><br>A lane gets stuck, a check goes red, a decision needs you: Jack steps in and brings you only what's yours to decide. The herd view shows where every lane stands.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/skills.svg" width="24" height="34" align="middle" alt=""> <b>Works with your skills.</b><br>Keep your own skills: a lane builds with whichever one you pick. Plans written elsewhere run too, once Jack fills in what they're missing.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments on a lane's pull request go back to that lane, which fixes them with a test. <code>/jh-follow</code> brings in anything a CLI or an API can read as JSON: tickets, error logs, status pages.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/ear.svg" width="24" height="34" align="middle" alt=""> <b>Jack listens.</b><br>Review comments on a lane's pull request go back to that lane, which fixes them with a test. <code>/jh-follow</code> brings in anything a CLI or an API can read as JSON: tickets, error logs, status pages.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/model.svg" width="24" height="34" align="middle" alt=""> <b>The right model for each phase.</b><br>Every phase names its model: the stronger one where a mistake is expensive (data, security, a migration), the cheaper one for the rest. Lanes start on it, and a hook refuses to start a phase's subagent on a weaker one.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/model.svg" width="24" height="34" align="middle" alt=""> <b>The right model for each phase.</b><br>Every phase names its model: the stronger one where a mistake is expensive (data, security, a migration), the cheaper one for the rest. Lanes start on it, and a hook refuses to start a phase's subagent on a weaker one.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>A crash or a full context doesn't cost you the work.</b><br>Plan, board and a hand-over file hold the state, not the chat: the next session picks up where the last one stopped.</p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/bowl.svg" width="24" height="34" align="middle" alt=""> <b>A crash or a full context doesn't cost you the work.</b><br>Plan, board and a hand-over file hold the state, not the chat: the next session picks up where the last one stopped.</p>
 
-<p><img src="https://unpkg.com/jackherd@1.20.0/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg"></p>
+<p><img src="https://unpkg.com/jackherd@1.22.0/assets/icons/plan.svg" width="24" height="34" align="middle" alt=""> <b>Lives in your repository.</b><br>Plans, board and every decision are Markdown, reviewed like code. <code>jh init</code> gives your team the same setup.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg"></p>
 
 ## Quickstart
 
@@ -68,22 +68,22 @@ Then `/jh-start` in a repository, and Jack offers your first plan. → [Quicksta
    /jh-orchestrate docs/plans/board-<name>/board.md
    ```
 
-Linux and macOS are supported (Windows through WSL); the requirements are in [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md). By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg">
+Linux and macOS are supported (Windows through WSL); the requirements are in [INSTALL.md](https://unpkg.com/jackherd/INSTALL.md). By hand (Bun 1.3+): `bun add -g jackherd` or `npm install -g jackherd`, then `jh init --global` for yourself, or `jh init` in a repository to give your team the same skills and guard hooks.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg">
 
 ## Follow anything you can query
 
 Tickets, error logs, status pages: if a command or an API call can read it as JSON with your login, Jack can watch it. Recipes cover Jira, Linear, GitHub issues and Projects, Sentry, Google Calendar and status pages; for anything else, `/jh-follow` writes the command with you. One yes, and every change shows up like this:
 
-<img src="https://unpkg.com/jackherd@1.20.0/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
+<img src="https://unpkg.com/jackherd@1.22.0/docs/follow-dark.svg" width="720" alt="A source (ticket, error log or status page) has a new or changed entry; jh watch reports it to Jack; Jack puts a row into Your turn, prefixed with the source's label; its [ask] button makes Jack ask you, and then a lane works it.">
 
-The herd sums up your sources in one `Sources` line: new entries per source, or its last run, red while it fails; opened, a click opens an entry. One that needs you lands in Your turn under the source's label, [ask] has Jack look at it, and a ticket shows on the lane that works it.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.20.0/assets/icons/space.svg">
+The herd sums up your sources in one `Sources` line: new entries per source, or its last run, red while it fails; opened, a click opens an entry. One that needs you lands in Your turn under the source's label, [ask] has Jack look at it, and a ticket shows on the lane that works it.<br><img width="1" height="8" alt="" src="https://unpkg.com/jackherd@1.22.0/assets/icons/space.svg">
 
 ## In detail
 
 <details>
 <summary><b>What Jack does on his own, and what waits for you</b></summary>
 
-<img src="https://unpkg.com/jackherd@1.20.0/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
+<img src="https://unpkg.com/jackherd@1.22.0/docs/lanes-dark.svg" alt="Jack prompts two lanes and asks you for decisions and approvals; the lanes send questions back as text; jh watch reads lane state, pull requests and checks and wakes Jack.">
 
 | On his own | After your approval | Never |
 | --- | --- | --- |
@@ -118,7 +118,7 @@ The guards catch mistakes, not intent; for that, use branch protection. The hook
 
 A **plan** is Markdown with phases, checkbox tasks, a model and a review gate per phase. A **board** lists the lanes of one or more plans: which phases each lane builds, on which model, after what. A **lane** is one agent session in its own git worktree (a second checkout of your repository), and **Jack** is the session in the main checkout that runs `/jh-orchestrate` on a board.
 
-<img src="https://unpkg.com/jackherd@1.20.0/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
+<img src="https://unpkg.com/jackherd@1.22.0/docs/skills-dark.svg" alt="Your own plan or an issue is adopted (Jack adds what is missing, you see the diff) and goes to /jh-orchestrate; /jh-grill hands decisions to /jh-plan; /jh-plan feeds /jh-orchestrate or a single /jh-implement, which your own skill can replace; /jh-implement ends in /jh-pre-commit, which runs the reviewers; /jh-diagnose hands a red command to /jh-implement.">
 
 | Skill | Does |
 | --- | --- |

package/herdr-plugin/herdr-plugin.toml

@@ -1,6 +1,6 @@
 id = "crossdelta.jackherd"
 name = "jackherd"
-version = "1.20.0"
+version = "1.22.0"
 min_herdr_version = "0.8.2"
 description = "Show the herd, the state of a board's lanes, in a herdr pane"
 platforms = ["linux", "macos"]

package/install.sh

@@ -9,7 +9,7 @@ set -eu
 
 # The default is the version this file ships with. The release bump changes it together with
 # package.json; install.test.ts fails while the two differ. Overridable, but only by a plain release.
-JACKHERD_VERSION="${JACKHERD_VERSION:-1.20.0}"
+JACKHERD_VERSION="${JACKHERD_VERSION:-1.22.0}"
 
 JACKHERD_PACKAGE='jackherd'
 # Test seam: the terminal the wizard asks its questions on.

package/kit/hooks/hooks/approval-gate/read-only-shell.ts

@@ -0,0 +1,310 @@
+import { realpathSync } from 'node:fs'
+import { isAbsolute, relative, resolve } from 'node:path'
+
+type Token = { kind: 'word'; value: string } | { kind: 'variable'; name: string } | { kind: 'separator' }
+
+type PartialWord = { value: string; quoted: boolean }
+
+type Step =
+  | { kind: 'text'; value: string; quoted: boolean; next: number }
+  | { kind: 'blank'; next: number }
+  | { kind: 'separator'; next: number }
+  | { kind: 'variable'; name: string; next: number }
+  | { kind: 'redirect'; next: number }
+
+type Quoted = { value: string; next: number }
+
+/** The directory the check starts in, and the one `cd` has reached since. */
+type Position = { root: string; current: string }
+
+type Rule = (args: string[], position: Position) => boolean
+
+const NAME = /^[A-Za-z_][A-Za-z0-9_]*/
+const ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/
+const BOUNDARY = /^(?:$|[ \t\n;&|])/
+const ALLOWED_REDIRECT = /^>(?:&1|[ \t]*\/dev\/null(?=$|[ \t\n;&|]))/
+const SAFE_EXPANSION = /^[\w./:=,@%+-]+(?: +[\w./:=,@%+-]+)*$/
+const SECRET_NAME = /^\.env|\.(?:pem|key)$|^id_(?:rsa|ed25519)|^Pulumi\..*\.ya?ml$|credentials|secret/i
+const SECRET_DIRECTORY = /(?:^|\/)(?:\.ssh|\.aws|\.gnupg|\.pulumi|\.config\/gh)(?:\/|$)/
+const FORBIDDEN_NAME =
+  /^(?:PATH|IFS|HOME|CDPATH|ENV|BASH.*|SHELLOPTS|PS4|PROMPT_COMMAND|GIT_.*|LD_.*|.*PAGER|EDITOR|LESS.*)$/
+const UNQUOTED_FORBIDDEN = new Set(['`', '(', ')', '<', '\\', '\r', '*', '?', '[', ']', '{', '}'])
+
+const GIT_READ_SUBCOMMANDS = new Set([
+  'grep',
+  'show',
+  'log',
+  'diff',
+  'status',
+  'ls-files',
+  'ls-tree',
+  'rev-parse',
+  'merge-base',
+  'blame',
+])
+const FIND_WRITING_PRIMARIES = new Set([
+  '-exec',
+  '-execdir',
+  '-ok',
+  '-okdir',
+  '-delete',
+  '-fprint',
+  '-fprint0',
+  '-fprintf',
+  '-fls',
+])
+const SED_SCRIPT = /^(?:(?:\d+|\$|\/[^/\\]*\/)(?:,(?:\d+|\$|\+\d+|\/[^/\\]*\/))?)[p=]$/
+const SED_FLAGS = /^-[nEr]+$/
+const SED_FLAGS_WITH_SCRIPT = /^-[nEr]*e$/
+
+const singleQuoted = (text: string, start: number): Quoted | null => {
+  const end = text.indexOf("'", start + 1)
+  return end === -1 ? null : { value: text.slice(start + 1, end), next: end + 1 }
+}
+
+const doubleQuoted = (text: string, start: number): Quoted | null => {
+  const end = text.indexOf('"', start + 1)
+  if (end === -1) return null
+  const value = text.slice(start + 1, end)
+  return /[$`\\]/.test(value) ? null : { value, next: end + 1 }
+}
+
+/** `$NAME` or `${NAME}`, only as a whole word; anything else after a dollar sign is refused. */
+const expansionAt = (text: string, start: number, atWordStart: boolean): Step | null => {
+  if (!atWordStart) return null
+  const braced = text[start + 1] === '{'
+  const nameStart = start + (braced ? 2 : 1)
+  const name = NAME.exec(text.slice(nameStart))?.[0]
+  if (name === undefined) return null
+  const end = nameStart + name.length
+  if (braced && text[end] !== '}') return null
+  const next = braced ? end + 1 : end
+  return BOUNDARY.test(text.slice(next)) ? { kind: 'variable', name, next } : null
+}
+
+/** A redirection to the null device or `2>&1`; the word before it may only be a file descriptor. */
+const redirectAt = (text: string, start: number, word: PartialWord | null): Step | null => {
+  if (word !== null && (word.quoted || (word.value !== '1' && word.value !== '2'))) return null
+  const matched = ALLOWED_REDIRECT.exec(text.slice(start))
+  if (matched === null) return null
+  return { kind: 'redirect', next: start + matched[0].length }
+}
+
+const separatorAt = (text: string, start: number): Step | null => {
+  const char = text[start]
+  const double = text[start + 1] === char
+  if (char === '&' && !double) return null
+  return { kind: 'separator', next: start + (double ? 2 : 1) }
+}
+
+const quotedStep = (text: string, start: number): Step | null => {
+  const quoted = text[start] === "'" ? singleQuoted(text, start) : doubleQuoted(text, start)
+  return quoted === null ? null : { kind: 'text', value: quoted.value, quoted: true, next: quoted.next }
+}
+
+const stepAt = (text: string, start: number, word: PartialWord | null): Step | null => {
+  const char = text[start] as string
+  if (char === ' ' || char === '\t') return { kind: 'blank', next: start + 1 }
+  if (char === '\n' || char === ';') return { kind: 'separator', next: start + 1 }
+  if (char === '&' || char === '|') return separatorAt(text, start)
+  if (char === "'" || char === '"') return quotedStep(text, start)
+  if (char === '$') return expansionAt(text, start, word === null)
+  if (char === '>') return redirectAt(text, start, word)
+  if (UNQUOTED_FORBIDDEN.has(char) || (char === '#' && word === null)) return null
+  return { kind: 'text', value: char, quoted: false, next: start + 1 }
+}
+
+/** Splits the command into words, variable words and separators; null for any construct the check does not model. */
+const tokenize = (text: string): Token[] | null => {
+  const tokens: Token[] = []
+  let word = null as PartialWord | null
+  const flush = () => {
+    if (word !== null) tokens.push({ kind: 'word', value: word.value })
+    word = null
+  }
+  let position = 0
+  while (position < text.length) {
+    const step = stepAt(text, position, word)
+    if (step === null) return null
+    position = step.next
+    if (step.kind === 'text') {
+      word = { value: (word?.value ?? '') + step.value, quoted: (word?.quoted ?? false) || step.quoted }
+      continue
+    }
+    if (step.kind === 'redirect') {
+      word = null
+      continue
+    }
+    flush()
+    if (step.kind === 'separator') tokens.push({ kind: 'separator' })
+    if (step.kind === 'variable') tokens.push({ kind: 'variable', name: step.name })
+  }
+  flush()
+  return tokens
+}
+
+const splitCommands = (tokens: Token[]): Token[][] => {
+  const commands: Token[][] = [[]]
+  for (const token of tokens) {
+    if (token.kind === 'separator') commands.push([])
+    else commands[commands.length - 1]?.push(token)
+  }
+  return commands.filter((command) => command.length > 0)
+}
+
+/** Whether an option is one of the long options, or an abbreviation of one: GNU option parsing takes any unambiguous prefix. */
+const hasLong = (args: string[], names: string[]): boolean =>
+  args.some((arg) => {
+    const option = arg.split('=')[0] as string
+    return option.length > 2 && names.some((name) => name.startsWith(option))
+  })
+
+/** Whether a single-dash option carries one of the letters; a cluster such as `-nO` counts, a value starting with a dash too. */
+const hasShort = (args: string[], letters: string): boolean =>
+  args.some((arg) => /^-[^-]/.test(arg) && [...letters].some((letter) => arg.includes(letter)))
+
+const isInside = (root: string, target: string): boolean => {
+  const path = relative(root, target)
+  return path !== '..' && !path.startsWith('../') && !isAbsolute(path)
+}
+
+const realPathOrNull = (path: string): string | null => {
+  try {
+    return realpathSync(path)
+  } catch {
+    return null
+  }
+}
+
+/** `cd` into an existing directory that, once symbolic links are followed, still lies inside the root. */
+const cdRule: Rule = (args, position) => {
+  const [target] = args
+  if (args.length !== 1 || target === undefined || target.startsWith('-') || target.startsWith('~')) return false
+  const root = realPathOrNull(position.root)
+  const next = realPathOrNull(resolve(position.current, target))
+  if (root === null || next === null || !isInside(root, next)) return false
+  position.current = next
+  return true
+}
+
+const isSedFlag = (arg: string): boolean => arg === '--quiet' || arg === '--silent' || SED_FLAGS.test(arg)
+
+/** The scripts of a `sed` call, from `-e` or the first plain argument; null for an option the check does not know. */
+const sedScripts = (args: string[]): string[] | null => {
+  const scripts: string[] = []
+  let index = 0
+  while (index < args.length) {
+    const arg = args[index++] as string
+    if (SED_FLAGS_WITH_SCRIPT.test(arg)) {
+      const script = args[index++]
+      if (script === undefined) return null
+      scripts.push(script)
+    } else if (arg.startsWith('-') && !isSedFlag(arg)) return null
+    else if (!arg.startsWith('-') && scripts.length === 0) scripts.push(arg)
+  }
+  return scripts
+}
+
+const isSedQuiet = (args: string[]): boolean =>
+  args.some((arg) => (isSedFlag(arg) || SED_FLAGS_WITH_SCRIPT.test(arg)) && (arg.startsWith('--') || arg.includes('n')))
+
+const sedRule: Rule = (args) => {
+  const scripts = sedScripts(args)
+  return (
+    scripts !== null && isSedQuiet(args) && scripts.length > 0 && scripts.every((script) => SED_SCRIPT.test(script))
+  )
+}
+
+const gitRule: Rule = ([subcommand = '', ...rest]) =>
+  GIT_READ_SUBCOMMANDS.has(subcommand) &&
+  !hasLong(rest, ['--output', '--ext-diff', '--open-files-in-pager']) &&
+  !hasShort(rest, 'O')
+
+const RULES: Record<string, Rule> = {
+  cd: cdRule,
+  true: () => true,
+  echo: () => true,
+  printf: () => true,
+  cat: () => true,
+  head: () => true,
+  wc: () => true,
+  ls: () => true,
+  grep: () => true,
+  cut: () => true,
+  tail: (args) => !hasShort(args, 'fF') && !hasLong(args, ['--follow']),
+  sort: (args) => !hasShort(args, 'o') && !hasLong(args, ['--output', '--compress-program']),
+  uniq: (args) => args.filter((arg) => !arg.startsWith('-')).length <= 1,
+  rg: (args) => !hasShort(args, 'z') && !hasLong(args, ['--pre', '--hostname-bin', '--search-zip']),
+  find: (args) => !args.some((arg) => FIND_WRITING_PRIMARIES.has(arg)),
+  sed: sedRule,
+  git: gitRule,
+}
+
+/** The assignment `NAME=value` as a whole command: records it, or null when the name could change how commands run. */
+const assign = (word: string, variables: Map<string, string>): boolean => {
+  const matched = ASSIGNMENT.exec(word)
+  if (matched === null || FORBIDDEN_NAME.test(matched[1] as string)) return false
+  variables.set(matched[1] as string, matched[2] as string)
+  return true
+}
+
+/** The words of the command with a leading `$NAME` replaced by its recorded value; null when anything else expands. */
+const wordsOf = (command: Token[], variables: Map<string, string>): string[] | null => {
+  const [first, ...rest] = command
+  if (rest.some((token) => token.kind !== 'word')) return null
+  const words = rest.map((token) => (token as { value: string }).value)
+  if (first?.kind === 'word') return [first.value, ...words]
+  const value = first?.kind === 'variable' ? variables.get(first.name) : undefined
+  return value !== undefined && SAFE_EXPANSION.test(value) ? [...value.split(' ').filter(Boolean), ...words] : null
+}
+
+const isAssignmentCommand = (command: Token[]): boolean => {
+  const [first] = command
+  return command.length === 1 && first?.kind === 'word' && ASSIGNMENT.test(first.value)
+}
+
+/** The arguments that name a place to read, without the search pattern of `grep`, `rg` and `git grep`. */
+const pathArguments = (name: string, args: string[]): string[] => {
+  const isGitGrep = name === 'git' && args[0] === 'grep'
+  if (name !== 'grep' && name !== 'rg' && !isGitGrep) return args
+  const search = isGitGrep ? args.slice(1) : args
+  const kept: string[] = []
+  let patternGiven = search.some((arg) => arg === '-e' || arg === '--regexp')
+  let skipNext = false
+  for (const arg of search) {
+    const isPatternFlag = arg === '-e' || arg === '--regexp'
+    const isPositionalPattern = !patternGiven && !arg.startsWith('-')
+    patternGiven = patternGiven || isPositionalPattern
+    if (!skipNext && !isPatternFlag && !isPositionalPattern) kept.push(arg)
+    skipNext = isPatternFlag
+  }
+  return isGitGrep ? [...args.slice(0, 1), ...kept] : kept
+}
+
+/** Whether an argument names a file that tends to hold secrets, also behind `--option=`, `rev:` or a glob. */
+const namesSecret = (argument: string): boolean => {
+  const path = argument.replace(/[:=]/g, '/')
+  return SECRET_DIRECTORY.test(path) || path.split('/').some((part) => SECRET_NAME.test(part))
+}
+
+const isReadOnlyCommand = (command: Token[], variables: Map<string, string>, position: Position): boolean => {
+  if (isAssignmentCommand(command)) return assign((command[0] as { value: string }).value, variables)
+  const words = wordsOf(command, variables)
+  const [name = '', ...args] = words ?? []
+  const rule = Object.hasOwn(RULES, name) ? RULES[name] : undefined
+  return rule !== undefined && !pathArguments(name, args).some(namesSecret) && rule(args, position)
+}
+
+/**
+ * Whether a Bash command only reads: every simple command, across `;`, `&&`, `||`, `|` and newlines, is an allowlisted
+ * reading command with arguments that cannot write or run something else. Conservative: a construct this check does not
+ * model (substitution, redirection to a file, heredoc, subshell, unknown variable or command) answers false. `cd` may
+ * only reach a directory inside `cwd`; symbolic links are not followed, so a link inside `cwd` can still lead out.
+ */
+export const isReadOnlyShellCommand = (command: string, cwd: string): boolean => {
+  const tokens = tokenize(command)
+  if (tokens === null) return false
+  const variables = new Map<string, string>()
+  const position: Position = { root: resolve(cwd), current: resolve(cwd) }
+  return splitCommands(tokens).every((simple) => isReadOnlyCommand(simple, variables, position))
+}

package/kit/hooks/hooks/approval-gate/run.ts

@@ -1,10 +1,12 @@
 import { ASK_USER_QUESTION_TOOL } from '../shared/dialog-answers'
 import { isFresh, MS_PER_MINUTE } from '../shared/fresh'
+import { isRecord } from '../shared/json'
 import { isCoordinatorAgent, laneOfAgent } from '../shared/lane'
 import type { PaneAgent } from '../shared/pane-agent'
 import { type StandingLabels, standingGrants } from '../shared/standing-mark'
 import { gateDecision, type GateLabels } from './decision'
 import { type ApprovalRequest, callHash, type GateCall, isStorableInput, newRequest, requestId } from './request'
+import { isReadOnlyShellCommand } from './read-only-shell'
 import { type GateSettings, gateSettingsOf } from './settings'
 import { queryOf, type StandingHistoryEntry } from './standing-history'
 import { ENVIRONMENT_KIND, standingSqlDecision } from './standing-sql'
@@ -154,6 +156,10 @@ const awaitDecision = async (
 /** A question to the user asks for an answer, not for a permission: the lane asks the coordinator in its text instead. */
 const isHeld = ({ tool, input }: ClientCall): boolean => tool !== ASK_USER_QUESTION_TOOL && isStorableInput(input)
 
+/** A Bash call whose command provably only reads passes at once; nobody is asked about it. */
+const isReadOnlyBash = ({ tool, input, cwd }: ClientCall): boolean =>
+  tool === 'Bash' && isRecord(input) && typeof input.command === 'string' && isReadOnlyShellCommand(input.command, cwd)
+
 /**
  * What holds the call: the lane of the pane's agent, else, for a subagent of the coordinator, its own name. The
  * coordinator's session is the one the hook was called for, and the agent of the pane started in the main checkout
@@ -193,6 +199,7 @@ export const runGate = async (
     const settings = gateSettingsOf(dependencies.config(main))
     const lane = holderOf(clientCall, agent, main, settings.worktreeDirectory, dependencies)
     if (!lane) return null
+    if (isReadOnlyBash(clientCall)) return { kind: 'allow' }
     const { cwd, tool, input } = clientCall
     const request = openRequest(main, { lane, cwd, tool, input }, dependencies)
     return await awaitDecision(main, request, texts, settings, dependencies)

package/kit/workflow/skills/orchestrate/references/lane-setup.md

@@ -16,6 +16,11 @@ changes nothing. Decide by what you find:
   marker of step 4; that command is the check, not a look for a directory such as `node_modules/<package>`.
   If the command fails, do the step below yourself;
   if that fails too, report it.
+- **Plugin enabled, but its hook never ran for this worktree** (taken over, or made before the plugin was set
+  up): inside the worktree, run
+  `env -u HERDR_PLUGIN_CONTEXT_JSON -u HERDR_PLUGIN_EVENT_JSON python3 <plugin_root>/worktree_bootstrap.py sync`
+  (`plugin_root` is in `herdr plugin list --json`; without `env -u` the script takes the context workspace).
+  It copies the env files only: then `cmp -s` per file, and step 4 stays.
 - **Plugin missing, disabled, or its file absent:** do the step as written below.
 
 ## Step 3: env files

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jackherd",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "keywords": [
     "claude-code",
     "coding-agents",

package/src/check/skill-budget-defaults.ts

@@ -57,7 +57,7 @@ export const KIT_SKILL_TARGETS: Readonly<Record<string, number>> = {
   '.claude/skills/orchestrate/references/lane-handover.md': 360,
   // Ending the agent names `herdr agent prompt <lane> /exit`, the form the merge guard passes (+25).
   '.claude/skills/orchestrate/references/lane-session.md': 285,
-  '.claude/skills/orchestrate/references/lane-setup.md': 380,
+  '.claude/skills/orchestrate/references/lane-setup.md': 440,
   // Open up: an adopted plan is committed like a missing one, and a tracked copy is restored after the merge.
   // Core cut: the question of § 2 step 0 (the adoption's diff round, the approval it is, `<topic>`, a no) (+60).
   // Prose cut, round 2: the question itself moved here from § 2 step 0; measured size plus 5 %.

package/src/sync/command-context.ts

@@ -10,6 +10,7 @@ import { type KitLocation, locateKit, readKitSource } from './kit-source'
 import { driftExitCodeOf, exitCodeOf, formatReport, SYNC_EXIT } from './report'
 import type { SyncResult } from './sync-result'
 import { detectTools, INSTALLERS, type InstallerName, spawnTool, type ToolPresence } from './tools'
+import { bootstrapHerdrWorktreesFrom } from './worktree-bootstrap'
 
 export type CommandContext = {
   projectRoot: string
@@ -21,6 +22,8 @@ export type CommandContext = {
   log: (line: string) => void
   /** Hooks the herdr plugin in and returns the line to print, if any. Must not throw: a failure is a line, not an error. */
   linkHerdrPlugin: (roots: { packageRoot: string; projectRoot: string }) => string | null
+  /** Prepares the main checkout for the herdr worktree plugin and returns the lines to print; none without herdr or the plugin. Must not throw. */
+  bootstrapWorktrees: (projectRoot: string) => string[]
   /** A yes/no question to the user; null when there is no terminal to ask in. */
   ask: (question: string) => Promise<boolean | null>
   /** A choice among fixed answers; Enter takes `fallback`; null when there is no terminal to ask in. */
@@ -96,6 +99,7 @@ export const defaultContext = (): CommandContext => ({
   locate: () => locateKit(),
   log: (line) => console.log(line),
   linkHerdrPlugin: linkHerdrPluginFrom,
+  bootstrapWorktrees: bootstrapHerdrWorktreesFrom,
   ask: askOnTerminal,
   choose: chooseOnTerminal,
   detectTools: () => detectTools(process.env, process.platform, spawnTool(process.env)),

package/src/sync/command.ts

@@ -111,7 +111,8 @@ const syncProject = (context: CommandContext, accept: string[], dryRun: boolean)
       const foreignLines = foreignSkillLines(result, readForeignSkills(context.projectRoot))
       const foreign = foreignLines.length > 0 ? [foreignLines.join('\n')] : []
       const dryRunNote = dryRun ? [`${CLI_NAME} sync ${CHECK_FLAG}: nothing is written`] : []
-      return { notes: [...dryRunNote, ...foreign], result }
+      const bootstrap = dryRun ? [] : context.bootstrapWorktrees(context.projectRoot)
+      return { notes: [...dryRunNote, ...foreign, ...bootstrap], result }
     },
     dryRun,
   )

package/src/sync/init-command.ts

@@ -201,7 +201,11 @@ const initProjectCommand = async (context: CommandContext, answer: boolean | und
     })
     finished = { init, version: kit.version }
     return {
-      notes: [...configNotes(init.configCreated, PROJECT_CONFIG_PATH, setup), ...notes],
+      notes: [
+        ...configNotes(init.configCreated, PROJECT_CONFIG_PATH, setup),
+        ...notes,
+        ...context.bootstrapWorktrees(context.projectRoot),
+      ],
       result: init.sync,
     }
   })

package/src/sync/worktree-bootstrap.ts

@@ -0,0 +1,150 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { readResolvedConfig } from '../config/read-config'
+import { mainCheckoutOrNull } from '../plans/git'
+import { CLI_NAME } from '../version/release'
+import { herdrBinary, type RunTool, spawnTool } from './tools'
+
+/** The herdr plugin that copies files into a new worktree and runs a setup command there. */
+export const BOOTSTRAP_PLUGIN_ID = 'zerodice0.worktree-bootstrap'
+
+export const BOOTSTRAP_COPY_LIST = '.herdr/worktree-copy.list'
+
+export const BOOTSTRAP_SETUP = '.herdr/worktree-setup.json'
+
+/** The line `.git/info/exclude` gets: the plugin's files belong to this machine, not to the repository. */
+export const BOOTSTRAP_EXCLUDE_LINE = '/.herdr/'
+
+const NODE_VERSION_FILE = '.nvmrc'
+
+const SETUP_TIMEOUT_SECONDS = 900
+
+const COPY_LIST_HEADER = `# Generated by ${CLI_NAME} from lanes.copy in .jackherd/config.json; change the config, not this file.`
+
+export type BootstrapInput = {
+  /** The main checkout: the plugin reads its files there. */
+  mainRoot: string
+  /** `lanes.copy` of the config. */
+  copy: readonly string[]
+  /** `commands.install` of the config, undefined when the project has none. */
+  install: string | undefined
+  herdr: string
+  run: RunTool
+}
+
+/** Whether a `herdr plugin list --json` answer lists the bootstrap plugin as enabled; false for any other shape. */
+export const isBootstrapPluginEnabled = (json: string): boolean => {
+  try {
+    const plugins = (JSON.parse(json) as { result?: { plugins?: unknown } }).result?.plugins
+    return (
+      Array.isArray(plugins) &&
+      plugins.some((plugin) => plugin?.plugin_id === BOOTSTRAP_PLUGIN_ID && plugin.enabled === true)
+    )
+  } catch {
+    return false
+  }
+}
+
+/** The plugin's copy list: one path per line below a header comment. */
+export const copyListContent = (paths: readonly string[]): string => `${[COPY_LIST_HEADER, ...paths].join('\n')}\n`
+
+/** The install command run with the Node version `.nvmrc` names; assumes nvm in `$HOME/.nvm`. */
+export const withNodeVersion = (install: string): string => `. "$HOME/.nvm/nvm.sh" && nvm use >/dev/null && ${install}`
+
+/** The plugin's setup file: the one command that installs a new worktree's dependencies. */
+export const setupContent = (script: string): string =>
+  `${JSON.stringify(
+    {
+      version: 1,
+      commands: [
+        { name: 'Install dependencies', argv: ['bash', '-c', script], timeout_seconds: SETUP_TIMEOUT_SECONDS },
+      ],
+    },
+    null,
+    2,
+  )}\n`
+
+/** The exclude file with `line` added at its end, or null when it already holds that line. */
+export const withExcludeLine = (current: string, line: string): string | null => {
+  if (current.split('\n').some((each) => each.trim() === line)) return null
+  const separator = current === '' || current.endsWith('\n') ? '' : '\n'
+  return `${current}${separator}${line}\n`
+}
+
+/** The warning for copy paths git does not ignore, which the plugin skips; null when there are none. */
+export const notIgnoredWarning = (paths: readonly string[]): string | null =>
+  paths.length === 0
+    ? null
+    : `The herdr plugin ${BOOTSTRAP_PLUGIN_ID} copies only git-ignored paths and skips: ${paths.join(', ')}. Ignore them or take them off lanes.copy.`
+
+const readOrEmpty = (path: string): string => (existsSync(path) ? readFileSync(path, 'utf8') : '')
+
+/** Writes `content` unless the file already holds it; true when it wrote. */
+const writeIfChanged = (path: string, content: string): boolean => {
+  if (readOrEmpty(path) === content) return false
+  mkdirSync(dirname(path), { recursive: true })
+  writeFileSync(path, content)
+  return true
+}
+
+const excludeFileOf = (mainRoot: string, run: RunTool): string | null => {
+  const answer = run('git', ['-C', mainRoot, 'rev-parse', '--path-format=absolute', '--git-common-dir'])
+  return answer.exitCode === 0 && answer.output !== '' ? join(answer.output, 'info', 'exclude') : null
+}
+
+const excludeHerdrDirectory = (mainRoot: string, run: RunTool): string[] => {
+  const file = excludeFileOf(mainRoot, run)
+  if (file === null) return []
+  const merged = withExcludeLine(readOrEmpty(file), BOOTSTRAP_EXCLUDE_LINE)
+  if (merged === null) return []
+  writeIfChanged(file, merged)
+  return [`Added ${BOOTSTRAP_EXCLUDE_LINE} to the git exclude file.`]
+}
+
+/** Exit 1 is git's "not ignored"; any other failure says nothing about the path and is not reported. */
+const notIgnored = ({ mainRoot, run }: BootstrapInput, path: string): boolean =>
+  run('git', ['-C', mainRoot, 'check-ignore', '-q', '--', path]).exitCode === 1
+
+const setupScript = (mainRoot: string, install: string): string =>
+  existsSync(join(mainRoot, NODE_VERSION_FILE)) ? withNodeVersion(install) : install
+
+const writeFiles = ({ mainRoot, copy, install }: BootstrapInput): string[] => {
+  const written: string[] = []
+  if (copy.length > 0 && writeIfChanged(join(mainRoot, BOOTSTRAP_COPY_LIST), copyListContent(copy)))
+    written.push(`Wrote ${BOOTSTRAP_COPY_LIST} from lanes.copy.`)
+  if (
+    install !== undefined &&
+    writeIfChanged(join(mainRoot, BOOTSTRAP_SETUP), setupContent(setupScript(mainRoot, install)))
+  )
+    written.push(`Wrote ${BOOTSTRAP_SETUP} from commands.install.`)
+  return written
+}
+
+/**
+ * Prepares the main checkout for the herdr plugin `zerodice0.worktree-bootstrap`: its copy list and setup command from
+ * the config, and the `.herdr/` directory in the git exclude file. Does nothing without herdr or with the plugin
+ * missing or disabled. A file that is already as it should be is not rewritten. Returns the lines to print.
+ */
+export const bootstrapHerdrWorktrees = (input: BootstrapInput): string[] => {
+  const listing = input.run(input.herdr, ['plugin', 'list', '--json'])
+  if (listing.missing || listing.exitCode !== 0 || !isBootstrapPluginEnabled(listing.output)) return []
+  const warning = notIgnoredWarning(input.copy.filter((path) => notIgnored(input, path)))
+  return [...writeFiles(input), ...excludeHerdrDirectory(input.mainRoot, input.run), ...(warning ? [warning] : [])]
+}
+
+/** `bootstrapHerdrWorktrees` for the project at `projectRoot` (also a lane's worktree), with the real herdr and git. */
+export const bootstrapHerdrWorktreesFrom = (projectRoot: string): string[] => {
+  const mainRoot = mainCheckoutOrNull(projectRoot) ?? projectRoot
+  try {
+    const { config } = readResolvedConfig([...new Set([projectRoot, mainRoot])])
+    return bootstrapHerdrWorktrees({
+      mainRoot,
+      copy: config.lanes.copy,
+      install: config.commands.install,
+      herdr: herdrBinary(process.env),
+      run: spawnTool(process.env),
+    })
+  } catch (err) {
+    return [`Could not prepare the herdr worktree plugin: ${err instanceof Error ? err.message : String(err)}`]
+  }
+}