pi-roundtable 0.7.15 → 0.7.17

package/src/core/discord/agent-discord.ts

@@ -23,6 +23,7 @@ import type {
 	DashboardBoard,
 } from "../agents/agent-ports.ts";
 import { AgentError } from "../domain/errors.ts";
+import type { InterimPosts } from "../domain/interim.ts";
 import { messages } from "../i18n/index.ts";
 import type { Logger } from "../log.ts";
 
@@ -69,6 +70,38 @@ export class DiscordAgentChannels implements AgentChannels {
 		}
 	}
 
+	interim(
+		channelId: string,
+		as: Omit<AgentPost, "thinking" | "chunks" | "files">,
+	): InterimPosts {
+		const threadId = as.threadId ? { threadId: as.threadId } : {};
+		return {
+			post: async (text) => {
+				const webhook = await this.#webhook(channelId);
+				try {
+					const message = await webhook.send({
+						username: as.name,
+						avatarURL: as.avatarUrl,
+						allowedMentions: { parse: ["users"] },
+						...threadId,
+						content: text,
+					});
+					return {
+						edit: async (change) => {
+							await webhook.editMessage(message, {
+								content: change,
+								...threadId,
+							});
+						},
+					};
+				} catch (error) {
+					this.#webhooks.delete(channelId);
+					throw error;
+				}
+			},
+		};
+	}
+
 	async createChannel(
 		name: string,
 		topic: string,

package/src/core/discord/discord-surface.ts

@@ -17,6 +17,7 @@ import type {
 	InboundMessage,
 	OutboundReply,
 } from "../domain/conversation.ts";
+import type { InterimPosts } from "../domain/interim.ts";
 import type { OwnerPrompts } from "../domain/owner-prompts.ts";
 import type { OwnerNotifier } from "../domain/ports.ts";
 import { messages } from "../i18n/index.ts";
@@ -159,6 +160,25 @@ export class DiscordSurface
 		return this.#options.prompts(channel, speaker);
 	}
 
+	/** The channel's interim posts: ordinary messages, edited in place for the progress line. */
+	interim(channel: ChannelKey): InterimPosts | undefined {
+		if (!channel.startsWith(PREFIX)) return undefined;
+		return {
+			post: async (text) => {
+				const target = await this.#sendable(channel);
+				const message = await target.send({
+					content: text,
+					allowedMentions: { parse: ["users"] },
+				});
+				return {
+					edit: async (change) => {
+						await message.edit({ content: change });
+					},
+				};
+			},
+		};
+	}
+
 	async start(onMessage: (message: InboundMessage) => void): Promise<void> {
 		const { logger, token } = this.#options;
 		this.#client.on(Events.MessageCreate, (message) => {

package/src/core/domain/interim.ts

@@ -0,0 +1,16 @@
+/** A message an interim post made, which the turn edits in place as it goes. */
+export interface InterimMessage {
+	edit(text: string): Promise<void>;
+}
+
+/**
+ * Where a running turn posts the text it writes before its final answer: the channel the
+ * final reply goes to, under the same name. Each call posts one ordinary message of at most
+ * Discord's 2000 characters.
+ */
+export interface InterimPosts {
+	post(text: string): Promise<InterimMessage>;
+}
+
+/** Whether a turn posts its intermediate text as it goes; "on" by default. */
+export type InterimTextMode = "on" | "off";

package/src/core/domain/ports.ts

@@ -2,6 +2,7 @@ import type { AgentTurnScope, TurnSelection } from "../sessions.ts";
 import type { Speaker } from "../speakers.ts";
 import type { TurnAttachments } from "./attachment.ts";
 import type { ChannelKey } from "./conversation.ts";
+import type { InterimPosts } from "./interim.ts";
 
 export type { AgentTurnScope };
 
@@ -32,6 +33,11 @@ export interface TurnRequest {
 	 * schedule's turn is not.
 	 */
 	interactive?: boolean;
+	/**
+	 * Where the turn posts the text it writes before its final answer, as it goes; the caller
+	 * hands the channel its reply goes to. Absent = only the final reply is posted.
+	 */
+	interim?: InterimPosts;
 }
 
 /** The judge's question and answer shapes. */

package/src/core/holds.ts

@@ -5,6 +5,8 @@ import { type Tier, tierAtLeast } from "./speakers.ts";
 export interface HoldContext {
 	/** The shared workspace of a session with a shell; calls reaching outside it may be held. */
 	workspace?: string;
+	/** The session's scratch dir, where its shell's TMPDIR points; writes and removals inside it run. */
+	scratchDir?: string;
 }
 
 /**

package/src/core/modules/host-shell/git-push.ts

@@ -0,0 +1,112 @@
+import { execFileSync } from "node:child_process";
+import { type LineState, resolvePath } from "./shell-paths.ts";
+
+/** Which pushes run without the owner's approval; see `shellHoldRuleFor`. */
+export interface PushPolicy {
+	/** GitHub owners whose repositories take a plain push without a hold. */
+	ownPushOwners?: readonly string[];
+	/** `owner/repo` names that stay held although their owner is listed. */
+	heldPushRepos?: readonly string[];
+}
+
+const GIT_TIMEOUT_MS = 3_000;
+
+/** Push options that neither force, delete, nor push tags or more than the named refs. */
+const PLAIN_FLAGS = new Set([
+	"-u",
+	"--set-upstream",
+	"-q",
+	"--quiet",
+	"-v",
+	"--verbose",
+	"-n",
+	"--dry-run",
+	"--no-verify",
+	"--verify",
+	"--atomic",
+	"--porcelain",
+	"--progress",
+	"--no-progress",
+]);
+
+/** `owner/repo` of a GitHub remote URL, https or ssh, or undefined. */
+export function githubRepo(url: string): string | undefined {
+	const match =
+		/^(?:https:\/\/(?:[^@/]+@)?github\.com\/|ssh:\/\/git@github\.com(?::\d+)?\/|git@github\.com:)([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+?)(?:\.git)?\/?$/i.exec(
+			url.trim(),
+		);
+	return match ? `${match[1]}/${match[2]}`.toLowerCase() : undefined;
+}
+
+function git(dir: string, args: readonly string[]): string | undefined {
+	try {
+		return execFileSync("git", ["-C", dir, ...args], {
+			encoding: "utf8",
+			timeout: GIT_TIMEOUT_MS,
+			stdio: ["ignore", "pipe", "ignore"],
+		});
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Whether `git <global> push <args>` is a plain push to one of the owner's own GitHub repositories:
+ * no force, deletion, tags or mirror, and a remote whose push URLs all belong to a listed owner.
+ */
+export function ownPush(
+	globals: readonly string[],
+	args: readonly string[],
+	state: LineState,
+	policy: PushPolicy,
+): boolean {
+	const owners = (policy.ownPushOwners ?? []).map((o) => o.toLowerCase());
+	if (owners.length === 0) return false;
+	let dir = state.cwd;
+	for (let i = 0; i < globals.length; i++) {
+		// `-c`, `--git-dir` and the like can point the push elsewhere.
+		if (globals[i] !== "-C") return false;
+		const next = globals[++i];
+		if (next === undefined || dir === undefined) return false;
+		dir = resolvePath(next, { ...state, cwd: dir });
+	}
+	if (dir === undefined) return false;
+	const positional: string[] = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i] as string;
+		if (arg === "-o" || arg === "--push-option") i++;
+		else if (arg.startsWith("--push-option=")) continue;
+		else if (arg.startsWith("-")) {
+			if (!PLAIN_FLAGS.has(arg)) return false;
+		} else positional.push(arg);
+	}
+	const [remote = "origin", ...refspecs] = positional;
+	for (const refspec of refspecs) {
+		if (refspec.startsWith("+") || refspec.startsWith(":")) return false;
+		if (refspec.includes("refs/tags/")) return false;
+		for (const ref of refspec.split(":"))
+			if (
+				ref &&
+				git(dir, ["show-ref", "--verify", "--quiet", `refs/tags/${ref}`]) !==
+					undefined
+			)
+				return false;
+	}
+	const urls = /[:/]/.test(remote)
+		? [remote]
+		: git(dir, ["remote", "get-url", "--push", "--all", remote])
+				?.split("\n")
+				.filter(Boolean);
+	if (!urls || urls.length === 0) return false;
+	const held = new Set(
+		(policy.heldPushRepos ?? []).map((r) => r.toLowerCase()),
+	);
+	return urls.every((url) => {
+		const repo = githubRepo(url);
+		return (
+			repo !== undefined &&
+			owners.includes(repo.split("/")[0] as string) &&
+			!held.has(repo)
+		);
+	});
+}

package/src/core/modules/host-shell/shell-paths.ts

@@ -0,0 +1,160 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import {
+	basename,
+	dirname,
+	isAbsolute,
+	join,
+	relative,
+	resolve,
+} from "node:path";
+
+/**
+ * What the commands of one command line know as they are read in order: the variables assigned
+ * earlier with literal values, and the directory the last `cd` moved to.
+ */
+export interface LineState {
+	/** The shared workspace, where a command line starts. */
+	workspace: string;
+	/** Directories a command writes and removes in without a hold: the workspace and the scratch dir. */
+	roots: readonly string[];
+	/** Variables with known values; a name mapped to undefined was assigned something unknown. */
+	vars: Map<string, string | undefined>;
+	/** The working directory, or undefined once a `cd` went somewhere unknown. */
+	cwd: string | undefined;
+	/** Whether `cd` can be followed: false in a line with subshells or `||`, where the last `cd` may not apply. */
+	followsCd: boolean;
+}
+
+export function lineState(
+	command: string,
+	workspace: string,
+	scratchDir: string | undefined,
+): LineState {
+	const vars = new Map<string, string | undefined>([["HOME", homedir()]]);
+	if (scratchDir !== undefined) vars.set("TMPDIR", scratchDir);
+	return {
+		workspace,
+		roots: scratchDir === undefined ? [workspace] : [workspace, scratchDir],
+		vars,
+		cwd: workspace,
+		followsCd: !/(^|[^$])\(|\|\|/.test(command),
+	};
+}
+
+const ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+
+/**
+ * The word with the line's variables substituted and `~` expanded, or undefined when it holds a
+ * command substitution, an unknown variable or `~user`.
+ */
+export function expand(word: string, state: LineState): string | undefined {
+	if (word.includes("`") || word.includes("$(")) return undefined;
+	let unknown = false;
+	const substituted = word.replace(
+		/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g,
+		(_, braced: string | undefined, plain: string | undefined) => {
+			const value = state.vars.get((braced ?? plain) as string);
+			if (value === undefined) unknown = true;
+			return value ?? "";
+		},
+	);
+	if (unknown || substituted.includes("$")) return undefined;
+	if (substituted === "~" || substituted.startsWith("~/"))
+		return `${homedir()}${substituted.slice(1)}`;
+	return substituted.startsWith("~") ? undefined : substituted;
+}
+
+/** The absolute path a word names, from the line's working directory; undefined when unknown. */
+export function resolvePath(
+	word: string,
+	state: LineState,
+): string | undefined {
+	const path = expand(word, state);
+	if (path === undefined) return undefined;
+	if (isAbsolute(path)) return resolve(path);
+	return state.cwd === undefined ? undefined : resolve(state.cwd, path);
+}
+
+/** Records a simple command's effect on the line: an assignment, an `export`, or a `cd`. */
+export function follow(argv: readonly string[], state: LineState): void {
+	const [head, ...args] = argv;
+	if (head === undefined) return;
+	const assignments =
+		head === "export"
+			? args
+			: argv.every((w) => ASSIGNMENT.test(w))
+				? argv
+				: [];
+	for (const word of assignments) {
+		const match = ASSIGNMENT.exec(word);
+		if (match)
+			state.vars.set(match[1] as string, expand(match[2] as string, state));
+	}
+	if (head === "cd" || head === "pushd" || head === "popd") {
+		const target = args.find((a) => !a.startsWith("-"));
+		state.cwd =
+			state.followsCd && head === "cd" && target !== undefined
+				? resolvePath(target, state)
+				: undefined;
+	}
+}
+
+/** Whether `path` is `root` or under it, comparing the paths as written. */
+export function under(path: string, root: string): boolean {
+	const rel = relative(resolve(root), resolve(path));
+	return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/** The real path of `path`: its nearest existing ancestor's real path, joined with the rest. */
+function realPath(path: string): string {
+	let existing = path;
+	while (!existsSync(existing) && dirname(existing) !== existing)
+		existing = dirname(existing);
+	try {
+		return join(realpathSync(existing), relative(existing, path));
+	} catch {
+		return path;
+	}
+}
+
+/** Whether a write to `path` stays inside a root, as written. */
+export function insideRoots(path: string, state: LineState): boolean {
+	return state.roots.some((root) => under(path, root));
+}
+
+/**
+ * Why an `rm` is held, or undefined when every operand resolves, through symlinks, under a scratch
+ * root without being one; a glob is judged by its directory part.
+ */
+export function rmHeld(
+	args: readonly string[],
+	state: LineState,
+): string | undefined {
+	const operands: string[] = [];
+	let options = true;
+	for (const arg of args) {
+		if (options && arg === "--") options = false;
+		else if (options && arg.startsWith("-") && arg !== "-") continue;
+		else operands.push(arg);
+	}
+	if (operands.length === 0) return "rm";
+	const roots = state.roots.map(realPath);
+	for (const operand of operands) {
+		const glob = /[*?[]/.exec(operand);
+		const pattern = glob ? operand : undefined;
+		const word = glob
+			? operand.slice(0, operand.lastIndexOf("/", glob.index) + 1) || "."
+			: operand;
+		// `.*` once matched `..`; a glob of hidden names is held.
+		if (pattern && basename(pattern).startsWith(".")) return "rm";
+		const path = resolvePath(word, state);
+		if (path === undefined || path === "/") return "rm";
+		const real = realPath(path);
+		const inside = roots.some((root) =>
+			pattern ? under(real, root) : under(real, root) && real !== root,
+		);
+		if (!inside) return "rm";
+	}
+	return undefined;
+}

package/src/core/modules/host-shell/shell-policy.ts

@@ -1,7 +1,17 @@
-import { homedir } from "node:os";
-import { basename, isAbsolute, relative, resolve } from "node:path";
-import type { HoldRule } from "../../holds.ts";
+import { basename } from "node:path";
+import type { HoldContext, HoldRule } from "../../holds.ts";
 import { assistantName } from "../../i18n/index.ts";
+import { ownPush, type PushPolicy } from "./git-push.ts";
+import {
+	follow,
+	insideRoots,
+	type LineState,
+	lineState,
+	resolvePath,
+	rmHeld,
+} from "./shell-paths.ts";
+
+export type { PushPolicy } from "./git-push.ts";
 
 const MAX_SHOWN_COMMAND = 600;
 
@@ -18,7 +28,6 @@ const ALWAYS_HELD = new Set([
 	"sudo",
 	"su",
 	"doas",
-	"rm",
 	"dd",
 	"shutdown",
 	"reboot",
@@ -76,15 +85,17 @@ const WRAPPERS = new Set([
 	"xargs",
 ]);
 
-/** A path is inside the workspace when it resolves under it; `~` means the service user's home. */
-function insideWorkspace(path: string, workspace: string): boolean {
-	const expanded =
-		path === "~" || path.startsWith("~/")
-			? `${homedir()}${path.slice(1)}`
-			: path;
-	const target = resolve(workspace, expanded);
-	const rel = relative(resolve(workspace), target);
-	return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+/**
+ * Whether a write to the word stays inside a scratch root. A word the line cannot resolve is read
+ * as written from the workspace, as before variables were followed.
+ */
+function writable(word: string, state: LineState): boolean {
+	if (word === "/dev/null") return true;
+	const path =
+		resolvePath(word, state) ??
+		resolvePath(word, { ...state, vars: new Map(), cwd: state.workspace }) ??
+		word;
+	return insideRoots(path, state);
 }
 
 /** Splits a command line into simple commands of words; quotes are removed, operators separate. */
@@ -123,8 +134,11 @@ export function simpleCommands(command: string): string[][] {
 			if (ch === "\n") endCommand();
 			else endWord();
 		} else if (";&|()`{}".includes(ch)) {
+			// A word cut by a command substitution keeps its mark, so its value counts as unknown.
+			if (ch === "`" && inWord) word += ch;
 			endCommand();
 		} else if (ch === "$" && command[i + 1] === "(") {
+			if (inWord) word += "$(";
 			endCommand();
 			i++;
 		} else if (ch === ">" || ch === "<") {
@@ -147,17 +161,22 @@ export function simpleCommands(command: string): string[][] {
 	return commands;
 }
 
-/** Drops leading variable assignments, wrappers, and their options, leaving the real program. */
-function program(words: string[]): string[] {
+/**
+ * Drops leading variable assignments, wrappers, and their options, leaving the real program;
+ * `prefix` collects what was dropped.
+ */
+function program(words: string[], prefix: string[] = []): string[] {
 	let rest = words;
 	for (;;) {
 		const [first] = rest;
 		if (first === undefined) return rest;
 		if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(first)) {
+			prefix.push(first);
 			rest = rest.slice(1);
 			continue;
 		}
 		if (WRAPPERS.has(basename(first))) {
+			prefix.push(basename(first));
 			rest = rest.slice(1);
 			// Wrapper options and the timeout's duration.
 			while (
@@ -173,33 +192,37 @@ function program(words: string[]): string[] {
 	}
 }
 
-/** Why one simple command is held, or undefined. */
-function heldReason(words: string[], workspace: string): string | undefined {
+/** Why one simple command is held, or undefined; reads the line's state as it is before it. */
+function heldReason(
+	words: string[],
+	state: LineState,
+	policy: PushPolicy,
+): string | undefined {
 	for (let i = 0; i < words.length; i++) {
 		const op = words[i];
 		if (op === ">" || op === ">>") {
 			const target = words[i + 1];
-			if (
-				target &&
-				target !== "/dev/null" &&
-				!insideWorkspace(target, workspace)
-			)
-				return `writes to ${target}`;
+			if (target && !writable(target, state)) return `writes to ${target}`;
 		}
 	}
+	const prefix: string[] = [];
 	const argv = program(
 		words.filter(
 			(w, i) =>
 				!["<", ">", ">>", "dup"].includes(w) &&
 				!["<", ">", ">>"].includes(words[i - 1] ?? ""),
 		),
+		prefix,
 	);
 	const [head, ...args] = argv;
 	if (!head) return undefined;
 	const name = basename(head);
 	if (ALWAYS_HELD.has(name) || /^mkfs(\..+)?$/.test(name)) return name;
+	if (name === "rm")
+		// xargs adds operands nobody can see here.
+		return prefix.includes("xargs") ? "rm" : rmHeld(args, state);
 	if ((name === "bash" || name === "sh" || name === "zsh") && args[0] === "-c")
-		return commandHeld(args[1] ?? "", workspace);
+		return commandHeld(args[1] ?? "", state, policy);
 	const verbs = args.filter((a) => !a.startsWith("-"));
 	switch (name) {
 		case "systemctl":
@@ -255,11 +278,14 @@ function heldReason(words: string[], workspace: string): string | undefined {
 				? "installs or removes packages"
 				: undefined;
 		case "git": {
-			const [verb, ...rest] = gitCommand(args);
-			if (verb === "push")
+			const [globals, [verb, ...rest]] = gitCommand(args);
+			if (verb === "push") {
+				const plain = !prefix.some((w) => w.startsWith("GIT_"));
+				if (plain && ownPush(globals, rest, state, policy)) return undefined;
 				return rest.some((a) => a === "-f" || a.startsWith("--force"))
 					? "force-pushes"
 					: `pushes to GitHub, which deploys ${assistantName()} when the branch is main`;
+			}
 			if (verb === "reset" && rest.includes("--hard"))
 				return "git reset --hard";
 			return undefined;
@@ -270,11 +296,9 @@ function heldReason(words: string[], workspace: string): string | undefined {
 			return args.includes("-r") ? "removes a crontab" : undefined;
 		case "tee": {
 			const target = args.find(
-				(a) => !a.startsWith("-") && !insideWorkspace(a, workspace),
+				(a) => !a.startsWith("-") && !writable(a, state),
 			);
-			return target && target !== "/dev/null"
-				? `writes to ${target}`
-				: undefined;
+			return target ? `writes to ${target}` : undefined;
 		}
 		default:
 			return undefined;
@@ -290,12 +314,12 @@ const GIT_VALUE_OPTIONS = new Set([
 	"--namespace",
 ]);
 
-/** The git subcommand and its arguments, past global options such as `-C <dir>`. */
-function gitCommand(args: string[]): string[] {
+/** Git's global options, such as `-C <dir>`, and the subcommand with its arguments. */
+function gitCommand(args: string[]): [string[], string[]] {
 	let i = 0;
 	while (i < args.length && (args[i] as string).startsWith("-"))
 		i += GIT_VALUE_OPTIONS.has(args[i] as string) ? 2 : 1;
-	return args.slice(i);
+	return [args.slice(0, i), args.slice(i)];
 }
 
 const GH_BODY_FLAGS = ["-f", "-F", "--field", "--raw-field", "--input"];
@@ -348,44 +372,83 @@ function ghHeld(args: string[]): string | undefined {
 	}
 }
 
-function commandHeld(command: string, workspace: string): string | undefined {
+/** Why a command line is held; a `bash -c` inside one starts from the outer line's state. */
+function commandHeld(
+	command: string,
+	outer: LineState,
+	policy: PushPolicy,
+): string | undefined {
+	const state: LineState = {
+		...lineState(command, outer.workspace, undefined),
+		roots: outer.roots,
+		vars: new Map(outer.vars),
+		cwd: outer.cwd,
+	};
 	for (const words of simpleCommands(command)) {
-		const reason = heldReason(words, workspace);
+		const reason = heldReason(words, state, policy);
 		if (reason) return reason;
+		follow(program(words), state);
+		// `export` and `cd` are kept by program(); bare assignments are dropped by it.
+		if (words.every((w) => /^[A-Za-z_][A-Za-z0-9_]*=/.test(w)))
+			follow(words, state);
 	}
 	return undefined;
 }
 
 /**
- * Pi's shell and file tools: a bash command that is destructive or reaches outside the shared
- * workspace, and a write or edit outside it, wait for the owner. Reading always runs.
+ * Pi's shell and file tools: a bash command that is destructive or reaches outside the scratch
+ * roots (the shared workspace and the scratch dir), and a write or edit outside them, wait for the
+ * owner. Reading always runs.
  */
 export function shellActionNeedingConfirmation(
 	toolName: string,
 	input: Record<string, unknown>,
-	workspace: string,
+	context: HoldContext & { workspace: string },
+	policy: PushPolicy = {},
 ): string | undefined {
+	const state = lineState(
+		typeof input.command === "string" ? input.command : "",
+		context.workspace,
+		context.scratchDir,
+	);
 	if (toolName === "bash") {
 		const command = typeof input.command === "string" ? input.command : "";
-		const reason = commandHeld(command, workspace);
+		const reason = commandHeld(command, state, policy);
 		return reason
 			? `run the shell command \`${command.slice(0, MAX_SHOWN_COMMAND)}\` on the host (${reason})`
 			: undefined;
 	}
 	if (toolName === "write" || toolName === "edit") {
 		const path = typeof input.path === "string" ? input.path : "";
-		return insideWorkspace(path.replace(/^@/, ""), workspace)
+		return writable(path.replace(/^@/, ""), state)
 			? undefined
 			: `${toolName} the file ${path} on the host`;
 	}
 	return undefined;
 }
 
-/** Shell calls of a session with a workspace; sessions without one have no shell. */
-export const shellHoldRule: Readonly<HoldRule> = Object.freeze<HoldRule>({
-	name: "shell",
-	describe: (tool, input, { workspace }) =>
-		workspace === undefined
-			? undefined
-			: shellActionNeedingConfirmation(tool, input, workspace),
-});
+/**
+ * The shell rule with a push policy: a plain push to a repository of `ownPushOwners`, other than
+ * `heldPushRepos`, runs without a hold. Shell calls of a session without a workspace have no shell.
+ */
+export function shellHoldRuleFor(policy: PushPolicy = {}): Readonly<HoldRule> {
+	const frozen: PushPolicy = {
+		ownPushOwners: [...(policy.ownPushOwners ?? [])],
+		heldPushRepos: [...(policy.heldPushRepos ?? [])],
+	};
+	return Object.freeze<HoldRule>({
+		name: "shell",
+		describe: (tool, input, context) =>
+			context.workspace === undefined
+				? undefined
+				: shellActionNeedingConfirmation(
+						tool,
+						input,
+						{ ...context, workspace: context.workspace },
+						frozen,
+					),
+	});
+}
+
+/** The strict shell rule: every push is held. */
+export const shellHoldRule: Readonly<HoldRule> = shellHoldRuleFor();