brigade-cli 0.9.1__tar.gz → 0.9.3__tar.gz

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brigade-cli
-Version: 0.9.1
+Version: 0.9.3
 Summary: AI agent memory, handoffs, and local guardrails for Codex, Claude Code, OpenCode, Hermes, and OpenClaw.
 Author-email: Solomon Neas <srneas@gmail.com>
 License: MIT

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "brigade-cli"
-version = "0.9.1"
+version = "0.9.3"
 description = "AI agent memory, handoffs, and local guardrails for Codex, Claude Code, OpenCode, Hermes, and OpenClaw."
 readme = "README.md"
 requires-python = ">=3.10"

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/__init__.py

@@ -1,3 +1,3 @@
 """Brigade: local operator-system CLI for agent workspaces."""
 
-__version__ = "0.9.1"
+__version__ = "0.9.3"

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/handoff_cmd.py

@@ -16,6 +16,7 @@ WARN = "warn"
 FAIL = "fail"
 
 from . import scrub
+from .config import load_config as load_brigade_config
 from .selection import WRITER_INBOXES as _WRITER_INBOX_MAP
 
 WRITER_INBOXES = tuple(_WRITER_INBOX_MAP.values())
@@ -320,11 +321,16 @@ def doctor_checks(target: Path, sources: Path | None = None) -> list[tuple[str,
         level = WARN if pending_total else OK
         checks.append((level, "handoff_sources", "not configured; no pending handoffs" if not pending_total else "not configured"))
 
+    quiet_inboxes = [
+        inbox
+        for inbox in health.inboxes
+        if not inbox.exists and not inbox.watched and not inbox.pending and not inbox.processed
+    ]
     for inbox in health.inboxes:
+        if inbox in quiet_inboxes:
+            continue
         if inbox.pending and not inbox.watched:
             level = WARN
-        elif not inbox.exists:
-            level = OK
         else:
             level = OK
         watched = "yes" if inbox.watched else "no"
@@ -334,6 +340,14 @@ def doctor_checks(target: Path, sources: Path | None = None) -> list[tuple[str,
             f"(exists={exists}, pending={inbox.pending}, processed={inbox.processed}, watched={watched})"
         )
         checks.append((level, f"handoff_watch: {inbox.inbox}", detail))
+    if quiet_inboxes:
+        checks.append(
+            (
+                OK,
+                "handoff_watch: other inboxes",
+                f"{len(quiet_inboxes)} writer inbox(es) absent and unwatched",
+            )
+        )
 
     stale_backlog = [
         inbox
@@ -2220,7 +2234,22 @@ def sources_init(*, target: Path, force: bool = False, inboxes: list[str] | None
     if path.exists() and not force:
         print(f"error: handoff source config already exists: {path}", file=sys.stderr)
         return 2
-    inbox_values = list(inboxes) if inboxes is not None else list(WRITER_INBOXES)
+    if inboxes is not None:
+        inbox_values = list(inboxes)
+    else:
+        inbox_values = list(WRITER_INBOXES)
+        try:
+            config = load_brigade_config(target)
+        except Exception:
+            config = None
+        if config is not None and config.selection.harnesses:
+            selected = [
+                _WRITER_INBOX_MAP[h]
+                for h in config.selection.harnesses
+                if h in _WRITER_INBOX_MAP
+            ]
+            if selected:
+                inbox_values = selected
     payload = {
         "_description": "Local handoff source coverage. Relative roots resolve from this repo or workspace target.",
         "canonical_owner": "openclaw",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/operator_cmd.py

@@ -40,7 +40,7 @@ def guide_payload(*, profile: str = "internal-dogfood") -> dict[str, Any]:
         ],
         "boundaries": [
             "Brigade does not run automatically.",
-            "Brigade does not start daemons or install hooks.",
+            "Brigade does not start daemons. Templates may include an inactive hooks/pre-push file, but Brigade never activates hooks (git config core.hooksPath stays your call).",
             "Brigade does not send notifications unless a separate hook is explicitly configured.",
             "Brigade does not ingest handoffs into canonical memory from operator init/status.",
             "Brigade does not publish, push, tag, or mutate remotes.",
@@ -176,7 +176,7 @@ def adoption_plan_payload(target: Path) -> dict[str, Any]:
         "suggested_next_commands": commands,
         "boundaries": [
             "Read-only: does not write files.",
-            "Does not start services, install hooks, install schedulers, or mutate remotes.",
+            "Does not start services, activate hooks, install schedulers, or mutate remotes.",
             "Does not include raw crontab lines, OpenClaw job names, PM2 process names, command paths, or environment values.",
         ],
     }
@@ -348,7 +348,7 @@ def migration_status_payload(target: Path) -> dict[str, Any]:
         "boundaries": [
             "Uses redacted adoption, surface capture, review, work import, and task metadata.",
             "Does not include raw scheduler lines, job names, process names, command paths, environment values, host details, or private paths.",
-            "Does not start services, install hooks, mutate schedulers, mutate remotes, ingest memory, migrate secrets, or rotate credentials.",
+            "Does not start services, activate hooks, mutate schedulers, mutate remotes, ingest memory, migrate secrets, or rotate credentials.",
         ],
     }
 
@@ -559,7 +559,7 @@ def surfaces_capture_payload(target: Path) -> dict[str, Any]:
         "source_fingerprint": _surface_capture_fingerprint(capture),
         "boundaries": [
             "Reads external scheduler and process surfaces only when the operator runs this command.",
-            "Does not start services, install hooks, install schedulers, kill processes, or mutate remotes.",
+            "Does not start services, activate hooks, install schedulers, kill processes, or mutate remotes.",
             "Does not include raw crontab lines, job names, process names, command paths, environment values, hostnames, or private paths.",
         ],
     }
@@ -2385,7 +2385,7 @@ def doctor_payload(target: Path, *, profile: str = "internal-dogfood") -> dict[s
         },
         "local_only_notes": [
             ".brigade/ stores local config, receipts, scans, reports, waivers, and run artifacts.",
-            "Brigade does not run automatically, start daemons, install hooks, send notifications, publish, push, tag, or mutate remotes.",
+            "Brigade does not run automatically, start daemons, activate hooks, send notifications, publish, push, tag, or mutate remotes.",
         ],
         "tracked_vs_generated": [
             "Track reviewed cross-harness source docs under tools/.",
@@ -2505,6 +2505,35 @@ def verify_harness_payload(target: Path, *, harness: str) -> dict[str, Any]:
     else:
         checks.append({"status": "warn", "name": "handoff_inbox_gitignored", "detail": f"gitignore status: {gitignored}"})
 
+    # The managed .gitignore un-ignores each inbox's TEMPLATE.md so the format
+    # travels with the repo. Git cannot re-include a file whose parent dir is
+    # excluded by another source (commonly a global gitignore with a bare
+    # `.claude/` or `.codex/` entry), and that shadowing is otherwise silent.
+    template_path = inbox_path / "TEMPLATE.md"
+    if template_path.is_file():
+        template_ignored = dogfood_cmd._check_git_ignored(target, template_path)
+        if template_ignored == "yes":
+            inbox_root = inbox_rel.split("/")[0]
+            checks.append(
+                {
+                    "status": "warn",
+                    "name": "handoff_template_shadowed",
+                    "detail": (
+                        f"{inbox_rel}/TEMPLATE.md is gitignored despite the managed un-ignore rule; "
+                        f"an external ignore source (often a global gitignore entry like `{inbox_root}/`) "
+                        "is shadowing it, so the template will not travel with the repo"
+                    ),
+                }
+            )
+        else:
+            checks.append(
+                {
+                    "status": "ok",
+                    "name": "handoff_template_shadowed",
+                    "detail": f"{inbox_rel}/TEMPLATE.md is visible to git",
+                }
+            )
+
     lint_results = [
         result
         for result in health.lint
@@ -2795,6 +2824,7 @@ def quickstart(
             "depth": depth,
             "harnesses": selected_harnesses,
             "owner": memory_owner,
+            "owner_override": owner is not None,
             "dry_run": dry_run,
             "force": force,
             "steps": steps,
@@ -2845,6 +2875,7 @@ def quickstart(
         "depth": depth,
         "harnesses": selected_harnesses,
         "owner": memory_owner,
+        "owner_override": owner is not None,
         "dry_run": dry_run,
         "force": force,
         "steps": steps,
@@ -2877,7 +2908,7 @@ def _quickstart_local_notes() -> list[str]:
     return [
         ".brigade/ stores local config, receipts, scans, reports, waivers, and run artifacts.",
         "Generated harness projections and handoff inboxes are local ignored state.",
-        "Brigade does not start daemons, install hooks, publish, push, tag, or mutate remotes from quickstart.",
+        "Brigade does not start daemons, activate hooks (the pre-push hook file ships inactive), publish, push, tag, or mutate remotes from quickstart.",
     ]
 
 
@@ -2921,7 +2952,8 @@ def _print_quickstart(payload: dict[str, Any]) -> None:
     print(f"operator quickstart: {payload['target']}")
     print(f"depth: {payload['depth']}")
     print(f"harnesses: {','.join(payload['harnesses']) or 'none'}")
-    print(f"owner: {payload['owner']}")
+    owner_note = "" if payload.get("owner_override") else " (auto-selected; override with --owner)"
+    print(f"owner: {payload['owner']}{owner_note}")
     print(f"dry_run: {payload['dry_run']}")
     for step in payload["steps"]:
         print(f"[{step.get('status')}] {step.get('id')}")

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/scrub.py

@@ -27,6 +27,7 @@ def hook_status(target: Path, policy: str = "public-repo") -> dict[str, Any]:
     target = target.expanduser().resolve()
     hook = target / "hooks" / "pre-push"
     hooks_path = _git_config(target, "core.hooksPath")
+    local_hooks_path = _git_config(target, "core.hooksPath", local_only=True)
     git_hook = _git_pre_push_hook(target)
     configured_hook = _configured_pre_push_hook(target, hooks_path)
     active_hook = configured_hook if hooks_path else git_hook
@@ -40,6 +41,15 @@ def hook_status(target: Path, policy: str = "public-repo") -> dict[str, Any]:
         hook_mode = "configured-hooks-path"
     elif hook_enabled:
         hook_mode = "git-hooks"
+    # A core.hooksPath inherited from global/system git config can point at a
+    # personal pre-push that has nothing to do with content-guard. Reporting
+    # that as "installed" is a false positive; only trust an inherited hook
+    # when it actually runs content-guard.
+    hook_inherited = bool(hooks_path) and not local_hooks_path
+    if hook_mode == "configured-hooks-path" and hook_inherited and active_hook is not None:
+        if not _hook_runs_content_guard(active_hook):
+            hook_mode = "external-hooks-path"
+            hook_enabled = False
     try:
         resolved_policy = str(policy_path(target, policy))
     except ValueError as exc:
@@ -53,7 +63,17 @@ def hook_status(target: Path, policy: str = "public-repo") -> dict[str, Any]:
     if not policy_exists:
         checks.append({"status": "warn", "name": "content_guard_policy_missing", "detail": f"policy not found: {resolved_policy}"})
         suggestions.append(f"brigade scrub --target . --policy {policy} --dry-run")
-    if not hook_enabled:
+    if hook_mode == "external-hooks-path":
+        checks.append(
+            {
+                "status": "warn",
+                "name": "content_guard_hook_unrelated",
+                "detail": "the active pre-push comes from a global core.hooksPath outside this repo and does not run content-guard; the repo's hook is not active",
+            }
+        )
+        if hook.is_file():
+            suggestions.append("git config core.hooksPath hooks")
+    elif not hook_enabled:
         checks.append({"status": "warn", "name": "content_guard_hook_not_enabled", "detail": "no executable pre-push hook found in the active Git hooks path"})
         if hook.is_file():
             suggestions.append("git config core.hooksPath hooks")
@@ -85,10 +105,19 @@ def hook_status(target: Path, policy: str = "public-repo") -> dict[str, Any]:
     }
 
 
-def _git_config(target: Path, key: str) -> str | None:
+def _hook_runs_content_guard(path: Path) -> bool:
+    try:
+        text = path.read_text(errors="replace")
+    except OSError:
+        return False
+    return any(marker in text for marker in ("content-guard", "content_guard", "brigade scrub"))
+
+
+def _git_config(target: Path, key: str, *, local_only: bool = False) -> str | None:
+    scope = ["--local"] if local_only else []
     try:
         result = subprocess.run(
-            ["git", "-C", str(target), "config", "--get", key],
+            ["git", "-C", str(target), "config", *scope, "--get", key],
             check=False,
             stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL,

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/hermes/memory-handoff.harness.json

@@ -5,7 +5,7 @@
     "Describes the handoff inbox + routing targets that Hermes should treat",
     "as the canonical memory contract."
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "_brigade_status": "experimental",
   "memory_handoff": {
     "inbox_dir": ".hermes/memory-handoffs",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/hermes/model-lanes.harness.json

@@ -5,7 +5,7 @@
     "Suggested model lane names. Same shape as the OpenClaw alias map so",
     "knowledge cards and runbooks can talk about lanes without naming providers."
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "_brigade_status": "experimental",
   "model_lanes": {
     "main": "<provider/main-model-id>",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/hermes/workspace.harness.json

@@ -8,7 +8,7 @@
     "",
     "Replace <hermes-config-path> with your Hermes config location."
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "_brigade_status": "experimental",
   "workspace": {
     "root": "<workspace-root>",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/memory/chat-memory-sweep.example.json

@@ -1,5 +1,5 @@
 {
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "_description": "Example output contract for a nightly chat/session memory sweep. Keep raw chat transcripts in crawler archives; this file contains summaries and local source locators only.",
   "generated_at": "2026-05-26T22:09:00-04:00",
   "window": {

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/memory/memory-care.example.json

@@ -1,5 +1,5 @@
 {
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "_description": "Example config for a local memory-care scanner. Brigade does not run this scanner for you; it validates the output with `brigade doctor`.",
   "cards_glob": "memory/cards/*.md",
   "decay_dir": ".brigade/memory-care/decay",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/policies/personal.json

@@ -4,7 +4,7 @@
     "It blocks secrets and attribution trailers, while warning on personal or infrastructure-like context.",
     "Use via: brigade handoff lint --content-guard --guard-policy personal"
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "categories": {
     "secret": "block",
     "private-network": "warn",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/policies/public-content.json

@@ -4,7 +4,7 @@
     "social drafts, and docs that will be published, not just pushed.",
     "Use via: brigade scrub --policy public-content"
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "categories": {
     "secret": "block",
     "private-network": "block",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/templates/policies/public-repo.json

@@ -4,7 +4,7 @@
     "Used by brigade pre-push hook and `brigade scrub`.",
     "Override by pointing CONTENT_GUARD_POLICY at your own copy of this file."
   ],
-  "_brigade_version": "0.9.1",
+  "_brigade_version": "0.9.3",
   "categories": {
     "secret": "block",
     "private-network": "block",

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade/untrusted_cmd.py

@@ -17,6 +17,13 @@ def _read_input(*, text: list[str], from_file: Path | None) -> tuple[str | None,
         except OSError as exc:
             return None, f"cannot read input file: {exc}"
     if text:
+        if len(text) == 1 and "\n" not in text[0]:
+            candidate = Path(text[0]).expanduser()
+            if candidate.is_file():
+                return None, (
+                    f"{text[0]} is a file path; pass --from-file {text[0]} to scan its contents "
+                    "(positional text is scanned literally)"
+                )
         return " ".join(text), None
     return None, "provide text or --from-file"
 

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brigade-cli
-Version: 0.9.1
+Version: 0.9.3
 Summary: AI agent memory, handoffs, and local guardrails for Codex, Claude Code, OpenCode, Hermes, and OpenClaw.
 Author-email: Solomon Neas <srneas@gmail.com>
 License: MIT

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/src/brigade_cli.egg-info/SOURCES.txt

@@ -229,4 +229,5 @@ tests/test_station.py
 tests/test_status.py
 tests/test_toml_compat.py
 tests/test_untrusted.py
+tests/test_untrusted_cmd.py
 tests/test_work_cmd.py

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/tests/test_handoff_cmd.py

@@ -1731,3 +1731,28 @@ def test_openclaw_ingest_receipt_contract_updates_handoff_status(tmp_path, capsy
     assert handoff_cmd.show_draft(target=tmp_path, draft_id="20260603-210000-hermes-note", json_output=True) == 0
     draft_payload = json.loads(capsys.readouterr().out)
     assert draft_payload["draft"]["ingestion_status"] == "ingested"
+
+
+def test_handoff_sources_init_scopes_to_configured_selection(tmp_path, capsys):
+    from brigade.install import install_selection
+    from brigade.selection import Selection
+
+    install_selection(tmp_path, Selection(depth="repo", harnesses=["codex"], owner="codex", includes=[]))
+    capsys.readouterr()
+    assert handoff_cmd.sources_init(target=tmp_path, force=True, json_output=True) == 0
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["inboxes"] == [".codex/memory-handoffs"]
+
+
+def test_handoff_doctor_collapses_absent_unwatched_inboxes(tmp_path, capsys):
+    from brigade.install import install_selection
+    from brigade.selection import Selection
+
+    install_selection(tmp_path, Selection(depth="repo", harnesses=["codex"], owner="codex", includes=[]))
+    capsys.readouterr()
+    assert handoff_cmd.doctor(target=tmp_path) == 0
+    out = capsys.readouterr().out
+    assert "handoff_watch: .codex/memory-handoffs" in out
+    # absent, unwatched inboxes collapse to one summary line instead of 14 rows
+    assert ".qwen/memory-handoffs" not in out
+    assert "absent and unwatched" in out

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/tests/test_operator_cmd.py

@@ -1259,3 +1259,23 @@ def test_operator_quickstart_gitignore_covers_all_selected_inboxes(tmp_path, cap
     gitignore = (tmp_path / ".gitignore").read_text()
     assert ".codex/memory-handoffs/*" in gitignore
     assert ".claude/memory-handoffs/*" in gitignore
+
+
+def test_verify_harness_warns_when_inbox_template_shadowed_by_external_ignore(tmp_path, capsys):
+    import subprocess
+
+    subprocess.run(["git", "init", "-q", str(tmp_path)], check=True)
+    assert cli.main(["operator", "quickstart", "--target", str(tmp_path), "--harnesses", "codex", "--json"]) == 0
+    capsys.readouterr()
+
+    cli.main(["operator", "verify-harness", "--target", str(tmp_path), "--harness", "codex", "--json"])
+    payload = json.loads(capsys.readouterr().out)
+    shadow = [c for c in payload["checks"] if c["name"] == "handoff_template_shadowed"]
+    assert shadow and shadow[0]["status"] == "ok"
+
+    (tmp_path / ".git" / "info" / "exclude").write_text(".codex/\n")
+    cli.main(["operator", "verify-harness", "--target", str(tmp_path), "--harness", "codex", "--json"])
+    payload = json.loads(capsys.readouterr().out)
+    shadow = [c for c in payload["checks"] if c["name"] == "handoff_template_shadowed"]
+    assert shadow and shadow[0]["status"] == "warn"
+    assert "shadow" in shadow[0]["detail"] or "global" in shadow[0]["detail"]

{brigade_cli-0.9.1 → brigade_cli-0.9.3}/tests/test_scrub.py

@@ -134,3 +134,60 @@ def test_scrub_returns_4_on_unsafe_bare_name(tmp_path: Path, monkeypatch):
     monkeypatch.setenv("CONTENT_GUARD_DIR", str(scanner))
     rc = scrub_mod.run(target=target, policy="..", dry_run=True)
     assert rc == 4
+
+
+def _fake_git_run(target, *, global_hooks, local_hooks_path=None):
+    def fake_run(argv, **kwargs):
+        if argv[:3] == ["git", "-C", str(target)] and argv[-1] == "core.hooksPath":
+            if "--local" in argv:
+                class Result:
+                    returncode = 0 if local_hooks_path else 1
+                    stdout = local_hooks_path or ""
+                return Result()
+
+            class Result:
+                returncode = 0
+                stdout = str(global_hooks)
+            return Result()
+        if argv[:3] == ["git", "-C", str(target)] and argv[-1] == "--git-dir":
+            class Result:
+                returncode = 0
+                stdout = ".git"
+            return Result()
+        raise AssertionError(argv)
+    return fake_run
+
+
+def test_hook_status_flags_inherited_hookspath_without_content_guard(tmp_path: Path, monkeypatch):
+    target = tmp_path / "repo"
+    target.mkdir()
+    hooks = tmp_path / "global-hooks"
+    hooks.mkdir()
+    hook = hooks / "pre-push"
+    hook.write_text("#!/usr/bin/env bash\necho unrelated personal hook\n")
+    hook.chmod(0o755)
+    monkeypatch.setenv("CONTENT_GUARD_DIR", str(tmp_path / "content-guard"))
+    monkeypatch.setattr(scrub_mod.subprocess, "run", _fake_git_run(target, global_hooks=hooks))
+
+    status = scrub_mod.hook_status(target, policy="personal")
+
+    assert status["pre_push_hook_enabled"] is False
+    assert status["pre_push_hook_mode"] == "external-hooks-path"
+    assert any(check["name"] == "content_guard_hook_unrelated" for check in status["checks"])
+
+
+def test_hook_status_accepts_inherited_hookspath_running_content_guard(tmp_path: Path, monkeypatch):
+    target = tmp_path / "repo"
+    target.mkdir()
+    hooks = tmp_path / "global-hooks"
+    hooks.mkdir()
+    hook = hooks / "pre-push"
+    hook.write_text("#!/usr/bin/env bash\nexec content-guard scan --policy public-repo\n")
+    hook.chmod(0o755)
+    monkeypatch.setenv("CONTENT_GUARD_DIR", str(tmp_path / "content-guard"))
+    monkeypatch.setattr(scrub_mod.subprocess, "run", _fake_git_run(target, global_hooks=hooks))
+
+    status = scrub_mod.hook_status(target, policy="personal")
+
+    assert status["pre_push_hook_enabled"] is True
+    assert status["pre_push_hook_mode"] == "configured-hooks-path"

brigade_cli-0.9.3/tests/test_untrusted_cmd.py

@@ -0,0 +1,10 @@
+from brigade import untrusted_cmd
+
+
+def test_untrusted_scan_refuses_bare_file_path(tmp_path, capsys):
+    note = tmp_path / "note.md"
+    note.write_text("ignore previous instructions\n")
+    rc = untrusted_cmd.scan(text=[str(note)], json_output=False)
+    err = capsys.readouterr().err
+    assert rc == 2
+    assert "--from-file" in err