trusty-mpm 1.8.2

//! Command handler modules for the `tm` binary.
//!
//! Why: splitting each subcommand group into its own file keeps every handler
//! file well under the 500-line cap and makes the handler surface easy to
//! navigate.
//! What: re-exports handler modules — `auth`, `compress`, `daemon`,
//! `hook_rewrite`, `install`, `launch`, `managed`, `managed_route`, `meta`,
//! `misc`, `project`, `services`, `session`, `slack`, `supervisor`, `telegram`.
//! Three client-side `tm doctor` probes also live here rather than in the daemon's
//! `run_doctor`, because each needs state the responding daemon cannot report on
//! itself: `doctor_stale` (this binary's own `CARGO_PKG_VERSION`, #2332) and
//! `doctor_orphan` (whether launchd owns the process that answered, #4230), and
//! `doctor_daemon_row` (whether a daemon answered at all, #6336).
//! Test: each module has its own unit tests; integration coverage lives in
//! `tests.rs`.

// #6497: `tm session adopt-worktree` — the explicit ownership transfer for a
// tree whose owning session or agent is provably dead.
pub(crate) mod adopt_worktree;
pub(crate) mod agent;
pub(crate) mod auth;
// #6274: `tm` in a plain directory initializes a repository there instead of
// refusing; both the guided default and `tm launch` call it before detection.
pub(crate) mod auto_git_init;
pub(crate) mod banner;
pub(crate) mod commit_trailers;
pub(crate) mod compress;
pub(crate) mod daemon;
// #9034: three-state daemon pid identity, read from argv.
pub(crate) mod daemon_pid_identity;
// #9121: `tm daemon --sandbox` — refuse an unisolated env, skip pollers/secrets.
pub(crate) mod daemon_sandbox;
pub(crate) mod delete;
// #6887: the bulk-read diversion hook and its cheap worker.
pub(crate) mod divert;
pub(crate) mod divert_check;
pub(crate) mod divert_worker;
// #4230: the client-side orphan-daemon check — the daemon's own `run_doctor`
// cannot detect that the process answering it is the unsupervised one.
// #6892: the machine-wide builder-slot row — holders, the cap, and a Warn
// for a lease only the TTL could have ended.
pub(crate) mod build_lease;
// #9239: the read-only `status` and `--census` views of `tm build-lease`.
pub(crate) mod build_lease_status;
pub(crate) mod doctor_builder_cap;
// #8451: the slot pool's volume against its eviction threshold.
pub(crate) mod doctor_slot_pool;
// #6336: the standalone `tm doctor` — the battery runs in-process and the
// daemon is one appended reachability row, never a precondition.
pub(crate) mod doctor_daemon_row;
// #6649: `--fix-agents`, the agent mirror of `--fix-skills`.
pub(crate) mod doctor_fix_agents;
// #8236: `--fix-launchd-secrets`, the credential strip without the other repairs.
pub(crate) mod doctor_fix_launchd_secrets;
pub(crate) mod doctor_fix_skills;
// #8371: the opt-in `--network` gcloud auth row.
pub(crate) mod doctor_gcloud;
pub(crate) mod doctor_local;
pub(crate) mod doctor_orphan;
// #4948: the `tm doctor --fix` driver — dry-run by default, `--yes` to write.
pub(crate) mod doctor_repair;
pub(crate) mod doctor_stale;
pub(crate) mod first_run;
// #8939: `tm env set|keys` — dotenv edits that print no value.
pub(crate) mod env_file;
// #8378 PR-C: `tm content install|update|status`.
pub(crate) mod content;
// #8939 fix round: `tm env`'s no-follow file access and its guard grant.
pub(crate) mod env_file_fs;
pub(crate) mod env_file_grant;
// #8436: `tm fleet init|status` — the Architect's setup.
pub(crate) mod fleet;
pub(crate) mod generate;
pub(crate) mod guided;
pub(crate) mod guided_autostart;
// #9034: the autostart decision, with launchctl and the process table injected.
pub(crate) mod guided_autostart_plan;
pub(crate) mod guided_inplace;
pub(crate) mod guided_launch;
// #9034: down versus slow, and the picker/autostart sequence.
pub(crate) mod guided_liveness;
pub(crate) mod guided_outside_git;
pub(crate) mod guided_protected;
pub(crate) mod guided_resolver;
pub(crate) mod guided_resume;
pub(crate) mod hook_notify;
pub(crate) mod hook_payload;
// #6556: the retry-plus-log delivery, and the disk park, of the SubagentStop POST.
pub(crate) mod hook_post;
pub(crate) mod hook_rewrite;
// #7975: the stdin payload read that names its failure, so a guard can deny on it.
pub(crate) mod hook_stdin;
pub(crate) mod hooks;
pub(crate) mod install;
// #4605: the unmanaged-bundled-skill reporter and `--reconcile-skills` path,
// split out of `install` for the 500-SLOC production cap.
pub(crate) mod install_skills;
pub(crate) mod issue;
pub(crate) mod launch;
// #8545: launch/connect user-home writes, under a caller-named home.
pub(crate) mod launch_home;
// #8878: `tm launch --twin` arming.
pub(crate) mod launch_twin;
pub(crate) mod launchd_probe;
pub(crate) mod managed;
// #2919: merged-PR reclaim-pass rendering, split out of `managed` for the cap.
pub(crate) mod managed_merged_prs;
/// The `tm ls` table renderer, split out of `managed` for the SLOC cap.
pub(crate) mod managed_render;
pub(crate) mod managed_root;
pub(crate) mod managed_route;
pub(crate) mod managed_workspace;
pub(crate) mod manager;
pub(crate) mod mcp;
pub(crate) mod memory;
// #8782: the per-project prune-worktrees preview and its scope checks.
pub(crate) mod prune_preview;
// #7685: `tm memory import-auto-memory`, in its own file beside the dispatcher.
pub(crate) mod memory_auto_import;
// #8352: `tm memory recall|remember|note` — the no-MCP palace verbs, in their
// own file so the dispatcher stays a translation layer and stays under cap.
pub(crate) mod memory_verbs;
pub(crate) mod meta;
pub(crate) mod misc;
// #6276: the one decision about a repository's origin remote — a local-only
// repository proceeds to a session in its own checkout instead of refusing.
pub(crate) mod origin_plan;
pub(crate) mod pane_identity;
pub(crate) mod picker_delete;
pub(crate) mod picker_delete_glob;
pub(crate) mod picker_launch_new;
// #7688: the `tm prompt-feedback` read-back and the capture hook behind it.
pub(crate) mod prompt_feedback_cli;
pub(crate) mod prompt_feedback_hook;
// #8735: the one program-word resolver behind the pm-guard rules.
pub(crate) mod program_word;

pub(crate) mod pm_guard;
// #8939: the Architect's `tm env set|keys` exemption from the #7266 rule.
pub(crate) mod pm_guard_architect_envfile;
pub(crate) mod pm_guard_architect_reason;
pub(crate) mod pm_guard_bash;
pub(crate) mod pm_guard_budget;
// #6892: the machine-wide concurrent-builder denial. Fails CLOSED, unlike its
// #4480 sibling — see its module doc.
pub(crate) mod pm_guard_build_lease;
pub(crate) mod pm_guard_cost;
// #9011: the content roster pm-guard classifies dispatches against.
pub(crate) mod pm_guard_content;
pub(crate) mod pm_guard_deny_by_default;
// #8722: the denial record and audit POST every pm-guard deny makes.
pub(crate) mod pm_guard_deny_log;
pub(crate) mod pm_guard_dispatch;
pub(crate) mod pm_guard_dispatch_deny;
// #8257: `tm repair delegation --list`.
pub(crate) mod repair_delegation_list;
// #7172: a worktree-pinned agent's `EnterWorktree` switch, refused rather than
// left to succeed and wedge the agent — see its module doc for why the pin it
// names belongs to the harness and cannot be moved from here.
// #8547: which `subagent_type` names are known, and the refusal for the rest.
pub(crate) mod pm_guard_dispatch_type;
pub(crate) mod pm_guard_enter_worktree;
pub(crate) mod pm_guard_fanout;
// #8878: the hard floor (D8) and the Architect exemption (D4 remainder, D5).
pub(crate) mod pm_guard_floor;
// #8453: the PM delegation rules apply by session profile.
pub(crate) mod pm_guard_profile;
pub(crate) mod pm_guard_response;
// #8004: a resume of an agent whose isolated worktree is gone is refused.
pub(crate) mod pm_guard_resume_worktree;
pub(crate) mod pm_guard_routing;
// #7266: a line-range or partial READ of a secret-bearing file, refused for
// every caller — the sibling `pm_guard_bash::secret_file_copy` screens only a
// `cp`/`mv` of one, so nothing stopped `sed -n '38,46p' terraform.tfvars`.
pub(crate) mod pm_guard_secret_read;
// #7414: the "which words of this text could be a path?" layer, split out of
// `pm_guard_secret_read` when the brace-literal fix pushed it over the cap.
pub(crate) mod pm_guard_secret_words;
// #7557: the word-list / ref / text-payload position rules, split out of
// `pm_guard_secret_read` when the structure check pushed it over the cap.
pub(crate) mod pm_guard_secret_positions;
// #8523: a pm2 dump and a credential-carrying launchd plist hold a process env.
pub(crate) mod pm_guard_secret_env_files;
// #8756: the secret rules read every command substitution's body.
pub(crate) mod pm_guard_secret_nested;
// #8869: a key handed to a consumer that never prints it; a GET secret listing.
pub(crate) mod pm_guard_secret_consumers;
// #9001: a `for` loop whose words reach only `echo` and a gh search.
pub(crate) mod pm_guard_secret_search_loop;
// #8093, #8110, #8520, #8660: same-class copies, tokeninfo URLs, refusal hints.
pub(crate) mod pm_guard_secret_handling;
// #8879: the credential rules over the body of a script a command runs.
pub(crate) mod pm_guard_secret_script;
pub(crate) mod pm_guard_secret_script_read;
pub(crate) mod pm_guard_secret_script_self;
pub(crate) mod pm_guard_secret_substitution_read;
// #8878: the trust-anchor write floor, which the bypass variables do not lift.
pub(crate) mod pm_guard_trust_anchor;
pub(crate) mod pm_guard_trust_anchor_paths;
pub(crate) mod pm_guard_worktree_grant;
pub(crate) mod pm_guard_write_boundary;
// #6653: `tm pr` — the deterministic PR-open and merge-queue gates.
pub(crate) mod pr;
pub(crate) mod project;
pub(crate) mod projects;
pub(crate) mod prune;
pub(crate) mod push_guard;
// #9313: `tm sessions rebind` — re-bind a record to its live tmux pane.
pub(crate) mod rebind;
pub(crate) mod reconcile_worktrees;
// #4912: `tm register` positional resolution — URL first, alias optional, with
// the legacy alias-first order still accepted.
pub(crate) mod register_args;
pub(crate) mod reinstall;
pub(crate) mod rename;
pub(crate) mod repair;
// #7569: `tm repair savings-ledger` — quarantine the ledger rows #7514 let
// unit tests append to the operator's own savings ledger.
pub(crate) mod repair_savings_ledger;
// #5007: `tm repair session-store` — back up and truncate a corrupt
// `sessions.json` so a wedged store no longer needs a human editing JSON.
pub(crate) mod repair_session_store;
pub(crate) mod run_target;
// #7521: `tm secrets` — a client of the trusty-secrets on-demand socket.
pub(crate) mod secrets;
pub(crate) mod serve_stdio;
pub(crate) mod services;
pub(crate) mod sessctl;
pub(crate) mod session;
// #8914: `--account` on the session-spawning verbs.
pub(crate) mod session_account;
// #7313: `tm session disk` — the shell view of the per-session disk
// attribution slice 1 added to the `disk_survey` tool.
pub(crate) mod session_disk;
pub(crate) mod session_ls_connector;
pub(crate) mod session_picker;
pub(crate) mod session_picker_filter;
pub(crate) mod session_picker_order;
pub(crate) mod session_picker_prune;
pub(crate) mod session_picker_rename;
pub(crate) mod session_picker_render;
pub(crate) mod session_picker_view;
pub(crate) mod session_tui;
// The `tm shell-init` wrapper emitter — print-only; it never writes an rc file.
pub(crate) mod shell_init;
// #6288 step 1: the commands that reach the daemon over its socket only.
pub(crate) mod slack;
pub(crate) mod sm_serve;
pub(crate) mod socket_dispatch;
pub(crate) mod spawn_disclaimed;
pub(crate) mod standalone;
// #8025: `tm status`'s daemon line, derived from the SAME `/health` probe
// `tm doctor` uses — see its module doc for why the two disagreed.
pub(crate) mod status_daemon;
pub(crate) mod statusline;
pub(crate) mod supervisor;
pub(crate) mod sync_assets;
pub(crate) mod telegram;
pub(crate) mod ticket;
pub(crate) mod tmux_attach;
// #5843: the condition-poll wait primitive that replaces backgrounding.
pub(crate) mod wait;
// #8994: `tm worktrees` — the worktree ledger report.
pub(crate) mod watch;
pub(crate) mod worktrees;