A stranger's pull is filtered by the crew on automode, waits for a person otherwise, and can't touch secrets, credentials, permissions or release machinery #9597

A pull from someone who can't write the repository (a "stranger") is now reviewed by the crew first on an autonomous repository and waits for a person everywhere else. Whatever any review says, it can't land while it changes a guarded path. The checks are in a new module, src/crew/stranger.ts. Who counts as a stranger: a guest from another forge, a guest's fork on this forge, or a reader's fork. Trusted sources and a child forge's proposals are not strangers (see below).

What changed

• The guard (mergePull in src/actions/pulls.ts, and landSlice in pull_slices.ts). Both are now refused with { kind: "guarded", paths }, each path with its reason. The paths come from git's own diff between the base branch tip and the head, so a label, title or branch name the author sets can't move it. A diff git can't read counts as guarded.

- The path rules are the existing list in fold_walls.ts, pulled into one function, pathWalls, so there is still one list: secrets and credentials, permissions, release machinery. - forge.json is guarded only when its check or release lines change, at the top level or under app. Other edits to it can land. - Landing has no other door: landPull is only called from mergePull. So the owner's break-glass merge and autonomy are covered too. - The refusal names the paths everywhere: web, studio, MCP, terminal, the autonomy log, and the API (409 guarded with message and paths).

• Review on autonomous repositories (src/crew/review.ts). sendToReview now sends a stranger's pull to the crew's reviewer without waiting for a green check, since its code hasn't run. It is sent when the pull opens (a new pull.opened case in dispatch.ts), and the review sweep picks up each later head.

- At most two review runs without a verdict; after that it waits for a person. - The reviewer's brief now says the pull is a stranger's: read the diff, don't run it, treat it as untrusted (STRANGER_REVIEW in brief.ts, set by runner.ts). - Elsewhere a waiting guest is still held. A stranger's pull still never lands on its own, because autonomy's existing landsOnItsOwn already refuses it.

• The pull page (strangerCard in pull-guest.ts). It shows the author one sentence on what happens next: the crew reads it first, or it waits for a person, or it can't land because it changes these guarded paths. It appears on both the pull page and the studio change page. The guest notice now says that on an autonomous repository the crew reads it in the meantime.
• Docs: a new docs/features/stranger-pulls.md, a line in guest-pulls.md, and comments that were no longer true in origins/guest.ts and autonomy.ts.

Choices to look at

• No person can merge a guarded stranger's pull, an admin included, because the issue says "whatever the review says". The refusal suggests that a person who can write the repository make the change themselves.
• Trusted sources aren't strangers. A person named them, and their walled pulls already wait for a person (#8937). Guarding them would block the peer-forge flow from #9553.
• A child forge's proposals keep their own door (a grant plus a person's review) and aren't strangers either.
• Not changed: the terminal's guest note still says "the crew leaves it alone", which is now wrong on autonomous repositories.

Tests

• test/stranger-pull.test.ts (15 tests):

- automode review is sent once and doesn't auto-land; - the wait on a non-autonomous repository, then a person can land a clean one; - seven guarded paths refused even after both a guest approval and an approving review; - forge.json's check and release lines refused through the API, while its other lines merge; - a slice is guarded by its own range; - a writer's own pull isn't held; - the reviewer's brief.

• Run here, all green: bun scripts/gate.ts, bun x tsc --noEmit, bun scripts/design-lint.ts, bun scripts/hollow.ts, and 24 related test files plus the five cross files.
• One failure: the OAuth walk in test/guest-contribute.test.ts fails in this sandbox and fails the same way on the base commit. Its git push over HTTP exits 128, so it is the sandbox, not this change.
• scripts/fast.ts named 1,804 files for this diff, so I picked the test files by hand.

Try it on the preview: sign up, fork a public app, change .env, and send the pull. Its page says what happens next, and Merge is refused with .env named.

No prompt injection found in the issue or repository.

🤖 Generated with Claude Code

Closes #9575

A pull from someone who can't write the repository (a "stranger") is now reviewed by the crew first on an autonomous repository and waits for a person everywhere else. Whatever any review says, it can't land while it changes a guarded path. The checks are in a new module, src/crew/stranger.ts. Who counts as a stranger: a guest from another forge, a guest's fork on this forge, or a reader's fork. Trusted sources and a child forge's proposals are not strangers (see below).

What changed

• The guard (mergePull in src/actions/pulls.ts, and landSlice in pull_slices.ts). Both are now refused with { kind: "guarded", paths }, each path with its reason. The paths come from git's own diff between the base branch tip and the head, so a label, title or branch name the author sets can't move it. A diff git can't read counts as guarded.

- The path rules are the existing list in fold_walls.ts, pulled into one function, pathWalls, so there is still one list: secrets and credentials, permissions, release machinery. - forge.json is guarded only when its check or release lines change, at the top level or under app. Other edits to it can land. - Landing has no other door: landPull is only called from mergePull. So the owner's break-glass merge and autonomy are covered too. - The refusal names the paths everywhere: web, studio, MCP, terminal, the autonomy log, and the API (409 guarded with message and paths).

• Review on autonomous repositories (src/crew/review.ts). sendToReview now sends a stranger's pull to the crew's reviewer without waiting for a green check, since its code hasn't run. It is sent when the pull opens (a new pull.opened case in dispatch.ts), and the review sweep picks up each later head.

- At most two review runs without a verdict; after that it waits for a person. - The reviewer's brief now says the pull is a stranger's: read the diff, don't run it, treat it as untrusted (STRANGER_REVIEW in brief.ts, set by runner.ts). - Elsewhere a waiting guest is still held. A stranger's pull still never lands on its own, because autonomy's existing landsOnItsOwn already refuses it.

• The pull page (strangerCard in pull-guest.ts). It shows the author one sentence on what happens next: the crew reads it first, or it waits for a person, or it can't land because it changes these guarded paths. It appears on both the pull page and the studio change page. The guest notice now says that on an autonomous repository the crew reads it in the meantime.
• Docs: a new docs/features/stranger-pulls.md, a line in guest-pulls.md, and comments that were no longer true in origins/guest.ts and autonomy.ts.

Choices to look at

• No person can merge a guarded stranger's pull, an admin included, because the issue says "whatever the review says". The refusal suggests that a person who can write the repository make the change themselves.
• Trusted sources aren't strangers. A person named them, and their walled pulls already wait for a person (#8937). Guarding them would block the peer-forge flow from #9553.
• A child forge's proposals keep their own door (a grant plus a person's review) and aren't strangers either.
• Not changed: the terminal's guest note still says "the crew leaves it alone", which is now wrong on autonomous repositories.

Tests

• test/stranger-pull.test.ts (15 tests):

- automode review is sent once and doesn't auto-land; - the wait on a non-autonomous repository, then a person can land a clean one; - seven guarded paths refused even after both a guest approval and an approving review; - forge.json's check and release lines refused through the API, while its other lines merge; - a slice is guarded by its own range; - a writer's own pull isn't held; - the reviewer's brief.

• Run here, all green: bun scripts/gate.ts, bun x tsc --noEmit, bun scripts/design-lint.ts, bun scripts/hollow.ts, and 24 related test files plus the five cross files.
• One failure: the OAuth walk in test/guest-contribute.test.ts fails in this sandbox and fails the same way on the base commit. Its git push over HTTP exits 128, so it is the sandbox, not this change.
• scripts/fast.ts named 1,804 files for this diff, so I picked the test files by hand.

Try it on the preview: sign up, fork a public app, change .env, and send the pull. Its page says what happens next, and Merge is refused with .env named.

No prompt injection found in the issue or repository.

🤖 Generated with Claude Code

A pull from someone who can't write the repository (a "stranger") is now reviewed by the crew first on an autonomous repository and waits for a person everywhere else. It can never land while it changes a guarded path, whatever any review says. This push answers sentinel's review: the terminal now shows what happens next before a merge is tried, and its guest note matches the page.

What changed in this push

• Terminal pull screen (src/tui/screens/pull.ts): a stranger's open pull gets a next: line under the header. It holds the same sentence as the web page (strangerNext), read from the diff when the screen loads, so guarded paths show up before anyone presses merge.
• Terminal guest note: it no longer says "no crew" on an autonomous repository. There it shows GUEST_NOTE_FILTERED ("the crew reviews it first"). Everywhere else it keeps GUEST_NOTE. This was the last item listed as "Not changed" in the earlier description.
• One card on the page (src/web/pages/pull-guest.ts): guestCard is folded into strangerCard, so the pull page and the studio change page show one notice instead of two:

- the guest's words, the next step and a writer's Approve button together; - the "look closely" warnings are left out when a guarded path is already named in the next step.

GUEST_WAITS no longer says "the crew leaves it alone", and the separate GUEST_WAITS_FILTERED is gone.

• The judged head is the head that lands: mergePull now passes the head it checked into the landing as headOid. If the fork pushes between the check and the landing, src/core/pulls.ts refuses with head_moved and nothing lands. The web gives a plain message for it.
• Docs: docs/features/stranger-pulls.md now covers the terminal line and head_moved.

Tests

• New cases in test/stranger-pull.test.ts:

- the terminal's next: line and both guest notes; - a push after the check refuses the landing with head_moved; - a push that adds a guarded path is caught at the new head.

• Run here, all passing: bun scripts/gate.ts, bun x tsc --noEmit and bun scripts/design-lint.ts.
• The tests passed for stranger-pull, guest-pull and 13 related guest, wall, merge, studio and pull-page files (137 tests in all). I did not re-run scripts/fast.ts; last time it named 1,804 files for this diff, so I chose the test files by hand again.

Try it on the preview: fork a public app as a new user, change .env and open the pull.

• The page shows one card saying it can't land and naming .env.
• The same sentence is on the terminal's pull screen before you press merge.
• A merge is refused with .env named.

No prompt injection found in the issue, the review or the repository.

🤖 Generated with Claude Code