Read whether a repository's instruction files may be loaded
Reports the one answer stored for repo: whether its own instruction files (AGENTS.md, or CLAUDE.md when there is no AGENTS.md, plus docs/PROJECT_RULES.md) may enter the system prompt, together with which of those files the repository actually carries right now. unknown means nobody has been asked — an interactive client asks once and records the answer here; a non-interactive run loads nothing and says so. Both unknown and refused keep every repository-supplied file out of the prompt: a repository somebody cloned does not get to write into the model’s instructions unasked. The answer is stored per canonical repository path and by that path alone — a worktree, or a subdirectory opened as its own session, answers for itself.
Query Parameters
Absolute path of the repository to report on.
4096Response
The repository's trust answer and the files it would load.
A repository's stored trust answer, with everything that answer governs: the instruction files that would reach the model, the repository's own command and skill directories, which the same answer loads and whose shell blocks it lets run, and its own .narya/config.toml, whose permission rules and hooks the same answer loads.
The canonical repository path the answer is stored under — absolute, with symlinks resolved, which may differ from the path the request named.
4096The directory instructionFiles are named relative to: the nearest enclosing git repository root at or above repository, or repository itself when it sits inside no repository. It differs from repository whenever a session was opened in a subdirectory of a checkout — a component of a monorepo — and a surface that asks somebody to approve these files must name this directory, because it is where they will actually be read from. The answer is still stored under repository alone.
4096The EFFECTIVE answer for this directory: its own stored answer, or, when it has none, the nearest one stored above it — inheritedFrom says which. unknown when nobody has been asked for this directory or any ancestor, which is what makes an interactive client ask. trusted lets the instruction files below into the system prompt, loads the repository's own commands, skills, agent recipes and .narya/config.toml, and lifts the permission posture out of untrusted mode; refused keeps all of it out and stops the asking.
unknown, trusted, refused The repository files the loader DISCOVERS by name, in prompt order, relative to the repository root, that would reach the model if this repository were trusted. Only files present on disk right now. An empty array does not mean nothing would reach the model: resourceDirs is governed by the same answer, and projectConfig can NAME further repository files that this array does not carry.
512The repository's own command, skill and agent directories and its Claude Code settings file, present on disk right now, relative to instructionRoot, in resolution order. The SAME answer governs them, and it grants more there than it grants over instruction files: a command file under .claude/commands becomes typeable, and its !cmd`` blocks run a shell on this machine, in this repository's directory, the instant somebody types the command's name; an agent recipe under .claude/agents supplies the system prompt, the tool allowlist and the model a delegated turn runs under; and .claude/settings.json's hook table runs shell with no trigger at all — once when the session starts, and again before every tool call, model request and tool result. A surface asking for the answer must name these too, and must ask about a repository that carries only these — no instruction files at all — because otherwise its commands, skills, recipes and hooks never load in any session.
512The ancestor directory decision came from, when it did not come from repository itself. Absent means the answer is this directory's own, or that there is none. A client uses it to say WHY it is not asking — a worktree under a trusted parent is trusted without anybody being questioned about it.
4096The immediate parent of repository, which is the only other directory a client may offer to trust. The IMMEDIATE parent and never a grandparent, so nobody trusts their whole machine by misreading a dialogue. Absent when there is no such directory to offer: when repository IS the filesystem root, and when its parent WOULD BE the filesystem root — /workspace, /app, /srv, the usual repository mount in a container. A / row trusts every directory on the machine forever, so it is never one keypress away; a user who wants one writes it into the store by hand.
4096The repository's own .narya/config.toml, when it is present on disk right now — the fourth thing this one answer settles, and the one a client is most likely to miss. It declares this repository's permission rules and its hook table, and a hook runs shell with no trigger at all, so it carries the weight of .claude/settings.json rather than of an instruction file. Its own text never reaches the model: its rules are evaluated and its hooks run, and neither the file nor what a hook prints enters a prompt. What it can do is NAME text that does — its instruction_files key lists repository paths whose contents are wrapped into every turn's prompt once this repository is trusted — and those names appear neither here nor in instructionFiles, which carries the discovered files alone. So a surface asking for the answer must name this file, and must ask about a repository that carries only this — no discovered instruction files, no resource directories — because otherwise its rules, its hooks and the files it names never load in any session and the only signal is one warning on the first gated effect.
Relative to repository, NOT to instructionRoot, which is the one entry on this response that differs: a component of a monorepo loads its own .narya/config.toml rather than the one at the checkout root, and a consent surface naming a file its loader will not read is the one lie it cannot afford. Absent means this repository declares nothing of its own.
512