rubino-agent 0.3.0 → 0.5.0

data/lib/rubino/security/hardline_guard.rb

@@ -4,6 +4,21 @@ module Rubino
   module Security
     # Hardline (unconditional) blocklist — a floor BELOW yolo.
     #
+    # SCOPE: this is a best-effort anti-INCIDENT circuit-breaker, NOT an anti-
+    # adversary boundary. It stops the agent (or a careless user) from running an
+    # unrecoverable command via --yolo, INCLUDING the accidental/model-emitted
+    # indirection forms that pad real commands — `echo $(rm -rf /)`, a backticked
+    # `rm -rf /`, a `{ rm -rf /; }` brace-group. It is NOT a sandbox: a determined
+    # adversary with shell access can always evade a regex floor (base64, here-
+    # docs, an env-var/here-string built at runtime, a written-then-run script).
+    # The real containment boundary is the deferred OS-level sandbox (#290).
+    # Within that anti-incident scope we canonicalize aggressively — collapsing
+    # trivial evasions (quoting, trailing slashes, path-equivalents, ${HOME}) AND
+    # UNWRAPPING command substitution / backticks / brace-and-subshell groups so
+    # the floor patterns match the INNER command — rather than widening the
+    # blocklist patterns to chase each wrapper (whack-a-mole on a best-effort
+    # string blocklist buys little; the boundary is #290, not the regex) (#325).
+    #
     # Commands so catastrophic they must NEVER run via the agent, regardless
     # of --yolo, skip-approvals mode, a permissions:allow rule, or a
     # command_allowlist entry. Opting into yolo is the user trusting the agent
@@ -58,21 +73,46 @@ module Rubino
         [/#{CMDPOS}telinit\s+[06]\b/, "telinit 0/6 (shutdown/reboot)"]
       ].freeze
 
-      # sudo -S without a configured SUDO_PASSWORD is the model piping a
-      # *guessed* password via stdin — a brute-force vector. Unconditional
-      # block. Mirrors approval.py:_check_sudo_stdin_guard (:255).
-      SUDO_STDIN_RE = /(?:^|[;&|`\n]|&&|\|\||\$\()\s*sudo\s+-s\b/
+      # sudo -S / sudo --stdin without a configured SUDO_PASSWORD is the model
+      # piping a *guessed* password via stdin — a brute-force vector.
+      # Unconditional block. Mirrors approval.py:_check_sudo_stdin_guard (:255).
+      #
+      # CASE-SENSITIVE on purpose: `-S` (capital — read the password from STDIN)
+      # is the dangerous form this guard owns; `-s` (lowercase — run $SHELL) is a
+      # DIFFERENT flag and must NOT be flagged here (sudo's own privilege-flag
+      # handling lives in DangerousPatterns, not the hardline floor). The
+      # previous `-s\b` regex relied on #normalize lowercasing the command, which
+      # both over-matched `sudo -s` AND failed to anchor on the real intent — and
+      # it missed the `--stdin` long form entirely. We now match against a
+      # case-PRESERVED form (#sudo_stdin?): `-S` and combined short clusters
+      # ending in S (`-kS`, `-nS`), plus the GNU `--stdin` long form.
+      SUDO_STDIN_RE = /(?:^|[;&|`\n]|&&|\|\||\$\()\s*sudo\s+(?:-[a-zA-Z]*S(?![a-zA-Z])|--stdin\b)/
 
       module_function
 
       # Returns [true, description] when the command hits the hardline floor
       # (a HARDLINE_PATTERN or the sudo-stdin guard), else [false, nil].
+      #
+      # We match the patterns against TWO forms and OR the results: the raw
+      # whitespace/case-normalized string, and a canonicalized form that strips
+      # quoting, expands $HOME, collapses path-equivalents, and UNWRAPS command
+      # substitution / backticks / brace-and-subshell groups (see #canonicalize).
+      # Canonicalization closes the trivial bypasses (rm -rf '/', /usr/, ${HOME},
+      # //, /./) and the indirection bypasses ($(rm -rf /), `rm -rf /`,
+      # { rm -rf /; }); matching the raw form too is fail-open insurance for the
+      # rare case where canonicalization rewrites a separator/redirect out of a
+      # match (an anti-incident guard should never become LESS strict than before).
       def detect(command)
         normalized = normalize(command)
+        canonical = canonicalize(normalized)
         HARDLINE_PATTERNS.each do |regex, description|
-          return [true, description] if normalized.match?(regex)
+          return [true, description] if normalized.match?(regex) || canonical.match?(regex)
         end
-        return [true, "sudo password guessing via stdin (sudo -S)"] if sudo_stdin?(normalized)
+        # The sudo-stdin guard is CASE-SENSITIVE (`-S` ≠ `-s`), so it must NOT see
+        # the lowercased normalized/canonical forms. Match it against a
+        # whitespace-normalized but case-PRESERVED form of the raw command.
+        sudo_hit = sudo_stdin?(normalize_case_preserving(command))
+        return [true, "sudo password guessing via stdin (sudo -S)"] if sudo_hit
 
         [false, nil]
       end
@@ -84,21 +124,154 @@ module Rubino
         blocked ? description : nil
       end
 
-      # sudo -S only fires the guard when no SUDO_PASSWORD is configured —
-      # with one set, an internal transform legitimately injects -S elsewhere.
-      def sudo_stdin?(normalized)
+      # sudo -S / --stdin only fires the guard when no SUDO_PASSWORD is
+      # configured — with one set, an internal transform legitimately injects
+      # -S elsewhere. The input MUST be case-preserved (see #detect): the regex
+      # discriminates `-S` from `-s` on case.
+      def sudo_stdin?(case_preserved)
         return false if ENV.key?("SUDO_PASSWORD")
 
-        normalized.match?(SUDO_STDIN_RE)
+        case_preserved.match?(SUDO_STDIN_RE)
       end
 
-      # Minimal normalization: collapse runs of spaces/tabs (newlines kept so
-      # the command-separator anchors still fire), trim, and lowercase so
-      # trivial obfuscation (extra spaces, case) doesn't slip through.
-      # Deliberately NOT a full ANSI/Unicode normalizer — over-engineering for
-      # the hardline floor.
+      # Minimal normalization: strip shell line-continuations, collapse runs of
+      # spaces/tabs (newlines kept so the command-separator anchors still fire),
+      # trim, and lowercase so trivial obfuscation (extra spaces, case) doesn't
+      # slip through. Deliberately NOT a full ANSI/Unicode normalizer —
+      # over-engineering for the hardline floor.
+      #
+      # Line-continuation strip (#348): a backslash immediately before a newline
+      # is a shell line-continuation — the two characters fold the next line onto
+      # the current one with NO intervening character. The shell deletes the
+      # `\<newline>` pair entirely; it does NOT insert a space. Pre-fix we replaced
+      # it with a SPACE, so `rm -r\<newline>f /` became `rm -r f /` — the `-r` and
+      # `f` split into two tokens and the `\brm\s+(?:-\S*\s+)*/` pattern (which
+      # needs the flags glued) MISSED it, letting an unrecoverable `rm -rf /` past
+      # the floor (#348 residual). Replace the continuation with the EMPTY string
+      # so `rm -r\<newline>f /` folds to `rm -rf /` exactly as the shell sees it.
+      # (Trailing whitespace after the backslash is NOT part of the continuation
+      # and is left for the space-collapse below.)
       def normalize(command)
-        command.to_s.gsub(/[ \t]+/, " ").strip.downcase
+        normalize_case_preserving(command).downcase
+      end
+
+      # Same whitespace normalization as #normalize (line-continuation strip,
+      # space/tab collapse, trim) but WITHOUT lowercasing. Used only by the
+      # case-sensitive sudo-stdin guard so `-S` (stdin password) stays
+      # distinguishable from `-s` (start shell).
+      def normalize_case_preserving(command)
+        joined = command.to_s.gsub(/\\\r?\n/, "")
+        joined.gsub(/[ \t]+/, " ").strip
+      end
+
+      # Canonicalize the (already normalized) command so common, trivial
+      # evasions of the hardline patterns collapse onto the bare forms the
+      # patterns expect. This is the #325 hardening: instead of growing the
+      # pattern list to chase each quoting/path-equivalent variant, we normalize
+      # the INPUT the patterns see. Steps, per token:
+      #   1. Shell-word split (Shellwords) — strips quotes so '/' "/" '/usr'
+      #      collapse to /, /usr. Unbalanced quotes raise ArgumentError; we then
+      #      FALL BACK to the raw normalized string (fail-open — never raise out
+      #      of a security check).
+      #   2. Expand a TINY fixed env set ($HOME, ${HOME}, "$HOME", $home, ${home})
+      #      to ~ so the home-directory pattern fires on the brace/quote forms
+      #      the (?:~|\$home) regex misses.
+      #   3. For path-shaped tokens (start with / or ~), Pathname#cleanpath
+      #      (pure-string, no FS touch) collapses /usr/ -> /usr, // -> /,
+      #      /. -> /, /./ -> /, /home/../ -> / .
+      # Re-join with single spaces and append a trailing space so a token-final
+      # `/` still satisfies the patterns' (?:\s|$) anchor.
+      def canonicalize(normalized)
+        require "shellwords"
+        require "pathname"
+        normalized = expand_word_splits(normalized)
+        normalized = unwrap_substitutions(normalized)
+        tokens = shell_split(normalized)
+        return normalized if tokens.nil? # unbalanced quotes: fail open to raw
+
+        cleaned = tokens.map { |tok| clean_token(tok) }
+        "#{cleaned.join(" ")} "
+      end
+
+      # Unwrap command-substitution / backtick / brace-and-subshell indirection so
+      # the floor patterns see the INNER command at command position (#325 gap).
+      # A model or a careless user can pad a catastrophic command with a wrapper
+      # the rm/dd/mkfs patterns don't anchor on — `$(rm -rf /)`, `` `rm -rf /` ``,
+      # `{ rm -rf /; }`, `echo $(rm -rf /*)`. The wrapper merely RUNS the inner
+      # text, so unwrapping it to bare text is faithful to what the shell executes.
+      #
+      # We turn each wrapper delimiter into a space, which promotes the inner
+      # command to the top level of the canonical string. Crucially we DO NOT
+      # touch `${...}` PARAMETER expansion (handled by #expand_word_splits /
+      # #clean_token) — only the `$(` COMMAND-substitution opener — so `${HOME}`
+      # and `${IFS}` keep their meaning. Applied repeatedly (capped) so nested
+      # `$(echo $(rm -rf /))` flattens too. Fail-open: a runaway input just stops
+      # after the cap and matching proceeds on whatever it reached.
+      def unwrap_substitutions(text)
+        5.times do
+          before = text
+          # $(  ... )  command substitution. `$(` opener (NOT `${`), and bare
+          # `)`/`(` subshell parens -> spaces. The negative lookbehind keeps
+          # `${...}` intact while still splitting `$(`.
+          text = text.gsub("$(", " ").gsub(/(?<!\$)[()]/, " ")
+          # backtick command substitution -> spaces (open and close).
+          text = text.gsub("`", " ")
+          # `{ ... ; }` brace group: a brace GROUP delimiter is a `{` followed by
+          # whitespace and a closing `}` at word boundary, plus the command-
+          # terminating `;` — all separators, not part of the command. Map them to
+          # spaces so the inner `rm -rf /` lands at command position. We DELIBERATELY
+          # do NOT touch a `{`/`}` that is part of `${...}` parameter expansion
+          # (no surrounding space) so `${HOME}`/`${IFS}` keep their meaning.
+          text = text.gsub(/(?<=\s|\A){\s/, "  ").gsub(/(?<=\s)}/, " ")
+          text = text.gsub(";", " ")
+          break if text == before
+        end
+        text
+      end
+
+      # #348 follow-ups, applied BEFORE shell-splitting so the substituted text is
+      # re-tokenized into the bare `rm -rf /` form the patterns expect:
+      #   * ${IFS} word-splitting: `rm${IFS}-rf${IFS}/` joins rm to / with no
+      #     real whitespace, so Shellwords sees ONE token `rm-rf/`. Replace any
+      #     ${IFS} / $IFS occurrence with a space so the shell's own field-split
+      #     is reproduced. (lowercased input -> ${ifs}/$ifs.)
+      #   * ${IFS:0:1} substring form (#348 residual): `${IFS:OFFSET:LENGTH}`
+      #     takes a slice of $IFS — `${IFS:0:1}` is its first char (a space). It is
+      #     the SAME field-split trick as ${IFS}; `rm${IFS:0:1}-rf${IFS:0:1}/` must
+      #     also collapse to spaces. Match the brace-with-offset form too.
+      #   * ${VAR:-/} / ${VAR:=/} param-default (#348 residual): the `:-`/`:=`
+      #     default is used when VAR is unset/empty. The pre-fix only handled the
+      #     literal name `home`; ANY unset varname works (`${X:-/}`, `${FOO:-/}`),
+      #     so an attacker just picks a name that is unset and the default `/`
+      #     expands to the root filesystem. Collapse `${<anyname>:-VALUE}` /
+      #     `${<anyname>:=VALUE}` to its default VALUE so the root/home pattern
+      #     fires regardless of the chosen variable name.
+      def expand_word_splits(text)
+        # ${ifs}, $ifs, and the ${ifs:OFFSET:LEN} substring form all -> a space.
+        out = text.gsub(/\$\{ifs(?::\d+(?::\d+)?)?\}|\$ifs\b/, " ")
+        # ${VAR:-VALUE} / ${VAR:=VALUE} -> VALUE (the default the shell uses when
+        # VAR is unset/empty), for ANY variable name. Captures the default path so
+        # `${x:-/}` becomes `/` and the root-filesystem pattern matches.
+        out.gsub(/\$\{[a-z_][a-z0-9_]*:[-=]([^}]*)\}/, '\1')
+      end
+
+      # Shell-word split, or nil on unbalanced quotes (caller falls back to raw).
+      def shell_split(normalized)
+        Shellwords.split(normalized)
+      rescue ArgumentError
+        nil
+      end
+
+      # Expand the tiny HOME env set, then cleanpath absolute-path tokens.
+      def clean_token(tok)
+        # $HOME / ${HOME} / $home / ${home} -> ~ (Shellwords already stripped the
+        # surrounding quotes of "$HOME"). Only when the token IS (or starts) the
+        # HOME ref, so we don't rewrite an unrelated $homedir.
+        tok = tok.sub(%r{\A\$\{?home\}?(?=\z|/)}, "~")
+        return tok unless tok.start_with?("/")
+
+        # Pure-string path cleanup: /usr/ -> /usr, // -> /, /. -> /, /home/../ -> /.
+        Pathname.new(tok).cleanpath.to_s
       end
     end
   end

data/lib/rubino/security/pattern_matcher.rb

@@ -21,17 +21,40 @@ module Rubino
       end
 
       # Returns the action for a given tool call description
-      # Returns :allow, :ask, or :deny
+      # Returns :allow, :ask, or :deny (nil when no rule matches).
+      #
+      # DENY ALWAYS WINS (the documented permissions invariant). Resolution is
+      # NOT a plain first-hit on the specificity-sorted list — that let a longer,
+      # more specific :allow outrank a shorter overlapping :deny (e.g.
+      # "shell git push" => deny vs. "shell git push --force-with-lease …" =>
+      # allow), silently swallowing the deny. Instead we resolve in two passes
+      # over ALL matching rules:
+      #
+      #   1. If ANY matching rule is :deny, the result is :deny — regardless of
+      #      a longer overlapping :allow/:ask. (deny wins ACROSS verdict classes)
+      #   2. Otherwise the FIRST (= longest/most-specific, per #parse_rules)
+      #      matching :allow/:ask wins. (longest-match preserved WITHIN a class)
+      #
+      # The hardline floor is a separate, earlier layer (ApprovalPolicy step 1)
+      # and is unaffected.
       def match(tool_name, command_or_args = nil)
         full_string = [tool_name, command_or_args].compact.join(" ")
 
-        # Check rules from most specific to least specific
+        first_non_deny = nil
         @rules.each do |pattern, action|
-          return action.to_sym if matches_pattern?(full_string, pattern)
+          next unless matches_pattern?(full_string, pattern)
+
+          sym = action.to_sym
+          # Pass 1: a deny short-circuits everything — deny always wins.
+          return :deny if sym == :deny
+
+          # Pass 2 (deferred): remember the first (most-specific) allow/ask, but
+          # keep scanning in case a shorter overlapping deny is still ahead.
+          first_non_deny ||= sym
         end
 
-        # Default: no explicit match
-        nil
+        # No matching deny: the longest/most-specific allow/ask (or nil).
+        first_non_deny
       end
 
       # Returns true if the pattern matches the input

data/lib/rubino/security/prefix_deriver.rb

@@ -92,20 +92,25 @@ module Rubino
       end
 
       # Leading safe-token run of a plain command:
-      #   "git status"            -> "git"
+      #   "git status"            -> "git status"
       #   "bundle exec rspec"     -> "bundle exec"
       #   "npm run test --watch"  -> "npm run"
-      # A plain command keeps only its head; a wrapper command (bundle/npm/...)
-      # additionally keeps its declared verb (exec/run) so distinct wrapped
-      # tools don't collapse into one rule. The run stops at the first flag or
-      # argument-shaped token, mirroring CommandAllowlist's start_with? match.
+      # A wrapper command (bundle/npm/...) keeps its declared verb (exec/run) so
+      # distinct wrapped tools don't collapse into one rule. `git` keeps its
+      # READ-ONLY subcommand (`git status` not bare `git`) and refuses to derive
+      # a prefix at all for any non-read-only git verb: a bare `git` prefix
+      # persisted to the allowlist would pre-approve `git apply`,
+      # `git -c alias.x=!cmd x`, ... = RCE/arbitrary-write (SEC-R2-1). For a
+      # plain command the head alone is the prefix. The run stops at the first
+      # flag or argument-shaped token, mirroring CommandAllowlist's match.
       def command_prefix(command)
         tokens = command.to_s.strip.split(/\s+/)
         return "" if tokens.empty?
 
         head = tokens.first
-        prefix = [head]
+        return git_prefix(tokens) if head == "git"
 
+        prefix = [head]
         if WRAPPERS.key?(head)
           verb = tokens[1]
           prefix << verb if verb && plain_word?(verb) && WRAPPERS[head].include?(verb)
@@ -114,6 +119,20 @@ module Rubino
         prefix.join(" ")
       end
 
+      # The persistable prefix for a git command: `git <subcommand>` ONLY when
+      # the subcommand is provably read-only (no global flags before it, a
+      # read-only verb). Anything else — a bare `git`, a global flag like `-c`,
+      # a mutating/code-loading verb (apply/am/push/...) — returns "" so the
+      # caller offers no "always_prefix" choice and the broad rule is never
+      # persisted. The narrow exact-command path still remains available.
+      def git_prefix(tokens)
+        sub = tokens[1]
+        return "" if sub.nil? || sub.start_with?("-")
+        return "" unless Security::ReadonlyCommands::GIT_READONLY_SUBCOMMANDS.include?(sub)
+
+        "git #{sub}"
+      end
+
       # A "plain word" is a bare token: not a flag, no path/assignment/glob
       # punctuation — the shape that can safely extend a prefix.
       def plain_word?(token)

data/lib/rubino/security/readonly_commands.rb

@@ -45,13 +45,32 @@ module Rubino
       ].freeze
 
       # Mutating/executing flags that disqualify an otherwise-safe head.
-      # Matched as exact token or `flag=value`.
+      # Matched as exact token or `flag=value`. Heads that read by default but
+      # gain a WRITE or an EXEC through one of these flags: an allowlisted entry
+      # for the head pre-approves the read, never the smuggled write/exec.
+      #   sort -o FILE / --output=FILE         arbitrary write (SEC-R2-2)
+      # (sed/tar/tee/awk/... are handled by CODE_EXEC_HEADS below — their
+      # argument is itself a program / they pipe to a shell, so no flag list can
+      # make an arbitrary-arg invocation safe.)
       FORBIDDEN_FLAGS = {
         "find" => %w[-exec -execdir -ok -okdir -delete -fprintf -fprint -fprint0 -fls],
         "date" => %w[-s --set],
-        "tree" => %w[-o]
+        "tree" => %w[-o],
+        "sort" => %w[-o --output]
       }.freeze
 
+      # Heads whose very PURPOSE is to run arbitrary code (or whose argument is
+      # a program that can spawn a shell), so no flag inspection can make an
+      # arbitrary-arg invocation provably safe. An allowlist entry for one of
+      # these is DENIED auto-approval outright (default-deny): being on the
+      # allowlist must never pre-approve `awk 'BEGIN{system("…")}'`,
+      # `sed -n '…e cmd'`, `perl -e …`, `tee FILE`, etc. (SEC-R2-2). This is the
+      # convenience-layer floor; these still run after an explicit prompt.
+      CODE_EXEC_HEADS = %w[
+        awk gawk mawk sed perl python python2 python3 ruby node php pwsh
+        bash sh zsh ksh dash env xargs eval source tee tar dd
+      ].freeze
+
       # Leading `FOO=bar cmd` environment assignment — rejected, not stripped:
       # an assignment can change what the command resolves to (PATH=...) or
       # how it behaves, so it is never "provably read-only".
@@ -179,15 +198,136 @@ module Rubino
         end
       end
 
+      # Heads that are otherwise allowlistable but can still WRITE or EXEC
+      # through trailing flags (git --output, find -exec/-delete/-fprintf,
+      # date -s, tree -o, sort -o, tar --to-command). The user command allowlist
+      # reuses this to vet the flags of a matched entry, so an allowlisted head
+      # (e.g. `git diff`) can never smuggle an arbitrary write via `--output`.
+      FLAG_VETTED_HEADS = (["git"] + FORBIDDEN_FLAGS.keys).freeze
+
+      # True when `tokens` (a single already-split, non-chained segment whose
+      # head matched a user allowlist entry) must NOT be auto-approved because
+      # the head can WRITE or EXEC arbitrary code with these arguments. An
+      # allowlist entry pre-approves the EXACT read-only intent of a head, never
+      # a smuggled write/exec form. Pure inspection; it does NOT require the
+      # command to be read-only overall (an allowlist entry is user-chosen), it
+      # only rejects the forms that turn a read into a write/exec.
+      #
+      #   - CODE_EXEC_HEADS (awk/sed/perl/python/tar/tee/xargs/...) are
+      #     default-denied outright: their argument IS a program (or pipes to a
+      #     shell), so `awk 'BEGIN{system("…")}'`, `sed -e '…'`, `tar
+      #     --to-command=sh` can't be made provably safe by flag inspection
+      #     (SEC-R2-2);
+      #   - git is screened for BOTH global flags before the subcommand
+      #     (`-c alias.X=!cmd`, `-c core.sshCommand=…`, `-C dir`, `--exec-path`)
+      #     and a code-loading/writing subcommand (`apply`, `am`, hooks, …) and
+      #     the --output/-o write flag (SEC-R2-1);
+      #   - the remaining FORBIDDEN_FLAGS heads (find/date/tree/sort/...) are
+      #     screened for their specific write/exec flags.
+      def dangerous_flags?(tokens)
+        head = tokens.first
+        return true if CODE_EXEC_HEADS.include?(head)
+        return false unless FLAG_VETTED_HEADS.include?(head)
+
+        if head == "git"
+          dangerous_git?(tokens)
+        else
+          !safe_flags?(head, tokens)
+        end
+      end
+
+      # Git GLOBAL flags (between `git` and the subcommand) that load or run
+      # arbitrary code, and the dangerous subcommands an allowlisted bare `git`
+      # would otherwise pre-approve. None of these belong to a read-only git
+      # intent, so an allowlisted git head carrying any of them is rejected.
+      #
+      #   -c <name>=<val> / -c<name>=<val>   sets config for this invocation; the
+      #     load-bearing ones are alias.* (a `!cmd` alias = RCE), core.sshCommand,
+      #     core.pager, core.editor, core.hooksPath, core.fsmonitor,
+      #     uploadpack/receivepack.* — all run a command. We reject -c entirely
+      #     for an auto-approved git: a read-only git never needs per-call config.
+      #   --config-env=<name>=<envvar>       sets config like -c, sourcing the
+      #     VALUE from an environment variable (so `--config-env=alias.x=PWNVAR`
+      #     with PWNVAR='!cmd' is the same RCE as `-c alias.x='!cmd'`). Rejected
+      #     for the same reason as -c (SEC-R3-1).
+      #   --attr-source=<tree>               reads .gitattributes from an
+      #     arbitrary tree-ish; not config, but never part of a read-only intent,
+      #     so rejected too (SEC-R3-1).
+      #   -C <path> / --exec-path[=path]     changes the working dir / git's exec
+      #     path (which can point git at attacker binaries).
+      GIT_GLOBAL_EXEC_FLAGS = %w[
+        -c --config-env --exec-path --git-dir --work-tree --namespace --attr-source -C
+      ].freeze
+
+      # Subcommands that mutate the working tree / apply attacker-supplied data /
+      # run hooks, never part of a read-only intent. An allowlisted git head must
+      # not pre-approve them even though they don't start with `-`.
+      GIT_DANGEROUS_SUBCOMMANDS = %w[
+        apply am rebase merge cherry-pick revert reset checkout switch restore
+        clean stash push pull fetch clone commit hook filter-branch
+        update-index update-ref symbolic-ref config send-email daemon
+      ].freeze
+
+      # True when a git invocation whose head matched an allowlist entry carries
+      # a code-loading global flag, a dangerous subcommand, or an output-writing
+      # flag. Scans the GLOBAL flag region (before the subcommand) AND the rest.
+      def dangerous_git?(tokens)
+        rest = tokens.drop(1)
+        # Global flag region: everything up to the first non-flag token (the
+        # subcommand). `-c name=val` / `-C path` may consume the next token as
+        # their value, so a value that happens to look like a subcommand isn't
+        # mistaken for one.
+        i = 0
+        while i < rest.length
+          tok = rest[i]
+          break unless tok.start_with?("-")
+
+          return true if git_global_exec_flag?(tok)
+
+          # -c / -C / --exec-path take a value as the NEXT token when not glued.
+          i += 1 if %w[-c -C].include?(tok) && !rest[i + 1].nil?
+          i += 1
+        end
+
+        sub = rest[i]
+        return true if sub && GIT_DANGEROUS_SUBCOMMANDS.include?(sub)
+
+        git_write_flag?(rest.drop(i + 1))
+      end
+
+      # A global-flag token matches when it is the exact flag (`-c`,
+      # `--exec-path`), its `flag=value` form (`--exec-path=/x`), or a glued
+      # short form (`-cNAME=VAL`, `-Cpath`).
+      def git_global_exec_flag?(tok)
+        GIT_GLOBAL_EXEC_FLAGS.any? do |f|
+          tok == f ||
+            tok.start_with?("#{f}=") ||
+            (f.length == 2 && f.start_with?("-") && !f.start_with?("--") && tok.start_with?(f) && tok.length > 2)
+        end
+      end
+
+      # Git flags that write the output to an arbitrary file:
+      #   --output <file> / --output=<file>  (git diff/log/show/format-patch)
+      #   -o <file> / -o<file>               (short form, git log/format-patch)
+      # `-O<orderfile>` reads an orderfile (no write) but is rejected too, so a
+      # short-flag write form can never slip through ambiguity. Matched on the
+      # whole rest of the segment (token or `flag=value` / glued `-oFILE`).
+      def git_write_flag?(rest)
+        rest.any? do |t|
+          t == "--output" || t.start_with?("--output=", "-o", "-O")
+        end
+      end
+
       # Read-only git: a safe subcommand (no global flags before it — `git -C`
-      # falls to the prompt), never --output (git log/diff/show can write a
-      # file with it), branch/remote in their pure listing forms only.
+      # falls to the prompt), never an output-writing flag (git log/diff/show
+      # can write a file with --output/-o), branch/remote in their pure
+      # listing forms only.
       def safe_git?(tokens)
         sub = tokens[1]
         return false if sub.nil? || sub.start_with?("-")
 
         rest = tokens.drop(2)
-        return false if rest.any? { |t| t == "--output" || t.start_with?("--output=") }
+        return false if git_write_flag?(rest)
 
         case sub
         when *GIT_READONLY_SUBCOMMANDS then true

data/lib/rubino/security/secret_path.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Rubino
+  module Security
+    # ONE "is this a secret/credential path?" predicate, shared by the tool
+    # layer (read/grep/glob refuse to leak; write/edit refuse to clobber) and
+    # the approval layer (Security::ApprovalPolicy#decide → :ask). Previously
+    # the read side and the write side carried two parallel denylists; the
+    # maintainer decision (#446) is that reading OR writing a secret both
+    # require the SAME explicit user approval over the SAME set — so the set
+    # and the predicate live here, once.
+    #
+    # The gate itself is in ApprovalPolicy/ToolExecutor (interactive →
+    # approval dropdown; approved → tool proceeds; denied → refused; headless →
+    # fails closed). This module is pure detection — it never prompts, blocks,
+    # or touches IO beyond symlink resolution.
+    module SecretPath
+      module_function
+
+      # Credential/secret BASENAMES, in any directory.
+      BASENAME_RE = /
+        \A\.env(\..+)?\z | \A\.envrc\z |
+        \A\.netrc\z | \A\.pgpass\z | \A\.npmrc\z | \A\.pypirc\z |
+        \A\.git-credentials\z |
+        \A\.bashrc\z | \A\.zshrc\z | \A\.profile\z | \A\.bash_profile\z | \A\.zprofile\z
+      /x
+
+      # Home-relative credential subtrees (resolved against $HOME).
+      HOME_PREFIXES = [
+        ".ssh", ".aws", ".gnupg", ".kube", ".docker", ".azure",
+        ".config/gh", ".config/gcloud"
+      ].freeze
+
+      # Absolute system paths / prefixes.
+      SYSTEM_PATHS    = ["/etc/sudoers", "/etc/passwd", "/etc/shadow"].freeze
+      SYSTEM_PREFIXES = ["/etc/sudoers.d", "/etc/systemd"].freeze
+
+      # Returns the matched-secret category string (truthy) for a secret path,
+      # or nil for a normal file. `path` may be relative or absolute; it is
+      # resolved through every symlink first so an in-workspace link to ~/.ssh
+      # can't slip past the basename/prefix checks.
+      def category(path)
+        base   = File.basename(path.to_s)
+        target = canonical_path(path) || File.expand_path(path.to_s)
+
+        return "credential file (#{base})" if base.match?(BASENAME_RE)
+        if (cat = denied_path_category(target, base))
+          return cat
+        end
+
+        agent_home_category(path, base, target)
+      end
+
+      # True when `path` is a secret. Thin boolean wrapper over #category.
+      def secret?(path)
+        !category(path).nil?
+      end
+
+      # Absolute-path / prefix matches (SSH keys, cloud creds, /etc system
+      # files), compared against the symlink-resolved target.
+      def denied_path_category(target, base)
+        home = File.expand_path("~")
+        HOME_PREFIXES.each do |rel|
+          return "credential directory (~/#{rel})" if under_path?(target, File.join(home, rel))
+        end
+        return "system file (#{base})" if SYSTEM_PATHS.include?(target)
+
+        SYSTEM_PREFIXES.each do |prefix|
+          return "system path (#{prefix})" if under_path?(target, prefix)
+        end
+        nil
+      end
+
+      # Agent-home (~/.rubino) auth/secret material: the home .env, the token
+      # store sqlite DB, *oauth* files, mcp-tokens/, and *.key/*.pem material.
+      def agent_home_category(path, base, target)
+        return unless under_agent_home?(path)
+
+        lower = target.downcase
+        return unless base == ".env" || base.match?(BASENAME_RE) ||
+                      base == "rubino.sqlite3" || base.end_with?(".sqlite3") ||
+                      lower.include?("oauth") || lower.include?("/mcp-tokens/") ||
+                      base.end_with?(".key") || base.end_with?(".pem")
+
+        "agent-home secret (#{base})"
+      end
+
+      # True when +target+ is +root+ itself or sits under it.
+      def under_path?(target, root)
+        target == root || target.start_with?("#{root}#{File::SEPARATOR}")
+      end
+
+      # Resolves `path` through every symlink to its canonical destination,
+      # re-joining the missing tail for a not-yet-created target. Mirrors
+      # Tools::Base#canonical_path so the write-creates-new-file flow resolves
+      # to the same place the tool will write.
+      def canonical_path(path)
+        return nil if path.nil? || path.to_s.empty?
+
+        expanded = File.expand_path(path.to_s)
+        return File.realpath(expanded) if File.exist?(expanded)
+
+        ancestor = expanded
+        tail     = []
+        until File.exist?(ancestor)
+          parent = File.dirname(ancestor)
+          break if parent == ancestor
+
+          tail.unshift(File.basename(ancestor))
+          ancestor = parent
+        end
+        return nil unless File.exist?(ancestor)
+
+        File.join(File.realpath(ancestor), *tail)
+      rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+        nil
+      end
+
+      # True when `path` resolves under the Rubino home directory.
+      def under_agent_home?(path)
+        home = Rubino.home_path
+        return false if home.nil? || home.to_s.empty?
+
+        home_real   = (File.realpath(home) if File.exist?(home)) || File.expand_path(home)
+        target_real = canonical_path(path)
+        return false unless target_real
+
+        target_real == home_real || target_real.start_with?("#{home_real}#{File::SEPARATOR}")
+      rescue StandardError
+        false
+      end
+    end
+  end
+end