@aitne/daemon 0.1.8 → 0.1.10

package/dist/safety/always-disallowed.d.ts

@@ -36,7 +36,7 @@
  * are matched as shell-command globs, Read/Write/Edit arguments as path
  * globs.
  */
-export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification"];
+export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(rm -rf /*)", "Bash(rm -rf ~*)", "Bash(rm -rf .*)", "Bash(rm -r *)", "Bash(rm -rf*)", "Bash(rm -rv*)", "Bash(rm -ri*)", "Bash(rm -rd*)", "Bash(rm -rI*)", "Bash(rm -fr*)", "Bash(rm -vr*)", "Bash(rm -ir*)", "Bash(rm -dr*)", "Bash(rm -Ir*)", "Bash(rm -R*)", "Bash(rm -fR*)", "Bash(rm -vR*)", "Bash(rm -iR*)", "Bash(rm -dR*)", "Bash(rm -IR*)", "Bash(rm --recursive*)", "Bash(rm --force --recursive*)", "Bash(rm --recursive --force*)", "Bash(sudo *)", "Bash(doas *)", "Bash(su *)", "Bash(curl * | sh*)", "Bash(curl * | bash*)", "Bash(wget * | sh*)", "Bash(wget * | bash*)", "Bash(bash <(*)*)", "Bash(sh <(*)*)", "Bash(bash<*)", "Bash(sh<*)", "Bash(eval *)", "Bash(source *)", "Bash(security *)", "Bash(secret-tool *)", "Bash(cmdkey *)", "Bash(certutil *)", "Bash(rundll32.exe *)", "Read(.env)", "Read(.env.*)", "Read(**/.env)", "Read(**/.env.*)", "Read(id_rsa*)", "Read(id_ed25519*)", "Read(~/.ssh/**)", "Read(~/.gnupg/**)", "Read(~/.aws/**)", "Read(~/.config/gcloud/**)", "Read(~/.config/gh/hosts.yml)", "Read(~/.netrc)", "Read(~/Library/Keychains/**)", "Read(~/.local/share/keyrings/**)", "Read(~/.personal-agent/backups/**)", "Read(~/.personal-agent/whatsapp/auth/**)", "Read(~/.personal-agent/secrets/**)", "Read(~/.claude/.credentials.json)", "Read(~/.claude.json)", "Read(~/.codex/auth.json)", "Read(~/.gemini/gemini-credentials.json)", "Read(~/.gemini/oauth_creds.json)", "Read(~/.config/anthropic/**)", "Write(.env)", "Edit(.env)", "Write(.env.*)", "Edit(.env.*)", "Write(**/.env)", "Edit(**/.env)", "Write(**/.env.*)", "Edit(**/.env.*)", "Write(id_rsa*)", "Edit(id_rsa*)", "Write(id_ed25519*)", "Edit(id_ed25519*)", "Write(~/.ssh/**)", "Edit(~/.ssh/**)", "Write(~/.gnupg/**)", "Edit(~/.gnupg/**)", "Write(~/.aws/**)", "Edit(~/.aws/**)", "Write(~/.config/gcloud/**)", "Edit(~/.config/gcloud/**)", "Write(~/.config/gh/hosts.yml)", "Edit(~/.config/gh/hosts.yml)", "Write(~/.netrc)", "Edit(~/.netrc)", "Write(~/Library/Keychains/**)", "Edit(~/Library/Keychains/**)", "Write(~/.local/share/keyrings/**)", "Edit(~/.local/share/keyrings/**)", "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)", "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)", "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)", "Write(~/.claude/.credentials.json)", "Edit(~/.claude/.credentials.json)", "Write(~/.claude.json)", "Edit(~/.claude.json)", "Write(~/.codex/auth.json)", "Edit(~/.codex/auth.json)", "Write(~/.gemini/gemini-credentials.json)", "Edit(~/.gemini/gemini-credentials.json)", "Write(~/.gemini/oauth_creds.json)", "Edit(~/.gemini/oauth_creds.json)", "Write(~/.config/anthropic/**)", "Edit(~/.config/anthropic/**)", "Bash(sqlite3 *)", "Bash(cp ~/Library/Application Support/Google/Chrome/*)", "Bash(cp ~/Library/Application Support/Chromium/*)", "Bash(cp ~/Library/Application Support/Microsoft Edge/*)", "Bash(cp ~/Library/Application Support/BraveSoftware/*)", "Bash(cp ~/Library/Application Support/Comet/*)", "Bash(cp ~/Library/Application Support/Perplexity Comet/*)", "Bash(cp ~/Library/Application Support/com.openai.atlas/*)", "Bash(cp ~/.config/google-chrome/*)", "Bash(cp ~/.config/chromium/*)", "Bash(cp ~/.config/microsoft-edge/*)", "Bash(cp ~/.config/BraveSoftware/*)", "Bash(cp ~/.config/Comet/*)", "Bash(cp ~/.var/app/com.google.Chrome/*)", "Bash(cp /mnt/c/Users/*)", "Bash(curl file://*)", "Read(~/Library/Application Support/Google/Chrome/**)", "Read(~/Library/Application Support/Chromium/**)", "Read(~/Library/Application Support/Microsoft Edge/**)", "Read(~/Library/Application Support/BraveSoftware/**)", "Read(~/Library/Application Support/Comet/**)", "Read(~/Library/Application Support/Perplexity Comet/**)", "Read(~/Library/Application Support/com.openai.atlas/**)", "Read(~/.config/google-chrome/**)", "Read(~/.config/chromium/**)", "Read(~/.config/microsoft-edge/**)", "Read(~/.config/BraveSoftware/**)", "Read(~/.config/Comet/**)", "Read(~/.var/app/com.google.Chrome/**)", "Read(/mnt/c/Users/**)", "Write(~/Library/Application Support/Google/Chrome/**)", "Edit(~/Library/Application Support/Google/Chrome/**)", "Write(~/Library/Application Support/Chromium/**)", "Edit(~/Library/Application Support/Chromium/**)", "Write(~/Library/Application Support/Microsoft Edge/**)", "Edit(~/Library/Application Support/Microsoft Edge/**)", "Write(~/Library/Application Support/BraveSoftware/**)", "Edit(~/Library/Application Support/BraveSoftware/**)", "Write(~/Library/Application Support/Comet/**)", "Edit(~/Library/Application Support/Comet/**)", "Write(~/Library/Application Support/Perplexity Comet/**)", "Edit(~/Library/Application Support/Perplexity Comet/**)", "Write(~/Library/Application Support/com.openai.atlas/**)", "Edit(~/Library/Application Support/com.openai.atlas/**)", "Write(~/.config/google-chrome/**)", "Edit(~/.config/google-chrome/**)", "Write(~/.config/chromium/**)", "Edit(~/.config/chromium/**)", "Write(~/.config/microsoft-edge/**)", "Edit(~/.config/microsoft-edge/**)", "Write(~/.config/BraveSoftware/**)", "Edit(~/.config/BraveSoftware/**)", "Write(~/.config/Comet/**)", "Edit(~/.config/Comet/**)", "Write(~/.var/app/com.google.Chrome/**)", "Edit(~/.var/app/com.google.Chrome/**)", "Write(/mnt/c/Users/**)", "Edit(/mnt/c/Users/**)", "Bash(cp ~/.personal-agent/chromium-*)", "Bash(mv ~/.personal-agent/chromium-*)", "Bash(tar ~/.personal-agent/chromium-*)", "Bash(zip ~/.personal-agent/chromium-*)", "Bash(rsync ~/.personal-agent/chromium-*)", "Bash(cp $HOME/.personal-agent/chromium-*)", "Bash(mv $HOME/.personal-agent/chromium-*)", "Bash(tar $HOME/.personal-agent/chromium-*)", "Bash(zip $HOME/.personal-agent/chromium-*)", "Bash(rsync $HOME/.personal-agent/chromium-*)", "Read(~/.personal-agent/chromium-sync/**)", "Read(~/.personal-agent/chromium-automation/**)", "Read(~/.personal-agent/chromium-automation-anon/**)", "Read(~/.personal-agent/chromium-automation-auth/**)", "Read(~/.personal-agent/chromium-automation-purchase/**)", "Write(~/.personal-agent/chromium-sync/**)", "Edit(~/.personal-agent/chromium-sync/**)", "Write(~/.personal-agent/chromium-automation/**)", "Edit(~/.personal-agent/chromium-automation/**)", "Write(~/.personal-agent/chromium-automation-anon/**)", "Edit(~/.personal-agent/chromium-automation-anon/**)", "Write(~/.personal-agent/chromium-automation-auth/**)", "Edit(~/.personal-agent/chromium-automation-auth/**)", "Write(~/.personal-agent/chromium-automation-purchase/**)", "Edit(~/.personal-agent/chromium-automation-purchase/**)", "CronCreate", "CronList", "CronDelete", "RemoteTrigger", "PushNotification"];
 /**
  * Structured classification of an attempted command or path against the
  * absolute-block list, used by the §6.3 audit path.
@@ -47,7 +47,7 @@ export declare const ALWAYS_DISALLOWED_TOOLS: readonly ["Bash(rm -rf *)", "Bash(
  * observability, and the SDK-level `disallowedTools` rejection remains
  * the authoritative block regardless of what this classifier says.
  */
-export type AbsoluteBlockCategory = "recursive_delete" | "privilege_escalation" | "pipe_to_shell" | "secret_cli" | "secret_read" | "secret_write";
+export type AbsoluteBlockCategory = "recursive_delete" | "privilege_escalation" | "pipe_to_shell" | "secret_cli" | "secret_read" | "secret_write" | "browser_profile" | "purchase_token_echo";
 export interface AbsoluteBlockMatch {
     category: AbsoluteBlockCategory;
     /** Redacted form of the offending arg — path for Read/Write, first token for Bash. */
@@ -119,6 +119,55 @@ export interface AbsoluteBlockMatch {
 export declare function stripBashHeredocs(cmd: string): string;
 export declare function stripBashStringContent(cmd: string): string;
 export declare function classifyAbsoluteBlock(toolName: string, rawArg: string | undefined): AbsoluteBlockMatch | null;
+/**
+ * Substring scan for shell commands that read a known secret-file
+ * path via a file-reader command. Mirrors `looksLikeBashSecretRead`'s
+ * sibling pattern for browser-profile paths — runs on the
+ * single-quote/heredoc-stripped command and matches case-insensitively
+ * to close the same macOS/Windows FS bypass that `looksLikeSecretPath`
+ * closes for Read/Write/Edit args.
+ *
+ * Detection shape: the command's first executable token is in
+ * `SECRET_READ_BASH_COMMANDS` (`cat` / `less` / `head` / `xxd` / …) AND
+ * the rest of the command contains a recognised secret-file fragment
+ * (`.ssh/`, `~/.aws/`, `.env`-extension, `/library/keychains/`, …).
+ * Skipping the command anchor would over-block on innocent prose like
+ * `echo "see ~/.ssh/config for details"`; pinning the reader keeps the
+ * false-positive surface to commands that actually exfiltrate the file.
+ *
+ * NOT a substitute for the Read-tool glob list — that layer remains
+ * the authoritative block for the Read tool. This helper closes the
+ * Bash-side hole the glob list cannot express.
+ */
+export declare function looksLikeBashSecretRead(cmd: string): boolean;
+/**
+ * Substring scan for shell commands that touch a browser profile
+ * directory. Independent of the prefix-glob matcher — runs on the
+ * stripped command line (single-quoted contents + heredocs already
+ * collapsed by `stripBashStringContent`) and matches case-insensitively.
+ *
+ * Exported so the per-backend tool hook (Claude PreToolUse, Gemini
+ * admin policy translator) can mirror the same coverage. The substring
+ * set is closed: it lists the parent directories every supported
+ * browser writes its profile under, plus the profile-specific
+ * filenames Chromium uses for high-value tokens.
+ */
+export declare function looksLikeBrowserProfileBash(cmd: string): boolean;
+/**
+ * Path-shape sibling of `looksLikeBrowserProfileBash` for the
+ * `Read(...)` / `Write(...)` / `Edit(...)` tool arg. The prefix-glob
+ * layer covers canonical paths; this catches Windows-style paths and
+ * encoded forms that the glob matcher's POSIX-only patterns miss.
+ */
+export declare function looksLikeBrowserProfilePath(raw: string): boolean;
+/**
+ * Convenience wrapper used by per-backend tool hooks. Identical
+ * coverage to `looksLikeBrowserProfileBash` + `looksLikeBrowserProfilePath`
+ * — re-exposed under the name the implementation plan uses
+ * (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11) so PreToolUse hooks
+ * can import a single function.
+ */
+export declare function classifyChromiumTokenAccess(toolName: string, rawArg: string | undefined): AbsoluteBlockMatch | null;
 /**
  * Return true when `raw` looks like a path to a credential / secret file.
  *
@@ -126,6 +175,14 @@ export declare function classifyAbsoluteBlock(toolName: string, rawArg: string |
  * read-side denylist enforcement) can mirror this layer without
  * duplicating the pattern table — see
  * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
+ *
+ * Patterns match **case-insensitively** to close a bypass on case-
+ * insensitive filesystems (macOS default, Windows): an agent that submits
+ * `Read("~/.SSH/id_rsa")` resolves to the real `~/.ssh/id_rsa` on disk
+ * and would otherwise sidestep the absolute-block audit because the
+ * SDK's minimatch glob (`Read(~/.ssh/**)`) is case-sensitive. Mirrors
+ * the `.toLowerCase()`-on-input strategy already used by
+ * `looksLikeBrowserProfilePath`.
  */
 export declare function looksLikeSecretPath(raw: string): boolean;
 /**
@@ -162,4 +219,3 @@ export declare function buildOpencodeAbsoluteBlockPermission(): {
     };
     warnings: string[];
 };
-//# sourceMappingURL=always-disallowed.d.ts.map

package/dist/safety/always-disallowed.js

@@ -156,6 +156,14 @@ export const ALWAYS_DISALLOWED_TOOLS = [
     "Bash(security *)", // macOS Keychain CLI
     "Bash(secret-tool *)", // Linux libsecret CLI
     "Bash(cmdkey *)", // Windows Credential Manager CLI
+    // Windows DPAPI / vault abuse — MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md
+    // §7.11 lists `certutil` (cert + dpapi blob export) and `rundll32.exe`
+    // (loads vault.dll / cryptui.dll for credential dumping). No legitimate
+    // Aitne skill invokes either; blanket-deny so a Windows owner running
+    // allow mode cannot dump credentials via the same vectors macOS/Linux
+    // already block with the `security`/`secret-tool` entries above.
+    "Bash(certutil *)", // Windows DPAPI / cert export
+    "Bash(rundll32.exe *)", // Windows vault.dll / dpapi abuse
     // ── Secret-file reads ──
     "Read(.env)",
     "Read(.env.*)",
@@ -178,6 +186,22 @@ export const ALWAYS_DISALLOWED_TOOLS = [
     "Read(~/.personal-agent/backups/**)",
     "Read(~/.personal-agent/whatsapp/auth/**)",
     "Read(~/.personal-agent/secrets/**)",
+    // ── Backend CLI credential files ──
+    // The agent's own Claude / Codex / Gemini OAuth tokens. The daemon
+    // reads these itself (claude-credentials-store.ts, codex-core.ts:377,
+    // gemini-cli-core.ts:488) to drive auth-health recovery, but the agent
+    // must never reach around to lift the long-lived refresh token for its
+    // own — or a sibling — backend and exfiltrate it through the sanctioned
+    // curl-to-localhost write path. On macOS the Claude token lives in the
+    // Keychain (covered by `~/Library/Keychains/**` above); these are the
+    // Linux/Windows plaintext fallback (Claude) and the all-platform
+    // plaintext stores (Codex `auth.json`, Gemini OAuth json).
+    "Read(~/.claude/.credentials.json)",
+    "Read(~/.claude.json)",
+    "Read(~/.codex/auth.json)",
+    "Read(~/.gemini/gemini-credentials.json)",
+    "Read(~/.gemini/oauth_creds.json)",
+    "Read(~/.config/anthropic/**)",
     // ── Secret-file writes ──
     // Kept symmetrical to the read list — an agent that can WRITE .env or
     // ~/.ssh/authorized_keys can leak via its own exfil channel even without
@@ -200,6 +224,111 @@ export const ALWAYS_DISALLOWED_TOOLS = [
     "Write(~/.personal-agent/backups/**)", "Edit(~/.personal-agent/backups/**)",
     "Write(~/.personal-agent/whatsapp/auth/**)", "Edit(~/.personal-agent/whatsapp/auth/**)",
     "Write(~/.personal-agent/secrets/**)", "Edit(~/.personal-agent/secrets/**)",
+    // Backend CLI credential files (symmetric twins of the read block above —
+    // an agent that can overwrite a token store can plant/replace credentials,
+    // which is strictly worse than reading them).
+    "Write(~/.claude/.credentials.json)", "Edit(~/.claude/.credentials.json)",
+    "Write(~/.claude.json)", "Edit(~/.claude.json)",
+    "Write(~/.codex/auth.json)", "Edit(~/.codex/auth.json)",
+    "Write(~/.gemini/gemini-credentials.json)", "Edit(~/.gemini/gemini-credentials.json)",
+    "Write(~/.gemini/oauth_creds.json)", "Edit(~/.gemini/oauth_creds.json)",
+    "Write(~/.config/anthropic/**)", "Edit(~/.config/anthropic/**)",
+    // ── Browser-history profile directories (BROWSER_HISTORY_INTEGRATION_PLAN §11.4) ──
+    // The browser-history integration's threat model assumes the agent
+    // never reads raw browser profile files directly — all access goes
+    // through the daemon's `curl http://localhost:8321/api/browser-history/*`
+    // chokepoint. These prefix-only patterns deny the canonical shell
+    // exfiltration idioms (cp / sqlite3 / Read / curl file://). Encoded /
+    // shell-expanded forms (`$HOME/Library/...`, backtick-expanded paths)
+    // fall through to the `classifyBrowserProfileAccess` substring scan
+    // below, which is independent of the prefix-glob matcher and runs in
+    // every backend's PreToolUse layer.
+    "Bash(sqlite3 *)",
+    "Bash(cp ~/Library/Application Support/Google/Chrome/*)",
+    "Bash(cp ~/Library/Application Support/Chromium/*)",
+    "Bash(cp ~/Library/Application Support/Microsoft Edge/*)",
+    "Bash(cp ~/Library/Application Support/BraveSoftware/*)",
+    // Comet's real macOS user-data dir is vendorless "Comet" (see
+    // platform.ts comet.macProfileRoots). The legacy "Perplexity Comet"
+    // guard below never matched a path that exists, leaving the real
+    // profile unprotected — keep both.
+    "Bash(cp ~/Library/Application Support/Comet/*)",
+    "Bash(cp ~/Library/Application Support/Perplexity Comet/*)",
+    "Bash(cp ~/Library/Application Support/com.openai.atlas/*)",
+    "Bash(cp ~/.config/google-chrome/*)",
+    "Bash(cp ~/.config/chromium/*)",
+    "Bash(cp ~/.config/microsoft-edge/*)",
+    "Bash(cp ~/.config/BraveSoftware/*)",
+    "Bash(cp ~/.config/Comet/*)",
+    "Bash(cp ~/.var/app/com.google.Chrome/*)",
+    "Bash(cp /mnt/c/Users/*)",
+    "Bash(curl file://*)",
+    "Read(~/Library/Application Support/Google/Chrome/**)",
+    "Read(~/Library/Application Support/Chromium/**)",
+    "Read(~/Library/Application Support/Microsoft Edge/**)",
+    "Read(~/Library/Application Support/BraveSoftware/**)",
+    "Read(~/Library/Application Support/Comet/**)",
+    "Read(~/Library/Application Support/Perplexity Comet/**)",
+    "Read(~/Library/Application Support/com.openai.atlas/**)",
+    "Read(~/.config/google-chrome/**)",
+    "Read(~/.config/chromium/**)",
+    "Read(~/.config/microsoft-edge/**)",
+    "Read(~/.config/BraveSoftware/**)",
+    "Read(~/.config/Comet/**)",
+    "Read(~/.var/app/com.google.Chrome/**)",
+    "Read(/mnt/c/Users/**)",
+    // Symmetric Write/Edit twins — the Read/Write symmetry invariant
+    // (security.test.ts) requires every Read(...) pattern carry matching
+    // Write(...) + Edit(...) entries so an agent that cannot read the
+    // file also cannot overwrite it (credential injection / token
+    // replacement is strictly worse than read).
+    "Write(~/Library/Application Support/Google/Chrome/**)", "Edit(~/Library/Application Support/Google/Chrome/**)",
+    "Write(~/Library/Application Support/Chromium/**)", "Edit(~/Library/Application Support/Chromium/**)",
+    "Write(~/Library/Application Support/Microsoft Edge/**)", "Edit(~/Library/Application Support/Microsoft Edge/**)",
+    "Write(~/Library/Application Support/BraveSoftware/**)", "Edit(~/Library/Application Support/BraveSoftware/**)",
+    "Write(~/Library/Application Support/Comet/**)", "Edit(~/Library/Application Support/Comet/**)",
+    "Write(~/Library/Application Support/Perplexity Comet/**)", "Edit(~/Library/Application Support/Perplexity Comet/**)",
+    "Write(~/Library/Application Support/com.openai.atlas/**)", "Edit(~/Library/Application Support/com.openai.atlas/**)",
+    "Write(~/.config/google-chrome/**)", "Edit(~/.config/google-chrome/**)",
+    "Write(~/.config/chromium/**)", "Edit(~/.config/chromium/**)",
+    "Write(~/.config/microsoft-edge/**)", "Edit(~/.config/microsoft-edge/**)",
+    "Write(~/.config/BraveSoftware/**)", "Edit(~/.config/BraveSoftware/**)",
+    "Write(~/.config/Comet/**)", "Edit(~/.config/Comet/**)",
+    "Write(~/.var/app/com.google.Chrome/**)", "Edit(~/.var/app/com.google.Chrome/**)",
+    "Write(/mnt/c/Users/**)", "Edit(/mnt/c/Users/**)",
+    // ── Managed Chromium profile directories (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11) ──
+    // The daemon-owned Chromium profile dirs under PA_DATA_DIR. Agent
+    // memory writes to `chromium-sync/` would corrupt the OAuth refresh
+    // token; reads would let an LLM-driven exfiltration attack lift the
+    // token out. The chokepoint is the `/api/browser-history/managed/*`
+    // API; the absolute-block layer prevents the agent from reaching
+    // around it.
+    //
+    // PA_DATA_DIR defaults to `~/.personal-agent/` but is operator-
+    // overridable. The prefix globs below hard-code the default; the
+    // substring fallback (`looksLikeBrowserProfileBash` / `…Path` —
+    // extended in the same edit) catches non-default PA_DATA_DIR
+    // installs and encoded forms.
+    "Bash(cp ~/.personal-agent/chromium-*)",
+    "Bash(mv ~/.personal-agent/chromium-*)",
+    "Bash(tar ~/.personal-agent/chromium-*)",
+    "Bash(zip ~/.personal-agent/chromium-*)",
+    "Bash(rsync ~/.personal-agent/chromium-*)",
+    "Bash(cp $HOME/.personal-agent/chromium-*)",
+    "Bash(mv $HOME/.personal-agent/chromium-*)",
+    "Bash(tar $HOME/.personal-agent/chromium-*)",
+    "Bash(zip $HOME/.personal-agent/chromium-*)",
+    "Bash(rsync $HOME/.personal-agent/chromium-*)",
+    "Read(~/.personal-agent/chromium-sync/**)",
+    "Read(~/.personal-agent/chromium-automation/**)",
+    "Read(~/.personal-agent/chromium-automation-anon/**)",
+    "Read(~/.personal-agent/chromium-automation-auth/**)",
+    "Read(~/.personal-agent/chromium-automation-purchase/**)",
+    "Write(~/.personal-agent/chromium-sync/**)", "Edit(~/.personal-agent/chromium-sync/**)",
+    "Write(~/.personal-agent/chromium-automation/**)", "Edit(~/.personal-agent/chromium-automation/**)",
+    "Write(~/.personal-agent/chromium-automation-anon/**)", "Edit(~/.personal-agent/chromium-automation-anon/**)",
+    "Write(~/.personal-agent/chromium-automation-auth/**)", "Edit(~/.personal-agent/chromium-automation-auth/**)",
+    "Write(~/.personal-agent/chromium-automation-purchase/**)", "Edit(~/.personal-agent/chromium-automation-purchase/**)",
     // ── Anthropic-cloud managed/scheduled agents ──
     // Aitne is local-first by design: scheduling lives in `agent_schedule` +
     // `recurring_schedules` and is driven by the daemon's own cron. The Claude
@@ -306,10 +435,46 @@ export function stripBashStringContent(cmd) {
     // are intentionally left in place (see the JSDoc above on why).
     return stripBashHeredocs(cmd).replace(/'[^']*'/g, "''");
 }
+/**
+ * Regex sentinel for the B-4 purchase confirmation token shape —
+ * `!~<8 base32>` (uppercase A-Z + digits 2-7). Used by
+ * `classifyAbsoluteBlock` so any agent-tool arg containing a live (or
+ * stale) token trips a structured `purchase_token_echo` refusal.
+ *
+ * MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7 specifies the regex
+ * verbatim. We keep the embed (non-anchored) form here — the
+ * adapter-side classifier uses the anchored `^…$` form to detect a
+ * full token reply, but the absolute-block layer needs the embed form
+ * because an attacker echo could happen as a substring of a larger
+ * Bash arg (e.g. `curl -d '{"note":"!~AAAAAAAA"}' …`). Matching
+ * embedded covers both.
+ */
+const PURCHASE_TOKEN_EMBED = /!~[A-Z2-7]{8}/;
+function redactPurchaseTokenMatch(arg) {
+    const m = PURCHASE_TOKEN_EMBED.exec(arg);
+    /* c8 ignore next — guarded by the caller; defensive default */
+    if (!m)
+        return "<redacted-token>";
+    return `${m[0].slice(0, 2)}****${m[0].slice(-3)}`;
+}
 export function classifyAbsoluteBlock(toolName, rawArg) {
     if (!rawArg)
         return null;
     const arg = rawArg.trim();
+    // Purchase-token echo — applies to every tool surface. The agent's
+    // tools must never read / write / echo a `!~xxxxxxxx` token even if a
+    // buggy messaging adapter surfaces one to the conversation log.
+    // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §17.7.
+    if ((toolName === "Bash" ||
+        toolName === "Read" ||
+        toolName === "Write" ||
+        toolName === "Edit") &&
+        PURCHASE_TOKEN_EMBED.test(arg)) {
+        return {
+            category: "purchase_token_echo",
+            redacted: redactPurchaseTokenMatch(arg),
+        };
+    }
     if (toolName === "Bash") {
         // Run every pattern check against the quote/heredoc-stripped form
         // so command-shaped text inside JSON bodies / header values /
@@ -403,25 +568,262 @@ export function classifyAbsoluteBlock(toolName, rawArg) {
             || /\b(?:python|python3|node|deno|perl|ruby|php)\b[^|]*?(?:-c|-e|--eval|--exec)\b[^|]*?\$\([^)]*?\b(?:curl|wget)\b/.test(scan)) {
             return { category: "pipe_to_shell", redacted: firstToken(arg) };
         }
-        if (/(^|\s)(security|secret-tool|cmdkey)\b/.test(scan)) {
+        if (/(^|\s)(security|secret-tool|cmdkey|certutil|rundll32\.exe)\b/.test(scan)) {
             return { category: "secret_cli", redacted: firstToken(arg) };
         }
+        // Bash-side secret-file read (EXECUTION-MODE-DESIGN.md §6, scope
+        // bullet "secret-file reads"). The `Read(~/.ssh/**)` glob layer
+        // only matches the Read tool — without this branch, an agent can
+        // `Bash(cat ~/.ssh/id_rsa)` and silently sidestep both the SDK
+        // glob list AND the absolute-block audit. `SECRET_READ_BASH_COMMANDS`
+        // is the existing reader denylist; here we mirror it for Claude /
+        // Codex (opencode already emits per-reader Bash globs via
+        // `buildOpencodeAbsoluteBlockPermission`).
+        if (looksLikeBashSecretRead(scan)) {
+            return { category: "secret_read", redacted: firstToken(arg) };
+        }
+        // Browser-history profile exfiltration (§11.4). The prefix glob
+        // layer catches the canonical `cp ~/Library/...` / `cp ~/.config/...`
+        // forms; this substring scan catches encoded / shell-expanded
+        // variants the prefix matcher cannot express:
+        //   - $HOME-expanded paths           ($HOME/Library/Application Support/Google/Chrome/...)
+        //   - backtick-substituted paths     (`echo ~/Library/...`)
+        //   - $(echo ...)-substituted paths  ($(echo ~/Library/...))
+        //   - filename keywords that only appear inside a real profile
+        //     directory (`Login Data`, `Cookies`, `Web Data`).
+        // The match is case-insensitive over the quote-stripped command
+        // line. False-positive surface is narrow — no Aitne skill needs to
+        // read these literal substrings; the `browser-history` skill
+        // exclusively talks to `localhost:8321`.
+        if (looksLikeBrowserProfileBash(scan)) {
+            return { category: "browser_profile", redacted: firstToken(arg) };
+        }
         return null;
     }
     if (toolName === "Read") {
         if (looksLikeSecretPath(arg)) {
             return { category: "secret_read", redacted: redactPath(arg) };
         }
+        if (looksLikeBrowserProfilePath(arg)) {
+            return { category: "browser_profile", redacted: redactPath(arg) };
+        }
         return null;
     }
     if (toolName === "Write" || toolName === "Edit") {
         if (looksLikeSecretPath(arg)) {
             return { category: "secret_write", redacted: redactPath(arg) };
         }
+        if (looksLikeBrowserProfilePath(arg)) {
+            return { category: "browser_profile", redacted: redactPath(arg) };
+        }
         return null;
     }
     return null;
 }
+/**
+ * Substring scan for shell commands that read a known secret-file
+ * path via a file-reader command. Mirrors `looksLikeBashSecretRead`'s
+ * sibling pattern for browser-profile paths — runs on the
+ * single-quote/heredoc-stripped command and matches case-insensitively
+ * to close the same macOS/Windows FS bypass that `looksLikeSecretPath`
+ * closes for Read/Write/Edit args.
+ *
+ * Detection shape: the command's first executable token is in
+ * `SECRET_READ_BASH_COMMANDS` (`cat` / `less` / `head` / `xxd` / …) AND
+ * the rest of the command contains a recognised secret-file fragment
+ * (`.ssh/`, `~/.aws/`, `.env`-extension, `/library/keychains/`, …).
+ * Skipping the command anchor would over-block on innocent prose like
+ * `echo "see ~/.ssh/config for details"`; pinning the reader keeps the
+ * false-positive surface to commands that actually exfiltrate the file.
+ *
+ * NOT a substitute for the Read-tool glob list — that layer remains
+ * the authoritative block for the Read tool. This helper closes the
+ * Bash-side hole the glob list cannot express.
+ */
+export function looksLikeBashSecretRead(cmd) {
+    const lc = cmd.toLowerCase();
+    const first = firstToken(lc);
+    // The "executable" we care about is the first token, optionally
+    // stripped of a leading path (`/usr/bin/cat` → `cat`). The reader
+    // set is intentionally narrow — any reader not in the list is an
+    // accepted gap (documented alongside `SECRET_READ_BASH_COMMANDS`).
+    const exec = first.includes("/") ? first.slice(first.lastIndexOf("/") + 1) : first;
+    const isReader = SECRET_READ_BASH_COMMANDS.includes(exec);
+    if (!isReader)
+        return false;
+    // Path fragments that uniquely identify a secret file / directory.
+    // Each fragment is a substring lookup (case-insensitive via the
+    // pre-lowercased `lc`). Mirrors the regex table in
+    // `looksLikeSecretPath` — kept as plain substrings here because we
+    // are scanning an entire command line, not a single path arg.
+    const fragments = [
+        "/.ssh/",
+        "/.ssh ",
+        "/.gnupg/",
+        "/.gnupg ",
+        "/.aws/",
+        "/.aws ",
+        "/.config/gcloud/",
+        "/.config/gh/hosts.yml",
+        "/.netrc",
+        "/library/keychains/",
+        "/.local/share/keyrings/",
+        "/.personal-agent/backups/",
+        "/.personal-agent/whatsapp/auth/",
+        "/.personal-agent/secrets/",
+        // Backend CLI OAuth credential files (Claude / Codex / Gemini).
+        "/.claude/.credentials.json",
+        "/.claude.json",
+        "/.codex/auth.json",
+        "/.gemini/gemini-credentials.json",
+        "/.gemini/oauth_creds.json",
+        "/.config/anthropic/",
+    ];
+    if (fragments.some((f) => lc.includes(f)))
+        return true;
+    // `.env` / `.env.*` — the `looksLikeSecretPath` regex requires `$`
+    // anchor; in a Bash command, the path is followed by a space, pipe,
+    // redirect, or end-of-string. Match each of those bounds explicitly.
+    if (/(?:^|[\s/"'])\.env(?:\.[a-z0-9_-]+)?(?=$|[\s|;&<>"'`])/i.test(cmd)) {
+        return true;
+    }
+    // SSH private keys by basename — caught by a path-segment regex so
+    // `id_rsa_backup` style suffixes that the path classifier
+    // intentionally skips still surface here (the Bash reader context
+    // is unambiguous — `cat id_rsa_backup` is not benign).
+    if (/(?:^|[\s/"'])id_(?:rsa|ed25519|ecdsa|dsa)(?:[\b._-][^\s|;&<>"'`]*)?(?=$|[\s|;&<>"'`])/i.test(cmd)) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Substring scan for shell commands that touch a browser profile
+ * directory. Independent of the prefix-glob matcher — runs on the
+ * stripped command line (single-quoted contents + heredocs already
+ * collapsed by `stripBashStringContent`) and matches case-insensitively.
+ *
+ * Exported so the per-backend tool hook (Claude PreToolUse, Gemini
+ * admin policy translator) can mirror the same coverage. The substring
+ * set is closed: it lists the parent directories every supported
+ * browser writes its profile under, plus the profile-specific
+ * filenames Chromium uses for high-value tokens.
+ */
+export function looksLikeBrowserProfileBash(cmd) {
+    const lc = cmd.toLowerCase();
+    // Browser profile *parent* directories — any of these as a substring
+    // means the agent is reaching into a profile root. eTLD+1-like
+    // matching: the fragment is the OS-specific path prefix the browser
+    // owns; nothing legitimate inside Aitne's surface needs to touch
+    // these directories.
+    const parents = [
+        // macOS Application Support roots
+        "library/application support/google/chrome",
+        "library/application support/chromium",
+        "library/application support/microsoft edge",
+        "library/application support/bravesoftware",
+        "library/application support/comet",
+        "library/application support/perplexity comet",
+        "library/application support/com.openai.atlas",
+        // Linux / XDG roots
+        ".config/google-chrome",
+        ".config/chromium",
+        ".config/microsoft-edge",
+        ".config/bravesoftware",
+        ".config/comet",
+        ".var/app/com.google.chrome",
+        // Windows / WSL
+        "appdata/local/google/chrome",
+        "appdata/local/chromium",
+        "appdata/local/microsoft/edge",
+        "appdata/local/bravesoftware",
+        // Comet on Windows lands under either %LOCALAPPDATA%\Comet\ or
+        // %LOCALAPPDATA%\Perplexity\Comet\ depending on build (see platform.ts).
+        "appdata/local/comet",
+        "appdata/local/perplexity/comet",
+        "/mnt/c/users/",
+        // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11 — the daemon-owned
+        // Chromium profile directories. The path lives under PA_DATA_DIR
+        // which is typically `~/.personal-agent/`, but operators may set
+        // it elsewhere via env var, so we match the trailing component
+        // (which is stable across installs).
+        "chromium-sync",
+        "chromium-automation",
+        "chromium-automation-anon",
+        "chromium-automation-auth",
+        "chromium-automation-purchase",
+    ];
+    if (parents.some((p) => lc.includes(p)))
+        return true;
+    // Chromium profile-internal filename anchors. Each is matched as a
+    // path segment ending the path (or followed by a delimiter
+    // character) so legitimate names like `cookies-policy.md` or
+    // `/api/web-data` do not false-positive. The `\b` style negative
+    // lookahead — `(?=$|[\s"'`)/])` — captures end-of-string, quote
+    // closers, and shell metacharacters that bound a token.
+    const filenameAnchors = [
+        /\/login data(?=$|[\s"'`)>;|&])/,
+        /\/web data(?=$|[\s"'`)>;|&])/,
+        /\/cookies(?=$|[\s"'`)>;|&])/,
+    ];
+    return filenameAnchors.some((r) => r.test(lc));
+}
+/**
+ * Path-shape sibling of `looksLikeBrowserProfileBash` for the
+ * `Read(...)` / `Write(...)` / `Edit(...)` tool arg. The prefix-glob
+ * layer covers canonical paths; this catches Windows-style paths and
+ * encoded forms that the glob matcher's POSIX-only patterns miss.
+ */
+export function looksLikeBrowserProfilePath(raw) {
+    const p = raw.replace(/^["']|["']$/g, "").toLowerCase();
+    const patterns = [
+        /library\/application support\/google\/chrome/,
+        /library\/application support\/chromium/,
+        /library\/application support\/microsoft edge/,
+        /library\/application support\/bravesoftware/,
+        /library\/application support\/comet/,
+        /library\/application support\/perplexity comet/,
+        /library\/application support\/com\.openai\.atlas/,
+        /\.config\/google-chrome/,
+        /\.config\/chromium/,
+        /\.config\/microsoft-edge/,
+        /\.config\/bravesoftware/,
+        /\.config\/comet/,
+        /\.var\/app\/com\.google\.chrome/,
+        /appdata[\\/]local[\\/](google[\\/]chrome|chromium|microsoft[\\/]edge|bravesoftware|comet|perplexity[\\/]comet)/,
+        /\/mnt\/c\/users\//,
+        // MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11 — daemon-owned
+        // Chromium profile dirs under PA_DATA_DIR. The trailing-component
+        // shape catches paths regardless of where PA_DATA_DIR resolves
+        // (default `~/.personal-agent/`, but operators can override).
+        /(?:^|[\\/])chromium-sync(?:[\\/]|$)/,
+        /(?:^|[\\/])chromium-automation(?:[\\/]|$|-)/,
+    ];
+    return patterns.some((r) => r.test(p));
+}
+/**
+ * Convenience wrapper used by per-backend tool hooks. Identical
+ * coverage to `looksLikeBrowserProfileBash` + `looksLikeBrowserProfilePath`
+ * — re-exposed under the name the implementation plan uses
+ * (MANAGED_CHROMIUM_IMPLEMENTATION_PLAN.md §7.11) so PreToolUse hooks
+ * can import a single function.
+ */
+export function classifyChromiumTokenAccess(toolName, rawArg) {
+    if (!rawArg)
+        return null;
+    if (toolName === "Bash") {
+        const scan = stripBashStringContent(rawArg.trim());
+        if (looksLikeBrowserProfileBash(scan)) {
+            return { category: "browser_profile", redacted: firstToken(rawArg.trim()) };
+        }
+        return null;
+    }
+    if (toolName === "Read" || toolName === "Write" || toolName === "Edit") {
+        if (looksLikeBrowserProfilePath(rawArg)) {
+            return { category: "browser_profile", redacted: redactPath(rawArg) };
+        }
+    }
+    return null;
+}
 function firstToken(cmd) {
     const m = cmd.match(/^\s*([^\s;&|]+)/);
     /* c8 ignore start — regex always matches a possibly-empty string; the
@@ -436,23 +838,38 @@ function firstToken(cmd) {
  * read-side denylist enforcement) can mirror this layer without
  * duplicating the pattern table — see
  * `docs/design/appendices/cost-reduction-structural.md` §A "Privacy".
+ *
+ * Patterns match **case-insensitively** to close a bypass on case-
+ * insensitive filesystems (macOS default, Windows): an agent that submits
+ * `Read("~/.SSH/id_rsa")` resolves to the real `~/.ssh/id_rsa` on disk
+ * and would otherwise sidestep the absolute-block audit because the
+ * SDK's minimatch glob (`Read(~/.ssh/**)`) is case-sensitive. Mirrors
+ * the `.toLowerCase()`-on-input strategy already used by
+ * `looksLikeBrowserProfilePath`.
  */
 export function looksLikeSecretPath(raw) {
     // Trim obvious quoting. We deliberately don't resolve `~` / relative
     // paths — the classifier runs against the string the agent passed.
     const p = raw.replace(/^["']|["']$/g, "");
     const patterns = [
-        /(^|\/)\.env(\..+)?$/,
-        /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\b|\.)/,
-        /\.ssh(\/|$)/,
-        /\.gnupg(\/|$)/,
-        /\.aws(\/|$)/,
-        /\.config\/gcloud(\/|$)/,
-        /\.config\/gh\/hosts\.yml$/,
-        /\.netrc$/,
-        /Library\/Keychains(\/|$)/,
-        /\.local\/share\/keyrings(\/|$)/,
-        /\.personal-agent\/(backups|whatsapp\/auth|secrets)(\/|$)/,
+        /(^|\/)\.env(\..+)?$/i,
+        /(^|\/)id_(rsa|ed25519|ecdsa|dsa)(\b|\.)/i,
+        /\.ssh(\/|$)/i,
+        /\.gnupg(\/|$)/i,
+        /\.aws(\/|$)/i,
+        /\.config\/gcloud(\/|$)/i,
+        /\.config\/gh\/hosts\.yml$/i,
+        /\.netrc$/i,
+        /Library\/Keychains(\/|$)/i,
+        /\.local\/share\/keyrings(\/|$)/i,
+        /\.personal-agent\/(backups|whatsapp\/auth|secrets)(\/|$)/i,
+        // Backend CLI OAuth credential files (Claude / Codex / Gemini) +
+        // the Anthropic config dir.
+        /(^|\/)\.claude\.json$/i,
+        /\.claude\/\.credentials\.json$/i,
+        /\.codex\/auth\.json$/i,
+        /\.gemini\/(gemini-credentials|oauth_creds)\.json$/i,
+        /\.config\/anthropic(\/|$)/i,
     ];
     return patterns.some((r) => r.test(p));
 }
@@ -547,4 +964,3 @@ export function buildOpencodeAbsoluteBlockPermission() {
         warnings: [],
     };
 }
-//# sourceMappingURL=always-disallowed.js.map