@bridge4dev/runner 0.68.1 → 0.69.0

package/dist/policy.js

@@ -121,6 +121,50 @@ const SECRET_PATH_PATTERNS = [
     // for. Matching the distinctive `checkpoints/<hash>.git` shape closes it
     // wherever the state directory ends up.
     /(^|\/)checkpoints\/[0-9a-f]{8,}\.git(\/|$)/,
+    /**
+     * Ticket #445 — the session journals of the agents themselves.
+     *
+     * Everything an agent ever printed is in these files, and that now includes
+     * secrets the PLATFORM handed it: the ten-minute key
+     * `devbridge_library_download` prints is masked in the session feed and is
+     * plain text here. On a machine where a project may work outside its own
+     * folder (ADR 0008), the neighbouring project's agent reads them as ordinary
+     * files.
+     *
+     * **Only the journals, never the directory, and the difference is the whole
+     * rule.** Measured on this machine on 2026-09-19: `/root/.claude/projects/`
+     * holds 35 project directories, 1120 `.jsonl` files — and, inside the same
+     * directories, the `memory/` folders where every agent on the fleet keeps its
+     * own notes, `-opt-devbridge` among them. A rule on the directory would take
+     * that memory away from every session on every machine after one «Update
+     * all», in both directions, because `normalize` resolves symlinks and the
+     * account homes point straight here. The runner-directory rule two entries up
+     * carries the same warning for the same reason, and there too the exceptions
+     * are not optional.
+     *
+     * `.jsonl` is what draws the line: journals are `.jsonl`, memory is `.md`.
+     * Nested transcripts (`<session>/subagents/agent-*.jsonl`, written by the
+     * workflow runner) are covered by the same rule.
+     */
+    //
+    // **Directory-shaped, not `.jsonl`-shaped, and that took an independent QA
+    // to see.** A rule anchored on the file extension cannot match a DIRECTORY,
+    // and `Grep {pattern: 'dbk_', path: '…/projects', output_mode: 'content'}`
+    // hands back the contents of every journal under it in one call — the exact
+    // shape this file was already bitten by once for the runner directory
+    // (QA-114 MAJOR-2, two entries above). So the directory is refused and
+    // `<project>/memory` is carved back out by name, the same way the command
+    // form below does it.
+    /(^|\/)\.claude\/projects(\/|$)(?![^/]+\/memory(\/|$))/,
+    // The same journals reached through an account home, for the case
+    // `normalize` cannot resolve (a path that is not on this disk).
+    /(^|\/)claude-homes\/[^/]+\/projects(\/|$)(?![^/]+\/memory(\/|$))/,
+    // Codex writes one file per turn under its own home. Inside the runner
+    // directory this is already refused; these two entries hold where that path
+    // does not spell `devbridge-runner` — a `DEVBRIDGE_RUNNER_HOME` override, and
+    // the host's own `~/.codex` where `history.jsonl` keeps every prompt typed.
+    /(^|\/)sessions\/\d{4}\/\d{2}\/\d{2}\/rollout-[^/]*\.jsonl$/,
+    /(^|\/)\.codex\/(sessions(\/|$)|history\.jsonl$)/,
     /(^|\/)(shadow|passwd|sudoers)$/,
     /(^|\/)\.netrc$/,
     /(^|\/)\.git-credentials$/,
@@ -702,6 +746,431 @@ function parseCheckout(segment) {
     }
     return null;
 }
+// ─── Flags and config keys that name a PROGRAM git will run (#443, A-1) ──────
+//
+// `gitRunsAProgram` below is the narrow, context-free half of the git rules,
+// exported for the `PreToolUse` guard (#399). Only this half: the guard runs in
+// «Полный доступ», where the project's own git settings — the push ban, the
+// protected branches, `git clean` — are deliberately not enforced, and dragging
+// them in would refuse work that mode exists to allow. «Which program runs on
+// somebody else's machine» is not one of those settings and never was.
+/**
+ * Git's main-level options that swallow the next word, so the scan for the
+ * subcommand steps over their value instead of reading it as one.
+ *
+ * `-c` and `-C` also accept the value glued on (`-cfoo=bar`, `-C/tmp`), which
+ * the length check below handles; everything long here takes `=` or a word.
+ */
+const GIT_MAIN_VALUE_OPTS = new Set([
+    '-c',
+    '-C',
+    '--config-env',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--super-prefix',
+    '--attr-source',
+]);
+/**
+ * The subcommand of a `git …` segment, or null when it cannot be read.
+ *
+ * Null is not «harmless»: every caller below treats an unreadable subcommand as
+ * one that accepts the flag, for the same reason `parsePush` reports the most
+ * dangerous reading — refusing what cannot be understood is the only safe
+ * direction here.
+ */
+function gitSubcommand(tokens, gitAt) {
+    let i = gitAt + 1;
+    while (i < tokens.length) {
+        const token = tokens[i] ?? '';
+        if (!token.startsWith('-'))
+            return token;
+        // `--git-dir=/x`, `-c a=b` glued as `-ca=b`: the value travels with the flag.
+        if (token.includes('=') ||
+            ((token.startsWith('-c') || token.startsWith('-C')) && token.length > 2)) {
+            i += 1;
+            continue;
+        }
+        i += GIT_MAIN_VALUE_OPTS.has(token) ? 2 : 1;
+    }
+    return null;
+}
+/**
+ * Flags whose value is a command line git executes, and the subcommands that
+ * accept them — verified against git 2.43.0 on 2026-09-19, by running each one
+ * against a local repository and looking for the marker file it left behind.
+ *
+ * The subcommand list is not decoration, and it is not «which ones are
+ * dangerous» either: every one of these words is an ordinary search term. A
+ * rule that looked for `--upload-pack` anywhere would refuse
+ * `git log -S '--upload-pack'` — which is the command somebody investigating
+ * THIS hole would type first. So the flag counts only where git would act on
+ * it; where git answers «unknown option», so does this table, by silence.
+ *
+ * `--exec` is absent from `fetch`, `pull` and `clone` on purpose: git rejects
+ * it there («unknown option `exec=X'»). It is absent from `rebase` for the
+ * opposite reason — there it is a legitimate local flag, and a blanket ban
+ * would take away a card the person can approve today (`git rebase --exec
+ * 'pnpm test' main`). `git bisect run` and `git submodule foreach` take a
+ * command as an OPERAND, not as a flag, and are equally out of scope here.
+ */
+const PROGRAM_FLAGS = [
+    {
+        flag: '--upload-pack',
+        on: new Set(['fetch', 'pull', 'clone', 'ls-remote']),
+        why: 'runs the command you name instead of `git-upload-pack` — against a local path that is simply your command, run here',
+    },
+    {
+        flag: '--exec',
+        on: new Set(['ls-remote', 'archive', 'push', 'send-pack', 'upload-archive']),
+        why: 'is the same switch as `--upload-pack` / `--receive-pack` under another name, and names the program to run',
+    },
+    {
+        flag: '--receive-pack',
+        on: new Set(['push', 'send-pack']),
+        why: 'runs the command you name on the receiving side instead of `git-receive-pack`',
+    },
+    {
+        flag: '--template',
+        on: new Set(['clone', 'init']),
+        why: 'seeds the new repository from a directory of hooks, and git runs those hooks at the end of the clone',
+    },
+    {
+        flag: '--open-files-in-pager',
+        on: new Set(['grep']),
+        why: 'runs the program you name over the files that matched',
+    },
+    // Raised by the independent QA of this stage: the same family, found by
+    // running git rather than by reading the ticket. Neither was a silent path
+    // (both already asked under the default trust), but the rule is «a flag that
+    // names a program is refused», and a list that stops one word short of true
+    // is the kind of list somebody later trusts.
+    {
+        flag: '--extcmd',
+        on: new Set(['difftool', 'mergetool']),
+        why: 'runs the program you name in place of the configured diff or merge tool',
+    },
+    {
+        flag: '--tree-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--index-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--env-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--parent-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--msg-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--commit-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every commit in the history',
+    },
+    {
+        flag: '--tag-name-filter',
+        on: new Set(['filter-branch']),
+        why: 'runs the command you name over every tag in the history',
+    },
+];
+/**
+ * Config settings whose VALUE git runs as a program.
+ *
+ * Exact names first, then the families where a name sits in the middle
+ * (`filter.<name>.smudge`), then a suffix backstop so a setting added by a
+ * later git — `something.command`, `something.helper` — is refused before
+ * anybody notices it exists.
+ *
+ * **Decided on the KEY alone, never on the value**, and that is deliberate:
+ * `--config-env=core.sshCommand=VAR` takes its value out of the environment,
+ * where nothing here can see it. A rule that had to read the value would be
+ * exactly the rule that form defeats.
+ *
+ * Proven to execute on git 2.43.0 on 2026-09-19 (marker files, local repo):
+ * `core.sshCommand`, `core.pager`, `core.hooksPath`, `core.fsmonitor`,
+ * `init.templateDir`, `diff.external`, `filter.<n>.smudge`,
+ * `remote.<n>.uploadpack`, `protocol.ext.allow` (with an `ext::` URL) and
+ * `alias.<n>` with a leading `!`. The rest are the same mechanism reached
+ * through a condition this probe did not stage (a credential prompt, a server
+ * side, an editor) and are listed for the same reason the table in
+ * `error-policy.ts` lists causes it never retries: an absence reads as an
+ * oversight.
+ */
+const EXECUTABLE_CONFIG_KEYS = new Set([
+    'core.sshcommand',
+    'core.pager',
+    'core.editor',
+    'core.askpass',
+    'core.hookspath',
+    'core.fsmonitor',
+    'core.gitproxy',
+    'init.templatedir',
+    'sequence.editor',
+    'diff.external',
+    'gpg.program',
+    'gpg.openpgp.program',
+    'gpg.x509.program',
+    'gpg.ssh.program',
+    'uploadpack.packobjectshook',
+    'credential.helper',
+    'protocol.allow',
+    'include.path',
+    'instaweb.httpd',
+    'man.viewer',
+    'web.browser',
+]);
+/** `<head>.<any name>.<tail>` — the families where the middle word is free. */
+const EXECUTABLE_CONFIG_FAMILIES = new Map([
+    ['filter', new Set(['clean', 'smudge', 'process'])],
+    ['diff', new Set(['command', 'textconv'])],
+    ['merge', new Set(['driver'])],
+    ['mergetool', new Set(['cmd', 'path'])],
+    ['difftool', new Set(['cmd', 'path'])],
+    ['guitool', new Set(['cmd'])],
+    ['browser', new Set(['cmd', 'path'])],
+    ['man', new Set(['cmd', 'path'])],
+    ['trailer', new Set(['command', 'cmd'])],
+    ['remote', new Set(['uploadpack', 'receivepack', 'proxy'])],
+    ['credential', new Set(['helper'])],
+    ['submodule', new Set(['update'])],
+    ['imap', new Set(['tunnel'])],
+    ['sendemail', new Set(['smtpserver'])],
+    ['protocol', new Set(['allow'])],
+    ['includeif', new Set(['path'])],
+]);
+/**
+ * The shape of a setting that runs something, for keys no list here names yet.
+ *
+ * `path` is NOT in it, and leaving it out is the whole difference between a
+ * backstop and a nuisance: `submodule.<name>.path` is a directory, while
+ * `mergetool.<name>.path` is a program — so `path` is listed per family above
+ * and never as a shape.
+ */
+const EXECUTABLE_CONFIG_SUFFIXES = [
+    'command',
+    'cmd',
+    'program',
+    'helper',
+    'driver',
+    'editor',
+    'pager',
+    'external',
+    'textconv',
+    'askpass',
+    'hook',
+    'hookspath',
+    'tunnel',
+];
+function configKeyRunsProgram(rawKey) {
+    const key = rawKey.toLowerCase();
+    if (key === '')
+        return false;
+    if (EXECUTABLE_CONFIG_KEYS.has(key))
+        return true;
+    // Setting an alias from the command line is refused whatever its value: an
+    // alias beginning with `!` is a shell command, and with `--config-env` the
+    // value is in the environment where this cannot look at it.
+    if (key.startsWith('alias.'))
+        return true;
+    // `pager.<git command>` is the pager for that command — a program, always.
+    if (key.startsWith('pager.'))
+        return true;
+    const parts = key.split('.');
+    const head = parts[0] ?? '';
+    const tail = parts[parts.length - 1] ?? '';
+    if (parts.length >= 3 && EXECUTABLE_CONFIG_FAMILIES.get(head)?.has(tail) === true)
+        return true;
+    return EXECUTABLE_CONFIG_SUFFIXES.includes(tail);
+}
+/** The key out of `-c key=value`, `--config-env=key=VAR`, `--config key=value`. */
+function configKeyFromToken(token, next) {
+    const eq = token.indexOf('=');
+    if (token === '-c' || token === '--config' || token === '--config-env') {
+        return next === undefined ? null : (next.split('=')[0] ?? null);
+    }
+    if (token.startsWith('-c') && !token.startsWith('--') && token.length > 2) {
+        return token.slice(2).split('=')[0] ?? null;
+    }
+    if (eq > 0 && (token.startsWith('--config=') || token.startsWith('--config-env='))) {
+        return token.slice(eq + 1).split('=')[0] ?? null;
+    }
+    return null;
+}
+/** `git config <key> <value>` and friends — reads and removals are not writes. */
+const CONFIG_READ_FLAGS = new Set([
+    '--get',
+    '--get-all',
+    '--get-regexp',
+    '--get-urlmatch',
+    '--get-color',
+    '--get-colorbool',
+    '--list',
+    '-l',
+    '--unset',
+    '--unset-all',
+    '--remove-section',
+    '--rename-section',
+    '--edit',
+    '-e',
+]);
+/**
+ * `git config` options that swallow the next word.
+ *
+ * Independent QA, 2026-09-19: without this the key was read as the first
+ * non-dash operand, so `git config --file .git/config core.pager /tmp/x` put
+ * the PATH in the key's place and the executable key one slot along was never
+ * looked at — the write went through and every later git command in that
+ * folder ran the program. `--type` did the same with no file option at all.
+ */
+const CONFIG_VALUE_OPTS = new Set([
+    '--file',
+    '-f',
+    '--blob',
+    '--type',
+    '-t',
+    '--default',
+    '--name-only',
+    '--fixed-value',
+    '--value',
+]);
+const RUN_A_PROGRAM = 'Nothing an agent does by the book has to choose which program runs on somebody else’s machine. ' +
+    'A person who really needs this runs it from their own shell.';
+/**
+ * Does this segment tell git to run a program of the caller's choosing? (#443)
+ *
+ * The hole this closes was open from 2026-08-30 to this release and survived
+ * runner 0.59 through 0.68: `git fetch --upload-pack='touch /tmp/x' /path` is
+ * on the safe list (it starts `git fetch`), carries no shell metacharacter, and
+ * so ran with no permission card at all under the DEFAULT trust level. The
+ * flag is not a niche one — git executes it even when the fetch itself then
+ * fails with code 128.
+ *
+ * Three things this must not do, each of them a mistake somebody already paid
+ * for on this file:
+ *
+ *  - **no regex over the command.** `git -c` forty-four times in a row once
+ *    froze the runner for minutes inside a normal turn (see `GIT_PUSH`), and
+ *    this runs synchronously on every Bash call of every session on the
+ *    machine. Everything below is a single pass over `words()` and string
+ *    compares;
+ *  - **no searching for the flag as a substring.** See `PROGRAM_FLAGS`;
+ *  - **the refusal has to catch the form with no shell metacharacter in it.**
+ *    The proof-of-concept in the 2026-08-30 audit used `;`, which the
+ *    metacharacter filter already caught, so a test written from it would have
+ *    gone green against an unfixed runner.
+ */
+export function gitRunsAProgram(command) {
+    // Both spellings and every segment, exactly as `evaluateGitPolicy` reads
+    // them — a caller outside this file must not have to know that.
+    for (const variant of [command, dequote(command)]) {
+        for (const segment of commandSegments(variant)) {
+            const found = parseGitProgramFlag(segment);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+function parseGitProgramFlag(segment) {
+    const tokens = words(segment);
+    const gitAt = tokens.findIndex((token) => token === 'git' || token.endsWith('/git'));
+    if (gitAt === -1)
+        return null;
+    const sub = gitSubcommand(tokens, gitAt);
+    for (let i = gitAt + 1; i < tokens.length; i += 1) {
+        const token = tokens[i] ?? '';
+        if (!token.startsWith('-'))
+            continue;
+        const name = token.split('=')[0] ?? token;
+        // `--exec-path=<dir>` makes git look for its own subcommands in a
+        // directory of your choosing, so `git --exec-path=/tmp/x fetch` runs
+        // `/tmp/x/git-fetch`. Only the `=` form sets it: verified on 2.43, a bare
+        // `--exec-path` (with or without a word after it) prints the path and
+        // exits, which is a harmless thing to let through.
+        if (token.startsWith('--exec-path=')) {
+            return {
+                decision: 'deny',
+                reason: `\`--exec-path=\` is not allowed — it points git at a directory of your own programs and runs them in place of its own subcommands. ${RUN_A_PROGRAM}`,
+            };
+        }
+        // `git clone -u <cmd>` is `--upload-pack` spelled short, and it really does
+        // run the command (verified 2.43). On `fetch` the same letter is
+        // `--update-head-ok` and harmless, which is why this is asked only of the
+        // subcommand that means the dangerous one.
+        if (sub === 'clone' && (token === '-u' || (token.startsWith('-u') && token.length > 2))) {
+            return {
+                decision: 'deny',
+                reason: `\`git clone -u\` is \`--upload-pack\` — it runs the command you name instead of \`git-upload-pack\`. ${RUN_A_PROGRAM}`,
+            };
+        }
+        // `git grep -O<pager>` opens the matches in a program of your choosing.
+        if (sub === 'grep' && token.startsWith('-O') && token.length > 2) {
+            return {
+                decision: 'deny',
+                reason: `\`git grep -O\` is \`--open-files-in-pager\` — it runs the program you name over the files that matched. ${RUN_A_PROGRAM}`,
+            };
+        }
+        for (const rule of PROGRAM_FLAGS) {
+            if (name !== rule.flag)
+                continue;
+            if (sub !== null && !rule.on.has(sub))
+                continue;
+            return {
+                decision: 'deny',
+                reason: `\`${rule.flag}\` is not allowed — it ${rule.why}. ${RUN_A_PROGRAM}`,
+            };
+        }
+        const key = configKeyFromToken(token, tokens[i + 1]);
+        if (key !== null && configKeyRunsProgram(key)) {
+            return {
+                decision: 'deny',
+                reason: `setting \`${key}\` on the command line is not allowed — git runs the value of that setting as a program. ${RUN_A_PROGRAM}`,
+            };
+        }
+    }
+    // `git config <executable key> <value>` is the same hole one step removed:
+    // `-c` runs the program once, this writes it into `.git/config` so every
+    // later git command in the folder runs it. Reads and removals are untouched
+    // — only a write with a value is refused.
+    if (sub === 'config') {
+        const rest = tokens.slice(tokens.indexOf('config', gitAt) + 1);
+        if (!rest.some((token) => CONFIG_READ_FLAGS.has(token.split('=')[0] ?? token))) {
+            // The value of a value-taking option is NOT an operand, and reading it as
+            // one is what let the key hide one slot further along.
+            const operands = [];
+            for (let i = 0; i < rest.length; i += 1) {
+                const token = rest[i] ?? '';
+                if (!token.startsWith('-')) {
+                    operands.push(token);
+                    continue;
+                }
+                if (!token.includes('=') && CONFIG_VALUE_OPTS.has(token))
+                    i += 1;
+            }
+            const key = operands[0];
+            if (key !== undefined && operands.length >= 2 && configKeyRunsProgram(key)) {
+                return {
+                    decision: 'deny',
+                    reason: `\`git config ${key} …\` is not allowed — git runs the value of that setting as a program, and writing it into the config runs it for every later command in this folder. ${RUN_A_PROGRAM}`,
+                };
+            }
+        }
+    }
+    return null;
+}
 /**
  * The project's git rules, applied to one Bash command.
  *
@@ -723,6 +1192,18 @@ export function evaluateGitPolicy(command, ctx) {
     const policy = resolveGitPolicy(ctx);
     let asked = null;
     for (const segment of commandSegments(command)) {
+        /**
+         * #443 — first in the loop, and with no switch above it.
+         *
+         * The same standing as the `--receive-pack` rule further down and for the
+         * same sentence: nothing an agent legitimately does needs to choose which
+         * program runs on somebody else's machine. It is not `allowDestructiveGit`
+         * and it is not a project setting, because a project that trusts its agent
+         * with `git clean` has said nothing about arbitrary code.
+         */
+        const runsProgram = parseGitProgramFlag(segment);
+        if (runsProgram)
+            return runsProgram;
         if (!policy.allowDestructiveGit) {
             /**
              * The two git commands that destroy work nobody has committed (16).
@@ -960,6 +1441,25 @@ const SECRET_COMMAND_PATTERNS = [
     // secret table and not the other is theatre, and `git --git-dir=…` /
     // `cat …/checkpoints/<hash>.git/…` walks past a Read-tool guard entirely.
     /checkpoints\/[0-9a-f]{8,}\.git/,
+    /**
+     * Ticket #445 in command form — and the exception in it is NOT optional.
+     *
+     * Written against the literal command text, so it has to answer the shapes
+     * the shell has not expanded yet: one journal named outright, a glob over
+     * the whole folder, and `grep -r dbk_ ~/.claude/projects`, which names no
+     * file at all and would read every one of them.
+     *
+     * Hence the directory is refused and `<project>/memory/…` is carved back out
+     * — `cat` and `grep` over an agent's own notes are ordinary work, done many
+     * times a session, and the cost of getting this backwards is the whole fleet
+     * losing its memory at once. The accepted cost of the other side: listing the
+     * project directory itself (`ls ~/.claude/projects/-opt-devbridge/`) is
+     * refused too, the same trade as `devbridge-runner doctor` above.
+     */
+    /\.claude\/projects(?!\/[^/\s"']+\/memory\b)/,
+    /claude-homes\/[^/\s"']+\/projects(?!\/[^/\s"']+\/memory\b)/,
+    /sessions\/\d{4}\/\d{2}\/\d{2}\/rollout-/,
+    /(^|[\s"'/=~])\.codex\/(sessions\b|history\.jsonl)/,
     /devbridge-runner(?=\s|$|['"])/,
     /\/etc\/(shadow|passwd|sudoers)/,
     /\.git-credentials/,
@@ -967,8 +1467,21 @@ const SECRET_COMMAND_PATTERNS = [
     // Session 13 — same list as SECRET_PATH_PATTERNS, in command form.
     /\.config\/(gh|glab-cli|hub|gcloud)\b/,
 ];
-function commandMentionsSecretPath(command) {
-    return SECRET_COMMAND_PATTERNS.some((re) => re.test(command));
+/**
+ * Does this shell command name a path the agent must not touch?
+ *
+ * Exported for the `PreToolUse` guard (#399), which is the one check that
+ * survives `bypassPermissions` — where `evaluateToolUse` below is never called
+ * at all. One list, one function, two callers: a second copy of these patterns
+ * would drift, and the drift would be silent.
+ *
+ * Both spellings are tested here rather than at the call site, so a caller
+ * cannot forget the one that matters: `cat "/root/.cla""ude/…"` collapses only
+ * under `dequote`, and forgetting it is how quote-splitting got past a rule
+ * once already (QA-96 F8/F9).
+ */
+export function commandMentionsSecretPath(command) {
+    return SECRET_COMMAND_PATTERNS.some((re) => re.test(command) || re.test(dequote(command)));
 }
 /**
  * Does this command name the compose project it claims to own?
@@ -1070,9 +1583,9 @@ export function evaluateRecipeCommand(command, ctx = {}) {
             }
             return { allowed: false, reason };
         }
-        if (commandMentionsSecretPath(variant)) {
-            return { allowed: false, reason: 'the command touches protected secret paths' };
-        }
+    }
+    if (commandMentionsSecretPath(command)) {
+        return { allowed: false, reason: 'the command touches protected secret paths' };
     }
     return { allowed: true };
 }
@@ -1234,9 +1747,11 @@ export function evaluateToolUse(toolName, input, ctx) {
                 if (re.test(variant))
                     return { decision: 'deny', reason };
             }
-            if (commandMentionsSecretPath(variant)) {
-                return { decision: 'deny', reason: 'command touches protected secret paths' };
-            }
+        }
+        // Both spellings are tested inside the function now that the `PreToolUse`
+        // guard calls it too (#399) — one caller must not be able to forget one.
+        if (commandMentionsSecretPath(command)) {
+            return { decision: 'deny', reason: 'command touches protected secret paths' };
         }
         // The project said the agent does not commit. Checked BEFORE the trust
         // modes, exactly like the deny list above it: under AUTO the Bash branch

package/dist/protocol.d.ts

@@ -1633,8 +1633,15 @@ export type RunnerFrame = {
     baseBranch?: string;
     baseSha?: string;
     errorMessage?: string;
-    /** Why it ended, when the reason is worth naming rather than an error. */
-    endReason?: 'TIME_BUDGET' | 'COST_BUDGET';
+    /**
+     * Why it ended, when the reason is worth naming rather than an error.
+     *
+     * `MODEL_REFUSAL` since 0.69.0 (#435, first item): the provider's safety
+     * filter refused the answer and no fallback model took the turn. The API
+     * reads this through a Zod enum with `.catch(undefined)`, so an older API
+     * simply hears no reason rather than dropping the whole frame.
+     */
+    endReason?: 'TIME_BUDGET' | 'COST_BUDGET' | 'MODEL_REFUSAL';
     /** Agent-active milliseconds, cumulative across processes (session 7). */
     activeMs?: number;
     /**