@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/_lib/confusables.ts

@@ -49,6 +49,25 @@ export const CONFUSABLE_FOREIGN: ReadonlySet<number> = new Set([
     0x03a1 /*Ρ→P*/, 0x03a4 /*Τ→T*/, 0x03a5 /*Υ→Y*/, 0x03a7 /*Χ→X*/, 0x0392 /*Β→B*/,
 ]);
 
+/**
+ * The basic-Latin twin of each confusable foreign letter that has one, for a
+ * detector that folds a lookalike back before matching. Every key is in
+ * `CONFUSABLE_FOREIGN`, which a test holds.
+ */
+export const LATIN_TWIN: ReadonlyMap<number, string> = new Map([
+    [0x0430, 'a'], [0x0435, 'e'], [0x043e, 'o'], [0x0440, 'p'], [0x0441, 'c'],
+    [0x0443, 'y'], [0x0445, 'x'], [0x0455, 's'], [0x0456, 'i'], [0x0458, 'j'],
+    [0x04bb, 'h'], [0x0501, 'd'], [0x051b, 'q'],
+    [0x0410, 'A'], [0x0412, 'B'], [0x0415, 'E'], [0x041a, 'K'], [0x041c, 'M'],
+    [0x041d, 'H'], [0x041e, 'O'], [0x0420, 'P'], [0x0421, 'C'], [0x0422, 'T'],
+    [0x0423, 'Y'], [0x0425, 'X'], [0x0405, 'S'], [0x0406, 'I'], [0x0408, 'J'],
+    [0x03b1, 'a'], [0x03b5, 'e'], [0x03bf, 'o'], [0x03bd, 'v'], [0x03c1, 'p'],
+    [0x03c5, 'u'], [0x03c7, 'x'], [0x03ba, 'k'],
+    [0x0391, 'A'], [0x0392, 'B'], [0x0395, 'E'], [0x0396, 'Z'], [0x0397, 'H'],
+    [0x0399, 'I'], [0x039a, 'K'], [0x039c, 'M'], [0x039d, 'N'], [0x039f, 'O'],
+    [0x03a1, 'P'], [0x03a4, 'T'], [0x03a5, 'Y'], [0x03a7, 'X'],
+]);
+
 type ScriptName = 'latin' | 'cyrillic' | 'greek' | 'other';
 
 function _script_of(ch: string): ScriptName {

package/src/scripts/_lib/consumer_impact.ts

@@ -0,0 +1,199 @@
+/**
+ * The `Consumer-Impact:` commit trailer — parsing, breaking-ness, and
+ * the impact map the release writes into the published `package.json`.
+ *
+ * The trailer lives in the commit BODY, so the release log is read with a body
+ * field and a record separator rather than one line per commit. The vocabulary
+ * is documented beside the bump table in CONTRIBUTING.md § Versioning policy.
+ *
+ * Recording is advisory: the impact does not change how a release is numbered. The
+ * bump still follows breaking-ness (`is_breaking_commit`); whether it should
+ * follow the impact instead is an open owner decision.
+ */
+
+export const CONSUMER_IMPACT_VALUES = ['none', 'automatic', 'notice', 'action'] as const;
+export type ConsumerImpact = (typeof CONSUMER_IMPACT_VALUES)[number];
+
+export interface ImpactTrailers {
+    readonly impact: ConsumerImpact;
+    /** False when the commit carried no valid trailer and `impact` is the default. */
+    readonly recorded: boolean;
+    /** Why the trailer is not valid — out-of-enum value, conflicting duplicates, misspelt key — for the refusal. */
+    readonly invalid: string | null;
+    readonly security: boolean;
+}
+
+export const NO_IMPACT_TRAILERS: ImpactTrailers = Object.freeze({
+    impact: 'none',
+    recorded: false,
+    invalid: null,
+    security: false,
+});
+
+/** `git log --format` producing sha, subject and body, one record per `\x1e`. */
+export const COMMIT_LOG_FORMAT = '%H%x1f%s%x1f%b%x1e';
+
+export interface CommitRecord {
+    readonly sha: string;
+    readonly subject: string;
+    readonly body: string;
+}
+
+export function parse_commit_log(raw: string): CommitRecord[] {
+    const out: CommitRecord[] = [];
+    for (const chunk of raw.split('\x1e')) {
+        const rec = chunk.replace(/^\n+/, '');
+        const parts = rec.split('\x1f');
+        if (parts.length < 2) continue;
+        out.push({ sha: parts[0]!, subject: parts[1]!, body: parts.slice(2).join('\x1f') });
+    }
+    return out;
+}
+
+const TRAILER_LINE = /^(BREAKING CHANGE|[A-Za-z0-9][A-Za-z0-9-]*):[ \t]*(.*?)[ \t]*$/;
+
+/**
+ * Every Git trailer block in the body: each paragraph whose every line is a
+ * `Key: value` trailer or an indented continuation. Not only the final one — a
+ * GitHub squash merge folds each squashed commit's trailers into an earlier
+ * paragraph and closes the body with its own `Co-authored-by:` paragraph. A
+ * paragraph holding any other line, or any part of a code fence, is not a block.
+ */
+export function trailer_blocks(body: string): Array<Array<[key: string, value: string]>> {
+    const blocks: Array<Array<[string, string]>> = [];
+    let para: string[] = [];
+    let tainted = false;
+    let fenced = false;
+    const flush = (): void => {
+        const block = tainted ? [] : parse_trailer_paragraph(para);
+        if (block.length > 0) blocks.push(block);
+        para = [];
+        tainted = false;
+    };
+    for (const line of body.replace(/\r\n/g, '\n').split('\n')) {
+        if (/^[ \t]*(```|~~~)/.test(line)) {
+            fenced = !fenced;
+            tainted = true;
+        } else if (fenced) {
+            tainted = true;
+        } else if (/^[ \t]*$/.test(line)) {
+            flush();
+        } else {
+            para.push(line);
+        }
+    }
+    flush();
+    return blocks;
+}
+
+function parse_trailer_paragraph(lines: readonly string[]): Array<[string, string]> {
+    const out: Array<[string, string]> = [];
+    for (const line of lines) {
+        if (/^[ \t]+\S/.test(line) && out.length > 0) continue;
+        const m = TRAILER_LINE.exec(line);
+        if (!m) return [];
+        out.push([m[1]!, m[2]!]);
+    }
+    return out;
+}
+
+type BlockImpact = Omit<ImpactTrailers, 'security'>;
+
+function block_impact(block: ReadonlyArray<[string, string]>): BlockImpact | null {
+    const variant = block.find(([k]) => k !== 'Consumer-Impact' && k.toLowerCase() === 'consumer-impact');
+    if (variant) return { impact: 'none', recorded: false, invalid: `key '${variant[0]}' (spell it Consumer-Impact)` };
+    const values = [...new Set(block.filter(([k]) => k === 'Consumer-Impact').map(([, v]) => v))];
+    if (values.length === 0) return null;
+    if (values.length > 1) return { impact: 'none', recorded: false, invalid: `conflicting values '${values.join("', '")}'` };
+    const value = values[0]!;
+    if ((CONSUMER_IMPACT_VALUES as readonly string[]).includes(value)) {
+        return { impact: value as ConsumerImpact, recorded: true, invalid: null };
+    }
+    return { impact: 'none', recorded: false, invalid: `value '${value}'` };
+}
+
+/**
+ * One block decides by the single-commit contract. Several blocks are a squash
+ * of several commits: an invalid block refuses the whole body, otherwise the
+ * most severe value wins — the reduction `release_impact_entry` applies to a span.
+ */
+export function parse_impact_trailers(body: string): ImpactTrailers {
+    const blocks = trailer_blocks(body);
+    const security = blocks.some((b) => b.some(([k, v]) => k === 'Security' && v === 'yes'));
+    let best: BlockImpact | null = null;
+    for (const block of blocks) {
+        const r = block_impact(block);
+        if (r === null) continue;
+        if (r.invalid !== null) return { ...r, security };
+        if (best === null || IMPACT_RANK[r.impact] > IMPACT_RANK[best.impact]) best = r;
+    }
+    return best === null ? { ...NO_IMPACT_TRAILERS, security } : { ...best, security };
+}
+
+/**
+ * Breaking-ness, decided without depending on the subject being conventional: a
+ * `!` before the colon (`bang`, when the conventional parse matched), `BREAKING
+ * CHANGE` / `BREAKING-CHANGE` in the subject, or a `BREAKING CHANGE:` /
+ * `BREAKING-CHANGE:` footer at any body line start. The footer is not limited to
+ * the trailer block: a Conventional Commits breaking footer may run on over
+ * paragraphs. It decides the major bump; a breaking commit with no trailer is
+ * recorded as `none` like any other, and the release does not refuse it.
+ */
+export function is_breaking_commit(subject: string, body: string, bang = false): boolean {
+    return bang || /BREAKING[ -]CHANGE/.test(subject) || /^BREAKING[ -]CHANGE:/m.test(body);
+}
+
+export interface ImpactCommit {
+    readonly sha: string;
+    readonly type: string;
+    readonly scope: string | null;
+    readonly subject: string;
+    readonly breaking: boolean;
+    readonly trailers: ImpactTrailers;
+}
+
+export interface ImpactEntry {
+    readonly impact: ConsumerImpact;
+    readonly security?: true;
+}
+export type ImpactMap = Readonly<Record<string, ImpactEntry>>;
+
+export const IMPACT_RANK: Readonly<Record<ConsumerImpact, number>> = Object.freeze({
+    none: 0,
+    automatic: 1,
+    notice: 2,
+    action: 3,
+});
+
+export function release_impact_entry(commits: readonly ImpactCommit[]): ImpactEntry {
+    let impact: ConsumerImpact = 'none';
+    let security = false;
+    for (const c of commits) {
+        if (IMPACT_RANK[c.trailers.impact] > IMPACT_RANK[impact]) impact = c.trailers.impact;
+        security = security || c.trailers.security;
+    }
+    return security ? { impact, security: true } : { impact };
+}
+
+/** Add `version`'s entry to the map; a release that is `none` throughout adds nothing. */
+export function with_release_impact(
+    map: ImpactMap,
+    version: string,
+    commits: readonly ImpactCommit[],
+): ImpactMap {
+    const entry = release_impact_entry(commits);
+    if (entry.impact === 'none' && !entry.security) return { ...map };
+    return { ...map, [version]: entry };
+}
+
+/** Write the map under `agentConfig.impact` of a parsed package.json, in place. */
+export function write_impact_map(
+    data: Record<string, unknown>,
+    version: string,
+    commits: readonly ImpactCommit[],
+): void {
+    const block = (data['agentConfig'] ?? {}) as Record<string, unknown>;
+    const next = with_release_impact((block['impact'] ?? {}) as ImpactMap, version, commits);
+    if (Object.keys(next).length === 0) return;
+    data['agentConfig'] = { ...block, impact: next };
+}

package/src/scripts/_lib/content_class.ts

@@ -0,0 +1,127 @@
+/**
+ * The content classes of `internal/bench/tool-results-content-profile-PREREG.md`
+ * as one dependency-free module, so the result store that reads them per hook
+ * event (road-to-tool-results-that-leave-a-handle Phase 2) classes a result
+ * exactly as the selection report did over its window.
+ */
+export type ContentClass = 'Read:text' | 'Bash:file-print' | 'Bash:vcs-content' | 'execution' | 'residue' | 'out-of-scope';
+export const CONTENT_CLASSES = ['Read:text', 'Bash:file-print', 'Bash:vcs-content'] as const;
+
+/**
+ * Pipeline stages as word lists, or null when the command carries a construct
+ * the PREREG excludes: a `&&` / `||` / `;` / `&` / newline chain, a redirect, a
+ * subshell or command substitution, or an unterminated quote.
+ */
+export function pipelineStages(command: string): string[][] | null {
+    const stages: string[][] = [[]];
+    let word = '';
+    let inWord = false;
+    let quote: '"' | "'" | null = null;
+    const push = (): void => {
+        if (inWord) (stages[stages.length - 1] as string[]).push(word);
+        word = '';
+        inWord = false;
+    };
+    for (let i = 0; i < command.length; i++) {
+        const ch = command[i] as string;
+        const next = command[i + 1];
+        if (quote === "'") {
+            if (ch === "'") quote = null;
+            else word += ch;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === '"') quote = null;
+            else if (ch === '`' || (ch === '$' && next === '(')) return null;
+            else if (ch === '\\' && next !== undefined) word += command[++i];
+            else word += ch;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            inWord = true;
+        } else if (ch === '\\' && next === '\n') {
+            i += 1;
+            push();
+        } else if (ch === '\\' && next !== undefined) {
+            word += command[++i];
+            inWord = true;
+        } else if (ch === ' ' || ch === '\t') {
+            push();
+        } else if (ch === '|') {
+            if (next === '|') return null;
+            push();
+            stages.push([]);
+        } else if (';&\n<>()`'.includes(ch) || (ch === '$' && next === '(')) {
+            return null;
+        } else {
+            word += ch;
+            inWord = true;
+        }
+    }
+    if (quote !== null) return null;
+    push();
+    return stages.some((s) => s.length === 0) ? null : stages;
+}
+
+const ADDR = String.raw`(?:\d+|\$|/(?:[^/\\]|\\.)*/)`;
+const PRINT_ONLY = new RegExp(String.raw`^(?:${ADDR}(?:\s*,\s*${ADDR})?)?\s*p$`);
+
+/** `sed` with `-n` and a script whose every command is a (possibly addressed) `p`. */
+function sedPrintsOnly(args: readonly string[]): boolean {
+    let quiet = false;
+    let explicitScript = false;
+    const scripts: string[] = [];
+    let operandsOnly = false;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i] as string;
+        if (!operandsOnly && a === '--') operandsOnly = true;
+        else if (!operandsOnly && (a === '-n' || a === '--quiet' || a === '--silent')) quiet = true;
+        else if (!operandsOnly && a === '-e') {
+            const s = args[++i];
+            if (s === undefined) return false;
+            scripts.push(s);
+            explicitScript = true;
+        } else if (!operandsOnly && a.startsWith('--expression=')) {
+            scripts.push(a.slice('--expression='.length));
+            explicitScript = true;
+        } else if (!operandsOnly && /^-[nErsuz]+$/.test(a)) {
+            if (a.includes('n')) quiet = true;
+        } else if (!operandsOnly && a.startsWith('-') && a !== '-') return false;
+        else if (!explicitScript && scripts.length === 0) scripts.push(a);
+    }
+    if (!quiet || scripts.length === 0) return false;
+    return scripts.every((s) => {
+        const parts = s
+            .split(/[;\n]/)
+            .map((p) => p.trim())
+            .filter((p) => p !== '');
+        return parts.length > 0 && parts.every((p) => PRINT_ONLY.test(p));
+    });
+}
+
+const FILE_PRINT_PROGRAMS = new Set(['cat', 'head', 'tail', 'nl', 'wc']);
+
+function isFilePrint(stage: readonly string[]): boolean {
+    const [prog, ...args] = stage;
+    if (prog === undefined) return false;
+    return FILE_PRINT_PROGRAMS.has(prog) || (prog === 'sed' && sedPrintsOnly(args));
+}
+
+function isVcsContent(stage: readonly string[]): boolean {
+    if (stage[0] !== 'git') return false;
+    if (stage[1] === 'diff' || stage[1] === 'show') return true;
+    return stage[1] === 'log' && stage.slice(2).some((a) => a === '-p' || a === '--patch');
+}
+
+/** One result into a PREREG content class, the execution profile, Bash residue, or out of scope. */
+export function classifyResult(tool: string, command: string | null): ContentClass {
+    if (tool === 'Read') return 'Read:text';
+    if (tool !== 'Bash') return 'out-of-scope';
+    if (command === null || command.trim() === '') return 'execution';
+    const stages = pipelineStages(command);
+    if (stages === null || stages[0]?.[0] === 'cd') return 'residue';
+    if (stages.every(isFilePrint)) return 'Bash:file-print';
+    if (isVcsContent(stages[0] as string[]) && stages.slice(1).every(isFilePrint)) return 'Bash:vcs-content';
+    return 'execution';
+}

package/src/scripts/_lib/counted_probe.ts

@@ -24,7 +24,7 @@
  * counting/listing class, where a short read silently manufactures a passing
  * result.
  */
-import { spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import { spawn, spawnSync, type SpawnSyncReturns } from 'node:child_process';
 
 /**
  * Default ceiling: 64 MiB.
@@ -90,6 +90,73 @@ export function runCountedProbe(
     return interpretProbeResult(res, `${command} ${args.join(' ')}`.trim(), maxBuffer);
 }
 
+/**
+ * `runCountedProbe` without blocking the event loop, so a caller can run several
+ * probes at once. Same contract: the per-stream `maxBuffer` mirrors `spawnSync`,
+ * and an overflow kills the child and throws rather than resolving to a short read.
+ *
+ * @throws {ProbeOverflowError} (as a rejection) when a stream exceeded `maxBuffer`.
+ */
+export function runCountedProbeAsync(
+    command: string,
+    args: readonly string[],
+    opts: ProbeOptions = {},
+): Promise<ProbeResult> {
+    const maxBuffer = opts.maxBuffer ?? DEFAULT_PROBE_MAX_BUFFER;
+    const label = `${command} ${args.join(' ')}`.trim();
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, [...args], {
+            cwd: opts.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            ...(opts.env === undefined ? {} : { env: opts.env }),
+        });
+        const out: Buffer[] = [];
+        const err: Buffer[] = [];
+        let outBytes = 0;
+        let errBytes = 0;
+        let error: (Error & { code?: string }) | undefined;
+        const fail = (code: string): void => {
+            if (error !== undefined) return;
+            error = Object.assign(new Error(code), { code });
+            child.kill('SIGTERM');
+        };
+        const timer =
+            opts.timeout === undefined ? undefined : setTimeout(() => fail('ETIMEDOUT'), opts.timeout);
+        child.stdout.on('data', (chunk: Buffer) => {
+            outBytes += chunk.length;
+            if (outBytes > maxBuffer) fail('ENOBUFS');
+            else out.push(chunk);
+        });
+        child.stderr.on('data', (chunk: Buffer) => {
+            errBytes += chunk.length;
+            if (errBytes > maxBuffer) fail('ENOBUFS');
+            else err.push(chunk);
+        });
+        child.on('error', (e: Error & { code?: string }) => {
+            error ??= e;
+        });
+        child.on('close', (status: number | null) => {
+            if (timer !== undefined) clearTimeout(timer);
+            try {
+                resolve(
+                    interpretProbeResult(
+                        {
+                            error,
+                            status: error === undefined ? status : null,
+                            stdout: Buffer.concat(out).toString('utf-8'),
+                            stderr: Buffer.concat(err).toString('utf-8'),
+                        },
+                        label,
+                        maxBuffer,
+                    ),
+                );
+            } catch (e) {
+                reject(e as Error);
+            }
+        });
+    });
+}
+
 /**
  * Classify a finished spawn. Split out from `runCountedProbe` so the failure
  * modes are unit-testable without spawning a real, slow, large-output child.

package/src/scripts/_lib/credential_deny_rows.ts

@@ -0,0 +1,151 @@
+/**
+ * The host's own deny rows for the credential classes the `pre_tool_use` read
+ * guard refuses — OFFERED by `hooks:doctor`, written nowhere.
+ *
+ * This package publishes that it writes no host setting, with one
+ * owner-decided exception (`docs/mcp-server.md`); writing these rows would be a
+ * second. So the doctor reads which rows are already in force across the
+ * settings layers and prints the rest for the user to paste; nothing here opens
+ * a file for writing.
+ *
+ * The classes are `credential_files.ts`'s. Each Read row carries a `sample`
+ * path, and a test holds every sample to that module's classifier, so a row
+ * that stops naming a class the guard refuses is a red test, not a quiet drift.
+ * The converse is not held: a class added to the guard needs a row added here.
+ *
+ * Two residues of a native deny the guard does not have, stated rather than
+ * hidden: a gitignore pattern cannot except a template, so `.env.*` is not
+ * offered (it would deny `.env.example`) and the value-holding suffixes are
+ * listed by name instead; and a `.pem` is offered only under key-shaped names.
+ * Every other name stays the guard's alone.
+ *
+ * Spellings follow the grammar recorded in `src/install/hostPermissionsAdapter.ts`
+ * (`Read(./.env)`, `Bash(npm run build)`), read 2026-10-13.
+ */
+import * as path from "node:path";
+
+import type { CredentialFileClass } from "./credential_files.js";
+import type { FloorPostureDeps } from "./floor_posture.js";
+
+export interface CredentialDenyRow {
+    readonly rule: string;
+    readonly class: CredentialFileClass;
+    /** A path this rule denies; `null` for a command row. */
+    readonly sample: string | null;
+}
+
+const read = (spec: string, cls: CredentialFileClass, sample: string): CredentialDenyRow => ({
+    rule: `Read(${spec})`,
+    class: cls,
+    sample,
+});
+
+const ENV_NAMES = [".env", ".envrc", ".env.local", ".env.development", ".env.production", ".env.staging", ".env.test"];
+const KEY_GLOBS: ReadonlyArray<readonly [string, string]> = [
+    ["*.key", "server.key"],
+    ["*.p12", "client.p12"],
+    ["*.pfx", "client.pfx"],
+    ["*.ppk", "deploy.ppk"],
+    ["*.jks", "release.jks"],
+    ["*.keystore", "release.keystore"],
+    ["*-key.pem", "server-key.pem"],
+    ["*_key.pem", "server_key.pem"],
+    ["private.pem", "private.pem"],
+];
+const SSH_KEYS = ["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519"];
+const HOME_TAILS: ReadonlyArray<readonly [string, CredentialFileClass]> = [
+    [".aws/credentials", "cloud-credentials"],
+    [".config/gcloud/application_default_credentials.json", "cloud-credentials"],
+    // cache-invalidation: not a cache this package writes — gcloud's own credential store, named only to offer a deny row
+    [".config/gcloud/credentials.db", "cloud-credentials"],
+    [".azure/accessTokens.json", "cloud-credentials"],
+    [".azure/msal_token_cache.json", "cloud-credentials"],
+    [".kube/config", "cloud-credentials"],
+    [".docker/config.json", "cloud-credentials"],
+    [".config/gh/hosts.yml", "cloud-credentials"],
+    [".git-credentials", "cloud-credentials"],
+    [".gem/credentials", "registry-credentials"],
+    [".cargo/credentials", "registry-credentials"],
+    [".cargo/credentials.toml", "registry-credentials"],
+    [".composer/auth.json", "registry-credentials"],
+    [".config/composer/auth.json", "registry-credentials"],
+];
+/** Registry files a project can carry too, so they are offered at both scopes. */
+const ANYWHERE_TAILS = [".npmrc", ".pypirc", ".netrc", "_netrc", ".pgpass", ".my.cnf"];
+
+export const CREDENTIAL_DENY_ROWS: readonly CredentialDenyRow[] = [
+    ...ENV_NAMES.map((n) => read(`./**/${n}`, "env-file", `app/${n}`)),
+    ...KEY_GLOBS.map(([g, sample]) => read(`./**/${g}`, "private-key", `certs/${sample}`)),
+    ...SSH_KEYS.map((k) => read(`~/.ssh/${k}`, "private-key", `/home/u/.ssh/${k}`)),
+    ...HOME_TAILS.map(([t, c]) => read(`~/${t}`, c, `/home/u/${t}`)),
+    ...ANYWHERE_TAILS.flatMap((t) => [
+        read(`~/${t}`, "registry-credentials", `/home/u/${t}`),
+        read(`./**/${t}`, "registry-credentials", `app/${t}`),
+    ]),
+    read("//proc/*/environ", "process-environment", "/proc/self/environ"),
+    { rule: "Bash(env)", class: "process-environment", sample: null },
+    { rule: "Bash(printenv)", class: "process-environment", sample: null },
+];
+
+export type DenyTier = "none" | "partial" | "complete";
+
+export interface CredentialDenyReport {
+    tier: DenyTier;
+    present: string[];
+    missing: string[];
+    /** Settings layers that exist and do not parse — their rows cannot be counted. */
+    unreadable: string[];
+}
+
+/** The settings layers Claude Code merges, user first — the same three `floor_posture` reads. */
+function layers(deps: Pick<FloorPostureDeps, "homeDir" | "projectRoot">): string[] {
+    return [
+        path.join(deps.homeDir, ".claude", "settings.json"),
+        path.join(deps.projectRoot, ".claude", "settings.json"),
+        path.join(deps.projectRoot, ".claude", "settings.local.json"),
+    ];
+}
+
+/** Which offered rows are already in `permissions.deny` on some layer. Reads only. */
+export function readCredentialDenyTier(
+    deps: Pick<FloorPostureDeps, "homeDir" | "projectRoot" | "readFile">,
+): CredentialDenyReport {
+    const inForce = new Set<string>();
+    const unreadable: string[] = [];
+    for (const file of layers(deps)) {
+        const raw = deps.readFile(file);
+        if (raw === null) continue;
+        let parsed: unknown;
+        try {
+            parsed = JSON.parse(raw);
+        } catch {
+            unreadable.push(file);
+            continue;
+        }
+        const deny = (parsed as { permissions?: { deny?: unknown } } | null)?.permissions?.deny;
+        if (Array.isArray(deny)) for (const r of deny) if (typeof r === "string") inForce.add(r.trim());
+    }
+    const present = CREDENTIAL_DENY_ROWS.map((r) => r.rule).filter((r) => inForce.has(r));
+    const missing = CREDENTIAL_DENY_ROWS.map((r) => r.rule).filter((r) => !inForce.has(r));
+    const tier: DenyTier = missing.length === 0 ? "complete" : present.length === 0 ? "none" : "partial";
+    return { tier, present, missing, unreadable };
+}
+
+/** The doctor's section: the tier, and the rows still to paste — none when complete. */
+export function renderCredentialDenyTier(report: CredentialDenyReport): string[] {
+    const total = report.present.length + report.missing.length;
+    const lines = [
+        `Native deny tier (Claude Code): ${report.tier} — ${report.present.length}/${total} credential rows in force`,
+        "    Offered, never written: this package writes no deny row into a host setting.",
+    ];
+    for (const f of report.unreadable) lines.push(`    ⚠️  unreadable, not counted: ${f}`);
+    if (report.missing.length > 0) {
+        lines.push("    Paste into permissions.deny of ~/.claude/settings.json to add them:");
+        for (const r of report.missing) lines.push(`      ${JSON.stringify(r)},`);
+    }
+    lines.push(
+        "    Stronger tiers stay yours to enable: the host sandbox (sandbox.enabled) and a",
+        "    scrubbed environment for the session; the read guard covers names no row lists.",
+    );
+    return lines;
+}