@fusengine/harness 0.1.87 → 0.1.89

package/README.md

@@ -125,12 +125,12 @@ also works elsewhere.
 | Harness | PreToolUse coverage | Lifecycle (Session/Subagent/Stop/Compact/…) | Known limit |
 |---|---|---|---|
 | **claude-code** | Full: `evaluate` + APEX gates via `handleHook` (`src/adapters/claude/index.ts`) | 14 event types implemented (`dispatch.ts`) — fires once wired into `.claude/settings.json` beyond the `init` default | None found; richer lifecycle needs manual/marketplace wiring (see Quickstart) |
-| **codex** | Bash gated reliably; **`apply_patch` edits are now gated too** — the patch text is parsed per file (`adapters/codex/apply-patch.ts`), each hunk runs the file gates and ONE violating hunk denies the whole patch (`runtime/apply-patch-gate.ts`, sim scenario 22 incl. the multi-file smuggling case). `ask` prompts are **downgraded to explicit deny** (`respond.ts`, sim scenario 23) because Codex fails open on unsupported shapes. On the PostToolUse side, an allowed patch is fanned into one synthetic per-file event so the SOLID/tracking/post-edit handlers see every touched file (`runtime/post-fanout.ts`), and a non-blocking security advisory fires on the first qualifying file (`securityAdvisoryForPatch`). | Not wired by `harness init codex` (PreToolUse `Bash\|apply_patch` + PostToolUse only, `src/init/templates.ts:29-38`) — `Stop` (session cleanup + the SOLID/receipt completion check, since Codex never emits `SessionEnd`/`TaskCompleted`, `runtime/lifecycle/stop-core.ts`) and `SessionStart` (plugin agents/commands cache resync, `runtime/lifecycle/codex-resync/`) ARE implemented but, same caveat as claude-code's extra lifecycle above, only fire once the codex-plugins marketplace's own `hooks.json` wires them. | Upstream caveat: Codex itself does not always enforce a correct `apply_patch` deny (openai/codex#27833) — we emit the right verdict; enforcement is theirs. No interactive `ask`. Codex has no native `PostToolUseFailure`; a failure is inferred from the ordinary `PostToolUse` result shape (non-zero exit or an explicit error field only — never a guess) and journaled into the one-shot failure tally (`src/tracking/codex-post-failure.ts`). |
+| **codex** | Bash gated reliably; **`apply_patch` edits are now gated too** — the patch text is parsed per file (`adapters/codex/apply-patch.ts`), each hunk runs the file gates and ONE violating hunk denies the whole patch (`runtime/apply-patch-gate.ts`, sim scenario 22 incl. the multi-file smuggling case). `ask` prompts are **downgraded to explicit deny** (`respond.ts`, sim scenario 23) because Codex fails open on unsupported shapes — the deny now carries a `CONFIRM <code>` recourse (see "CONFIRM code" under [Beyond gating](#beyond-gating-memory-receipts-one-shot-metric) below). On the PostToolUse side, an allowed patch is fanned into one synthetic per-file event so the SOLID/tracking/post-edit handlers see every touched file (`runtime/post-fanout.ts`), and a non-blocking security advisory fires on the first qualifying file (`securityAdvisoryForPatch`). | Not wired by `harness init codex` (PreToolUse `Bash\|apply_patch` + PostToolUse only, `src/init/templates.ts:29-38`) — `Stop` (session cleanup + the SOLID/receipt completion check, since Codex never emits `SessionEnd`/`TaskCompleted`, `runtime/lifecycle/stop-core.ts`) and `SessionStart` (plugin agents/commands cache resync, `runtime/lifecycle/codex-resync/`) ARE implemented but, same caveat as claude-code's extra lifecycle above, only fire once the codex-plugins marketplace's own `hooks.json` wires them. | Upstream caveat: Codex itself does not always enforce a correct `apply_patch` deny (openai/codex#27833) — we emit the right verdict; enforcement is theirs. No interactive `ask`. Codex has no native `PostToolUseFailure`; a failure is inferred from the ordinary `PostToolUse` result shape (non-zero exit or an explicit error field only — never a guess) and journaled into the one-shot failure tally (`src/tracking/codex-post-failure.ts`). |
 | **cursor** | `beforeShellExecution` can deny/ask (shell only, `cursor/index.ts:16-21`) | none | File edits are **advisory only**: `afterFileEdit` always returns `allow` + a `user_message` correction on violation — a `deny` there has no proven effect (hook was "informational only" at launch, and Cursor's deny-enforcement for file ops is confirmed broken upstream, forum.cursor.com/t/154377). Human sees the message; the model is never re-informed. Platform ceiling, documented in `cursor/index.ts`. |
 | **gemini-cli** | `BeforeTool` denies via `{decision:"deny",reason}` (`gemini/index.ts:22-36`) | none | Thin stateless adapter — no session track, no APEX gates wired through it. |
 | **cline** | `PreToolUse` only; block → `{cancel:true}`, non-block → `contextModification` (`cline/index.ts:24-36`) | none | Same as gemini-cli: stateless guard only. |
 | **hermes** | `pre_tool_call` proven: reuses the Claude stdin reader, blocks via `{decision:"block",reason}` (`hermes/index.ts:12-36`) | untested — no lifecycle dispatch wired for Hermes in this repo | `ask`/`inform` degrade to non-blocking `{context}` — Hermes "has no interactive ask state" (`hermes/index.ts:27-28`). |
-| **kimi** | `PreToolUse` denies via the camelCase JSON channel `{"hookSpecificOutput":{"permissionDecision":"deny","permissionDecisionReason":"…"}}` on stdout at **exit 0** (verified live against kimi-code v0.27.0 — exit 2 with stderr = reason also blocks, but is not required) — only `deny` is documented. `ask` is **downgraded to deny** prefixed `[downgraded from ask — Kimi Code has no interactive approval]`; `inform` rides plain stdout text at exit 0, never wrapped in JSON. Blocking events: `UserPromptSubmit`, `PreToolUse`, `Stop` (`kimi/index.ts`). | Observation only: `PostToolUse`, `PostToolUseFailure`, `PermissionRequest`, `PermissionResult`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `StopFailure`, `Interrupt`, `PreCompact`, `PostCompact`, `Notification` — Kimi delivers them but **ignores any response**, so no verdict can be returned from them. | A **hook** cannot request approval — Kimi's `ask` lives in a parallel, hook-unreachable system (`[[permission.rules]] decision = "ask"` in `config.toml`), hence the ask→deny downgrade. Hooks are configured **only** in the global `~/.kimi-code/config.toml` (no project-local hooks file), so `harness init` writes no kimi wiring — copy the TOML snippet from [docs/adapters.md](docs/adapters.md#kimi-code--manual-wiring), and emit **no field** beyond `event`/`matcher`/`command`/`timeout` or the whole config fails to load. **Fail-open by design**: any exit code other than 0/2, a timeout, or a crash lets the call through. Stdin payload is snake_case and carries only `hook_event_name`, `session_id`, `cwd`, `tool_name`, `tool_input.command` and an undocumented `tool_call_id` (unused here) — no `transcript_path`, no `permission_mode`, no `tool_response`. Verified live against kimi-code v0.27.0 for `PreToolUse`/`Bash`; validate hand-written config with `kimi doctor`. Instructions file is `AGENTS.md`, not `CLAUDE.md`. |
+| **kimi** | `PreToolUse` denies via the camelCase JSON channel `{"hookSpecificOutput":{"permissionDecision":"deny","permissionDecisionReason":"…"}}` on stdout at **exit 0** (verified live against kimi-code v0.27.0 — exit 2 with stderr = reason also blocks, but is not required) — only `deny` is documented. `ask` is **downgraded to deny** prefixed `[downgraded from ask — Kimi Code has no interactive approval]`, with a `CONFIRM <code>` recourse appended (see "CONFIRM code" under [Beyond gating](#beyond-gating-memory-receipts-one-shot-metric) below); `inform` rides plain stdout text at exit 0, never wrapped in JSON. Blocking events: `UserPromptSubmit`, `PreToolUse`, `Stop` (`kimi/index.ts`). | Observation only: `PostToolUse`, `PostToolUseFailure`, `PermissionRequest`, `PermissionResult`, `SessionStart`, `SessionEnd`, `SubagentStart`, `SubagentStop`, `StopFailure`, `Interrupt`, `PreCompact`, `PostCompact`, `Notification` — Kimi delivers them but **ignores any response**, so no verdict can be returned from them. | A **hook** cannot request approval — Kimi's `ask` lives in a parallel, hook-unreachable system (`[[permission.rules]] decision = "ask"` in `config.toml`), hence the ask→deny downgrade. Hooks are configured **only** in the global `~/.kimi-code/config.toml` (no project-local hooks file), so `harness init` writes no kimi wiring — copy the TOML snippet from [docs/adapters.md](docs/adapters.md#kimi-code--manual-wiring), and emit **no field** beyond `event`/`matcher`/`command`/`timeout` or the whole config fails to load. **Fail-open by design**: any exit code other than 0/2, a timeout, or a crash lets the call through. Stdin payload is snake_case and carries only `hook_event_name`, `session_id`, `cwd`, `tool_name`, `tool_input.command` and an undocumented `tool_call_id` (unused here) — no `transcript_path`, no `permission_mode`, no `tool_response`. Verified live against kimi-code v0.27.0 for `PreToolUse`/`Bash`; validate hand-written config with `kimi doctor`. Instructions file is `AGENTS.md`, not `CLAUDE.md`. |
 
 ## What it enforces
 
@@ -141,7 +141,7 @@ Guard/gate chain evaluated before a tool runs (`src/policy/guards/index.ts`,
 |---|---|
 | security | `rm -rf /`, fork bombs, `curl \| sh`; `sudo` (asks) |
 | protected-path | edits to `.claude/plugins\|logs\|cache`, `.git/`, the harness's own state dirs |
-| bash-write | `python3 -c` / `sed -i` / redirects to code files |
+| bash-write | `sed -i` / redirects to code files; `python3 -c` judged on content (mutating script → block, read-only → pass, same as `node -e`) |
 | interface-separation | top-level interface/type/protocol in a component/controller |
 | install | `npm/pip/brew/...` installs (asks) |
 | git | destructive git (`push --force`, `reset --hard`, …) — block; routine git — ask |
@@ -161,6 +161,30 @@ through per window without the full APEX gates (`Write` is never trivial).
 
 Features shipped since 0.1.44, each with its own test:
 
+- **`CONFIRM <code>` — recourse for a degraded `ask`** — Codex and Kimi both
+  ignore `permissionDecision: "ask"` (Kimi's own binary shortcuts on
+  `hookSpecificOutput?.permissionDecision !== "deny"`; Codex fails a hook open
+  on the unsupported shape), so the harness downgrades every `ask` there to a
+  hard `deny`. That deny now appends a short 4-hex-char code; retyping
+  `CONFIRM <code>` in the very next prompt authorizes that **exact** action
+  once (Claude Code is untouched — its native `ask` still shows an interactive
+  confirmation, no code ever appears there,
+  `src/runtime/confirm/confirm-gate.ts`). Guardrails, each independently
+  testable (`test/confirm.test.ts`, `test/confirm-g0.test.ts`): **G0** no token
+  can be placed while a sub-agent is active for this session (a monotone
+  max-write timestamp, window tunable via `FUSE_CONFIRM_SUBAGENT_WINDOW_SEC`,
+  default 300s); **G1** a token is consumed on first use; **G2** a token
+  expires after 5 minutes; **G3** the token is scoped to the action's full
+  SHA-256 hash, never the 4-char display code (which collides by design — it
+  exists only for a human to retype); **G4** irreversible commands
+  (`push --force`, `reset --hard`, `rm -rf`, `git clean -fd`, `branch -D`, …)
+  are never confirmable, regardless of a valid token; **G5** an explicit
+  refusal in the next prompt drops any pending token. **This is a guard
+  against accidental/hasty denial with no recourse, not a security control
+  against an adversarial agent** — an agent with arbitrary shell access can
+  write the token straight into the session-state file it authorizes from and
+  self-approve, same as it could bypass any other stateful gate this harness
+  keeps outside a sandbox.
 - **Deny-loop breaker** — an identical retried call that was already denied gets
   a rewritten `[REPEAT] … STOP` message forcing a different approach, instead of
   looping silently (`src/policy/deny-loop.ts`, `test/deny-loop.test.ts`).
@@ -291,6 +315,7 @@ non-zero exit is swallowed — a broken or absent player can never break a hook
 | `FUSE_DESIGN_GEMINI` | **Opt-in (default off), a *different* gate from the one above.** Enables the design-pipeline's own Gemini gates (`create_frontend` validation + "generate before hand-writing HTML/CSS") — inert unless a design agent is active (`src/policy/design/gates.ts:58-60`, see [docs/design.md](docs/design.md)). |
 | `FUSE_MCP_TTL_SEC` | MCP (Context7/Exa) cache freshness, seconds (default 48h, `src/runtime/mcp-key.ts`). |
 | `FUSE_WEBFETCH_TTL_SEC` | WebFetch cache freshness, seconds (default 24h — pages stale faster than docs). |
+| `FUSE_CONFIRM_SUBAGENT_WINDOW_SEC` | G0 cool-down (seconds, default `300`) for the `CONFIRM <code>` mechanism above — no token can be placed within this window of the last SubagentStart/Stop seen for the session. |
 | `RALPH_MODE` | **Opt-in (default off).** Exempts safe git commands (`add`/`commit`/`checkout -b`/`status`/`diff`/`log`) from the confirmation ask and auto-approves project installs. Destructive git (force-push, `reset --hard`) and system installs still gate. |
 | `CLAUDE_PROJECT_DIR` | Overrides the project root used to hash the out-of-tree state dir (`src/runtime/paths.ts:20`). |
 | `FUSE_HARNESS_SOUND` | **On by default.** Set to `0` to disable every lifecycle notification sound. |
@@ -384,6 +409,12 @@ Run `bun run docs:api` for the generated typedoc API reference.
   checkpoint, not continuously.
 - **Hermes coverage beyond `pre_tool_call` is unverified** — no lifecycle events
   have been proven against a live Hermes install in this repo.
+- **`CONFIRM <code>` is not a security boundary.** It guards against an `ask`
+  being silently dropped by Codex/Kimi's degrade-to-deny, i.e. against
+  precipitation and lost recourse — not against an adversarial agent. Any
+  agent with shell access can write its own confirm token into session state
+  and self-approve; this is true of every stateful gate this harness keeps
+  outside a sandbox, not specific to this mechanism.
 
 ## Develop
 

package/dist/adapters/claude/index.mjs

@@ -1,2 +1,2 @@
-import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-CEWX-8m9.mjs";
+import { a as fileSizeGuard, c as readClaudeInput, i as denyResponse, l as systemMessage, n as blockResponse, o as guard, r as contextResponse, s as informResponse, t as attachSystemMessage, u as toClaudeResponse } from "../../claude-5bC8TDAz.mjs";
 export { attachSystemMessage, blockResponse, contextResponse, denyResponse, fileSizeGuard, guard, informResponse, readClaudeInput, systemMessage, toClaudeResponse };

package/dist/adapters/cline/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-9bUzRquQ.mjs";
+import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cline/index.ts
 /**

package/dist/adapters/codex/index.mjs

@@ -1,8 +1,8 @@
-import { t as evaluate } from "../../evaluate-9bUzRquQ.mjs";
+import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
 import { f as countLines } from "../../home-state-oUGFB4ds.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
-import { n as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-BN3MNgbm.mjs";
-import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-CEWX-8m9.mjs";
+import { n as canonicalizeCodexShellTool, r as parseApplyPatch, t as isBypassPermissions } from "../../permission-mode-B0MUl7FT.mjs";
+import { _ as commandToString, c as readClaudeInput, i as denyResponse, r as contextResponse, s as informResponse } from "../../claude-5bC8TDAz.mjs";
 //#region src/adapters/codex/index.ts
 /**
 * OpenAI Codex CLI adapter (hook-mode). Codex's `PreToolUse` hook (since 2026)
@@ -51,7 +51,7 @@ function applyPatchPrompt(command) {
 function resolvePrompt(input) {
 	const i = input.tool_input;
 	const r = evaluate({
-		tool: input.tool_name ?? "Write",
+		tool: canonicalizeCodexShellTool("codex", input.tool_name ?? "Write"),
 		filePath: i?.file_path,
 		content: i?.content ?? i?.new_string,
 		command: commandToString(i?.command),

package/dist/adapters/cursor/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-9bUzRquQ.mjs";
+import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/cursor/index.ts
 /**

package/dist/adapters/gemini/index.mjs

@@ -1,4 +1,4 @@
-import { t as evaluate } from "../../evaluate-9bUzRquQ.mjs";
+import { t as evaluate } from "../../evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "../../types-ernB1Dy3.mjs";
 //#region src/adapters/gemini/index.ts
 /**

package/dist/adapters/hermes/index.mjs

@@ -1,2 +1,2 @@
-import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-H6qePmBC.mjs";
+import { n as readHermesInput, r as toHermesResponse, t as guard } from "../../hermes-kP6NUQlG.mjs";
 export { guard, readHermesInput, toHermesResponse };

package/dist/adapters/kimi/index.mjs

@@ -1,2 +1,2 @@
-import { i as toKimiResponse, n as kimiDenyResponse, r as readKimiInput, t as guard } from "../../kimi-CqLkpg1A.mjs";
+import { i as toKimiResponse, n as kimiDenyResponse, r as readKimiInput, t as guard } from "../../kimi-D6X7b8wF.mjs";
 export { guard, kimiDenyResponse, readKimiInput, toKimiResponse };

package/dist/{claude-CEWX-8m9.mjs → claude-5bC8TDAz.mjs}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-9bUzRquQ.mjs";
+import { t as evaluate } from "./evaluate-C1VSI5pb.mjs";
 import { t as formatPrompt } from "./types-ernB1Dy3.mjs";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";

package/dist/cli/bin.mjs

@@ -3,9 +3,9 @@ import { o as resolveStdinMaxBytes } from "../limits-DG5pl-5s.mjs";
 import { c as resolveTtlSec, r as loadDotenv } from "../dotenv-BLBkBTww.mjs";
 import { t as detectHarness } from "../harness-BMuLJ9lm.mjs";
 import { t as claudeHome } from "../home-state-oUGFB4ds.mjs";
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4kqWMA3.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 import { n as writeInitFile, t as initFor } from "../run-TAXNRSpD.mjs";
-import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-Boj3vnxD.mjs";
+import { $ as runningVersion, Q as runDoctor, Z as notify, et as versionBanner, i as respond, t as handleHook, zt as todayUtc } from "../handle-DHhukRdh.mjs";
 import { delimiter, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readSync, readdirSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";

package/dist/cli/index.d.mts

@@ -1,7 +1,12 @@
 //#region src/cli/run.d.ts
 /** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
 declare function stagedFiles(): string[];
-/** Read a file's staged (index) content — not the working-tree version. */
+/**
+ * Read a file's staged (index) content — not the working-tree version.
+ * Uses `execFileSync` with an argv array (never a shell), so a staged
+ * filename containing shell metacharacters (backticks, `$(...)`, quotes)
+ * reaches `git show` as a single literal argument — see issue #87.
+ */
 declare function stagedContent(path: string): string;
 /**
  * Evaluate staged code files against the policy core; return violation blocks.

package/dist/cli/index.mjs

@@ -1,2 +1,2 @@
-import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-B4kqWMA3.mjs";
+import { n as stagedContent, r as stagedFiles, t as checkStaged } from "../run-CdIlUtjv.mjs";
 export { checkStaged, stagedContent, stagedFiles };

package/dist/{evaluate-9bUzRquQ.mjs → evaluate-C1VSI5pb.mjs}

@@ -826,10 +826,6 @@ const CODE_MUTATORS = [
 		re: new RegExp(`${CMD}python3?\\s+-\\s*<<`),
 		desc: "Python heredoc input"
 	},
-	{
-		re: new RegExp(`${CMD}python3?\\s+-c\\b`),
-		desc: "Python inline script"
-	},
 	{
 		re: new RegExp(`${CMD}sed\\b[^|]*\\s-i`),
 		desc: "sed in-place edit"
@@ -863,6 +859,53 @@ const CODE_COMMAND_WRITE = new RegExp(`${CMD}(?:tee\\s+[^;&|\\n]*?|dd\\b[^|]*\\b
 /** File-mutating one-liners via `node -e` / `ruby -e` (parity NODE_WRITES/RUBY_WRITES). */
 const NODE_WRITES = /writeFile|appendFile|createWriteStream|fs\.(?:write|rename|unlink|mkdir|rmdir|copyFile)|execSync|spawnSync|child_process/;
 const RUBY_WRITES = /File\.(?:write|open|delete|rename)|IO\.write|FileUtils|\bsystem\b|\bexec\b|`[^`]/;
+/**
+* Command-position anchor for `python3 -c` (same anchored-token shape as the
+* removed unconditional CODE_MUTATORS entry) — used ONLY to gate {@link PYTHON_WRITES}
+* below, never as a standalone block. `python3 - <<EOF` (heredoc) stays
+* unconditionally blocked in CODE_MUTATORS — a heredoc body can't be inspected
+* reliably with a single-line regex, so it is never widened.
+*/
+const PYTHON_C_ANCHOR = new RegExp(`${CMD}python3?\\s+-c\\b`);
+/**
+* File/process-mutating constructs inside a `python3 -c` inline script (parity
+* NODE_WRITES/RUBY_WRITES: content-gated, not name-gated). `python3 -c` is
+* blocked ONLY when this matches — a read-only one-liner (`print(...)`,
+* `json.load`/`json.dumps`) passes. Doc-verified against docs.python.org
+* (functions/pathlib/shutil/subprocess/os/pickle) before writing this pattern.
+*
+* Families, each independently sufficient to mutate state or run arbitrary code:
+*  - `open(...)` / `Path(...).open(...)` in a write/append/exclusive/read-write
+*    mode — positional (`'w'`,`'x'`,`'a'`,`'r+'`,`'w+'`, …) or `mode=` kwarg, any
+*    `b`/`t` suffix. Plain `open(f)` / `open(f, 'r')` (read-only, the default)
+*    does NOT match.
+*  - `pathlib.Path` mutators: `write_text`, `write_bytes`, `unlink`, `rename`,
+*    `replace`, `mkdir`, `rmdir`, `touch`, `chmod`, `symlink_to`, `hardlink_to`,
+*    plus 3.14+ `move`, `move_into`, `copy`, `copy_into`.
+*  - `shutil.*` EXCLUDING the confirmed read-only members `which`,
+*    `disk_usage`, `get_terminal_size`, `get_archive_formats`,
+*    `get_unpack_formats` — every other shutil function copies/moves/deletes.
+*  - `os.*` mutators/exec: `remove`, `unlink`, `rename`, `replace`, `makedirs`,
+*    `mkdir`, `rmdir`, `removedirs`, `chmod`, `chown`, `symlink`, `link`,
+*    `truncate`, `chdir`, `fchdir`, `putenv`, `write`, `ftruncate`, `fchmod`,
+*    `fchown`, `fork`, `system`, `popen`, plus the `exec*`/`spawn*`/
+*    `posix_spawn` families.
+*  - `subprocess.run|call|check_call|check_output|Popen|getoutput|getstatusoutput`
+*    — the actual spawn surface. Non-spawning members (`PIPE`, `DEVNULL`,
+*    `STDOUT`, `CompletedProcess`, `CalledProcessError`, …) are deliberately
+*    excluded — a bare `subprocess\.\w+` would false-positive on those.
+*  - `pickle.dump` / `json.dump` (the file-writing form — `\b` after `dump`
+*    excludes `dumps`, which only serializes to a string/bytes in memory).
+*  - `csv.writer`, `tempfile.*` (temp-file/dir creation is still a write).
+*  - generic `.write(`/`.writelines(` — covers any file-like object, including
+*    one opened via a variable this static check can't trace back to `open()`.
+*  - `exec(`/`eval(` — arbitrary code execution, not merely file I/O.
+*
+* Deliberately NOT included: bare `import` statements, arithmetic/string
+* formatting, `print`, `json.load`/`json.loads`, `sys.argv`/`os.environ` reads,
+* `os.getcwd`/`os.listdir`/`os.path.*` — none of these mutate disk or spawn.
+*/
+const PYTHON_WRITES = /* @__PURE__ */ new RegExp("\\bopen\\s*\\([^)]*(?:(['\"])(?:[wax]|r\\+|\\+r)[bt]?\\1|mode\\s*=\\s*(['\"])(?:[wax]|r\\+|\\+r)[bt]?\\2)|\\.(?:write_text|write_bytes|unlink|rename|replace|mkdir|rmdir|touch|chmod|symlink_to|hardlink_to|move_into|copy_into|move|copy|write|writelines)\\s*\\(|\\bshutil\\.(?!which\\b|disk_usage\\b|get_terminal_size\\b|get_archive_formats\\b|get_unpack_formats\\b)\\w+|\\bos\\.(?:remove|unlink|rename|replace|makedirs|mkdir|rmdir|removedirs|system|popen|chmod|chown|symlink|link|truncate|chdir|fchdir|putenv|write|ftruncate|fchmod|fchown|fork)\\b|\\bos\\.(?:exec|spawn|posix_spawn)\\w*\\b|\\bsubprocess\\.(?:run|call|check_call|check_output|Popen|getoutput|getstatusoutput)\\b|\\bpickle\\.dump\\b|\\bjson\\.dump\\b|\\bcsv\\.writer\\b|\\btempfile\\.\\w+|\\b(?:exec|eval)\\s*\\(");
 /** Redirect to a non-code file. Excludes `/dev/null`, `2>`/`N>` and `>&N` fd
 * redirects via the `(?<![0-9&])` lookbehind + `(?!…|&)` (parity has_file_redirect). */
 const FILE_REDIRECT = /(?<![0-9&])\s*>>?\s*(?!\/dev\/null|&)[a-zA-Z./~$]/;
@@ -962,6 +1005,7 @@ function bashWriteGuard(ctx) {
 	const mutator = CODE_MUTATORS.find((m) => m.re.test(cmd));
 	if (mutator) return blockCodeWrite(`${mutator.desc} — Use Edit/Write tools instead`);
 	if (CODE_COMMAND_WRITE.test(cmd)) return blockCodeWrite("tee/dd into a code file — Use Edit/Write tools instead");
+	if (PYTHON_C_ANCHOR.test(cmd) && PYTHON_WRITES.test(cmd)) return blockCodeWrite("Python inline script mutates files/spawns a process — Use Edit/Write tools instead");
 	if (SAFE_PREFIXES.some((p) => stripped.startsWith(p)) && !FILE_REDIRECT.test(stripped)) return null;
 	if (cmd.includes(".fuse-harness/cache/sessions")) return {
 		kind: "block",