@galaxyproject/orbit 0.0.0 → 0.9.0

package/extensions/orbit/exec-guard/gate.ts

@@ -0,0 +1,181 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import * as os from "os";
+import * as path from "path";
+import { getNotebookPath } from "../state";
+import { appendActivityEvent } from "../activity";
+import { redactArgs } from "../activity-hooks";
+import {
+  loadGuardianConfig,
+  resolveBypass,
+  trustWorkspace,
+  recordConsent,
+} from "./guardian-config";
+import { createPathResolver } from "./path-jail";
+import { classifyModelTier } from "./model-tier";
+import { decide } from "./policy";
+import { CONSENT_VERSION, type PolicyResult } from "./types";
+import { buildApprovalPrompt } from "../../../shared/approval-prompt.js";
+
+// In-memory "allow for this session" set, keyed by tool + raw input signature.
+const sessionAllow = new Set<string>();
+function sig(toolName: string, input: Record<string, unknown>): string {
+  return toolName + ":" + JSON.stringify(input);
+}
+
+function audit(
+  toolName: string,
+  input: Record<string, unknown>,
+  result: PolicyResult,
+  outcome: string,
+): void {
+  const nb = getNotebookPath();
+  if (!nb) return;
+  appendActivityEvent(path.dirname(nb), {
+    timestamp: new Date().toISOString(),
+    kind: "guard.decision",
+    source: "exec-guard",
+    payload: {
+      toolName,
+      decision: result.decision,
+      category: result.category,
+      reason: result.reason,
+      outcome,
+      args: redactArgs(toolName, input),
+    },
+  });
+}
+
+// The state dir (.loom/.orbit) is deliberately not a root of its own. Under
+// cwd it is already inside the jail; the only thing a separate root ever added
+// was trust in wherever a symlinked state dir pointed, which the user never
+// granted.
+export function workspaceRoots(cwd: string, extra: string[]): string[] {
+  return [cwd, os.tmpdir(), ...extra];
+}
+
+export function registerExecGuard(pi: ExtensionAPI): void {
+  pi.on("tool_call", async (event, ctx) => {
+    const config = loadGuardianConfig();
+    if (!config.enabled) return; // gate fully disabled (advanced escape hatch)
+    // Fold the effective bypass back into the config the pure engine sees.
+    config.dangerouslyBypassPermissions = resolveBypass(config);
+
+    const input = event.input as Record<string, unknown>;
+    const cwd = ctx.cwd;
+    const resolver = createPathResolver(
+      workspaceRoots(cwd, config.extraWorkspaceRoots),
+      os.homedir(),
+    );
+
+    let result: PolicyResult;
+    try {
+      result = decide(
+        {
+          toolName: event.toolName,
+          toolInput: input,
+          modelTier: classifyModelTier(ctx.model),
+          config,
+          interactive: ctx.hasUI,
+          cwd,
+        },
+        { resolver, home: os.homedir() },
+      );
+    } catch {
+      const reason = "exec-guard internal error; failing closed";
+      audit(event.toolName, input, { decision: "deny", category: "error", reason }, "blocked");
+      return { block: true, reason };
+    }
+
+    if (result.decision === "allow") {
+      audit(event.toolName, input, result, "allowed");
+      return;
+    }
+    if (result.decision === "deny") {
+      audit(event.toolName, input, result, "blocked");
+      return { block: true, reason: result.reason };
+    }
+
+    // Destructive Galaxy op (#338): its own yes/no confirm, never cached and never
+    // offered "allow for session"/"trust workspace" -- every irreversible action
+    // re-prompts. Independent of the one-time local-exec consent disclosure (that's
+    // about shell execution; this is its own, more pointed prompt). The decision here
+    // is always "ask" -- the non-interactive case already denied above.
+    if (result.category === "galaxy:destructive") {
+      const proceed = await ctx.ui.confirm(
+        "Confirm destructive Galaxy operation",
+        `${ctx.model?.id ?? "The model"} wants to: ${result.reason}\n\nContinue?`,
+        {},
+      );
+      if (proceed) {
+        audit(event.toolName, input, result, "allowed:destructive-confirm");
+        return;
+      }
+      audit(event.toolName, input, result, "blocked:destructive-user");
+      return { block: true, reason: "Destructive Galaxy operation cancelled by user." };
+    }
+
+    // ask: session memory first.
+    if (sessionAllow.has(sig(event.toolName, input))) {
+      audit(event.toolName, input, result, "allowed:session");
+      return;
+    }
+
+    // One-time local-execution disclosure on the first gated action. Relies on
+    // the persisted flag (saveConfig is synchronous), so a failed save simply
+    // re-discloses rather than silently proceeding.
+    if (!config.consentAcknowledged) {
+      const ok = await ctx.ui.confirm(
+        "Orbit runs actions on your computer",
+        "Orbit can run shell commands and read/write files as you. Commands from the AI are gated, but no gate is perfect -- only use it in workspaces you trust. Continue?",
+        {},
+      );
+      if (!ok) {
+        audit(event.toolName, input, result, "blocked:consent-declined");
+        return { block: true, reason: "Local execution not consented." };
+      }
+      recordConsent(CONSENT_VERSION);
+    }
+
+    const modelName = ctx.model?.id ?? "the model";
+    // Heading and the thing being approved are separated by a blank line so a
+    // shell can render the command as a readable body instead of a headline.
+    // Lowercased to match the policy engine, which gates on the normalized
+    // name -- otherwise a "Bash" call would be gated as a command but prompted
+    // as a path, showing the user nothing of what they're approving.
+    const isBash = event.toolName.toLowerCase() === "bash";
+    const heading = isBash
+      ? `Allow ${modelName} to run this command?`
+      : `Allow ${modelName} to ${event.toolName} this path?`;
+    // File tools also arrive with the Anthropic `file_path` spelling and the policy
+    // layer gates both, so the prompt names every path the call carries: answering
+    // it while looking at one of two different targets is not consent.
+    const paths = [...new Set([input.path, input.file_path].filter((v) => typeof v === "string"))];
+    const detail = String(isBash ? (input.command ?? "") : paths.join(" + "));
+    const choice = await ctx.ui.select(
+      buildApprovalPrompt(heading, detail),
+      [
+        "Allow once",
+        "Allow for this session",
+        "Trust this workspace (stop asking for routine commands)",
+        "Deny",
+      ],
+      {},
+    );
+    if (choice === "Allow once") {
+      audit(event.toolName, input, result, "allowed:once");
+      return;
+    }
+    if (choice === "Allow for this session") {
+      sessionAllow.add(sig(event.toolName, input));
+      audit(event.toolName, input, result, "allowed:session");
+      return;
+    }
+    if (choice && choice.startsWith("Trust this workspace")) {
+      trustWorkspace(cwd);
+      audit(event.toolName, input, result, "allowed:trust-workspace");
+      return;
+    }
+    audit(event.toolName, input, result, "blocked:user");
+    return { block: true, reason: "Denied by user." };
+  });
+}

package/extensions/orbit/exec-guard/guardian-config.ts

@@ -0,0 +1,54 @@
+import { loadConfig, saveConfig } from "../../../shared/orbit-config.js";
+import type { GuardianConfig } from "./types";
+import { readEnv } from "../../../shared/orbit-env.js";
+
+export function loadGuardianConfig(): GuardianConfig {
+  const g = loadConfig().guardian ?? {};
+  return {
+    enabled: g.enabled !== false,
+    dangerouslyBypassPermissions: g.dangerouslyBypassPermissions === true,
+    trustedWorkspaces: g.trustedWorkspaces ?? [],
+    extraWorkspaceRoots: g.extraWorkspaceRoots ?? [],
+    consentAcknowledged: g.consentAcknowledged ?? null,
+    sandbox: g.sandbox === true,
+  };
+}
+
+/**
+ * Bypass is ON if (env flag OR config) AND NOT force-off. The agent can never
+ * flip the env or config: those are human-only channels (the gate makes
+ * writing ~/.orbit/config.json gated and editing guardian.* catastrophic).
+ */
+export function resolveBypass(cfg: GuardianConfig): boolean {
+  if (readEnv("SAFE") === "1") return false;
+  if (readEnv("DANGEROUSLY_BYPASS_PERMISSIONS") === "1") return true;
+  return cfg.dangerouslyBypassPermissions === true;
+}
+
+/**
+ * The OS bash sandbox is opt-in: enabling it necessarily restricts bash network
+ * (ASRT cannot confine writes alone), so it's a deliberate user choice, not a
+ * default. On via LOOM_SANDBOX=1 or guardian.sandbox. Default off.
+ */
+export function resolveSandbox(cfg: GuardianConfig): boolean {
+  if (readEnv("SANDBOX") === "1") return true;
+  return cfg.sandbox === true;
+}
+
+export function trustWorkspace(dir: string): void {
+  const cfg = loadConfig();
+  const g = cfg.guardian ?? {};
+  const set = new Set(g.trustedWorkspaces ?? []);
+  set.add(dir);
+  cfg.guardian = { ...g, trustedWorkspaces: [...set] };
+  saveConfig(cfg);
+}
+
+export function recordConsent(version: string): void {
+  const cfg = loadConfig();
+  cfg.guardian = {
+    ...(cfg.guardian ?? {}),
+    consentAcknowledged: { version, at: new Date().toISOString() },
+  };
+  saveConfig(cfg);
+}

package/extensions/orbit/exec-guard/index.ts

@@ -0,0 +1 @@
+export { registerExecGuard } from "./gate";

package/extensions/orbit/exec-guard/model-tier.ts

@@ -0,0 +1,36 @@
+import type { ModelTier } from "./types";
+
+export interface TierInput {
+  id?: string;
+  provider?: string;
+  cost?: { input: number; output: number };
+}
+
+// Tokens that mark a model as weak/cheap regardless of cost. Matched as whole
+// dash/dot-delimited tokens of the lowercased id (NOT substrings) so "mini"
+// flags gpt-4o-mini but not gemini. Conservative: when unsure -> weak.
+const WEAK_ID_MARKERS = ["haiku", "mini", "flash", "small", "lite", "8b", "7b", "1b", "3b", "nano"];
+
+// Frontier id markers that are trusted even if a custom price table is wrong.
+const TRUSTED_ID_MARKERS = [
+  "opus",
+  "sonnet",
+  "gpt-5",
+  "gpt-4.1",
+  "o1",
+  "o3",
+  "gemini-2.5-pro",
+  "gemini-1.5-pro",
+];
+
+export function classifyModelTier(model: TierInput | undefined): ModelTier {
+  if (!model || !model.id) return "weak";
+  const id = model.id.toLowerCase();
+  const idTokens = id.split(/[^a-z0-9]+/);
+  if (idTokens.some((tok) => WEAK_ID_MARKERS.includes(tok))) return "weak";
+  if (TRUSTED_ID_MARKERS.some((m) => id.includes(m))) return "trusted";
+  // Fall back to price: frontier output pricing is well above cheap tiers.
+  // Threshold chosen so Haiku ($5 out) is weak and Sonnet ($15 out) is trusted.
+  const out = model.cost?.output ?? 0;
+  return out >= 10 ? "trusted" : "weak";
+}

package/extensions/orbit/exec-guard/path-jail.ts

@@ -0,0 +1,54 @@
+import * as fs from "fs";
+import * as path from "path";
+import type { PathResolver } from "./types";
+
+// Expand a leading `~` or `$HOME`/`${HOME}` to the home dir. The shell does this
+// in bash, and pi resolves `~` in its file tools, but `path.resolve` does not --
+// so without this a `~/.aws/config` read resolves to `<cwd>/~/.aws/config` and
+// dodges both the sensitive-read floor and the workspace jail.
+export function expandHome(p: string, home: string): string {
+  if (!home) return p;
+  if (p === "~" || p === "~/") return home;
+  if (p.startsWith("~/")) return path.join(home, p.slice(2));
+  const m = p.match(/^\$\{?HOME\}?(?=\/|$)/);
+  if (m) return path.join(home, p.slice(m[0].length));
+  return p;
+}
+
+function realpathDeepest(target: string): string {
+  // realpath the longest existing prefix, then re-append the missing tail.
+  let cur = path.resolve(target);
+  const tail: string[] = [];
+  for (;;) {
+    try {
+      return path.join(fs.realpathSync(cur), ...tail.reverse());
+    } catch {
+      const parent = path.dirname(cur);
+      if (parent === cur) return path.resolve(target); // hit the root, nothing exists
+      tail.push(path.basename(cur));
+      cur = parent;
+    }
+  }
+}
+
+export function createPathResolver(roots: string[], home = ""): PathResolver {
+  const realRoots = roots
+    .map((r) => {
+      const expanded = expandHome(r, home);
+      try {
+        return fs.realpathSync(expanded);
+      } catch {
+        return path.resolve(expanded);
+      }
+    })
+    .filter(Boolean);
+  return {
+    contains(targetPath: string) {
+      const resolved = realpathDeepest(expandHome(targetPath, home));
+      const inside = realRoots.some(
+        (root) => resolved === root || resolved.startsWith(root + path.sep),
+      );
+      return { resolved, inside };
+    },
+  };
+}

package/extensions/orbit/exec-guard/policy.ts

@@ -0,0 +1,342 @@
+import * as path from "path";
+import { classifyBash } from "./bash-risk";
+import { expandHome } from "./path-jail";
+import {
+  isSensitivePath,
+  isCredentialStore,
+  isProtectedWritePath,
+  isOrbitStatePath,
+  isRecordStorePath,
+} from "./sensitive-read";
+import type { PolicyDeps, PolicyRequest, PolicyResult } from "./types";
+import {
+  classifyGalaxyDestructive,
+  describeGalaxyDestructive,
+  isGalaxyDestructiveCurl,
+} from "../../../shared/galaxy-destructive.js";
+import type { GalaxyDestructiveOp } from "../../../shared/galaxy-destructive.js";
+
+// A dedicated credential store's CONTENTS are never readable by the agent --
+// denied for every tier, not downgraded to an ask. This is the floor that closes
+// #183: a capable model that gets to read ~/.orbit/config.json echoes the keys
+// straight into the provider's request logs. Approval can't override it.
+function denyCredentialStore(p: string, home: string): PolicyResult {
+  return {
+    decision: "deny",
+    category: "read:credential-store",
+    reason: `access to credential store ${shown(p, home)} blocked for all models`,
+  };
+}
+
+// Reasons land in the activity log, and a path the classifier resolved is
+// absolute; spelling the home dir as `~` keeps the username out of it.
+// Compared as forward-slashed strings so the spelling is the same on every host.
+function shown(p: string, home: string): string {
+  const fp = p.replace(/\\/g, "/");
+  const fh = home.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!fh) return p;
+  if (fp.toLowerCase() === fh.toLowerCase()) return "~";
+  return fp.toLowerCase().startsWith(fh.toLowerCase() + "/") ? `~/${fp.slice(fh.length + 1)}` : p;
+}
+
+const FILE_WRITE_TOOLS = new Set(["write", "edit"]);
+// Tools that write a local file they're handed a path for. Readers that take a
+// path (the local uploader) are left alone: reading the notebook is fine.
+const LOCAL_WRITER_TOOL = /download/i;
+// Parameter names those tools use for the destination.
+const LOCAL_PATH_KEY = /^(?:file_?path|path|output_?path|dest(?:ination)?(?:_path)?|out_?file)$/i;
+// The record files only the hooked file tools may write.
+const RECORD_BASENAMES = new Set(["notebook.md", "activity.jsonl"]);
+// Read-like pi tools that take an optional `path`. grep reads file CONTENTS, so
+// `grep <pat> ~/.ssh/id_rsa` is a credential-leak vector; ls/find/glob enumerate
+// names under a path. All face the sensitive-path floor AND the workspace jail --
+// a read pointed outside the work dir prompts, same as a write. A path-less call
+// (e.g. grep with just a pattern) searches the cwd and is allowed.
+const FILE_READ_TOOLS = new Set(["read", "grep", "ls", "find", "glob"]);
+
+function pick(toolInput: Record<string, unknown>, key: string): string | undefined {
+  const v = toolInput[key];
+  return typeof v === "string" ? v : undefined;
+}
+
+// pi declares its file tools with a `path` parameter, but every one of their
+// renderers resolves `file_path ?? path` (dist/core/tools/{edit,write,read}.js):
+// the Anthropic spelling arrives often enough that pi displays it. A floor must
+// not assume one spelling, so both keys are collected and each check below runs
+// across all of them -- a benign `path` cannot launder a sensitive `file_path`,
+// and the path the human is asked about is one the tool could actually touch.
+const PATH_KEYS = ["path", "file_path"];
+
+interface PathTarget {
+  raw: string;
+  resolved: string;
+  inside: boolean;
+}
+
+function pathTargets(req: PolicyRequest, deps: PolicyDeps): PathTarget[] {
+  const out: PathTarget[] = [];
+  for (const key of PATH_KEYS) {
+    const raw = pick(req.toolInput, key);
+    if (!raw || out.some((t) => t.raw === raw)) continue;
+    out.push({ raw, ...deps.resolver.contains(raw) });
+  }
+  return out;
+}
+
+// Apply the weak-model + non-interactive modifiers to an `ask`.
+function finalizeAsk(req: PolicyRequest, category: string, reason: string): PolicyResult {
+  if (req.modelTier === "weak") {
+    return { decision: "deny", category, reason: `${reason} (denied: low-capability model)` };
+  }
+  if (!req.interactive) {
+    return {
+      decision: "deny",
+      category,
+      reason: `${reason} (denied: no interactive session to approve)`,
+    };
+  }
+  return { decision: "ask", category, reason };
+}
+
+// A destructive, irreversible Galaxy operation (#338). Always confirm -- regardless of
+// model tier, so it deliberately does NOT go through finalizeAsk (no weak->deny downgrade).
+// A non-interactive session has no one to approve, so it denies rather than running silently.
+function destructiveGalaxy(req: PolicyRequest, op: GalaxyDestructiveOp): PolicyResult {
+  const headline = describeGalaxyDestructive(op).headline;
+  if (!req.interactive) {
+    return {
+      decision: "deny",
+      category: "galaxy:destructive",
+      reason: `${headline} (denied: no interactive session to approve)`,
+    };
+  }
+  return { decision: "ask", category: "galaxy:destructive", reason: headline };
+}
+
+export function decide(req: PolicyRequest, deps: PolicyDeps): PolicyResult {
+  // 1. Bypass short-circuit (human-only; see guardian-config.resolveBypass).
+  if (req.config.dangerouslyBypassPermissions) {
+    return { decision: "allow", category: "bypass", reason: "permissions bypassed" };
+  }
+
+  // pi emits its built-in file tools lowercase ("bash"/"read"/"write"/"edit"); we
+  // normalize so a future capitalized or renamed emission can't slip past the jail
+  // into the "other -> allow" bucket. (Verified: pi has exactly write+edit, lowercase.)
+  const toolName = req.toolName.toLowerCase();
+
+  if (toolName === "bash") {
+    const command = pick(req.toolInput, "command") ?? "";
+    const c = classifyBash(command, deps.home, req.cwd);
+    if (c.kind === "catastrophic") {
+      return { decision: "deny", category: "bash:catastrophic", reason: c.reason };
+    }
+    // The classifier judges the command string; only this layer has a resolver.
+    // A write target that looks like ordinary work product in the analysis
+    // workspace but realpaths into Orbit's own state is still Orbit's own state.
+    for (const p of c.stateDirWriteTargets) {
+      if (isOrbitStatePath(deps.resolver.contains(p).resolved, deps.home)) {
+        return {
+          decision: "deny",
+          category: "bash:catastrophic",
+          reason: "write to the Orbit config directory",
+        };
+      }
+    }
+    // Sensitive-read floor: every content-read target, including inside a pipe or
+    // compound command (closes the `cat secret | tool` evasion). A dedicated
+    // credential store is denied for ALL tiers; any other sensitive path
+    // downgrades to an ask (deny for weak / non-interactive).
+    // Targets resolved after a cd go first, so the credential store a cd reached
+    // is denied even when the operand as typed is only basename-sensitive
+    // (`cd ~/.ssh && cat id_rsa`). A command with no cd has none, and keeps the
+    // single first-match pass it always had.
+    const cdReads = c.cdReadPaths.map((p) => ({ p, ...deps.resolver.contains(p) }));
+    for (const { p, resolved } of cdReads) {
+      if (isCredentialStore(resolved, deps.home)) return denyCredentialStore(p, deps.home);
+    }
+    for (const p of c.sensitiveReadPaths) {
+      const { resolved } = deps.resolver.contains(p);
+      if (isCredentialStore(resolved, deps.home)) return denyCredentialStore(p, deps.home);
+      if (isSensitivePath(resolved, deps.home)) {
+        return finalizeAsk(req, "read:sensitive", `read of sensitive path ${shown(p, deps.home)}`);
+      }
+    }
+    for (const { p, resolved } of cdReads) {
+      if (isSensitivePath(resolved, deps.home)) {
+        return finalizeAsk(req, "read:sensitive", `read of sensitive path ${shown(p, deps.home)}`);
+      }
+    }
+    // Workspace-jail floor: only confidently-parsed simple read commands, so a
+    // compound command's jail semantics stay unchanged (it falls to "unknown").
+    for (const p of c.readPaths) {
+      const { inside } = deps.resolver.contains(p);
+      if (!inside) {
+        return finalizeAsk(req, "read:escape", `read outside workspace: ${p}`);
+      }
+    }
+    if (c.kind === "safe") {
+      return { decision: "allow", category: "bash:safe", reason: c.reason };
+    }
+    // Destructive Galaxy API call via raw curl/wget (DELETE /api/histories/{id}). A
+    // guardrail, not a boundary -- routes the unknown command to the same destructive
+    // confirm as the tool path (asks even a weak model) instead of a generic "unknown" ask.
+    // Catastrophic pipes were already denied above, so they never reach here.
+    {
+      const op = isGalaxyDestructiveCurl(command);
+      if (op) return destructiveGalaxy(req, op);
+    }
+    // Unknown command. A trusted workspace relaxes by one notch only, and only
+    // for this category: trusted model ask->allow, weak model deny->ask (the
+    // human stays in the loop). It never lifts the catastrophic/jail/sensitive
+    // floor above, and it never covers a command run after a cd into Orbit's own
+    // state or a credential store -- trusting the workspace says nothing about
+    // those directories.
+    // Nor a line that names the analysis record or the registry: what an
+    // interpreter or script does with them is beyond this classifier, and the
+    // shell write forms it does model are denied above.
+    if (req.config.trustedWorkspaces.includes(req.cwd) && !c.guardedCwd && !c.namesRecord) {
+      if (req.modelTier === "trusted") {
+        return {
+          decision: "allow",
+          category: "bash:trusted-workspace",
+          reason: "unknown command in trusted workspace",
+        };
+      }
+      if (!req.interactive) {
+        return {
+          decision: "deny",
+          category: "bash:unknown",
+          reason: `${c.reason} (denied: no interactive session to approve)`,
+        };
+      }
+      return { decision: "ask", category: "bash:trusted-workspace", reason: c.reason };
+    }
+    // Unrecognized command in an untrusted workspace. Both tiers get a human
+    // approval prompt when interactive -- a weak model is no longer hard-denied
+    // here, so a user who explicitly chose local execution can approve routine
+    // local work (run a script it just wrote, a compound/redirected command)
+    // instead of being stuck (#232). Nothing is auto-allowed: the silent pass
+    // stays reserved for a trusted model in a trusted workspace (above), and the
+    // catastrophic / credential-store / sensitive-read / jail floors are all
+    // enforced before this point, so this branch only governs the residual
+    // "command we can't reason about" case. A headless session still denies --
+    // there is no one to approve.
+    if (!req.interactive) {
+      return {
+        decision: "deny",
+        category: "bash:unknown",
+        reason: `${c.reason} (denied: no interactive session to approve)`,
+      };
+    }
+    return { decision: "ask", category: "bash:unknown", reason: c.reason };
+  }
+
+  if (FILE_READ_TOOLS.has(toolName)) {
+    // Each floor sweeps every target before the next one runs, so the strictest
+    // verdict wins no matter which key carries the offending path.
+    const targets = pathTargets(req, deps);
+    for (const t of targets) {
+      if (isCredentialStore(t.resolved, deps.home)) return denyCredentialStore(t.raw, deps.home);
+    }
+    for (const t of targets) {
+      if (isSensitivePath(t.resolved, deps.home)) {
+        return finalizeAsk(req, "read:sensitive", `${req.toolName} of sensitive path ${t.raw}`);
+      }
+    }
+    // Out-of-workspace reads prompt. Sensitive paths are floored above.
+    for (const t of targets) {
+      if (!t.inside) {
+        return finalizeAsk(req, "read:escape", `${req.toolName} outside workspace: ${t.raw}`);
+      }
+    }
+    return { decision: "allow", category: "read:ok", reason: "non-sensitive read" };
+  }
+
+  if (FILE_WRITE_TOOLS.has(toolName)) {
+    const targets = pathTargets(req, deps);
+    if (targets.length === 0) {
+      return finalizeAsk(req, "write:no-path", "write with no resolvable path");
+    }
+    // Credential-shaped writes are floored regardless of jail membership, mirroring
+    // the read branch -- a secret dropped inside the workspace is still a secret.
+    for (const t of targets) {
+      if (isSensitivePath(t.resolved, deps.home)) {
+        return finalizeAsk(req, "write:sensitive", `write to sensitive path ${t.raw}`);
+      }
+    }
+    // Gated even inside the jail: a script under .git/hooks runs on the next git
+    // operation, and .loom/ is Orbit's own state -- these always prompt, regardless
+    // of being in the workspace. The lone carve-out is the $HOME/.loom/analyses
+    // tree (Orbit's default cwd), where the analysis's own files are work product;
+    // a .git/.loom/.orbit nested inside an analysis still gates. See
+    // isProtectedWritePath.
+    //
+    // The path as written is checked as well as the realpath: a state dir that
+    // is itself a symlink (onto a bigger disk, say) realpaths to somewhere with
+    // no state segment, and since it is also a jail root the write would
+    // otherwise pass silently.
+    // The registry and provenance are a floor, not an ask: approving the
+    // model's write to its own approval record would make the approval mean
+    // nothing.
+    for (const t of targets) {
+      const lexical = path.resolve(req.cwd, expandHome(t.raw, deps.home));
+      if (isRecordStorePath(t.resolved) || isRecordStorePath(lexical)) {
+        return {
+          decision: "deny",
+          category: "write:record-store",
+          reason: `write to Orbit's harness-owned record ${t.raw} (approvals, run evaluations, provenance) blocked for all models`,
+        };
+      }
+    }
+    for (const t of targets) {
+      const lexical = path.resolve(req.cwd, expandHome(t.raw, deps.home));
+      if (isProtectedWritePath(t.resolved, deps.home) || isProtectedWritePath(lexical, deps.home)) {
+        return finalizeAsk(req, "write:protected", `write to protected path ${t.raw}`);
+      }
+    }
+    for (const t of targets) {
+      if (!t.inside) {
+        return finalizeAsk(req, "write:escape", `write outside workspace: ${t.raw}`);
+      }
+    }
+    return { decision: "allow", category: "write:in-jail", reason: "write inside workspace" };
+  }
+
+  // A tool that writes a local file it is handed a path for -- download_dataset
+  // with `file_path` is the one that exists -- must not land
+  // on the analysis record or the harness-owned registry, any more than the
+  // shell may. Lexical and resolved both, as for the write tools.
+  for (const [key, value] of LOCAL_WRITER_TOOL.test(toolName)
+    ? Object.entries(req.toolInput)
+    : []) {
+    if (typeof value !== "string" || !LOCAL_PATH_KEY.test(key) || value.length === 0) continue;
+    const lexical = path.resolve(req.cwd, expandHome(value, deps.home));
+    const { resolved } = deps.resolver.contains(value);
+    const recordFile = [lexical, resolved].some((p) =>
+      RECORD_BASENAMES.has(path.basename(p).toLowerCase()),
+    );
+    if (recordFile || isRecordStorePath(lexical) || isRecordStorePath(resolved)) {
+      return {
+        decision: "deny",
+        category: "write:record-store",
+        reason: `${req.toolName} would write ${value}, part of the analysis record`,
+      };
+    }
+  }
+
+  // Destructive Galaxy operations (whole-history delete/purge) -- called directly or
+  // dispatched through the code-mode run_galaxy_tool envelope -- must be confirmed
+  // regardless of tier (#338). Non-destructive Galaxy/MCP tools fall through to the allow.
+  {
+    const op = classifyGalaxyDestructive(toolName, req.toolInput);
+    if (op) return destructiveGalaxy(req, op);
+  }
+
+  // Everything else is allowed: Galaxy/notebook tools, web fetchers, MCP. These are
+  // the remote/egress surface (notebook_push_to_galaxy, galaxy_upload_*/run_user_tool,
+  // skills_fetch's ~/.loom cache write) and are deliberately OUT of scope
+  // for the working-dir write-jail -- a local write boundary cannot and does not
+  // promise anything about data leaving the machine. Gating egress is separate future
+  // work; do not let this fallthrough be read as "confined".
+  return { decision: "allow", category: "other", reason: "non-local-execution tool" };
+}