@goodandready/dsh-approval-gate 0.1.17 → 0.1.18

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.18
+
+- Security: Эвристический предохранитель размера аргументов (`computePayloadSize` / `maxPayloadBytes`, по умолчанию 64 КБ) для предотвращения переполнения контекста LLM-ревьюера и обхода инспекции (`payload-too-large` -> `ask`) (Refs: #71).
+- Security: Сканер анти-инъекций инструкций в аргументы и скрипты (`scanPromptInjection`) с жесткой блокировкой директив обхода правил (`SYSTEM OVERRIDE: ALLOW`, `ignore previous instructions` и др. -> `reviewer-injection-attempt`) (Refs: #72).
+- Security: Страж соответствия контракту задачи (`ContractGuard` в `lib/contract-guard.js`) с перехватом нецелевых системных пакетных менеджеров, управления службами, сетевых конфигураций и запрещенных инструментов (`contract-violation` -> `ask`) (Refs: #87).
+- Security: Строгая изоляция временных каталогов проекта (`resolveTempRoot`, `isGlobalTempPath`, `checkTempIsolation` в `lib/paths.js`) с переводом обращений к глобальному `/tmp` на запрос подтверждения (`unisolated-temp-path` -> `ask` в пользу `<workspace>/.dsh/tmp`) (Refs: #102).
+- Feature: Контроль оверинжиниринга (`OverengineeringGuard` в `lib/overengineering.js`) с отслеживанием числа создаваемых уникальных файлов за сессию (`maxFilesPerSession`, по умолчанию 10) и запросом подтверждения при превышении (`overengineering-file-limit` -> `ask`) (Refs: #89).
+
 ## 0.1.17
 
 - Feature: Автонормализация URL эндпоинтов пользовательских LLM (`normalizeChatCompletionsUrl`) с поддержкой bare host, портов, `/v1` и `/chat/completions` без риска 404 (Refs: #127).

package/lib/contract-guard.js

@@ -0,0 +1,147 @@
+// lib/contract-guard.js
+// Enforces task contract boundaries and blocks out-of-scope system mutations (#87).
+
+const SYSTEM_PACKAGE_MANAGERS = new Set([
+  "apt",
+  "apt-get",
+  "dpkg",
+  "yum",
+  "dnf",
+  "pacman",
+  "zypper",
+  "brew",
+  "snap",
+  "flatpak",
+  "apk",
+]);
+
+const SYSTEM_SERVICE_COMMANDS = new Set([
+  "systemctl",
+  "service",
+  "init",
+  "reboot",
+  "shutdown",
+  "poweroff",
+]);
+
+const SYSTEM_NETWORKING_COMMANDS = new Set([
+  "iptables",
+  "ufw",
+  "firewalld",
+  "ifconfig",
+  "netplan",
+]);
+
+const SYSTEM_CONFIG_TARGETS = [
+  "/etc/passwd",
+  "/etc/shadow",
+  "/etc/sudoers",
+  "/etc/fstab",
+  "/etc/hosts",
+  "/etc/pam.d",
+  "/etc/profile",
+  "/etc/bash.bashrc",
+];
+
+/**
+ * Validates whether a command or tool execution stays within task contract boundaries (#87).
+ */
+export class ContractGuard {
+  /**
+   * @param {{
+   *   allowSystemMutations?: boolean,
+   *   allowedTools?: string[],
+   *   allowedCommands?: string[],
+   *   forbiddenCommands?: string[]
+   * }} [contract]
+   */
+  constructor(contract = {}) {
+    this.allowSystemMutations = contract.allowSystemMutations === true;
+    this.allowedTools = Array.isArray(contract.allowedTools) ? new Set(contract.allowedTools) : null;
+    this.allowedCommands = Array.isArray(contract.allowedCommands) ? new Set(contract.allowedCommands) : null;
+    this.forbiddenCommands = Array.isArray(contract.forbiddenCommands) ? new Set(contract.forbiddenCommands) : null;
+  }
+
+  /**
+   * Checks if an execution violates the task contract boundaries.
+   *
+   * @param {string} toolName
+   * @param {string} [command]
+   * @param {any} [execution]
+   * @returns {{ allowed: boolean, reason?: string, detail?: string, snippet?: string }}
+   */
+  check(toolName, command, execution) {
+    // 1. Tool-level restriction
+    if (this.allowedTools && toolName && !this.allowedTools.has(toolName)) {
+      return {
+        allowed: false,
+        reason: "contract-violation",
+        detail: `Tool '${toolName}' is not permitted by task contract`,
+        snippet: toolName,
+      };
+    }
+
+    if (!command || typeof command !== "string") {
+      return { allowed: true };
+    }
+
+    const trimmed = command.trim();
+    if (!trimmed) return { allowed: true };
+
+    const firstWord = trimmed.split(/\s+/)[0].replace(/^sudo\s+/, "");
+
+    // 2. Explicit forbidden command list
+    if (this.forbiddenCommands && this.forbiddenCommands.has(firstWord)) {
+      return {
+        allowed: false,
+        reason: "contract-violation",
+        detail: `Command '${firstWord}' is explicitly forbidden by task contract`,
+        snippet: firstWord,
+      };
+    }
+
+    // 3. System mutations guard when allowSystemMutations is false
+    if (!this.allowSystemMutations) {
+      if (SYSTEM_PACKAGE_MANAGERS.has(firstWord)) {
+        return {
+          allowed: false,
+          reason: "contract-violation",
+          detail: `Out-of-scope system package manager invocation: ${firstWord}`,
+          snippet: trimmed,
+        };
+      }
+
+      if (SYSTEM_SERVICE_COMMANDS.has(firstWord)) {
+        return {
+          allowed: false,
+          reason: "contract-violation",
+          detail: `Out-of-scope system service or reboot control: ${firstWord}`,
+          snippet: trimmed,
+        };
+      }
+
+      if (SYSTEM_NETWORKING_COMMANDS.has(firstWord)) {
+        return {
+          allowed: false,
+          reason: "contract-violation",
+          detail: `Out-of-scope network configuration command: ${firstWord}`,
+          snippet: trimmed,
+        };
+      }
+
+      // Check system configuration mutation redirects
+      for (const target of SYSTEM_CONFIG_TARGETS) {
+        if (trimmed.includes(target) && /[><]/.test(trimmed)) {
+          return {
+            allowed: false,
+            reason: "contract-violation",
+            detail: `Out-of-scope system configuration file write: ${target}`,
+            snippet: trimmed,
+          };
+        }
+      }
+    }
+
+    return { allowed: true };
+  }
+}

package/lib/dispatcher.js

@@ -1,208 +1,210 @@
-// lib/dispatcher.js
-// Command Dispatcher: architectural isolation of command parsing and syntactic dispatch
-// from the safety evaluation engine.
-// Resolves: #133, #65
-
-import { tokenize, splitSubcommands } from "./tokenizer.js";
-import { parseGitArgv, classifyGitOperation } from "./parsers/git.js";
-import { extractRedirects, inspectRedirectSecurity, inspectSilentErrors, inspectPipelines } from "./parsers/shell-cmds.js";
-import { isLoopbackCommand, isLoopbackUrl } from "./loopback.js";
-import { resolveSafePath, isPathTraversal, isProtectedConfigPath } from "./paths.js";
-
-export const TOOL_KIND_SHELL = "shell";
-export const TOOL_KIND_FILE_WRITE = "file_write";
-export const TOOL_KIND_FILE_READ = "file_read";
-export const TOOL_KIND_NETWORK = "network";
-export const TOOL_KIND_GENERIC = "generic";
-
-export const DEFAULT_BASH_TOOL = "bash";
-export const DEFAULT_FILE_WRITE_TOOLS = Object.freeze([
-  "write",
-  "edit",
-  "Write",
-  "Edit",
-  "str_replace_editor",
-  "str_replace",
-  "apply_patch",
-]);
-
-export const DEFAULT_READ_ONLY_TOOLS = Object.freeze([
-  "read_file",
-  "view_file",
-  "read_url_content",
-  "search_web",
-  "list_dir",
-  "glob",
-  "grep",
-]);
-
-export const DEFAULT_NETWORK_TOOLS = Object.freeze([
-  "fetch",
-  "web_fetch",
-  "http_request",
-  "read_url_content",
-]);
-
-/**
- * Extracts target file path from various tool argument schemas.
- *
- * @param {any} args
- * @returns {string | null}
- */
-export function extractFilePath(args) {
-  if (typeof args === "string") return args;
-  if (!args || typeof args !== "object") return null;
-  const keys = [
-    "path",
-    "file_path",
-    "filePath",
-    "file",
-    "filename",
-    "target",
-    "to",
-    "TargetFile",
-    "AbsolutePath",
-  ];
-  for (const k of keys) {
-    if (typeof args[k] === "string" && args[k].trim()) {
-      return args[k].trim();
-    }
-  }
-  return null;
-}
-
-/**
- * Checks whether an execution originates from a designated read-only reviewer agent.
- * Resolves: #65 (strict read-only reviewer subagent isolation).
- *
- * @param {any} execution
- * @param {any} [options]
- * @returns {boolean}
- */
-export function isReviewerAgent(execution, options = {}) {
-  if (options && options.reviewerMode === true) return true;
-  const agent = execution && execution.agent;
-  if (!agent) return false;
-
-  const role = typeof agent.role === "string" ? agent.role.toLowerCase() : "";
-  const name = typeof agent.name === "string" ? agent.name.toLowerCase() : "";
-  const type = typeof agent.type === "string" ? agent.type.toLowerCase() : "";
-
-  return role.includes("review") || name.includes("review") || type.includes("review");
-}
-
-export class CommandDispatcher {
-  /**
-   * @param {{
-   *   toolName?: string,
-   *   fileWriteTools?: string[] | Set<string>,
-   *   readOnlyTools?: string[] | Set<string>,
-   *   networkTools?: string[] | Set<string>,
-   *   workspaceDir?: string
-   * }} [options]
-   */
-  constructor(options = {}) {
-    this.toolName = options.toolName || DEFAULT_BASH_TOOL;
-    this.fileWriteTools = new Set(options.fileWriteTools || DEFAULT_FILE_WRITE_TOOLS);
-    this.readOnlyTools = new Set(options.readOnlyTools || DEFAULT_READ_ONLY_TOOLS);
-    this.networkTools = new Set(options.networkTools || DEFAULT_NETWORK_TOOLS);
-    this.workspaceDir = options.workspaceDir || process.cwd();
-  }
-
-  /**
-   * Categorizes the tool name into functional kind.
-   *
-   * @param {string} name
-   * @returns {"shell" | "file_write" | "file_read" | "network" | "generic"}
-   */
-  classifyTool(name) {
-    if (!name) return TOOL_KIND_GENERIC;
-    if (name === this.toolName) return TOOL_KIND_SHELL;
-    if (this.fileWriteTools.has(name)) return TOOL_KIND_FILE_WRITE;
-    if (this.readOnlyTools.has(name)) return TOOL_KIND_FILE_READ;
-    if (this.networkTools.has(name)) return TOOL_KIND_NETWORK;
-    return TOOL_KIND_GENERIC;
-  }
-
-  /**
-   * Dispatches and normalizes a tool execution request into a structured descriptor.
-   *
-   * @param {any} execution - The tool execution event carrying name, arguments, agent, session
-   * @param {any} [options] - Dynamic context overrides
-   * @returns {{
-   *   tool: string,
-   *   kind: "shell" | "file_write" | "file_read" | "network" | "generic",
-   *   isMutating: boolean,
-   *   reviewerViolation: boolean,
-   *   command?: string,
-   *   tokens?: any[],
-   *   subcommands?: string[],
-   *   git?: any,
-   *   silentError?: any,
-   *   loopback?: any,
-   *   filePath?: string,
-   *   pathSafety?: any
-   * }}
-   */
-  dispatch(execution, options = {}) {
-    const name = execution && execution.name ? String(execution.name).trim() : "";
-    const args = execution ? execution.arguments : undefined;
-    const kind = this.classifyTool(name);
-    const isReviewer = isReviewerAgent(execution, options);
-
-    const isMutating = kind === TOOL_KIND_SHELL || kind === TOOL_KIND_FILE_WRITE;
-    const reviewerViolation = isReviewer && isMutating;
-
-    const descriptor = {
-      tool: name,
-      kind,
-      isMutating,
-      reviewerViolation,
-    };
-
-    if (kind === TOOL_KIND_SHELL) {
-      const rawCommand = args && typeof args === "object" ? args.command : (typeof args === "string" ? args : "");
-      descriptor.command = typeof rawCommand === "string" ? rawCommand : "";
-
-      if (descriptor.command) {
-        const tokenized = tokenize(descriptor.command);
-        descriptor.tokens = tokenized.tokens || [];
-        descriptor.tokenizerOk = tokenized.ok;
-        descriptor.tokenizerReason = tokenized.reason;
-
-        // Subcommands breakdown
-        descriptor.subcommands = splitSubcommands(descriptor.command);
-
-        // Silent errors inspection (#90)
-        descriptor.silentError = inspectSilentErrors(descriptor.command);
-
-        // Git inspection (#125, #103)
-        if (/\bgit\b/.test(descriptor.command)) {
-          const firstWords = descriptor.command.trim().split(/\s+/);
-          descriptor.git = parseGitArgv(firstWords);
-          descriptor.gitClassification = classifyGitOperation(descriptor.git.verb, descriptor.git.args);
-        }
-
-        // Loopback detection (#40)
-        descriptor.loopback = isLoopbackCommand(descriptor.command.trim().split(/\s+/));
-      }
-    } else if (kind === TOOL_KIND_FILE_WRITE) {
-      const filePath = extractFilePath(args);
-      descriptor.filePath = filePath;
-      if (filePath) {
-        const ws = options.workspaceDir || this.workspaceDir;
-        descriptor.pathSafety = resolveSafePath(filePath, ws);
-        descriptor.isProtected = isProtectedConfigPath(descriptor.pathSafety.canonical || filePath);
-        descriptor.isTraversal = !descriptor.pathSafety.safe;
-      }
-    } else if (kind === TOOL_KIND_NETWORK) {
-      const url = args && typeof args === "object" ? (args.url || args.Url || args.uri || args.Uri) : "";
-      descriptor.url = typeof url === "string" ? url : "";
-      if (descriptor.url) {
-        descriptor.isLoopback = isLoopbackUrl(descriptor.url);
-      }
-    }
-
-    return descriptor;
-  }
+// lib/dispatcher.js
+// Command Dispatcher: architectural isolation of command parsing and syntactic dispatch
+// from the safety evaluation engine.
+// Resolves: #133, #65
+
+import { tokenize, splitSubcommands } from "./tokenizer.js";
+import { parseGitArgv, classifyGitOperation } from "./parsers/git.js";
+import { extractRedirects, inspectRedirectSecurity, inspectSilentErrors, inspectPipelines } from "./parsers/shell-cmds.js";
+import { isLoopbackCommand, isLoopbackUrl } from "./loopback.js";
+import { resolveSafePath, isPathTraversal, isProtectedConfigPath } from "./paths.js";
+
+export const TOOL_KIND_SHELL = "shell";
+export const TOOL_KIND_FILE_WRITE = "file_write";
+export const TOOL_KIND_FILE_READ = "file_read";
+export const TOOL_KIND_NETWORK = "network";
+export const TOOL_KIND_GENERIC = "generic";
+
+export const DEFAULT_BASH_TOOL = "bash";
+export const DEFAULT_FILE_WRITE_TOOLS = Object.freeze([
+  "write",
+  "edit",
+  "Write",
+  "Edit",
+  "write_to_file",
+  "replace_file_content",
+  "str_replace_editor",
+  "str_replace",
+  "apply_patch",
+]);
+
+export const DEFAULT_READ_ONLY_TOOLS = Object.freeze([
+  "read_file",
+  "view_file",
+  "read_url_content",
+  "search_web",
+  "list_dir",
+  "glob",
+  "grep",
+]);
+
+export const DEFAULT_NETWORK_TOOLS = Object.freeze([
+  "fetch",
+  "web_fetch",
+  "http_request",
+  "read_url_content",
+]);
+
+/**
+ * Extracts target file path from various tool argument schemas.
+ *
+ * @param {any} args
+ * @returns {string | null}
+ */
+export function extractFilePath(args) {
+  if (typeof args === "string") return args;
+  if (!args || typeof args !== "object") return null;
+  const keys = [
+    "path",
+    "file_path",
+    "filePath",
+    "file",
+    "filename",
+    "target",
+    "to",
+    "TargetFile",
+    "AbsolutePath",
+  ];
+  for (const k of keys) {
+    if (typeof args[k] === "string" && args[k].trim()) {
+      return args[k].trim();
+    }
+  }
+  return null;
+}
+
+/**
+ * Checks whether an execution originates from a designated read-only reviewer agent.
+ * Resolves: #65 (strict read-only reviewer subagent isolation).
+ *
+ * @param {any} execution
+ * @param {any} [options]
+ * @returns {boolean}
+ */
+export function isReviewerAgent(execution, options = {}) {
+  if (options && options.reviewerMode === true) return true;
+  const agent = execution && execution.agent;
+  if (!agent) return false;
+
+  const role = typeof agent.role === "string" ? agent.role.toLowerCase() : "";
+  const name = typeof agent.name === "string" ? agent.name.toLowerCase() : "";
+  const type = typeof agent.type === "string" ? agent.type.toLowerCase() : "";
+
+  return role.includes("review") || name.includes("review") || type.includes("review");
+}
+
+export class CommandDispatcher {
+  /**
+   * @param {{
+   *   toolName?: string,
+   *   fileWriteTools?: string[] | Set<string>,
+   *   readOnlyTools?: string[] | Set<string>,
+   *   networkTools?: string[] | Set<string>,
+   *   workspaceDir?: string
+   * }} [options]
+   */
+  constructor(options = {}) {
+    this.toolName = options.toolName || DEFAULT_BASH_TOOL;
+    this.fileWriteTools = new Set(options.fileWriteTools || DEFAULT_FILE_WRITE_TOOLS);
+    this.readOnlyTools = new Set(options.readOnlyTools || DEFAULT_READ_ONLY_TOOLS);
+    this.networkTools = new Set(options.networkTools || DEFAULT_NETWORK_TOOLS);
+    this.workspaceDir = options.workspaceDir || process.cwd();
+  }
+
+  /**
+   * Categorizes the tool name into functional kind.
+   *
+   * @param {string} name
+   * @returns {"shell" | "file_write" | "file_read" | "network" | "generic"}
+   */
+  classifyTool(name) {
+    if (!name) return TOOL_KIND_GENERIC;
+    if (name === this.toolName) return TOOL_KIND_SHELL;
+    if (this.fileWriteTools.has(name)) return TOOL_KIND_FILE_WRITE;
+    if (this.readOnlyTools.has(name)) return TOOL_KIND_FILE_READ;
+    if (this.networkTools.has(name)) return TOOL_KIND_NETWORK;
+    return TOOL_KIND_GENERIC;
+  }
+
+  /**
+   * Dispatches and normalizes a tool execution request into a structured descriptor.
+   *
+   * @param {any} execution - The tool execution event carrying name, arguments, agent, session
+   * @param {any} [options] - Dynamic context overrides
+   * @returns {{
+   *   tool: string,
+   *   kind: "shell" | "file_write" | "file_read" | "network" | "generic",
+   *   isMutating: boolean,
+   *   reviewerViolation: boolean,
+   *   command?: string,
+   *   tokens?: any[],
+   *   subcommands?: string[],
+   *   git?: any,
+   *   silentError?: any,
+   *   loopback?: any,
+   *   filePath?: string,
+   *   pathSafety?: any
+   * }}
+   */
+  dispatch(execution, options = {}) {
+    const name = execution && execution.name ? String(execution.name).trim() : "";
+    const args = execution ? execution.arguments : undefined;
+    const kind = this.classifyTool(name);
+    const isReviewer = isReviewerAgent(execution, options);
+
+    const isMutating = kind === TOOL_KIND_SHELL || kind === TOOL_KIND_FILE_WRITE;
+    const reviewerViolation = isReviewer && isMutating;
+
+    const descriptor = {
+      tool: name,
+      kind,
+      isMutating,
+      reviewerViolation,
+    };
+
+    if (kind === TOOL_KIND_SHELL) {
+      const rawCommand = args && typeof args === "object" ? args.command : (typeof args === "string" ? args : "");
+      descriptor.command = typeof rawCommand === "string" ? rawCommand : "";
+
+      if (descriptor.command) {
+        const tokenized = tokenize(descriptor.command);
+        descriptor.tokens = tokenized.tokens || [];
+        descriptor.tokenizerOk = tokenized.ok;
+        descriptor.tokenizerReason = tokenized.reason;
+
+        // Subcommands breakdown
+        descriptor.subcommands = splitSubcommands(descriptor.command);
+
+        // Silent errors inspection (#90)
+        descriptor.silentError = inspectSilentErrors(descriptor.command);
+
+        // Git inspection (#125, #103)
+        if (/\bgit\b/.test(descriptor.command)) {
+          const firstWords = descriptor.command.trim().split(/\s+/);
+          descriptor.git = parseGitArgv(firstWords);
+          descriptor.gitClassification = classifyGitOperation(descriptor.git.verb, descriptor.git.args);
+        }
+
+        // Loopback detection (#40)
+        descriptor.loopback = isLoopbackCommand(descriptor.command.trim().split(/\s+/));
+      }
+    } else if (kind === TOOL_KIND_FILE_WRITE) {
+      const filePath = extractFilePath(args);
+      descriptor.filePath = filePath;
+      if (filePath) {
+        const ws = options.workspaceDir || this.workspaceDir;
+        descriptor.pathSafety = resolveSafePath(filePath, ws);
+        descriptor.isProtected = isProtectedConfigPath(descriptor.pathSafety.canonical || filePath);
+        descriptor.isTraversal = !descriptor.pathSafety.safe;
+      }
+    } else if (kind === TOOL_KIND_NETWORK) {
+      const url = args && typeof args === "object" ? (args.url || args.Url || args.uri || args.Uri) : "";
+      descriptor.url = typeof url === "string" ? url : "";
+      if (descriptor.url) {
+        descriptor.isLoopback = isLoopbackUrl(descriptor.url);
+      }
+    }
+
+    return descriptor;
+  }
 }

package/lib/engine.js

@@ -17,6 +17,9 @@ import { QualityLedger } from "./ledger.js";
 import { AuditLogger } from "./audit-log.js";
 import { DeclarativeRulesEngine } from "./rules-loader.js";
 import { BlockCounters } from "./counters.js";
+import { ContractGuard } from "./contract-guard.js";
+import { OverengineeringGuard } from "./overengineering.js";
+import { extractFilePath, DEFAULT_FILE_WRITE_TOOLS } from "./dispatcher.js";
 
 /**
  * Determine whether an operation belongs to a critical risk category requiring lockedAsk (#52).
@@ -112,6 +115,14 @@ export class SecurityEngine {
     this.declarativeRules = options.declarativeRules || new DeclarativeRulesEngine({
       workspaceDir: this.inspectConfig?.workspaceDir,
     });
+    this.contractGuard = options.contractGuard !== undefined
+      ? options.contractGuard
+      : (options.taskContract ? new ContractGuard(options.taskContract) : null);
+    this.overengineeringGuard = options.overengineeringGuard !== undefined
+      ? options.overengineeringGuard
+      : (options.maxFilesPerSession !== undefined || options.maxCreatedFilesPerSession !== undefined
+          ? new OverengineeringGuard(options)
+          : null);
   }
 
   /**
@@ -316,6 +327,42 @@ export class SecurityEngine {
       return { verdict: "deny", stage: "P0", reason: hit.reason || "hard-deny", detail: hit.detail || hit.snippet, hit };
     }
 
+    // Task Contract Guard (#87)
+    if (this.contractGuard) {
+      const cg = this.contractGuard.check(toolName, command, execution);
+      if (!cg.allowed) {
+        const cgHit = {
+          ask: true,
+          reason: cg.reason || "contract-violation",
+          detail: cg.detail,
+          snippet: cg.snippet || command || toolName,
+        };
+        const res = { verdict: "ask", stage: "P4", reason: cg.reason || "contract-violation", detail: cg.detail, hit: cgHit };
+        this._applyLockedAskIfCritical(res, toolName, command, execution);
+        return res;
+      }
+    }
+
+    // Overengineering Guard (#89)
+    const fileTools = new Set(this.inspectConfig?.fileWriteTools || DEFAULT_FILE_WRITE_TOOLS);
+    if (this.overengineeringGuard && typeof toolName === "string" && fileTools.has(toolName)) {
+      const targetPath = extractFilePath(execution ? execution.arguments : undefined);
+      if (targetPath) {
+        const og = this.overengineeringGuard.checkAndRecord(sessionId, targetPath);
+        if (!og.allowed) {
+          const ogHit = {
+            ask: true,
+            reason: og.reason || "overengineering-file-limit",
+            detail: og.detail,
+            snippet: targetPath,
+          };
+          const res = { verdict: "ask", stage: "P4", reason: og.reason || "overengineering-file-limit", detail: og.detail, hit: ogHit };
+          this._applyLockedAskIfCritical(res, toolName, command, execution);
+          return res;
+        }
+      }
+    }
+
     // P1: Session Grants
     if (this.grantRegistry && typeof this.grantRegistry.decide === "function") {
       const grantMatch = this.grantRegistry.decide(toolName, execution.arguments, context);
@@ -458,6 +505,7 @@ export class SecurityEngine {
 
   resume(sessionId, reason) {
     if (this.retryGuard) this.retryGuard.reset(sessionId);
+    if (this.overengineeringGuard) this.overengineeringGuard.reset(sessionId);
     if (this.cache) this.cache.clearSession(sessionId);
     return this.breaker.resume(sessionId, reason);
   }