@goodandready/dsh-approval-gate 0.1.21 → 0.1.23

package/lib/dossier.js

@@ -0,0 +1,122 @@
+// lib/dossier.js
+// Evidence Dossier Gathering (#64).
+// Assembles compact evidence packets for tool calls, diffs, terminal output, and user prompts.
+
+export const MAX_PROMPT_CHARS = 200;
+export const MAX_DIFF_CHARS = 400;
+export const MAX_OUTPUT_CHARS = 300;
+
+/**
+ * Truncates a string safely with ellipsis.
+ * @param {any} str
+ * @param {number} max
+ * @returns {string}
+ */
+function truncate(str, max) {
+  if (typeof str !== "string") return "";
+  const trimmed = str.trim();
+  if (trimmed.length <= max) return trimmed;
+  return trimmed.slice(0, max - 3) + "...";
+}
+
+/**
+ * Extracts a concise summary of arguments without sensitive credentials.
+ * @param {Record<string, any>} [args]
+ * @returns {Record<string, any>}
+ */
+function sanitizeArgs(args) {
+  if (!args || typeof args !== "object") return {};
+  const summary = {};
+  for (const [k, v] of Object.entries(args)) {
+    if (k.toLowerCase().includes("token") || k.toLowerCase().includes("secret") || k.toLowerCase().includes("password")) {
+      summary[k] = "[REDACTED]";
+    } else if (typeof v === "string") {
+      summary[k] = v.length > 80 ? v.slice(0, 77) + "..." : v;
+    } else if (typeof v === "number" || typeof v === "boolean") {
+      summary[k] = v;
+    } else if (Array.isArray(v)) {
+      summary[k] = `Array(${v.length})`;
+    } else if (typeof v === "object" && v !== null) {
+      summary[k] = `Object(${Object.keys(v).length})`;
+    }
+  }
+  return summary;
+}
+
+/**
+ * Builds an evidence dossier object for an execution (#64).
+ *
+ * @param {Object} params
+ * @param {Record<string, any>} [params.execution]
+ * @param {Record<string, any>} [params.decision]
+ * @param {Record<string, any>} [params.context]
+ * @param {string} [params.toolName]
+ * @param {string} [params.command]
+ * @param {Record<string, any>} [params.args]
+ * @param {string} [params.userPrompt]
+ * @param {string} [params.diffSnippet]
+ * @param {string} [params.terminalOutput]
+ * @param {string} [params.track]
+ * @param {string} [params.riskBucket]
+ * @returns {{
+ *   toolName: string,
+ *   command: string,
+ *   argsSummary: Record<string, any>,
+ *   userPrompt: string,
+ *   diffSnippet: string,
+ *   terminalOutput: string,
+ *   track: string,
+ *   riskBucket: string,
+ *   timestamp: number
+ * }}
+ */
+export function buildEvidenceDossier({
+  execution = {},
+  decision = {},
+  context = {},
+  toolName,
+  command,
+  args,
+  userPrompt,
+  diffSnippet,
+  terminalOutput,
+  track,
+  riskBucket,
+} = {}) {
+  const tool = String(toolName || execution?.name || execution?.toolName || "").trim();
+  const cmd = String(command || execution?.arguments?.command || execution?.command || "").trim();
+  const rawArgs = args || execution?.arguments || {};
+  const prompt = userPrompt || context?.userPrompt || context?.prompt || context?.goal || "";
+  const diff = diffSnippet || context?.diffSnippet || context?.diff || rawArgs?.diff || "";
+  const output = terminalOutput || context?.terminalOutput || context?.output || "";
+  const assignedTrack = track || decision?.track || context?.track || "external";
+  const assignedRisk = riskBucket || decision?.riskBucket || context?.riskBucket || "medium";
+
+  return {
+    toolName: tool,
+    command: cmd,
+    argsSummary: sanitizeArgs(rawArgs),
+    userPrompt: truncate(prompt, MAX_PROMPT_CHARS),
+    diffSnippet: truncate(diff, MAX_DIFF_CHARS),
+    terminalOutput: truncate(output, MAX_OUTPUT_CHARS),
+    track: assignedTrack,
+    riskBucket: assignedRisk,
+    timestamp: Date.now(),
+  };
+}
+
+/**
+ * Formats a single-line summary of an evidence dossier.
+ * @param {ReturnType<typeof buildEvidenceDossier>} dossier
+ * @returns {string}
+ */
+export function formatDossierSummary(dossier) {
+  if (!dossier) return "[Dossier: empty]";
+  const parts = [];
+  if (dossier.toolName) parts.push(`tool=${dossier.toolName}`);
+  if (dossier.track) parts.push(`track=${dossier.track}`);
+  if (dossier.riskBucket) parts.push(`risk=${dossier.riskBucket}`);
+  if (dossier.userPrompt) parts.push(`prompt="${dossier.userPrompt.slice(0, 30)}"`);
+  if (dossier.diffSnippet) parts.push(`diff="${dossier.diffSnippet.slice(0, 30)}"`);
+  return `[Dossier: ${parts.join(" ")}]`;
+}

package/lib/drift.js

@@ -0,0 +1,214 @@
+// lib/drift.js
+// Trajectory Drift Detection for dsh-approval-gate (#68).
+// Detects when agent deviates from session goal into port scanning, credential hunting, or out-of-scope probing.
+
+export const DRIFT_CATEGORIES = Object.freeze({
+  NETWORK_RECON: "network-recon",
+  CREDENTIAL_HUNT: "credential-hunt",
+  SYSTEM_PROBING: "system-probing",
+  OUT_OF_SCOPE: "out-of-scope",
+});
+
+const NETWORK_RECON_PATTERNS = [
+  /\b(?:nmap|masscan|zmap)\b/i,
+  /\bnetstat\s+-[antulp]+/i,
+  /\bss\s+-[antulp]+/i,
+  /\barp\s+-(?:a|n)\b/i,
+  /\b(?:tcpdump|tshark|wireshark)\b/i,
+  /\b(?:traceroute|tracepath)\b/i,
+];
+
+const NETWORK_GOAL_KEYWORDS = [
+  "network", "port", "scan", "packet", "interface", "traceroute", "traffic", "firewall", "diagnose"
+];
+
+const CREDENTIAL_HUNT_PATTERNS = [
+  /[\\/]\.ssh[\\/](?:id_rsa|id_ed25519|id_ecdsa|authorized_keys|known_hosts)/i,
+  /[\\/]\.aws[\\/]credentials/i,
+  /\/etc\/(?:shadow|gshadow|sudoers)/i,
+  /\bcat\s+[^\n]*(?:id_rsa|id_ed25519|\.ssh|\.aws\/credentials)/i,
+  /\bfind\s+[^\n]*-(?:name|iname)\s+['"]?\*?\.(?:pem|key|pfx|pkcs12)['"]?/i,
+];
+
+const CREDENTIAL_GOAL_KEYWORDS = [
+  "ssh", "key", "credential", "auth", "secret", "password", "token", "certificate", "cert", "deploy key"
+];
+
+const SYSTEM_PROBE_PATTERNS = [
+  /\bfind\s+\/(?:\s|$)[^\n]*-perm\s+-[0-9]+/i,
+  /\/proc\/(?:kallsyms|keys|sched_debug)/i,
+  /\b(?:linpeas|winpeas|chkrootkit|rkhunter)\b/i,
+  /\bls\s+-[la]*\s+\/root\b/i,
+];
+
+const SYSTEM_PROBE_GOAL_KEYWORDS = [
+  "kernel", "root", "audit", "security audit", "permission audit", "probe", "privilege"
+];
+
+/**
+ * Checks if text contains any of the given keywords.
+ * @param {string} text
+ * @param {string[]} keywords
+ * @returns {boolean}
+ */
+function containsKeyword(text, keywords) {
+  if (!text || typeof text !== "string") return false;
+  const lower = text.toLowerCase();
+  return keywords.some((kw) => lower.includes(kw));
+}
+
+/**
+ * Detects trajectory drift for an execution against session goal (#68).
+ *
+ * @param {string} [sessionId]
+ * @param {Record<string, any>} [execution]
+ * @param {Record<string, any>} [context]
+ * @param {{ goal?: string, allowedScopes?: string[] }} [goalInfo]
+ * @returns {{
+ *   hasDrift: boolean,
+ *   driftScore: number,
+ *   driftWarning: boolean,
+ *   category?: string,
+ *   reason?: string,
+ *   detail?: string
+ * }}
+ */
+export function detectTrajectoryDrift(sessionId, execution = {}, context = {}, goalInfo = {}) {
+  const goal = String(
+    goalInfo?.goal ||
+    context?.goal ||
+    context?.userPrompt ||
+    context?.prompt ||
+    ""
+  ).trim();
+
+  const command = String(
+    execution?.arguments?.command ||
+    execution?.command ||
+    ""
+  ).trim();
+
+  const targetPath = String(
+    execution?.arguments?.TargetFile ||
+    execution?.arguments?.targetPath ||
+    execution?.arguments?.path ||
+    execution?.arguments?.file ||
+    ""
+  ).trim();
+
+  const textToScan = `${command} ${targetPath}`.trim();
+  if (!textToScan) {
+    return { hasDrift: false, driftScore: 0, driftWarning: false };
+  }
+
+  // 1. Network reconnaissance check
+  if (NETWORK_RECON_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, NETWORK_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.85,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.NETWORK_RECON,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches network reconnaissance without matching session goal (${goal.slice(0, 50) || "none"})`,
+      };
+    }
+  }
+
+  // 2. Credential hunting check
+  if (CREDENTIAL_HUNT_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, CREDENTIAL_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.95,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.CREDENTIAL_HUNT,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches credential inspection without matching session goal (${goal.slice(0, 50) || "none"})`,
+      };
+    }
+  }
+
+  // 3. System probing check
+  if (SYSTEM_PROBE_PATTERNS.some((p) => p.test(textToScan))) {
+    if (!containsKeyword(goal, SYSTEM_PROBE_GOAL_KEYWORDS)) {
+      return {
+        hasDrift: true,
+        driftScore: 0.9,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.SYSTEM_PROBING,
+        reason: "trajectory-drift-detected",
+        detail: `Operation matches system probing/privilege reconnaissance outside session goal`,
+      };
+    }
+  }
+
+  // 4. Allowed scopes check
+  const allowedScopes = goalInfo?.allowedScopes || context?.allowedScopes;
+  if (Array.isArray(allowedScopes) && allowedScopes.length > 0 && targetPath) {
+    const normTarget = targetPath.replace(/\\/g, "/").toLowerCase();
+    const isWithinScope = allowedScopes.some((scope) => {
+      const normScope = String(scope).replace(/\\/g, "/").toLowerCase();
+      return normTarget.startsWith(normScope);
+    });
+    if (!isWithinScope && (normTarget.startsWith("/etc") || normTarget.startsWith("/root") || normTarget.includes("/.ssh"))) {
+      return {
+        hasDrift: true,
+        driftScore: 0.8,
+        driftWarning: true,
+        category: DRIFT_CATEGORIES.OUT_OF_SCOPE,
+        reason: "trajectory-drift-detected",
+        detail: `Access to ${targetPath} is outside declared session scopes`,
+      };
+    }
+  }
+
+  return { hasDrift: false, driftScore: 0, driftWarning: false };
+}
+
+/**
+ * Trajectory Tracker for sessions (#68).
+ */
+export class TrajectoryTracker {
+  constructor() {
+    /** @type {Map<string, { goal: string, allowedScopes: string[], stepCount: number }>} */
+    this.sessions = new Map();
+  }
+
+  setGoal(sessionId, goal, allowedScopes = []) {
+    const key = sessionId || "default";
+    this.sessions.set(key, {
+      goal: String(goal || ""),
+      allowedScopes: Array.isArray(allowedScopes) ? [...allowedScopes] : [],
+      stepCount: 0,
+    });
+  }
+
+  getGoal(sessionId) {
+    const key = sessionId || "default";
+    return this.sessions.get(key) || null;
+  }
+
+  recordStep(sessionId) {
+    const key = sessionId || "default";
+    const entry = this.sessions.get(key);
+    if (entry) {
+      entry.stepCount += 1;
+    }
+  }
+
+  detect(sessionId, execution, context = {}) {
+    const key = sessionId || "default";
+    const goalInfo = this.sessions.get(key) || {};
+    return detectTrajectoryDrift(key, execution, context, goalInfo);
+  }
+
+  clearSession(sessionId) {
+    const key = sessionId || "default";
+    this.sessions.delete(key);
+  }
+
+  reset() {
+    this.sessions.clear();
+  }
+}

package/lib/dualtrack.js

@@ -0,0 +1,101 @@
+// lib/dualtrack.js
+// Dual-Track Markers for separating internal agent chores from external project mutations (#92).
+// Provides classification and predicates to differentiate internal sandbox actions from project changes.
+
+export const TRACK_TYPES = Object.freeze({
+  INTERNAL: "internal",
+  EXTERNAL: "external",
+});
+
+const INTERNAL_TOOL_NAMES = new Set([
+  "read_url_content",
+  "search_web",
+  "web_search",
+  "view_file",
+  "read_file",
+  "view",
+  "inspect_file",
+]);
+
+const INTERNAL_PATH_PATTERNS = [
+  /[\\/]\.dsh[\\/](?:tmp|trash|cache|sessions)[\\/]/i,
+  /[\\/]\.gemini[\\/]/i,
+  /[\\/]scratch[\\/]/i,
+  /[\\/]\.cache[\\/]/i,
+  /[\\/]tmp[\\/]/i,
+];
+
+const INTERNAL_COMMAND_REGEX = /^(?:git\s+(?:status|diff|rev-parse|branch|log)|npm\s+(?:view|help)|node\s+--version|echo\b|cat\s+[^\n]*\.(?:dsh|tmp|cache)|ls\s+-[la]*\s*(?:\.|$))/i;
+
+/**
+ * Classifies an operation into internal or external track (#92).
+ *
+ * @param {string} [toolName]
+ * @param {string} [command]
+ * @param {Record<string, any>} [args]
+ * @param {Record<string, any>} [context]
+ * @returns {'internal' | 'external'}
+ */
+export function classifyTrack(toolName, command, args = {}, context = {}) {
+  // Explicit overrides in context or args
+  if (context.track === TRACK_TYPES.INTERNAL || args?.track === TRACK_TYPES.INTERNAL || context.internal === true || args?.internal === true) {
+    return TRACK_TYPES.INTERNAL;
+  }
+  if (context.track === TRACK_TYPES.EXTERNAL || args?.track === TRACK_TYPES.EXTERNAL || context.external === true || args?.external === true) {
+    return TRACK_TYPES.EXTERNAL;
+  }
+
+  const tool = String(toolName || "").trim();
+  const cmd = String(command || (args && args.command) || "").trim();
+  const target = String((args && (args.TargetFile || args.targetPath || args.path || args.file)) || "").trim();
+
+  // Operations targeting internal scratch/temp paths are internal
+  if (target && INTERNAL_PATH_PATTERNS.some((p) => p.test(target))) {
+    return TRACK_TYPES.INTERNAL;
+  }
+
+  // Pure read-only knowledge tools are internal
+  if (INTERNAL_TOOL_NAMES.has(tool)) {
+    return TRACK_TYPES.INTERNAL;
+  }
+
+  // File mutations on project files are external
+  if (tool === "write_to_file" || tool === "replace_file_content" || tool === "create_file") {
+    return TRACK_TYPES.EXTERNAL;
+  }
+
+  // Shell command classification
+  if (cmd) {
+    if (INTERNAL_PATH_PATTERNS.some((p) => p.test(cmd))) {
+      return TRACK_TYPES.INTERNAL;
+    }
+    if (INTERNAL_COMMAND_REGEX.test(cmd)) {
+      return TRACK_TYPES.INTERNAL;
+    }
+  }
+
+  // Default for non-read commands or mutations
+  return TRACK_TYPES.EXTERNAL;
+}
+
+/**
+ * Checks whether track or decision is marked as internal.
+ * @param {string | { track?: string }} [trackOrDecision]
+ * @returns {boolean}
+ */
+export function isInternalTrack(trackOrDecision) {
+  if (!trackOrDecision) return false;
+  if (typeof trackOrDecision === "string") return trackOrDecision === TRACK_TYPES.INTERNAL;
+  return trackOrDecision.track === TRACK_TYPES.INTERNAL;
+}
+
+/**
+ * Checks whether track or decision is marked as external.
+ * @param {string | { track?: string }} [trackOrDecision]
+ * @returns {boolean}
+ */
+export function isExternalTrack(trackOrDecision) {
+  if (!trackOrDecision) return false;
+  if (typeof trackOrDecision === "string") return trackOrDecision === TRACK_TYPES.EXTERNAL;
+  return trackOrDecision.track === TRACK_TYPES.EXTERNAL;
+}

package/lib/engine.js

@@ -22,6 +22,12 @@ import { VersionGuard } from "./version-guard.js";
 import { loadAgentsRules, evaluateAgentsRules } from "./agents-parser.js";
 import { classifyMeasureKind } from "./measure-kinds.js";
 import { SnapshotManager } from "./snapshots.js";
+import { LineageManager } from "./lineage.js";
+import { isRedundantSandboxRequest, buildRedundantSandboxRemediation, checkEscalationJustification } from "./escalation.js";
+import { classifyTrack } from "./dualtrack.js";
+import { applySessionModePolicy, SessionModeRegistry } from "./session-modes.js";
+import { buildEvidenceDossier } from "./dossier.js";
+import { TrajectoryTracker } from "./drift.js";
 
 /**
  * Determine whether an operation belongs to a critical risk category requiring lockedAsk (#52).
@@ -37,29 +43,12 @@ export function isCriticalOperation(toolName, command, execution) {
   const tool = String(toolName || "").trim();
   if (!cmd && !tool) return false;
 
-  // 1. Root and privilege escalation
-  if (/^(sudo|su|doas)\b/i.test(cmd)) return true;
-  if (/\b(chmod\s+(-[a-zA-Z]*\s+)?777|chown\s+(-[a-zA-Z]*\s+)?root)\b/i.test(cmd)) return true;
-
-  // 2. Recursive or bulk destructive deletion
-  if (/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s+|--recursive\s+)/i.test(cmd)) return true;
-  if (/\b(shred|wipefs)\b/i.test(cmd)) return true;
-
-  // 3. Sensitive credentials and SSH access
+  if (/^(sudo|su|doas)\b/i.test(cmd) || /\b(chmod\s+(-[a-zA-Z]*\s+)?777|chown\s+(-[a-zA-Z]*\s+)?root)\b/i.test(cmd)) return true;
+  if (/\brm\s+(-[a-zA-Z]*[rf][a-zA-Z]*\s+|--recursive\s+)/i.test(cmd) || /\b(shred|wipefs)\b/i.test(cmd)) return true;
   if (/(\.ssh\/(id_|authorized_keys|known_hosts)|\.gnupg\/|\/etc\/shadow)/i.test(cmd)) return true;
-
-  // 4. Raw disk and filesystem manipulation
-  if (/\b(mkfs|fdisk|parted)\b/i.test(cmd)) return true;
-  if (/\bdd\s+.*of=\/dev\/(sd[a-z]|nvme|vd[a-z]|hd[a-z]|loop)/i.test(cmd)) return true;
-
-  // 5. Remote shell piping and reverse shells
-  if (/curl\s+.*\|\s*(bash|sh|python|perl)/i.test(cmd)) return true;
-  if (/\b(nc|ncat|netcat)\s+.*-e\s+/i.test(cmd)) return true;
-  if (/>&\s*\/dev\/tcp\//i.test(cmd)) return true;
-
-  // 6. System halts and service shutdowns
-  if (/\b(shutdown|reboot|poweroff|halt|init\s+0)\b/i.test(cmd)) return true;
-  if (/systemctl\s+(stop|disable|mask)\s+(sshd|systemd|ufw|iptables)/i.test(cmd)) return true;
+  if (/\b(mkfs|fdisk|parted)\b/i.test(cmd) || /\bdd\s+.*of=\/dev\/(sd[a-z]|nvme|vd[a-z]|hd[a-z]|loop)/i.test(cmd)) return true;
+  if (/curl\s+.*\|\s*(bash|sh|python|perl)/i.test(cmd) || /\b(nc|ncat|netcat)\s+.*-e\s+/i.test(cmd) || />&\s*\/dev\/tcp\//i.test(cmd)) return true;
+  if (/\b(shutdown|reboot|poweroff|halt|init\s+0)\b/i.test(cmd) || /systemctl\s+(stop|disable|mask)\s+(sshd|systemd|ufw|iptables)/i.test(cmd)) return true;
 
   // 7. Protected file writes via tools
   if (tool === "write_to_file" || tool === "edit" || tool === "replace_file_content" || tool === "str_replace_editor") {
@@ -99,6 +88,11 @@ export class SecurityEngine {
     this.versionGuard = options.versionGuard !== undefined ? options.versionGuard : new VersionGuard({ workspaceDir: this.inspectConfig?.workspaceDir });
     this.agentsRules = options.agentsRules !== undefined ? options.agentsRules : (loadAgentsRules(this.inspectConfig?.workspaceDir)?.rules || null);
     this.snapshotManager = options.snapshotManager !== undefined ? options.snapshotManager : new SnapshotManager({ workspaceDir: this.inspectConfig?.workspaceDir });
+    this.lineage = options.lineage !== undefined ? options.lineage : new LineageManager();
+    this.enableRedundantSandboxRecovery = options.enableRedundantSandboxRecovery !== false;
+    this.requireJustification = options.requireJustification === true;
+    this.sessionModes = options.sessionModes || new SessionModeRegistry(options.defaultSessionMode);
+    this.trajectoryTracker = options.trajectoryTracker !== undefined ? options.trajectoryTracker : new TrajectoryTracker();
   }
 
   /**
@@ -116,12 +110,7 @@ export class SecurityEngine {
 
       // Check Retry Exhaustion guard (#96)
       if (this.retryGuard && this.retryGuard.isExhausted(sessionId)) {
-        const exhHit = {
-          deny: true,
-          reason: "retry-exhaustion",
-          detail: "Retry exhaustion: consecutive blocked attempts exceeded threshold",
-          snippet: command || toolName,
-        };
+        const exhHit = { deny: true, reason: "retry-exhaustion", detail: "Retry exhaustion: consecutive blocked attempts exceeded threshold", snippet: command || toolName };
         const exhDecision = { verdict: "deny", stage: "P0", reason: "retry-exhaustion", detail: exhHit.detail, hit: exhHit };
         if (this.ledger) this.ledger.record(sessionId, "exhaustion", { reason: "retry-exhaustion", tool: toolName });
         if (this.counters) this.counters.record(exhDecision, execution);
@@ -157,6 +146,10 @@ export class SecurityEngine {
 
       let decision = this._evaluateWaterfall(execution, context, sessionId, toolName, command);
       this._enrichDecision(decision, execution, context);
+      if (this.sessionModes) {
+        const mode = this.sessionModes.getMode(sessionId, context?.preset || context?.sessionMode);
+        decision = applySessionModePolicy(mode, decision, { track: decision.track, riskBucket: decision.riskBucket, lockedAsk: decision.lockedAsk });
+      }
 
       // Post-decision hooks: ledger, retryGuard, cache
       if (decision.verdict === "deny") {
@@ -408,19 +401,8 @@ export class SecurityEngine {
     // If Circuit Breaker is tripped, force P4 Human Ask
     if (this.breaker.isTripped(sessionId)) {
       if (this.ledger) this.ledger.record(sessionId, "breaker", { reason: "circuit-breaker-tripped", tool: toolName });
-      const breakerHit = {
-        ask: true,
-        reason: "circuit-breaker-tripped",
-        detail: "Circuit breaker tripped due to repeated security denials. Manual confirmation required.",
-        snippet: command || toolName,
-      };
-      const res = {
-        verdict: "ask",
-        stage: "P4",
-        reason: "circuit-breaker-tripped",
-        detail: breakerHit.detail,
-        hit: breakerHit,
-      };
+      const breakerHit = { ask: true, reason: "circuit-breaker-tripped", detail: "Circuit breaker tripped due to repeated security denials. Manual confirmation required.", snippet: command || toolName };
+      const res = { verdict: "ask", stage: "P4", reason: "circuit-breaker-tripped", detail: breakerHit.detail, hit: breakerHit };
       this._applyLockedAskIfCritical(res, toolName, command, execution);
       return res;
     }
@@ -432,7 +414,45 @@ export class SecurityEngine {
       return res;
     }
 
-    // P2: Static Rules / Safe Allow
+    // Redundant Sandbox Recovery (#101)
+    if (this.enableRedundantSandboxRecovery && isRedundantSandboxRequest(command, context?.sandboxMode || context?.preset, { toolName, args: execution?.arguments })) {
+      const advice = buildRedundantSandboxRemediation(command);
+      const hit = { ask: true, reason: "redundant-sandbox-privilege", detail: advice, snippet: command };
+      const res = { verdict: "ask", stage: "P4", reason: "redundant-sandbox-privilege", detail: advice, redundantSandbox: true, hit };
+      this._applyLockedAskIfCritical(res, toolName, command, execution);
+      return res;
+    }
+
+    // Trajectory Drift (#68)
+    if (this.trajectoryTracker) {
+      const drift = this.trajectoryTracker.detect(sessionId, execution, context);
+      if (drift && drift.hasDrift) {
+        const driftHit = { ask: true, reason: drift.reason, detail: drift.detail, snippet: command || toolName };
+        const res = { verdict: "ask", stage: "P4", reason: drift.reason, detail: drift.detail, drift, hit: driftHit };
+        this._applyLockedAskIfCritical(res, toolName, command, execution);
+        return res;
+      }
+    }
+
+    // P2: Static Rules / Safe Allow (Bands Engine)
+    if (bandVerdict === "allow" && !this.requireJustification) {
+      this.breaker.resetConsecutive(sessionId);
+      return { verdict: "allow", stage: "P2", reason: "safe-allow", hit };
+    }
+
+    // Escalation Justification Protocol (#107)
+    const just = checkEscalationJustification(command, toolName, execution?.arguments, {
+      context,
+      justification: context?.justification || execution?.justification || execution?.arguments?.justification,
+      requireJustification: this.requireJustification,
+    });
+    if (just.required && !just.valid) {
+      const hit = { ask: true, reason: just.reason, detail: just.detail, snippet: command || toolName };
+      const res = { verdict: "ask", stage: "P4", reason: just.reason, detail: just.detail, justificationAdvice: just.advice, hit };
+      this._applyLockedAskIfCritical(res, toolName, command, execution);
+      return res;
+    }
+
     if (bandVerdict === "allow") {
       this.breaker.resetConsecutive(sessionId);
       return { verdict: "allow", stage: "P2", reason: "safe-allow", hit };
@@ -504,40 +524,13 @@ export class SecurityEngine {
     }
   }
 
-  addGrant(options) {
-    if (this.grantRegistry && typeof this.grantRegistry.addGrant === "function") {
-      return this.grantRegistry.addGrant(options);
-    }
-    return null;
-  }
-
-  getGrants(sessionId) {
-    if (this.grantRegistry && typeof this.grantRegistry.getGrants === "function") {
-      return this.grantRegistry.getGrants(sessionId);
-    }
-    return [];
-  }
-
-  getLedgerSummary(sessionId) {
-    return this.ledger ? this.ledger.getSummary(sessionId) : null;
-  }
-
-  isRetryExhausted(sessionId) {
-    return this.retryGuard ? this.retryGuard.isExhausted(sessionId) : false;
-  }
-
-  clearCache() {
-    if (this.cache) this.cache.clear();
-  }
-
-  getCounters() {
-    return this.counters ? this.counters.getSnapshot() : null;
-  }
-
-  resetCounters() {
-    if (this.counters) this.counters.reset();
-  }
-
+  addGrant(options) { return this.grantRegistry?.addGrant ? this.grantRegistry.addGrant(options) : null; }
+  getGrants(sessionId) { return this.grantRegistry?.getGrants ? this.grantRegistry.getGrants(sessionId) : []; }
+  getLedgerSummary(sessionId) { return this.ledger ? this.ledger.getSummary(sessionId) : null; }
+  isRetryExhausted(sessionId) { return this.retryGuard ? this.retryGuard.isExhausted(sessionId) : false; }
+  clearCache() { if (this.cache) this.cache.clear(); }
+  getCounters() { return this.counters ? this.counters.getSnapshot() : null; }
+  resetCounters() { if (this.counters) this.counters.reset(); }
   resume(sessionId, reason) {
     if (this.retryGuard) this.retryGuard.reset(sessionId);
     if (this.overengineeringGuard) this.overengineeringGuard.reset(sessionId);
@@ -551,13 +544,19 @@ export class SecurityEngine {
    */
   _enrichDecision(decision, execution, context) {
     if (!decision) return decision;
+    const command = execution && execution.arguments && execution.arguments.command;
+    if (!decision.track) decision.track = classifyTrack(execution?.name, command, execution?.arguments, context);
+    if (!decision.dossier) decision.dossier = buildEvidenceDossier({ execution, decision, context, toolName: execution?.name, command });
     if (!decision.riskBucket) decision.riskBucket = categorizeRiskBucket(execution, context);
     if (!decision.riskTags || !Array.isArray(decision.riskTags)) decision.riskTags = extractRiskTags(execution, context);
     if (!decision.measureKind) decision.measureKind = classifyMeasureKind(execution, context);
-    const command = execution && execution.arguments && execution.arguments.command;
-    if (command && isRmCommand(command)) {
-      decision.trashAlternative = suggestTrashAlternative(command, this.inspectConfig?.workspaceDir, context?.sessionId);
-    }
+    if (command && isRmCommand(command)) decision.trashAlternative = suggestTrashAlternative(command, this.inspectConfig?.workspaceDir, context?.sessionId);
+    const callId = context?.callId || execution?.callId || execution?.id || context?.execution?.id;
+    const agentId = context?.agentId || context?.agent?.id || context?.session?.agentId || execution?.agentId;
+    const subagentId = context?.subagentId || context?.session?.subagentId || execution?.subagentId;
+    if (callId) decision.callId = callId;
+    if (agentId) decision.agentId = agentId;
+    if (subagentId) decision.subagentId = subagentId;
     return decision;
   }
 
@@ -570,6 +569,11 @@ export class SecurityEngine {
   getSnapshots(sessionId) { return this.snapshotManager ? this.snapshotManager.getSnapshots(sessionId) : []; }
   clearSnapshots(sessionId) { return this.snapshotManager ? this.snapshotManager.clearSnapshots(sessionId) : { cleared: 0 }; }
   clearAllSnapshots() { return this.snapshotManager ? this.snapshotManager.clearAllSnapshots() : { cleared: 0 }; }
+  getLineage(sessionId) { return this.lineage ? this.lineage.getLineage(sessionId) : [sessionId]; }
+  registerLineage(child, parent, root) { return this.lineage ? this.lineage.registerLineage(child, parent, root) : false; }
+  setSessionGoal(sessionId, goal, scopes) { if (this.trajectoryTracker) this.trajectoryTracker.setGoal(sessionId, goal, scopes); }
+  getSessionGoal(sessionId) { return this.trajectoryTracker ? this.trajectoryTracker.getGoal(sessionId) : null; }
+  setSessionMode(sessionId, mode) { return this.sessionModes ? this.sessionModes.setMode(sessionId, mode) : null; }
+  getSessionMode(sessionId, preset) { return this.sessionModes ? this.sessionModes.getMode(sessionId, preset) : null; }
 }
 
-