@guanlin4924/devflow-pi 0.1.94 → 0.1.96

package/plugins/devflow-core/runtime/hooks/hook_common.py

@@ -442,6 +442,520 @@ def tool_requests_protected_source(
     return False, []
 
 
+# Core control store protection (approval records live in control.db). This is
+# misuse prevention, not a defence against a hostile same-user process. It is
+# always on: neither DEVFLOW_SOFT_GATES, the policy mode nor hook-config can
+# disable it; hook-config may only add extra protected path globs.
+CONTROL_STORE_NAME_RE = re.compile(r"^control\.db(?:$|[-.])", re.IGNORECASE)
+CANONICAL_ACCEPTANCE_RE = re.compile(
+    r"(?:^|/)\.devflow/planning/test-runs/[^/]+/acceptance-results(?:\.meta)?\.json$",
+    re.IGNORECASE,
+)
+CANONICAL_ACCEPTANCE_COMMAND_RE = re.compile(
+    r"\.devflow/planning/test-runs/(?:[^\s/'\"`]+|\$\{?[^\s}/]+\}?)/acceptance-results(?:\.meta)?\.json\b",
+    re.IGNORECASE,
+)
+_CONTROL_TABLE = r"[\"'`\[]?(?:main\.)?(?:approval_proposals|approvals|authority_state)\b[\"'`\]]?"
+APPROVAL_SQL_RE = re.compile(
+    r"\b(?:insert\s+(?:or\s+\w+\s+)?into|replace\s+into|delete\s+from|drop\s+table(?:\s+if\s+exists)?|alter\s+table)\s+"
+    + _CONTROL_TABLE
+    + r"|\bupdate\s+(?:or\s+\w+\s+)?"
+    + _CONTROL_TABLE
+    + r"\s+set\b",
+    re.IGNORECASE,
+)
+
+
+def devflow_home() -> Path:
+    """DEVFLOW_HOME rule shared with src/paths.ts: unset/empty/whitespace-only -> ~/.devflow-pi,
+    otherwise expand a leading ``~`` and make absolute (no symlink resolution, existence not required)."""
+    configured = os.environ.get("DEVFLOW_HOME")
+    if configured is None or not configured.strip():
+        return Path(os.path.abspath(str(Path.home() / ".devflow-pi")))
+    if configured == "~" or configured.startswith("~/"):
+        configured = str(Path.home()) + configured[1:]
+    return Path(os.path.abspath(configured))
+
+
+def _raw_tool_paths(event: dict[str, Any]) -> list[str]:
+    tool_input = event.get("tool_input", {})
+    values = list(_walk_path_values(tool_input))
+    if isinstance(tool_input, dict):
+        for key in ("patch", "input"):
+            patch = tool_input.get(key)
+            if isinstance(patch, str):
+                values.extend(re.findall(r"^\*\*\* (?:Add|Update|Delete|Move) (?:File|to):\s*(.+)$", patch, re.MULTILINE))
+    elif isinstance(tool_input, str):
+        values.extend(re.findall(r"^\*\*\* (?:Add|Update|Delete|Move) (?:File|to):\s*(.+)$", tool_input, re.MULTILINE))
+    return [str(value).strip().strip("'\"") for value in values if str(value).strip()]
+
+
+def _extra_control_store_globs(root: Path) -> list[str]:
+    config = load_hook_config(root).get("gates", {})
+    section = config.get("control_store", {}) if isinstance(config, dict) else {}
+    extra = section.get("extra_protected_paths", []) if isinstance(section, dict) else []
+    return [str(item) for item in extra if isinstance(item, str) and item.strip()] if isinstance(extra, list) else []
+
+
+def _under(item: Path, base: Path) -> bool:
+    try:
+        item.relative_to(base)
+        return True
+    except ValueError:
+        return False
+
+
+def _data_home_project_roots() -> list[Path]:
+    """Every spelling of the Devflow ``projects`` tree (configured home, default home, symlink-resolved)."""
+    homes = [devflow_home(), Path(os.path.abspath(str(Path.home() / ".devflow-pi")))]
+    roots: list[Path] = []
+    for home in homes:
+        for base in (home, Path(os.path.realpath(str(home)))):
+            root = base / "projects"
+            if root not in roots:
+                roots.append(root)
+    return roots
+
+
+def is_pure_read_tool(event: dict[str, Any]) -> bool:
+    """True for file-reader tools (Read/Grep/Glob/...) that cannot mutate anything."""
+    name = tool_name(event)
+    return (
+        any(marker in name for marker in READ_TOOL_MARKERS)
+        and not is_mutation_tool(event)
+        and not is_command_tool(event)
+    )
+
+
+def path_is_control_store(
+    raw: str, cwd: Path, extra_globs: list[str] | None = None, allow_acceptance_read: bool = False
+) -> bool:
+    """``allow_acceptance_read`` opens canonical acceptance-results*.json for pure read tools only;
+    control.db, the data-home projects tree and extra globs stay denied for every access."""
+    candidate = Path(raw).expanduser()
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    project_roots = _data_home_project_roots()
+    for item in (lexical, resolved):
+        if not allow_acceptance_read and CANONICAL_ACCEPTANCE_RE.search(item.as_posix()):
+            return True
+        if CONTROL_STORE_NAME_RE.match(item.name):
+            return True
+        if any(_under(item, root) for root in project_roots):
+            return True
+        if any(fnmatch.fnmatch(item.as_posix(), pattern) for pattern in extra_globs or []):
+            return True
+    return False
+
+
+# Programs that can open a SQLite file (or run arbitrary code that can) from their arguments.
+DB_CAPABLE_PROGRAM_RE = re.compile(
+    r"^(?:sqlite3?|python[\d.]*|pypy[\d.]*|bun|bunx|node|deno|ruby|perl|php|lua|litecli|duckdb|datasette|sqlite-utils|sqlitebrowser)$",
+    re.IGNORECASE,
+)
+# Programs that read/copy/delete their file arguments, so a bare ``control.db`` operand is a real file target.
+FILE_OPERAND_PROGRAMS = {
+    "cat", "less", "more", "head", "tail", "strings", "xxd", "od", "hexdump", "file", "stat", "cp", "mv", "rm",
+    "tee", "ln", "dd", "install", "touch", "truncate", "rsync", "scp", "sha256sum", "shasum", "md5sum", "md5",
+    "cksum", "base64", "open", "tar", "zip", "gzip", "gunzip", "bzip2", "xz", "unlink", "shred", "chmod", "chown",
+}
+WRAPPER_PROGRAMS = {"sudo", "env", "command", "time", "nohup", "exec", "nice", "xargs", "builtin", "stdbuf", "timeout"}
+SHELL_PROGRAMS = {"sh", "bash", "zsh", "dash", "ksh", "fish"}
+CONTROL_OPERATORS = {";", "&&", "||", "|", "&", "|&", "(", ")", "\n"}
+REDIRECT_OPERATORS = {">", ">>", ">|", "<", "<>", "&>", ">&", "<&", "&>>"}
+ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=")
+
+
+def _split_unquoted_newlines(command: str) -> str:
+    out: list[str] = []
+    quote = ""
+    escaped = False
+    for ch in command:
+        if escaped:
+            escaped = False
+        elif ch == "\\" and quote != "'":
+            escaped = True
+        elif quote:
+            if ch == quote:
+                quote = ""
+        elif ch in "'\"":
+            quote = ch
+        elif ch == "\n":
+            out.append(" ; ")
+            continue
+        out.append(ch)
+    return "".join(out)
+
+
+def _shell_tokens(command: str) -> list[str]:
+    import shlex
+
+    prepared = _split_unquoted_newlines(command)
+    try:
+        lexer = shlex.shlex(prepared, posix=True, punctuation_chars=True)
+        lexer.whitespace_split = True
+        lexer.commenters = ""
+        return list(lexer)
+    except ValueError:
+        return [item.strip("'\"") for item in prepared.split()]
+
+
+def _expand_shell_path(token: str) -> str:
+    home = devflow_home().as_posix()
+    user_home = str(Path.home())
+    for name, value in (("DEVFLOW_HOME", home), ("HOME", user_home)):
+        token = re.sub(r"\$\{" + name + r"(?::-[^}]*)?\}|\$" + name + r"\b", lambda _m, v=value: v, token)
+    if token == "~" or token.startswith("~/"):
+        token = user_home + token[1:]
+    return token
+
+
+def _token_is_control_target(token: str, cwd: Path, *, bare_name_is_target: bool) -> bool:
+    if not token or any(ch.isspace() for ch in token):
+        return False
+    if token.startswith("-") and "=" in token:
+        token = token.split("=", 1)[1]
+    elif token.startswith("-"):
+        return False
+    expanded = _expand_shell_path(token).replace("\\", "/")
+    candidate = Path(expanded)
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    project_roots = _data_home_project_roots()
+    for item in (lexical, resolved):
+        if any(_under(item, root) for root in project_roots):
+            return True
+    if ".devflow-pi/projects" in expanded:
+        return True
+    for item in (lexical, resolved):
+        if not CONTROL_STORE_NAME_RE.match(item.name):
+            continue
+        # ``rg control.db src/`` names a pattern, not a file: a bare name only counts when it is
+        # a real file, is redirected/handed to a file-operating program, or carries a directory part.
+        if "/" in expanded or bare_name_is_target or item.exists() or resolved.exists():
+            return True
+    return False
+
+
+def _segments(tokens: list[str]) -> list[list[str]]:
+    segments: list[list[str]] = [[]]
+    for token in tokens:
+        if token in CONTROL_OPERATORS:
+            segments.append([])
+        else:
+            segments[-1].append(token)
+    return [segment for segment in segments if segment]
+
+
+def _analyze_command(command: str, cwd: Path, depth: int = 0) -> bool:
+    tokens = _shell_tokens(command)
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1 :]
+        db_program = bool(DB_CAPABLE_PROGRAM_RE.match(program))
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_command(operands[pos + 1], cwd, depth + 1):
+                        return True
+        previous = ""
+        for operand in [*segment[:index], *operands]:
+            after_redirect = previous in REDIRECT_OPERATORS or bool(re.match(r"^\d*(?:>>?|<)$", previous))
+            bare_ok = db_program or after_redirect or program in FILE_OPERAND_PROGRAMS
+            if operand not in REDIRECT_OPERATORS:
+                if db_program and (
+                    re.search(r"control\.db", operand, re.IGNORECASE) or ".devflow-pi/projects" in operand
+                ):
+                    return True
+                if _token_is_control_target(operand, cwd, bare_name_is_target=bare_ok):
+                    return True
+                glued = re.sub(r"^\d*[<>]+", "", operand)
+                if glued != operand and _token_is_control_target(glued, cwd, bare_name_is_target=True):
+                    return True
+            previous = operand
+    return False
+
+
+def command_touches_control_store(command: str, cwd: Path | None = None) -> bool:
+    """Deny shell commands that target the real control store or write approval tables.
+
+    Merely mentioning the text ``control.db`` (rg patterns, commit messages, echo) is allowed;
+    this is a mistake-prevention guard, not a sandbox."""
+    normalized = command.replace("\\", "/")
+    if APPROVAL_SQL_RE.search(normalized) or CANONICAL_ACCEPTANCE_COMMAND_RE.search(normalized):
+        return True
+    return _analyze_command(command, cwd or Path.cwd())
+
+
+def tool_touches_control_store(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    """Deny non-Core access to control.db and the Devflow project data dir; canonical
+    acceptance results are additionally readable by pure read tools (never writable)."""
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    extra = _extra_control_store_globs(root)
+    allow_read = is_pure_read_tool(event)
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_control_store(raw, cwd, extra, allow_read)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and command_touches_control_store(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
+# MCP authorization and audit data are user-local security state.  This guard
+# is deliberately narrower than DEVFLOW_HOME: only mcp.json and mcp-audit/
+# are protected, and the decision is independent of soft-gate policy.
+def path_is_mcp_protected(raw: str, cwd: Path) -> bool:
+    candidate = Path(_expand_shell_path(str(raw)))
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    home = devflow_home()
+    config = home / "mcp.json"
+    audit = home / "mcp-audit"
+    for item in (lexical, resolved):
+        if item == config or _under(item, audit):
+            return True
+    return False
+
+
+def _analyze_mcp_command(command: str, cwd: Path, depth: int = 0) -> bool:
+    tokens = _shell_tokens(command)
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1:]
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_mcp_command(operands[pos + 1], cwd, depth + 1):
+                        return True
+        ignored: set[int] = set()
+        if program in {"echo", "printf"}:
+            ignored.update(range(len(operands)))
+        elif program in {"rg", "grep", "ag", "ack"}:
+            seen_pattern = False
+            pos = 0
+            while pos < len(operands):
+                operand = operands[pos]
+                if operand in {"-e", "--regexp"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                    pos += 2
+                    continue
+                if operand.startswith("--regexp=") or (not operand.startswith("-") and not seen_pattern):
+                    ignored.add(pos)
+                    seen_pattern = True
+                pos += 1
+        elif program == "git":
+            for pos, operand in enumerate(operands):
+                if operand in {"-m", "--message"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+        previous = ""
+        for pos, operand in enumerate(operands):
+            if previous in REDIRECT_OPERATORS and path_is_mcp_protected(operand, cwd):
+                return True
+            if pos in ignored:
+                previous = operand
+                continue
+            if operand in REDIRECT_OPERATORS or operand.startswith("-"):
+                previous = operand
+                continue
+            if path_is_mcp_protected(operand, cwd):
+                return True
+            previous = operand
+    return False
+
+
+def tool_touches_mcp_config(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_mcp_protected(raw, cwd)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and _analyze_mcp_command(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
+# Run artifacts are user-local evidence, not agent-readable source.  Keep this
+# guard separate from the control-store guard: it is always on and its only
+# read exception is the Core-produced result.json summary.
+def _run_root(cwd: Path) -> Path:
+    # macOS commonly exposes /var as a symlink to /private/var; use the
+    # canonical cwd so lexical and realpath checks compare in one namespace.
+    return Path(os.path.realpath(str(cwd))) / ".devflow" / "runs"
+
+
+def _run_relative(raw: str, cwd: Path, anchor: Path | None = None) -> tuple[Path, Path, Path]:
+    # The protected root is anchored at the project root, never at the current
+    # shell cwd, so `cd .devflow && cat runs/...` still resolves into it.
+    expanded = _expand_shell_path(raw)
+    cwd_text = str(cwd)
+    expanded = re.sub(r"\$\{PWD\}|\$PWD\b", cwd_text, expanded)
+    candidate = Path(expanded.replace("\\", "/"))
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    lexical = Path(os.path.normpath(str(candidate)))
+    resolved = Path(os.path.realpath(str(candidate)))
+    return lexical, resolved, _run_root(anchor or cwd)
+
+
+def _under_run(path: Path, run_root: Path) -> bool:
+    return _under(path, run_root)
+
+
+def path_is_run_artifact(raw: str, cwd: Path, tool: dict[str, Any] | str) -> bool:
+    """Return whether a tool path enters .devflow/runs.
+
+    ``result.json`` is readable only by pure-read tools.  Glob may list the
+    runs directory itself; every other path, including result.json writes and
+    symlink aliases, remains protected.
+    """
+    lexical, resolved, run_root = _run_relative(raw, cwd)
+    paths = (lexical, resolved)
+    tool_event = tool if isinstance(tool, dict) else {"tool_name": tool}
+    pure_read = is_pure_read_tool(tool_event)
+    name = tool_name(tool_event)
+    for item in paths:
+        if not _under_run(item, run_root):
+            continue
+        relative = item.relative_to(run_root).parts
+        if name == "glob" and len(relative) == 0:
+            continue
+        if pure_read and len(relative) == 3 and relative[-1] == "result.json":
+            continue
+        return True
+    return False
+
+
+RUN_FILE_PROGRAMS = {
+    "cat", "cp", "mv", "rm", "tee", "touch", "truncate", "install", "rsync", "scp",
+    "tar", "unzip", "zip", "base64", "xxd", "strings", "od", "hexdump", "file", "stat",
+    "head", "tail", "less", "more", "sed", "awk", "nl", "bat", "rg", "grep", "find", "fd",
+    "ls", "tree", "du", "open", "sha256sum", "shasum", "md5sum", "md5", "cksum", "chmod",
+    "chown", "unlink", "shred", "dd", "gzip", "gunzip", "bzip2", "xz", "python", "python3",
+    "node", "bun", "deno", "ruby", "perl", "php", "lua",
+}
+
+
+def _token_is_run_target(token: str, cwd: Path, anchor: Path | None = None) -> bool:
+    if not token or token in REDIRECT_OPERATORS or token.startswith("-"):
+        return False
+    lexical, resolved, run_root = _run_relative(token, cwd, anchor)
+    return _under_run(lexical, run_root) or _under_run(resolved, run_root)
+
+
+def _analyze_run_command(command: str, cwd: Path, depth: int = 0, anchor: Path | None = None) -> bool:
+    anchor = anchor or cwd
+    tokens = _shell_tokens(command)
+    current_cwd = cwd
+    for segment in _segments(tokens):
+        index = 0
+        while index < len(segment) and (ASSIGNMENT_RE.match(segment[index]) or segment[index] in WRAPPER_PROGRAMS):
+            index += 1
+        if index >= len(segment):
+            continue
+        program = os.path.basename(segment[index]).lower()
+        operands = segment[index + 1:]
+        if program in SHELL_PROGRAMS and depth < 3:
+            for pos, operand in enumerate(operands):
+                if operand.startswith("-") and "c" in operand[1:] and pos + 1 < len(operands):
+                    if _analyze_run_command(operands[pos + 1], current_cwd, depth + 1, anchor):
+                        return True
+        if program == "cd" and operands:
+            if _token_is_run_target(operands[-1], current_cwd, anchor):
+                return True
+            candidate = Path(_expand_shell_path(operands[-1]))
+            current_cwd = candidate if candidate.is_absolute() else current_cwd / candidate
+            current_cwd = Path(os.path.normpath(str(current_cwd)))
+            continue
+        # Any shell redirection is a real filesystem access, even when the
+        # command producing the bytes is otherwise harmless (e.g. echo).
+        previous = ""
+        for operand in operands:
+            if previous in REDIRECT_OPERATORS and _token_is_run_target(operand, current_cwd, anchor):
+                return True
+            previous = operand
+        # Inline interpreters can open arbitrary files.  Reject the source
+        # text conservatively whenever it names the protected tree.
+        if program in {"python", "python3", "node", "bun", "deno", "ruby", "perl", "php"}:
+            for pos, operand in enumerate(operands):
+                if operand in {"-c", "-e", "--eval"} and pos + 1 < len(operands):
+                    if ".devflow/runs" in operands[pos + 1]:
+                        return True
+                if any(operand.startswith(prefix) for prefix in ("--eval=", "-e=")) and ".devflow/runs" in operand.split("=", 1)[1]:
+                    return True
+
+        # Every non-option operand is a potential filesystem target, regardless
+        # of the executable.  Only documented text positions are exempt.
+        ignored: set[int] = set()
+        if program in {"echo", "printf"}:
+            ignored.update(range(len(operands)))
+        elif program in {"rg", "grep", "ag", "ack"}:
+            seen_pattern = False
+            pos = 0
+            while pos < len(operands):
+                operand = operands[pos]
+                if operand in {"-e", "--regexp"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                    pos += 2
+                    continue
+                if operand.startswith("--regexp="):
+                    ignored.add(pos)
+                elif not operand.startswith("-") and not seen_pattern:
+                    ignored.add(pos)
+                    seen_pattern = True
+                pos += 1
+        elif program == "git":
+            for pos, operand in enumerate(operands):
+                if operand in {"-m", "--message"} and pos + 1 < len(operands):
+                    ignored.add(pos + 1)
+                elif operand.startswith("--message=") or operand.startswith("-m="):
+                    ignored.add(pos)
+
+        for pos, operand in enumerate(operands):
+            if pos in ignored or operand in REDIRECT_OPERATORS:
+                continue
+            target = operand
+            if operand.startswith("--") and "=" in operand:
+                target = operand.split("=", 1)[1]
+            if not target or target.startswith("-"):
+                continue
+            if _token_is_run_target(target, current_cwd, anchor):
+                return True
+    return False
+
+
+def command_touches_run_artifacts(command: str, cwd: Path | None = None) -> bool:
+    """Deny shell access to real run-artifact paths, not textual mentions."""
+    return _analyze_run_command(command, cwd or Path.cwd())
+
+
+def tool_touches_run_artifacts(event: dict[str, Any], root: Path) -> tuple[bool, list[str]]:
+    cwd = Path(str(event.get("cwd") or root)).expanduser()
+    blocked = [raw for raw in _raw_tool_paths(event) if path_is_run_artifact(raw, cwd, event)]
+    if blocked:
+        return True, sorted(dict.fromkeys(blocked))
+    command = command_text(event)
+    if command and command_touches_run_artifacts(command, cwd):
+        return True, ["<shell command>"]
+    return False, []
+
+
 def evidence_observed(event: dict[str, Any], root: Path, artifacts: list[str]) -> list[str]:
     name = tool_name(event)
     if not (any(marker in name for marker in READ_TOOL_MARKERS) or is_command_tool(event)):

package/plugins/devflow-core/runtime/hooks/index_gate.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""PreToolUse hook: block protected source access until indexes were observed."""
+"""PreToolUse hook: deny control-store access and block protected source access until indexes were observed."""
 
 from __future__ import annotations
 
@@ -15,13 +15,58 @@ from hook_common import (
     read_event,
     record_prechange_fingerprints,
     required_evidence,
+    tool_touches_mcp_config,
     tool_requests_protected_source,
+    tool_touches_control_store,
+    tool_touches_run_artifacts,
 )
 
 
+def deny(reason: str) -> int:
+    print(
+        json.dumps(
+            {
+                "hookSpecificOutput": {
+                    "hookEventName": "PreToolUse",
+                    "permissionDecision": "deny",
+                    "permissionDecisionReason": reason,
+                }
+            },
+            ensure_ascii=False,
+        )
+    )
+    return 0
+
+
 def main() -> int:
     event = read_event()
     root = project_root(event)
+    # Hard protection, evaluated before any soft/strict policy handling.
+    mcp_blocked, mcp_paths = tool_touches_mcp_config(event, root)
+    if mcp_blocked:
+        return deny(
+            "MCP_CONFIG_PROTECTED: $DEVFLOW_HOME/mcp.json and $DEVFLOW_HOME/mcp-audit/ are reserved for "
+            "Devflow MCP authorization and audit records; ordinary agent file and shell access is denied "
+            "regardless of DEVFLOW_SOFT_GATES. Blocked target: " + ", ".join(mcp_paths) + "."
+        )
+    control_blocked, control_paths = tool_touches_control_store(event, root)
+    if control_blocked:
+        return deny(
+            "CONTROL_STORE_PROTECTED: Devflow control.db, the Devflow data-home projects tree and writes to canonical "
+            "acceptance results are reserved for Core runtime tools; this misuse-prevention hook denies ordinary agent file and "
+            "shell access to them regardless of DEVFLOW_SOFT_GATES, but is not a same-user process sandbox. "
+            "Canonical acceptance-results*.json may be read with the Read/Grep file tools. "
+            f"Use devflow_approval(action=\"propose\"|\"list\") for approvals. Blocked target: {', '.join(control_paths)}."
+        )
+    run_blocked, run_paths = tool_touches_run_artifacts(event, root)
+    if run_blocked:
+        return deny(
+            "RUN_ARTIFACTS_PROTECTED: .devflow/runs/ contains trace, screenshots, runtime logs and other "
+            "user-local evidence that Agent tools may not read, write or access through bash. Trace and screenshots "
+            "are for the user to inspect locally with Playwright in a terminal; Agent failure analysis must read "
+            "the Core-produced result.json summary instead. Only pure-read access to a feature execution's "
+            "result.json is allowed. Blocked target: " + ", ".join(run_paths) + "."
+        )
     policy = load_policy(root)
     session_id = ensure_session(root, event)
     required = required_evidence(root, policy)
@@ -34,24 +79,11 @@ def main() -> int:
     missing = [path for path in required if path not in observed]
     strict = str(policy.get("mode", "strict")).lower() == "strict"
     if strict and required and missing and blocked:
-        reason = (
+        return deny(
             "INDEX_GATE_BLOCKED: protected source access requires observed index evidence. "
             f"Read these files first, in order: {', '.join(missing)}. "
             f"Blocked target: {', '.join(paths)}. The gate records successful tool reads, not assistant promises."
         )
-        print(
-            json.dumps(
-                {
-                    "hookSpecificOutput": {
-                        "hookEventName": "PreToolUse",
-                        "permissionDecision": "deny",
-                        "permissionDecisionReason": reason,
-                    }
-                },
-                ensure_ascii=False,
-            )
-        )
-        return 0
 
     if is_mutation_tool(event):
         record_prechange_fingerprints(root, session_id, direct_tool_paths(event, root))
@@ -60,4 +92,3 @@ def main() -> int:
 
 if __name__ == "__main__":
     raise SystemExit(main())
-