@intentic/sandbox-contract 1.316.0 → 1.318.0

package/src/ids/project-dir.test.ts

@@ -0,0 +1,60 @@
+import { readFileSync } from "node:fs";
+import { MEMORY_FILE, PUBLIC_DIR, REFERENCE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
+import { STARTER_REPO } from "../state/starter.js";
+import { isProjectDirName, projectDirNameFor, projectDirNameOf, projectRemoteDir, RESERVED_PROJECT_DIR_NAMES } from "./project-dir.js";
+
+// The cases `ic` is held to as well (_sandbox/ic/src/sandbox/project_dir.rs), read from the one file both run.
+interface ProjectDirCases {
+    readonly names: readonly { readonly name: string; readonly valid: boolean }[];
+    readonly folders: readonly { readonly folder: string; readonly dirName: string }[];
+}
+// SAFETY: the fixture is this repository's own file, written to this shape; one that drifted fails every case below.
+const CASES = JSON.parse(readFileSync(new URL("./project-dir.fixture.json", import.meta.url), "utf8")) as ProjectDirCases;
+
+test.each([...CASES.names])("the shared name case $name is valid: $valid", ({ name, valid }) => {
+    expect(isProjectDirName(name)).toBe(valid);
+});
+
+test.each([...CASES.folders])("the folder $folder syncs into $dirName", ({ folder, dirName }) => {
+    expect(projectDirNameFor(folder)).toBe(dirName);
+});
+
+test("every folder name the slug produces is one the validation accepts, and slugging it again changes nothing", () => {
+    for (const { folder } of CASES.folders) {
+        const name = projectDirNameFor(folder);
+        expect(isProjectDirName(name)).toBe(true);
+        expect(projectDirNameFor(name)).toBe(name);
+    }
+});
+
+test("the reserved names are the ones the daemon keeps at the workspace root", () => {
+    expect([...RESERVED_PROJECT_DIR_NAMES].toSorted()).toEqual(
+        [
+            PUBLIC_DIR,
+            REFERENCE_DIR,
+            STARTER_REPO,
+            MEMORY_FILE,
+            "root",
+            "intent",
+            "desired-state",
+            "app",
+            "node_modules",
+            "dist",
+            "venv",
+            "claude.json",
+        ].toSorted(),
+    );
+});
+
+test("a project dir is exactly one valid name under the workspace root", () => {
+    expect(projectRemoteDir("my-app")).toBe(`${WORKSPACE_ROOT}/my-app`);
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app`)).toBe("my-app");
+    expect(projectDirNameOf(WORKSPACE_ROOT)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app/`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app/src`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/public`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/../etc`)).toBeUndefined();
+    expect(projectDirNameOf("/workspace/my-app")).toBeUndefined();
+    expect(projectDirNameOf("/srv/work/my-app", "/srv/work")).toBe("my-app");
+});

package/src/ids/project-dir.ts

@@ -0,0 +1,70 @@
+import { MEMORY_FILE, PUBLIC_DIR, REFERENCE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
+import { STARTER_REPO } from "../state/starter.js";
+
+// A PROJECT SANDBOX is made for one folder on the owner's computer, synced live into `/work/<name>` rather than into
+// /work itself: the workspace root is the daemon's own, where it keeps its state, seeds its starter repo and serves
+// `public/` to anyone with a link. `<name>` is derived from the folder's name once, on the owner's side, and every
+// later reader (the sync agent, `ic`, the daemon) only validates it. `_sandbox/ic/src/sandbox/project_dir.rs` holds the
+// validation again for the host side; `project-dir.fixture.json` is the one set of cases both run.
+
+// Top-level names the daemon treats as its own, so a project can never land on one: the public outbox, the reference
+// shelf, the starter repo seeded on first boot, the root repo's id and the three repo roles repo discovery refuses
+// (`_sandbox/sandbox/src/workspace/layout/repo-discovery.ts`), and the standing-instructions file it writes. Then the
+// names every walk of the workspace skips at any depth (@intentic/workspace-ignore IGNORED_DIRS, and the private file
+// the git scopes leave out), where a project would sync and never be seen; the daemon's tests hold this list to that
+// one. Everything else of either kind starts with a dot (`.intentic`, `.venv`), which the name rule below refuses.
+export const RESERVED_PROJECT_DIR_NAMES: readonly string[] = [
+    PUBLIC_DIR,
+    REFERENCE_DIR,
+    STARTER_REPO,
+    "root",
+    "intent",
+    "desired-state",
+    "app",
+    MEMORY_FILE,
+    "node_modules",
+    "dist",
+    "venv",
+    "claude.json",
+];
+
+// Starts alphanumeric, so no dot-file and no leading dash an argv could read as a flag; no separator, so it is always
+// one path segment; bounded, since it also names a git dir and a folder in every view of the workspace.
+const PROJECT_DIR_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const PROJECT_DIR_NAME_MAX = 64;
+
+// Used when nothing of the folder's name survives the slug (a name in another script, or only punctuation).
+const FALLBACK_NAME = "project";
+
+// Combining marks, which NFKD splits off an accented letter.
+const COMBINING_MARKS = /[\u0300-\u036f]/g;
+
+export const isProjectDirName = (name: string): boolean => PROJECT_DIR_NAME.test(name) && !RESERVED_PROJECT_DIR_NAMES.includes(name);
+
+// The workspace-relative name for a folder the owner picked, always one `isProjectDirName` accepts. Accents are folded
+// to their base letter first, so `Café` keeps its `e` rather than losing it to a dash.
+export const projectDirNameFor = (folderBasename: string): string => {
+    const slug = folderBasename
+        .normalize("NFKD")
+        .replace(COMBINING_MARKS, "")
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/-{2,}/g, "-")
+        .replace(/^[._-]+/, "")
+        .slice(0, PROJECT_DIR_NAME_MAX)
+        .replace(/[.-]+$/, "");
+    const name = slug === "" ? FALLBACK_NAME : slug;
+    return RESERVED_PROJECT_DIR_NAMES.includes(name) ? `${name}-project` : name;
+};
+
+// Where a project folder lands in the sandbox, and the name back out of such a path: exactly `<root>/<name>`, anything
+// else (a deeper path, a trailing slash, a reserved name) is not a project dir.
+export const projectRemoteDir = (name: string): string => `${WORKSPACE_ROOT}/${name}`;
+
+export const projectDirNameOf = (remoteDir: string, root: string = WORKSPACE_ROOT): string | undefined => {
+    const prefix = `${root}/`;
+    if (!remoteDir.startsWith(prefix)) {
+        return undefined;
+    }
+    const name = remoteDir.slice(prefix.length);
+    return isProjectDirName(name) ? name : undefined;
+};

package/src/index.ts

@@ -32,6 +32,7 @@ import { netdiskContract } from "./contracts/netdisk.contract.js";
 import { providersContract } from "./contracts/providers.contract.js";
 import { pushContract } from "./contracts/push.contract.js";
 import { safetyContract } from "./contracts/safety.contract.js";
+import { needsContract } from "./contracts/needs.contract.js";
 import { secretsContract } from "./contracts/secrets.contract.js";
 import { sessionsContract } from "./contracts/sessions.contract.js";
 import { settingsContract } from "./contracts/settings.contract.js";
@@ -57,6 +58,8 @@ export { choresContract } from "./contracts/chores.contract.js";
 export { ciContract } from "./contracts/ci.contract.js";
 export {
     endpointsContract,
+    type LocalModelDevice,
+    LocalModelDeviceSchema,
     LocalModelFitSchema,
     type LocalModelFitResponse,
     type LocalModelGpu,
@@ -92,6 +95,7 @@ export { publicContract } from "./contracts/public.contract.js";
 export { providersContract, type RunnableProviders, RunnableProvidersSchema } from "./contracts/providers.contract.js";
 export { pushContract } from "./contracts/push.contract.js";
 export { safetyContract } from "./contracts/safety.contract.js";
+export { needsContract } from "./contracts/needs.contract.js";
 export { secretsContract } from "./contracts/secrets.contract.js";
 export { sessionsContract } from "./contracts/sessions.contract.js";
 export { settingsContract } from "./contracts/settings.contract.js";
@@ -109,12 +113,14 @@ export * from "./events/agent-events.js";
 export * from "./events/agent-words.js";
 export * from "./events/requests.js";
 export * from "./events/resume.js";
+export * from "./events/sandbox-notice.js";
 export * from "./events/system-events.js";
 export * from "./events/transcript.js";
 export * from "./events/land-breakage.js";
 export * from "./events/land-conflict.js";
 export * from "./events/verify-nudge.js";
 export * from "./events/errands.js";
+export * from "./events/need-wake.js";
 export * from "./events/watch-wake.js";
 export * from "./policy/request-status.js";
 export * from "./events/child-run.js";
@@ -136,7 +142,6 @@ export * from "./state/history-state.js";
 export * from "./state/fix-stance.js";
 export * from "./state/landed-commit.js";
 export * from "./state/fix-attempt-plan.js";
-export * from "./state/red-streak.js";
 // Provider vocabulary bottom-up: agent-runtimes, provider-specs, agent-catalog; three modules since the dependency
 // points one way.
 export * from "./models/agent-runtimes.js";
@@ -149,6 +154,7 @@ export * from "./policy/safety-policy.js";
 export * from "./policy/reserved-servers.js";
 export * from "./policy/credential-material.js";
 export * from "./policy/capability-secrets.js";
+export * from "./policy/secret-hosts.js";
 export * from "./ids/conversation-ids.js";
 export * from "./text/documents.js";
 export * from "./protocol/host-protocol.js";
@@ -158,6 +164,7 @@ export * from "./protocol/runner-protocol.js";
 export * from "./protocol/listener-protocol.js";
 export * from "./protocol/container-requirements.js";
 export * from "./ids/hostnames.js";
+export * from "./ids/project-dir.js";
 export * from "./policy/overlay-lint.js";
 export * from "./models/model-label.js";
 export * from "./models/model-order.js";
@@ -197,6 +204,7 @@ export * from "./schemas/git/git.js";
 export * from "./schemas/git/git-history.js";
 export * from "./schemas/history.js";
 export * from "./schemas/hosts.js";
+export * from "./schemas/loopback-catch.js";
 export * from "./schemas/intentic.js";
 export * from "./schemas/inventory.js";
 export * from "./schemas/issues.js";
@@ -214,6 +222,7 @@ export * from "./schemas/providers/provider-subscriptions.js";
 export * from "./schemas/public.js";
 export * from "./schemas/push.js";
 export * from "./schemas/git/remote-refs.js";
+export * from "./schemas/needs.js";
 export * from "./schemas/secrets.js";
 export * from "./schemas/netdisk.js";
 export * from "./schemas/sessions.js";
@@ -224,6 +233,7 @@ export * from "./schemas/shared.js";
 export * from "./schemas/system-prompt.js";
 export * from "./schemas/system.js";
 export * from "./schemas/state-plan.js";
+export * from "./schemas/updates.js";
 export * from "./schemas/terminal.js";
 export * from "./schemas/turn-break.js";
 export * from "./schemas/keep-warm.js";
@@ -234,7 +244,6 @@ export * from "./schemas/webext.js";
 export * from "./schemas/workflows.js";
 export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
-export * from "./schemas/workspace/push-checks.js";
 export * from "./schemas/workspace/workspace-setup.js";
 export * from "./schemas/workspace/workspace-tree.js";
 export * from "./state/arrival.js";
@@ -285,6 +294,7 @@ export const sandboxContract = {
     public: publicContract,
     providers: providersContract,
     push: pushContract,
+    needs: needsContract,
     secrets: secretsContract,
     system: systemContract,
     translator: translatorContract,
@@ -302,8 +312,12 @@ export const SANDBOX_ROUTES: readonly ContractRoute[] = contractRoutes(sandboxCo
 export const SANDBOX_ROUTE_NAMES: readonly string[] = SANDBOX_ROUTES.map((route) => route.name);
 
 // Each route's shape, for the failure names alone can't describe: a route both builds have, but whose payload only one
-// expects. Computed once at load, since it's too expensive to repeat per connection.
-export const SANDBOX_ROUTE_SHAPES: Readonly<Record<string, string>> = routeShapes(sandboxContract);
+// expects. Computed on the first ask and kept, since it's too expensive to repeat per connection — and too expensive to
+// pay at load: turning every route's schemas into JSON Schema was a third of a second of a phone's startup at 4× CPU
+// throttle, for a comparison a browser only makes when it has a disagreement to explain (the version card). The daemon
+// asks on its first hello.
+let fingerprints: Readonly<Record<string, string>> | undefined;
+export const sandboxRouteFingerprints = (): Readonly<Record<string, string>> => (fingerprints ??= routeShapes(sandboxContract));
 
 // The contract route a concrete browser request belongs to, bound to this build's route table.
 export const sandboxRouteName = (method: string, pathWithQuery: string): string | undefined =>

package/src/models/agent-catalog.test.ts

@@ -126,6 +126,9 @@ test("the ceiling has nothing to disclose; a floor names what it lacks", () => {
     expect(grokCaps.steering).toBe(false);
     expect(grokCaps.isolation).toBe("cwd");
     expect(limitationsOf(grokCaps).length).toBeGreaterThan(0);
+    // The turn's remote servers, as Codex takes them: mounted on the shared OpenCode server per conversation.
+    expect(grokCaps.mcp).toBe("http");
+    expect(limitationsOf(grokCaps)).toContain("MCP servers only, none of the daemon's own tools, no plugins");
 
     const acpCaps = capabilitiesOf("some-installed-agent", "native");
     expect(acpCaps.mcp).toBe("http");
@@ -178,7 +181,10 @@ test("the safety axes disclose the middle answer differently from the floor", ()
 
     expect(codexCaps.rulebook).toBe("approval");
     expect(piCaps.rulebook).toBe("none");
-    expect(grokCaps.rulebook).toBe("refuse-only");
+    expect(grokCaps.rulebook).toBe("approval");
+    // A hold parks on a card now that the turn's watchdog is held while it waits, so nothing says it cannot hold.
+    expect(limitationsOf(grokCaps)).toContain("command rules apply only to calls this agent raises");
+    expect(limitationsOf(grokCaps)).not.toContain("command rules can refuse but not hold");
 
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("command rules");
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("stored secrets");

package/src/models/agent-runtimes.ts

@@ -102,14 +102,15 @@ export const CODEX: AgentCapabilities = {
     secrets: "none",
 };
 
-// OpenCode (the Grok runtime): its own agentic loop, its own tools, allow-all permissions. Takes a model id, a prompt
-// and one system message of ours; no effort scale, no tools of ours, no command list.
+// OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
+// server per conversation. Takes a model id, a prompt and one system message of ours; no effort scale, no command list.
 export const OPENCODE: AgentCapabilities = {
     runtime: "opencode",
     steering: false,
     permissions: "plan",
     questions: false,
-    mcp: "none",
+    // Added at runtime under the conversation's own names, each prompt showing its session only its own (opencode-mcp.ts).
+    mcp: "http",
     execution: ["shell"],
     effort: false,
     fastMode: false,
@@ -121,8 +122,9 @@ export const OPENCODE: AgentCapabilities = {
     // `system` on the prompt body, per message; adds to OpenCode's own prompt, with no seam to replace it.
     instructions: "append",
     skillDiscovery: "prompt",
-    // refuse-only for its inactivity watchdog, not its protocol: a paused approval reads as a stalled turn.
-    rulebook: "refuse-only",
+    // OpenCode raises its permission asks for the commands its config names; the daemon answers from the rulebook, a
+    // hold parked on a card while the turn's inactivity watchdog is held.
+    rulebook: "approval",
     secrets: "none",
 };
 

package/src/models/model-roles.ts

@@ -71,7 +71,7 @@ export const MODEL_ROLES = [
     {
         id: "pipeline-fix",
         label: "Pipeline fixes",
-        blurb: "The agent started by Fix on a red pipeline.",
+        blurb: "The agent started by Fix on a failed pipeline.",
         kind: "run",
         trigger: "pressed",
         icon: "wave-pulse",
@@ -108,14 +108,6 @@ export const MODEL_ROLES = [
         trigger: "pressed",
         icon: "list-check",
     },
-    {
-        id: "pre-push-fix",
-        label: "Pre-push fixes",
-        blurb: "The fix proposed when a check fails on the way to a push.",
-        kind: "run",
-        trigger: "pressed",
-        icon: "cloud-upload",
-    },
     {
         // Pressed trigger: the owner's approval click starts this turn; the queue between is just machinery.
         id: "approval-queue",

package/src/policy/command-classes.test.ts

@@ -40,6 +40,22 @@ describe("git.destructive", () => {
     test("a -f belonging to the next command in a pipeline is not a force-push", () => {
         expect(classify("git push origin main | grep -f patterns.txt")).not.toContain("git.destructive");
     });
+
+    test("deleting a checkout's .git, or re-initialising the folder it stands in, cuts it off from its history", () => {
+        for (const command of ["rm .git", "rm -f .git", "rm -rf ./.git", "rm -rf tabularium/.git", "rm .git && git init -b main"]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        for (const command of ["git init", "git init .", "git init -b main", "git init --initial-branch main -q ."]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        expect(marked("cd /work && rm .git && git init -b main", "git.destructive")).toEqual(["rm .git", "git init -b main"]);
+    });
+
+    test("a new project's git init, and files that merely start with .git, are left alone", () => {
+        for (const command of ["git init new-project", "git init -b main tools/cli", "rm .gitignore", "rm -f .github/old.yml", "rm .gitmodules"]) {
+            expect(classify(command), command).not.toContain("git.destructive");
+        }
+    });
 });
 
 describe("files.destructive", () => {
@@ -72,6 +88,27 @@ describe("files.destructive", () => {
         }
     });
 
+    test("find deleting what it walks, or handing it to rm, is the same delete as rm -rf", () => {
+        for (const command of [
+            "find /home/x/PROJECT/cerberus-worktrees/m1-a -depth -delete",
+            "find build -name '*.o' -delete",
+            "find . -type d -name node_modules -exec rm -rf {} +",
+            "find dist -exec /bin/rm -f {} \\;",
+            "find tmp -execdir rm {} \\;",
+            "find . -name '*.log' -print0 | xargs -0 rm -f",
+            "ls old | xargs rm",
+        ]) {
+            expect(classify(command), command).toContain("files.destructive");
+        }
+        expect(marked("find build -name '*.o' -delete; echo done", "files.destructive")).toEqual(["find build -name '*.o' -delete"]);
+    });
+
+    test("a find that only lists, and an xargs that runs something else, pass", () => {
+        for (const command of ["find . -name '*.ts'", "find . -newer deleted.txt -print", "find src -exec grep -l rm {} +", "ls | xargs wc -l"]) {
+            expect(classify(command), command).not.toContain("files.destructive");
+        }
+    });
+
     test("a script that deletes one file, or nothing, is not recursive deletion", () => {
         for (const code of ['fs.unlinkSync("tmp.txt")', 'await fs.promises.rm("tmp.txt")', "const rmq = queue.rm(job)"]) {
             expect(classify(code), code).not.toContain("files.destructive");
@@ -113,6 +150,8 @@ describe("system.destructive", () => {
             "rm -rf C:\\",
             'fs.rmSync("/", { recursive: true, force: true })',
             'rimraf("/work")',
+            "find / -delete",
+            "find /home -type f -delete",
         ]) {
             expect(classify(command), command).toContain("system.destructive");
         }

package/src/policy/command-classes.ts

@@ -375,6 +375,66 @@ const recursiveForceRms = (command: string): CommandSpan[] =>
         .filter((invocation) => invocation.recursive && invocation.force)
         .map((invocation) => invocation.span);
 
+// The same tree delete spelled without `rm -rf`: `find` deleting what it walks, or handing each hit to `rm`, and a list
+// piped into `rm` through xargs. An agent told `rm -rf` needs a card reaches for exactly these.
+const FIND_INVOCATION = /\bfind\s+([^|;&\n]*)/g;
+const FIND_DELETES = /\s(?:-delete\b|-exec(?:dir)?\s+(?:[^\s|;&]*\/)?rm\b)/;
+const XARGS_RM = /\bxargs\b[^|;&\n]*?\s(?:[^\s|;&]*\/)?rm\b/g;
+
+interface FindDelete {
+    // The paths find starts walking from: the words before its first expression (`-name`, `(`, `!`).
+    readonly starts: readonly string[];
+    readonly span: CommandSpan;
+}
+
+const parseFindDeletes = (command: string): FindDelete[] =>
+    [...command.matchAll(FIND_INVOCATION)].flatMap((invocation) => {
+        const args = invocation[1] as string;
+        if (!FIND_DELETES.test(` ${args}`)) {
+            return [];
+        }
+        const words = args.trim().split(/\s+/);
+        const expression = words.findIndex((word) => /^[-(!]/.test(word));
+        const starts = (expression === -1 ? words : words.slice(0, expression)).filter((word) => word !== "").map(unquote);
+        return [{ starts, span: { start: invocation.index, end: invocation.index + invocation[0].trimEnd().length } }];
+    });
+
+const findAndXargsDeletes = (command: string): CommandSpan[] => [
+    ...parseFindDeletes(command).map((found) => found.span),
+    ...spansOf([XARGS_RM], command),
+];
+
+// What cuts a checkout off from its repository's history: deleting its `.git` (for a worktree, a one-line pointer
+// whose loss strands every commit the checkout was reading), or `git init` over the folder it stands in, which makes
+// a standalone repository sharing nothing with the one it came from. A `git init <new-dir>` for a new project is not
+// this, so only an init of the current folder counts.
+const GIT_POINTER = /(?:^|[/\\])\.git[/\\]?$/;
+const GIT_INIT = /\bgit\s+init\b([^|;&\n]*)/g;
+const GIT_INIT_VALUED = /^(?:-b|--initial-branch|--template|--separate-git-dir|--object-format|--ref-format)$/;
+
+const initsHere = (args: string): boolean => {
+    const words = args.trim().split(/\s+/).filter((word) => word !== "");
+    const operands: string[] = [];
+    for (let index = 0; index < words.length; index += 1) {
+        const word = words[index] as string;
+        if (GIT_INIT_VALUED.test(word)) {
+            index += 1;
+        } else if (!word.startsWith("-")) {
+            operands.push(unquote(word));
+        }
+    }
+    return operands.every((operand) => operand === "." || operand === "./");
+};
+
+const checkoutUnlinks = (command: string): CommandSpan[] => [
+    ...parseRm(command)
+        .filter((invocation) => invocation.operands.some((operand) => GIT_POINTER.test(operand)))
+        .map((invocation) => invocation.span),
+    ...[...command.matchAll(GIT_INIT)]
+        .filter((invocation) => initsHere(invocation[1] as string))
+        .map((invocation) => ({ start: invocation.index, end: invocation.index + invocation[0].trimEnd().length })),
+];
+
 // A recursive delete aimed at a root, in either spelling the gate is handed (shell or script). Which targets count as
 // roots is the locus's answer.
 const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
@@ -384,6 +444,9 @@ const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
     ...nodeDeleteTargets(program)
         .filter((delete_) => isRootTarget(delete_.target, locus))
         .map((delete_) => delete_.span),
+    ...parseFindDeletes(program)
+        .filter((found) => found.starts.some((start) => isRootTarget(start, locus)))
+        .map((found) => found.span),
 ];
 
 // The g twins, built once at load: a card is minted per command held, classify runs per command typed.
@@ -434,10 +497,10 @@ const credentialReads = (command: string, context: CommandContext): CommandSpan[
 
 // One function per class; empty means the command is not in it, so membership and evidence are the same walk.
 const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandContext) => CommandSpan[]>> = {
-    "git.destructive": (command) => spansOf(GIT_DESTRUCTIVE_G, command),
+    "git.destructive": (command) => [...spansOf(GIT_DESTRUCTIVE_G, command), ...checkoutUnlinks(command)],
     // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
     "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
-    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command)],
+    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command), ...findAndXargsDeletes(command)],
     "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
     "secrets.access": credentialReads,
@@ -489,6 +552,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "git clean -f" },
         { code: "git branch -D" },
         { code: "git filter-branch" },
+        { code: "rm .git", qualifier: "any flags: a checkout's link to its history" },
+        { code: "git init", qualifier: "only in the current folder, which may already be a checkout" },
     ],
     "git.branch-switch": [
         { code: "git switch <branch>" },
@@ -498,6 +563,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "rm -rf <path>" },
         { code: "fs.rm(<path>, { recursive: true })", qualifier: "also rmSync, rmdir, rmdirSync" },
         { code: "rimraf(<path>)" },
+        { code: "find <path> -delete", qualifier: "also -exec rm and -execdir rm" },
+        { code: "xargs rm" },
     ],
     "system.destructive": [
         { code: "mkfs" },
@@ -507,7 +574,7 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "dd of=/dev/…" },
         { code: "shred /dev/…" },
         { code: "> /dev/sda" },
-        { code: "rm -rf /", qualifier: "only when the target is a root, listed below" },
+        { code: "rm -rf /", qualifier: "also find / -delete; only when the target is a root, listed below" },
     ],
     "container.state": [
         { code: "docker volume rm", qualifier: "also remove, prune, and podman for any of these" },

package/src/policy/safety-policy.ts

@@ -64,6 +64,15 @@ export const COMMAND_RULE_CATALOG: readonly CommandRule[] = CommandClassSchema.o
 export const CommandJudgeModeSchema = z.enum(["off", "watch", "on"]);
 export type CommandJudgeMode = z.infer<typeof CommandJudgeModeSchema>;
 
+// What an agent's own project-dependency install (`pnpm add`, `npm install`, `uv sync`) does, one answer for every
+// turn. Where the install lands is the sandbox's business, not the owner's: an isolated turn installs into its own copy
+// and a main-tree turn takes the install lane the daemon's own installs take. This only says whether a person is asked:
+// - automatic: it runs
+// - ask: a card in the turn; the turn waits on that one call, and "allow for this conversation" stops the asking
+// - never: refused; the manifest change still lands and the daemon installs it then
+export const ProjectInstallModeSchema = z.enum(["automatic", "ask", "never"]);
+export type ProjectInstallMode = z.infer<typeof ProjectInstallModeSchema>;
+
 // What the judge answers, one instruction per verdict:
 // - allow: run it, say nothing, the ordinary answer for a triage false positive
 // - ask: raise the card; the only path to a person, meant to be rare
@@ -122,6 +131,7 @@ Ask me before:
 
 - publishing or releasing anything (npm publish, a GitHub release, a container push);
 - force-pushing, hard-resetting or otherwise discarding commits that are not this turn's own work;
+- deleting a checkout's \`.git\` or running \`git init\` in a folder that already is one: in a worktree that cuts it off from my workspace's history, and its work can no longer come back to me;
 - moving a checkout onto another branch (\`git checkout <branch>\`, \`git switch\`) — you only ever see this for a tree that is mine as well as yours, never for a copy of your own, so the worktree paragraph above does not cover it;
 - sending a credential anywhere outside this container.
 

package/src/policy/secret-hosts.test.ts

@@ -0,0 +1,89 @@
+import { hostAllowed, hostMatches, normalizeHost, normalizeHostPattern, tightensHostGuard } from "./secret-hosts.js";
+
+// The pattern a person writes against the host a use would reach. Every boundary a limit turns on is pinned by value:
+// the apex a wildcard leaves out, the look-alike that only shares a suffix, and which edits take hosts away.
+
+describe("normalizeHostPattern", () => {
+    it("reads what a person types or pastes as the host it means", () => {
+        expect(normalizeHostPattern("  API.GitHub.com. ")).toBe("api.github.com");
+        expect(normalizeHostPattern("https://api.github.com/user?per_page=5")).toBe("api.github.com");
+        expect(normalizeHostPattern("api.github.com:443")).toBe("api.github.com");
+        expect(normalizeHostPattern("*.githubusercontent.com")).toBe("*.githubusercontent.com");
+        expect(normalizeHostPattern("localhost")).toBe("localhost");
+        expect(normalizeHostPattern("10.0.0.2")).toBe("10.0.0.2");
+    });
+
+    it("refuses what is not one host or one domain's hosts", () => {
+        expect(normalizeHostPattern("*")).toBeUndefined();
+        expect(normalizeHostPattern("*.com")).toBeUndefined();
+        expect(normalizeHostPattern("api.*.com")).toBeUndefined();
+        expect(normalizeHostPattern("api.github.com/user")).toBeUndefined();
+        expect(normalizeHostPattern("user@api.github.com")).toBeUndefined();
+        expect(normalizeHostPattern("-bad.example.com")).toBeUndefined();
+        expect(normalizeHostPattern("")).toBeUndefined();
+        expect(normalizeHostPattern(`${"a".repeat(64)}.com`)).toBeUndefined();
+    });
+});
+
+describe("normalizeHost", () => {
+    it("takes a plain host or address and nothing shaped like a pattern or a stray token", () => {
+        expect(normalizeHost("API.github.com.")).toBe("api.github.com");
+        expect(normalizeHost("*.github.com")).toBeUndefined();
+        expect(normalizeHost("[::1]")).toBeUndefined();
+        expect(normalizeHost("api.github.com\u0001")).toBeUndefined();
+        expect(normalizeHost("$host")).toBeUndefined();
+    });
+});
+
+describe("hostMatches", () => {
+    it("matches an exact host only to itself", () => {
+        expect(hostMatches("api.github.com", "api.github.com")).toBe(true);
+        expect(hostMatches("api.github.com", "github.com")).toBe(false);
+        expect(hostMatches("github.com", "api.github.com")).toBe(false);
+    });
+
+    it("matches a wildcard to every host under the domain, at any depth, and not to the domain itself", () => {
+        expect(hostMatches("*.github.com", "api.github.com")).toBe(true);
+        expect(hostMatches("*.github.com", "a.b.github.com")).toBe(true);
+        expect(hostMatches("*.github.com", "github.com")).toBe(false);
+    });
+
+    it("does not match a host that merely ends in the same letters", () => {
+        expect(hostMatches("*.github.com", "evilgithub.com")).toBe(false);
+        expect(hostMatches("*.github.com", "github.com.evil.example")).toBe(false);
+    });
+
+    it("allows a host any one pattern in the list matches", () => {
+        expect(hostAllowed(["api.github.com", "*.githubusercontent.com"], "raw.githubusercontent.com")).toBe(true);
+        expect(hostAllowed(["api.github.com", "*.githubusercontent.com"], "evil.example")).toBe(false);
+        expect(hostAllowed([], "api.github.com")).toBe(false);
+    });
+});
+
+describe("tightensHostGuard", () => {
+    const on = (...hosts: string[]) => ({ guard: true, hosts });
+    const off = (...hosts: string[]) => ({ guard: false, hosts });
+
+    it("reads turning the guard on as tightening, whatever the list, and turning it off as loosening", () => {
+        expect(tightensHostGuard(undefined, on("api.github.com"))).toBe(true);
+        expect(tightensHostGuard(off("api.github.com"), on())).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), off("api.github.com"))).toBe(false);
+        expect(tightensHostGuard(undefined, off())).toBe(true);
+        expect(tightensHostGuard(off(), off("evil.example"))).toBe(true);
+    });
+
+    it("reads taking a host off a guarded list as tightening, down to none, and adding one as loosening", () => {
+        expect(tightensHostGuard(on("api.github.com", "github.com"), on("github.com"))).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), on())).toBe(true);
+        expect(tightensHostGuard(on("api.github.com"), on("api.github.com", "evil.example"))).toBe(false);
+        expect(tightensHostGuard(on(), on("api.github.com"))).toBe(false);
+        expect(tightensHostGuard(on("api.github.com"), on("api.github.com"))).toBe(true);
+    });
+
+    it("counts a host or a deeper wildcard under a held wildcard as covered, and the domain itself as not", () => {
+        expect(tightensHostGuard(on("*.github.com"), on("api.github.com"))).toBe(true);
+        expect(tightensHostGuard(on("*.github.com"), on("*.api.github.com"))).toBe(true);
+        expect(tightensHostGuard(on("*.github.com"), on("github.com"))).toBe(false);
+        expect(tightensHostGuard(on("api.github.com"), on("*.api.github.com"))).toBe(false);
+    });
+});