@intentic/sandbox-contract 1.317.0 → 1.318.0

package/src/ids/conversation-ids.test.ts

@@ -7,8 +7,6 @@ import {
     latestFixAttempt,
     newConversationId,
     nextFixAttemptId,
-    PUSH_FIX_PREFIX,
-    pushFixConversationId,
 } from "./conversation-ids.js";
 import { ConversationIdSchema } from "../schemas/agent.js";
 
@@ -90,28 +88,6 @@ test("the prefix is carried by every fix id", () => {
     expect(ciFixConversationId(`ci-fix`, 7)).toBe(`ci-fix-ci-fix-7`);
 });
 
-test("a push fix id is the same string every time the same failure derives it", () => {
-    expect(pushFixConversationId(`intentic`, `checkout gates,lint`)).toBe(pushFixConversationId(`intentic`, `checkout gates,lint`));
-    expect(pushFixConversationId(`intentic`, `checkout gates,lint`)).toMatch(/^push-fix-intentic-[0-9a-z]{7}$/);
-});
-
-test("a push fix id separates failures and scopes", () => {
-    expect(pushFixConversationId(`intentic`, `lint`)).not.toBe(pushFixConversationId(`intentic`, `checkout gates`));
-    expect(pushFixConversationId(`web`, `lint`)).not.toBe(pushFixConversationId(`api`, `lint`));
-});
-
-// Signatures cover raw gate output: control characters, unicode, path-like strings, and pathological lengths.
-test("every derived push fix id passes the conversation-id guard", () => {
-    const signatures = [``, `checkout gates`, `✗ lint · pnpm lint`, `a`.repeat(4_000), `../../etc/passwd`, `a\nb\tc`, `résumé`];
-    for (const scope of [`root`, `apps/web`, `my repo`, `___`, `x`.repeat(80)]) {
-        for (const signature of signatures) {
-            const id = pushFixConversationId(scope, signature);
-            expect(ConversationIdSchema.safeParse(id).success).toBe(true);
-            expect(id.startsWith(PUSH_FIX_PREFIX)).toBe(true);
-        }
-    }
-});
-
 // Attempt 1 is the bare derived id, so every fix conversation minted before attempts existed reads as attempt 1.
 test("the first attempt wears the failure's own id, later ones carry their number", () => {
     const base = ciFixConversationId(`web`, 41);
@@ -136,8 +112,8 @@ test("another failure's id is not an attempt at this one", () => {
 });
 
 test("attempts are read off the roster, earliest first, and the newest is the live answer", () => {
-    const base = pushFixConversationId(`intentic`, `lint`);
-    const roster = [{ id: `swift-otter-k9m2` }, { id: fixAttemptId(base, 3) }, { id: base }, { id: pushFixConversationId(`intentic`, `typecheck`) }];
+    const base = ciFixConversationId(`intentic`, 7);
+    const roster = [{ id: `swift-otter-k9m2` }, { id: fixAttemptId(base, 3) }, { id: base }, { id: ciFixConversationId(`intentic`, 8) }];
     expect(fixAttemptsOf(base, roster).map((entry) => entry.attempt)).toEqual([1, 3]);
     expect(latestFixAttempt(base, roster)?.agent.id).toBe(fixAttemptId(base, 3));
     expect(latestFixAttempt(base, [])).toBeUndefined();

package/src/ids/conversation-ids.ts

@@ -160,13 +160,9 @@ const repoSlug = (repo: string): string =>
         .replace(/^-+|-+$/g, "") || "repo";
 export const ciFixConversationId = (repo: string, runId: number): string => `${CI_FIX_PREFIX}${repoSlug(repo)}-${runId}`;
 
-// Keyed by when the project's push red began (pushFixBase, `red:<since>`), not a run id (a push has none): a refused push
-// is owed by that red too (push-checks-store.ts). Hashed rather than spelled into the branch name; the fix agent's first
-// message names what it is for.
-export const PUSH_FIX_PREFIX = "push-fix-";
-
 // FNV-1a, not a cryptographic hash: nothing here is secret, the only requirement is the same failure yields the same
-// seven characters in every browser and in node. The one spelling: a push finding's id (push-checks-store.ts) is this too.
+// seven characters in every browser and in node. The one spelling: what a failing main owes is named by it too (a
+// failed job's id, ci/main-fixer.ts).
 const FNV_OFFSET = 0x811c_9dc5;
 const FNV_PRIME = 0x0100_0193;
 export const fnvDigest = (text: string): string => {
@@ -177,14 +173,12 @@ export const fnvDigest = (text: string): string => {
     return (hash >>> 0).toString(36).padStart(7, "0");
 };
 
-export const pushFixConversationId = (scope: string, signature: string): string => `${PUSH_FIX_PREFIX}${repoSlug(scope)}-${fnvDigest(signature)}`;
-
-// A red main-line check that no conversation still holding the work could take: keyed by the project and the moment its
-// red streak began, so every attempt at one streak shares a base and a later streak in the same project starts over.
+// A failing main-line check that no conversation still holding the work could take: keyed by the project and the moment
+// it began failing, so every attempt at one streak shares a base and a later streak in the same project starts over.
 // Seconds in base36 keep it short; the workspace root is spelled `workspace`, since its project folder is empty.
 export const LAND_FIX_PREFIX = "land-fix-";
-export const landFixConversationId = (project: string, redSince: number): string =>
-    `${LAND_FIX_PREFIX}${repoSlug(project === "" ? "workspace" : project)}-${Math.floor(redSince / 1000).toString(36)}`;
+export const landFixConversationId = (project: string, failingSince: number): string =>
+    `${LAND_FIX_PREFIX}${repoSlug(project === "" ? "workspace" : project)}-${Math.floor(failingSince / 1000).toString(36)}`;
 
 // ONE FAILURE, MANY ATTEMPTS, ONE LIVE ANSWER. The derived id above names the FAILURE; an attempt at it is a
 // conversation of its own, so starting over (another model, a clean worktree) never rewrites a record some other window

package/src/ids/project-dir.fixture.json

@@ -0,0 +1,65 @@
+{
+    "names": [
+        { "name": "my-app", "valid": true },
+        { "name": "My_App.v2", "valid": true },
+        { "name": "a", "valid": true },
+        { "name": "0", "valid": true },
+        { "name": "Public", "valid": true },
+        { "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "valid": true },
+        { "name": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "valid": false },
+        { "name": "public", "valid": false },
+        { "name": "refs", "valid": false },
+        { "name": "site", "valid": false },
+        { "name": "root", "valid": false },
+        { "name": "intent", "valid": false },
+        { "name": "desired-state", "valid": false },
+        { "name": "app", "valid": false },
+        { "name": "AGENTS.md", "valid": false },
+        { "name": "node_modules", "valid": false },
+        { "name": "dist", "valid": false },
+        { "name": "venv", "valid": false },
+        { "name": "claude.json", "valid": false },
+        { "name": "__pycache__", "valid": false },
+        { "name": ".intentic", "valid": false },
+        { "name": ".hidden", "valid": false },
+        { "name": "-flag", "valid": false },
+        { "name": "_under", "valid": false },
+        { "name": "", "valid": false },
+        { "name": "a/b", "valid": false },
+        { "name": "..", "valid": false },
+        { "name": "has space", "valid": false },
+        { "name": "café", "valid": false },
+        { "name": "my-app/", "valid": false }
+    ],
+    "folders": [
+        { "folder": "my-app", "dirName": "my-app" },
+        { "folder": "My App", "dirName": "My-App" },
+        { "folder": "My  App!!", "dirName": "My-App" },
+        { "folder": "Café Menu", "dirName": "Cafe-Menu" },
+        { "folder": "日本語", "dirName": "project" },
+        { "folder": "", "dirName": "project" },
+        { "folder": "...", "dirName": "project" },
+        { "folder": ".config", "dirName": "config" },
+        { "folder": "--flag--", "dirName": "flag" },
+        { "folder": "_private", "dirName": "private" },
+        { "folder": "public", "dirName": "public-project" },
+        { "folder": "site", "dirName": "site-project" },
+        { "folder": "app", "dirName": "app-project" },
+        { "folder": "AGENTS.md", "dirName": "AGENTS.md-project" },
+        { "folder": "dist", "dirName": "dist-project" },
+        { "folder": "node_modules", "dirName": "node_modules-project" },
+        { "folder": "__pycache__", "dirName": "pycache__" },
+        { "folder": "a--b", "dirName": "a-b" },
+        { "folder": "report (final) v2", "dirName": "report-final-v2" },
+        {
+            "folder": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+            "dirName": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        },
+        {
+            "folder": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa b",
+            "dirName": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+        },
+        { "folder": "C++ Project", "dirName": "C-Project" },
+        { "folder": "release.2024.", "dirName": "release.2024" }
+    ]
+}

package/src/ids/project-dir.test.ts

@@ -0,0 +1,60 @@
+import { readFileSync } from "node:fs";
+import { MEMORY_FILE, PUBLIC_DIR, REFERENCE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
+import { STARTER_REPO } from "../state/starter.js";
+import { isProjectDirName, projectDirNameFor, projectDirNameOf, projectRemoteDir, RESERVED_PROJECT_DIR_NAMES } from "./project-dir.js";
+
+// The cases `ic` is held to as well (_sandbox/ic/src/sandbox/project_dir.rs), read from the one file both run.
+interface ProjectDirCases {
+    readonly names: readonly { readonly name: string; readonly valid: boolean }[];
+    readonly folders: readonly { readonly folder: string; readonly dirName: string }[];
+}
+// SAFETY: the fixture is this repository's own file, written to this shape; one that drifted fails every case below.
+const CASES = JSON.parse(readFileSync(new URL("./project-dir.fixture.json", import.meta.url), "utf8")) as ProjectDirCases;
+
+test.each([...CASES.names])("the shared name case $name is valid: $valid", ({ name, valid }) => {
+    expect(isProjectDirName(name)).toBe(valid);
+});
+
+test.each([...CASES.folders])("the folder $folder syncs into $dirName", ({ folder, dirName }) => {
+    expect(projectDirNameFor(folder)).toBe(dirName);
+});
+
+test("every folder name the slug produces is one the validation accepts, and slugging it again changes nothing", () => {
+    for (const { folder } of CASES.folders) {
+        const name = projectDirNameFor(folder);
+        expect(isProjectDirName(name)).toBe(true);
+        expect(projectDirNameFor(name)).toBe(name);
+    }
+});
+
+test("the reserved names are the ones the daemon keeps at the workspace root", () => {
+    expect([...RESERVED_PROJECT_DIR_NAMES].toSorted()).toEqual(
+        [
+            PUBLIC_DIR,
+            REFERENCE_DIR,
+            STARTER_REPO,
+            MEMORY_FILE,
+            "root",
+            "intent",
+            "desired-state",
+            "app",
+            "node_modules",
+            "dist",
+            "venv",
+            "claude.json",
+        ].toSorted(),
+    );
+});
+
+test("a project dir is exactly one valid name under the workspace root", () => {
+    expect(projectRemoteDir("my-app")).toBe(`${WORKSPACE_ROOT}/my-app`);
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app`)).toBe("my-app");
+    expect(projectDirNameOf(WORKSPACE_ROOT)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app/`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/my-app/src`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/public`)).toBeUndefined();
+    expect(projectDirNameOf(`${WORKSPACE_ROOT}/../etc`)).toBeUndefined();
+    expect(projectDirNameOf("/workspace/my-app")).toBeUndefined();
+    expect(projectDirNameOf("/srv/work/my-app", "/srv/work")).toBe("my-app");
+});

package/src/ids/project-dir.ts

@@ -0,0 +1,70 @@
+import { MEMORY_FILE, PUBLIC_DIR, REFERENCE_DIR, WORKSPACE_ROOT } from "@intentic/constants";
+import { STARTER_REPO } from "../state/starter.js";
+
+// A PROJECT SANDBOX is made for one folder on the owner's computer, synced live into `/work/<name>` rather than into
+// /work itself: the workspace root is the daemon's own, where it keeps its state, seeds its starter repo and serves
+// `public/` to anyone with a link. `<name>` is derived from the folder's name once, on the owner's side, and every
+// later reader (the sync agent, `ic`, the daemon) only validates it. `_sandbox/ic/src/sandbox/project_dir.rs` holds the
+// validation again for the host side; `project-dir.fixture.json` is the one set of cases both run.
+
+// Top-level names the daemon treats as its own, so a project can never land on one: the public outbox, the reference
+// shelf, the starter repo seeded on first boot, the root repo's id and the three repo roles repo discovery refuses
+// (`_sandbox/sandbox/src/workspace/layout/repo-discovery.ts`), and the standing-instructions file it writes. Then the
+// names every walk of the workspace skips at any depth (@intentic/workspace-ignore IGNORED_DIRS, and the private file
+// the git scopes leave out), where a project would sync and never be seen; the daemon's tests hold this list to that
+// one. Everything else of either kind starts with a dot (`.intentic`, `.venv`), which the name rule below refuses.
+export const RESERVED_PROJECT_DIR_NAMES: readonly string[] = [
+    PUBLIC_DIR,
+    REFERENCE_DIR,
+    STARTER_REPO,
+    "root",
+    "intent",
+    "desired-state",
+    "app",
+    MEMORY_FILE,
+    "node_modules",
+    "dist",
+    "venv",
+    "claude.json",
+];
+
+// Starts alphanumeric, so no dot-file and no leading dash an argv could read as a flag; no separator, so it is always
+// one path segment; bounded, since it also names a git dir and a folder in every view of the workspace.
+const PROJECT_DIR_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+const PROJECT_DIR_NAME_MAX = 64;
+
+// Used when nothing of the folder's name survives the slug (a name in another script, or only punctuation).
+const FALLBACK_NAME = "project";
+
+// Combining marks, which NFKD splits off an accented letter.
+const COMBINING_MARKS = /[\u0300-\u036f]/g;
+
+export const isProjectDirName = (name: string): boolean => PROJECT_DIR_NAME.test(name) && !RESERVED_PROJECT_DIR_NAMES.includes(name);
+
+// The workspace-relative name for a folder the owner picked, always one `isProjectDirName` accepts. Accents are folded
+// to their base letter first, so `Café` keeps its `e` rather than losing it to a dash.
+export const projectDirNameFor = (folderBasename: string): string => {
+    const slug = folderBasename
+        .normalize("NFKD")
+        .replace(COMBINING_MARKS, "")
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/-{2,}/g, "-")
+        .replace(/^[._-]+/, "")
+        .slice(0, PROJECT_DIR_NAME_MAX)
+        .replace(/[.-]+$/, "");
+    const name = slug === "" ? FALLBACK_NAME : slug;
+    return RESERVED_PROJECT_DIR_NAMES.includes(name) ? `${name}-project` : name;
+};
+
+// Where a project folder lands in the sandbox, and the name back out of such a path: exactly `<root>/<name>`, anything
+// else (a deeper path, a trailing slash, a reserved name) is not a project dir.
+export const projectRemoteDir = (name: string): string => `${WORKSPACE_ROOT}/${name}`;
+
+export const projectDirNameOf = (remoteDir: string, root: string = WORKSPACE_ROOT): string | undefined => {
+    const prefix = `${root}/`;
+    if (!remoteDir.startsWith(prefix)) {
+        return undefined;
+    }
+    const name = remoteDir.slice(prefix.length);
+    return isProjectDirName(name) ? name : undefined;
+};

package/src/index.ts

@@ -58,6 +58,8 @@ export { choresContract } from "./contracts/chores.contract.js";
 export { ciContract } from "./contracts/ci.contract.js";
 export {
     endpointsContract,
+    type LocalModelDevice,
+    LocalModelDeviceSchema,
     LocalModelFitSchema,
     type LocalModelFitResponse,
     type LocalModelGpu,
@@ -111,6 +113,7 @@ export * from "./events/agent-events.js";
 export * from "./events/agent-words.js";
 export * from "./events/requests.js";
 export * from "./events/resume.js";
+export * from "./events/sandbox-notice.js";
 export * from "./events/system-events.js";
 export * from "./events/transcript.js";
 export * from "./events/land-breakage.js";
@@ -139,7 +142,6 @@ export * from "./state/history-state.js";
 export * from "./state/fix-stance.js";
 export * from "./state/landed-commit.js";
 export * from "./state/fix-attempt-plan.js";
-export * from "./state/red-streak.js";
 // Provider vocabulary bottom-up: agent-runtimes, provider-specs, agent-catalog; three modules since the dependency
 // points one way.
 export * from "./models/agent-runtimes.js";
@@ -152,6 +154,7 @@ export * from "./policy/safety-policy.js";
 export * from "./policy/reserved-servers.js";
 export * from "./policy/credential-material.js";
 export * from "./policy/capability-secrets.js";
+export * from "./policy/secret-hosts.js";
 export * from "./ids/conversation-ids.js";
 export * from "./text/documents.js";
 export * from "./protocol/host-protocol.js";
@@ -161,6 +164,7 @@ export * from "./protocol/runner-protocol.js";
 export * from "./protocol/listener-protocol.js";
 export * from "./protocol/container-requirements.js";
 export * from "./ids/hostnames.js";
+export * from "./ids/project-dir.js";
 export * from "./policy/overlay-lint.js";
 export * from "./models/model-label.js";
 export * from "./models/model-order.js";
@@ -200,6 +204,7 @@ export * from "./schemas/git/git.js";
 export * from "./schemas/git/git-history.js";
 export * from "./schemas/history.js";
 export * from "./schemas/hosts.js";
+export * from "./schemas/loopback-catch.js";
 export * from "./schemas/intentic.js";
 export * from "./schemas/inventory.js";
 export * from "./schemas/issues.js";
@@ -239,7 +244,6 @@ export * from "./schemas/webext.js";
 export * from "./schemas/workflows.js";
 export * from "./schemas/workspace/workspace-repos.js";
 export * from "./schemas/workspace/workspace-search.js";
-export * from "./schemas/workspace/push-checks.js";
 export * from "./schemas/workspace/workspace-setup.js";
 export * from "./schemas/workspace/workspace-tree.js";
 export * from "./state/arrival.js";
@@ -308,8 +312,12 @@ export const SANDBOX_ROUTES: readonly ContractRoute[] = contractRoutes(sandboxCo
 export const SANDBOX_ROUTE_NAMES: readonly string[] = SANDBOX_ROUTES.map((route) => route.name);
 
 // Each route's shape, for the failure names alone can't describe: a route both builds have, but whose payload only one
-// expects. Computed once at load, since it's too expensive to repeat per connection.
-export const SANDBOX_ROUTE_SHAPES: Readonly<Record<string, string>> = routeShapes(sandboxContract);
+// expects. Computed on the first ask and kept, since it's too expensive to repeat per connection — and too expensive to
+// pay at load: turning every route's schemas into JSON Schema was a third of a second of a phone's startup at 4× CPU
+// throttle, for a comparison a browser only makes when it has a disagreement to explain (the version card). The daemon
+// asks on its first hello.
+let fingerprints: Readonly<Record<string, string>> | undefined;
+export const sandboxRouteFingerprints = (): Readonly<Record<string, string>> => (fingerprints ??= routeShapes(sandboxContract));
 
 // The contract route a concrete browser request belongs to, bound to this build's route table.
 export const sandboxRouteName = (method: string, pathWithQuery: string): string | undefined =>

package/src/models/agent-catalog.test.ts

@@ -126,6 +126,9 @@ test("the ceiling has nothing to disclose; a floor names what it lacks", () => {
     expect(grokCaps.steering).toBe(false);
     expect(grokCaps.isolation).toBe("cwd");
     expect(limitationsOf(grokCaps).length).toBeGreaterThan(0);
+    // The turn's remote servers, as Codex takes them: mounted on the shared OpenCode server per conversation.
+    expect(grokCaps.mcp).toBe("http");
+    expect(limitationsOf(grokCaps)).toContain("MCP servers only, none of the daemon's own tools, no plugins");
 
     const acpCaps = capabilitiesOf("some-installed-agent", "native");
     expect(acpCaps.mcp).toBe("http");
@@ -178,7 +181,10 @@ test("the safety axes disclose the middle answer differently from the floor", ()
 
     expect(codexCaps.rulebook).toBe("approval");
     expect(piCaps.rulebook).toBe("none");
-    expect(grokCaps.rulebook).toBe("refuse-only");
+    expect(grokCaps.rulebook).toBe("approval");
+    // A hold parks on a card now that the turn's watchdog is held while it waits, so nothing says it cannot hold.
+    expect(limitationsOf(grokCaps)).toContain("command rules apply only to calls this agent raises");
+    expect(limitationsOf(grokCaps)).not.toContain("command rules can refuse but not hold");
 
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("command rules");
     expect(limitationsOf(claudeCaps).join(" ")).not.toContain("stored secrets");

package/src/models/agent-runtimes.ts

@@ -102,14 +102,15 @@ export const CODEX: AgentCapabilities = {
     secrets: "none",
 };
 
-// OpenCode (the Grok runtime): its own agentic loop, its own tools, allow-all permissions. Takes a model id, a prompt
-// and one system message of ours; no effort scale, no tools of ours, no command list.
+// OpenCode (the Grok runtime): its own agentic loop and tools, with the turn's remote MCP servers mounted on the shared
+// server per conversation. Takes a model id, a prompt and one system message of ours; no effort scale, no command list.
 export const OPENCODE: AgentCapabilities = {
     runtime: "opencode",
     steering: false,
     permissions: "plan",
     questions: false,
-    mcp: "none",
+    // Added at runtime under the conversation's own names, each prompt showing its session only its own (opencode-mcp.ts).
+    mcp: "http",
     execution: ["shell"],
     effort: false,
     fastMode: false,
@@ -121,8 +122,9 @@ export const OPENCODE: AgentCapabilities = {
     // `system` on the prompt body, per message; adds to OpenCode's own prompt, with no seam to replace it.
     instructions: "append",
     skillDiscovery: "prompt",
-    // refuse-only for its inactivity watchdog, not its protocol: a paused approval reads as a stalled turn.
-    rulebook: "refuse-only",
+    // OpenCode raises its permission asks for the commands its config names; the daemon answers from the rulebook, a
+    // hold parked on a card while the turn's inactivity watchdog is held.
+    rulebook: "approval",
     secrets: "none",
 };
 

package/src/models/model-roles.ts

@@ -71,7 +71,7 @@ export const MODEL_ROLES = [
     {
         id: "pipeline-fix",
         label: "Pipeline fixes",
-        blurb: "The agent started by Fix on a red pipeline.",
+        blurb: "The agent started by Fix on a failed pipeline.",
         kind: "run",
         trigger: "pressed",
         icon: "wave-pulse",
@@ -108,14 +108,6 @@ export const MODEL_ROLES = [
         trigger: "pressed",
         icon: "list-check",
     },
-    {
-        id: "pre-push-fix",
-        label: "Pre-push fixes",
-        blurb: "The fix proposed when a check fails on the way to a push.",
-        kind: "run",
-        trigger: "pressed",
-        icon: "cloud-upload",
-    },
     {
         // Pressed trigger: the owner's approval click starts this turn; the queue between is just machinery.
         id: "approval-queue",

package/src/policy/command-classes.test.ts

@@ -40,6 +40,22 @@ describe("git.destructive", () => {
     test("a -f belonging to the next command in a pipeline is not a force-push", () => {
         expect(classify("git push origin main | grep -f patterns.txt")).not.toContain("git.destructive");
     });
+
+    test("deleting a checkout's .git, or re-initialising the folder it stands in, cuts it off from its history", () => {
+        for (const command of ["rm .git", "rm -f .git", "rm -rf ./.git", "rm -rf tabularium/.git", "rm .git && git init -b main"]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        for (const command of ["git init", "git init .", "git init -b main", "git init --initial-branch main -q ."]) {
+            expect(classify(command), command).toContain("git.destructive");
+        }
+        expect(marked("cd /work && rm .git && git init -b main", "git.destructive")).toEqual(["rm .git", "git init -b main"]);
+    });
+
+    test("a new project's git init, and files that merely start with .git, are left alone", () => {
+        for (const command of ["git init new-project", "git init -b main tools/cli", "rm .gitignore", "rm -f .github/old.yml", "rm .gitmodules"]) {
+            expect(classify(command), command).not.toContain("git.destructive");
+        }
+    });
 });
 
 describe("files.destructive", () => {
@@ -72,6 +88,27 @@ describe("files.destructive", () => {
         }
     });
 
+    test("find deleting what it walks, or handing it to rm, is the same delete as rm -rf", () => {
+        for (const command of [
+            "find /home/x/PROJECT/cerberus-worktrees/m1-a -depth -delete",
+            "find build -name '*.o' -delete",
+            "find . -type d -name node_modules -exec rm -rf {} +",
+            "find dist -exec /bin/rm -f {} \\;",
+            "find tmp -execdir rm {} \\;",
+            "find . -name '*.log' -print0 | xargs -0 rm -f",
+            "ls old | xargs rm",
+        ]) {
+            expect(classify(command), command).toContain("files.destructive");
+        }
+        expect(marked("find build -name '*.o' -delete; echo done", "files.destructive")).toEqual(["find build -name '*.o' -delete"]);
+    });
+
+    test("a find that only lists, and an xargs that runs something else, pass", () => {
+        for (const command of ["find . -name '*.ts'", "find . -newer deleted.txt -print", "find src -exec grep -l rm {} +", "ls | xargs wc -l"]) {
+            expect(classify(command), command).not.toContain("files.destructive");
+        }
+    });
+
     test("a script that deletes one file, or nothing, is not recursive deletion", () => {
         for (const code of ['fs.unlinkSync("tmp.txt")', 'await fs.promises.rm("tmp.txt")', "const rmq = queue.rm(job)"]) {
             expect(classify(code), code).not.toContain("files.destructive");
@@ -113,6 +150,8 @@ describe("system.destructive", () => {
             "rm -rf C:\\",
             'fs.rmSync("/", { recursive: true, force: true })',
             'rimraf("/work")',
+            "find / -delete",
+            "find /home -type f -delete",
         ]) {
             expect(classify(command), command).toContain("system.destructive");
         }

package/src/policy/command-classes.ts

@@ -375,6 +375,66 @@ const recursiveForceRms = (command: string): CommandSpan[] =>
         .filter((invocation) => invocation.recursive && invocation.force)
         .map((invocation) => invocation.span);
 
+// The same tree delete spelled without `rm -rf`: `find` deleting what it walks, or handing each hit to `rm`, and a list
+// piped into `rm` through xargs. An agent told `rm -rf` needs a card reaches for exactly these.
+const FIND_INVOCATION = /\bfind\s+([^|;&\n]*)/g;
+const FIND_DELETES = /\s(?:-delete\b|-exec(?:dir)?\s+(?:[^\s|;&]*\/)?rm\b)/;
+const XARGS_RM = /\bxargs\b[^|;&\n]*?\s(?:[^\s|;&]*\/)?rm\b/g;
+
+interface FindDelete {
+    // The paths find starts walking from: the words before its first expression (`-name`, `(`, `!`).
+    readonly starts: readonly string[];
+    readonly span: CommandSpan;
+}
+
+const parseFindDeletes = (command: string): FindDelete[] =>
+    [...command.matchAll(FIND_INVOCATION)].flatMap((invocation) => {
+        const args = invocation[1] as string;
+        if (!FIND_DELETES.test(` ${args}`)) {
+            return [];
+        }
+        const words = args.trim().split(/\s+/);
+        const expression = words.findIndex((word) => /^[-(!]/.test(word));
+        const starts = (expression === -1 ? words : words.slice(0, expression)).filter((word) => word !== "").map(unquote);
+        return [{ starts, span: { start: invocation.index, end: invocation.index + invocation[0].trimEnd().length } }];
+    });
+
+const findAndXargsDeletes = (command: string): CommandSpan[] => [
+    ...parseFindDeletes(command).map((found) => found.span),
+    ...spansOf([XARGS_RM], command),
+];
+
+// What cuts a checkout off from its repository's history: deleting its `.git` (for a worktree, a one-line pointer
+// whose loss strands every commit the checkout was reading), or `git init` over the folder it stands in, which makes
+// a standalone repository sharing nothing with the one it came from. A `git init <new-dir>` for a new project is not
+// this, so only an init of the current folder counts.
+const GIT_POINTER = /(?:^|[/\\])\.git[/\\]?$/;
+const GIT_INIT = /\bgit\s+init\b([^|;&\n]*)/g;
+const GIT_INIT_VALUED = /^(?:-b|--initial-branch|--template|--separate-git-dir|--object-format|--ref-format)$/;
+
+const initsHere = (args: string): boolean => {
+    const words = args.trim().split(/\s+/).filter((word) => word !== "");
+    const operands: string[] = [];
+    for (let index = 0; index < words.length; index += 1) {
+        const word = words[index] as string;
+        if (GIT_INIT_VALUED.test(word)) {
+            index += 1;
+        } else if (!word.startsWith("-")) {
+            operands.push(unquote(word));
+        }
+    }
+    return operands.every((operand) => operand === "." || operand === "./");
+};
+
+const checkoutUnlinks = (command: string): CommandSpan[] => [
+    ...parseRm(command)
+        .filter((invocation) => invocation.operands.some((operand) => GIT_POINTER.test(operand)))
+        .map((invocation) => invocation.span),
+    ...[...command.matchAll(GIT_INIT)]
+        .filter((invocation) => initsHere(invocation[1] as string))
+        .map((invocation) => ({ start: invocation.index, end: invocation.index + invocation[0].trimEnd().length })),
+];
+
 // A recursive delete aimed at a root, in either spelling the gate is handed (shell or script). Which targets count as
 // roots is the locus's answer.
 const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
@@ -384,6 +444,9 @@ const rootDeletes = (program: string, locus: CommandLocus): CommandSpan[] => [
     ...nodeDeleteTargets(program)
         .filter((delete_) => isRootTarget(delete_.target, locus))
         .map((delete_) => delete_.span),
+    ...parseFindDeletes(program)
+        .filter((found) => found.starts.some((start) => isRootTarget(start, locus)))
+        .map((found) => found.span),
 ];
 
 // The g twins, built once at load: a card is minted per command held, classify runs per command typed.
@@ -434,10 +497,10 @@ const credentialReads = (command: string, context: CommandContext): CommandSpan[
 
 // One function per class; empty means the command is not in it, so membership and evidence are the same walk.
 const MATCHES: Readonly<Record<CommandClass, (command: string, context: CommandContext) => CommandSpan[]>> = {
-    "git.destructive": (command) => spansOf(GIT_DESTRUCTIVE_G, command),
+    "git.destructive": (command) => [...spansOf(GIT_DESTRUCTIVE_G, command), ...checkoutUnlinks(command)],
     // The only class that can answer "not here": in its own copy a conversation's checkout is its own to move.
     "git.branch-switch": (command, context) => (context.ownCheckout === true ? [] : spansOf(GIT_BRANCH_SWITCH_G, command)),
-    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command)],
+    "files.destructive": (command) => [...recursiveForceRms(command), ...recursiveDeletes(command), ...findAndXargsDeletes(command)],
     "system.destructive": (command, context) => [...spansOf(BLOCK_DEVICE_G, command), ...rootDeletes(command, context.locus)],
     "container.state": (command) => spansOf(CONTAINER_STATE_G, command),
     "secrets.access": credentialReads,
@@ -489,6 +552,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "git clean -f" },
         { code: "git branch -D" },
         { code: "git filter-branch" },
+        { code: "rm .git", qualifier: "any flags: a checkout's link to its history" },
+        { code: "git init", qualifier: "only in the current folder, which may already be a checkout" },
     ],
     "git.branch-switch": [
         { code: "git switch <branch>" },
@@ -498,6 +563,8 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "rm -rf <path>" },
         { code: "fs.rm(<path>, { recursive: true })", qualifier: "also rmSync, rmdir, rmdirSync" },
         { code: "rimraf(<path>)" },
+        { code: "find <path> -delete", qualifier: "also -exec rm and -execdir rm" },
+        { code: "xargs rm" },
     ],
     "system.destructive": [
         { code: "mkfs" },
@@ -507,7 +574,7 @@ export const COMMAND_CLASS_PATTERNS: Readonly<Record<CommandClass, readonly Comm
         { code: "dd of=/dev/…" },
         { code: "shred /dev/…" },
         { code: "> /dev/sda" },
-        { code: "rm -rf /", qualifier: "only when the target is a root, listed below" },
+        { code: "rm -rf /", qualifier: "also find / -delete; only when the target is a root, listed below" },
     ],
     "container.state": [
         { code: "docker volume rm", qualifier: "also remove, prune, and podman for any of these" },

package/src/policy/safety-policy.ts

@@ -64,6 +64,15 @@ export const COMMAND_RULE_CATALOG: readonly CommandRule[] = CommandClassSchema.o
 export const CommandJudgeModeSchema = z.enum(["off", "watch", "on"]);
 export type CommandJudgeMode = z.infer<typeof CommandJudgeModeSchema>;
 
+// What an agent's own project-dependency install (`pnpm add`, `npm install`, `uv sync`) does, one answer for every
+// turn. Where the install lands is the sandbox's business, not the owner's: an isolated turn installs into its own copy
+// and a main-tree turn takes the install lane the daemon's own installs take. This only says whether a person is asked:
+// - automatic: it runs
+// - ask: a card in the turn; the turn waits on that one call, and "allow for this conversation" stops the asking
+// - never: refused; the manifest change still lands and the daemon installs it then
+export const ProjectInstallModeSchema = z.enum(["automatic", "ask", "never"]);
+export type ProjectInstallMode = z.infer<typeof ProjectInstallModeSchema>;
+
 // What the judge answers, one instruction per verdict:
 // - allow: run it, say nothing, the ordinary answer for a triage false positive
 // - ask: raise the card; the only path to a person, meant to be rare
@@ -122,6 +131,7 @@ Ask me before:
 
 - publishing or releasing anything (npm publish, a GitHub release, a container push);
 - force-pushing, hard-resetting or otherwise discarding commits that are not this turn's own work;
+- deleting a checkout's \`.git\` or running \`git init\` in a folder that already is one: in a worktree that cuts it off from my workspace's history, and its work can no longer come back to me;
 - moving a checkout onto another branch (\`git checkout <branch>\`, \`git switch\`) — you only ever see this for a tree that is mine as well as yours, never for a copy of your own, so the worktree paragraph above does not cover it;
 - sending a credential anywhere outside this container.