@intutic/sync-daemon 1.10.0 → 2.0.0

package/dist/harness/protectedPaths.js

@@ -0,0 +1,805 @@
+/**
+ * The config files an agent must never write, and the command shapes it must
+ * never run — whichever harness it runs under.
+ *
+ * # Why this is one list
+ *
+ * It was eleven lists, and no two agreed. Measured on 2026-08-04:
+ *
+ * | path | harnesses protecting it |
+ * |---|---|
+ * | `.claude/settings.local.json` | 3 of 11 |
+ * | `.gemini/settings.json` | 5 of 11 |
+ * | `.intutic/events` | 5 of 11 |
+ * | `.codeium/windsurf/hooks.json` | 8 of 11 |
+ * | `.cursor/hooks.json` | 8 of 11 |
+ *
+ * That is not eleven partial views of one intent, it is a **cross-harness
+ * tamper matrix**. The Claude-family lists carried only Claude paths, so an
+ * agent under Claude Code could rewrite `.cursor/hooks.json`,
+ * `.openhands/hooks.json`, `.gemini/settings.json` or the governance plugin
+ * directory unopposed; the other nine could write `.claude/settings.local.json`,
+ * which Claude Code loads at *higher* precedence than the `settings.json` they
+ * all did protect. Whichever harness the agent was running under, it could
+ * disarm a different one.
+ *
+ * A protected-path list is a security control. Eleven copies of a security
+ * control is eleven chances for one to be wrong, and every one of them was.
+ *
+ * # The same was true of the command guards
+ *
+ * Nine writers hand-maintained a `BYPASS_PATTERNS` list. Measured on 2026-08-05:
+ *
+ * | pattern | writers carrying it |
+ * |---|---|
+ * | `chflags nouchg` / `chattr -i` | 9 of 9 |
+ * | `rm -rf .intutic` | 7 of 9 — **`cursorHooks` and `windsurfHooks` had no protected-path command guard at all** |
+ * | `rm -rf .gemini/settings` | 4 of 9 |
+ * | the harness's own env kill-switch | 1 each |
+ *
+ * That last row is the load-bearing one. `claudeCodeHooks` guarded
+ * `CLAUDE_CODE_HOOKS=` and nothing else; `piHooks` guarded `PI_PRE_TOOL_HOOK=`
+ * and nothing else. So under any harness, the *other eight* kill-switches were
+ * free to set — the identical cross-harness hole the path list already had.
+ * `GOVERNANCE_BYPASS_PATTERNS` closes it with one generic pattern rather than
+ * nine specific ones, so a harness added tomorrow is covered on the day it
+ * lands.
+ *
+ * Two writers also used `/chflags\s+nouchg/` where the other seven used a
+ * literal substring. `\s` does not exist in POSIX ERE — see
+ * {@link assertPortableEre} for why that class of divergence is now a load
+ * failure rather than a silent one.
+ *
+ * # Scope
+ *
+ * Universal by design. A Cursor agent has no legitimate reason to edit Claude
+ * Code's settings, and the reverse holds for every pair — so the union is the
+ * correct list for all of them, not a Cursor list plus a Claude list.
+ * Harness-specific additions spread this and append; `harnessProtectedPaths.test.ts`
+ * asserts each is a superset.
+ *
+ * @module
+ */
+import { SECRET_VALUE_PATTERNS } from '@intutic/shared-types';
+/** Governance config that must hold still, for every harness. */
+export const UNIVERSAL_PROTECTED_PATHS = [
+    // Intutic's own enforcement surface.
+    '.intutic/hooks',
+    '.intutic/integrity.json',
+    '.intutic/events',
+    // Claude Code / Claude Desktop. `settings.local.json` loads at higher
+    // precedence than `settings.json`, so protecting only the latter leaves the
+    // override unguarded — which was the case in eight of eleven lists.
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    // Every other harness's hook surface. Present here even for harnesses that
+    // are not the one generating the script: the threat is an agent under
+    // harness A disabling harness B.
+    '.cursor/hooks.json',
+    '.cline/hooks',
+    '.codeium/windsurf/hooks.json',
+    // The Windsurf JetBrains plugin's SEPARATE user-level hooks.json path (no
+    // `windsurf` subdirectory — confirmed against docs.devin.ai/desktop/
+    // cascade/hooks; see windsurfHooks.ts's module doc comment). Listed
+    // independently of the entry above: an agent disabling the JetBrains
+    // plugin's copy would not touch Desktop's.
+    '.codeium/hooks.json',
+    '.windsurf/hooks.json',
+    '.openhands/hooks.json',
+    '.gemini/settings.json',
+    '.agents/plugins/intutic-governance',
+    // Muse Code — project-level hooks, user settings (managed_hooks_path lives
+    // here), and the Intutic-owned managed-hooks file it points at.
+    '.muse/hooks.json',
+    '.config/muse/settings.json',
+    '.config/muse/intutic-managed-hooks.json',
+    // Grok Build. `.grok/hooks` covers the whole hook directory (not just the
+    // one file this writer owns) — the same "the surface, not the one file"
+    // discipline every other harness's hooks dir gets. `trusted_folders.toml`
+    // is watched even though nothing here writes to it: it governs which
+    // projects Grok Build trusts enough to run hooks in at all, so an agent
+    // rewriting it could disable this harness's whole governance surface
+    // without touching a single hook file.
+    '.grok/hooks',
+    '.grok/config.toml',
+    '.grok/trusted_folders.toml',
+    // DeepSeek's "dsh" — $DSH_HOME defaults to ~/.dsh, so these paths are
+    // matched wherever they appear (command text, or a Write/Edit target) the
+    // same "bare-mention block" way every entry above is, not resolved against
+    // a fixed absolute root here. `.dsh/profiles` covers the whole profiles
+    // directory (every profile's cordis.patch.yml, not just one), the same
+    // "the surface, not the one file" discipline `.grok/hooks` above uses —
+    // dsh may have zero, one, or several profiles, and a tamper anywhere under
+    // it is the same threat. `.dsh/settings.yaml` is the LLM-egress half; both
+    // are the only two files `dshHooks.ts` writes.
+    '.dsh/profiles',
+    '.dsh/settings.yaml',
+    // OpenCode — the plugin directories OpenCode globs (`.opencode/plugin` and
+    // `.opencode/plugins` are both read; only the latter is written) plus the
+    // user-level one. The whole directory, not the one file, same as `.grok/
+    // hooks`: a second plugin dropped beside ours is the same surface.
+    '.opencode/plugins',
+    '.opencode/plugin',
+    '.config/opencode/plugins',
+];
+/**
+ * The normalisation every gate applies before matching, stated once so the
+ * shell and JS emitters cannot drift.
+ *
+ * 1. Every whitespace run collapses to a single space.
+ * 2. The result is padded with one space at each end.
+ *
+ * Step 1 exists because the portable subset has no whitespace class: `[[:space:]]`
+ * is a POSIX construct JavaScript does not implement, and `\s` is a JS construct
+ * POSIX does not implement, so *any* pattern spelling whitespace directly would
+ * enforce in the five bash gates and silently enforce nothing in the eight JS
+ * ones. Normalising first means patterns need only a literal space. It also
+ * closes `rm{TAB}-rf{TAB}/` and the newline-splitting evasion, since `grep` is
+ * line-oriented and would otherwise never see the whole command on one line.
+ *
+ * Step 2 is what lets every pattern use a plain leading/trailing space as a word
+ * boundary instead of `^`, `$` or `\b`. `\b` is not POSIX; and `$` inside an
+ * alternation group — `( |$)` — is an anchor in GNU ERE but unspecified in
+ * POSIX, which is exactly the kind of "works on the CI box" difference this
+ * table exists to eliminate.
+ */
+/**
+ * The one expression every normaliser is built from.
+ *
+ * `js` below is compiled from this string, and `jsSource` embeds the same string
+ * into the emitted gate — so the in-process implementation and the shipped one
+ * are not "kept in sync", they are the same characters. That distinction is not
+ * pedantic: the previous version had a hand-typed copy in each JS gate and they
+ * had already drifted. `NORMALISE_CONTRACT.js(undefined)` returned `" undefined "`
+ * while the emitted gate returned `"  "`, because one wrote `String(s)` and the
+ * other `String(s == null ? '' : s)`.
+ */
+const NORMALISE_JS_EXPR = "' ' + String(s == null ? '' : s).replace(/\\s+/g, ' ') + ' '";
+export const NORMALISE_CONTRACT = {
+    /**
+     * JS: produce the string patterns are matched against.
+     *
+     * Compiled from {@link NORMALISE_JS_EXPR} rather than written out, so it
+     * cannot diverge from what the gates run. `unknown` in, because callers pass
+     * whatever a harness put in its payload.
+     */
+    js: new Function('s', `return ${NORMALISE_JS_EXPR}`),
+    /** The JS function, emitted verbatim into every JavaScript gate. */
+    jsSource: `function intuticNormalise(s) {\n  return ${NORMALISE_JS_EXPR};\n}`,
+    /**
+     * The Python function, emitted into the Open WebUI filter.
+     *
+     * `re.sub(r"\s+", " ", …)` rather than the more idiomatic `" ".join(s.split())`,
+     * and the difference is the one a test caught: `split()` **strips** leading and
+     * trailing whitespace, while the JS `replace(/\s+/g, ' ')` collapses it to a
+     * single space and keeps it. So `"  a  b  "` normalised to `" a b "` in Python
+     * and `"  a b  "` in JS and bash. Both match the same patterns, since patterns
+     * use single-space boundaries — but "happens to be equivalent" is not the
+     * property this contract claims, and the next edit would not have been so lucky.
+     *
+     * Python's `\s` on a `str` covers Unicode whitespace (U+00A0, U+3000), matching
+     * JS. The shell fallback cannot, which is why SHELL_EXTRACT pre-passes.
+     */
+    /** Requires `re` in scope — the emitted filter imports it. */
+    pySource: [
+        'def _intutic_normalise(text):',
+        '    return " " + re.sub(r"\\s+", " ", str(text if text is not None else "")) + " "',
+    ].join('\n'),
+    /**
+     * Shell: pure parameter expansion — no subshell, no `tr`, no `python3`.
+     *
+     * **ASCII only, and deliberately second in line.** Bash cannot express a
+     * Unicode whitespace class, so this collapses only the C0 set; U+00A0 would
+     * survive it and a pattern written with a literal space would then miss. The
+     * bash gates are not exposed to that because `SHELL_EXTRACT` runs every field
+     * through Python's `" ".join(str(v).split())` *before* this ever sees it —
+     * which is Unicode-aware. This is the belt to that pair of braces, and saying
+     * so here is the point: an earlier version of this comment claimed the three
+     * normalisers were provably identical, and they were not.
+     */
+    shell: [
+        'intutic_normalise() {',
+        '  local s="$1"',
+        "  s=\"${s//[$'\\t\\n\\r\\v\\f']/ }\"",
+        '  while [ "$s" != "${s//  / }" ]; do s="${s//  / }"; done',
+        '  printf \' %s \' "$s"',
+        '}',
+    ].join('\n'),
+};
+/**
+ * Rejects any pattern that would not mean the same thing to `grep -E` and to
+ * JavaScript.
+ *
+ * Runs at module load rather than from a test, so a non-portable pattern breaks
+ * the import — every writer, every test, immediately — instead of breaking one
+ * test that someone might skip. The failure this prevents is not hypothetical:
+ * `cursorHooks` and `windsurfHooks` shipped `\s+` for a year.
+ *
+ * `\s`, `\d`, `\w` and `\b` are forbidden **even though GNU grep accepts them**,
+ * because GNU grep is not the only grep — busybox and BSD do not, and a customer
+ * running us in an Alpine image would get a gate that silently matches nothing.
+ */
+export function assertPortableEre(source, id) {
+    const forbidden = [
+        [/\\[sSdDwWbB]/, 'GNU-only escape class (\\s, \\d, \\w, \\b) — normalisation means you can use a literal space'],
+        [
+            /\\[tnrvfxu0]/,
+            'escape sequence (\\t, \\n, \\x41, …) — POSIX ERE does not define these, so ' +
+                'each grep decides for itself whether \\t means a tab or the letter t. ' +
+                'BSD grep happens to agree with JavaScript, which is exactly why this is ' +
+                'checked rather than trusted. Normalisation removes every reason to need one.',
+        ],
+        [/\[\[:/, 'POSIX character class [[:alpha:]] — not implemented by JavaScript'],
+        [/\(\?/, 'lookaround or non-capturing group — not in POSIX ERE'],
+        [/\\[1-9]/, 'backreference — not in POSIX ERE'],
+        [/(^|[^\\])\{/, 'unescaped { — interval syntax differs; escape it as \\{ for a literal brace'],
+        [/(^|[^\\])[$^]/, 'anchor — patterns match a space-padded string, so use a literal space'],
+        [/\t/, 'tab — the .rules snapshot projection is tab-separated'],
+        [/'/, "single quote — patterns are emitted into single-quoted shell literals"],
+    ];
+    for (const [probe, why] of forbidden) {
+        if (probe.test(source))
+            throw new Error(`GuardPattern ${id}: ${why} (in ${JSON.stringify(source)})`);
+    }
+    // Must compile as a JS RegExp at all.
+    try {
+        new RegExp(source);
+    }
+    catch (err) {
+        throw new Error(`GuardPattern ${id}: not a valid RegExp — ${String(err)}`, { cause: err });
+    }
+}
+/** Validates the whole table at load: portable, uniquely identified, and
+ *  carrying a real false-positive contract. */
+function assertGuardTableSane(patterns) {
+    const seen = new Set();
+    for (const p of patterns) {
+        assertPortableEre(p.source, p.id);
+        if (seen.has(p.id))
+            throw new Error(`GuardPattern id is not unique: ${p.id}`);
+        seen.add(p.id);
+        if (p.matches.length < 1) {
+            throw new Error(`GuardPattern ${p.id}: needs at least one \`matches\` fixture. Nothing in ` +
+                `this repo checked that a pattern fires at all — a rule that matches ` +
+                `nothing satisfied the portability test, the false-positive test and ` +
+                `every gate assertion, because they only ever ask what it does NOT do.`);
+        }
+        for (const m of p.matches) {
+            const re = new RegExp(p.source, p.ignoreCase ? 'i' : '');
+            if (!re.test(NORMALISE_CONTRACT.js(m))) {
+                throw new Error(`GuardPattern ${p.id}: declared match ${JSON.stringify(m)} does not match ` +
+                    `its own pattern. The fixture and the rule disagree at module load.`);
+            }
+        }
+        if (p.notMatches.length < 3) {
+            throw new Error(`GuardPattern ${p.id}: needs at least 3 notMatches. A guard with no ` +
+                `false-positive contract is a guard nobody has thought about failing.`);
+        }
+    }
+    return patterns;
+}
+/** Escapes a literal string for use inside a portable ERE. */
+function ereLiteral(s) {
+    return s.replace(/[.[\]()*+?|\\{}^$]/g, (c) => '\\' + c);
+}
+/**
+ * Commands that disarm governance itself.
+ *
+ * The union of the nine hand-rolled `BYPASS_PATTERNS` lists, plus the two holes
+ * the union exposed: `cursorHooks`/`windsurfHooks` never guarded `.intutic` at
+ * all, and every list guarded only its own harness's env kill-switch.
+ */
+export const GOVERNANCE_BYPASS_PATTERNS = assertGuardTableSane([
+    {
+        id: 'bypass.chflags_nouchg',
+        source: ' chflags .*nouchg',
+        severity: 'block',
+        reason: 'Governance bypass pattern: clearing the macOS immutable flag on a governance file',
+        rationale: 'Present in all nine writers. `chflags nouchg <hook>` is step one of ' +
+            'editing a hook that was locked; step two is the edit, which the path ' +
+            'guard would catch — so this is the earlier and clearer signal. Does not ' +
+            'catch a `chflags` reached through a shell function or an alias.',
+        matches: [' chflags nouchg .intutic/hooks ', ' sudo chflags -R nouchg /x ', ' chflags nouchg a b '],
+        // Counter-examples must not name a protected path: those are blocked by the
+        // path rules, correctly, and would make this pattern look like it had a
+        // false positive it does not have.
+        notMatches: [' chflags uchg /tmp/locked.txt ', ' ls -lO /tmp ', ' echo chflags '],
+    },
+    {
+        id: 'bypass.chattr_immutable',
+        source: ' chattr .*-[a-zA-Z]*i',
+        severity: 'block',
+        reason: 'Governance bypass pattern: clearing the Linux immutable attribute on a governance file',
+        rationale: 'The Linux half of `chflags nouchg`. Matches `-i` in any flag cluster ' +
+            '(`-Ri`, `-R -i`). Deliberately does not require a path argument: the ' +
+            'command is only ever run to make something writable.',
+        matches: [' chattr -i /x ', ' chattr -R -i /x ', ' sudo chattr -Ri /x '],
+        notMatches: [' chattr +i /x ', ' lsattr /x ', ' chattr -a /x '],
+    },
+    {
+        id: 'bypass.chmod_governance',
+        source: ' chmod .*(hooks|\\.intutic|\\.claude|\\.cursor)',
+        severity: 'block',
+        reason: 'Governance bypass pattern: changing permissions on a governance file',
+        rationale: 'Generalises the `chmod [0-9]*7[0-9]* .*hooks` regex that only ' +
+            '`cursorHooks` and `windsurfHooks` carried, and drops its mode-digit ' +
+            'requirement — `chmod 000` disarms a hook just as well as `chmod 777`. ' +
+            'Does not catch `chmod` on a governance path reached via a symlink.',
+        matches: [' chmod 777 .intutic/hooks/x ', ' chmod -R 000 .claude ', ' chmod +x .cursor/hooks.json '],
+        notMatches: [' chmod +x ./build.sh ', ' chmod 644 src/index.ts ', ' chmod -R 755 dist '],
+    },
+    {
+        id: 'bypass.env_kill_switch',
+        source: ' [A-Z][A-Z0-9_]*_HOOKS?=',
+        severity: 'block',
+        reason: 'Governance bypass pattern: setting a harness environment variable that disables its hooks',
+        rationale: 'One generic pattern replacing nine harness-specific ones. Every writer ' +
+            'guarded only its own switch, so `CLAUDE_CODE_HOOKS=0` was blocked under ' +
+            'Claude Code and free under the other eight — and a harness added ' +
+            'tomorrow was guarded nowhere. Requires the underscore before HOOK so ' +
+            '`WEBHOOKS=` and `GITHOOKS=` stay legal. Does not catch `env -u`, ' +
+            '`unset`, or a switch whose name does not end in _HOOK/_HOOKS.',
+        matches: [' CLAUDE_CODE_HOOKS=0 x ', ' PI_PRE_TOOL_HOOK= x ', ' ANTIGRAVITY_PRE_TOOL_HOOK=/dev/null x '],
+        notMatches: [' WEBHOOKS=1 x ', ' GITHOOKS=off x ', ' export PATH=/usr/bin '],
+    },
+]);
+/**
+ * Credential VALUES in the content an agent is about to write.
+ *
+ * The gap this closes, measured before it was built: the PreToolUse gate —
+ * the only enforcement point that runs before the harness executes a tool —
+ * matched tool name, target path and command, never content. A key the model
+ * had seen anywhere in context could be written into a config file and the
+ * gate had no rule that could notice; the proxy's DLP covers the same case
+ * only when LLM traffic actually routes through the proxy, so a
+ * hooks-installed-but-unproxied workspace had zero write-direction scanning.
+ * (GitGuardian's 2025 measurement of why this matters: AI-assisted commits
+ * shipped hardcoded secrets at 3.2% against a 1.5% human baseline.)
+ *
+ * Sources live in `@intutic/shared-types` (`secretPatterns.ts`) because the
+ * pre-commit scan in `tools/cli/src/lib/gitHooks.ts` greps the SAME shapes
+ * over the staged diff — two hand-kept copies of "what is a credential" is
+ * the drift this repo keeps paying for. Fixtures stay here, where the
+ * table's self-test runs.
+ *
+ * ## Severity: block, deliberately skipping the warn-first ramp
+ *
+ * DESTRUCTIVE_COMMAND_PATTERNS shipped at warn to earn promotion on measured
+ * false positives. These four ship at block because both halves of that
+ * trade differ: the patterns are prefix-anchored value shapes already
+ * hard-blocking in production on the MCP proxy's input path with no
+ * false-positive reports, and the failure being prevented — a credential in
+ * a file, then in a commit — is not undone by an undo (the key is burned;
+ * rotation is the only remedy). A warn that lets the write proceed IS the
+ * incident.
+ *
+ * ## What this deliberately does not catch
+ *
+ * A secret split across two Writes, base64/hex-encoded values, secrets
+ * assembled by concatenation in generated code, values reached through
+ * env-var indirection, and any credential format without a distinctive
+ * prefix. Those need entropy analysis and cross-call state that belong in
+ * the proxy's DLP, not in a gate that must stay fast and false-positive-free
+ * to keep its block tier trusted. This is the same floor-vs-DLP split the
+ * warn tier's own comment draws ("arguments and paths stay out — that is
+ * DLP's job"): the floor takes the four shapes precise enough to refuse on.
+ */
+export const SECRET_CONTENT_PATTERNS = assertGuardTableSane((() => {
+    // Fixture material is runtime-assembled: the repo convention forbids
+    // contiguous credential-shaped literals in source, in every package.
+    const awsKey = 'AKIA' + 'B2C3D4E5F6G7H2J3';
+    const antKey = 'sk-ant-' + 'api03-abcdefghijklmnop';
+    const ghToken = 'ghp_' + 'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8';
+    const orKey = 'sk-or-v1-' + 'a1b2c3d4e5f6g7h8i9j0k1l2';
+    // vk_ + 32 lowercase hex (apiKeyService.ts: randomBytes(16).toString('hex'))
+    const vkKey = 'vk_' + 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6';
+    // gwk_ + 64 lowercase hex (routes/gateways.ts: randomBytes(32).toString('hex'))
+    const gwkKey = 'gwk_' + 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6' + '9f8e7d6c5b4a39281f7e6d5c4b3a2910';
+    const stripeKey = 'sk_live_' + 'A1b2C3d4E5f6G7h8I9j0K1l2';
+    const rsaPemHeader = '-----BEGIN ' + 'RSA PRIVATE KEY-----';
+    const pemHeader = '-----BEGIN ' + 'PRIVATE KEY-----';
+    const fixtures = {
+        'secrets.aws_access_key': {
+            matches: [`{"file_path":"config.ts","content":"const key = '${awsKey}'"}`],
+            notMatches: [
+                '{"content":"AKIA is the prefix AWS uses"}',
+                '{"content":"' + 'AKIA' + 'IOSFODNN7"}', // 9-char tail: too short
+                '{"content":"' + 'akia' + 'b2c3d4e5f6g7h2j3"}', // lowercase: not the format
+            ],
+        },
+        'secrets.anthropic_api_key': {
+            matches: [`{"content":"ANTHROPIC_API_KEY=${antKey}"}`],
+            notMatches: [
+                '{"content":"sk-ant- keys must never be committed"}',
+                '{"content":"' + 'sk-ant-' + 'short"}',
+                '{"content":"ask-antelope-20-questions-about-keys"}',
+            ],
+        },
+        'secrets.github_token': {
+            matches: [`{"content":"GITHUB_TOKEN: ${ghToken}"}`],
+            notMatches: [
+                '{"content":"ghp_ prefixed tokens are PATs"}',
+                '{"content":"' + 'ghp_' + 'tooShort123"}',
+                '{"content":"' + 'ghx_' + 'A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"}',
+            ],
+        },
+        'secrets.private_key_pem': {
+            matches: [`{"content":"${rsaPemHeader}"}`, `{"content":"${pemHeader}"}`],
+            notMatches: [
+                '{"content":"-----BEGIN CERTIFICATE-----"}',
+                '{"content":"-----BEGIN PUBLIC KEY-----"}',
+                '{"content":"the PRIVATE KEY header is five dashes"}',
+            ],
+        },
+        'secrets.openrouter_api_key': {
+            matches: [`{"content":"OPENROUTER_API_KEY=${orKey}"}`],
+            notMatches: [
+                '{"content":"sk-or-v1- is the OpenRouter prefix"}',
+                '{"content":"' + 'sk-or-v1-' + 'short"}',
+                '{"content":"' + 'sk-or-v2-' + 'a1b2c3d4e5f6g7h8i9j0k1l2"}', // wrong version tag
+            ],
+        },
+        'secrets.intutic_virtual_key': {
+            matches: [`{"content":"INTUTIC_API_KEY=${vkKey}"}`],
+            notMatches: [
+                '{"content":"vk_ prefixes every Intutic virtual key"}',
+                '{"content":"' + 'vk_' + 'tooshort"}',
+                // 31 hex chars, one short of the fixed 32 — must not match
+                '{"content":"' + 'vk_' + 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d"}',
+            ],
+        },
+        'secrets.intutic_gateway_token': {
+            matches: [`{"content":"gateway registered with token ${gwkKey}"}`],
+            notMatches: [
+                '{"content":"gwk_ prefixes every gateway token"}',
+                '{"content":"' + 'gwk_' + 'tooshort"}',
+                // 63 hex chars, one short of the fixed 64 — must not match
+                '{"content":"' + 'gwk_' + 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6' + '9f8e7d6c5b4a39281f7e6d5c4b3a291"}',
+            ],
+        },
+        'secrets.stripe_secret_key': {
+            matches: [`{"content":"STRIPE_SECRET_KEY=${stripeKey}"}`],
+            notMatches: [
+                '{"content":"sk_live_ is the Stripe live-mode prefix"}',
+                '{"content":"' + 'sk_live_' + 'short"}',
+                '{"content":"' + 'sk_test_' + 'A1b2C3d4E5f6G7h8I9j0K1l2"}', // test mode, not live
+            ],
+        },
+    };
+    return SECRET_VALUE_PATTERNS.map((p) => {
+        const f = fixtures[p.id];
+        if (!f)
+            throw new Error(`secretPatterns entry ${p.id} has no gate fixtures`);
+        return {
+            id: p.id,
+            source: p.source,
+            subject: 'content',
+            severity: 'block',
+            reason: `${p.description} detected in the content this call would write. ` +
+                'Writing a live credential into a file is one commit away from ' +
+                'shipping it; reference it from the environment instead.',
+            rationale: 'See SECRET_CONTENT_PATTERNS. Value shape, not access shape: fires ' +
+                'on the credential itself appearing in writable content. Does not ' +
+                'catch encoded, split, or concatenation-assembled values — those ' +
+                "are the proxy DLP's job.",
+            matches: f.matches,
+            notMatches: f.notMatches,
+        };
+    });
+})());
+/**
+ * Writes and edits targeting the agent-skill surface — `.agents/skills/**`
+ * and `.claude/skills/**`.
+ *
+ * TD-358 (updated 2026-08-18): these two entries stay `warn` and stay
+ * compiled into {@link staticFloorPatterns} — that part of the original
+ * decision is unchanged. What changed is what that tier assignment now
+ * *means*: it is the DEGRADED-MODE baseline, not the intended steady state.
+ * The steady state, everywhere a valid policy snapshot has landed, is `block`
+ * — shipped as `skill_surface.*.tier` entries through
+ * `services/sync-daemon/src/lib/policySnapshot.ts`'s `buildSnapshotRules`,
+ * gated behind `SKILL_SURFACE_TIER_SEVERITY`. See that constant's doc comment
+ * for why skill-directory *path* writes no longer sit behind the same
+ * false-positive-rate justification skill-CONTENT scanning still does — this
+ * entry only covers the half that stayed at `warn`.
+ *
+ * The two design choices below are for different reasons and worth
+ * separating:
+ *
+ * - **Why the FLOOR copy stays `warn`:** a compiled-in rule ships on every
+ *   machine at once and can only be changed by a release — no one-sync-cycle
+ *   undo if it turns out wrong. That is exactly the property a degraded-mode
+ *   baseline needs (safe to run forever, unconditionally, on a machine that
+ *   has never talked to the control plane) and exactly the property the
+ *   steady-state decision does not need to have, since it lives in the
+ *   snapshot and can be retracted in a cycle. Blocking here as well would
+ *   collapse that distinction and reintroduce the un-retractable blast radius
+ *   the snapshot channel exists to avoid.
+ * - **Why a floor copy exists at all, unlike `DESTRUCTIVE_COMMAND_PATTERNS`:**
+ *   this pattern set is NOT content-conditional — it does not run
+ *   `scanSkillContent` or judge what a skill file says, only WHERE a write
+ *   targets. That is a deterministic, zero-ambiguity match (a write's target
+ *   path either is or is not under `.agents/skills/` or `.claude/skills/`),
+ *   so a workspace with no control-plane connectivity (offline, pre-`connect`,
+ *   or a snapshot that failed its digest/workspace check) still gets an
+ *   advisory signal from the moment the gate is written, rather than falling
+ *   back to nothing.
+ *
+ * `subject: 'target'` deliberately, not `'any'`: this matches the tool's own
+ * path argument (`file_path`/`path`/…, the same extraction every Write/Edit
+ * gate already does), not a bare mention in a shell command. A `cat` or `grep`
+ * of a skill file is a read, not a write, and is not what this pattern
+ * exists to flag — narrower than `UNIVERSAL_PROTECTED_PATHS`'s "any mention"
+ * rule on purpose, since that rule blocks and this one only advises.
+ *
+ * A future promotion to `block` on skill CONTENT (not path) is a different,
+ * later, and still-open decision — it needs the corpus measurement TD-358
+ * describes, which this change does not supply. It should ship through the
+ * same policy-snapshot channel the way this path-tier promotion and
+ * `DESTRUCTIVE_COMMAND_PATTERNS` both do, so it too is retractable in a sync
+ * cycle rather than a release if the measurement turns out wrong.
+ */
+export const SKILL_SURFACE_PATTERNS = assertGuardTableSane([
+    {
+        id: 'skill_surface.agents_skills_write',
+        source: '\\.agents/skills/',
+        subject: 'target',
+        severity: 'warn',
+        reason: 'Write or edit targets a .agents/skills/** skill file — advisory only, pending a ' +
+            'false-positive measurement of scanSkillContent against real skill markdown (TD-358)',
+        rationale: 'Deterministic path match, not a content judgement — see the pattern-set doc comment ' +
+            'above. Does not catch a write reached through a shell redirect (subject is `target`, ' +
+            'not `any`), a symlink, or a relative walk such as ../.agents/skills/x.',
+        matches: [
+            ' .agents/skills/my-skill/SKILL.md ',
+            ' .agents/skills/foo/resources/data.json ',
+            ' /Users/dev/project/.agents/skills/bar/SKILL.md ',
+        ],
+        notMatches: [
+            ' .agents/rules.md ',
+            ' src/agents/skills/legacy.ts ',
+            ' README.md ',
+            ' .claude/skills/other-skill/SKILL.md ',
+        ],
+    },
+    {
+        id: 'skill_surface.claude_skills_write',
+        source: '\\.claude/skills/',
+        subject: 'target',
+        severity: 'warn',
+        reason: 'Write or edit targets a .claude/skills/** skill file — advisory only, pending a ' +
+            'false-positive measurement of scanSkillContent against real skill markdown (TD-358)',
+        rationale: 'The Claude Code counterpart to skill_surface.agents_skills_write; same limits.',
+        matches: [
+            ' .claude/skills/my-skill/SKILL.md ',
+            ' .claude/skills/foo/resources/data.json ',
+            ' /Users/dev/project/.claude/skills/bar/SKILL.md ',
+        ],
+        notMatches: [
+            ' .claude/settings.json ',
+            ' .claude/commands/foo.md ',
+            ' src/claude/skills/legacy.ts ',
+            ' .agents/skills/other-skill/SKILL.md ',
+        ],
+    },
+]);
+/**
+ * Commands that destroy the machine or its data irrecoverably.
+ *
+ * TD-309: none of these were blocked by any harness. They are shipped through
+ * the policy snapshot rather than compiled into the gate, and at `warn` before
+ * `block` — see the note on `severity` below.
+ *
+ * ## What is deliberately allowed
+ *
+ * `rm -rf ./`, `rm -rf .`, `rm -rf *`, `rm -rf build/`, `rm -rf node_modules`
+ * and `rm -rf /home/…` are all ordinary developer commands and all pass. That
+ * is not an oversight to tighten later. A guard that blocks routine work
+ * teaches the developer to run `chflags nouchg` on the hook — the exact bypass
+ * `GOVERNANCE_BYPASS_PATTERNS` exists to stop. Blocking too much manufactures
+ * the adversary the rest of this file defends against.
+ *
+ * ## What no pattern here catches
+ *
+ * Shell redirection to a raw device (`cat /dev/zero > /dev/sda`), obfuscation
+ * (`eval "$(printf cm0gLXJmIC8= | base64 -d)"`), anything reached through a
+ * script file rather than typed as a command, and any of these run by a process
+ * the agent spawns rather than by the agent. This tier is a speed bump against
+ * accident and casual bypass. Containment is the proxy and OS permissions.
+ */
+export const DESTRUCTIVE_COMMAND_PATTERNS = assertGuardTableSane(
+// Every rule in this tier is about a shell command, so the subject is stamped
+// here rather than repeated eleven times — one place to be wrong instead of
+// eleven, which is the whole argument of this module.
+[
+    {
+        id: 'destructive.rm_rf_root',
+        source: ' rm( +-[a-zA-Z-]+)+ +/( |\\*)',
+        severity: 'block',
+        reason: 'Recursive delete of the filesystem root',
+        rationale: 'The trailing `( |\\*)` after the root slash is what separates this from ' +
+            'TD-309\'s false positive: `rm -rf /home/me/build` has a character other ' +
+            'than a space or a star after the slash and is allowed. Requires at least ' +
+            'one flag, so a bare `rm /` (which fails anyway) does not match.',
+        matches: [
+            ' rm -rf / ',
+            ' rm -rf / --no-preserve-root ',
+            ' sudo rm -rf / ',
+            ' rm -rf /* ',
+            ' cd /tmp && rm -fr / ',
+        ],
+        notMatches: [
+            ' rm -rf /home/me/project/build ',
+            ' rm -rf ./dist ',
+            ' rm -rf * ',
+            ' rm -rf node_modules ',
+            ' rm -rf /tmp/scratch ',
+            ' rm -rf .cache ',
+        ],
+    },
+    {
+        id: 'destructive.mkfs_device',
+        source: ' mkfs[a-z0-9.]* .*/dev/',
+        severity: 'block',
+        reason: 'Formatting a block device',
+        rationale: 'Covers `mkfs.ext4 /dev/sda1` and `mkfs -t ext4 /dev/sdb` in one pattern ' +
+            'by not caring what sits between the verb and the device. Does not catch ' +
+            'mkfs against a loop-mounted image file, which is a legitimate thing to do.',
+        matches: [' mkfs.ext4 /dev/sda1 ', ' mkfs -t ext4 /dev/sdb ', ' sudo mkfs.xfs /dev/nvme0n1 '],
+        notMatches: [' mkfs.ext4 disk.img ', ' ls /dev/sda ', ' cat /proc/mounts '],
+    },
+    {
+        id: 'destructive.dd_raw_device',
+        source: ' dd .*of=/dev/',
+        severity: 'block',
+        reason: 'Writing a raw image over a block device',
+        rationale: 'Keys on the output operand only. `dd if=/dev/sda of=backup.img` reads a ' +
+            'device and is allowed; `of=/dev/sda` writes one and is not. Does not ' +
+            'catch `dd` with the operands reordered onto separate normalised tokens ' +
+            'in a way that puts `of=` before the device — there is no such form.',
+        matches: [' dd if=/dev/zero of=/dev/sda ', ' sudo dd if=x.img of=/dev/disk2 bs=1m ', ' dd bs=4M of=/dev/sdb '],
+        notMatches: [' dd if=/dev/sda of=backup.img ', ' dd if=/dev/urandom of=./noise ', ' dd --help '],
+    },
+    {
+        id: 'destructive.block_device_wipe',
+        source: ' (shred|wipefs|blkdiscard) .*/dev/',
+        severity: 'block',
+        reason: 'Wiping a block device',
+        rationale: 'The three verbs whose whole purpose is unrecoverable erasure. `shred` on ' +
+            'a regular file is allowed — that is what it is for; only `/dev/` makes it ' +
+            'unrecoverable at device scope.',
+        matches: [' shred /dev/sda ', ' wipefs -a /dev/sdb ', ' sudo blkdiscard /dev/nvme0n1 '],
+        notMatches: [' shred -u secret.txt ', ' wipefs --help ', ' ls /dev/ '],
+    },
+    {
+        id: 'destructive.chmod_recursive_root',
+        source: ' chmod +-[a-zA-Z]*R[a-zA-Z]* +[0-7]+ +/( |\\*)',
+        severity: 'block',
+        reason: 'Recursive permission change across the filesystem root',
+        rationale: 'Same root-anchoring as rm_rf_root. Requires an explicit recursive flag, ' +
+            'so a non-recursive `chmod 777 /` (which affects one directory and is ' +
+            'recoverable) is allowed.',
+        matches: [' chmod -R 777 / ', ' sudo chmod -Rv 755 / ', ' chmod -R 000 /* '],
+        notMatches: [' chmod -R 755 /home/me/app ', ' chmod -R 644 ./src ', ' chmod 777 / '],
+    },
+    {
+        id: 'destructive.chown_recursive_root',
+        source: ' chown +-[a-zA-Z]*R[a-zA-Z]* +[a-zA-Z0-9_.:-]+ +/( |\\*)',
+        severity: 'block',
+        reason: 'Recursive ownership change across the filesystem root',
+        rationale: 'The companion to chmod_recursive_root; `chown -R me /` is the more ' +
+            'common accident of the two because it is what a misquoted `$HOME` ' +
+            'expands to. Same limits.',
+        matches: [' chown -R me / ', ' sudo chown -R root:wheel / ', ' chown -Rh nobody /* '],
+        notMatches: [' chown -R me /home/me ', ' chown -R node:node ./app ', ' chown me file.txt '],
+    },
+    {
+        id: 'destructive.fork_bomb',
+        source: ':\\(\\) *\\{ *:\\|:',
+        severity: 'block',
+        reason: 'Fork bomb',
+        rationale: 'The canonical `:(){ :|:& };:` and its spacing variants. Matches the ' +
+            'definition, not the invocation, so it fires before the function exists. ' +
+            'Does not catch a fork bomb written with any other function name — this ' +
+            'is a guard against paste, not against intent.',
+        matches: [':(){ :|:& };:', ' :() { :|: & }; : ', ' echo x; :(){ :|:& };: '],
+        notMatches: [' echo :() ', ' func() { echo hi; } ', ' test() { return 0; } '],
+    },
+    // ── warn tier ──────────────────────────────────────────────────────────
+    {
+        id: 'destructive.curl_pipe_shell',
+        source: ' (curl|wget) .*\\| *(sudo )?(ba|z|k|d)?sh',
+        severity: 'warn',
+        reason: 'Piping a downloaded script straight into a shell',
+        rationale: 'Warn, not block, and the reason is empirical rather than principled: ' +
+            'this is how a large share of legitimate developer tooling installs, ' +
+            'including ours. Blocking it blocks onboarding. Flagged so the shape is ' +
+            'visible in telemetry.',
+        matches: [' curl -fsSL https://x.sh | sh ', ' wget -qO- https://x | sudo bash ', ' curl x | zsh '],
+        notMatches: [' curl -o x.sh https://x ', ' curl https://api/x | jq . ', ' wget https://x.tar.gz '],
+    },
+    {
+        id: 'destructive.sql_drop',
+        source: ' (drop +(table|database|schema)|truncate +table) ',
+        ignoreCase: true,
+        severity: 'warn',
+        reason: 'Destructive SQL statement',
+        rationale: 'Demoted from the hook gate\'s hard block. Against a local development ' +
+            'database this is what a migration looks like, and the gate cannot tell a ' +
+            'dev DSN from a production one — the proxy can, and that is where a block ' +
+            'belongs. Warn keeps the signal without owning a decision it lacks the ' +
+            'context to make.',
+        matches: [' DROP TABLE users ', ' drop database app ', ' TRUNCATE TABLE events '],
+        notMatches: [' SELECT * FROM users ', ' echo drop it ', ' git stash drop '],
+    },
+    {
+        id: 'destructive.git_history_loss',
+        source: ' git .*(reset +--hard|clean +-[a-zA-Z]*f|push +.*--force)',
+        severity: 'warn',
+        reason: 'Git command that discards uncommitted or remote work',
+        rationale: 'Recoverable from the reflog in most cases, which is why it is not a ' +
+            'block — but `git clean -xfd` takes untracked files the reflog never saw. ' +
+            'Warn is the honest tier for "usually recoverable".',
+        matches: [' git reset --hard HEAD~3 ', ' git clean -xfd ', ' git push --force origin main '],
+        notMatches: [' git reset HEAD~1 ', ' git clean -n ', ' git push origin main '],
+    },
+].map((p) => ({ ...p, subject: 'command' })));
+/**
+ * Shell-command guards derived from {@link UNIVERSAL_PROTECTED_PATHS}.
+ *
+ * Derived rather than written out so that adding a protected path extends the
+ * command guard in all thirteen gates automatically. Hand-maintaining the two
+ * lists in parallel is how they diverged the first time.
+ *
+ * Each path becomes a bare-mention block, matching the strictest existing
+ * behaviour (`claudeCodeHooks` already blocked any command containing
+ * `.claude/settings.json`). That is stricter than a verb list would be, and it
+ * is chosen deliberately: narrowing to `rm|mv|chmod|…` would *shrink* the set
+ * of calls Claude Code blocks today, and this change is only safe to reason
+ * about if it never does that. The cost is that `cat .intutic/hooks/x` is
+ * refused as well as `rm` — documented here because it will surface as a
+ * support question.
+ */
+/**
+ * Computed at module load, not per call.
+ *
+ * It used to build and validate on every invocation, which meant a malformed
+ * derived pattern surfaced at emit time rather than at import — the opposite of
+ * what the other two tables do, and the whole argument for validating at load.
+ */
+const PROTECTED_PATH_SHELL_PATTERNS = (() => assertGuardTableSane(UNIVERSAL_PROTECTED_PATHS.map((p) => ({
+    id: `path.${p.replace(/[^a-zA-Z0-9]+/g, '_').replace(/^_|_$/g, '')}`,
+    source: ereLiteral(p),
+    severity: 'block',
+    reason: `Shell command references the governance-protected path ${p}`,
+    rationale: `Derived from UNIVERSAL_PROTECTED_PATHS. Blocks any mention, not just a ` +
+        `mutating verb, because that is what claudeCodeHooks already did and ` +
+        `narrowing it would reduce today's protection. Does not catch the path ` +
+        `reached through a variable, a symlink, or a relative walk such as ` +
+        `../${p}.`,
+    matches: [` rm -rf ${p} `, ` printf x > ${p} `, ` mv ${p} /tmp/x `],
+    notMatches: [' ls -la . ', ' git status ', ' npm run build '],
+}))))();
+export function protectedPathShellPatterns() {
+    return PROTECTED_PATH_SHELL_PATTERNS;
+}
+/** Every compiled-in guard: the static floor. Destructive patterns are **not**
+ *  here — they ship through the policy snapshot so they can be retracted
+ *  without a release. `SKILL_SURFACE_PATTERNS` IS here, deliberately, despite
+ *  also being new: unlike the destructive tier it is a deterministic path
+ *  match with no content judgement to get wrong, so there is no measurement
+ *  risk to hold it back from — see its own doc comment. As of TD-358's
+ *  block-tier promotion these two entries are the DEGRADED-MODE baseline
+ *  only: the steady state is `block`, delivered through the policy snapshot
+ *  (`SKILL_SURFACE_TIER_SEVERITY` in `lib/policySnapshot.ts`) and additive on
+ *  top of these, exactly the way the destructive tier layers on top of this
+ *  same floor. */
+export function staticFloorPatterns() {
+    return [
+        ...GOVERNANCE_BYPASS_PATTERNS,
+        ...SECRET_CONTENT_PATTERNS,
+        ...SKILL_SURFACE_PATTERNS,
+        ...protectedPathShellPatterns(),
+    ];
+}
+//# sourceMappingURL=protectedPaths.js.map