@ngockhoale/ukit 2.7.5 → 2.7.6

package/CHANGELOG.md

@@ -2,6 +2,32 @@
 
 All notable changes to UKit are documented here.
 
+## 2.7.6 - 2026-09-20
+
+Permission posture work — cycle C41 (TASK-001..004): omp prompts aligned to
+Claude Code — routine commands auto-allow, gates kept only for destructive
+operations.
+
+- `rm -rf *` static catch-all removed from `templates/.omp/config.yml`
+  `bash.patterns`, `templates/.claude/settings.json`, and
+  `permissionPolicy.CANONICAL_DENY` (16→15). The `block-dangerous` hook remains
+  the authority for generic `rm -rf <dir>` (fail-closed), so coverage for
+  real destructive targets is unchanged while routine/safe cleanup paths no
+  longer hit the static deny on both hosts.
+- `ompConfigMerge` now coerces preserved legacy `prompt`/`ask` bash.patterns
+  to `allow` instead of `deny` — under rendered `yolo` a broad preserved
+  pattern (worst case `*`) could globally brick bash. Preserved `deny` still
+  passes through; canonical deny + the hook still gate destructive commands.
+- `permissionDoctor` new FAIL check `omp-approval-mode-not-pinned`: under
+  `orchestration.permissionMode: unattended`, fires when omp `approvalMode`
+  is missing or not `yolo`; plus an advisory audit of preserved bash.patterns.
+  `applicable:false` when `.omp/config.yml` is absent or mode ≠ unattended.
+- `sensitive-data-guard` added to `CANONICAL_PROTECTED` (no precedence
+  change); new `tests/manifest/c41OmpPosture.test.js` asserts routine
+  commands are not prompted, all destructive classes stay denied, and
+  enumerates the full prompt-producing gate inventory (stale-spec-guard,
+  sensitive-data-guard, bridge, FAIL_CLOSED).
+
 ## 2.7.5 - 2026-09-20
 
 Hook performance work — cycle C40 (TASK-001..007): `.mjs` module steps,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngockhoale/ukit",
-  "version": "2.7.5",
+  "version": "2.7.6",
   "description": "Install/update an index-first AI workspace for Claude Code, OpenAI Codex and omp (Oh My Pi).",
   "license": "MIT",
   "type": "module",

package/src/core/ompConfigMerge.js

@@ -130,7 +130,12 @@ export function mergeOmpConfig(existingText, renderedText) {
   }
 
   // §7.4 — bash.patterns union: existing-only entries (dedupe by match) appended
-  // before the trailing `- match: "*"` allow; `prompt` re-emitted as `deny`.
+  // before the trailing `- match: "*"` allow; `prompt` re-emitted as `allow`.
+  // Under rendered yolo a `deny` is a silent hard block, so coercing prompt→deny
+  // would only ADD false bricks (worst case a legacy `*` pattern denying all
+  // bash) without adding real safety — the canonical deny set + block-dangerous
+  // hook still gate destructive commands. prompt→allow is behavior-identical
+  // to the trailing `*` allow and stays honest about what yolo can run.
   const existingPatterns = Array.isArray(existing?.bash?.patterns) ? existing.bash.patterns : [];
   const renderedPatterns = Array.isArray(rendered?.bash?.patterns) ? rendered.bash.patterns : [];
   const renderedMatches = new Set(renderedPatterns.map((p) => p?.match));
@@ -140,7 +145,7 @@ export function mergeOmpConfig(existingText, renderedText) {
     if (renderedMatches.has(pattern.match)) continue;
     let approval = pattern.approval;
     if (approval === 'prompt') {
-      approval = 'deny';
+      approval = 'allow';
       report.coercedPromptPatterns.push(pattern.match);
     }
     extraPatterns.push({ ...pattern, approval });

package/src/core/permissionDoctor.js

@@ -17,10 +17,11 @@ import { findOpencodeArtifacts, opencodeSteerMessage } from './opencodeSteer.js'
 // doctor section and `--json`.
 //
 // FAIL classes (each → named failing check + report.failures entry + exit 1):
-//   unattended-prompt      prompt/ask reachable while permissionMode=unattended
-//   deny-loss              canonical deny entry missing from a host surface
-//   unsafe-eval-mismatch   surface eval approval ≠ compiled evalPosture
-//   unrendered-token       literal {{token}} left in a rendered artifact
+//   unattended-prompt            prompt/ask reachable while permissionMode=unattended
+//   omp-approval-mode-not-pinned omp approvalMode ≠ 'yolo' under unattended
+//   deny-loss                    canonical deny entry missing from a host surface
+//   unsafe-eval-mismatch         surface eval approval ≠ compiled evalPosture
+//   unrendered-token             literal {{token}} left in a rendered artifact
 // INFO: reachable prompts under interactive/safe-auto. SKIP: absent host surface.
 
 const UNRESOLVED_TOKEN_PATTERN = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
@@ -210,7 +211,32 @@ export async function inspectPermissions({ projectRoot, ompPath = 'omp' }) {
       .filter((w) => w !== 'unsafe-eval-mismatch' && w !== 'prompt-reachable-under-unattended')
       .map((w) => `${h}:${w}`));
 
+  // TASK-003 / cycle-41 — C34/C35 blind spot: literal prompt/ask counting never
+  // sees `approvalMode: write` or a missing pin, yet unattended still needs the
+  // yolo pin (C35 decided; here we only detect drift, never re-litigate it).
+  const pinApplicable = omp.exists && declared === 'unattended';
+  const pinFail = pinApplicable && ompTools.approvalMode !== 'yolo';
+
+  // Preserved-pattern audit — omp bash.patterns deny/allow entries outside the
+  // canonical set (post-TASK-001 shape) are merges carrying legacy/custom
+  // rules; visible as advisory, never a FAIL.
+  const canonicalOmpMatches = new Set(
+    CANONICAL_DENY.map((c) => c.omp).filter((m) => typeof m === 'string'),
+  );
+  const preservedPatternMatches = bashPatterns
+    .filter(
+      (e) =>
+        e &&
+        (e.approval === 'deny' || e.approval === 'allow') &&
+        typeof e.match === 'string' &&
+        !canonicalOmpMatches.has(e.match) &&
+        // the template's own trailing catch-all allow is rendered, not preserved
+        !(e.match === '*' && e.approval === 'allow'),
+    )
+    .map((e) => e.match);
+
   if (promptsFail) failures.push('unattended-prompt');
+  if (pinFail) failures.push('omp-approval-mode-not-pinned');
   if (denyMissingAll.length > 0) failures.push('deny-loss');
   if (evalMismatch) failures.push('unsafe-eval-mismatch');
   if (unresolvedTokens.length > 0) failures.push('unrendered-token');
@@ -248,6 +274,35 @@ export async function inspectPermissions({ projectRoot, ompPath = 'omp' }) {
           : 'no host permission surfaces installed',
       },
     ),
+    check(
+      'omp approvalMode pinned under unattended',
+      !pinFail,
+      'install-repairable',
+      'Run ukit install to re-pin approvalMode to yolo.',
+      {
+        ...(pinApplicable ? {} : { applicable: false }),
+        detail: !omp.exists
+          ? '.omp/config.yml absent'
+          : declared !== 'unattended'
+            ? `mode ${declared} allows prompts — pin not required`
+            : `tools.approvalMode=${ompTools.approvalMode ?? 'absent'} (required: yolo)`,
+      },
+    ),
+    check(
+      'preserved omp bash.patterns audit',
+      true,
+      'advisory',
+      'Review preserved entries; drop them or rerun ukit install after pruning the source config.',
+      {
+        ...(omp.exists ? {} : { applicable: false }),
+        ...(preservedPatternMatches.length > 0 ? { severity: 'warning' } : {}),
+        detail: !omp.exists
+          ? '.omp/config.yml absent'
+          : preservedPatternMatches.length === 0
+            ? 'no non-canonical bash.patterns entries preserved'
+            : `non-canonical preserved entries: ${preservedPatternMatches.join(', ')}`,
+      },
+    ),
     check(
       'deny coverage vs canonical set',
       denyMissingAll.length === 0,

package/src/core/permissionPolicy.js

@@ -35,7 +35,6 @@ export const CANONICAL_DENY = Object.freeze([
   { id: 'rm-rf-home', claude: 'Bash(rm -rf ~:*)', omp: 'rm -rf ~*', codex: 'rm -rf ~', hardDeny: true },
   { id: 'rm-rf-parent', claude: 'Bash(rm -rf ..:*)', omp: 'rm -rf ..', codex: 'rm -rf ..', hardDeny: true },
   { id: 'rm-rf-dot', claude: 'Bash(rm -rf .:*)', omp: 'rm -rf .', codex: 'rm -rf .', hardDeny: true },
-  { id: 'rm-rf-any', claude: 'Bash(rm -rf:*)', omp: 'rm -rf *', codex: 'rm -rf' },
   { id: 'dd-raw-device', claude: 'Bash(dd if=/dev/:*)', omp: 'dd if=/dev/*', codex: 'dd if=/dev/', hardDeny: true },
   { id: 'write-raw-device', claude: 'Bash(*> /dev/sda:*)', omp: '*> /dev/sda*', codex: '> /dev/sda', hardDeny: true },
   { id: 'mkfs', claude: 'Bash(mkfs:*)', omp: 'mkfs.*', codex: 'mkfs', hardDeny: true },
@@ -48,6 +47,7 @@ export const CANONICAL_PROTECTED = Object.freeze([
   'release-credentials',   // npm tokens, signing keys, .env secrets
   'protected-files',       // protect-files.sh guarded paths
   'stale-spec-guard',      // spec/source drift guard on edits
+  'sensitive-data-guard',  // secret/PII scrub gate on reads, bash, prompts
 ]);
 
 const TIER_RANK = new Map(PERMISSION_PRECEDENCE.map((tier, i) => [tier, i]));

package/templates/.claude/settings.json

@@ -48,7 +48,6 @@
       "Bash(rm -rf ~:*)",
       "Bash(rm -rf ..:*)",
       "Bash(rm -rf .:*)",
-      "Bash(rm -rf:*)",
       "Bash(dd if=/dev/:*)",
       "Bash(*> /dev/sda:*)",
       "Bash(mkfs:*)",

package/templates/.omp/config.yml

@@ -98,14 +98,15 @@ bash:
       approval: deny
     - match: "dd if=/dev/*"
       approval: deny
-    # block-dangerous.sh also carries a safe-cleanup allowlist for recursive force-deletes
-    # (dist/build/coverage/.next/.nuxt/.turbo/tmp/temp/.cache/node_modules) and blocks every other
-    # `rm -rf`. bash.patterns has no conditional/allowlist syntax to express that distinction, so
-    # this layer is deliberately coarser: it denies ALL remaining `rm -rf` rather than approximating
-    # the allowlist. The real script still runs via TASK-004's bridge and is the authority here —
-    # bash.patterns is defence in depth, not the only line.
-    - match: "rm -rf *"
-      approval: deny
+    # Generic `rm -rf <dir>` is intentionally NOT denied here — the
+    # block-dangerous hook (running via TASK-004's bridge) is the authority:
+    # its safe-cleanup allowlist (dist/build/coverage/.next/.nuxt/.turbo/
+    # tmp/temp/.cache/node_modules, realpath-contained in the project root)
+    # passes routine cleanup, and every other `rm -rf` is gated fail-closed
+    # (ask → block on omp, deny on claude). A static `rm -rf *` deny used to
+    # sit here but outranked that allowlist, so allowlisted cleanup could
+    # never run. The hard rm denies above (/, ~, ., ..) stay — those are
+    # catastrophic regardless of allowlist.
     - match: "*"
       approval: allow