@ouro.bot/cli 0.1.0-alpha.99 → 0.1.0-alpha.991

package/dist/repertoire/guardrails.js

@@ -33,12 +33,23 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OURO_CLI_TRUST_MANIFEST = void 0;
+exports.BUNDLE_GIT_REFUSAL = exports.OURO_CLI_TRUST_MANIFEST = exports.PSYCHE_REFUSAL = void 0;
+exports.canonicalTarget = canonicalTarget;
+exports.insideAgentFolder = insideAgentFolder;
+exports.psycheFileClass = psycheFileClass;
+exports.psycheWriteAllowed = psycheWriteAllowed;
+exports.psycheEditNote = psycheEditNote;
+exports.bundleGitRefused = bundleGitRefused;
 exports.guardInvocation = guardInvocation;
 const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
-const types_1 = require("../mind/friends/types");
+const path = __importStar(require("node:path"));
+const friends_1 = require("@ouro.bot/friends");
+const shell_quote_1 = require("shell-quote");
 const runtime_1 = require("../nerves/runtime");
+const store_1 = require("../commerce/store");
+const identity_1 = require("../heart/identity");
+const sync_1 = require("../heart/sync");
 const deny = (reason) => ({ allowed: false, reason });
 const allow = { allowed: true };
 // --- reason templates ---
@@ -47,6 +58,7 @@ const REASONS = {
     readBeforeEdit: "i need to read that file first before i can edit it.",
     readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
     protectedPath: "that path is protected — i can read it but not modify it.",
+    unreadablePath: "that path is protected — i can't read it.",
     destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
     // Trust reasons (vary by relationship)
     needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
@@ -55,17 +67,165 @@ const REASONS = {
 // --- read-only tools that never need guardrails ---
 const READ_ONLY_TOOLS = new Set(["read_file", "glob", "grep"]);
 // --- protected path detection ---
-const PROTECTED_PATH_SEGMENTS = [".git/"];
-function getProtectedAbsolutePrefixes() {
-    return [`${os.homedir()}/.agentsecrets/`];
+const PROTECTED_PATH_SEGMENTS = [
+    ".git/",
+    ".ouro-cli/vault-unlock/",
+    ".ouro-cli/vault-unlock-dpapi/",
+    "state/policy/",
+    // The pre-trust-directory home of the escalation grants; the file is no longer read, and a model must not recreate it.
+    "state/a2a/escalation-grants.json",
+    // Where to queue mail for offline peers; a model that rewrote a contact could send a peer's mail to its own relay.
+    "state/a2a/relay-contacts/",
+    // Relay retirements awaiting their vault write; a forged marker would skip draining an old relay inbox.
+    "state/a2a/relay-retired/",
+    "state/outbox/",
+    "state/reports/",
+];
+const PROTECTED_FILENAMES = ["agent.json", "tool-profiles.json"];
+/** How many symlinks a dangling-link walk follows before refusing (the Linux kernel's own limit is 40). */
+const MAX_SYMLINK_HOPS = 40;
+/** A lookup that failed only because part of the path does not exist yet; any other failure leaves the target unknown. */
+function rethrowUnlessMissing(error) {
+    const code = error.code;
+    if (code !== "ENOENT" && code !== "ENOTDIR")
+        throw error;
+}
+/**
+ * The real location of `lexical`: `realpathSync.native` of the deepest part that exists, the final file included, with the
+ * missing remainder appended. A dangling symlink is followed, from its real parent, to where a write through it would land.
+ * Throws when the filesystem cannot say where the path lands (a denied lookup, a symlink loop, too many links), so the
+ * guard can refuse rather than fall back to the lexical path.
+ */
+function canonicalize(lexical) {
+    let current = lexical;
+    const missing = [];
+    let hops = 0;
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync.native(current), ...missing);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        let stat;
+        try {
+            stat = fs.lstatSync(current);
+        }
+        catch (error) {
+            rethrowUnlessMissing(error);
+        }
+        if (stat?.isSymbolicLink()) {
+            if (hops >= MAX_SYMLINK_HOPS)
+                throw new Error(`too many symbolic links resolving ${lexical}`);
+            hops += 1;
+            current = path.resolve(fs.realpathSync.native(path.dirname(current)), fs.readlinkSync(current));
+            continue;
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return path.join(current, ...missing);
+        missing.unshift(path.basename(current));
+        current = parent;
+    }
+}
+/**
+ * Every place a file tool could write `p`: resolved against the agent root and against the repo root (which is what
+ * `write_file` and `edit_file` use), each in its lexical and canonical form. An absolute `p` is resolved only as itself.
+ */
+function canonicalTarget(p, agentRoot) {
+    const lexicals = path.isAbsolute(p) ? [p] : [path.resolve(agentRoot, p), path.resolve((0, identity_1.getRepoRoot)(), p)];
+    return lexicals.flatMap((lexical) => [lexical, canonicalize(lexical)]);
+}
+/** True when any form of `p` is the agent's `folder` (in either its lexical or its canonical form) or under it. */
+function insideAgentFolder(p, agentRoot, folder) {
+    const lexicalFolder = path.resolve(agentRoot, folder);
+    const folders = [lexicalFolder, canonicalize(lexicalFolder)];
+    return canonicalTarget(p, agentRoot).some((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+}
+// --- the psyche belongs to the agent ---
+// Every agent writes its own TACIT.md: what it learns about how its house works. The rest of its psyche (who it is) changes only
+// when a family human asks it directly, one to one, on a channel that proves who they are.
+exports.PSYCHE_REFUSAL = "that file is part of me; I change it when my owner asks me in our own chat.";
+const PSYCHE_IDENTITY_CHANNELS = new Set(["telegram", "bluebubbles", "teams"]);
+/** `tacit` for the agent's psyche/TACIT.md, `identity` for anything else in psyche/ (the folder and new files included), `null` outside it. */
+function psycheFileClass(filePath, agentRoot) {
+    if (!filePath || !agentRoot || !insideAgentFolder(filePath, agentRoot, "psyche"))
+        return null;
+    const lexicalFolder = path.resolve(agentRoot, "psyche");
+    const folders = [lexicalFolder, canonicalize(lexicalFolder)];
+    const tacits = folders.map((folder) => path.join(folder, "TACIT.md"));
+    // Every form of the path that lands in psyche/ must be TACIT: a link that sends one form of it to SOUL makes it identity.
+    const inPsyche = canonicalTarget(filePath, agentRoot).filter((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+    return inPsyche.every((target) => tacits.includes(target)) ? "tacit" : "identity";
+}
+/** The lstat of `p`, or null when it does not exist; throws on any other lookup failure. */
+function lstatIfPresent(p) {
+    try {
+        return fs.lstatSync(p);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+/** Whether the person in this conversation may have the agent write this psyche file. */
+function psycheWriteAllowed(fileClass, _filePath, context) {
+    const agentRoot = context.agentRoot;
+    /* v8 ignore next -- a file is only classed as psyche when there is an agent root @preserve */
+    if (!agentRoot)
+        return false;
+    try {
+        if (lstatIfPresent(path.join(agentRoot, "psyche"))?.isSymbolicLink())
+            return false;
+        if (fileClass === "tacit") {
+            // A symlink or a hard link would carry the write to some other file.
+            const tacit = lstatIfPresent(path.join(agentRoot, "psyche", "TACIT.md"));
+            if (tacit && (tacit.isSymbolicLink() || tacit.nlink > 1))
+                return false;
+            if (context.friendId === undefined)
+                return true;
+            return context.trustLevel === undefined || context.trustLevel === "friend" || context.trustLevel === "family";
+        }
+    }
+    catch {
+        return false;
+    }
+    return context.friendKind === "human"
+        && context.trustLevel === "family"
+        && context.channel !== undefined && PSYCHE_IDENTITY_CHANNELS.has(context.channel)
+        && context.isGroupChat !== true
+        // Teams does not yet tell the turn whether it is a group chat, so there only an explicit one-to-one counts.
+        && (context.channel !== "teams" || context.isGroupChat === false);
+}
+/** The line a successful write to an identity file carries back to the agent. */
+function psycheEditNote(file) {
+    return `psyche edit: I changed psyche/${file}. I tell my owner in one line which file changed and why.`;
+}
+/** The agent's psyche folder, in the lexical form the shell check uses; the file tools classify with `psycheFileClass`. */
+function isPsychePath(filePath, agentRoot) {
+    const psyche = path.resolve(agentRoot, "psyche");
+    const target = path.resolve(agentRoot, filePath);
+    return target === psyche || target.startsWith(`${psyche}${path.sep}`);
+}
+/**
+ * The friends store (`friends/` under the agent root) is written by the harness's own code, which the model's file tools and
+ * shell redirects must not reach: a model talked into editing a record could rewrite trust, admission or a legacy grant.
+ * Scoped to this agent's root, so a project directory that happens to be named `friends` stays editable. Defence in depth
+ * only: a shell can still write anywhere its uid can, which is why delegated-command authority lives outside the bundle.
+ */
+function isFriendsStorePath(filePath, agentRoot) {
+    const store = path.resolve(agentRoot, "friends");
+    const target = path.resolve(agentRoot, filePath);
+    return target === store || target.startsWith(`${store}${path.sep}`);
 }
 function isProtectedPath(filePath) {
     for (const segment of PROTECTED_PATH_SEGMENTS) {
         if (filePath.includes(`/${segment}`) || filePath.startsWith(segment))
             return true;
     }
-    for (const prefix of getProtectedAbsolutePrefixes()) {
-        if (filePath.startsWith(prefix))
+    for (const name of PROTECTED_FILENAMES) {
+        if (path.basename(filePath) === name)
             return true;
     }
     return false;
@@ -99,6 +259,196 @@ function shellWritesToProtectedPath(command) {
         return true;
     return false;
 }
+// --- the psyche folder in shell commands ---
+// The agent changes its own psyche through write_file and edit_file, where the trust gate below decides who may ask for it.
+// The shell never writes there, for anyone: a shell command that mentions the psyche folder at all runs only if every part of
+// it is a read-only command, because enumerating the ways to write a file (>, >>, tee, cp, mv, sed -i, node -e, python, cd then
+// redirect) is a list the model can always step around.
+const PSYCHE_READ_ONLY_COMMANDS = new Set(["cat", "ls", "head", "tail", "grep", "wc", "sha256sum", "stat", "cd", "pwd"]);
+const SEGMENT_OPERATORS = new Set(["&&", "||", ";", "|"]);
+// --- globs and expansions that could land inside a protected folder ---
+// A word such as /bundle/fr*nds/x.json, /bundle/friend?/x.json or ${F}ends/x.json names no protected folder literally, but the
+// shell could resolve it into one. A word like that counts as mentioning the folder when its directory part can match the folder's
+// path, so the read-only rule below applies to the command.
+const EXPANSION = "\u0001";
+const STABLE_VARIABLES = ["HOME", "TMPDIR", "USER"];
+function neutraliseExpansions(command) {
+    return command.replace(/\$\([^)]*\)|`[^`]*`|\$\{([A-Za-z_]\w*)\}|\$([A-Za-z_]\w*)|\$\{[^}]*\}/g, (_match, braced, plain) => {
+        const name = braced ?? plain;
+        if (name !== undefined && STABLE_VARIABLES.includes(name) && !new RegExp(`\\b${name}=`).test(command) && process.env[name])
+            return process.env[name];
+        return EXPANSION;
+    });
+}
+function wordPattern(word) {
+    const generalised = word.replace(/\{[^}]*\}/g, EXPANSION).replace(/\[[^\]]*\]/g, "?");
+    let source = "";
+    for (const char of generalised)
+        source += char === EXPANSION ? ".*" : char === "*" ? "[^/]*" : char === "?" ? "[^/]" : char.replace(/[.+^$()|\\\]{}[]/g, "\\$&");
+    return new RegExp(`^${source}$`);
+}
+function globOrExpansionCouldReach(command, folder, agentRoot) {
+    const tokens = neutraliseExpansions(command).split(/[\s<>|;&()'"]+/).filter((token) => /[*?[{\u0001]/.test(token));
+    return tokens.some((token) => {
+        const word = token.startsWith("~") ? expandHome(token) : token;
+        const absolute = word.startsWith("/") || word.startsWith(EXPANSION) ? word : `${agentRoot}/${word}`;
+        const dir = absolute.slice(0, Math.max(absolute.lastIndexOf("/"), 0));
+        return wordPattern(absolute).test(folder) || wordPattern(dir).test(folder);
+    });
+}
+function commandMentionsPsyche(command, words, agentRoot) {
+    const psyche = path.resolve(agentRoot, "psyche");
+    if (globOrExpansionCouldReach(command, psyche, agentRoot))
+        return true;
+    if (command.includes(psyche) || words.some((word) => word.includes(psyche)))
+        return true;
+    if (words.some((word) => word === "psyche" || isPsychePath(word, agentRoot)))
+        return true;
+    // A relative "psyche/..." inside code or a quoted argument, when this agent has such a folder.
+    if (/(?:^|[\s'"=(])psyche\//.test(command) && fs.existsSync(psyche))
+        return true;
+    // ~/..., $HOME/... and paths relative to a cd or -C target that land in this agent's psyche/.
+    return commandMentionsAgentFolder(command, words, agentRoot, "psyche");
+}
+/**
+ * The shared rule: when a shell command mentions a protected folder at all, it runs only if every part of it is a read-only
+ * command. The mention test is the only thing that differs between folders.
+ */
+function protectedFolderShellWriteRefused(command, mentions) {
+    const entries = (0, shell_quote_1.parse)(command);
+    const words = entries.filter((entry) => typeof entry === "string");
+    if (!mentions(words))
+        return false;
+    // Substitution, heredocs and any $VAR or ${VAR} expansion: the shell could build a protected path or a command word we cannot see.
+    if (/\$[({A-Za-z_]|`|<\(|<</.test(command))
+        return true;
+    let expectCommandWord = true;
+    for (const entry of entries) {
+        if (typeof entry === "string") {
+            if (expectCommandWord && !/^\w+=/.test(entry)) {
+                if (!PSYCHE_READ_ONLY_COMMANDS.has(entry))
+                    return true;
+                expectCommandWord = false;
+            }
+            continue;
+        }
+        const op = "op" in entry ? entry.op : "comment";
+        if (SEGMENT_OPERATORS.has(op))
+            expectCommandWord = true;
+        else if (op !== "glob")
+            return true;
+    }
+    return false;
+}
+function psycheShellWriteRefused(command, agentRoot) {
+    if (!agentRoot)
+        return false;
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsPsyche(command, words, agentRoot));
+    }
+    catch {
+        // The filesystem could not say where a path that names psyche/ lands: refuse rather than guess.
+        return true;
+    }
+}
+// --- the friends store in shell commands ---
+// Same stance as the psyche folder: a command that names this agent's friends store runs only if it is read-only, because a list of
+// the ways to write a file (>, >>, tee, cp, mv, sed -i, node -e, python, cd then redirect, ~ paths) is one the model can step around.
+function expandHome(word) {
+    return word === "~" || word.startsWith("~/") ? path.join(os.homedir(), word.slice(1)) : word;
+}
+function commandMentionsFriendsStore(command, words, agentRoot) {
+    if (globOrExpansionCouldReach(command, path.resolve(agentRoot, "friends"), agentRoot))
+        return true;
+    // Only path-shaped words resolve against the store: an ordinary word such as "friends" in prose is not a path.
+    if (words.some((word) => word.includes("/") && isFriendsStorePath(expandHome(word), agentRoot)))
+        return true;
+    // A bare `friends` names the store only as the target of a cd; elsewhere it is an ordinary word ("my friends are kind").
+    if (words.some((word, index) => word.startsWith("friends/") || (word === "friends" && words[index - 1] === "cd")))
+        return true;
+    // A variable or substitution in front of the path ($BUNDLE/friends/x.json): the folder name is still in the command.
+    if (/\$[({A-Za-z_]|`/.test(command) && /(?:^|[\/\s'"=])friends(?:$|[\/\s'"])/.test(command))
+        return true;
+    // An absolute or relative path inside code or a quoted argument, such as node -e "...'/bundle/friends/x.json'...".
+    const store = path.resolve(agentRoot, "friends");
+    if (command.includes(store) || /(?:^|[\s'"=(])friends\//.test(command))
+        return true;
+    // Paths relative to a cd or -C target that land in this agent's friends/.
+    return commandMentionsAgentFolder(command, words, agentRoot, "friends");
+}
+function friendsShellWriteRefused(command, agentRoot) {
+    if (!agentRoot)
+        return false;
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsFriendsStore(command, words, agentRoot));
+    }
+    catch {
+        // The filesystem could not say where a path that names friends/ lands: refuse rather than guess.
+        return true;
+    }
+}
+// --- where a path in a shell command lands ---
+// A command can name one of this agent's folders by an absolute path, by ~/ or $HOME/, or relative to wherever it cd's (or
+// git -C's) first. Each word whose path has a part exactly `<name>` is resolved against every directory the command could be
+// working in, lexically and canonically, and counts when it lands in this agent's <name>/.
+const UNFOLLOWABLE_WORKING_DIRECTORY = /(?:^|[\s;&|(`])(?:pushd|popd)(?:\s|$)|(?:^|[\s;&|(`])cd\s+(?:--|["']?\$)|\s-C\s*["']?\$|(?:^|[\s;&|(`/])(?:sh|bash|zsh|dash|ksh)\s+(?:-\w+\s+)*-\w*c\b/;
+/** Words of a shell command that name a path whose part is exactly `name`, wherever they sit (code and quotes included). */
+function namedFolderWords(command, name) {
+    const part = new RegExp(`(?:^|/)${name}(?:/|$)`);
+    return command.split(/[\s'"=();|&<>`]+/).filter((token) => part.test(token));
+}
+function commandMentionsAgentFolder(command, words, agentRoot, name) {
+    const lexicalFolder = path.resolve(agentRoot, name);
+    if (globOrExpansionCouldReach(command, lexicalFolder, agentRoot))
+        return true;
+    const candidates = namedFolderWords(command, name);
+    if (candidates.length === 0)
+        return false;
+    // A variable in front of the path ($HOME/.../<name>/x): where it lands is the shell's to say, so it counts.
+    if (candidates.some((candidate) => candidate.includes("$")))
+        return true;
+    // A working directory this guard cannot follow (pushd, cd --, a cd or -C to a variable, or a nested shell's -c string):
+    // a relative path could land anywhere, so it counts.
+    if (UNFOLLOWABLE_WORKING_DIRECTORY.test(command))
+        return true;
+    // A path that names this bundle's own folder (x.ouro/psyche) or a glob just above the folder (*/psyche) is this agent's
+    // wherever the command works from, so eval, a piped shell, env --chdir, find -path and code that chdir's all count.
+    const bundle = path.basename(path.resolve(agentRoot)).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const anchored = new RegExp(`(?:^|/)(?:${bundle}|[^/]*[*?[][^/]*)/${name}(?:/|$)`);
+    if (candidates.some((candidate) => anchored.test(candidate)))
+        return true;
+    const folders = [lexicalFolder, path.join(canonicalize(path.resolve(agentRoot)), name)];
+    // Every directory the command could be working in: where the shell starts, and each cd target, from each earlier one.
+    const cwds = [process.cwd()];
+    for (const [index, word] of words.entries()) {
+        // `git -C <dir>` works in <dir> just as `cd <dir>` does.
+        if (words[index - 1] !== "cd" && words[index - 1] !== "-C")
+            continue;
+        const target = expandHome(word);
+        cwds.push(...(path.isAbsolute(target) ? [target] : cwds.map((cwd) => path.resolve(cwd, target))));
+    }
+    return candidates.some((candidate) => {
+        const word = expandHome(candidate);
+        const lexicals = path.isAbsolute(word) ? [path.resolve(word)] : cwds.map((cwd) => path.resolve(cwd, word));
+        return lexicals.flatMap((lexical) => [lexical, canonicalize(lexical)])
+            .some((target) => folders.some((dir) => target === dir || target.startsWith(`${dir}${path.sep}`)));
+    });
+}
+// --- the product rules in shell commands ---
+// product/PRODUCT.md is the package's standing rules for this agent; releases replace it, and nothing in a conversation does.
+// Unlike the friends store, a bare relative "product/" is an ordinary project folder almost everywhere, so it counts as this
+// agent's only when the command is plainly working in the agent root.
+function productShellWriteRefused(command, agentRoot) {
+    if (!agentRoot)
+        return false;
+    try {
+        return protectedFolderShellWriteRefused(command, (words) => commandMentionsAgentFolder(command, words, agentRoot, "product"));
+    }
+    catch {
+        // The filesystem could not say where a path that names product/ lands: refuse rather than guess.
+        return true;
+    }
+}
 // --- structural guardrail checks (always on, all trust levels) ---
 function checkReadBeforeWrite(toolName, args, context) {
     if (toolName === "edit_file") {
@@ -127,21 +477,51 @@ function checkDestructiveShellPatterns(toolName, args) {
     }
     return allow;
 }
-function checkProtectedPaths(toolName, args) {
+function checkProtectedPaths(toolName, args, context) {
     if (toolName === "write_file" || toolName === "edit_file") {
         const filePath = args.path || "";
+        // The file tools resolve a relative path against the repo root and follow symlinks, so the guard checks every form.
+        // A path whose landing place the filesystem cannot report is refused rather than checked lexically.
+        const agentRoot = filePath ? context.agentRoot : undefined;
+        if (agentRoot) {
+            try {
+                const psycheClass = psycheFileClass(filePath, agentRoot);
+                if (psycheClass && !psycheWriteAllowed(psycheClass, filePath, context))
+                    return deny(exports.PSYCHE_REFUSAL);
+                if (insideAgentFolder(filePath, agentRoot, "friends"))
+                    return deny(REASONS.protectedPath);
+                if (insideAgentFolder(filePath, agentRoot, "product"))
+                    return deny(REASONS.protectedPath);
+                // A link can carry a write that reads as harmless to a protected file (state/policy, agent.json).
+                if (canonicalTarget(filePath, agentRoot).some(isProtectedPath))
+                    return deny(REASONS.protectedPath);
+            }
+            catch {
+                return deny(REASONS.protectedPath);
+            }
+        }
         if (isProtectedPath(filePath))
             return deny(REASONS.protectedPath);
     }
     if (toolName === "shell") {
         const command = args.command || "";
+        if (psycheShellWriteRefused(command, context.agentRoot))
+            return deny(exports.PSYCHE_REFUSAL);
+        if (friendsShellWriteRefused(command, context.agentRoot))
+            return deny(REASONS.protectedPath);
+        if (productShellWriteRefused(command, context.agentRoot))
+            return deny(REASONS.protectedPath);
+        if (bundleGitRefused(command, context.agentRoot))
+            return deny(exports.BUNDLE_GIT_REFUSAL);
+        if (syncSecretShellRefused(command))
+            return deny(REASONS.unreadablePath);
         if (shellWritesToProtectedPath(command))
             return deny(REASONS.protectedPath);
     }
     return allow;
 }
 function checkStructuralGuardrails(toolName, args, context) {
-    const protectedResult = checkProtectedPaths(toolName, args);
+    const protectedResult = checkProtectedPaths(toolName, args, context);
     if (!protectedResult.allowed)
         return protectedResult;
     const destructiveResult = checkDestructiveShellPatterns(toolName, args);
@@ -155,18 +535,15 @@ exports.OURO_CLI_TRUST_MANIFEST = {
     whoami: "acquaintance",
     changelog: "acquaintance",
     "session list": "acquaintance",
-    "task board": "friend",
-    "task create": "friend",
-    "task update": "friend",
-    "task show": "friend",
-    "task actionable": "friend",
-    "task deps": "friend",
-    "task sessions": "friend",
     "friend list": "friend",
     "friend show": "friend",
     "friend create": "friend",
     "friend update": "family",
-    "reminder create": "friend",
+    // Linking and merging change who the agent believes someone is: family only.
+    "friend link": "family",
+    "friend unlink": "family",
+    "friend merge": "family",
+    "friend dedupe": "family",
     "config model": "friend",
     "config models": "friend",
     "mcp list": "acquaintance",
@@ -201,7 +578,8 @@ function resolveOuroSubcommand(command) {
     /* v8 ignore next -- bare "ouro" is caught upstream by checkShellTrustGuardrails @preserve */
     if (!afterOuro)
         return null;
-    const tokens = afterOuro.split(/\s+/);
+    // `--agent <name>` may come before the subcommand; it never changes which subcommand runs.
+    const tokens = afterOuro.split(/\s+/).filter((token, index, all) => token !== "--agent" && all[index - 1] !== "--agent");
     const twoWord = tokens.length >= 2 ? `${tokens[0]} ${tokens[1]}` : null;
     // Two-word match first (e.g. "task board"), then one-word (e.g. "whoami")
     if (twoWord && exports.OURO_CLI_TRUST_MANIFEST[twoWord])
@@ -210,6 +588,26 @@ function resolveOuroSubcommand(command) {
         return tokens[0];
     return null;
 }
+// --- MCP server-specific trust rules ---
+const MCP_SERVER_TRUST = {
+    browser: { minTrust: "friend", blockGroupChat: true },
+};
+function checkMcpServerTrust(command, context) {
+    const match = command.match(/^ouro\s+mcp\s+call\s+(\S+)/);
+    if (!match)
+        return allow;
+    const serverName = match[1];
+    const rules = MCP_SERVER_TRUST[serverName];
+    if (!rules)
+        return allow; // no special rules for this server
+    if (!trustLevelSatisfied(rules.minTrust, context.trustLevel ?? "friend")) {
+        return deny(REASONS.needsTrust);
+    }
+    if (rules.blockGroupChat && context.isGroupChat) {
+        return deny("browser tools are only available in 1:1 conversations, not group chats.");
+    }
+    return allow;
+}
 function checkSingleShellCommandTrust(command, trustLevel) {
     const trimmed = command.trim();
     const tokens = trimmed.split(/\s+/);
@@ -261,15 +659,1075 @@ function checkWriteTrustGuardrails(toolName, args, context) {
         return allow;
     return deny(REASONS.needsTrustForWrite);
 }
+// --- credential tool trust gating ---
+// Credential write tools: family only
+const CREDENTIAL_FAMILY_TOOLS = new Set([
+    "credential_generate_password", "credential_store", "credential_delete", "vault_setup",
+    // User profile tools: family only
+    "user_profile_store", "user_profile_get", "user_profile_delete",
+    // Payment tools: family only
+    "stripe_create_card", "stripe_deactivate_card", "stripe_list_cards",
+    // Booking tools that involve payment: family only
+    "flight_book", "flight_hold", "flight_cancel",
+]);
+// Credential read tools: friend+
+const CREDENTIAL_TRUSTED_TOOLS = new Set(["credential_get", "credential_list"]);
+// Travel tools: friend+ (weather_lookup accesses vault credentials indirectly;
+// advisory and geocode are public APIs but gated for consistency)
+// Flight search is also friend+ (read-only, no payment)
+const TRAVEL_TRUSTED_TOOLS = new Set(["weather_lookup", "travel_advisory", "geocode_search", "flight_search"]);
+const A2A_TRUSTED_TOOLS = new Set(["a2a_list_peers", "a2a_send_message", "a2a_get_task"]);
+const COMMERCE_FAMILY_TOOLS = new Set(["commerce_checkout_preview", "commerce_checkout_commit", "commerce_receipt_get", "commerce_access_log"]);
+const COMMERCE_AUTHORITY_TOOLS = new Set(["stripe_create_card", "flight_hold", "flight_book"]);
+// The Shepherd tools read the owner's terminals and speak to them through their desktop, so only family may use them.
+// A call with no known trust level fails closed.
+const SHEPHERD_FAMILY_TOOLS = new Set(["shepherd_overview", "shepherd_read", "shepherd_signal", "shepherd_send"]);
+const MAIL_FAMILY_TOOLS = new Set(["mail_screener", "mail_decide", "mail_access_log", "mail_send", "mail_index_refresh"]);
+const MAIL_DELEGATED_READ_TOOLS = new Set(["mail_recent", "mail_search"]);
+function opaqueAnsiShellAtoms(command) {
+    const atoms = [];
+    let inAnsiQuote = false;
+    for (let index = 0; index < command.length;) {
+        if (!inAnsiQuote && command.startsWith("$'", index)) {
+            inAnsiQuote = true;
+            index += 2;
+            continue;
+        }
+        const character = command[index];
+        if (inAnsiQuote && character === "'") {
+            inAnsiQuote = false;
+            index += 1;
+            continue;
+        }
+        if (inAnsiQuote && character === "\\") {
+            const escape = command.slice(index).match(/^\\(?:x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{1,4}|U[0-9a-fA-F]{1,8}|[0-7]{1,3}|c.|.)?/s)[0];
+            atoms.push(null);
+            index += escape.length;
+            continue;
+        }
+        if (!inAnsiQuote && (character === "'" || character === '"')) {
+            index += 1;
+            continue;
+        }
+        if (!inAnsiQuote && character === "\\" && index + 1 < command.length) {
+            atoms.push(command[index + 1]);
+            index += 2;
+            continue;
+        }
+        atoms.push(character);
+        index += 1;
+    }
+    return atoms;
+}
+function shellContainsAmbiguousAnsiMailCacheSync(command) {
+    if (!command.includes("$'"))
+        return false;
+    const expected = ["ouro", "mail", "sync-cache"];
+    let states = new Set(["0:0"]);
+    const crossTokenBoundary = (current) => {
+        const next = new Set(["0:0"]);
+        for (const state of current) {
+            const [tokenIndex, characterIndex] = state.split(":").map(Number);
+            if (characterIndex !== expected[tokenIndex].length)
+                continue;
+            if (tokenIndex === expected.length - 1)
+                return { matched: true, states: next };
+            next.add(`${tokenIndex + 1}:0`);
+        }
+        return { matched: false, states: next };
+    };
+    for (const atom of opaqueAnsiShellAtoms(command)) {
+        if (atom === null) {
+            const next = new Set(states);
+            for (const state of states) {
+                const [tokenIndex, characterIndex] = state.split(":").map(Number);
+                if (characterIndex >= 0 && characterIndex < expected[tokenIndex].length) {
+                    next.add(`${tokenIndex}:${characterIndex + 1}`);
+                }
+            }
+            const boundary = crossTokenBoundary(states);
+            if (boundary.matched)
+                return true;
+            states = new Set([...next, ...boundary.states]);
+            continue;
+        }
+        if (/\s|[;&|()`]/.test(atom)) {
+            const boundary = crossTokenBoundary(states);
+            if (boundary.matched)
+                return true;
+            states = boundary.states;
+            continue;
+        }
+        const next = new Set();
+        for (const state of states) {
+            const [tokenIndex, characterIndex] = state.split(":").map(Number);
+            const wanted = expected[tokenIndex]?.[characterIndex];
+            next.add(wanted?.toLowerCase() === atom.toLowerCase() ? `${tokenIndex}:${characterIndex + 1}` : `${tokenIndex}:-1`);
+        }
+        states = next;
+    }
+    return crossTokenBoundary(states).matched;
+}
+const SHELL_COMMAND_BOUNDARIES = new Set(["||", "&&", ";;", "|&", "&", ";", "(", ")", "|", "<("]);
+const SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh"]);
+const SHELL_TOKEN_BOUNDARIES = new Set(["{", "}", "then", "elif", "else", "do"]);
+const SHELL_GRAMMAR_PREFIXES = new Set(["!", "if", "until", "while"]);
+const SHELL_PARAMETER_MARKER = "__OURO_SHELL_PARAMETER_";
+const SHELL_ARRAY_EXPANSION = "__OURO_ARRAY_EXPANSION__";
+function hasUnescapedShellSubstitution(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        if (value[index] === "\\") {
+            index += 1;
+            continue;
+        }
+        if (value.startsWith("$(", index) && !value.startsWith("$((", index))
+            return true;
+        if (value[index] === "`")
+            return true;
+    }
+    return false;
+}
+function stripHereDocBodies(command) {
+    const pending = [];
+    const lines = command.split("\n");
+    return lines.map((sourceLine) => {
+        if (pending.length > 0) {
+            const active = pending[0];
+            const candidate = active.stripTabs ? sourceLine.replace(/^\t+/, "") : sourceLine;
+            if (candidate === active.delimiter) {
+                pending.shift();
+                return "";
+            }
+            if (active.quoted || !hasUnescapedShellSubstitution(sourceLine))
+                return "";
+            return exposeShellSubstitutions(sourceLine).split("\n").slice(1).join("\n");
+        }
+        const pattern = /<<(?!<)(-)?\s*(?:'([^']*)'|"([^"]*)"|\\([^\s;&|]+)|([^\s;&|]+))/g;
+        for (const match of stripShellComments(sourceLine).matchAll(pattern)) {
+            pending.push({
+                stripTabs: match[1] !== undefined,
+                delimiter: match[2] ?? match[3] ?? match[4] ?? match[5],
+                quoted: match[2] !== undefined || match[3] !== undefined || match[4] !== undefined,
+            });
+        }
+        return sourceLine;
+    }).join("\n");
+}
+function stripShellComments(command) {
+    let result = "";
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        if (character === "\\" && quote !== "single") {
+            result += character + (command[index + 1] ?? "");
+            index += 1;
+            continue;
+        }
+        if (character === "'" && quote !== "double")
+            quote = quote === "single" ? null : "single";
+        else if (character === '"' && quote !== "single")
+            quote = quote === "double" ? null : "double";
+        if (character === "#" && quote === null && (index === 0 || /[\s;&|()]/.test(command[index - 1]))) {
+            const newline = command.indexOf("\n", index);
+            if (newline < 0)
+                break;
+            result += " ".repeat(newline - index) + "\n";
+            index = newline;
+            continue;
+        }
+        result += character;
+    }
+    return result;
+}
+const SHELL_ARRAY_ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)(\+?=)\(([^()\n]*)\)/y;
+const SHELL_INDEXED_ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)\[(\d+)\]=("[^"]*"|'[^']*'|[^\s;&|]+)/y;
+const SHELL_SCALAR_ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|()]+)/y;
+const SHELL_ARRAY_PARAMETER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\[(@|\*)\]\}/y;
+const SHELL_SCALAR_PARAMETER = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/y;
+function shellMatchAt(pattern, command, index) {
+    pattern.lastIndex = index;
+    return pattern.exec(command);
+}
+function shellAssignmentPosition(command, index) {
+    let previous = index - 1;
+    while (previous >= 0 && /[ \t]/.test(command[previous]))
+        previous -= 1;
+    return previous < 0 || /[;&|()\n]/.test(command[previous]);
+}
+function parseShellWords(value) {
+    if (hasUnescapedShellSubstitution(value) || /(^|[^\\])\$(?!['"])/.test(value))
+        return undefined;
+    try {
+        const entries = (0, shell_quote_1.parse)(value);
+        if (entries.some((entry) => typeof entry !== "string"))
+            return undefined;
+        return entries;
+    }
+    catch {
+        return undefined;
+    }
+}
+function shellAssignmentPersists(command, endIndex) {
+    let next = endIndex;
+    while (next < command.length && /[ \t]/.test(command[next]))
+        next += 1;
+    return next === command.length || /[;&|\n]/.test(command[next]);
+}
+function shellUnquotedFields(values) {
+    const fields = values.flatMap((value) => value.split(/\s+/).filter(Boolean));
+    return fields.some((field) => /[*?[]/.test(field)) ? SHELL_ARRAY_EXPANSION : (0, shell_quote_1.quote)(fields);
+}
+function doubleQuotedFragment(value) {
+    if (hasUnescapedShellSubstitution(value))
+        return undefined;
+    try {
+        const parsed = (0, shell_quote_1.parse)(`"${value}"`);
+        return parsed.length === 1 && typeof parsed[0] === "string" ? parsed[0] : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function closingDoubleQuote(command, startIndex) {
+    for (let index = startIndex; index < command.length; index += 1) {
+        if (command[index] === "\\")
+            index += 1;
+        else if (command[index] === '"')
+            return index;
+    }
+    return -1;
+}
+function transformOrderedShellVariables(command) {
+    const variables = new Map();
+    const result = [];
+    let quote = null;
+    let doubleQuoteStart = -1;
+    let doubleQuoteResultIndex = -1;
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        if (character === "\\" && quote !== "single") {
+            result.push(character + (command[index + 1] ?? ""));
+            index += 1;
+            continue;
+        }
+        if (character === "'") {
+            if (quote !== "double")
+                quote = quote === "single" ? null : "single";
+            result.push(character);
+            continue;
+        }
+        if (character === '"') {
+            if (quote !== "single") {
+                if (quote === "double") {
+                    quote = null;
+                    doubleQuoteStart = -1;
+                    doubleQuoteResultIndex = -1;
+                }
+                else {
+                    quote = "double";
+                    doubleQuoteStart = index;
+                    doubleQuoteResultIndex = result.length;
+                }
+            }
+            result.push(character);
+            continue;
+        }
+        if (quote === null && /[A-Za-z_]/.test(character) && shellAssignmentPosition(command, index)) {
+            const arrayAssignment = shellMatchAt(SHELL_ARRAY_ASSIGNMENT, command, index);
+            if (arrayAssignment) {
+                const [, name, operator, body] = arrayAssignment;
+                const elements = parseShellWords(body);
+                if (elements === undefined)
+                    variables.delete(name);
+                else
+                    variables.set(name, { array: operator === "+=" ? [...(variables.get(name)?.array ?? []), ...elements] : elements });
+                result.push(`${name}=__OURO_ARRAY_LITERAL`);
+                index += arrayAssignment[0].length - 1;
+                continue;
+            }
+            const indexedAssignment = shellMatchAt(SHELL_INDEXED_ASSIGNMENT, command, index);
+            if (indexedAssignment) {
+                const [, name, elementIndex, rawValue] = indexedAssignment;
+                const element = parseShellWords(rawValue);
+                if (element?.length !== 1)
+                    variables.delete(name);
+                else {
+                    const array = [...(variables.get(name)?.array ?? [])];
+                    array[Number(elementIndex)] = element[0];
+                    variables.set(name, { array });
+                }
+                result.push(`${name}=__OURO_ARRAY_LITERAL`);
+                index += indexedAssignment[0].length - 1;
+                continue;
+            }
+            const scalarAssignment = shellMatchAt(SHELL_SCALAR_ASSIGNMENT, command, index);
+            if (scalarAssignment) {
+                const [, name, rawValue] = scalarAssignment;
+                const scalar = parseShellWords(rawValue);
+                if (shellAssignmentPersists(command, index + scalarAssignment[0].length)) {
+                    if (scalar?.length === 1)
+                        variables.set(name, { scalar: scalar[0] });
+                    else
+                        variables.delete(name);
+                }
+                result.push(scalarAssignment[0]);
+                index += scalarAssignment[0].length - 1;
+                continue;
+            }
+        }
+        if (quote !== "single" && character === "$") {
+            const arrayExpansion = shellMatchAt(SHELL_ARRAY_PARAMETER, command, index);
+            if (arrayExpansion) {
+                const [, name, mode] = arrayExpansion;
+                const elements = variables.get(name)?.array;
+                if (elements === undefined)
+                    result.push(SHELL_ARRAY_EXPANSION);
+                else if (quote === "double" && mode === "@") {
+                    const closing = closingDoubleQuote(command, index + arrayExpansion[0].length);
+                    const prefix = doubleQuotedFragment(command.slice(doubleQuoteStart + 1, index));
+                    const suffix = closing < 0 ? undefined : doubleQuotedFragment(command.slice(index + arrayExpansion[0].length, closing));
+                    if (closing < 0 || prefix === undefined || suffix === undefined)
+                        result.push(SHELL_ARRAY_EXPANSION);
+                    else {
+                        const presentElements = elements.filter((element) => element !== undefined);
+                        const expanded = presentElements.length === 0
+                            ? (prefix.length + suffix.length === 0 ? [] : [`${prefix}${suffix}`])
+                            : presentElements.map((element, elementIndex) => `${elementIndex === 0 ? prefix : ""}${element}${elementIndex === presentElements.length - 1 ? suffix : ""}`);
+                        result.splice(doubleQuoteResultIndex);
+                        result.push((0, shell_quote_1.quote)(expanded));
+                        quote = null;
+                        doubleQuoteStart = -1;
+                        doubleQuoteResultIndex = -1;
+                        index = closing;
+                        continue;
+                    }
+                }
+                else if (quote === "double")
+                    result.push(elements.join(" "));
+                else
+                    result.push(shellUnquotedFields(elements));
+                index += arrayExpansion[0].length - 1;
+                continue;
+            }
+            const scalarExpansion = shellMatchAt(SHELL_SCALAR_PARAMETER, command, index);
+            if (scalarExpansion) {
+                const name = scalarExpansion[1] ?? scalarExpansion[2];
+                const scalar = variables.get(name)?.scalar;
+                if (scalar !== undefined) {
+                    if (quote === "double")
+                        result.push(scalar.replace(/["\\$`]/g, "\\$&"));
+                    else
+                        result.push(shellUnquotedFields([scalar]));
+                    index += scalarExpansion[0].length - 1;
+                    continue;
+                }
+                if (quote === null) {
+                    result.push(SHELL_ARRAY_EXPANSION);
+                    index += scalarExpansion[0].length - 1;
+                    continue;
+                }
+            }
+        }
+        result.push(character);
+    }
+    return result.join("");
+}
+function findCommandSubstitutionEnd(command, start) {
+    let depth = 1;
+    let quote = null;
+    for (let index = start; index < command.length; index += 1) {
+        const character = command[index];
+        if (character === "\\" && quote !== "single") {
+            index += 1;
+            continue;
+        }
+        if (character === "'" && quote !== "double") {
+            quote = quote === "single" ? null : "single";
+            continue;
+        }
+        if (character === '"' && quote !== "single") {
+            quote = quote === "double" ? null : "double";
+            continue;
+        }
+        if (quote !== null)
+            continue;
+        if (character === "(")
+            depth += 1;
+        else if (character === ")") {
+            depth -= 1;
+            if (depth === 0)
+                return index;
+        }
+    }
+    return -1;
+}
+function exposeShellSubstitutions(command, depth = 0) {
+    if (depth >= 32)
+        return "ouro mail sync-cache";
+    let outer = "";
+    const nested = [];
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        if (character === "\\" && quote !== "single") {
+            outer += character + (command[index + 1] ?? "");
+            index += 1;
+            continue;
+        }
+        if (character === "'" && quote !== "double") {
+            quote = quote === "single" ? null : "single";
+            outer += character;
+            continue;
+        }
+        if (character === '"' && quote !== "single") {
+            quote = quote === "double" ? null : "double";
+            outer += character;
+            continue;
+        }
+        if (quote !== "single" && command.startsWith("$(", index) && !command.startsWith("$((", index)) {
+            const end = findCommandSubstitutionEnd(command, index + 2);
+            if (end >= 0) {
+                nested.push(exposeShellSubstitutions(command.slice(index + 2, end), depth + 1));
+                outer += "${__OURO_COMMAND_SUBSTITUTION}";
+                index = end;
+                continue;
+            }
+        }
+        if (quote !== "single" && character === "`") {
+            let end = index + 1;
+            while (end < command.length && command[end] !== "`") {
+                if (command[end] === "\\")
+                    end += 1;
+                end += 1;
+            }
+            if (end < command.length) {
+                nested.push(exposeShellSubstitutions(command.slice(index + 1, end), depth + 1));
+                outer += "${__OURO_COMMAND_SUBSTITUTION}";
+                index = end;
+                continue;
+            }
+        }
+        outer += character;
+    }
+    return [outer, ...nested].join("\n");
+}
+function normalizeShellNewlines(command) {
+    let result = "";
+    let quote = null;
+    for (let index = 0; index < command.length; index += 1) {
+        const character = command[index];
+        if (character === "\\" && quote !== "single") {
+            result += character + (command[index + 1] ?? "");
+            index += 1;
+            continue;
+        }
+        if (character === "'" && quote !== "double")
+            quote = quote === "single" ? null : "single";
+        else if (character === '"' && quote !== "single")
+            quote = quote === "double" ? null : "double";
+        result += character === "\n" && quote === null ? " ; " : character;
+    }
+    return result;
+}
+function executableShellView(command) {
+    const withoutData = stripShellComments(stripHereDocBodies(command));
+    return normalizeShellNewlines(transformOrderedShellVariables(exposeShellSubstitutions(withoutData)));
+}
+function parseShellCommands(command) {
+    let parameterIndex = 0;
+    const parameterNames = new Map();
+    const entries = (0, shell_quote_1.parse)(command, (name) => {
+        const marker = `${SHELL_PARAMETER_MARKER}${parameterIndex}__`;
+        parameterIndex += 1;
+        parameterNames.set(marker, name);
+        return marker;
+    });
+    const commands = [];
+    let current = [];
+    let skipRedirectionTarget = false;
+    const flush = () => {
+        if (current.length > 0)
+            commands.push(current);
+        current = [];
+        skipRedirectionTarget = false;
+    };
+    for (const entry of entries) {
+        if (typeof entry === "string") {
+            if (skipRedirectionTarget)
+                skipRedirectionTarget = false;
+            else if (SHELL_TOKEN_BOUNDARIES.has(entry.toLowerCase()))
+                flush();
+            else
+                current.push(entry);
+            continue;
+        }
+        const operation = entry;
+        if (operation.op === "glob") {
+            current.push(operation.pattern);
+            continue;
+        }
+        if (SHELL_COMMAND_BOUNDARIES.has(operation.op)) {
+            flush();
+            continue;
+        }
+        // Every remaining control operator is a redirection. Its next string is
+        // a path or descriptor, not an argv token.
+        skipRedirectionTarget = true;
+    }
+    flush();
+    return { commands, parameterNames };
+}
+function resolveKnownShellParameters(token, knownVariables, parameterNames) {
+    let resolved = token;
+    for (const [marker, name] of parameterNames) {
+        const known = knownVariables.get(name);
+        if (known !== undefined)
+            resolved = resolved.replaceAll(marker, known);
+    }
+    return resolved;
+}
+function shellTokenCanEqual(token, expected) {
+    const escaped = token
+        .split(new RegExp(`(?:${SHELL_PARAMETER_MARKER}\\d+__|${SHELL_ARRAY_EXPANSION})`, "g"))
+        .map((literal) => literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${escaped}$`, "i").test(expected);
+}
+function shellExecutableCanEqual(token, expected) {
+    const basenameToken = token.slice(token.lastIndexOf("/") + 1);
+    return shellTokenCanEqual(basenameToken, expected);
+}
+function exactShellExecutable(token) {
+    if (token === undefined || token.includes(SHELL_PARAMETER_MARKER))
+        return undefined;
+    return token.slice(token.lastIndexOf("/") + 1).toLowerCase();
+}
+const SUDO_SHORT_OPERANDS = new Set(["-C", "-D", "-g", "-h", "-p", "-R", "-r", "-T", "-t", "-U", "-u"]);
+const SUDO_LONG_OPERANDS = new Set(["--chdir", "--chroot", "--close-from", "--command-timeout", "--group", "--host", "--other-user", "--prompt", "--role", "--type", "--user"]);
+const TIME_SHORT_OPERANDS = new Set(["-f", "-o"]);
+const TIME_LONG_OPERANDS = new Set(["--format", "--output"]);
+function wrapperOptionAdvance(option, shortOperands, longOperands) {
+    if (shortOperands.has(option) || longOperands.has(option))
+        return 2;
+    if ([...shortOperands].some((candidate) => option.startsWith(candidate) && option.length > candidate.length))
+        return 1;
+    if ([...longOperands].some((candidate) => option.startsWith(`${candidate}=`)))
+        return 1;
+    return 0;
+}
+function resolveShellCommand(tokens, startIndex) {
+    let index = startIndex;
+    while (index < tokens.length) {
+        const executable = exactShellExecutable(tokens[index]);
+        if (SHELL_GRAMMAR_PREFIXES.has(executable ?? "")) {
+            index += 1;
+            continue;
+        }
+        if (executable === "coproc") {
+            index += 1;
+            const candidate = tokens[index] ?? "";
+            if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(candidate) && !shellExecutableCanEqual(candidate, "ouro") && tokens[index + 1] !== undefined)
+                index += 1;
+            continue;
+        }
+        if (executable === "command" || executable === "nohup") {
+            index += 1;
+            if (executable === "command" && (tokens[index] === "-v" || tokens[index] === "-V"))
+                return { index: tokens.length };
+            while (tokens[index]?.startsWith("-"))
+                index += 1;
+            continue;
+        }
+        if (executable === "env") {
+            index += 1;
+            while (index < tokens.length) {
+                const option = tokens[index];
+                if (option === "-S" || option === "--split-string")
+                    return { index, script: `env ${tokens.slice(index + 1).join(" ")}` };
+                if (option.startsWith("--split-string="))
+                    return { index, script: `env ${[option.slice("--split-string=".length), ...tokens.slice(index + 1)].join(" ")}` };
+                if (["-u", "-C", "--unset", "--chdir"].includes(option))
+                    index += 2;
+                else if (option.startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(option))
+                    index += 1;
+                else
+                    break;
+            }
+            continue;
+        }
+        if (executable === "sudo") {
+            index += 1;
+            while (tokens[index]?.startsWith("-")) {
+                const advance = wrapperOptionAdvance(tokens[index], SUDO_SHORT_OPERANDS, SUDO_LONG_OPERANDS);
+                index += advance === 0 ? 1 : advance;
+            }
+            continue;
+        }
+        if (executable === "time") {
+            index += 1;
+            while (tokens[index]?.startsWith("-")) {
+                const advance = wrapperOptionAdvance(tokens[index], TIME_SHORT_OPERANDS, TIME_LONG_OPERANDS);
+                index += advance === 0 ? 1 : advance;
+            }
+            continue;
+        }
+        if (executable === "exec") {
+            index += 1;
+            while (tokens[index]?.startsWith("-"))
+                index += tokens[index] === "-a" ? 2 : 1;
+            continue;
+        }
+        break;
+    }
+    return { index };
+}
+function shellScriptRequiresFamily(script, variables, depth) {
+    if (script.includes(SHELL_PARAMETER_MARKER) || script.includes(SHELL_ARRAY_EXPANSION))
+        return true;
+    return shellCommandsContainMailCacheSync(script, variables, depth + 1);
+}
+function shellTokensContainMailCacheSync(tokens, startIndex, variables, depth) {
+    const resolved = resolveShellCommand(tokens, startIndex);
+    if (resolved.script !== undefined)
+        return shellScriptRequiresFamily(resolved.script, variables, depth);
+    const executableToken = tokens[resolved.index] ?? "";
+    const executable = exactShellExecutable(executableToken);
+    if (executableToken.includes(SHELL_ARRAY_EXPANSION))
+        return true;
+    if (SHELL_INTERPRETERS.has(executable ?? "")) {
+        const commandOption = tokens.findIndex((token, index) => index > resolved.index && /^-[^-]*c/.test(token));
+        return commandOption >= 0
+            && shellScriptRequiresFamily(tokens[commandOption + 1] ?? "", variables, depth);
+    }
+    if (executable === "eval")
+        return shellScriptRequiresFamily(tokens.slice(resolved.index + 1).join(" "), variables, depth);
+    return shellExecutableCanEqual(executableToken, "ouro")
+        && shellTokenCanEqual(tokens[resolved.index + 1] ?? "", "mail")
+        && shellTokenCanEqual(tokens[resolved.index + 2] ?? "", "sync-cache");
+}
+function shellCommandsContainMailCacheSync(command, inheritedVariables = new Map(), depth = 0) {
+    if (depth >= 32)
+        return true;
+    let parsed;
+    try {
+        parsed = parseShellCommands(command);
+    }
+    catch {
+        return false;
+    }
+    const knownVariables = new Map(inheritedVariables);
+    for (const rawTokens of parsed.commands) {
+        const tokens = rawTokens.map((token) => resolveKnownShellParameters(token, knownVariables, parsed.parameterNames));
+        const invocationVariables = new Map(knownVariables);
+        let commandIndex = 0;
+        while (commandIndex < tokens.length) {
+            const assignment = tokens[commandIndex].match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s);
+            if (!assignment)
+                break;
+            if (assignment[2].includes(SHELL_PARAMETER_MARKER))
+                invocationVariables.delete(assignment[1]);
+            else
+                invocationVariables.set(assignment[1], assignment[2]);
+            commandIndex += 1;
+        }
+        if (commandIndex === tokens.length) {
+            knownVariables.clear();
+            for (const [name, value] of invocationVariables)
+                knownVariables.set(name, value);
+            continue;
+        }
+        if (shellTokensContainMailCacheSync(tokens, commandIndex, invocationVariables, depth))
+            return true;
+    }
+    return false;
+}
+function shellContainsMailCacheSync(command) {
+    const executableCommand = executableShellView(command);
+    if (shellContainsAmbiguousAnsiMailCacheSync(executableCommand))
+        return true;
+    return shellCommandsContainMailCacheSync(executableCommand);
+}
+function mailCacheSyncShellGuardrail(toolName, args, context) {
+    if (toolName !== "shell" || !shellContainsMailCacheSync(args.command ?? ""))
+        return allow;
+    if (context.trustLevel === undefined || context.trustLevel === "family")
+        return allow;
+    return deny("hosted mail cache convergence requires family trust.");
+}
+function mailTrustGuardrail(toolName, args, context) {
+    if (MAIL_FAMILY_TOOLS.has(toolName)) {
+        if (context.trustLevel === undefined || context.trustLevel === "family")
+            return allow;
+        if (toolName === "mail_send")
+            return deny("outbound mail sends require family trust.");
+        return deny(toolName === "mail_decide"
+            ? "mail screener decisions require family trust."
+            : "delegated human mail requires family trust.");
+    }
+    if (MAIL_DELEGATED_READ_TOOLS.has(toolName)) {
+        const scope = (args.scope ?? "").trim().toLowerCase();
+        if (scope === "delegated" || scope === "all") {
+            if (context.trustLevel === undefined || context.trustLevel === "family")
+                return allow;
+            return deny("delegated human mail requires family trust.");
+        }
+    }
+    return allow;
+}
+function checkCredentialTrustGuardrails(toolName, context) {
+    if (CREDENTIAL_FAMILY_TOOLS.has(toolName) || COMMERCE_FAMILY_TOOLS.has(toolName)) {
+        if (context.trustLevel === "family")
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    if (CREDENTIAL_TRUSTED_TOOLS.has(toolName) || TRAVEL_TRUSTED_TOOLS.has(toolName) || A2A_TRUSTED_TOOLS.has(toolName)) {
+        if ((0, friends_1.isTrustedLevel)(context.trustLevel))
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    return allow;
+}
+function checkCommerceAuthorityGuardrails(toolName, args, context) {
+    if (!COMMERCE_AUTHORITY_TOOLS.has(toolName))
+        return allow;
+    if (!context.agentRoot)
+        return deny("commerce authority unavailable: agent root could not be resolved.");
+    const result = (0, store_1.validateCommerceAuthority)({
+        agentRoot: context.agentRoot,
+        token: args.commerce_authority,
+        toolName,
+        args,
+        friendId: context.friendId,
+    });
+    if (result.ok)
+        return allow;
+    return deny(`commerce authority required: ${result.reason}`);
+}
+function checkFirstClassMcpTrust(context) {
+    if (!context.mcpServerName)
+        return allow;
+    const rules = MCP_SERVER_TRUST[context.mcpServerName] ?? { minTrust: "friend", blockGroupChat: false };
+    if (!trustLevelSatisfied(rules.minTrust, context.trustLevel ?? "friend")) {
+        return deny(REASONS.needsTrust);
+    }
+    if (rules.blockGroupChat && context.isGroupChat) {
+        return deny("browser tools are only available in 1:1 conversations, not group chats.");
+    }
+    return allow;
+}
 function checkTrustLevelGuardrails(toolName, args, context) {
-    // Trusted levels (family/friend) — no trust guardrails. Undefined defaults to friend.
-    if ((0, types_1.isTrustedLevel)(context.trustLevel))
+    if (toolName === "teams_send_image" && context.trustLevel !== "family") {
+        return deny("sending local images in Teams requires family trust.");
+    }
+    const cacheSyncResult = mailCacheSyncShellGuardrail(toolName, args, context);
+    if (!cacheSyncResult.allowed)
+        return cacheSyncResult;
+    const mailResult = mailTrustGuardrail(toolName, args, context);
+    if (!mailResult.allowed)
+        return mailResult;
+    if (SHEPHERD_FAMILY_TOOLS.has(toolName) && context.trustLevel !== "family") {
+        return deny("the owner's terminals require family trust.");
+    }
+    // Credential tools have their own trust rules that apply at all levels
+    const credentialResult = checkCredentialTrustGuardrails(toolName, context);
+    if (!credentialResult.allowed)
+        return credentialResult;
+    const commerceAuthorityResult = checkCommerceAuthorityGuardrails(toolName, args, context);
+    if (!commerceAuthorityResult.allowed)
+        return commerceAuthorityResult;
+    // First-class MCP tool trust (e.g. browser_navigate) — applies at all trust levels
+    const firstClassMcpResult = checkFirstClassMcpTrust(context);
+    if (!firstClassMcpResult.allowed)
+        return firstClassMcpResult;
+    // MCP server-specific trust via shell (e.g. ouro mcp call browser) — applies at all trust levels
+    if (toolName === "shell") {
+        const mcpResult = checkMcpServerTrust(args.command || "", context);
+        if (!mcpResult.allowed)
+            return mcpResult;
+    }
+    // Trusted levels (family/friend) — no further trust guardrails. Undefined defaults to friend.
+    if ((0, friends_1.isTrustedLevel)(context.trustLevel))
         return allow;
     if (toolName === "shell") {
         return checkShellTrustGuardrails(args.command || "", context.trustLevel);
     }
     return checkWriteTrustGuardrails(toolName, args, context);
 }
+// --- git aimed at this agent's own bundle ---
+// Sync owns the bundle's repository: it commits, merges and pushes under its own lock. A git command from the shell that
+// works in the bundle, or points git at it, is refused. Every directory the command could be working in counts: where the
+// shell starts, each cd, pushd, env -C and git -C, and the --git-dir, --work-tree, GIT_DIR and GIT_WORK_TREE it names.
+// A git call whose directory the guard cannot work out (a variable, a glob, cd -) is refused too.
+exports.BUNDLE_GIT_REFUSAL = "my bundle syncs itself; I don't run git in it.";
+const GIT_PATH_VARIABLES = new Set(["GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR"]);
+const GIT_GUARD_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+/** The commands a runner (xargs, find -exec, timeout) can start that the scan follows into. */
+const RUNNER_GIT_TARGETS = new Set(["git", "env", "eval", ...GIT_GUARD_SHELLS]);
+const DECLARATION_BUILTINS = new Set(["export", "declare", "typeset", "local", "readonly"]);
+// Commands that run another command given as their arguments; the guard looks for git (or a shell) among those arguments.
+const COMMAND_RUNNERS = new Set(["xargs", "find", "timeout", "nice", "ionice", "stdbuf", "setsid", "flock", "watch", "parallel", "doas", "chronic", "unbuffer", "chroot"]);
+/** git global options that take their value as the next word. */
+const GIT_VALUE_OPTIONS = new Set(["--namespace", "--exec-path", "--super-prefix", "--attr-source"]);
+function unknownShellWord(word) {
+    return word.includes(SHELL_PARAMETER_MARKER) || word.includes(SHELL_ARRAY_EXPANSION) || /[*?[\]{}]/.test(word);
+}
+function shellPathWord(word) {
+    return word === undefined || unknownShellWord(word) ? null : expandHome(word);
+}
+function noteGitAssignment(token, scan, known) {
+    const assignment = token.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s);
+    if (!assignment)
+        return false;
+    const [, name, value] = assignment;
+    if (GIT_PATH_VARIABLES.has(name))
+        scan.gitPaths.push(value);
+    if (/^GIT_CONFIG(?:_|$)/.test(name))
+        scan.configEnv = true;
+    if (name === "CDPATH")
+        scan.cdpath = true;
+    if (unknownShellWord(value))
+        known.delete(name);
+    else
+        known.set(name, value);
+    return true;
+}
+function scanShellForGit(command, scan, depth) {
+    if (depth >= 32) {
+        scan.opaqueShell = true;
+        return;
+    }
+    const parsed = parseShellCommands(executableShellView(command));
+    const known = new Map();
+    for (const name of STABLE_VARIABLES)
+        if (process.env[name])
+            known.set(name, process.env[name]);
+    for (const raw of parsed.commands) {
+        const tokens = raw.map((token) => resolveKnownShellParameters(token, known, parsed.parameterNames));
+        let index = 0;
+        while (index < tokens.length && noteGitAssignment(tokens[index], scan, known))
+            index += 1;
+        if (DECLARATION_BUILTINS.has(tokens[index] ?? "")) {
+            for (const token of tokens.slice(index + 1))
+                noteGitAssignment(token, scan, known);
+            continue;
+        }
+        if (index < tokens.length)
+            scanCommandForGit(tokens, index, scan, known, depth);
+    }
+}
+function scanCommandForGit(tokens, start, scan, known, depth) {
+    let index = start;
+    for (let hops = 0; hops <= tokens.length; hops += 1) {
+        const resolved = resolveShellCommand(tokens, index);
+        // A wrapper's own options: env -C and sudo --chdir change the directory, env NAME=value sets git's variables.
+        for (let k = index; k < resolved.index; k += 1) {
+            const word = tokens[k];
+            if (word === "-C" || word === "--chdir")
+                scan.cwdTargets.push(shellPathWord(tokens[k + 1]));
+            else if (word.startsWith("--chdir="))
+                scan.cwdTargets.push(shellPathWord(word.slice("--chdir=".length)));
+            else if (/^-C./.test(word))
+                scan.cwdTargets.push(shellPathWord(word.slice(2)));
+            else
+                noteGitAssignment(word, scan, known);
+        }
+        if (resolved.script !== undefined)
+            return scanShellForGit(resolved.script, scan, depth + 1);
+        index = resolved.index;
+        if (index >= tokens.length)
+            return;
+        // A command word the guard cannot read ($RUN git status) could be anything, git or a wrapper around it.
+        if (unknownShellWord(tokens[index])) {
+            if (tokens.slice(index).some((word) => /(?:^|\/)git$/.test(word)))
+                scan.opaqueShell = true;
+            return;
+        }
+        const executable = exactShellExecutable(tokens[index]);
+        if (executable === "git") {
+            scan.calls.push(tokens.slice(index + 1));
+            return;
+        }
+        if (executable === "cd" || executable === "pushd") {
+            const target = tokens.slice(index + 1).find((word) => !/^-[LPe@]+$/.test(word));
+            const viaCdpath = target !== undefined && scan.cdpath && !path.isAbsolute(expandHome(target));
+            scan.cwdTargets.push(target === undefined ? (executable === "cd" ? os.homedir() : null) : target === "-" || viaCdpath ? null : shellPathWord(target));
+            return;
+        }
+        if (GIT_GUARD_SHELLS.has(executable)) {
+            const option = tokens.findIndex((word, k) => k > index && /^-[^-]*c/.test(word));
+            if (option >= 0)
+                return scanShellForGit(tokens[option + 1] ?? "", scan, depth + 1);
+            if (tokens.slice(index + 1).every((word) => word.startsWith("-")))
+                scan.opaqueShell = true;
+            return;
+        }
+        if (executable === "eval")
+            return scanShellForGit(tokens.slice(index + 1).join(" "), scan, depth + 1);
+        if (!COMMAND_RUNNERS.has(executable))
+            return;
+        // find -execdir runs its command in each directory it finds.
+        if (executable === "find" && tokens.some((word, k) => k > index && (word === "-execdir" || word === "-okdir")))
+            scan.cwdTargets.push(null);
+        // xargs -I/-i/--replace puts its input into the command's words.
+        if (executable === "xargs" && tokens.some((word, k) => k > index && /^(?:-I|-i|--replace)/.test(word)))
+            scan.cwdTargets.push(null);
+        const next = tokens.findIndex((word, k) => k > index && RUNNER_GIT_TARGETS.has(exactShellExecutable(word)));
+        if (next < 0)
+            return;
+        index = next;
+    }
+}
+/** Where one git call works and what it names: its directories after -C, then --git-dir, --work-tree, and init or clone targets. Null when a word is unknown. */
+function gitCallPaths(args, cwds) {
+    let dirs = [...cwds];
+    const named = [];
+    let index = 0;
+    const value = (word) => shellPathWord(word);
+    while (index < args.length) {
+        const word = args[index];
+        if (word === "-C") {
+            const dir = value(args[index + 1]);
+            if (dir === null)
+                return null;
+            dirs = dirs.map((cwd) => path.isAbsolute(dir) ? dir : cwd === null ? null : path.resolve(cwd, dir));
+            index += 2;
+            continue;
+        }
+        if (word === "--git-dir" || word === "--work-tree") {
+            const dir = value(args[index + 1]);
+            if (dir === null)
+                return null;
+            named.push(dir);
+            index += 2;
+            continue;
+        }
+        if (word.startsWith("--git-dir=") || word.startsWith("--work-tree=")) {
+            const dir = value(word.slice(word.indexOf("=") + 1));
+            if (dir === null)
+                return null;
+            named.push(dir);
+            index += 1;
+            continue;
+        }
+        if (word === "-c") {
+            const setting = args[index + 1] ?? "";
+            // An alias can run any command, git in any directory included.
+            if (/^alias\./i.test(setting))
+                return null;
+            const worktree = setting.match(/^core\.worktree=(.*)$/is);
+            if (worktree) {
+                const dir = value(worktree[1]);
+                if (dir === null)
+                    return null;
+                named.push(dir);
+            }
+            index += 2;
+            continue;
+        }
+        if (word === "--config-env" || word.startsWith("--config-env="))
+            return null;
+        if (GIT_VALUE_OPTIONS.has(word)) {
+            index += 2;
+            continue;
+        }
+        if (word.startsWith("-")) {
+            index += 1;
+            continue;
+        }
+        // The subcommand. init and clone also name a directory to create or fill.
+        const positional = args.slice(index + 1).filter((arg) => !arg.startsWith("-"));
+        const separate = args.slice(index + 1).flatMap((arg, k, rest) => arg === "--separate-git-dir" ? [rest[k + 1]] : arg.startsWith("--separate-git-dir=") ? [arg.slice("--separate-git-dir=".length)] : []);
+        const targets = word === "init" ? [...positional.slice(-1), ...separate] : word === "clone" && positional.length >= 2 ? [...positional.slice(-1), ...separate] : [];
+        for (const target of targets) {
+            const dir = value(target);
+            if (dir === null)
+                return null;
+            named.push(dir);
+        }
+        break;
+    }
+    if (dirs.some((dir) => dir === null))
+        return null;
+    const known = dirs;
+    return [...known, ...named.flatMap((dir) => path.isAbsolute(dir) ? [dir] : known.map((cwd) => path.resolve(cwd, dir)))];
+}
+/** Whether a shell command could run git in the agent's bundle. Exported for tests. */
+function bundleGitRefused(command, agentRoot) {
+    // Quotes and backslashes can split the word (g''it, "g"it, g\it); the shell joins it back.
+    const plain = command.replace(/['"\\]/g, "");
+    if (!agentRoot || !plain.includes("git"))
+        return false;
+    try {
+        const scan = { cwdTargets: [], gitPaths: [], calls: [], opaqueShell: false, configEnv: false, cdpath: !!process.env.CDPATH };
+        scanShellForGit(command, scan, 0);
+        if (scan.opaqueShell && /(?:^|[^A-Za-z0-9_-])git(?:$|[^A-Za-z0-9_-])/.test(plain))
+            return true;
+        if (scan.calls.length === 0)
+            return false;
+        // Every directory the command could be working in: where the shell starts, and each change, from each earlier one.
+        const cwds = [process.cwd()];
+        for (const target of scan.cwdTargets) {
+            if (target === null)
+                cwds.push(null);
+            else
+                cwds.push(...(path.isAbsolute(target) ? [target] : cwds.map((cwd) => cwd === null ? null : path.resolve(cwd, target))));
+        }
+        const roots = [path.resolve(agentRoot), canonicalize(path.resolve(agentRoot))];
+        // git config from the environment can hide a git aimed at the bundle in an alias: refuse it when the command names the bundle.
+        if (scan.configEnv && [...roots, path.basename(agentRoot)].some((root) => plain.includes(root)))
+            return true;
+        const inBundle = (target) => [target, canonicalize(target)].some((form) => roots.some((root) => form === root || form.startsWith(`${root}${path.sep}`)));
+        for (const call of scan.calls) {
+            const paths = gitCallPaths(call, cwds);
+            if (paths === null)
+                return true;
+            const variables = scan.gitPaths.map((value) => shellPathWord(value));
+            if (variables.some((value) => value === null))
+                return true;
+            const bases = paths.slice(0, cwds.length);
+            const named = variables.flatMap((value) => path.isAbsolute(value) ? [value] : bases.map((base) => path.resolve(base, value)));
+            if ([...paths, ...named].some(inBundle))
+                return true;
+        }
+        return false;
+    }
+    catch {
+        // The command could not be parsed, or the filesystem could not say where a path lands: refuse rather than guess.
+        return true;
+    }
+}
+// --- the sync key's directory, closed to the read-only file tools ---
+/** The directories read_file, glob and grep would read for these arguments, as the tools resolve them. */
+function readToolTargets(toolName, args) {
+    const local = (p) => path.isAbsolute(p) ? p : path.resolve((0, identity_1.getRepoRoot)(), p);
+    if (toolName === "read_file")
+        return [{ target: local(args.path ?? ""), recursive: false }];
+    if (toolName === "grep")
+        return [{ target: local(args.path ?? ""), recursive: true }];
+    const cwd = args.cwd ? local(args.cwd) : process.cwd();
+    // The part of the pattern before its first glob segment is a directory the glob reads.
+    const segments = (args.pattern ?? "").split("/");
+    const firstGlob = segments.findIndex((segment) => /[*?[\]{}()!]/.test(segment));
+    const literal = (firstGlob < 0 ? segments : segments.slice(0, firstGlob)).join("/");
+    return [{ target: cwd, recursive: false }, { target: path.resolve(cwd, literal || "."), recursive: false }];
+}
+function syncSecretReadRefused(toolName, args) {
+    try {
+        const lexical = path.resolve((0, sync_1.syncSecretDir)());
+        const secrets = [lexical, canonicalize(lexical)];
+        return readToolTargets(toolName, args).some(({ target, recursive }) => [target, canonicalize(target)].some((form) => secrets.some((secret) => form === secret || form.startsWith(`${secret}${path.sep}`) || (recursive && (form === path.parse(form).root || secret.startsWith(`${form}${path.sep}`))))));
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * A shell command that names the key's directory. The agent's uid cannot read
+ * the key; this only turns an accidental attempt into a plain refusal.
+ */
+function syncSecretShellRefused(command) {
+    return command.includes(path.resolve((0, sync_1.syncSecretDir)()));
+}
 // --- main entry point ---
 function guardInvocation(toolName, args, context) {
     (0, runtime_1.emitNervesEvent)({
@@ -278,9 +1736,9 @@ function guardInvocation(toolName, args, context) {
         message: "guardrail check",
         meta: { toolName },
     });
-    // Read-only tools are always allowed (no structural or trust guardrails)
+    // Read-only tools skip the structural and trust guardrails; only the sync key's directory is closed to them.
     if (READ_ONLY_TOOLS.has(toolName))
-        return allow;
+        return syncSecretReadRefused(toolName, args) ? deny(REASONS.unreadablePath) : allow;
     // Layer 1: structural guardrails (always on)
     const structuralResult = checkStructuralGuardrails(toolName, args, context);
     if (!structuralResult.allowed)