@pify/yolo 0.1.0 → 0.3.0

package/README.md

@@ -18,6 +18,25 @@ Part of the [Pify suite](https://github.com/pifydev). Install with [`pify instal
 
 Fail-closed everywhere: rule-evaluation errors block; ASK without a UI (headless/CI) denies.
 
+## Secret files (v0.2)
+
+Credentials are the one thing yolo mode does **not** wave through — auto-approving speed is worth it, auto-approving your AWS keys into a prompt is not. Any `read`/`edit`/`write` on secret material, and any bash command that names it, asks first in both modes:
+
+`.env` (and `.env.*`, but not `.env.example`/`.sample`/`.template`) · `~/.ssh/*` and `id_rsa`/`id_ed25519`-style keys (`.pub` halves are fine) · `.aws/credentials` · `.pi/agent/auth.json`, `.claude/.credentials.json` · `.npmrc`, `.pypirc`, `.netrc`, `.git-credentials` · `~/.config/gh/hosts.yml` · `*.pem`, `*.key`, `*.p12`, `*.pfx` · `secrets.json`/`credentials.yaml`
+
+A user rule opts a project out: `{ "pattern": "*/.env", "action": "allow" }`.
+
+## Checkpoints (v0.2)
+
+Before every risky bash command in a git repo, the trail records a `git stash create` checkpoint — a dangling commit holding the working tree exactly as it was, kept alive under `refs/pify/yolo/`. It writes nothing to your tree, index, or stash list. `/yolo trail` prints the recovery line next to the command:
+
+```
+#7 2026-09-06 11:00:12 bash  git reset --hard @a1b2c3d4
+    ↩ git stash apply 9f8e7d6c5b4a
+```
+
+That covers what `/yolo undo` can't: damage done by a command rather than by an `edit`/`write`.
+
 ## The undo trail
 
 Always on, in both modes:
@@ -26,6 +45,31 @@ Always on, in both modes:
 - Risky bash commands are logged with cwd, timestamp, and git HEAD.
 - `/yolo trail` shows history; `/yolo undo [n]` restores the newest n file changes (with a confirmation listing exactly what will be touched). Files that didn't exist before are deleted; bash effects are logged but not undoable.
 
+## AI classifier (v0.3, opt-in)
+
+`/yolo classifier on` adds a third tier behind the regexes. Regexes only know the destructive shapes someone thought to write down — `find . -name '*.ts' -exec sed -i … {} +` is not one of them. When no rule matches, a model reads the command and can raise it to a confirmation.
+
+Two rules keep it honest:
+
+- **Escalation only.** It can turn `allow` into `ask`. It can never turn an `ask` or a `block` into an `allow`, so a classifier that gets talked into approving something cannot open the gate.
+- **A broken classifier changes nothing.** Timeout (20s), unreadable answer, no model available → the deterministic verdict stands. Safety comes from the rules; this is a second pair of eyes, not the gate.
+
+Obviously-safe commands (`git status`, `ls`, `cat`, `bun test`, …) skip the call entirely, so the cost lands only on unfamiliar ones.
+
+Measured over OpenRouter on six commands (three genuinely destructive, three read-only):
+
+| Model | Correct | Unreadable → no opinion |
+|---|---|---|
+| GPT-5.6 luna | 6/6 | 0 |
+| GPT-5.5 | 6/6 | 0 |
+| Claude Opus 4.8 | 6/6 | 0 |
+| GPT-5.6 terra / sol | 5/6 | 1 |
+| Claude Opus 5 | 4/6 | 1 |
+| Gemini 3.1 Pro | 2/6 | 4 |
+| Qwen3 235B | 3/6 | 3 |
+
+Every miss fell back to *allow* — no run ever downgraded a command the rules had already flagged. Weaker models simply give you less extra protection.
+
 ## Custom rules
 
 `.pi/yolo.json` — wildcard patterns, last-match-wins, may retune ASK/ALLOW but never the BLOCK floor:
@@ -46,6 +90,7 @@ Always on, in both modes:
 /yolo status     # mode, rule count, trail size
 /yolo trail      # recent trail entries
 /yolo undo 3     # restore the newest 3 file pre-images
+/yolo classifier on   # let a model flag unfamiliar commands (v0.3)
 ```
 
 ## License

package/extensions/yolo.ts

@@ -13,12 +13,22 @@
  * headless ASK becomes deny. User rules in .pi/yolo.json (wildcard,
  * last-match-wins) can retune ASK/ALLOW but never the catastrophic floor.
  *
+ * v0.2 adds two things yolo mode deliberately does not stand down for:
+ * secret material (.env, ssh keys, cloud/registry credentials) asks before
+ * any read/edit/write or naming command, and every risky bash command gets a
+ * `git stash create` checkpoint recorded on the trail so command damage —
+ * not just file edits — has a way back.
+ *
  * Design synthesis: three-tier rules (pi-yolo-seatbelt), fail-closed +
  * reject-with-reason + wildcard rules (@zhushanwen/pi-permission),
  * /yolo session toggle (valdo766hi).
  */
 import {
+  DefaultResourceLoader,
+  SessionManager,
+  createAgentSession,
   getAgentDir,
+  type AgentSession,
   type ExtensionAPI,
   type ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
@@ -26,16 +36,29 @@ import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { evaluateCommand, parseUserRules } from "../src/rules.ts";
+import {
+  CLASSIFY_SYSTEM_PROMPT,
+  applyClassification,
+  buildClassifyPrompt,
+  needsClassification,
+  parseClassification,
+  type Classification,
+} from "../src/classify.ts";
+import { evaluateCommand, evaluatePath, parseUserRules } from "../src/rules.ts";
 import { formatTrail, readManifest, recordBash, recordPreImage, trailDir, undo } from "../src/trail.ts";
 import { isRecord, type Mode, type UserRule } from "../src/types.ts";
 
 const MODE_ENTRY = "yolo-mode";
+const CLASSIFIER_ENTRY = "yolo-classifier";
+/** In front of every bash call: a slow answer costs seconds, not minutes. */
+const CLASSIFY_TIMEOUT_MS = 20_000;
 
 type UiContext = ExtensionContext;
 
 export default function yolo(pi: ExtensionAPI) {
   let mode: Mode = "guard";
+  /** Opt-in: layer 3 costs a model call on unfamiliar commands. */
+  let classifierEnabled = false;
   let userRules: UserRule[] = [];
   let dir = "";
 
@@ -71,6 +94,113 @@ export default function yolo(pi: ExtensionAPI) {
     }
   }
 
+  /**
+   * Snapshot the working tree into a dangling commit before a risky command.
+   * `git stash create` writes nothing to the tree, the index, or the stash
+   * list — it just gives us a sha to come back to. A ref keeps it out of gc's
+   * reach; empty output means there was nothing to save.
+   */
+  function gitCheckpoint(cwd: string, now: number): string | null {
+    try {
+      const sha = execFileSync("git", ["stash", "create"], {
+        cwd,
+        encoding: "utf8",
+        timeout: 5000,
+        windowsHide: true,
+      }).trim();
+      if (!/^[0-9a-f]{7,40}$/.test(sha)) return null;
+      try {
+        execFileSync("git", ["update-ref", `refs/pify/yolo/${now}`, sha], {
+          cwd,
+          timeout: 5000,
+          windowsHide: true,
+        });
+      } catch {
+        // unreachable-but-recent commits still survive the default gc window
+      }
+      return sha;
+    } catch {
+      return null;
+    }
+  }
+
+  /** Confirmation gate for a file path (secret material). */
+  async function guardPath(
+    ctx: UiContext,
+    path: string,
+    rule: string,
+    action: "ask" | "block",
+  ): Promise<{ block: true; reason: string } | undefined> {
+    if (action === "block") {
+      return { block: true, reason: `yolo guard blocked access to ${path} (${rule}).` };
+    }
+    if (!ctx.hasUI) {
+      return {
+        block: true,
+        reason: `yolo guard: ${path} holds secret material (${rule}) and there is no UI to confirm (fail-closed deny).`,
+      };
+    }
+    const approved = await ctx.ui.confirm(
+      "Secret file",
+      `${path}\n\nRule: ${rule}. Allow this access?`,
+    );
+    if (approved) return undefined;
+    return {
+      block: true,
+      reason: `The user declined access to ${path} (${rule}). Continue without its contents; ask for the value you need instead.`,
+    };
+  }
+
+  /**
+   * Ask a model whether an unmatched command is risky. Short timeout: this
+   * sits in front of every bash call, so a slow answer must cost the session
+   * seconds, not minutes — and a timeout is simply "no opinion".
+   */
+  async function classifyCommand(ctx: UiContext, command: string): Promise<Classification> {
+    let session: AgentSession | null = null;
+    try {
+      const created = await createAgentSession({
+        sessionManager: SessionManager.inMemory(ctx.cwd),
+        model: ctx.model as never,
+        tools: [],
+        resourceLoader: new DefaultResourceLoader({
+          cwd: ctx.cwd,
+          agentDir: getAgentDir(),
+          noExtensions: true,
+          noPromptTemplates: true,
+          noThemes: true,
+          // Replace the coding-agent prompt rather than append to it: with
+          // the default prompt in place, models answer a classification
+          // request with a markdown explanation instead of the JSON line.
+          systemPrompt: CLASSIFY_SYSTEM_PROMPT.join(" "),
+        } as never),
+      });
+      session = created.session;
+      await session.prompt(buildClassifyPrompt(command, ctx.cwd), {
+        signal: AbortSignal.timeout(CLASSIFY_TIMEOUT_MS),
+      } as never);
+      const messages = session.messages as Array<{ role?: string; content?: Array<{ type?: string; text?: string }> }>;
+      const last = [...messages].reverse().find((m) => m.role === "assistant");
+      const text = (last?.content ?? [])
+        .filter((part) => part.type === "text" && typeof part.text === "string")
+        .map((part) => part.text)
+        .join("");
+      return parseClassification(text);
+    } catch (err) {
+      return {
+        risk: "safe",
+        reason: `classifier unavailable (${err instanceof Error ? err.message : String(err)})`,
+        fallback: true,
+      };
+    } finally {
+      try {
+        session?.dispose();
+      } catch {
+        // best-effort
+      }
+    }
+  }
+
   function loadUserRules(cwd: string): void {
     try {
       userRules = parseUserRules(JSON.parse(readFileSync(join(cwd, ".pi", "yolo.json"), "utf8")));
@@ -82,11 +212,18 @@ export default function yolo(pi: ExtensionAPI) {
   // ── The gate + the trail ─────────────────────────────────────────────
 
   pi.on("tool_call", async (event, ctx) => {
-    // Trail: pre-image every file mutation, in both modes.
-    if (event.toolName === "edit" || event.toolName === "write") {
+    // Secret material is checked in BOTH modes: yolo trades safety for speed,
+    // not for handing credentials to a model.
+    if (event.toolName === "read" || event.toolName === "edit" || event.toolName === "write") {
       const path = (event as { input?: { path?: unknown } }).input?.path;
-      if (typeof path === "string" && dir) {
-        recordPreImage(dir, path, Date.now());
+      if (typeof path === "string") {
+        const verdict = evaluatePath(path, userRules);
+        if (verdict.action !== "allow") {
+          const denial = await guardPath(ctx, path, verdict.rule, verdict.action);
+          if (denial) return denial;
+        }
+        // Trail: pre-image every file mutation, in both modes.
+        if (event.toolName !== "read" && dir) recordPreImage(dir, path, Date.now());
       }
       return undefined;
     }
@@ -97,14 +234,27 @@ export default function yolo(pi: ExtensionAPI) {
       return { block: true, reason: "yolo guard: bash call without a command (fail-closed)." };
     }
 
-    const verdict = evaluateCommand(command, userRules);
+    let verdict = evaluateCommand(command, userRules);
+
+    // Layer 3: a model looks at what the regexes had no opinion about. It can
+    // only escalate allow → ask, so a talked-into-it classifier cannot open
+    // the gate, and a broken one leaves the deterministic verdict standing.
+    if (classifierEnabled && verdict.action === "allow" && needsClassification(command)) {
+      const classification = await classifyCommand(ctx, command);
+      const escalated = applyClassification(verdict.action, classification);
+      if (escalated.rule) verdict = { action: "ask", rule: escalated.rule };
+    }
+
+    const touchesSecret = verdict.rule.startsWith("secret:");
 
-    // Log risky commands (and everything in yolo mode) to the trail.
-    if (dir && (mode === "yolo" ? verdict.action !== "allow" : verdict.action !== "allow")) {
-      recordBash(dir, command, ctx.cwd, gitHead(ctx.cwd), Date.now());
+    // Log risky commands, with a checkpoint of the tree as it was.
+    if (dir && verdict.action !== "allow") {
+      const now = Date.now();
+      recordBash(dir, command, ctx.cwd, gitHead(ctx.cwd), now, gitCheckpoint(ctx.cwd, now));
     }
 
-    if (mode === "yolo") return undefined; // gate stands down; trail recorded
+    // The gate stands down in yolo mode — except for secrets.
+    if (mode === "yolo" && !touchesSecret) return undefined;
 
     if (verdict.action === "allow") return undefined;
 
@@ -123,7 +273,7 @@ export default function yolo(pi: ExtensionAPI) {
       };
     }
     const approved = await ctx.ui.confirm(
-      "Destructive command",
+      touchesSecret ? "Command touches secret material" : "Destructive command",
       `${command}\n\nRule: ${verdict.rule}. Run it?`,
     );
     if (approved) return undefined;
@@ -144,22 +294,30 @@ export default function yolo(pi: ExtensionAPI) {
     dir = trailDir(getAgentDir(), ctx.cwd);
     loadUserRules(ctx.cwd);
     mode = "guard";
+    classifierEnabled = false;
     for (const entry of ctx.sessionManager.getBranch()) {
       const e = entry as { type?: string; customType?: string; data?: unknown };
       if (e.type === "custom" && e.customType === MODE_ENTRY && isRecord(e.data)) {
         if (e.data.mode === "yolo" || e.data.mode === "guard") mode = e.data.mode;
       }
+      if (e.type === "custom" && e.customType === CLASSIFIER_ENTRY && isRecord(e.data)) {
+        if (typeof e.data.enabled === "boolean") classifierEnabled = e.data.enabled;
+      }
     }
     updateFooter(ctx);
   });
 
   pi.on("session_tree", async (_event, ctx) => {
     mode = "guard";
+    classifierEnabled = false;
     for (const entry of ctx.sessionManager.getBranch()) {
       const e = entry as { type?: string; customType?: string; data?: unknown };
       if (e.type === "custom" && e.customType === MODE_ENTRY && isRecord(e.data)) {
         if (e.data.mode === "yolo" || e.data.mode === "guard") mode = e.data.mode;
       }
+      if (e.type === "custom" && e.customType === CLASSIFIER_ENTRY && isRecord(e.data)) {
+        if (typeof e.data.enabled === "boolean") classifierEnabled = e.data.enabled;
+      }
     }
     updateFooter(ctx);
   });
@@ -171,7 +329,7 @@ export default function yolo(pi: ExtensionAPI) {
   // ── Command ──────────────────────────────────────────────────────────
 
   pi.registerCommand("yolo", {
-    description: "Toggle auto-approve: /yolo [on|off|status|trail|undo [n]]",
+    description: "Toggle auto-approve: /yolo [on|off|status|trail|undo [n]|classifier on|off]",
     handler: async (args, ctx) => {
       const [route, countRaw] = (args ?? "").trim().toLowerCase().split(/\s+/);
       switch (route || "toggle") {
@@ -191,12 +349,40 @@ export default function yolo(pi: ExtensionAPI) {
             [
               `Mode: ${mode === "yolo" ? "⚡ YOLO (gate off)" : "🛡 guard"}`,
               `User rules: ${userRules.length} (.pi/yolo.json)`,
+              `AI classifier: ${classifierEnabled ? "on" : "off"} (/yolo classifier on)`,
               `Trail: ${entries.length} entries — /yolo trail to view, /yolo undo [n] to restore`,
             ].join("\n"),
             "info",
           );
           return;
         }
+        case "classifier": {
+          const value = (countRaw ?? "").toLowerCase();
+          if (value !== "on" && value !== "off") {
+            if (ctx.hasUI) {
+              ctx.ui.notify(
+                [
+                  `AI classifier: ${classifierEnabled ? "on" : "off"}.`,
+                  "When on, commands no rule matched are read by a model, which can escalate them to a confirmation — never to an approval.",
+                  "Usage: /yolo classifier <on|off>",
+                ].join("\n"),
+                "info",
+              );
+            }
+            return;
+          }
+          classifierEnabled = value === "on";
+          pi.appendEntry(CLASSIFIER_ENTRY, { enabled: classifierEnabled });
+          if (ctx.hasUI) {
+            ctx.ui.notify(
+              classifierEnabled
+                ? "AI classifier ON — unmatched commands get a second opinion before they run."
+                : "AI classifier OFF.",
+              "info",
+            );
+          }
+          return;
+        }
         case "trail": {
           if (!ctx.hasUI) return;
           ctx.ui.notify(formatTrail(readManifest(dir), 20), "info");
@@ -232,7 +418,7 @@ export default function yolo(pi: ExtensionAPI) {
           return;
         }
         default:
-          if (ctx.hasUI) ctx.ui.notify("Usage: /yolo [on|off|status|trail|undo [n]]", "warning");
+          if (ctx.hasUI) ctx.ui.notify("Usage: /yolo [on|off|status|trail|undo [n]|classifier on|off]", "warning");
       }
     },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pify/yolo",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "One toggle to auto-approve everything, with an undo trail: three-tier bash guard, file pre-images, fail-closed everywhere",
   "keywords": [
     "pi-package",

package/src/classify.ts

@@ -0,0 +1,157 @@
+/**
+ * Layer 3 of the guard (zhushanwen's model): a model reads the commands the
+ * regex tiers had no opinion about. Regexes only know the destructive shapes
+ * someone thought to write down; `find . -name '*.ts' -exec sed -i ... {} +`
+ * is not one of them.
+ *
+ * Two rules keep this honest. The classifier can only ESCALATE — it may turn
+ * an allow into an ask, never an ask or a block into an allow, so a model
+ * that is talked into approving something cannot open the gate. And when it
+ * is slow, broken, or unreadable, the deterministic verdict stands: safety
+ * here comes from the rules, and the model is an extra pair of eyes.
+ */
+
+export type Risk = "safe" | "risky";
+
+export interface Classification {
+  risk: Risk;
+  reason: string;
+  /** True when the model was not consulted or could not be read. */
+  fallback: boolean;
+}
+
+export const CLASSIFY_SYSTEM_PROMPT = [
+  "You classify shell commands for a coding agent's safety guard.",
+  "A command is RISKY if running it could destroy work or state that is hard to get back:",
+  "deleting or overwriting files, rewriting git history, force-pushing, resetting or cleaning a",
+  "working tree, mass in-place edits, dropping databases, killing processes, changing permissions",
+  "or ownership broadly, downloading and executing code, or writing outside the project.",
+  "A command is SAFE if it only reads, inspects, queries, builds, or tests.",
+  "Judge what the command actually does, not what it is named. When you are unsure, answer risky.",
+  'Answer with ONE line of JSON and nothing else: {"risk":"safe","reason":"…"} or',
+  '{"risk":"risky","reason":"…"}. Keep the reason under 140 characters.',
+  "Do not explain. Do not use markdown. Your entire reply must start with { and end with }.",
+];
+
+/** Commands so common that asking a model about them is pure latency. */
+const OBVIOUSLY_SAFE =
+  /^(git (status|log|diff|show|branch|remote|fetch)|ls|pwd|cat|head|tail|wc|grep|rg|find|which|echo|node -v|npm (ls|view|test)|bun (test|--version)|python -V|cd|whoami|date|env)\b/i;
+
+/** Flags that turn a read-only-looking command into an executor. */
+const EXECUTOR_FLAGS = /\s-(exec|execdir|delete|ok|okdir)\b/i;
+
+/** Should the classifier be consulted for this command at all? */
+export function needsClassification(command: string): boolean {
+  const trimmed = command.trim();
+  if (!trimmed) return false;
+  // A pipeline or chain hides its real work; always look at those.
+  if (/[|;&]|&&|\$\(|`/.test(trimmed)) return true;
+  // `find` is on the safe list, but `find … -exec` is a way to run anything.
+  if (EXECUTOR_FLAGS.test(trimmed)) return true;
+  return !OBVIOUSLY_SAFE.test(trimmed);
+}
+
+export function buildClassifyPrompt(command: string, cwd: string): string {
+  return [
+    `Working directory: ${cwd}`,
+    "Command:",
+    "```sh",
+    command.trim(),
+    "```",
+    "Classify it.",
+  ].join("\n");
+}
+
+const MAX_REASON = 140;
+
+const RISKY_WORDS = new Set(["risky", "unsafe", "dangerous", "destructive", "irreversible"]);
+const SAFE_WORDS = new Set(["safe", "harmless", "benign"]);
+
+/** First meaningful sentence of a prose answer, trimmed to reason length. */
+function summarize(text: string): string {
+  const flat = text
+    .replace(/```[\s\S]*?```/g, " ")
+    .replace(/[*_`#]/g, "")
+    .replace(/\s+/g, " ")
+    .trim();
+  return flat.slice(0, MAX_REASON);
+}
+
+/**
+ * Read the classifier's answer. Anything unreadable falls back to safe with
+ * `fallback: true` — the caller then keeps the deterministic verdict rather
+ * than inventing an escalation from noise.
+ */
+export function parseClassification(text: string): Classification {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed) return { risk: "safe", reason: "the classifier returned nothing", fallback: true };
+
+  const objects = [...trimmed.matchAll(/\{[^{}]*\}/g)].map((m) => m[0]).reverse();
+  for (const raw of objects) {
+    let parsed: Record<string, unknown>;
+    try {
+      parsed = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      continue;
+    }
+    const reason = typeof parsed.reason === "string" ? parsed.reason.trim().slice(0, MAX_REASON) : "";
+    for (const key of ["risk", "verdict", "classification", "result"]) {
+      const value = String(parsed[key] ?? "").toLowerCase();
+      if (value === "risky" || value === "unsafe" || value === "dangerous" || value === "destructive") {
+        return { risk: "risky", reason: reason || "the classifier flagged it", fallback: false };
+      }
+      if (value === "safe" || value === "harmless") {
+        return { risk: "safe", reason: reason || "the classifier saw no risk", fallback: false };
+      }
+    }
+    if (typeof parsed.risky === "boolean") {
+      return {
+        risk: parsed.risky ? "risky" : "safe",
+        reason: reason || (parsed.risky ? "the classifier flagged it" : "the classifier saw no risk"),
+        fallback: false,
+      };
+    }
+  }
+
+  // Models routinely ignore the format and write an explanation instead. Read
+  // the verdict out of the prose rather than throwing the answer away: a
+  // labelled verdict first, then a standalone RISKY/SAFE token (the last one
+  // wins — the conclusion comes at the end), then a single unambiguous signal.
+  const labelled = [...trimmed.matchAll(/\b(?:classification|verdict|risk|answer)\b\s*[:=]?\s*\**\s*(\w+)/gi)];
+  for (const match of labelled.reverse()) {
+    const word = match[1]!.toLowerCase();
+    if (RISKY_WORDS.has(word)) return { risk: "risky", reason: summarize(trimmed), fallback: false };
+    if (SAFE_WORDS.has(word)) return { risk: "safe", reason: summarize(trimmed), fallback: false };
+  }
+
+  const tokens = [...trimmed.matchAll(/\b(RISKY|SAFE|UNSAFE|DANGEROUS|DESTRUCTIVE)\b/g)];
+  const lastToken = tokens.length > 0 ? tokens[tokens.length - 1]![1]! : null;
+  if (lastToken) {
+    return {
+      risk: lastToken === "SAFE" ? "safe" : "risky",
+      reason: summarize(trimmed),
+      fallback: false,
+    };
+  }
+
+  const risky = /\b(risky|unsafe|dangerous|destructive|irreversible)\b/i.test(trimmed);
+  const safe = /\b(safe|harmless|read-only|benign)\b/i.test(trimmed);
+  if (risky && !safe) return { risk: "risky", reason: summarize(trimmed), fallback: false };
+  if (safe && !risky) return { risk: "safe", reason: summarize(trimmed), fallback: false };
+  return { risk: "safe", reason: `unreadable classifier answer: ${trimmed.slice(0, 80)}`, fallback: true };
+}
+
+export type GuardAction = "allow" | "ask" | "block";
+
+/**
+ * Fold a classification into the deterministic verdict. Escalation only:
+ * allow can become ask, nothing can become allow.
+ */
+export function applyClassification(
+  action: GuardAction,
+  classification: Classification,
+): { action: GuardAction; rule: string | null } {
+  if (action !== "allow") return { action, rule: null };
+  if (classification.fallback || classification.risk === "safe") return { action, rule: null };
+  return { action: "ask", rule: `classifier:${classification.reason}` };
+}

package/src/rules.ts

@@ -42,6 +42,70 @@ const DESTRUCTIVE: BuiltinRule[] = [
   { name: "history-rewrite", action: "ask", re: /\bgit\s+(rebase|filter-branch|filter-repo)\b/ },
 ];
 
+/**
+ * Secret material (cc-safety-net's second pillar). Reading these is how a
+ * credential leaves the machine, so the check is on the path, not the verb —
+ * and unlike the destructive tier it still asks in yolo mode.
+ */
+const SECRET_PATHS: BuiltinRule[] = [
+  { name: "env-file", action: "ask", re: /(^|\/)\.env(\.[\w-]+)*$/ },
+  { name: "ssh-key", action: "ask", re: /(^|\/)(\.ssh\/.*|id_(rsa|dsa|ecdsa|ed25519)(_\w+)?)$/ },
+  { name: "aws-credentials", action: "ask", re: /(^|\/)\.aws\/(credentials|config)$/ },
+  { name: "agent-auth", action: "ask", re: /(^|\/)(\.pi\/agent\/auth\.json|\.claude\/\.credentials\.json)$/ },
+  { name: "registry-token", action: "ask", re: /(^|\/)(\.npmrc|\.pypirc|\.netrc|_netrc|\.git-credentials)$/ },
+  { name: "gh-hosts", action: "ask", re: /(^|\/)\.config\/gh\/hosts\.ya?ml$/ },
+  { name: "private-key", action: "ask", re: /\.(pem|key|p12|pfx|keystore|jks)$/ },
+  { name: "secrets-file", action: "ask", re: /(^|\/)(secrets?|credentials)\.(json|ya?ml|toml)$/ },
+];
+
+/** Example/sample templates carry no secrets — never worth a prompt. */
+const SECRET_EXEMPT = /(^|\/)[\w.-]*\.(example|sample|template|dist)$|\.pub$/;
+
+/** Name of the secret class this path belongs to, or null. */
+export function secretPathKind(path: string): string | null {
+  const normalized = path.trim().replace(/\\/g, "/").replace(/^["']|["']$/g, "").toLowerCase();
+  if (!normalized || SECRET_EXEMPT.test(normalized)) return null;
+  for (const rule of SECRET_PATHS) {
+    if (rule.re.test(normalized)) return rule.name;
+  }
+  return null;
+}
+
+/** Secret paths named anywhere in a shell command (cat, cp, curl -T, …). */
+export function secretPathsIn(command: string): string[] {
+  const kinds = new Set<string>();
+  for (const token of command.split(/[\s;|&()<>]+/)) {
+    const kind = secretPathKind(token);
+    if (kind) kinds.add(kind);
+  }
+  return [...kinds];
+}
+
+/**
+ * Verdict for a file path a tool is about to touch. Default is allow; secret
+ * material asks. User rules (matched against the path) get the last word, so
+ * a wildcard rule ending in `/.env` with action "allow" opts a project out.
+ */
+export function evaluatePath(path: string, userRules: UserRule[] = []): RuleHit {
+  try {
+    const kind = secretPathKind(path);
+    let verdict: RuleHit = kind ? { action: "ask", rule: `secret:${kind}` } : { action: "allow", rule: "default" };
+    const normalized = path.replace(/\\/g, "/");
+    for (const rule of userRules) {
+      try {
+        if (wildcardToRegex(rule.pattern).test(normalized)) {
+          verdict = { action: rule.action, rule: `user:${rule.pattern}` };
+        }
+      } catch {
+        // invalid user pattern — ignore that rule
+      }
+    }
+    return verdict;
+  } catch {
+    return { action: "block", rule: "fail-closed" };
+  }
+}
+
 /** Convert a user wildcard pattern (`git push*`) to a regex. */
 export function wildcardToRegex(pattern: string): RegExp {
   const escaped = pattern
@@ -74,6 +138,10 @@ export function evaluateCommand(command: string, userRules: UserRule[] = []): Ru
         break;
       }
     }
+    if (verdict.action === "allow") {
+      const secrets = secretPathsIn(normalized);
+      if (secrets.length > 0) verdict = { action: "ask", rule: `secret:${secrets.join(",")}` };
+    }
     for (const rule of userRules) {
       try {
         if (wildcardToRegex(rule.pattern).test(normalized)) {

package/src/trail.ts

@@ -80,6 +80,7 @@ export function recordBash(
   cwd: string,
   gitHead: string | null,
   now: number,
+  stashSha: string | null = null,
 ): void {
   try {
     append(dir, {
@@ -91,6 +92,7 @@ export function recordBash(
       existed: false,
       cwd,
       ...(gitHead ? { gitHead } : {}),
+      ...(stashSha ? { stashSha } : {}),
     });
   } catch {
     // trail must never break the tool call
@@ -142,7 +144,9 @@ export function formatTrail(entries: TrailEntry[], limit: number): string {
       if (e.type === "file") {
         return `#${e.seq} ${when} file  ${e.target}${e.existed ? "" : " (new file)"}`;
       }
-      return `#${e.seq} ${when} bash  ${e.target}${e.gitHead ? ` @${e.gitHead.slice(0, 8)}` : ""}`;
+      const head = e.gitHead ? ` @${e.gitHead.slice(0, 8)}` : "";
+      const stash = e.stashSha ? `\n    ↩ git stash apply ${e.stashSha}` : "";
+      return `#${e.seq} ${when} bash  ${e.target}${head}${stash}`;
     })
     .join("\n");
 }

package/src/types.ts

@@ -30,6 +30,8 @@ export interface TrailEntry {
   existed: boolean;
   cwd?: string;
   gitHead?: string;
+  /** bash: dangling `git stash create` commit holding the pre-command tree. */
+  stashSha?: string;
 }
 
 export interface BranchEntryLike {