@pugi/cli 0.1.0-beta.10 → 0.1.0-beta.101

package/dist/core/path-security.js

@@ -1,12 +1,48 @@
-import { realpathSync } from 'node:fs';
-import { basename, relative, resolve } from 'node:path';
+/**
+ * Path-security gate for Pugi CLI file operations.
+ *
+ * The original `resolveWorkspacePath` (preserved below) is the read-path
+ * gate: it stops relative-path traversal, URL-encoded traversal, and
+ * symlink escapes at the leaf. It is kept as the existing call surface
+ * for `read` and other non-mutating tools.
+ *
+ * `assertSafeWritePath` is a stricter, write-only gate ported from
+ * external's Rust `path_guard.rs` (Apache-2.0). It adds:
+ *
+ *  1. `..` segment rejection BEFORE any filesystem touch.
+ *  2. Walk-up canonicalize: finds the deepest existing ancestor,
+ *     canonicalizes it (resolving every symlink in the existing
+ *     prefix), then reattaches the non-existent tail. This closes
+ *     the "parent's parent is a symlink" bypass that catches naive
+ *     canonicalize-the-parent implementations.
+ *  3. Leaf-symlink reject: refuse to write through a symlink even
+ *     when the file already exists. Covers dangling symlinks too.
+ *  4. Fail-CLOSED on empty allowed roots: an empty PUGI_ALLOWED_ROOTS
+ *     means "no writes anywhere" rather than "writes allowed
+ *     everywhere".
+ *  5. Containment check against canonicalized allowed roots.
+ *  6. Denylist of system, credential, and shell-init paths even
+ *     when they sit inside an allowed root (defense in depth — a
+ *     misconfigured root pointing at `$HOME` still cannot clobber
+ *     `~/.ssh/id_ed25519`).
+ *
+ * ---
+ * Portions of `assertSafeWritePath` and `canonicalizeWithWalkUp` are
+ * derived from external `kei-mcp/src/handlers/safe_tools/
+ * path_guard.rs` (Apache-2.0). See `licenses/EXTERNAL-LICENSE-NOTICE.md`
+ * at the repo root for attribution and the full upstream license
+ * reference.
+ */
+import { existsSync, lstatSync, realpathSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, relative, resolve, sep, } from 'node:path';
 /**
  * Resolve and validate that an inputPath stays within the workspace.
  *
  * Defends against:
- *   1. relative-path traversal (`../etc/passwd`)
- *   2. URL-encoded traversal (`..%2Fetc%2Fpasswd`)
- *   3. symlink escapes at the target itself (`alias-link -> /etc/passwd`)
+ *  1. relative-path traversal (`../etc/passwd`)
+ *  2. URL-encoded traversal (`..%2Fetc%2Fpasswd`)
+ *  3. symlink escapes at the target itself (`alias-link -> /etc/passwd`)
  *
  * The previous implementation also resolved the parent's realpath and
  * compared to the workspace root. That broke `pugi explain .` on macOS
@@ -60,4 +96,250 @@ function isInsideWorkspace(child, workspaceRoot) {
     const rel = relative(workspaceRoot, child);
     return Boolean(rel) && !rel.startsWith('..') && rel !== '..';
 }
+/**
+ * Apply the strict write-path guard. Returns the canonical
+ * absolute path on success, throws on rejection.
+ *
+ * Use this for any operation that mutates the filesystem (`write`,
+ * `edit`, atomic-rename targets). The error message is safe to surface
+ * to the operator — it never echoes filesystem secrets.
+ */
+export function assertSafeWritePath(inputPath, options = {}) {
+    if (typeof inputPath !== 'string' || inputPath.length === 0) {
+        throw new Error('file_path: empty');
+    }
+    if (inputPath.includes('\0')) {
+        throw new Error('file_path: null byte rejected');
+    }
+    // step: reject `..` segments before any FS work. We split on
+    // both `/` and the platform separator so a Windows-style `..\foo`
+    // input cannot smuggle a traversal through on macOS test paths.
+    const decoded = decodeURIComponent(inputPath);
+    const segments = decoded.split(/[/\\]/);
+    if (segments.some((seg) => seg === '..')) {
+        throw new Error(`file_path: '..' segment not allowed in ${inputPath}`);
+    }
+    // step: refuse to write through a symlink leaf. We must
+    // check the LITERAL input path (pre-canonicalize) because `realpath`
+    // unconditionally resolves symlinks — so by the time we have the
+    // canonical path the symlink fingerprint is already gone. `lstatSync`
+    // does NOT follow symlinks, which is exactly what we need.
+    const cwdRoot = options.root ?? process.cwd();
+    const literalAbsolute = isAbsolute(decoded) ? decoded : resolve(cwdRoot, decoded);
+    try {
+        const meta = lstatSync(literalAbsolute);
+        if (meta.isSymbolicLink()) {
+            throw new Error(`file_path: leaf is a symlink (refusing to follow): ${literalAbsolute}`);
+        }
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== 'ENOENT' && code !== 'ENOTDIR')
+            throw error;
+        // ENOENT/ENOTDIR is fine — the leaf simply does not exist yet
+        // (write-create path). The walk-up canonicalize below handles it.
+    }
+    const canonical = canonicalizeWithWalkUp(decoded, cwdRoot);
+    // step: fail-CLOSED on empty allowed roots.
+    const roots = computeAllowedRoots(options);
+    if (roots.length === 0) {
+        throw new Error("file_path: allowed_roots is empty — refusing all writes " +
+            '(set PUGI_ALLOWED_ROOTS to a non-empty value or run from a real cwd)');
+    }
+    // step: containment check against canonicalized allowed
+    // roots. Each root is normalized to end in `sep` so `/tmp/wsX` does
+    // not accidentally pass containment for `/tmp/ws`.
+    const inAllowedRoot = roots.some((r) => isContainedIn(canonical, r));
+    if (!inAllowedRoot) {
+        throw new Error(`file_path: outside allowed roots ${JSON.stringify(roots)}: ${canonical}`);
+    }
+    // step: denylist. Applied AFTER containment so a
+    // misconfigured root pointing at `/` or `$HOME` still cannot clobber
+    // sensitive files. We canonicalize HOME so a $HOME that lives under
+    // a symlinked prefix (macOS /var → /private/var, Linux /home →
+    // /usr/home on some FreeBSD-style mounts) still matches the
+    // canonical write target.
+    assertNotDenylisted(canonical, canonicalizeHomeDir(options.homeDir ?? homedir()));
+    return canonical;
+}
+function canonicalizeHomeDir(raw) {
+    if (!raw)
+        return raw;
+    try {
+        return realpathSync.native(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * Ported from an external utility. Finds the deepest
+ * existing ancestor, canonicalizes it (resolving every symlink in the
+ * existing prefix), then reattaches the non-existent tail components.
+ *
+ * This closes the "parent's parent is a symlink" bypass where naive
+ * implementations canonicalize only the immediate parent.
+ */
+export function canonicalizeWithWalkUp(inputPath, cwd) {
+    const absolute = isAbsolute(inputPath) ? inputPath : resolve(cwd, inputPath);
+    let current = absolute;
+    const tail = [];
+    // Hard cap on walk-up iterations — defense against pathological
+    // inputs that somehow evade `dirname` termination.
+    const maxIterations = 4096;
+    let iterations = 0;
+    while (true) {
+        iterations += 1;
+        if (iterations > maxIterations) {
+            throw new Error(`file_path: walk-up exceeded ${maxIterations} iterations: ${absolute}`);
+        }
+        if (existsSync(current)) {
+            let canonicalExisting;
+            try {
+                canonicalExisting = realpathSync.native(current);
+            }
+            catch (error) {
+                throw new Error(`file_path: canonicalize ${current}: ${error.message}`);
+            }
+            // Reattach tail in original order (we pushed leaf-first).
+            let result = canonicalExisting;
+            for (let i = tail.length - 1; i >= 0; i -= 1) {
+                result = resolve(result, tail[i]);
+            }
+            return result;
+        }
+        const name = basename(current);
+        const parent = dirname(current);
+        if (!name || parent === current) {
+            throw new Error(`file_path: walked to root without finding existing dir: ${absolute}`);
+        }
+        tail.push(name);
+        current = parent;
+    }
+}
+function computeAllowedRoots(options) {
+    const envValue = options.allowedRootsEnv ?? process.env.PUGI_ALLOWED_ROOTS;
+    if (envValue !== undefined) {
+        return envValue
+            .split(':')
+            .filter((s) => s.length > 0)
+            .map(canonicalizeRoot)
+            .filter((s) => s !== null);
+    }
+    // No env override: implicit root is the caller-supplied cwd (defaults
+    // to `process.cwd()`).
+    const cwd = options.root ?? process.cwd();
+    const canon = canonicalizeRoot(cwd);
+    return canon ? [canon] : [];
+}
+function canonicalizeRoot(raw) {
+    if (!raw)
+        return null;
+    let canon;
+    try {
+        canon = realpathSync.native(raw);
+    }
+    catch {
+        canon = resolve(raw);
+    }
+    if (!canon)
+        return null;
+    return canon.endsWith(sep) ? canon : canon + sep;
+}
+function isContainedIn(canonicalChild, rootWithSep) {
+    const rootNoSep = rootWithSep.endsWith(sep)
+        ? rootWithSep.slice(0, -1)
+        : rootWithSep;
+    if (canonicalChild === rootNoSep)
+        return true;
+    return canonicalChild.startsWith(rootWithSep);
+}
+function assertNotDenylisted(canonical, homeDir) {
+    // System paths — match as prefix-with-separator so `/etc-fake/` is
+    // not denied while `/etc/passwd` is.
+    const systemDenyPrefixes = [
+        '/etc/',
+        '/usr/',
+        '/System/',
+        '/Library/Application Support/',
+        '/var/db/',
+        '/var/log/',
+        '/var/root/',
+        '/private/etc/',
+        '/private/usr/',
+        '/private/var/db/',
+        '/private/var/log/',
+        '/private/var/root/',
+        '/root/',
+        '/bin/',
+        '/sbin/',
+    ];
+    for (const prefix of systemDenyPrefixes) {
+        if (canonical.startsWith(prefix)) {
+            throw new Error(`file_path: denied (system dir): ${canonical}`);
+        }
+    }
+    if (!homeDir)
+        return;
+    // Credential and substrate directories.
+    const homeDirSecrets = [
+        '.ssh/',
+        '.aws/',
+        '.gnupg/',
+        '.config/gcloud/',
+        '.kube/',
+        '.docker/',
+        '.claude/',
+        '.grok/',
+        '.gemini/',
+        '.copilot/',
+        '.kimi/',
+        '.pugi/credentials/',
+    ];
+    for (const secret of homeDirSecrets) {
+        const full = joinHome(homeDir, secret);
+        if (canonical.startsWith(full)) {
+            throw new Error(`file_path: denied (secret/substrate dir): ${canonical}`);
+        }
+    }
+    // Credential files (exact match).
+    const homeFileSecrets = [
+        '.npmrc',
+        '.cargo/credentials',
+        '.cargo/credentials.toml',
+        '.docker/config.json',
+        '.netrc',
+        '.pgpass',
+    ];
+    for (const secret of homeFileSecrets) {
+        const full = joinHome(homeDir, secret);
+        if (canonical === full) {
+            throw new Error(`file_path: denied (credential file): ${canonical}`);
+        }
+    }
+    // Shell-init files (exact match).
+    const initFiles = [
+        '.zshrc',
+        '.bashrc',
+        '.profile',
+        '.bash_profile',
+        '.zprofile',
+        '.zshenv',
+        '.bash_login',
+        '.bash_logout',
+        '.inputrc',
+        '.gitconfig',
+        '.config/fish/config.fish',
+    ];
+    for (const file of initFiles) {
+        const full = joinHome(homeDir, file);
+        if (canonical === full) {
+            throw new Error(`file_path: denied (shell-init file): ${canonical}`);
+        }
+    }
+}
+function joinHome(homeDir, rest) {
+    const trimmedHome = homeDir.endsWith(sep) ? homeDir.slice(0, -1) : homeDir;
+    return `${trimmedHome}${sep}${rest}`;
+}
 //# sourceMappingURL=path-security.js.map

package/dist/core/permission.js

@@ -68,8 +68,8 @@ const protectedSuffixes = ['.pem', '.key', '.crt', '.p12', '.dump', '.sql'];
  * it as a list for callers (doctor, debug tooling) that need to
  * audit the rule set without re-running `classifyBash`.
  *
- * Code Reviewer P2 retro 2026-05-23: previously this list was
- * duplicated here as `destructiveBashPatterns`. Sprint α5.2 moves it
+ * Code Reviewer P2 retro: previously this list was
+ * duplicated here as `destructiveBashPatterns`. Sprint moves it
  * into the classifier so the permission engine and the doctor surface
  * cannot drift.
  */
@@ -79,23 +79,23 @@ export function destructiveBashPatternsList() {
 /**
  * Class-aware bash permission decision. The matrix:
  *
- *                     | plan | ask | acceptEdits | auto       | dontAsk | bypass
- *  read               | allow| allow| allow      | allow      | allow   | allow
- *  build_test         | deny | ask  | ask        | allow      | allow*  | allow
- *  network            | deny | ask  | ask        | ask        | allow*  | allow
- *  write_workspace    | deny | ask  | allow      | allow      | allow*  | allow
- *  write_protected    | deny | ask  | ask        | ask        | deny    | ask
- *  destructive        | deny | deny | deny       | deny       | deny    | deny**
- *  unknown            | deny | ask  | ask        | ask        | deny    | ask
+ *                    | plan | ask | acceptEdits | auto      | dontAsk | bypass
+ * read              | allow| allow| allow     | allow     | allow  | allow
+ * build_test        | deny | ask | ask       | allow     | allow* | allow
+ * network           | deny | ask | ask       | ask       | allow* | allow
+ * write_workspace   | deny | ask | allow     | allow     | allow* | allow
+ * write_protected   | deny | ask | ask       | ask       | deny   | ask
+ * destructive       | deny | deny | deny      | deny      | deny   | deny**
+ * unknown           | deny | ask | ask       | ask       | deny   | ask
  *
- *  * dontAsk allows non-destructive classes when no settings rule
- *    contradicts; the bare-mode policy is encoded in the table below.
- *  ** destructive can be unlocked ONLY when ALL three hold:
- *      - mode === 'bypassPermissions'
- *      - PUGI_DESTRUCTIVE_OVERRIDE === '1'
- *      - source === 'human'
- *    The agent loop never sets `source: 'human'`, so even a runaway
- *    agent in bypass mode cannot trigger a destructive deletion.
+ * * dontAsk allows non-destructive classes when no settings rule
+ *   contradicts; the bare-mode policy is encoded in the table below.
+ * ** destructive can be unlocked ONLY when ALL three hold:
+ *     - mode === 'bypassPermissions'
+ *     - PUGI_DESTRUCTIVE_OVERRIDE === '1'
+ *     - source === 'human'
+ *   The agent loop never sets `source: 'human'`, so even a runaway
+ *   agent in bypass mode cannot trigger a destructive deletion.
  */
 export function evaluateBashPermission(cmd, mode, ctx) {
     const classification = classifyBash(cmd, {
@@ -236,6 +236,18 @@ export function decidePermission(action, settings, root) {
     if (protectedReason) {
         return decisionForMode(settings.permissions.mode, protectedReason, 'protected_file', 'high');
     }
+    // task — operator-declared read-only paths gate edits
+    // and writes ahead of the generic deny check so the audit trail
+    // shows `source: 'readonly_paths'` (operator intent), not
+    // `settings.deny` (generic rule). Reads always pass through; the
+    // contract is "you can look but не touch".
+    if (action.kind === 'edit' && matchesAny(action.target, settings.permissions.readonlyPaths)) {
+        return {
+            decision: 'deny',
+            reason: `Read-only path: ${action.target}`,
+            source: 'readonly_paths',
+        };
+    }
     const signature = `${action.kind}:${action.target}`;
     if (matchesAny(signature, settings.permissions.deny)) {
         return { decision: 'deny', reason: `Denied by rule: ${signature}`, source: 'settings.deny' };
@@ -297,13 +309,61 @@ function riskForAction(action) {
         return 'medium';
     return 'medium';
 }
+/**
+ * Expand `${VAR}` and `$VAR` references in a rule string against
+ * `process.env`. Unknown variables expand к the empty string so a
+ * typo'd `${HMOE}` cannot accidentally match every signature via a
+ * literal `${HMOE}` substring; the expanded `mcp:fs/` is innocuous.
+ *
+ * task #23 — operator wants `mcp:secrets/${USER}-*`
+ * style rules so a single settings file fits multiple machines.
+ *
+ * The implementation deliberately avoids shell-style features like
+ * `$()` or default-value `${VAR:-x}`; permission rules should be
+ * easy to reason about at audit time.
+ */
+export function expandEnvVars(rule, env = process.env) {
+    // Single combined regex. Sequential `${VAR}` then `$VAR` passes are
+    // unsafe — if `${X}` expands to a value containing `$Y`, the second
+    // pass would also expand that. An attacker controlling one env var
+    // could rewrite permission rules. Substitute each variable exactly
+    // once by matching both forms in a single sweep.
+    return rule.replace(/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g, (_m, braced, bare) => {
+        const name = braced ?? bare ?? '';
+        return env[name] ?? '';
+    });
+}
+/**
+ * Convert a glob-style rule to a RegExp anchored full-string.
+ * Supports: `*` (greedy any), `?` (single char), all other regex
+ * metacharacters escaped. The simpler tail-`*` form remains valid —
+ * `mcp:fs/ *` works the same way as before, just via regex instead of
+ * the old `startsWith` branch. Power users get `mcp:* / write*` style
+ * cross-server denies.
+ */
+const REGEX_META = new Set(['\\', '^', '$', '.', '|', '+', '(', ')', '[', ']', '{', '}']);
+function ruleToRegExp(rule) {
+    let out = '';
+    for (const ch of rule) {
+        if (ch === '*')
+            out += '.*';
+        else if (ch === '?')
+            out += '.';
+        else if (REGEX_META.has(ch))
+            out += '\\' + ch;
+        else
+            out += ch;
+    }
+    return new RegExp('^' + out + '$');
+}
 function matchesAny(value, rules) {
     return rules.some((rule) => {
-        if (rule === value)
+        const expanded = expandEnvVars(rule);
+        if (expanded === value)
             return true;
-        if (rule.endsWith('*'))
-            return value.startsWith(rule.slice(0, -1));
-        return false;
+        if (!expanded.includes('*') && !expanded.includes('?'))
+            return false;
+        return ruleToRegExp(expanded).test(value);
     });
 }
 //# sourceMappingURL=permission.js.map

package/dist/core/permissions/auto-classifier.js

@@ -0,0 +1,124 @@
+/**
+ * Auto-mode classifier — Phase 1 (regex allowlist + denylist).
+ *
+ * `permissionMode === 'auto'` is the the upstream tool parity mode where the
+ * classifier decides safe-vs-unsafe per call. Phase 1 ships without
+ * ML — just two curated regex lists covering the 80% of "obviously
+ * safe" and "obviously catastrophic" patterns. Anything that doesn't
+ * match either list returns `ask`, so the operator stays in the loop
+ * для the ambiguous middle.
+ *
+ * Phase 2 (deferred, NOT in this PR): semantic classifier consulting
+ * the model with a tight system prompt. The interface (`AutoVerdict`)
+ * is stable so we can swap implementations without touching the gate.
+ *
+ * Design notes:
+ *
+ *  - Patterns are conservative: a read-only command is only
+ *    allow-listed когда its argv shape is unambiguous (no `-exec`,
+ *    no `--delete`, no `|` к shell). When в doubt, fall back to ask.
+ *  - The denylist matches catastrophic patterns even в auto-mode so
+ *    a misclick can't shred the workspace. The circuit-breaker
+ *    (`circuit-breaker.ts`) covers the same surface для bypass-mode;
+ *    this denylist is the auto-mode equivalent.
+ *  - All matches operate on the FULL command string, not parsed
+ *    argv. This is deliberately permissive on whitespace but strict
+ *    on operator characters (`|`, `&`, `;`, `>`, backticks) — a
+ *    pipe-into-shell или command-chain forces fallback к ask.
+ */
+/**
+ * Catastrophic patterns — the auto-mode regex denylist. Each entry
+ * carries a human-readable reason surfaced в the deny payload so the
+ * operator + audit log see why the gate refused. Order matters: most-
+ * specific первой так "rm -rf /" reports as that, не the generic
+ * "rm -rf".
+ */
+const AUTO_DENY_PATTERNS = [
+    { pattern: /\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\b/i, reason: 'rm -rf (recursive force-delete)' },
+    { pattern: /\bgit\s+push\s+(-{1,2}force\b|\-f\b)/i, reason: 'git push --force (history rewrite)' },
+    { pattern: /\bgit\s+reset\s+--hard\b/i, reason: 'git reset --hard (uncommitted-work loss)' },
+    { pattern: /\bdd\s+if=\/(dev|)/i, reason: 'dd if=/dev/* (raw device read/write)' },
+    { pattern: /\bmkfs(\.|\s|$)/i, reason: 'mkfs (filesystem format)' },
+    { pattern: /\bchmod\s+-R\s+777\b/i, reason: 'chmod -R 777 (world-writable recursive)' },
+    { pattern: /\bchown\s+-R\b/i, reason: 'chown -R (recursive ownership change)' },
+    { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;?\s*:/, reason: 'fork bomb signature' },
+    { pattern: /\bsudo\b/i, reason: 'sudo (privilege escalation)' },
+    { pattern: /\b(npm|pnpm|yarn)\s+publish\b/i, reason: 'package publish (irreversible npm release)' },
+    { pattern: /\b(curl|wget)\b[^|;&]*\|\s*(sh|bash|zsh)\b/i, reason: 'pipe-to-shell installer (curl … | sh)' },
+];
+/**
+ * Safe-by-default patterns — auto-mode regex allowlist. Each regex
+ * must match the FULL command (with `^…$` anchors) so a leading
+ * `sudo ls` или a trailing `; rm -rf /` does NOT slip through. The
+ * caller passes the trimmed command string; whitespace around argv
+ * tokens is tolerated.
+ */
+const AUTO_ALLOW_PATTERNS = [
+    { pattern: /^ls(\s+-[a-zA-Z]+)*(\s+[^|;&`>$()\\]+)?$/, reason: 'ls (directory listing)' },
+    { pattern: /^pwd\s*$/, reason: 'pwd (working directory)' },
+    { pattern: /^cat\s+[^|;&`>$()\\]+$/, reason: 'cat (file read)' },
+    { pattern: /^head(\s+-n?\s*\d+)?\s+[^|;&`>$()\\]+$/, reason: 'head (file preview)' },
+    { pattern: /^tail(\s+-n?\s*\d+)?\s+[^|;&`>$()\\]+$/, reason: 'tail (file preview)' },
+    { pattern: /^wc(\s+-[a-z]+)?\s+[^|;&`>$()\\]+$/, reason: 'wc (line/word count)' },
+    { pattern: /^du\s+-sh?\s+[^|;&`>$()\\]+$/, reason: 'du -sh (disk usage summary)' },
+    { pattern: /^df\s+-h\s*$/, reason: 'df -h (filesystem free space)' },
+    { pattern: /^git\s+status(\s+--short|\s+-s)?\s*$/, reason: 'git status' },
+    { pattern: /^git\s+diff(\s+[a-zA-Z0-9_./~^-]+)*\s*$/, reason: 'git diff (read-only)' },
+    { pattern: /^git\s+log(\s+[a-zA-Z0-9_./~^-]+)*\s*$/, reason: 'git log (read-only)' },
+    { pattern: /^git\s+branch(\s+-[a-z]+)?\s*$/, reason: 'git branch (read-only)' },
+    { pattern: /^git\s+remote\s+-v\s*$/, reason: 'git remote -v (read-only)' },
+    { pattern: /^pnpm\s+(typecheck|lint|test\s+--run|test\s+--watch=false)\s*$/, reason: 'pnpm read-only build check' },
+    { pattern: /^npm\s+(--version|-v|run\s+typecheck|run\s+lint)\s*$/, reason: 'npm read-only check' },
+    { pattern: /^node\s+--version\s*$/, reason: 'node --version' },
+    { pattern: /^pnpm\s+--version\s*$/, reason: 'pnpm --version' },
+    { pattern: /^which\s+[a-zA-Z0-9_-]+\s*$/, reason: 'which (command lookup)' },
+    { pattern: /^find\s+\.\s+-type\s+f(\s+-name\s+[^|;&`>$()\\]+)?\s*$/, reason: 'find -type f (read-only)' },
+    { pattern: /^(rg|ripgrep|grep)\s+(-[a-z]+\s+)*[^|;&`>$()\\]+(\s+[^|;&`>$()\\]+)?\s*$/, reason: 'grep/ripgrep (read-only search)' },
+];
+/**
+ * Classify an auto-mode command. Order:
+ *  1. Catastrophic deny patterns — surface the explicit deny reason.
+ *  2. Safe allow patterns — surface the matched reason.
+ *  3. Fallback к ask.
+ *
+ * The order matters: a destructive pattern that ALSO looks like a
+ * read-only token (e.g. `git diff ; rm -rf .`) hits deny first because
+ * the allow patterns require `^…$` anchors that the chained command
+ * fails to satisfy. Belt + suspenders.
+ */
+export function classifyAutoMode(command) {
+    const trimmed = command.trim();
+    if (trimmed.length === 0)
+        return { verdict: 'ask' };
+    for (const entry of AUTO_DENY_PATTERNS) {
+        if (entry.pattern.test(trimmed)) {
+            return {
+                verdict: 'deny',
+                reason: entry.reason,
+                pattern: entry.pattern.source,
+            };
+        }
+    }
+    for (const entry of AUTO_ALLOW_PATTERNS) {
+        if (entry.pattern.test(trimmed)) {
+            return {
+                verdict: 'allow',
+                reason: entry.reason,
+                pattern: entry.pattern.source,
+            };
+        }
+    }
+    return { verdict: 'ask' };
+}
+/**
+ * Diagnostic accessors — exposed для doctor surfaces + spec coverage.
+ * The arrays are frozen at module load so callers can iterate without
+ * mutating the source-of-truth.
+ */
+export function listAutoAllowPatterns() {
+    return AUTO_ALLOW_PATTERNS.map((e) => ({ pattern: e.pattern.source, reason: e.reason }));
+}
+export function listAutoDenyPatterns() {
+    return AUTO_DENY_PATTERNS.map((e) => ({ pattern: e.pattern.source, reason: e.reason }));
+}
+//# sourceMappingURL=auto-classifier.js.map