@synqa/cli 1.1.0 → 1.1.1

package/dist/main.js

@@ -1,18 +1,106 @@
 import { createInterface } from "node:readline/promises";
 import { runAgent } from "./agent.js";
-import { checkKey } from "./api.js";
+import { ApiError, checkKey } from "./api.js";
 import { announceNotes, freshHistory, runCommand, statusParts } from "./commands.js";
                                                   
 import { looksLikeKey, readConfig, resolveApiKey, writeConfig, configPath } from "./config.js";
 import { EditJournal } from "./journal.js";
-import { unsafeStartDir } from "./paths.js";
+import { isHomeDir, isSensitivePath, unsafeStartDir } from "./paths.js";
+                                             
+                                  
+import { join } from "node:path";
+
+// A workspace inside a protected area (~/.dotfiles, ~/.config/nvim, ~/Library/...): every file is
+// refused there, so say why once at start-up instead of leaving the user with refusals.
+export function protectedWorkspaceWarning(cwd        , home         )                     {
+  if (!isSensitivePath(join(cwd, "probe.txt"), undefined, home)) return undefined;
+  return "this folder is inside a protected area (a dot folder or Library in your home folder, or a credentials folder), where tools keep keys and tokens. The agent cannot read, write or search files here. Copy the project to a normal folder to work on it.";
+}
+
+// The start-up notes both the session banner and a one-shot run print.
+export function startWarnings(env                                    , cwd        , home         )           {
+  const out           = [];
+  if (env.SYNQA_API_KEY?.trim()) out.push("using the key from SYNQA_API_KEY (not the one saved by synqa login)");
+  const inProtected = protectedWorkspaceWarning(cwd, home);
+  if (inProtected) out.push(inProtected);
+  return out;
+}
+
+                                                                             
+
+// Keys from a terminal always go through a PromptFrame, framed or not, so pasted text can never
+// answer a y/N question; the frame (rules, status, / menu) is drawn only when `framed`. Questions
+// and the bracketed paste switch go to the terminal: stdout when it is one, else stderr, so
+// `synqa "task" | tee log` still asks on the screen and still tells pasted text from typing.
+export function openSessionInput(o   
+                                                                              
+                                             
+ )                                                                                {
+  const tty = Boolean(o.stdin.isTTY);
+  const term = o.stdout.isTTY || !o.stderr.isTTY ? o.stdout : o.stderr;
+  const keys = tty ? new PromptFrame(o.stdin, term, o.ui, o.below, o.promptWidth, { paste: Boolean(term.isTTY) }) : undefined;
+  const rl = createInterface({ input: keys ? keys.input : (o.stdin                         ), output: term, terminal: tty });
+  keys?.start(rl);
+  return { rl, keys, term };
+}
+
+                                                                          
+
+// Raw mode and bracketed paste are switched off on every way out: a normal exit, an uncaught
+// exception and an unhandled rejection (then the error is printed and the exit code is 1).
+export function installTerminalRestore(
+  restore            , proc           = process,
+  exit                         = (c) => process.exit(c), report                      = (s) => console.error(s),
+)       {
+  proc.on("exit", restore);
+  const crash = (err         ) => {
+    restore();
+    report(`\nerror: ${sanitize(err instanceof Error ? err.message : String(err))}`);
+    exit(1);
+  };
+  proc.on("uncaughtException", crash);
+  proc.on("unhandledRejection", crash);
+}
+
+// The session's terminal wiring, in one place so it is tested as main uses it: restore stops the
+// spinner and gives the keys back, on every way out. In a one-shot run on a terminal, a Ctrl+C the
+// key router saw (it closes readline) ends the process with 130, the shell's code for an
+// interrupt. Readline closing for any other reason (end of piped input, /dev/null) is not an
+// interrupt: without a terminal there is no key router and no handler at all.
+export function wireSession(o   
+                                                                                                                    
+                                                                               
+ )                                            {
+  const exit = o.exit ?? ((c        ) => process.exit(c));
+  const report = o.report ?? ((s        ) => console.error(s));
+  const restore = () => { o.spinner.stop(); o.keys?.stop(); };
+  installTerminalRestore(restore, o.proc ?? process, exit, report);
+  let finished = false;
+  const keys = o.keys;
+  if (o.oneShot && keys) {
+    o.rl.on("close", () => {
+      if (finished || !keys.interrupted) return;
+      restore();
+      report("\ninterrupted");
+      exit(130);
+    });
+  }
+  return { restore, done: () => { finished = true; } };
+}
+
+// --yes in the home folder would let the agent write shell startup files, launch agents and the
+// like without a question, so it is refused there (the tools also ignore it, as a second guard).
+export function homeYesRefusal(cwd        , yes         , home         )                     {
+  return yes && isHomeDir(cwd, home) ? "--yes is not allowed in your home folder. Run without --yes, or cd into a project folder." : undefined;
+}
 import { sanitize } from "./sanitize.js";
-import { formatStatus, StatusBar } from "./statusbar.js";
-import { DEFAULT_TIER, findEffort, findTier, routingLabel } from "./tiers.js";
+import { formatStatus } from "./statusbar.js";
+import { CONTEXT_TOKENS, DEFAULT_TIER, findEffort, findTier, routingLabel } from "./tiers.js";
 import { accent, dim, stone } from "./theme.js";
                                         
 import { fetchAccount } from "./account.js";
-import { balanceFrom, formatFooter, makeUi, readVersion, renderBanner, Spinner, styleOf, TurnRenderer } from "./ui.js";
+import { balanceFrom, formatFooter, makeUi, promptText, readVersion, renderBanner, renderStatusLines, Spinner, styleOf, textWidth, TurnRenderer } from "./ui.js";
+import { PromptFrame } from "./prompt.js";
                                        
 
 const VERSION = readVersion();
@@ -25,12 +113,16 @@ const HELP = `Usage:
   synqa "do something"      one-shot task
   synqa login               save your API key
 Options:
-  -y, --yes                 do not ask before write, edit and bash
+  -y, --yes                 do not ask before ordinary file writes and edits
+                            (shell commands always ask; not allowed in your home folder)
   -m, --model <tier>        blink | sonata | aeon (default blink)
   -e, --effort <level>      default | low | medium (default default)
-  --allow-home              allow starting in your home folder or the filesystem root
   -h, --help   -v, --version
-In a session: /model, /effort, /status, /init, /compact, /undo, /clear, /help, /exit`;
+In a session, type / for the command menu (/model, /effort, /status, /init, /compact, /undo,
+/clear, /help, /exit).`;
+
+// Said when SYNQA_API_KEY is set: it wins over the key that synqa login saved.
+export const ENV_KEY_NOTE = "SYNQA_API_KEY is set in this shell, so it is used instead of the key saved by synqa login. Remove it (unset SYNQA_API_KEY, and delete the line from ~/.zshrc or ~/.bash_profile) to use the saved key.";
 
 // Masked single-line input: nothing typed is echoed.
 export function readSecret(promptText        )                  {
@@ -88,6 +180,8 @@ export async function login()                  {
   }
   const file = writeConfig({ ...readConfig(), apiKey: key });
   console.log(`Key verified and saved to ${file}`);
+  const fromEnv = process.env.SYNQA_API_KEY?.trim();
+  if (fromEnv && fromEnv !== key) console.error(`\nWarning: ${ENV_KEY_NOTE}`);
   return 0;
 }
 
@@ -98,7 +192,7 @@ export function parseArgs(argv          )       {
   for (let i = 0; i < argv.length; i++) {
     const t = argv[i]          ;
     if (t === "-y" || t === "--yes") a.yes = true;
-    else if (t === "--allow-home") a.allowHome = true;
+    else if (t === "--allow-home") a.allowHome = true; // accepted and ignored since 1.1.1
     else if (t === "-h" || t === "--help") a.help = true;
     else if (t === "-v" || t === "--version") a.version = true;
     else if (t === "-m" || t === "--model") a.model = argv[++i] ?? "";
@@ -108,17 +202,20 @@ export function parseArgs(argv          )       {
   return a;
 }
 
-export async function main(argv          )                  {
+// `input` is the key source; tests pass a stream that ends at once, like `< /dev/null`.
+export async function main(argv          , input            = process.stdin)                  {
   const args = parseArgs(argv);
   if (args.help) { console.log(HELP); return 0; }
   if (args.version) { console.log(VERSION); return 0; }
   if (args.rest[0] === "login") return login();
 
   const unsafe = unsafeStartDir(process.cwd());
-  if (unsafe && !args.allowHome) {
-    console.error(`Refusing to start in ${unsafe}: the agent could read your keys and settings there. cd into a project folder, or pass --allow-home if you really mean it.`);
+  if (unsafe) {
+    console.error(`Synqa does not start in ${unsafe} (the whole disk would be its workspace). cd into a project folder first.`);
     return 1;
   }
+  const yesRefused = homeYesRefusal(process.cwd(), args.yes);
+  if (yesRefused) { console.error(yesRefused); return 1; }
   const apiKey = resolveApiKey();
   if (!apiKey) {
     console.error(`No API key. Run "synqa login" or set SYNQA_API_KEY. (config: ${configPath()})`);
@@ -131,8 +228,14 @@ export async function main(argv          )                  {
   const effort = args.effort ? findEffort(args.effort) : "default";
   if (!effort) { console.error(`Unknown effort "${args.effort}". Use default, low or medium.`); return 1; }
 
-  const interactive = Boolean(process.stdin.isTTY) && args.rest.length === 0;
-  const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: Boolean(process.stdin.isTTY) });
+  const interactive = Boolean(input.isTTY) && args.rest.length === 0;
+  // On a terminal the prompt frame reads the keys (for the / menu) and hands them to readline.
+  const framed = interactive && ui.tty && ui.unicode;
+  let statusLines                 = () => [];
+  const { rl, keys, term } = openSessionInput({
+    stdin: input, stdout: process.stdout, stderr: process.stderr, ui, framed, below: () => statusLines(), promptWidth: textWidth(ui.unicode ? "❯ " : "> "),
+  });
+  const frame = framed ? keys : undefined;
   const say = (s        ) => console.log(s);
   // Chrome (spinner, cards, footer) is for interactive terminals only. Pipes and one-shot runs get
   // the plain text output they had before.
@@ -143,9 +246,9 @@ export async function main(argv          )                  {
   // `detail` is the coloured diff the tools built; the question is sanitized, the diff is not
   // (the tools already escaped every file character in it).
   const confirm = async (q        , detail         )                   => {
-    if (!process.stdin.isTTY) return false;
+    if (!input.isTTY) return false;
     spinner.stop();
-    if (detail) say(inCard(detail));
+    if (detail) term.write(inCard(detail) + "\n"); // with the question, on the terminal
     const ans = await rl.question(`${accent(style, "?")} ${sanitize(q)} [y/N] `);
     return /^y(es)?$/i.test(ans.trim());
   };
@@ -158,21 +261,17 @@ export async function main(argv          )                  {
   st.history = freshHistory(st);
   const ctx = { cwd, confirm, yes: args.yes, color: style.color, journal: st.journal, show: (t        ) => say(inCard(t)), get notesLoaded() { return st.notesChars > 0; } };
 
-  // The pinned bar needs a terminal on both ends; otherwise the status is an ordinary line.
-  const bar = new StatusBar(
-    process.stdout,
-    interactive && Boolean(process.stdout.isTTY) && process.env.TERM !== "dumb",
-    (s) => dim(style, s),
-  );
-  const refresh = () => {
-    if (bar.enabled) bar.update(formatStatus(statusParts(st), (process.stdout.columns ?? 80) - 1));
-  };
-  const restore = () => { spinner.stop(); bar.uninstall(); };
-  process.on("exit", restore);
-  process.stdout.on("resize", () => { bar.resize(); refresh(); });
-
-  // Known balance for the footer; refreshed in the background after each turn, never awaited.
+  // Known balance for the footer and status line; refreshed in the background after each turn.
   let balance          = { kind: "unavailable" };
+  // The status line under the input: only known values (tier, workspace, context, tokens, credit).
+  statusLines = () => renderStatusLines({
+    tier: st.tier, effort: st.effort, cwd, tokens: st.total.prompt + st.total.completion,
+    contextTokens: st.last.prompt || undefined, contextMax: CONTEXT_TOKENS, routing: st.routing, balance,
+  }, ui);
+  const refresh = () => { frame?.redraw(); };
+  // Raw mode and bracketed paste are always switched off again, also after a crash.
+  const { restore, done } = wireSession({ spinner, keys, rl, oneShot: !interactive });
+  process.stdout.on("resize", () => refresh());
   const loadBalance = async ()                   => balanceFrom(await fetchAccount(apiKey, undefined, BALANCE_TIMEOUT_MS));
   const refreshBalance = () => { void loadBalance().then((b) => { balance = b; }, () => {}); };
 
@@ -213,7 +312,9 @@ export async function main(argv          )                  {
       }
     } catch (err) {
       spinner.stop();
-      console.error(`\nerror: ${sanitize(err instanceof Error ? err.message : String(err))}`);
+      const msg = sanitize(err instanceof Error ? err.message : String(err));
+      const envNote = err instanceof ApiError && err.status === 401 && process.env.SYNQA_API_KEY?.trim() ? `\n${ENV_KEY_NOTE}` : "";
+      console.error(`\n${chrome ? accent(style, "error") : "error"}: ${msg}${envNote}`);
     }
     refresh();
   };
@@ -223,6 +324,7 @@ export async function main(argv          )                  {
       const prompt = args.rest.join(" ");
       if (!prompt) { console.error("Nothing to do. Pass a task or run in a terminal."); return 1; }
       announceNotes(st, say);
+      for (const w of startWarnings(process.env, cwd)) console.error(`Warning: ${w}`);
       await turn(prompt);
       say(dim(style, formatStatus(statusParts(st))));
       return 0;
@@ -230,24 +332,28 @@ export async function main(argv          )                  {
 
     // The balance may take a moment; the banner waits at most BALANCE_TIMEOUT_MS for it.
     balance = await loadBalance();
-    for (const line of renderBanner({ version: VERSION, tier: st.tier, cwd, notesChars: st.notesChars, balance }, ui)) say(line);
-    say(dim(style, "Type /help for commands."));
-    announceNotes(st, say);
-    bar.install();
-    refresh();
+    const warnings = startWarnings(process.env, cwd);
+    say("");
+    for (const line of renderBanner({ version: VERSION, tier: st.tier, effort: st.effort, cwd, notesChars: st.notesChars, balance, warnings }, ui)) say(line);
+    say("");
+    if (!frame) say(dim(style, "Type /help for commands."));
+    announceNotes(st, (t) => say(dim(style, t)));
     for (;;) {
-      // Without a pinned bar the status is printed above each prompt instead.
-      if (!bar.enabled) say(dim(style, formatStatus(statusParts(st))));
+      // Without the frame the status is printed above each prompt instead.
+      if (!frame) say(dim(style, formatStatus(statusParts(st))));
       let line        ;
-      try { line = (await rl.question(`${accent(style, ui.unicode ? "❯" : ">")} `)).trim(); } catch { break; }
+      try {
+        line = (frame ? await frame.ask(promptText(ui)) : keys ? await keys.askPlain(`${accent(style, ui.unicode ? "❯" : ">")} `) : await rl.question(`${accent(style, ui.unicode ? "❯" : ">")} `)).trim();
+      } catch { break; }
       if (!line) continue;
-      const r = await runCommand(line, st, { print: say, confirm, style });
+      const r = await runCommand(line, st, { print: say, confirm, style, ui });
       refresh();
       if (r.exit) break;
       if (!r.handled) await turn(line);
     }
     return 0;
   } finally {
+    done(); // a normal end: closing readline below is not an interrupt
     restore();
     rl.close();
   }

package/dist/paths.js

@@ -1,6 +1,6 @@
 import { closeSync, constants, lstatSync, openSync, realpathSync, writeSync } from "node:fs";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { configDir } from "./config.js";
 
 export class ConfineError extends Error {}
@@ -62,47 +62,164 @@ export function fold(s        )         {
   return s.normalize("NFKC").toLowerCase();
 }
 
-// Folders whose contents are credentials.
-const SENSITIVE_DIRS = new Set([".ssh", ".aws", ".gnupg"]);
+// The protected tables. isSensitivePath (file tools) and commandTouchesSecrets (shell) are both
+// built from these, so a name added here is protected everywhere at once.
+// Folders whose contents are credentials, matched as any one path segment.
+export const SENSITIVE_DIRS                    = [".ssh", ".aws", ".gnupg", ".kube", ".password-store", ".mozilla", ".azure", "keychains"];
+// Runs of path segments that hold credentials, browser profiles or tokens, matched anywhere in the
+// path (folded). Inside the home folder every dot entry and Library is protected anyway (see
+// homeHidden); these runs also protect copies of such folders elsewhere.
+export const SENSITIVE_RUNS                                   = [
+  [".config", "synqa"], [".config", "gh"], [".config", "hub"], [".config", "gcloud"], [".config", "op"], [".config", "heroku"],
+  [".config", "google-chrome"], [".config", "chromium"], [".config", "bravesoftware"], [".config", "microsoft-edge"],
+  [".docker", "config.json"], [".local", "share", "keyrings"], [".cargo", "credentials.toml"], [".gem", "credentials"],
+  [".terraform.d", "credentials.tfrc.json"], [".m2", "settings.xml"], [".oci", "config"],
+  ["library", "cookies"], ["library", "safari"], ["library", "mail"], ["library", "messages"],
+  ["library", "application support", "google", "chrome"], ["library", "application support", "chromium"],
+  ["library", "application support", "bravesoftware"], ["library", "application support", "microsoft edge"],
+  ["library", "application support", "arc"], ["library", "application support", "firefox"],
+  ["library", "application support", "1password"], ["library", "group containers"],
+];
 // Exact file names that hold secrets (compared folded).
-const SENSITIVE_NAMES = new Set([
+export const SENSITIVE_NAMES                    = [
   ".env", ".envrc", ".netrc", ".npmrc", ".pypirc", ".git-credentials", ".dev.vars", "keys.json", "credentials.json", ".yarnrc.yml", ".pgpass", ".my.cnf",
-]);
+  "_netrc", ".boto", ".s3cfg", ".vault-token", ".terraformrc", "login data", "cookies", "cookies.binarycookies", "key4.db", "logins.json",
+  ".zsh_history", ".bash_history", ".python_history", ".node_repl_history", ".psql_history", ".mysql_history", ".lesshst",
+  ".yarnrc",
+];
+// File extensions of private keys, certificates with keys, key stores and infrastructure state.
+export const SENSITIVE_EXTENSIONS                    = [
+  "pem", "key", "p12", "p8", "pfx", "jks", "keystore", "ppk", "tfvars", "tfstate", "keychain", "keychain-db", "kdbx",
+];
+// Name patterns, each with the looser form a shell command is checked with. One table for both.
+// `word` rules guess from a word in the name, so they skip source code (src/auth/credentials.ts is
+// code about credentials, not credentials).
+export const SENSITIVE_PATTERNS                                                              = [
+  { name: /^\.env\.|\.env$/, shell: /\.env/ }, // .env.local, prod.env, config.env
+  { name: /\.tfstate(\.|$)/, shell: /\.tfstate/ }, // terraform.tfstate, terraform.tfstate.backup
+  { name: /service[-_]?account.*\.json$/, shell: /service[-_]?account/ },
+  // credential(s) or secret(s) as a word ("client_secret.json", "aws-secrets.yaml"; not "secretary.ts")
+  { name: /(^|[^a-z])(credential|secret)s?([^a-z]|$)/, shell: /credential|secret/, word: true },
+  // shell and REPL histories (.zsh_history, .python_history, history): the name ends in "history"
+  { name: /history$/, shell: /history/ }, // only a name that ends in "history": history.md and chat_history.ts never match
+  { name: /^id_[a-z0-9_]+$/, shell: /\bid_[a-z0-9]/ }, // id_rsa, id_ed25519; id_rsa.pub is not matched
+];
+// Source files: a word rule never applies to these (named secret files still do).
+export const SOURCE_EXTENSIONS                    = [
+  "ts", "tsx", "js", "jsx", "mjs", "cjs", "py", "go", "rs", "rb", "java", "kt", "swift", "c", "cc", "cpp", "h", "cs", "php", "vue", "svelte",
+];
+const SOURCE_RE = new RegExp(`\\.(${SOURCE_EXTENSIONS.join("|")})$`);
+// Source files whose whole stem says secret (secrets.py, credentials.js, client_secret.ts) often
+// hold real keys: the word rules let them through, so read_file asks first and grep and glob skip
+// them. A longer name (secret_manager.go, credentials_form.ts) is ordinary code.
+export const SECRET_STEMS                    = ["secret", "secrets", "credential", "credentials", "client_secret", "client_secrets"];
+
+export function isSecretStemSource(abs        )          {
+  const name = fold(abs.split(sep).join("/")).split("/").pop() ?? "";
+  if (!SOURCE_RE.test(name)) return false;
+  return SECRET_STEMS.includes(name.slice(0, name.lastIndexOf(".")));
+}
+// First segments of SENSITIVE_RUNS that are credential folders in their own right, so a shell
+// command that names the folder (ls .docker, cat ~/.docker/*) asks too. .config and .local hold
+// much else and are covered by the home rule.
+const RUN_FOLDERS = [...new Set(SENSITIVE_RUNS.map((r) => r[0]          ))].filter((f) => f.startsWith(".") && f !== ".config" && f !== ".local");
+const NAME_SET = new Set(SENSITIVE_NAMES);
+const DIR_SET = new Set(SENSITIVE_DIRS);
 const EXAMPLE_SUFFIX = /\.(example|sample|template|dist)$/;
+const EXT_RE = new RegExp(`\\.(${SENSITIVE_EXTENSIONS.map((e) => e.replace(/[.-]/g, "\\$&")).join("|")})$`);
 
-// Files and folders that hold secrets: .env files, private keys, cloud, package manager and
-// container credentials, and this CLI's own config (which holds the API key). Names only, no file
-// is opened. Every segment is folded first (see fold).
-export function isSensitivePath(abs        , cfg         = configDir())          {
-  const norm = fold(abs.split(sep).join("/"));
-  const parts = norm.split("/").filter(Boolean);
-  if (parts.some((d) => SENSITIVE_DIRS.has(d))) return true;
-  for (let i = 0; i + 1 < parts.length; i++) {
-    if (parts[i] === ".config" && parts[i + 1] === "synqa") return true;
-    if (parts[i] === ".kube" && parts[i + 1] === "config") return true;
-    if (parts[i] === ".docker" && parts[i + 1] === "config.json") return true;
+function hasRun(parts          , run                   )          {
+  for (let i = 0; i + run.length <= parts.length; i++) {
+    if (run.every((seg, j) => parts[i + j] === seg)) return true;
   }
-  const c = fold(cfg.split(sep).join("/")).replace(/\/+$/, "");
+  return false;
+}
+
+const slashed = (p        ) => fold(p.split(sep).join("/")).replace(/\/+$/, "");
+
+// The home folder, as given and with symlinks resolved, folded.
+function homeForms(home        )           {
+  const out = [slashed(home)];
+  try {
+    out.push(slashed(realpathSync(home)));
+  } catch {
+    // a home that does not exist is compared as given
+  }
+  return out.filter((h) => h !== "" && h !== "/");
+}
+
+// Inside the home folder, everything under a dot entry at its top (~/.zsh_history, ~/.config/**,
+// ~/.cargo/**, any tool's credential store, known or not) and everything under
+// ~/Library is protected. This is the structural rule: it does not depend on naming each store.
+// A project's own dot files (~/proj/.github, ~/proj/.eslintrc) are below a normal folder and stay usable.
+export function homeHidden(abs        , home         = homedir())          {
+  const norm = slashed(abs);
+  for (const h of homeForms(home)) {
+    if (!norm.startsWith(h + "/")) continue;
+    const first = norm.slice(h.length + 1).split("/")[0] ?? "";
+    if (first.startsWith(".") || first === "library") return true;
+  }
+  return false;
+}
+
+// True when `cwd` is the home folder itself.
+export function isHomeDir(cwd        , home         = homedir())          {
+  let real = slashed(cwd);
+  try {
+    real = slashed(realpathSync(cwd));
+  } catch {
+    // compared as given
+  }
+  return homeForms(home).includes(real) || homeForms(home).includes(slashed(cwd));
+}
+
+// Files and folders that hold secrets: the home folder's dot entries and Library (homeHidden),
+// env files, private keys, cloud, package manager and container credentials, keychains, browser
+// profiles, histories, and this CLI's own config (which holds the API key). Names only, no file is
+// opened. Every segment is folded first (see fold). read_file, write_file and edit_file refuse
+// these outright; grep and glob skip them.
+export function isSensitivePath(abs        , cfg         = configDir(), home         = homedir())          {
+  if (homeHidden(abs, home)) return true;
+  const norm = slashed(abs);
+  const parts = norm.split("/").filter(Boolean);
+  if (parts.some((d) => DIR_SET.has(d))) return true;
+  if (SENSITIVE_RUNS.some((run) => hasRun(parts, run))) return true;
+  const c = slashed(cfg);
   if (c && (norm === c || norm.startsWith(c + "/"))) return true;
   const name = parts[parts.length - 1] ?? "";
   // Remotes can hold tokens: .git/config, .git/config.worktree, .git/worktrees/<name>/config, at any depth.
   if (parts.slice(0, -1).includes(".git") && (name === "config" || name.startsWith("config."))) return true;
-  if (SENSITIVE_NAMES.has(name)) return true;
-  if (name.startsWith(".env.") && !EXAMPLE_SUFFIX.test(name)) return true;
-  if (/\.(pem|key|p12|pfx|tfvars|tfstate)$/.test(name)) return true;
-  if (/^secrets\./.test(name) && !EXAMPLE_SUFFIX.test(name)) return true;
-  return /^id_[a-z0-9_]+$/.test(name); // id_rsa, id_ed25519; id_rsa.pub is not matched
+  if (NAME_SET.has(name)) return true;
+  if (EXAMPLE_SUFFIX.test(name)) return false;
+  if (EXT_RE.test(name)) return true;
+  const source = SOURCE_RE.test(name);
+  return SENSITIVE_PATTERNS.some((x) => x.name.test(name) && !(x.word && source));
 }
 
-// Names a shell command can use to reach a secret, including globs that expand to them. Heuristic:
-// it makes an unattended (--yes) command ask when it looks at secrets, it does not make bash safe.
-const SECRET_WORDS = [
-  /\.env/, /\.ssh/, /\.aws/, /\.gnupg/, /\.kube/, /\.docker/, /\.netrc/, /\.npmrc/, /\.pypirc/, /\.git-credentials/,
-  /\.dev\.vars/, /keys\.json/, /credentials/, /\.tfvars/, /\bsecrets?\b/, /\.(pem|key|p12|pfx)\b/, /\bid_[a-z0-9]/,
-  /\.config\/synqa/, /synqa\/config/, /(^|[\s/])\.[\w.-]*[*?[]/, /~\/?\./,
+const escRe = (s        ) => s.replace(/[.*+?^${}()|[\]\\/-]/g, "\\$&");
+
+// Names a shell command can use to reach a secret, including globs that expand to them, built from
+// the same tables as isSensitivePath. Heuristic: it makes an unattended (--yes) command ask when it
+// looks at secrets, it does not make bash safe.
+const SECRET_WORDS                    = [
+  ...SENSITIVE_DIRS.map((d) => new RegExp(escRe(d))),
+  ...SENSITIVE_RUNS.map((r) => new RegExp(r.map(escRe).join("/"))),
+  ...SENSITIVE_NAMES.map((n) => new RegExp(escRe(n))),
+  ...RUN_FOLDERS.map((f) => new RegExp(`${escRe(f)}\\b`)),
+  new RegExp(`\\.(${SENSITIVE_EXTENSIONS.map(escRe).join("|")})\\b`),
+  ...SENSITIVE_PATTERNS.map((x) => x.shell),
+  /\.git\/config/,
+  // Dumping the environment (where tokens live): printenv, env or export -p or set with no arguments.
+  /\bprintenv\b/, /(^|[;&|(]\s*)env\s*($|[;&|)>])/, /\bexport\s+-p\b/, /(^|[;&|(]\s*)(set|declare\s+-x)\s*($|[;&|)>])/,
+  /\.config\/synqa/, /synqa\/config/,
+  /(^|[\s/])\.[\w.-]*[*?[]/, // a dot glob such as .e* or .*
+  /~\/?\./, /\$\{?home\}?\/?\./, /~\/library/, /\$\{?home\}?\/library/, // the home folder's dot entries and Library
+  /\bsecurity\s+(find|dump|export)-/, /\.binarycookies/,
 ];
 
 export function commandTouchesSecrets(command        , cfg         = configDir())          {
+  // Escapes that can spell any name ($'\x2eenv', \056, printf '\x2e'): always ask.
+  if (/\$'|\\x[0-9a-f]{2}|\\[0-7]{3}|\\u[0-9a-f]{4}/i.test(command)) return true;
   // Quotes and backslashes are dropped first so .e""nv and .\env read as .env.
   const c = fold(command).replace(/["'\\`]/g, "");
   if (SECRET_WORDS.some((re) => re.test(c))) return true;
@@ -110,22 +227,17 @@ export function commandTouchesSecrets(command        , cfg         = configDir()
   return dir !== "" && c.includes(dir);
 }
 
-// A start folder this CLI refuses without --allow-home: the home folder or the filesystem root.
-// Returns the reason, or undefined when the folder is fine.
-export function unsafeStartDir(cwd        , home         = homedir())                     {
+// The one start folder this CLI refuses: the filesystem root, where the working directory would be
+// the whole disk. Anywhere else, the home folder included, it starts like any other coding CLI;
+// secrets there are protected by isSensitivePath, not by refusing to start. Returns the reason,
+// or undefined when the folder is fine.
+export function unsafeStartDir(cwd        )                     {
   let real        ;
-  let realHome        ;
   try {
     real = realpathSync(cwd);
   } catch {
     return undefined;
   }
-  try {
-    realHome = realpathSync(home);
-  } catch {
-    realHome = home;
-  }
   if (real === parse(real).root) return "the filesystem root";
-  if (real === realHome) return "your home folder";
   return undefined;
 }