@wrongstack/core 0.283.1 → 0.284.0

package/dist/{parallel-eternal-engine-iY2uxocj.d.ts → parallel-eternal-engine-HUrtePLd.d.ts}

@@ -1,8 +1,7 @@
-import { A as Agent, a as AgentFactory } from './agent-subagent-runner-BsuWhB28.js';
-import { B as BrainArbiter, E as EventBus } from './events-KmxSmvho.js';
-import { C as Compactor } from './compactor-BxddyCFu.js';
-import { J as JournalEntry } from './goal-store-8owBXJT2.js';
-import { D as DispatchClassifier, a as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-CrjeTB9i.js';
+import { A as Agent, a as AgentFactory, D as DispatchClassifier, b as DefaultMultiAgentCoordinator } from './multi-agent-coordinator-4RCRZKjN.js';
+import { B as BrainArbiter, E as EventBus } from './events-Bgnh43r9.js';
+import { C as Compactor } from './compactor-DQLL4HTo.js';
+import { J as JournalEntry } from './goal-store-Datpp-ar.js';
 
 /**
  * Design Studio — curated frontend/mobile UI design kits.

package/dist/{permission-B6YAtNFz.d.ts → permission-ByDKXEcG.d.ts}

@@ -1,4 +1,4 @@
-import { f as Permission, g as Tool, d as Context } from './tool-LVSLiE1s.js';
+import { f as Permission, g as Tool, d as Context } from './tool-BNlnIJvo.js';
 
 interface TrustPolicy {
     [toolNameOrPattern: string]: {

package/dist/{pipeline-ixSFe5jg.d.ts → pipeline-DGDyIohT.d.ts}

@@ -1,6 +1,6 @@
-import { g as Tool, s as TextBlock, i as ContentBlock } from './tool-LVSLiE1s.js';
+import { g as Tool, s as TextBlock, i as ContentBlock } from './tool-BNlnIJvo.js';
 import { a as MailboxAgentStatus } from './mailbox-types-BGZWrYTJ.js';
-import { H as HookEvent, f as HookMatcher, I as InProcessHook, S as ShellHook, g as HookEntry, T as ToolResultRenderMode } from './config-DkCbA3Bw.js';
+import { H as HookEvent, f as HookMatcher, I as InProcessHook, g as HookRegistrationOptions, S as ShellHook, h as HttpHook, C as ConfiguredHook, i as HookEntry, T as ToolResultRenderMode } from './config-MRqn1V-u.js';
 
 /** Model capabilities relevant to prompt composition. */
 interface ModelCapabilities {
@@ -31,10 +31,29 @@ interface BuildContext {
      */
     onlineAgents?: MailboxAgentStatus[] | undefined;
 }
+/**
+ * Stability regions for the system prompt.
+ *
+ * `core` and `session` form the provider-cache prefix and must remain byte-for-byte
+ * stable after the first request in a session. `volatile` is appended at request
+ * time and may change between turns without rewriting that prefix.
+ */
+interface SystemPromptRegions {
+    readonly core: readonly TextBlock[];
+    readonly session: readonly TextBlock[];
+    readonly volatile: readonly TextBlock[];
+}
+declare function flattenSystemPromptRegions(regions: SystemPromptRegions): TextBlock[];
 interface SystemPromptBuilder {
     build(ctx: BuildContext): Promise<TextBlock[]>;
+    /** Region-aware build used by hosts that enforce prompt-prefix stability. */
+    buildRegions?(ctx: BuildContext): Promise<SystemPromptRegions>;
 }
 
+interface LoadConfiguredHooksOptions {
+    /** Load only trusted hooks that remain active under `--no-hooks`. */
+    policyOnly?: boolean | undefined;
+}
 /**
  * Registry of lifecycle hooks (both in-process and shell). One instance is
  * shared per session: the boot path loads `config.hooks` as shell entries and
@@ -44,14 +63,16 @@ interface SystemPromptBuilder {
 declare class HookRegistry {
     private readonly entries;
     /** Register an in-process hook. Returns an unsubscribe function. */
-    registerInProcess(event: HookEvent, matcher: HookMatcher | undefined, hook: InProcessHook, owner?: string | undefined): () => void;
+    registerInProcess(event: HookEvent, matcher: HookMatcher | undefined, hook: InProcessHook, owner?: string | undefined, options?: HookRegistrationOptions): () => void;
     /**
      * Register a single shell hook. The hook is owned by the runtime (no plugin
      * name) — it survives plugin uninstalls. Returns an unsubscribe function.
      */
     registerShell(event: HookEvent, hook: ShellHook): () => void;
-    /** Bulk-load shell hooks from a `config.hooks` map. */
-    loadShellHooks(hooks: Partial<Record<HookEvent, ShellHook[]>> | undefined): void;
+    /** Register a native HTTP hook. */
+    registerHttp(event: HookEvent, hook: HttpHook): () => void;
+    /** Bulk-load command/HTTP hooks from a `config.hooks` map. */
+    loadShellHooks(hooks: Partial<Record<HookEvent, ConfiguredHook[]>> | undefined, options?: LoadConfiguredHooksOptions): void;
     /**
      * Atomically replace the shell-hook set: drop every currently-registered
      * shell entry, then load the supplied `config.hooks` map. In-process
@@ -65,7 +86,7 @@ declare class HookRegistry {
      * with the same map yields the same registry state (callers should still
      * guard at the change-detection layer to avoid wasted work).
      */
-    replaceShellHooks(hooks: Partial<Record<HookEvent, ShellHook[]>> | undefined): void;
+    replaceShellHooks(hooks: Partial<Record<HookEvent, ConfiguredHook[]>> | undefined, options?: LoadConfiguredHooksOptions): void;
     /** All entries registered for an event, in registration order. */
     list(event: HookEvent): readonly HookEntry[];
     /** True when any entry is registered for the event. */
@@ -307,4 +328,4 @@ declare class Pipeline<T> {
     private ensureUnique;
 }
 
-export { type BuildContext as B, Container as C, type Decorator as D, type Factory as F, HookRegistry as H, type MiddlewareHandler as M, type NextFn as N, Pipeline as P, type ReadonlyPipeline as R, type SystemPromptBuilder as S, type Token as T, type Renderer as a, type Middleware as b, type ModelCapabilities as c, type BindOptions as d, type PipelineOptions as e, hookMatcherMatches as h };
+export { type BuildContext as B, Container as C, type Decorator as D, type Factory as F, HookRegistry as H, type MiddlewareHandler as M, type NextFn as N, Pipeline as P, type ReadonlyPipeline as R, type SystemPromptBuilder as S, type Token as T, type Renderer as a, type Middleware as b, type ModelCapabilities as c, type SystemPromptRegions as d, type BindOptions as e, type PipelineOptions as f, flattenSystemPromptRegions as g, hookMatcherMatches as h };

package/dist/{provider-model-resolve-DIxKL_T-.d.ts → provider-model-resolve-o2hHLs79.d.ts}

@@ -1,7 +1,7 @@
-import { P as Provider, M as Message } from './tool-LVSLiE1s.js';
-import { M as MessageSelector, S as SelectorResult } from './selector-Bx2HgUkU.js';
+import { P as Provider, M as Message } from './tool-BNlnIJvo.js';
+import { M as MessageSelector, S as SelectorResult } from './selector-D8O6B_Rm.js';
 import { M as ModeStore, a as ModeConfig, b as Mode } from './mode-CZlO9iU1.js';
-import { M as ModelsRegistry, c as ModelsDevPayload, d as ResolvedProvider, R as ResolvedModel, W as WireFamily, e as ModelsDevModel } from './config-DkCbA3Bw.js';
+import { M as ModelsRegistry, c as ModelsDevPayload, d as ResolvedProvider, R as ResolvedModel, W as WireFamily, e as ModelsDevModel } from './config-MRqn1V-u.js';
 
 /**
  * Offline **floor** for the ChatGPT "Sign in with ChatGPT" (`openai-codex`)

package/dist/{provider-runner-oQhDaZmH.d.ts → provider-runner-ChL-kVg6.d.ts}

@@ -1,8 +1,8 @@
-import { E as EventBus } from './events-KmxSmvho.js';
+import { E as EventBus } from './events-Bgnh43r9.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { T as Tracer } from './observability-D-HZN_mF.js';
-import { P as Provider, c as Request, d as Context, e as Response } from './tool-LVSLiE1s.js';
-import { R as RetryPolicy } from './retry-policy-V67lBOJz.js';
+import { P as Provider, c as Request, d as Context, e as Response } from './tool-BNlnIJvo.js';
+import { R as RetryPolicy } from './retry-policy-CQ7KwXJa.js';
 
 /**
  * Options passed to a ProviderRunner when calling the provider.

package/dist/{retry-policy-V67lBOJz.d.ts → retry-policy-CQ7KwXJa.d.ts}

@@ -1,4 +1,4 @@
-import { d as Context, e as Response, h as ProviderError } from './tool-LVSLiE1s.js';
+import { d as Context, e as Response, h as ProviderError } from './tool-BNlnIJvo.js';
 
 type RecoveryDecision = {
     /**
@@ -32,7 +32,7 @@ interface ErrorHandler {
      */
     recover(err: unknown, ctx: Context): Promise<RecoveryDecision | null>;
     classify(err: unknown): {
-        kind: 'rate_limit' | 'overloaded' | 'server' | 'client' | 'network' | 'abort' | 'context_overflow' | 'unknown';
+        kind: 'rate_limit' | 'overloaded' | 'server' | 'client' | 'network' | 'abort' | 'context_overflow' | 'content_filter' | 'unknown';
         retryable: boolean;
     };
 }

package/dist/{secret-vault-D7jeyXUQ.d.ts → secret-vault-DxohkUBc.d.ts}

@@ -1,6 +1,6 @@
-import { g as Tool, d as Context } from './tool-LVSLiE1s.js';
+import { g as Tool, d as Context } from './tool-BNlnIJvo.js';
 import { I as InputReader } from './input-reader-E-ffP2ee.js';
-import { P as PermissionPolicy, a as PermissionDecision } from './permission-B6YAtNFz.js';
+import { P as PermissionPolicy, a as PermissionDecision } from './permission-ByDKXEcG.js';
 import { S as SecretScrubber } from './secret-scrubber-3MHDDAtm.js';
 import { L as Logger } from './logger-B63L5bTg.js';
 import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
@@ -102,6 +102,7 @@ declare class DefaultPermissionPolicy implements PermissionPolicy {
     evaluate(tool: Tool, input: unknown, ctx: Context): Promise<PermissionDecision>;
     private isDestructiveByCapability;
     private isDestructiveYoloCall;
+    private isSensitiveReadCall;
     trust(rule: {
         tool: string;
         pattern: string;

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { A as AutoApprovePermissionPolicy, a as DefaultPermissionPolicy, b as DefaultSecretScrubber, D as DefaultSecretVault, P as PermissionPolicyOptions, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, c as rotateConfigKeys } from '../secret-vault-D7jeyXUQ.js';
-export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-BEFWNZYs.js';
-import '../tool-LVSLiE1s.js';
+export { A as AutoApprovePermissionPolicy, a as DefaultPermissionPolicy, b as DefaultSecretScrubber, D as DefaultSecretVault, P as PermissionPolicyOptions, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, c as rotateConfigKeys } from '../secret-vault-DxohkUBc.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-CbyuOE5y.js';
+import '../tool-BNlnIJvo.js';
 import '../input-reader-E-ffP2ee.js';
-import '../permission-B6YAtNFz.js';
+import '../permission-ByDKXEcG.js';
 import '../secret-scrubber-3MHDDAtm.js';
 import '../logger-B63L5bTg.js';
 import '../secret-vault-BAKpgFw_.js';

package/dist/security/index.js

@@ -1131,6 +1131,10 @@ var ToolCapabilities = {
   SUBAGENT_SPAWN: "subagent.spawn",
   /** Can inspect fleet/subagent coordination state without mutating it. */
   COORDINATION_FLEET_READ: "coordination.fleet.read",
+  /** Can publish attributed, schema-checked events onto the fleet bus. */
+  COORDINATION_FLEET_EMIT: "coordination.fleet.emit",
+  /** Can submit a task-local structured result to the parent Director. */
+  COORDINATION_RESULT_SUBMIT: "coordination.result.submit",
   /** Can read or write inter-agent mailbox messages. */
   COORDINATION_MAIL: "coordination.mail",
   /** Can schedule, inspect, or cancel in-session cron jobs. */
@@ -1167,7 +1171,8 @@ var DANGEROUS_FOR_SUBAGENTS = [
   ToolCapabilities.PACKAGE_INSTALL,
   // Read-only fleet visibility (fleet_status) — peer awareness has no blast
   // radius and every fleet worker should coordinate around its peers.
-  ToolCapabilities.COORDINATION_FLEET_READ
+  ToolCapabilities.COORDINATION_FLEET_READ,
+  ToolCapabilities.COORDINATION_RESULT_SUBMIT
 ];
 function hasDangerousCapabilityForSubagents(toolOrCaps) {
   if (!toolOrCaps) return false;
@@ -1239,6 +1244,11 @@ var CATASTROPHIC_PATTERNS = [
   /:\(\)\s*\{\s*:\|:&\s*\}\s*;/
   // classic fork bomb
 ];
+var HIGH_IMPACT_PATTERNS = [
+  /\b(?:curl|wget|fetch|httpie|http|irm|iwr|Invoke-WebRequest|Invoke-RestMethod)\b[\s\S]{0,300}\|\s*(?:sudo\s+)?(?:sh|bash|zsh|fish|pwsh|powershell|iex|Invoke-Expression)\b/i,
+  /\b(?:powershell|pwsh)(?:\.exe)?\b[\s\S]{0,120}-(?:enc|encodedcommand)\b/i,
+  /\b(?:shutdown|reboot)\b/i
+];
 var CATASTROPHIC_POSIX_ROOTS = /* @__PURE__ */ new Set([
   "/etc",
   "/usr",
@@ -1286,6 +1296,121 @@ function pathLooksInsideProject(rawPath, projectRoot) {
 function tokenizeShell(command) {
   return command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => token.replace(/^['"]|['"]$/g, "")) ?? [];
 }
+function commandSegment(tokens, start) {
+  const out = [];
+  for (let i = start; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (token === void 0 || SHELL_OPERATORS.has(token)) break;
+    out.push(token);
+  }
+  return out;
+}
+function hasShortFlag(args, letters) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const arg of args) {
+    if (!arg.startsWith("-") || arg.startsWith("--")) continue;
+    for (const ch of arg.replace(/^-+/, "")) seen.add(ch.toLowerCase());
+  }
+  return letters.split("").every((letter) => seen.has(letter));
+}
+function hasRecursiveForceDelete(command, projectRoot) {
+  const tokens = tokenizeShell(command);
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]?.toLowerCase();
+    if (!token) continue;
+    if (token === "rm" || token === "rmdir") {
+      const args = commandSegment(tokens, i + 1);
+      const recursiveForce = hasShortFlag(args, "rf") || args.some((arg) => arg === "--recursive") && args.some((arg) => arg === "--force");
+      if (recursiveForce) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+        if (targets.length > 0 && targets.every((target) => target.trim().length === 0)) {
+          continue;
+        }
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+    if (token === "remove-item" || token === "ri") {
+      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
+      const recurse = args.some((arg) => arg === "-recurse" || arg === "-r");
+      const force = args.some((arg) => arg === "-force" || arg === "-f");
+      if (recurse && force && !args.includes("-whatif")) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !SHELL_OPERATORS.has(arg));
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+    if (token === "rd" || token === "rmdir") {
+      const args = commandSegment(tokens, i + 1).map((arg) => arg.toLowerCase());
+      if (args.includes("/s")) {
+        const targets = args.filter((arg) => !arg.startsWith("-") && !arg.startsWith("/") && !SHELL_OPERATORS.has(arg));
+        if (targets.length === 0) return true;
+        if (targets.some(isCatastrophicDeleteTarget)) return true;
+        if (targets.some((target) => !pathLooksInsideProject(target, projectRoot))) return true;
+      }
+    }
+  }
+  return false;
+}
+function hasGitHistoryRewrite(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i] !== "git") continue;
+    const args = commandSegment(tokens, i + 1);
+    if (args.includes("reset") && args.some((arg) => arg === "--hard" || arg.startsWith("--hard="))) {
+      return true;
+    }
+    const cleanIdx = args.indexOf("clean");
+    if (cleanIdx >= 0) {
+      const cleanArgs = args.slice(cleanIdx + 1);
+      if (cleanArgs.some((arg) => arg === "-f" || arg === "--force" || /^-[a-z]*f[a-z]*$/i.test(arg))) {
+        return true;
+      }
+    }
+    const pushIdx = args.indexOf("push");
+    if (pushIdx >= 0) {
+      const pushArgs = args.slice(pushIdx + 1);
+      if (pushArgs.some(
+        (arg) => arg === "-f" || arg === "--force" || arg === "--force-with-lease" || arg.startsWith("--force=") || arg.startsWith("--force-with-lease=")
+      )) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function hasExternalPublish(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    const cmd = tokens[i];
+    if (!cmd) continue;
+    const args = commandSegment(tokens, i + 1);
+    if (["npm", "pnpm", "yarn", "bun"].includes(cmd) && (args.includes("publish") || args.includes("deploy"))) {
+      return true;
+    }
+    if (cmd === "cargo" && (args.includes("publish") || args.includes("yank"))) return true;
+    if ((cmd === "docker" || cmd === "podman") && args.includes("push")) return true;
+    if (cmd === "kubectl") {
+      const deleteIdx = args.indexOf("delete");
+      if (deleteIdx >= 0 && (args[deleteIdx + 1] === "namespace" || args[deleteIdx + 1] === "ns")) {
+        return true;
+      }
+      if (args.includes("drain")) return true;
+    }
+  }
+  return false;
+}
+function hasFindExec(command) {
+  const tokens = tokenizeShell(command).map((token) => token.toLowerCase());
+  for (let i = 0; i < tokens.length; i++) {
+    if (tokens[i] !== "find") continue;
+    const args = commandSegment(tokens, i + 1);
+    if (args.some((arg) => arg === "-exec" || arg === "-ok" || arg === "-execdir")) return true;
+  }
+  return false;
+}
 function isCatastrophicDeleteTarget(rawTarget) {
   const t = rawTarget.replace(/^['"]|['"]$/g, "").trim();
   if (!t) return false;
@@ -1340,11 +1465,16 @@ function hasCatastrophicDelete(command) {
   }
   return false;
 }
-function isClearlyDestructiveBashCommand(command, _projectRoot) {
+function isClearlyDestructiveBashCommand(command, projectRoot) {
   const trimmed = command.trim();
   if (!trimmed) return false;
+  if (hasRecursiveForceDelete(trimmed, projectRoot)) return true;
+  if (hasGitHistoryRewrite(trimmed)) return true;
+  if (hasExternalPublish(trimmed)) return true;
+  if (hasFindExec(trimmed)) return true;
   if (hasCatastrophicDelete(trimmed)) return true;
   if (CATASTROPHIC_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
+  if (HIGH_IMPACT_PATTERNS.some((pattern) => pattern.test(trimmed))) return true;
   return false;
 }
 
@@ -1361,6 +1491,64 @@ function shellCommandLineFromInput(input) {
   const renderedArgs = args.filter((arg) => typeof arg === "string").map((arg) => /\s/.test(arg) ? `"${arg.replace(/"/g, '\\"')}"` : arg);
   return [command, ...renderedArgs].join(" ");
 }
+var SENSITIVE_READ_PATHS = [
+  /(?:^|[\\/])\.env(?:[.\w-]*)?$/i,
+  /(?:^|[\\/])\.npmrc$/i,
+  /(?:^|[\\/])\.pypirc$/i,
+  /(?:^|[\\/])\.netrc$/i,
+  /(?:^|[\\/])id_(?:rsa|dsa|ecdsa|ed25519)$/i,
+  /(?:^|[\\/])\.aws[\\/]credentials$/i,
+  /(?:^|[\\/])\.kube[\\/]config$/i,
+  /(?:^|[\\/])(?:secrets?|tokens?|credentials?|private[_-]?keys?)$/i,
+  /(?:^|[\\/])[^\\/]*(?:secret|token|credential|private[_-]?key)[^\\/]*(?:\.json|\.ya?ml|\.toml|\.ini|\.txt|\.env|\.properties|\.key|\.pem)$/i
+];
+var SHELL_READ_VERBS = /* @__PURE__ */ new Set([
+  "cat",
+  "type",
+  "get-content",
+  "gc",
+  "more",
+  "less",
+  "head",
+  "tail",
+  "grep",
+  "rg",
+  "sed",
+  "awk",
+  "findstr",
+  "select-string",
+  "strings",
+  "cp",
+  "copy",
+  "scp"
+]);
+function stripShellQuotes(value) {
+  return value.replace(/^['"]|['"]$/g, "");
+}
+function pathLooksSensitive(rawPath) {
+  const normalized = stripShellQuotes(rawPath).replace(/\\/g, "/");
+  return SENSITIVE_READ_PATHS.some((pattern) => pattern.test(normalized));
+}
+function inputPathLooksSensitive(input) {
+  if (!input || typeof input !== "object") return false;
+  const obj = input;
+  for (const key of ["path", "file", "file_path", "filePath", "target", "targetPath"]) {
+    const value = obj[key];
+    if (typeof value === "string" && pathLooksSensitive(value)) return true;
+  }
+  return false;
+}
+function shellCommandReadsSensitivePath(command) {
+  const tokens = command.match(/"[^"]*"|'[^']*'|\S+/g)?.map((token) => stripShellQuotes(token).toLowerCase()) ?? [];
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i];
+    if (!token) continue;
+    if (!SHELL_READ_VERBS.has(token)) continue;
+    const rest = tokens.slice(i + 1);
+    if (rest.some((arg) => pathLooksSensitive(arg))) return true;
+  }
+  return false;
+}
 var DefaultPermissionPolicy = class {
   policy = {};
   loaded = false;
@@ -1543,6 +1731,34 @@ var DefaultPermissionPolicy = class {
       this._evalCache.set(cacheKey, decision);
       return decision;
     }
+    if (!this.yolo && this.isSensitiveReadCall(tool, input)) {
+      if (this.promptDelegate) {
+        const userDecision = await this.promptDelegate(tool, input, subject ?? tool.name);
+        if (userDecision === "always") {
+          await this.trust({ tool: tool.name, pattern: subject ?? tool.name });
+          return {
+            permission: "auto",
+            source: "user",
+            reason: "user always-allowed sensitive read"
+          };
+        }
+        if (userDecision === "deny") {
+          await this.deny({ tool: tool.name, pattern: subject ?? tool.name });
+          return { permission: "deny", source: "user", reason: "user denied sensitive read" };
+        }
+        return {
+          permission: userDecision === "yes" ? "auto" : "deny",
+          source: "user",
+          reason: "sensitive read user decision"
+        };
+      }
+      return {
+        permission: "confirm",
+        source: "default",
+        riskTier: "standard",
+        reason: "sensitive file read needs explicit approval"
+      };
+    }
     if (this.yolo) {
       const decision = { permission: "auto", source: "yolo" };
       this._evalCache.set(cacheKey, decision);
@@ -1627,6 +1843,20 @@ var DefaultPermissionPolicy = class {
     }
     return tool.riskTier === "destructive";
   }
+  isSensitiveReadCall(tool, input) {
+    const isReadTool = hasCapability(tool, ToolCapabilities.FS_READ) || tool.name === "read" || tool.name === "grep" || tool.name === "glob" || tool.name === "tree";
+    if (isReadTool && inputPathLooksSensitive(input)) return true;
+    const hasShellCap = hasCapability(tool, [
+      ToolCapabilities.SHELL_ARBITRARY,
+      ToolCapabilities.SHELL_RESTRICTED,
+      ToolCapabilities.SHELL_EXEC
+    ]);
+    if (!hasShellCap && tool.name !== "bash" && tool.name !== "shell" && tool.name !== "exec") {
+      return false;
+    }
+    const command = shellCommandLineFromInput(input);
+    return command ? shellCommandReadsSensitivePath(command) : false;
+  }
   async trust(rule) {
     if (!this.loaded) await this.reload();
     const entry = this.policy[rule.tool] ?? {};