auto-mode 0.9.0 → 0.10.0

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { g as string, h as strictObject, l as DEFAULT_DENIAL_BUDGET, m as number, n as parseActionRequest, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-CK9sRJpa.js";
+import { g as string, h as strictObject, l as DEFAULT_DENIAL_BUDGET, m as number, n as parseActionRequest, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-1xtCI2is.js";
 import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";

package/dist/index.d.ts

@@ -115,7 +115,7 @@ interface DecisionDiagnostics {
 }
 //#endregion
 //#region src/classify-action.d.ts
-type DecidingStage = 'local' | 'jev' | 'messages' | 'retry';
+type DecidingStage = 'local' | 'containment' | 'jev' | 'messages' | 'retry';
 interface ActionOutcome {
   readonly verdict: Verdict | null;
   readonly decidingStage: DecidingStage;

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveApiKey, f as resolveConfigPath, i as classifyLocally, n as parseActionRequest, o as parseModelVerdict, p as PRESETS, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-CK9sRJpa.js";
+import { a as classifyWithModel, c as DEFAULT_CONFIG, d as resolveApiKey, f as resolveConfigPath, i as classifyLocally, n as parseActionRequest, o as parseModelVerdict, p as PRESETS, r as classifyAction, s as loadPolicy, t as renderVerdict, u as loadConfig } from "./render-verdict-1xtCI2is.js";
 export { DEFAULT_CONFIG, PRESETS, classifyAction, classifyLocally, classifyWithModel, loadConfig, loadPolicy, parseActionRequest, parseModelVerdict, renderVerdict, resolveApiKey, resolveConfigPath };

package/dist/{render-verdict-CK9sRJpa.js → render-verdict-1xtCI2is.js}

@@ -5569,6 +5569,764 @@ async function loadClaudeRules(path) {
 		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
 	};
 }
+//#endregion
+//#region src/rules/split-shell-command.ts
+function splitShellCommand(command) {
+	const segments = [];
+	let current = "";
+	let quote = null;
+	let unparsed = false;
+	let i = 0;
+	const collectSegment = () => {
+		const text = current.trim();
+		if (text !== "") segments.push({ text });
+		current = "";
+	};
+	while (i < command.length) {
+		const ch = command.charAt(i);
+		if (quote !== null) {
+			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
+			if (ch === quote) quote = null;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			quote = ch;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (ch === "\\") {
+			current += command.slice(i, i + 2);
+			i += 2;
+			continue;
+		}
+		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
+			unparsed = true;
+			current += ch;
+			i += 1;
+			continue;
+		}
+		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
+			collectSegment();
+			i += 2;
+			continue;
+		}
+		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
+			collectSegment();
+			i += 1;
+			continue;
+		}
+		current += ch;
+		i += 1;
+	}
+	collectSegment();
+	return {
+		segments,
+		hasUnparsedConstruct: unparsed || quote !== null
+	};
+}
+//#endregion
+//#region src/containment/collect-scope-findings.ts
+function collectScopeFindings(action, scope) {
+	const filePath = action.input["file_path"] ?? action.input["notebook_path"];
+	const command = action.input["command"];
+	const findings = [
+		...FILE_WRITE_TOOLS.has(action.tool) && typeof filePath === "string" ? collectTargetFindings(action.cwd, filePath, scope) : [],
+		...action.tool.startsWith("mcp__") ? collectToolFindings(action, scope) : [],
+		...action.tool === "Bash" && typeof command === "string" ? collectCommandFindings(command, action.cwd, scope) : []
+	];
+	return findings.filter((finding, index) => findings.findIndex((other) => other.kind === finding.kind && other.target === finding.target) === index);
+}
+const FILE_WRITE_TOOLS = /* @__PURE__ */ new Set([
+	"Edit",
+	"MultiEdit",
+	"Write",
+	"NotebookEdit"
+]);
+function collectTargetFindings(directory, target, scope) {
+	const path = resolvePath(directory, target, scope.home);
+	return path === null ? [] : collectPathFindings(path, scope);
+}
+const CREDENTIAL_PATHS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".gitconfig",
+	".netrc",
+	".npmrc",
+	".config/gh"
+];
+function collectPathFindings(path, scope) {
+	if (CREDENTIAL_PATHS.some((entry) => isUnder(path, join(scope.home, entry)))) return [{
+		kind: "credential",
+		target: path
+	}];
+	return isInScope(path, scope) ? [] : [{
+		kind: "path",
+		target: path
+	}];
+}
+function collectToolFindings(action, scope) {
+	const verb = action.tool.split("__").at(-1) ?? "";
+	if (!/merge|create|comment|update|delete|push|close|review/u.test(verb)) return [];
+	const number = action.input["pullNumber"] ?? action.input["pull_number"] ?? action.input["issue_number"];
+	return !verb.includes("merge") && typeof number === "number" && scope.pullRequests.includes(number) ? [] : [{
+		kind: "remote-write",
+		target: action.tool
+	}];
+}
+const PATH_WRITERS = /* @__PURE__ */ new Set([
+	"rm",
+	"rmdir",
+	"shred",
+	"truncate",
+	"chmod",
+	"chown"
+]);
+const DESTINATION_WRITERS = /* @__PURE__ */ new Set([
+	"cp",
+	"mv",
+	"rsync",
+	"ln"
+]);
+function collectCommandFindings(command, cwd, scope) {
+	const findings = [];
+	const hasPipe = /(?<!\|)\|(?!\|)/u.test(command);
+	let directory = cwd;
+	for (const segment of splitShellCommand(command).segments) {
+		const [name, ...args] = getCommandWords(splitWords$1(segment.text));
+		for (const target of collectRedirectTargets(segment.text)) findings.push(...collectTargetFindings(directory, target, scope));
+		if (name === void 0) continue;
+		if (name === "cd" && hasPipe) directory = null;
+		else if (name === "cd") directory = args[0] === void 0 ? scope.home : resolvePath(directory, args[0], scope.home);
+		else findings.push(...collectProgramFindings(name, args, directory, cwd, scope));
+	}
+	return findings;
+}
+function collectProgramFindings(name, args, directory, cwd, scope) {
+	const resolve = (path) => collectTargetFindings(directory, path, scope);
+	const operands = args.filter((word) => !word.startsWith("-"));
+	if (name === "git") return collectGitFindings(args, directory, cwd, scope);
+	if (name === "gh") return collectGhFindings(args, scope);
+	if (PATH_WRITERS.has(name)) return operands.flatMap((path) => resolve(path));
+	if (DESTINATION_WRITERS.has(name)) return collectCopyFindings(name, args, operands).flatMap((path) => resolve(path));
+	if (name === "find" && args.some((word) => word === "-delete" || word === "-exec")) return operands.slice(0, 1).flatMap((path) => resolve(path));
+	if ((name === "perl" || name === "sed") && args.some((word) => /^-\w*i/u.test(word))) return collectInPlaceFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh-keygen") return collectKeygenFiles(args).flatMap((path) => resolve(path));
+	if (name === "ssh") {
+		const logIndex = args.indexOf("-E");
+		const log = logIndex === -1 ? void 0 : args[logIndex + 1];
+		return [...log === void 0 ? [] : resolve(log), ...collectSSHFindings(args)];
+	}
+	if (name === "scp") {
+		const destination = collectSSHOperands(args).at(-1);
+		if (destination === void 0 || /^[^/]+:/u.test(destination)) return destination === void 0 ? [] : [{
+			kind: "remote-write",
+			target: "scp"
+		}];
+		return resolve(destination);
+	}
+	if (name === "curl") return collectCurlFindings(args);
+	const finding = findProgramFinding(name, args);
+	return finding === null ? [] : [finding];
+}
+function collectCopyFindings(name, args, operands) {
+	const optionIndex = args.findIndex((word) => word === "-t" || word === "--target-directory");
+	let targetDirectory = args.find((word) => word.startsWith("--target-directory="))?.slice(19);
+	if (targetDirectory === void 0 && optionIndex !== -1) targetDirectory = args[optionIndex + 1];
+	if (targetDirectory !== void 0) {
+		const sources = operands.filter((word) => word !== targetDirectory);
+		return [targetDirectory, ...name === "mv" ? sources : []];
+	}
+	if (operands.length < 2) return [];
+	return [operands.at(-1) ?? "", ...name === "mv" ? operands.slice(0, -1) : []];
+}
+const KEYGEN_READ_OPTIONS = /* @__PURE__ */ new Set([
+	"-l",
+	"-y",
+	"-F",
+	"-B",
+	"-R"
+]);
+function collectKeygenFiles(args) {
+	if (args.some((word) => KEYGEN_READ_OPTIONS.has(word))) return [];
+	const index = args.indexOf("-f");
+	const file = index === -1 ? void 0 : args[index + 1];
+	return file === void 0 ? [] : [file];
+}
+const SSH_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-b",
+	"-c",
+	"-D",
+	"-E",
+	"-F",
+	"-i",
+	"-J",
+	"-l",
+	"-L",
+	"-m"
+]);
+const SSH_MORE_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+	"-o",
+	"-p",
+	"-P",
+	"-Q",
+	"-R",
+	"-S",
+	"-W",
+	"-w"
+]);
+function collectSSHOperands(args) {
+	const operands = [];
+	for (let index = 0; index < args.length; index += 1) {
+		const word = args[index] ?? "";
+		if (operands.length > 0 || !word.startsWith("-")) operands.push(word);
+		else if (SSH_VALUE_OPTIONS.has(word) || SSH_MORE_VALUE_OPTIONS.has(word)) index += 1;
+	}
+	return operands;
+}
+const SSH_READS = /* @__PURE__ */ new Set([
+	"cat",
+	"df",
+	"du",
+	"free",
+	"head",
+	"id",
+	"ls",
+	"ps",
+	"pwd",
+	"stat",
+	"tail",
+	"uname",
+	"uptime",
+	"whoami"
+]);
+function collectSSHFindings(args) {
+	const [host, ...remote] = collectSSHOperands(args);
+	if (host === void 0) return [];
+	const command = remote.join(" ");
+	const [program] = command.trim().split(/\s+/u);
+	return SSH_READS.has(program ?? "") && !/[;&|<>`\n\r]|\$\(/u.test(command) ? [] : [{
+		kind: "remote-write",
+		target: "ssh"
+	}];
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"0.0.0.0"
+]);
+function collectCurlFindings(args) {
+	const joined = args.join(" ");
+	const isUpload = args.some((word) => /^-[a-zA-Z]*[dFT]$|^--(?:data\S*|form|upload-file|json)$/u.test(word));
+	const isWriteMethod = /(?:-X\s*|--request\s+)(?:POST|PUT|PATCH|DELETE)/u.test(joined);
+	if (!isUpload && !isWriteMethod) return [];
+	const hosts = args.filter((word) => /^(?:https?:\/\/|localhost\b|127\.)/u.test(word)).map((word) => /^(?:https?:\/\/)?(?<host>\[[^\]]+\]|[^/:?#\s]+)/u.exec(word)?.groups?.["host"]?.toLowerCase() ?? "");
+	return hosts.length > 0 && hosts.every((host) => LOCAL_HOSTS.has(host)) ? [] : [{
+		kind: "remote-write",
+		target: "curl upload"
+	}];
+}
+const GIT_DIRECTORY_WRITES = /* @__PURE__ */ new Set([
+	"clean",
+	"reset",
+	"checkout",
+	"switch",
+	"merge",
+	"commit",
+	"rm",
+	"stash",
+	"push"
+]);
+function collectGitFindings(args, directory, cwd, scope) {
+	let gitDirectory = directory;
+	let index = 0;
+	while (index < args.length && args[index]?.startsWith("-") === true) {
+		const option = args[index];
+		if (option === "-C") gitDirectory = resolvePath(gitDirectory, args[index + 1] ?? "", scope.home);
+		index += option === "-C" || option === "-c" ? 2 : 1;
+	}
+	const subcommand = args[index] ?? "";
+	const rest = args.slice(index + 1);
+	const operands = rest.filter((word) => !word.startsWith("-"));
+	const findings = [];
+	if (gitDirectory !== null && GIT_DIRECTORY_WRITES.has(subcommand) && !isInScope(gitDirectory, scope)) findings.push({
+		kind: "path",
+		target: gitDirectory
+	});
+	if (subcommand === "worktree" && operands[0] === "remove" && operands[1] !== void 0) findings.push(...collectTargetFindings(gitDirectory, operands[1], scope));
+	if (subcommand === "branch" && rest.some((word) => /^-(?:d|D|-delete)$/u.test(word))) for (const branch of operands.filter((word) => !scope.branches.includes(word))) findings.push({
+		kind: "branch",
+		target: branch
+	});
+	const isConfigRead = rest.some((word) => /^--(?:get|get-all|get-regexp|list)$|^-l$/u.test(word));
+	if (subcommand === "config" && rest.includes("--global") && !isConfigRead) findings.push({
+		kind: "credential",
+		target: `git config ${operands[0] ?? ""}`
+	});
+	if (subcommand === "push") {
+		const currentBranch = gitDirectory === cwd ? scope.currentBranch : null;
+		findings.push(...collectPushFindings(rest, operands, currentBranch, scope));
+	}
+	return findings;
+}
+function collectPushFindings(rest, operands, currentBranch, scope) {
+	const [remote, ...refspecs] = operands;
+	const findings = [];
+	if (rest.includes("--all") || rest.includes("--mirror")) findings.push({
+		kind: "branch",
+		target: "--all"
+	});
+	if (remote !== void 0 && !isUnresolved(remote) && !isOwnedRemote(remote, scope)) findings.push({
+		kind: "remote-write",
+		target: remote
+	});
+	const destinations = refspecs.length === 0 && !rest.includes("--tags") ? ["HEAD"] : refspecs;
+	for (const refspec of destinations) {
+		const named = (refspec.split(":").at(-1) ?? refspec).replace(/^\+/u, "").replace(/^refs\/heads\//u, "");
+		const branch = named === "HEAD" ? currentBranch : named;
+		if (branch !== null && !isUnresolved(branch) && !branch.startsWith("refs/tags/") && !scope.branches.includes(branch)) findings.push({
+			kind: "branch",
+			target: branch
+		});
+	}
+	return findings;
+}
+function isUnresolved(word) {
+	return /[$`]/u.test(word);
+}
+function isOwnedRemote(remote, scope) {
+	if (scope.remotes.some((entry) => entry.name === remote)) return true;
+	const slug = toRepositorySlug(remote);
+	return slug !== null && scope.remotes.some((entry) => toRepositorySlug(entry.url) === slug);
+}
+function toRepositorySlug(reference) {
+	const match = /^(?:[a-z+]+:\/\/)?(?:[^@/]+@)?(?<host>[^/:]+)[:/](?<owner>[^/]+)\/(?<name>[^/]+?)(?:\.git)?\/?$/iu.exec(reference);
+	if (match?.groups === void 0) return null;
+	const parts = match.groups;
+	return `${parts["host"] ?? ""}/${parts["owner"] ?? ""}/${parts["name"] ?? ""}`.toLowerCase();
+}
+const GH_PR_WRITES = /* @__PURE__ */ new Set([
+	"comment",
+	"merge",
+	"edit",
+	"close",
+	"review",
+	"ready",
+	"reopen"
+]);
+const GH_REMOTE_WRITES = /* @__PURE__ */ new Set([
+	"gist",
+	"release",
+	"repo",
+	"ruleset",
+	"label",
+	"workflow"
+]);
+const GH_CREDENTIAL_WRITES = /* @__PURE__ */ new Set([
+	"secret",
+	"variable",
+	"ssh-key",
+	"gpg-key"
+]);
+const GH_READS = /* @__PURE__ */ new Set([
+	"list",
+	"view",
+	"clone",
+	"status",
+	"checks",
+	"diff"
+]);
+function collectGhFindings(args, scope) {
+	const group = args[0] ?? "";
+	const verb = args[1] ?? "";
+	if (group === "pr" && GH_PR_WRITES.has(verb)) {
+		const number = Number(args.slice(2).find((word) => /^\d+$/u.test(word)));
+		const repoIndex = args.findIndex((word) => word === "--repo" || word === "-R");
+		const repo = repoIndex === -1 ? void 0 : args[repoIndex + 1];
+		return verb !== "merge" && scope.pullRequests.includes(number) && (repo === void 0 || isCheckoutRepository(repo, scope)) ? [] : [{
+			kind: "remote-write",
+			target: `gh pr ${verb}`
+		}];
+	}
+	if (group === "issue" && verb !== "" && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh issue ${verb}`
+	}];
+	if (group === "api") return collectGhAPIFindings(args.slice(1), scope);
+	if (group === "auth" && [
+		"refresh",
+		"login",
+		"logout"
+	].includes(verb)) return [{
+		kind: "credential",
+		target: `gh auth ${verb}`
+	}];
+	if (GH_CREDENTIAL_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "credential",
+		target: `gh ${group} ${verb}`
+	}];
+	if (GH_REMOTE_WRITES.has(group) && !GH_READS.has(verb)) return [{
+		kind: "remote-write",
+		target: `gh ${group} ${verb}`
+	}];
+	return [];
+}
+function isCheckoutRepository(repo, scope) {
+	const wanted = repo.toLowerCase().replace(/\.git$/u, "");
+	return scope.remotes.some((remote) => {
+		const slug = toRepositorySlug(remote.url);
+		return slug !== null && (slug === wanted || slug.endsWith(`/${wanted}`));
+	});
+}
+function collectGhAPIFindings(args, scope) {
+	const endpoint = args.find((word) => !word.startsWith("-")) ?? "";
+	if (endpoint === "graphql") return args.some((word) => /\bmutation\b/u.test(word)) ? [{
+		kind: "remote-write",
+		target: "gh api graphql mutation"
+	}] : [];
+	const methodIndex = args.findIndex((word) => word === "-X" || word === "--method");
+	const method = methodIndex === -1 ? null : (args[methodIndex + 1] ?? "").toUpperCase();
+	const hasFields = args.some((word) => /^(?:-f|-F|--field|--raw-field|--input)$/u.test(word));
+	if (method === "GET" || method === null && !hasFields) return [];
+	const pull = /^\/?repos\/(?<repo>[^/]+\/[^/]+)\/(?:pulls|issues)\/(?<number>\d+)(?:\/|$)/u.exec(endpoint)?.groups;
+	if (pull !== void 0 && scope.pullRequests.includes(Number(pull["number"])) && isCheckoutRepository(pull["repo"] ?? "", scope) && !endpoint.includes("/merge")) return [];
+	return [{
+		kind: /secret|collaborator|protection|key|permission/u.test(endpoint) ? "credential" : "remote-write",
+		target: `gh api ${endpoint}`
+	}];
+}
+const IAM_WRITE = /^(?:add|attach|change|create|deactivate|delete|detach|enable|put|remove|reset|set|tag|untag|update|upload)-/u;
+function findProgramFinding(name, args) {
+	const joined = args.join(" ");
+	if (name === "op" && /^(?:item|vault|document) (?:edit|create|delete)\b/u.test(joined)) return {
+		kind: "credential",
+		target: `op ${args[0] ?? ""} ${args[1] ?? ""}`
+	};
+	if (name === "aws" && args[0] === "iam" && IAM_WRITE.test(args[1] ?? "")) return {
+		kind: "credential",
+		target: `aws iam ${args[1] ?? ""}`
+	};
+	if (name === "docker" && /\b(?:volume|system|image|container) prune\b|\bvolume rm\b|\bdown\b.*(?:-v|--volumes)\b/u.test(joined)) return {
+		kind: "prune",
+		target: `docker ${joined}`
+	};
+	if (name === "npm" && args[0] === "publish") return {
+		kind: "remote-write",
+		target: "npm publish"
+	};
+	if (name === "kubectl" && /\b(?:apply|delete|replace|patch|scale)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "kubectl write"
+	};
+	if (name === "terraform" && /\b(?:apply|destroy|import)\b/u.test(joined)) return {
+		kind: "remote-write",
+		target: "terraform write"
+	};
+	if (name === "psql" && /\b(?:UPDATE|DELETE|DROP|INSERT|TRUNCATE|ALTER)\b/iu.test(joined)) return {
+		kind: "remote-write",
+		target: "database write"
+	};
+	if (/^(?:bun|npm|pnpm|yarn)$/u.test(name) && /\bdeploy\b/u.test(joined) && /prod/u.test(joined)) return {
+		kind: "remote-write",
+		target: "production deploy"
+	};
+	return null;
+}
+function collectRedirectTargets(text) {
+	const targets = [];
+	let quote = null;
+	let index = 0;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			quote = ch === quote ? null : quote;
+			index += 1;
+		} else if (ch === "'" || ch === "\"") {
+			quote = ch;
+			index += 1;
+		} else if (ch === ">" && text.charAt(index - 1) !== "<") {
+			let next = index + 1;
+			if (text.charAt(next) === ">" || text.charAt(next) === "|") next += 1;
+			if (text.charAt(next) === "&") {
+				index = next + 1;
+				continue;
+			}
+			const [target, end] = readWord(text, next);
+			if (target !== "") targets.push(target);
+			index = end;
+		} else index += 1;
+	}
+	return targets;
+}
+function readWord(text, start) {
+	let index = start;
+	while (/\s/u.test(text.charAt(index))) index += 1;
+	let word = "";
+	let quote = null;
+	while (index < text.length) {
+		const ch = text.charAt(index);
+		if (quote !== null) {
+			if (ch === quote) quote = null;
+			else word += ch;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (/[\s;&|<>()]/u.test(ch)) break;
+		else word += ch;
+		index += 1;
+	}
+	return [word, index];
+}
+function collectInPlaceFiles(args) {
+	const files = [];
+	let skipNext = false;
+	let sawScript = false;
+	for (const word of args) if (skipNext) {
+		skipNext = false;
+		sawScript = true;
+	} else if (/^-\w*e$/u.test(word)) skipNext = true;
+	else if (!word.startsWith("-")) {
+		if (sawScript) files.push(word);
+		else sawScript = true;
+	}
+	return files;
+}
+function getCommandWords(words) {
+	let index = 0;
+	while (index < words.length) {
+		const word = words[index] ?? "";
+		if (/^\w+=/u.test(word) || word === "sudo" || word === "command") index += 1;
+		else if (word === "env") {
+			index += 1;
+			while (words[index] === "-u" || /^\w+=/u.test(words[index] ?? "")) index += words[index] === "-u" ? 2 : 1;
+		} else if (word === "timeout") index += 2;
+		else break;
+	}
+	return words.slice(index).filter((word, position, all) => !/^\d*[<>]/u.test(word) && !/^\d*>{1,2}\|?$/u.test(all[position - 1] ?? ""));
+}
+function splitWords$1(text) {
+	const words = [];
+	let current = "";
+	let quote = null;
+	let started = false;
+	for (const ch of text) if (quote !== null) {
+		if (ch === quote) quote = null;
+		else current += ch;
+	} else if (ch === "'" || ch === "\"") {
+		quote = ch;
+		started = true;
+	} else if (/\s/u.test(ch)) {
+		if (started) words.push(current);
+		current = "";
+		started = false;
+	} else {
+		current += ch;
+		started = true;
+	}
+	if (started) words.push(current);
+	return words;
+}
+function resolvePath(cwd, path, home) {
+	const expanded = path.replace(/^(?:~|\$HOME|\$\{HOME\})(?=\/|$)/u, home);
+	if (/[$`]|^~/u.test(expanded) || expanded === "") return null;
+	if (cwd === null && !isAbsolute(expanded)) return null;
+	const absolute = isAbsolute(expanded) || cwd === null ? expanded : join(cwd, expanded);
+	return normalize(absolute).replace(/(?<=.)\/$/u, "");
+}
+const SCRATCH_PATHS = [
+	"/tmp",
+	"/dev/null",
+	"/dev/stdout",
+	"/dev/stderr"
+];
+function isInScope(path, scope) {
+	if (SCRATCH_PATHS.some((entry) => isUnder(path, entry))) return true;
+	return scope.worktrees.some((worktree) => {
+		const isNested = isUnder(path, join(worktree, ".worktrees"));
+		const isOtherOwned = scope.worktrees.some((other) => other !== worktree && isUnder(path, other));
+		return isUnder(path, worktree) && (!isNested || isOtherOwned);
+	});
+}
+function isUnder(path, root) {
+	return path === root || path.startsWith(`${root}/`);
+}
+//#endregion
+//#region src/model/load-repository-context.ts
+async function loadRepositoryContext(cwd) {
+	if ([
+		"GIT_DIR",
+		"GIT_WORK_TREE",
+		"GIT_COMMON_DIR"
+	].some((name) => process.env[name] !== void 0)) return null;
+	let directory = resolve(cwd);
+	for (;;) {
+		const gitPath = join(directory, ".git");
+		try {
+			await stat(gitPath);
+		} catch (error) {
+			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
+			const parent = dirname(directory);
+			if (parent === directory) return null;
+			directory = parent;
+			continue;
+		}
+		let gitDir = gitPath;
+		let head;
+		try {
+			try {
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			} catch {
+				const link = await readFile(gitPath, "utf8");
+				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
+				if (path === void 0) return null;
+				gitDir = resolve(directory, path.trim());
+				head = await readFile(join(gitDir, "HEAD"), "utf8");
+			}
+		} catch {
+			return null;
+		}
+		let commonDir = gitDir;
+		try {
+			const common = await readFile(join(gitDir, "commondir"), "utf8");
+			commonDir = resolve(gitDir, common.trim());
+		} catch {
+			commonDir = gitDir;
+		}
+		let defaultBranch = null;
+		try {
+			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
+		} catch {
+			defaultBranch = null;
+		}
+		return {
+			cwd: resolve(cwd),
+			branch: parseReference(head, "refs/heads/"),
+			defaultBranch
+		};
+	}
+}
+function parseReference(content, prefix) {
+	const value = content.trim();
+	const marker = `ref: ${prefix}`;
+	if (!value.startsWith(marker)) return null;
+	const branch = value.slice(marker.length);
+	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
+}
+//#endregion
+//#region src/containment/build-cwd-scope.ts
+function buildCWDScope(input) {
+	const isDefault = input.branch === input.defaultBranch || input.defaultBranch === null && DEFAULT_NAMES.has(input.branch ?? "");
+	return {
+		home: input.home,
+		worktrees: [input.worktree],
+		branches: input.branch !== null && !isDefault ? [input.branch] : [],
+		currentBranch: input.branch,
+		remotes: input.remotes,
+		pullRequests: []
+	};
+}
+const DEFAULT_NAMES = /* @__PURE__ */ new Set([
+	"main",
+	"master",
+	"trunk",
+	"develop"
+]);
+//#endregion
+//#region src/containment/load-task-scope.ts
+async function loadTaskScope(cwd) {
+	const [checkout, context] = await Promise.all([findCheckout(resolve(cwd)), loadRepositoryContext(cwd)]);
+	return buildCWDScope({
+		home: homedir(),
+		worktree: checkout?.worktree ?? resolve(cwd),
+		branch: context?.branch ?? null,
+		defaultBranch: context?.defaultBranch ?? null,
+		remotes: checkout === null ? [] : await readRemotes(checkout.commonDir)
+	});
+}
+const GIT_OVERRIDES = [
+	"GIT_DIR",
+	"GIT_WORK_TREE",
+	"GIT_COMMON_DIR"
+];
+async function findCheckout(start) {
+	if (GIT_OVERRIDES.some((name) => process.env[name] !== void 0)) return null;
+	for (let directory = start;; directory = dirname(directory)) {
+		const gitPath = join(directory, ".git");
+		const info = await stat(gitPath).catch(() => null);
+		if (info !== null) {
+			const gitDir = info.isDirectory() ? gitPath : await findLinkedGitDir(directory, gitPath);
+			return gitDir === null ? null : {
+				worktree: directory,
+				commonDir: await findCommonDir(gitDir)
+			};
+		}
+		if (dirname(directory) === directory) return null;
+	}
+}
+async function findLinkedGitDir(directory, gitPath) {
+	const link = await readFile(gitPath, "utf8").catch(() => "");
+	const path = /^gitdir: (?<path>.+)$/mu.exec(link)?.groups?.["path"];
+	return path === void 0 ? null : resolve(directory, path.trim());
+}
+async function findCommonDir(gitDir) {
+	const common = await readFile(join(gitDir, "commondir"), "utf8").catch(() => null);
+	return common === null ? gitDir : resolve(gitDir, common.trim());
+}
+async function readRemotes(commonDir) {
+	const config = await readFile(join(commonDir, "config"), "utf8").catch(() => "");
+	const remotes = [];
+	let section = null;
+	for (const line of config.split("\n")) {
+		const header = /^\s*\[remote "(?<name>[^"]+)"\]/u.exec(line)?.groups?.["name"];
+		if (header !== void 0) section = header;
+		else if (/^\s*\[/u.test(line)) section = null;
+		else if (section !== null) {
+			const url = /^\s*(?:push)?url\s*=\s*(?<url>\S+)/u.exec(line)?.groups?.["url"];
+			if (url !== void 0) remotes.push({
+				name: section,
+				url
+			});
+		}
+	}
+	return remotes;
+}
+//#endregion
+//#region src/containment/check-containment.ts
+const CONTAINMENT_RULE = "Outside Task Scope";
+async function checkContainment(request) {
+	let scope;
+	try {
+		scope = await loadTaskScope(request.cwd);
+	} catch {
+		return null;
+	}
+	const findings = collectScopeFindings({
+		tool: request.toolName,
+		cwd: request.cwd,
+		input: request.toolInput
+	}, scope);
+	if (findings.length === 0) return null;
+	return {
+		rule: CONTAINMENT_RULE,
+		reason: formatContainmentReason(findings, scope),
+		findings
+	};
+}
+const KIND_LABELS = {
+	path: "path",
+	branch: "branch",
+	"remote-write": "remote target",
+	credential: "credential or global setting",
+	prune: "shared resource"
+};
+function formatContainmentReason(findings, scope) {
+	const targets = findings.slice(0, 5).map((finding) => `${KIND_LABELS[finding.kind]} ${finding.target}`).join(", ");
+	const more = findings.length > 5 ? ` and ${findings.length - 5} more` : "";
+	const [branch] = scope.branches;
+	return `This action writes outside the task scope: ${targets}${more}. The task owns ${`the worktree ${scope.worktrees.join(", ")}${branch === void 0 ? "" : ` and the branch ${branch}`}`}. Do the work inside the task's own worktree and branch, or ask the user to extend the task scope to this target.`;
+}
 const PRESETS = {
 	jev: {
 		protocol: "system-one",
@@ -6124,68 +6882,6 @@ function formatClassifierNote(note, apiKey) {
 	return apiKey === null || apiKey === "" ? note : note.split(apiKey).join("[redacted]");
 }
 //#endregion
-//#region src/model/load-repository-context.ts
-async function loadRepositoryContext(cwd) {
-	if ([
-		"GIT_DIR",
-		"GIT_WORK_TREE",
-		"GIT_COMMON_DIR"
-	].some((name) => process.env[name] !== void 0)) return null;
-	let directory = resolve(cwd);
-	for (;;) {
-		const gitPath = join(directory, ".git");
-		try {
-			await stat(gitPath);
-		} catch (error) {
-			if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) return null;
-			const parent = dirname(directory);
-			if (parent === directory) return null;
-			directory = parent;
-			continue;
-		}
-		let gitDir = gitPath;
-		let head;
-		try {
-			try {
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			} catch {
-				const link = await readFile(gitPath, "utf8");
-				const path = /^gitdir: (?<path>.+)\r?\n?$/u.exec(link)?.groups?.["path"];
-				if (path === void 0) return null;
-				gitDir = resolve(directory, path.trim());
-				head = await readFile(join(gitDir, "HEAD"), "utf8");
-			}
-		} catch {
-			return null;
-		}
-		let commonDir = gitDir;
-		try {
-			const common = await readFile(join(gitDir, "commondir"), "utf8");
-			commonDir = resolve(gitDir, common.trim());
-		} catch {
-			commonDir = gitDir;
-		}
-		let defaultBranch = null;
-		try {
-			defaultBranch = parseReference(await readFile(join(commonDir, "refs", "remotes", "origin", "HEAD"), "utf8"), "refs/remotes/origin/");
-		} catch {
-			defaultBranch = null;
-		}
-		return {
-			cwd: resolve(cwd),
-			branch: parseReference(head, "refs/heads/"),
-			defaultBranch
-		};
-	}
-}
-function parseReference(content, prefix) {
-	const value = content.trim();
-	const marker = `ref: ${prefix}`;
-	if (!value.startsWith(marker)) return null;
-	const branch = value.slice(marker.length);
-	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
-}
-//#endregion
 //#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
 const t = Symbol.for("@ts-pattern/matcher");
 const e = Symbol.for("@ts-pattern/isVariadic");
@@ -6969,64 +7665,6 @@ const REGENERABLE_DIRS = /* @__PURE__ */ new Set([
 	"venv"
 ]);
 //#endregion
-//#region src/rules/split-shell-command.ts
-function splitShellCommand(command) {
-	const segments = [];
-	let current = "";
-	let quote = null;
-	let unparsed = false;
-	let i = 0;
-	const collectSegment = () => {
-		const text = current.trim();
-		if (text !== "") segments.push({ text });
-		current = "";
-	};
-	while (i < command.length) {
-		const ch = command.charAt(i);
-		if (quote !== null) {
-			if (quote === "\"" && (command.startsWith("$(", i) || ch === "`")) unparsed = true;
-			if (ch === quote) quote = null;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			quote = ch;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (ch === "\\") {
-			current += command.slice(i, i + 2);
-			i += 2;
-			continue;
-		}
-		if (command.startsWith("$(", i) || ch === "`" || command.startsWith("<(", i) || ch === ">") {
-			unparsed = true;
-			current += ch;
-			i += 1;
-			continue;
-		}
-		if (command.startsWith("&&", i) || command.startsWith("||", i)) {
-			collectSegment();
-			i += 2;
-			continue;
-		}
-		if (ch === ";" || ch === "|" || ch === "\n" || ch === "&") {
-			collectSegment();
-			i += 1;
-			continue;
-		}
-		current += ch;
-		i += 1;
-	}
-	collectSegment();
-	return {
-		segments,
-		hasUnparsedConstruct: unparsed || quote !== null
-	};
-}
-//#endregion
 //#region src/rules/classify-locally.ts
 const ESCALATE = { kind: "escalate" };
 function classifyLocally(payload) {
@@ -7104,12 +7742,18 @@ async function classifyAction(request, config, options = {}) {
 		};
 	}
 	const local = configured !== null && (configured.hard_deny.length > 0 || configured.soft_deny.length > 0) ? { kind: "escalate" } : classifyLocally(request);
-	if (local.kind === "allow") return {
-		verdict: { kind: "allow" },
-		decidingStage: "local",
-		note: `allowed by ${local.exception} (local)`,
-		status: "allow"
-	};
+	if (local.kind === "allow" && local.exception === READ_ONLY_EXCEPTION) return buildLocalAllow(local.exception);
+	const containment = await checkContainment(request);
+	if (containment !== null) {
+		const guidance = await tryReadDenialGuidance();
+		return {
+			verdict: buildGuidedDeny(containment.rule, containment.reason, guidance),
+			decidingStage: "containment",
+			note: `denied by the containment check: ${containment.findings.map((finding) => finding.target).join(", ")}`,
+			status: "deny"
+		};
+	}
+	if (local.kind === "allow") return buildLocalAllow(local.exception);
 	if (options.localOnly === true) return {
 		verdict: null,
 		decidingStage: "local",
@@ -7124,6 +7768,15 @@ async function classifyAction(request, config, options = {}) {
 		status: outcome.diagnostics?.status ?? outcome.verdict?.kind ?? "failure"
 	};
 }
+const READ_ONLY_EXCEPTION = "Read-only actions";
+function buildLocalAllow(exception) {
+	return {
+		verdict: { kind: "allow" },
+		decidingStage: "local",
+		note: `allowed by ${exception} (local)`,
+		status: "allow"
+	};
+}
 function buildGuidedDeny(rule, reason, guidance) {
 	const sentence = /[.!?]$/u.test(reason) ? reason : `${reason}.`;
 	return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auto-mode",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "A permission classifier library and Claude Code mod, so agents that are not Claude can run unattended",
   "keywords": [
     "agent",