npm - create-walle - Versions diffs - 0.9.31 → 0.9.32 - Mend

create-walle 0.9.31 → 0.9.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (99) hide show

package/template/claude-task-manager/api-reviews.js CHANGED Viewed

@@ -1,6 +1,7 @@
 'use strict';
 const path = require('path');
 const fs = require('fs');
+const os = require('os');
 const db = require('./db');
 const gitUtils = require('./git-utils');
 const documentReview = require('./lib/document-review');
@@ -31,14 +32,27 @@ function isValidProjectPath(p) {
 // Returns the safe absolute path to read, or null if it escapes the project.
 // A path that doesn't exist yet (ENOENT) can't be a symlink, so the lexical check
 // already guarantees safety — return it so the caller can produce its own 404.
-// Best-effort fallback when an html path doesn't resolve at the given root — e.g. a path
-// relative to the repo root while the session cwd is a subdir. Searches tracked + untracked
-// .html within the repo and returns the best suffix/basename match (stays inside the root).
-function findHtmlInRepo(root, relPath) {
+// The repo's worktree roots, main-style checkouts first (work usually lands there), capped.
+function htmlWorktreeRoots(projectRoot, cap = 20) {
+  try {
+    const { execFileSync } = require('child_process');
+    const out = execFileSync('git', ['worktree', 'list', '--porcelain'],
+      { cwd: projectRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    const roots = [];
+    for (const line of out.split('\n')) {
+      if (line.startsWith('worktree ')) roots.push(line.slice('worktree '.length).trim());
+    }
+    const isWorktreeSubdir = (pth) => /\/\.(?:claude|walle)\/worktrees\/|\/\.worktrees\//.test(pth);
+    roots.sort((a, b) => (isWorktreeSubdir(a) ? 1 : 0) - (isWorktreeSubdir(b) ? 1 : 0));
+    return roots.slice(0, Math.max(1, cap));
+  } catch { return []; }
+}
+// Find an .html file (tracked + untracked) within a single worktree `root` by exact relative
+// path, suffix, or basename.
+function findHtmlInRoot(root, want, base) {
   try {
     const { execFileSync } = require('child_process');
-    const want = String(relPath || '').replace(/^\.?\//, '');
-    const base = path.basename(want);
     const out = execFileSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard', '*.html', '*.htm'],
       { cwd: root, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 }).split('\0').filter(Boolean);
     let hit = out.find(f => f === want || f.endsWith('/' + want));
@@ -47,6 +61,35 @@ function findHtmlInRepo(root, relPath) {
   } catch { return null; }
 }
+// Best-effort fallback when an html path doesn't resolve at the given root — e.g. a path
+// relative to the repo root while the session cwd is a subdir, OR a file that lives in a
+// SIBLING worktree of the same repo (work landed on main while the session runs in a feature
+// worktree). Searches the own worktree first, then the repo's others; returns a path under
+// the user's HOME or null.
+function findHtmlInRepo(root, relPath) {
+  const want = String(relPath || '').replace(/^\.?\//, '');
+  if (!want) return null;
+  const base = path.basename(want);
+  const home = process.env.HOME || '';
+  const underHome = (pth) => {
+    if (!home) return false;
+    const r = path.resolve(pth);
+    return r === home || r.startsWith(home + path.sep);
+  };
+  const own = findHtmlInRoot(root, want, base);
+  if (own && underHome(own)) return own;
+  let realRoot = '';
+  try { realRoot = fs.realpathSync(root); } catch { realRoot = path.resolve(root); }
+  for (const wt of htmlWorktreeRoots(root)) {
+    let realWt = '';
+    try { realWt = fs.realpathSync(wt); } catch { realWt = path.resolve(wt); }
+    if (realWt === realRoot) continue; // own worktree already searched
+    const hit = findHtmlInRoot(wt, want, base);
+    if (hit && underHome(hit)) return hit;
+  }
+  return null;
+}
 function htmlNotFoundPage(filePath) {
   const safe = String(filePath || '').replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
   return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>File not found</title>
@@ -73,6 +116,40 @@ function resolveWithinProject(project, filePath) {
   if (realFile !== realRoot && !realFile.startsWith(realRoot + path.sep)) return null; // symlink escape
   return realFile;
 }
+// The per-session scratchpad lives OUTSIDE the project root AND outside HOME:
+//   <tmp>/claude-<uid>/<project-slug>/<session>/scratchpad/<file>.html
+// (e.g. <tmpdir>/claude-<uid>/.../scratchpad/plan.html). Agents author HTML there and
+// print the absolute path into session output; clicking it built a serve-html URL that
+// 403'd because resolveWithinProject (project- and HOME-scoped) rejected it. Serve these
+// too — same trust level as project HTML (same uid, mode-0700 temp dir), behind the same
+// .html + sandbox-CSP guards, with realpath containment to block a symlink escaping the
+// scratchpad. Returns the safe absolute path to read, or null.
+function scratchpadRoots() {
+  let uid = '';
+  try { if (typeof process.getuid === 'function') uid = String(process.getuid()); } catch {}
+  if (!uid) return [];
+  const roots = new Set();
+  // os.tmpdir() (launchd gives a per-user /var/folders/... TMPDIR) plus the /tmp aliases
+  // Claude Code actually uses; realpath collapses /tmp → /private/tmp on macOS and dedupes.
+  for (const base of [os.tmpdir(), '/tmp', '/private/tmp']) {
+    try { roots.add(fs.realpathSync(path.join(base, 'claude-' + uid))); } catch {}
+  }
+  return [...roots];
+}
+function resolveWithinScratchpad(filePath) {
+  if (typeof filePath !== 'string' || !path.isAbsolute(filePath)) return null;
+  const roots = scratchpadRoots();
+  if (!roots.length) return null;
+  let realFile;
+  try { realFile = fs.realpathSync(filePath); } // must exist; no pre-create 404 for scratchpad
+  catch { return null; }
+  for (const root of roots) {
+    if (realFile === root || realFile.startsWith(root + path.sep)) return realFile;
+  }
+  return null;
+}
 function jsonResponse(res, code, data) {
   const body = JSON.stringify(data);
   res.writeHead(code, { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) });
@@ -284,6 +361,22 @@ function handleReviewApi(req, res, url) {
     return true;
   }
+  // POST /api/reviews/verify-commits — given a repo and a list of candidate SHAs
+  // (mined from session output), return only the ones that are real commits, with
+  // their short hash + subject. Lets the client linkify commit references safely.
+  if (p === '/api/reviews/verify-commits' && m === 'POST') {
+    readBody(req).then(body => {
+      const project = body && body.project;
+      const shas = (body && Array.isArray(body.shas)) ? body.shas.slice(0, 50) : [];
+      if (!project) return jsonResponse(res, 400, { error: 'project required' });
+      if (!isValidProjectPath(project)) return jsonResponse(res, 403, { error: 'Invalid project path' });
+      gitUtils.verifyCommits(project, shas)
+        .then(commits => jsonResponse(res, 200, { commits }))
+        .catch(e => jsonResponse(res, 500, { error: e.message }));
+    }).catch(e => jsonResponse(res, 400, { error: e.message }));
+    return true;
+  }
   // GET /api/reviews/diff-stat?project=...&base=...
   if (p === '/api/reviews/diff-stat' && m === 'GET') {
     const project = url.searchParams.get('project');
@@ -556,6 +649,9 @@ function handleReviewApi(req, res, url) {
     const ext = path.extname(filePath).toLowerCase();
     if (ext !== '.html' && ext !== '.htm') return jsonResponse(res, 400, { error: 'Only .html files are supported' });
     let resolved = resolveWithinProject(project, filePath);
+    // The file may be agent-authored HTML in the session scratchpad (absolute /tmp path,
+    // outside the project and HOME). realpath-validated to the user's claude-<uid> temp dir.
+    if (!resolved) resolved = resolveWithinScratchpad(filePath);
     if (!resolved) return jsonResponse(res, 403, { error: 'Invalid file path' });
     // Fallback: the path may be relative to the repo root while the session cwd is a
     // subdir/worktree — search the repo for the file before giving up.
@@ -658,4 +754,6 @@ module.exports = {
   _sanitizeReviewCommentUpdate: sanitizeReviewCommentUpdate,
   _documentReview: documentReview,
   _resolveWithinProject: resolveWithinProject,
+  _resolveWithinScratchpad: resolveWithinScratchpad,
+  _findHtmlInRepo: findHtmlInRepo,
 };

package/template/claude-task-manager/approval-agent.js CHANGED Viewed

@@ -13,6 +13,7 @@ const { commandHead } = require('./lib/escalation-review');
 const { callBackgroundLlm } = require('./lib/background-llm');
 const { verifyIfEnabled } = require('./lib/auto-approval-verifier');
 const { matchPermission } = require('./lib/permission-match');
+const mcpRisk = require('./lib/mcp-risk');
 const approvalAiRefinement = require('./lib/approval-ai-refinement');
 // Dangerous-command blocklist: when enabled, any command matching
@@ -612,6 +613,17 @@ function cardTextFingerprint(cleanText) {
 function normalizeCommandSignature(toolName, command) {
   const tool = (toolName || '').replace(/^[⏺●\s]+/, '').trim();
   const cmd = (command || '').trim();
+  // Network-access approvals: the HOST is the meaningful, granular unit, so keep it
+  // in the signature ("network <host>"). Otherwise the non-Bash branch below would
+  // collapse every host to the bare tool name 'network' → one all-hosts group and a
+  // dangerously broad Network(*) rule. Runs before the empty-cmd guard so a host that
+  // only survives in the synthesized command is still captured.
+  if (/^network\b/i.test(tool)) {
+    const host = (cmd.match(/[a-z0-9-]+(?:\.[a-z0-9-]+)+/i) || [])[0];
+    return host ? `network ${host.toLowerCase()}` : 'network';
+  }
   if (!cmd) return tool.toLowerCase();
   // For non-Bash tools (Edit, Write, Read, etc.), signature is just the tool name
@@ -904,29 +916,121 @@ function _buildSessionContext(session) {
   return { goal, cwd };
 }
+// Hard ceiling on the auto-approval verifier's LLM round-trip. The inner builtin
+// verifier already has its own ~20s budget (lib/auto-approval-verifier BUILTIN_TIMEOUT_MS)
+// and the Wall-E status fetch a 2.5s AbortSignal — but the await at the call sites had no
+// overall guard, so a provider that ignores its abort signal could strand a live approval
+// prompt indefinitely (the symptom behind the stuck Codex `search_code` banner). This sits
+// just above the inner budget: it normally never fires (the inner timeout wins, preserving
+// the verifier verdict) and only trips on a true hang.
+const VERIFIER_OVERALL_TIMEOUT_MS = 25_000;
+// Resolve `promise`, but never settle later than `ms`. On timeout OR rejection, resolve to
+// `fallback`. The verifier is fail-OPEN (a disabled/unknown verdict → approve), so the safe
+// fallback for a wedged verifier is the same "no block" sentinel — a stuck banner is worse
+// than approving a medium-risk op the blocklist already cleared.
+function _withTimeout(promise, ms, fallback) {
+  let timer;
+  const guard = new Promise((resolve) => { timer = setTimeout(() => resolve(fallback), ms); });
+  return Promise.race([
+    Promise.resolve(promise).then(
+      (v) => { clearTimeout(timer); return v; },
+      () => { clearTimeout(timer); return fallback; },
+    ),
+    guard,
+  ]);
+}
+// Verifier posture (proposal P-E). The LLM verifier is fail-OPEN by design — when
+// it can't produce a confident "unsafe" verdict (disabled, timeout, errored,
+// 'unknown') the approval proceeds. That is correct for the bounded-blast-radius
+// MEDIUM tier, but for HIGH-risk commands it means "approved blind" whenever the
+// verifier can't vouch — which is exactly what happens to Codex sessions where the
+// background verifier ~100% times out. So HIGH risk fails CLOSED: unless the
+// verifier POSITIVELY cleared it (enabled + verdict==='safe'), escalate to the
+// human instead of auto-approving. The dangerous-command blocklist remains the
+// deterministic hard gate above all of this; this is the second net for the
+// high-risk heuristic patterns (rm -rf /, --force, drop table, sudo, dd, …).
+function _highRiskNeedsHumanWhenUnverified(riskLevel, verifier) {
+  if (riskLevel !== 'high') return false;
+  const positivelyCleared = !!(verifier && verifier.enabled && verifier.verdict === 'safe');
+  return !positivelyCleared;
+}
+// Approval posture (proposal P-G) — one global knob over the UNCERTAIN MEDIUM tier
+// only. It NEVER weakens the hard floors: the dangerous-command blocklist, deny
+// rules, the HIGH-risk fail-closed gate (_highRiskNeedsHumanWhenUnverified), and
+// forced egress escalation all run regardless of posture. User-allowed commands and
+// learned-rule matches are explicit trust and are never held. Low risk always
+// auto-approves. So posture moves exactly one boundary: what to do with a
+// pure-heuristic ('auto') MEDIUM-risk action.
+//   - cautious   → hold it for the human (escalate) instead of fail-open approving
+//   - balanced   → today's behavior (verifier second-opinion, then approve)
+//   - autonomous → trust the heuristic and skip the LLM verifier round-trip for medium
+const APPROVAL_POSTURES = new Set(['cautious', 'balanced', 'autonomous']);
+function _approvalPosture() {
+  try {
+    if (!dbModule || typeof dbModule.getSetting !== 'function') return 'balanced';
+    const v = String(dbModule.getSetting('approval_posture', 'balanced') || 'balanced').toLowerCase();
+    return APPROVAL_POSTURES.has(v) ? v : 'balanced';
+  } catch { return 'balanced'; }
+}
+// Autonomous trusts the heuristic for MEDIUM and skips the (slower, sometimes
+// timing-out) LLM verifier. HIGH still runs it. decidedBy guards keep this to the
+// pure-heuristic tier.
+function _postureSkipsMediumVerifier(posture, riskLevel) {
+  return posture === 'autonomous' && riskLevel === 'medium';
+}
+// Cautious holds an uncertain MEDIUM for the human. Only the 'auto' (pure-heuristic)
+// tier — never a user-allow, a learned rule, low, or high.
+function _postureHoldsMedium(posture, riskLevel, decidedBy) {
+  return posture === 'cautious' && riskLevel === 'medium' && decidedBy === 'auto';
+}
 async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcastFn, label, source, riskLevel, callModel) {
   // Verifier scope: medium+ risk only. Clearly low-risk/read-only approvals skip
   // the LLM second opinion — keeps the fast path fast and usable offline.
   if (riskLevel && riskLevel !== 'medium' && riskLevel !== 'high') return null;
+  // Posture (P-G): autonomous trusts the heuristic for the medium tier and skips
+  // the verifier entirely (HIGH still runs it below). Cautious is handled after the
+  // verdict so it can hold an otherwise-approved medium.
+  const posture = _approvalPosture();
+  if (_postureSkipsMediumVerifier(posture, riskLevel) && source === 'auto') return null;
   // Attach the warm session-context packet (goal + cwd) so the built-in verifier
   // can judge GOAL-ALIGNMENT, not just the command in isolation. Single point —
   // covers both call sites (allow-by-default + approval-rescue). Never overwrite a
   // packet the caller already supplied.
   if (context && !context.sessionContext) context.sessionContext = _buildSessionContext(session);
-  const verifier = await verifyIfEnabled({ context, dbModule, callModel });
-  // Approve-by-default: ONLY a confident "unsafe" verdict blocks an auto-approval.
-  // A disabled verifier, a 'safe' verdict, or an 'unknown'/errored verdict (AI
-  // unavailable, timeout, bad response) all fall through to APPROVE. The approver
-  // escalates only when it is sure the command is high risk — never merely because
-  // the AI gate could not produce an answer. (The dangerous-command blocklist
-  // remains the deterministic hard gate above this.)
-  if (!verifier.enabled || verifier.verdict !== 'unsafe') return null;
+  // Fail-open if the verifier wedges: a disabled-shaped verdict ⇒ the guard below
+  // returns null ⇒ the approval proceeds, same as an 'unknown'/timeout verdict.
+  const verifier = await _withTimeout(
+    verifyIfEnabled({ context, dbModule, callModel }),
+    VERIFIER_OVERALL_TIMEOUT_MS,
+    { enabled: false },
+  );
+  // Escalate when EITHER (a) the verifier is confidently "unsafe", OR (b) the
+  // command is HIGH risk and the verifier could not positively clear it (P-E posture
+  // — see _highRiskNeedsHumanWhenUnverified). MEDIUM risk stays fail-open: a disabled
+  // verifier or an 'unknown'/timeout verdict falls through to APPROVE, so the fast
+  // path stays fast and usable offline. The dangerous-command blocklist remains the
+  // deterministic hard gate above this.
+  const isUnsafe = !!(verifier.enabled && verifier.verdict === 'unsafe');
+  const highRiskUnverified = !isUnsafe && _highRiskNeedsHumanWhenUnverified(riskLevel, verifier);
+  // Cautious posture: hold an otherwise-approved pure-heuristic MEDIUM for the human.
+  const cautiousHold = !isUnsafe && !highRiskUnverified && _postureHoldsMedium(posture, riskLevel, source);
+  if (!isUnsafe && !highRiskUnverified && !cautiousHold) return null;
   // Prefer the OBJECTIVE block reason (the category — e.g. "Runs arbitrary code
   // (node -e)") over the verifier's vague free-text, so the banner + Pending group
-  // tell the user WHY it was held. Fall back to the verifier's reason, then a default.
+  // tell the user WHY it was held. Fall back to the verifier's reason (unsafe case),
+  // a cautious-posture message, or the high-risk-unverified message, then a default.
   const blocked = classifyBlockReason(context);
-  const reason = blocked.reason || verifier.reason || 'Auto-approval verifier flagged this command as high risk.';
+  const reason = blocked.reason
+    || (isUnsafe
+      ? (verifier.reason || 'Auto-approval verifier flagged this command as high risk.')
+      : cautiousHold
+        ? 'Cautious posture — holding this medium-risk action for your approval.'
+        : 'High-risk command could not be automatically verified — approve once to allow it.');
   const parts = escalationCommandParts(context);
   // The group key the Permission "Pending" tab will bucket this under — same fn the
   // endpoint uses (lib/escalation-review.commandHead over the signature), so the
@@ -943,8 +1047,8 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
     warning: context.warning || '',
     decision: 'escalated',
     reasoning: reason,
-    decidedBy: 'verifier',
-    riskLevel: 'high',
+    decidedBy: cautiousHold ? 'posture' : 'verifier',
+    riskLevel: cautiousHold ? 'medium' : 'high',
   };
   let decisionId;
   try { decisionId = dbModule.addApprovalDecision?.(decision); } catch (e) { console.error('[approval-agent] verifier DB error:', e.message); }
@@ -953,7 +1057,7 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
       type: 'approval-decision',
       sessionId,
       decision: 'escalated',
-      decidedBy: 'verifier',
+      decidedBy: cautiousHold ? 'posture' : 'verifier',
       decisionId,
       // Banner shows the actual command (matches the recorded commandSummary),
       // not the heuristic rule label.
@@ -965,7 +1069,7 @@ async function _verifyAutoApprovalOrBlock(sessionId, session, context, broadcast
       groupKey,
       riskLevel: decision.riskLevel,
       verifierSource: source || '',
-      verifierVerdict: verifier.verdict,
+      verifierVerdict: verifier.verdict || (highRiskUnverified ? 'unverified' : ''),
       command: String(context.command || '').slice(0, 500),
       warning: context.warning || '',
     });
@@ -1151,6 +1255,55 @@ function _isDevCleanupCommand(cmd) {
   return sawKill || sawTmpRm;
 }
+// Network egress is a genuine security boundary (a confused/compromised agent can
+// exfiltrate to any host), so it is NOT blanket-approved. Only a small allowlist of
+// the agent's OWN provider backends auto-approves — stalling Codex on OpenAI's own
+// infra (e.g. ab.chatgpt.com) is pure friction with no egress benefit. Every other
+// host force-escalates to a granular, one-click Network(<host>) Pending rule the user
+// approves once. Suffix match so subdomains of an allowlisted apex are covered.
+// EDIT THIS LIST to broaden/narrow the auto-approved egress set.
+const NETWORK_ALLOWLIST = ['chatgpt.com', 'openai.com', 'oaistatic.com', 'oaiusercontent.com'];
+function isAllowedNetworkHost(host) {
+  const h = String(host || '').toLowerCase().trim().replace(/:\d+$/, '').replace(/\.$/, '');
+  if (!h) return false;
+  return NETWORK_ALLOWLIST.some((d) => h === d || h.endsWith('.' + d));
+}
+// Pull a hostname out of a Codex network-access prompt's question/reason text — used
+// as a fallback when the provider did not already extract context.networkHost.
+function extractNetworkHost(text) {
+  const s = String(text || '');
+  let m = s.match(/network access to ['"]?([a-z0-9.-]+\.[a-z]{2,})['"]?/i)
+    || s.match(/([a-z0-9.-]+\.[a-z]{2,})\s+is\s+not\s+in\s+the\s+allowed[_ ]?domains/i)
+    || s.match(/\b([a-z0-9-]+(?:\.[a-z0-9-]+)+\.[a-z]{2,})\b/i)
+    || s.match(/\b([a-z0-9-]+\.[a-z]{2,})\b/i);
+  return m ? m[1].toLowerCase().replace(/[.'"]+$/, '') : '';
+}
+// Refresh the shared MCP annotation registry (lib/mcp-risk) from the persisted
+// `mcp_tool_annotations` setting so authoritative read/write classifications
+// override the verb heuristic. TTL-cached (and change-gated) so the hot approval
+// path doesn't re-read/re-parse every call; tolerant of a missing db or bad JSON
+// (leaves the registry as-is). An ABSENT setting is a no-op — only an explicit
+// value (e.g. `{}` to clear) replaces the registry. Shared by every decision path
+// because they all funnel through reviewWithHeuristics.
+const MCP_ANNO_TTL_MS = 5000;
+let _mcpAnnoRaw;
+let _mcpAnnoAt = 0;
+function _refreshMcpAnnotations() {
+  try {
+    if (!dbModule || typeof dbModule.getSetting !== 'function') return;
+    const now = Date.now();
+    if (now - _mcpAnnoAt < MCP_ANNO_TTL_MS) return;
+    _mcpAnnoAt = now;
+    const raw = dbModule.getSetting('mcp_tool_annotations', null);
+    if (raw === _mcpAnnoRaw) return; // unchanged since last load
+    _mcpAnnoRaw = raw;
+    if (raw == null) return; // absent → leave the registry untouched
+    const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    mcpRisk.loadAnnotations(parsed);
+  } catch { /* keep whatever is registered; never block a decision on this */ }
+}
 // Simple heuristic review when no API key is available
 function reviewWithHeuristics(context) {
   const cmd = (context.command || '').toLowerCase();
@@ -1176,15 +1329,19 @@ function reviewWithHeuristics(context) {
   // "mcp__…" / "(mcp)" command text.
   const isMcp = /^(?:plugin:|mcp__|mcp\b)/i.test(tool) || /\(mcp\)/i.test(cmd);
   if (isMcp) {
-    // Boundaries are `(?<![a-z0-9]) … (?![a-z0-9])` rather than `\b`: snake_case
-    // tool ids (mcp__server__get_thread) glue the verb to the noun with `_`, which
-    // IS a regex word char, so `\bget\b` never fired and every read-only snake_case
-    // MCP op (Gmail/Calendar/Drive/wall-e) fell through to the medium verifier path.
-    // The class treats `_`, `-`, space, `:`, and start/end as separators while still
-    // rejecting alnum-glued false positives (`get` in "target", `draft` in "drafts").
-    const readOnlyMcp = /(?<![a-z0-9])(navigate(?:_back)?|snapshot|take_screenshot|screenshot|read|list|get|query|search|fetch|download|find|view|suggest|stats|status|brief|ask|console_messages|network_requests?|wait_for|hover|tabs|resolve[-_ ]?library[-_ ]?id|get[-_ ]?library[-_ ]?docs|browser_snapshot|browser_navigate)(?![a-z0-9])/i;
-    const mutatingMcp = /(?<![a-z0-9])(click|type|fill|drag|drop|file_upload|upload|run_code|evaluate|press_key|select_option|handle_dialog|write|create|delete|remove|update|send|post|install|deploy|exec|label|unlabel|respond|copy|move|add|set|insert|draft|authenticate|complete|reconnect|ingest|rebuild|export|remember|put|patch)(?![a-z0-9])/i;
-    if (readOnlyMcp.test(tool) && !mutatingMcp.test(tool)) {
+    _refreshMcpAnnotations(); // pick up any persisted authoritative annotations
+    // Read/write classification lives in lib/mcp-risk (shared with the MCP(...)
+    // permission-rule matcher so the two never drift) and is authoritative-first:
+    // a server's registered tool annotation wins, else the verb heuristic.
+    // Some providers (codex-mcp) emit a literal toolName='MCP' and carry the real tool
+    // verb in the structured `mcpTool` field, hiding it from a tool-name-only match — so
+    // a read-only `search_code` looked verb-less and fell through to the medium verifier
+    // path. Classify against the tool name PLUS `mcpTool` so the verb is visible wherever
+    // the provider put it. When mcpTool is absent (Claude's `mcp__…` ids already carry the
+    // verb in toolName), mcpTarget === tool, so nothing else changes.
+    const mcpTarget = context.mcpTool ? `${tool} ${String(context.mcpTool).toLowerCase()}` : tool;
+    const mcpClass = mcpRisk.classifyMcp({ server: context.mcpServer, tool: context.mcpTool, target: mcpTarget });
+    if (mcpClass === 'read') {
       return { decision: 'approve', reasoning: 'Read-only MCP operation (heuristic)', riskLevel: 'low',
         ruleLabel: context.toolName || 'MCP read-only operation',
         rulePattern: '',
@@ -1197,6 +1354,29 @@ function reviewWithHeuristics(context) {
       ruleDescription: 'Routed to AI reviewer/verifier for a decision' };
   }
+  // Network-access approvals (Codex "Do you want to approve network access to <host>?").
+  // Allowlisted provider-own hosts auto-approve (low). Every other host force-escalates
+  // to a granular, generalized Network(<host>) Pending rule — NOT to the LLM verifier,
+  // which can't reason about egress and would let it through when uncertain/down. The
+  // verifier is a fail-OPEN gate; egress must fail-CLOSED to the human.
+  if (/^network\b/.test(tool) || context.networkHost) {
+    const host = String(
+      context.networkHost || extractNetworkHost(context.command) || extractNetworkHost(context.warning),
+    ).toLowerCase();
+    if (host && isAllowedNetworkHost(host)) {
+      return { decision: 'approve', reasoning: `Network access to allowlisted host ${host} (heuristic)`, riskLevel: 'low',
+        ruleLabel: `Network access to ${host}`, rulePattern: `Network(${host})`,
+        ruleDescription: `Auto-approve network access to ${host}` };
+    }
+    return { decision: 'escalate', forceEscalate: true, riskLevel: 'medium',
+      reasoning: host
+        ? `Network access to ${host} is not on the egress allowlist — approve once to allow it for the future.`
+        : 'Network access requested — approve once to allow this host for the future.',
+      ruleLabel: host ? `Network access to ${host}` : 'Network access',
+      rulePattern: host ? `Network(${host})` : '',
+      ruleDescription: host ? `Allow network access to ${host}` : 'Allow network access' };
+  }
   // Low-risk tools — auto-approve immediately (before high-risk content check,
   // because Edit/Write diffs may contain code with "drop table" or "rm -rf" as
   // string literals — those are code content, not dangerous operations).
@@ -2131,7 +2311,7 @@ async function decideApproval(context, session, options = {}) {
   // 2) Permission Manager rules (the user's explicit allow/deny).
   let permRules = [];
   try { permRules = typeof dbModule.listPermRules === 'function' ? dbModule.listPermRules({}) : []; } catch { permRules = []; }
-  const permMatch = matchPermission({ toolName: context.toolName, command }, permRules);
+  const permMatch = matchPermission({ toolName: context.toolName, command, mcpServer: context.mcpServer, mcpTool: context.mcpTool }, permRules);
   if (permMatch && permMatch.action === 'deny') {
     return {
       decision: 'ask', decidedBy: 'user-deny', riskLevel: 'high',
@@ -2159,13 +2339,39 @@ async function decideApproval(context, session, options = {}) {
     : matchingRule ? `Matched learned rule: ${matchingRule.label}`
     : 'Auto-approved by default (not on the denylist)';
+  // 3b) Heuristic-forced escalation (e.g. un-allowlisted network egress) — ask the
+  //     human deterministically, before the fail-open verifier, with the granular
+  //     Network(<host>) rule pre-suggested.
+  if (!userAllowed && !matchingRule && heuristic && heuristic.forceEscalate) {
+    return {
+      decision: 'ask', decidedBy: 'heuristic', riskLevel: heuristic.riskLevel || 'medium',
+      reason: heuristic.reasoning || 'Needs review before allowing.',
+      label: heuristic.ruleLabel || context.toolName,
+      suggestedRule: heuristic.rulePattern || '',
+    };
+  }
   // 4) Goal-aligned verifier — medium+ risk only; user-allowed commands skip it
   //    (the user has explicitly vouched). Only a confident "unsafe" verdict
   //    escalates; a disabled/safe/unknown verdict falls through to allow.
-  if (!userAllowed && (riskLevel === 'medium' || riskLevel === 'high')) {
+  //    Posture (P-G): autonomous trusts the heuristic for medium and skips the
+  //    verifier (HIGH still runs it); cautious is applied after, on the medium
+  //    fall-through, so it can hold an otherwise-approved action.
+  const posture = _approvalPosture();
+  const runVerifier = !userAllowed
+    && (riskLevel === 'high' || (riskLevel === 'medium' && !_postureSkipsMediumVerifier(posture, riskLevel)));
+  if (runVerifier) {
     if (context && !context.sessionContext) context.sessionContext = _buildSessionContext(session);
+    // Bounded like the live-path verifier (see _withTimeout / VERIFIER_OVERALL_TIMEOUT_MS):
+    // a wedged background model must not strand this approval. Fail-open on timeout/error.
     let verifier = { enabled: false, verdict: 'unknown' };
-    try { verifier = await verifyIfEnabled({ context, dbModule, callModel }); } catch { verifier = { enabled: false, verdict: 'unknown' }; }
+    try {
+      verifier = await _withTimeout(
+        verifyIfEnabled({ context, dbModule, callModel }),
+        VERIFIER_OVERALL_TIMEOUT_MS,
+        { enabled: false, verdict: 'unknown' },
+      );
+    } catch { verifier = { enabled: false, verdict: 'unknown' }; }
     if (verifier.enabled && verifier.verdict === 'unsafe') {
       const blocked = classifyBlockReason(context);
       return {
@@ -2174,6 +2380,32 @@ async function decideApproval(context, session, options = {}) {
         blockCategory: blocked.category || '', verifierVerdict: verifier.verdict, label,
       };
     }
+    // P-E posture: HIGH risk the verifier could not positively clear (disabled /
+    // timeout / unknown) fails CLOSED — ask the human rather than approve blind.
+    // MEDIUM falls through to allow (bounded blast radius). Mirrors the live-path
+    // _verifyAutoApprovalOrBlock so both entrypoints share one posture.
+    if (_highRiskNeedsHumanWhenUnverified(riskLevel, verifier)) {
+      const blocked = classifyBlockReason(context);
+      return {
+        decision: 'ask', decidedBy: 'heuristic', riskLevel: 'high',
+        reason: blocked.reason
+          || (heuristic && heuristic.reasoning)
+          || 'High-risk command could not be automatically verified — approve once to allow it.',
+        blockCategory: blocked.category || '', verifierVerdict: verifier.verdict || 'unverified',
+        label, suggestedRule: (heuristic && heuristic.rulePattern) || '',
+      };
+    }
+  }
+  // Posture (P-G): cautious holds an otherwise-approved pure-heuristic MEDIUM for
+  // the human. Runs after every hard gate (blocklist/deny/high-fail-closed) and
+  // never touches user-allow / learned-rule / low decisions.
+  if (_postureHoldsMedium(posture, riskLevel, decidedBy)) {
+    return {
+      decision: 'ask', decidedBy: 'posture', riskLevel: 'medium',
+      reason: 'Cautious posture — holding this medium-risk action for your approval.',
+      label, suggestedRule: (heuristic && heuristic.rulePattern) || '',
+    };
   }
   return {
@@ -2257,7 +2489,7 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
   // verifier (the user has explicitly vouched for it).
   let permRules = [];
   try { permRules = typeof dbModule.listPermRules === 'function' ? dbModule.listPermRules({}) : []; } catch { permRules = []; }
-  const permMatch = matchPermission({ toolName: context.toolName, command: context.command }, permRules);
+  const permMatch = matchPermission({ toolName: context.toolName, command: context.command, mcpServer: context.mcpServer, mcpTool: context.mcpTool }, permRules);
   if (permMatch && permMatch.action === 'deny') {
     const reasoning = `Permission Manager deny rule matched: ${permMatch.rule}`;
     try {
@@ -2302,6 +2534,37 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
     : matchingRule ? `Matched learned rule: ${matchingRule.label}`
     : 'Auto-approved by default (not on the denylist)';
+  // Heuristic-forced escalation (e.g. un-allowlisted network egress): route straight
+  // to the Pending "Needs Review" surface as a granular, generalized rule the user can
+  // approve once. Deterministic — does NOT depend on the fail-open LLM verifier, which
+  // could let an un-vouched host through when uncertain or down.
+  if (!userAllowed && !matchingRule && heuristic && heuristic.forceEscalate) {
+    const parts = escalationCommandParts(context);
+    const groupKey = (() => { try { return commandHead(parts.signature) || ''; } catch { return ''; } })();
+    const escReason = heuristic.reasoning || 'Needs review before allowing.';
+    const escRisk = heuristic.riskLevel || 'medium';
+    // Prefer the heuristic's human label (e.g. "Network access to <host>") over the
+    // bare operative command (the host) so the Pending row reads as a category.
+    const escLabel = heuristic.ruleLabel || parts.title || context.toolName || 'Approval needs review';
+    let decisionId;
+    try {
+      decisionId = dbModule.addApprovalDecision({
+        sessionId, toolName: context.toolName,
+        commandSummary: escLabel,
+        fullContext: context.fullContext.slice(0, 2000), warning: context.warning,
+        decision: 'escalated', reasoning: escReason, decidedBy: 'heuristic', riskLevel: escRisk,
+        commandSignature: parts.signature || commandSignature,
+      });
+    } catch (e) { console.error('[approval-agent] DB error:', e.message); }
+    broadcastFn(sessionId, session, {
+      type: 'approval-decision', sessionId, decision: 'escalated', decidedBy: 'heuristic', decisionId,
+      label: escLabel, reasoning: escReason, groupKey, riskLevel: escRisk,
+      suggestedRule: heuristic.rulePattern || '',
+      command: (context.command || '').slice(0, 500), warning: context.warning,
+    });
+    return true;
+  }
   if (!userAllowed) {
     // Verifier scope: medium+ risk only — read-only/low-risk ops auto-approve fast.
     const verifierBlock = await _verifyAutoApprovalOrBlock(sessionId, session, context, broadcastFn, label, decidedBy, riskLevel, callModel);
@@ -2341,6 +2604,8 @@ async function handleApprovalCheck(sessionId, session, cleanText, broadcastFn, p
 module.exports = {
   parseApprovalContext,
+  _refreshMcpAnnotations,
+  _resetMcpAnnotationCache: () => { _mcpAnnoAt = 0; _mcpAnnoRaw = undefined; },
   isLiveApprovalPrompt,
   isPlanApprovalPrompt,
   planCardFingerprint,
@@ -2355,6 +2620,7 @@ module.exports = {
   _isTmpScopedRmClause,
   _isPortScopedKillClause,
   _buildSessionContext,
+  _withTimeout,
   normalizeCommandSignature,
   escalationCommandParts,
   classifyBlockReason,