dsh-perm-gate 5.1.2-compat.7 → 5.1.2

package/lib/command-normalize.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Command normalization — decode the layers a call hides behind, as a scan signal.
+ *
+ * Why this exists: every deterministic layer reads the command *as written*.
+ * `deny-defaults` is a word list, the parsers switch on `baseName`, and
+ * `isCleanupSafe` matches path segments. All three are blind to
+ * `powershell -EncodedCommand UgBlAG0A...`, to `R="-rf"; rm $R /`, and to a
+ * function wrapper around a wipe. Measured on the eval set, the encoded cases are
+ * exactly where a graded model ships an unrecoverable act past the gate
+ * (`adv_013` decodes to `Remove-Item -Recurse -Force C:\`, `adv_032` to
+ * `DROP DATABASE orders_prod`).
+ *
+ * Two rules keep this from becoming its own vulnerability:
+ *
+ * 1. **Additive only.** The caller feeds these strings to *stricter* scans
+ *    (deny-keyword, P0 wipe detection, tier grading). Nothing here can widen a
+ *    decision, and no result is written back to `exec.arguments` or the event
+ *    log, so fingerprints, grants and audit text stay about the call as received.
+ * 2. **Bounded.** Length caps, depth cap, variant cap and a printable-ratio gate,
+ *    because decoding is attacker-controlled input on the decision path. Oversized
+ *    or undecodable input yields nothing, which leaves the call
+ *    `targetResolvable=false` — opaque, never optimistically safe.
+ *
+ * On the plugin's own `--exec-b64` launcher wrapper: it is decoded like anything
+ * else rather than exempted. An exemption would hand the agent a disguise
+ * (`ac-launcher --config x --exec-b64 <rm -rf ...>`), while decoding it can only
+ * ever escalate — so the cost is at most a second confirmation, never a block
+ * that could not have been reached honestly.
+ */
+/** Where a decoded string came from, and whether the original runs it as code. */
+export interface NormalizedText {
+    readonly text: string;
+    readonly via: 'base64' | 'hex' | 'varsub';
+    /**
+     * True when the payload is handed to an execution primitive
+     * (`-EncodedCommand`, `FromBase64String`, `Invoke-Expression`, `eval`,
+     * `bash -c`, `xxd -r -p` …), i.e. it will really run. Only these variants may
+     * feed P0 hard-deny; a stray base64 blob in a comment must not.
+     */
+    readonly executed: boolean;
+}
+export interface NormalizeOptions {
+    /** Refuse to touch a command longer than this (DoS + false-positive guard). */
+    readonly maxInputChars?: number;
+    /** How many decode layers to peel. */
+    readonly maxDepth?: number;
+    /** Shortest base64 blob considered (below this, too noisy). */
+    readonly minBlobChars?: number;
+    /** Longest decoded output kept. */
+    readonly maxOutputChars?: number;
+    /** Hard cap on returned variants. */
+    readonly maxVariants?: number;
+    /**
+     * Wall-clock budget for the whole peel. On expiry **all** partial work is
+     * dropped, not just the remaining layers: a decoded fragment found late could
+     * turn into a P0 deny, and the guardrail this plugin cannot trade away is that
+     * the normalizer never decides — an expired peel leaves the call opaque, so the
+     * decision falls back to the ask it was already heading for.
+     */
+    readonly maxMs?: number;
+    /** Injected clock (tests drive the deadline without sleeping). */
+    readonly now?: () => number;
+}
+/**
+ * Peel encoding layers off one command and return every readable variant.
+ *
+ * Never throws: any failure yields whatever decoded fine, and an empty result
+ * simply means the call stays opaque to the deterministic layers. Exceeding the
+ * time budget returns **nothing** rather than the partial set (see `maxMs`).
+ */
+export declare function normalizeCommandText(text: string, options?: NormalizeOptions): NormalizedText[];
+/**
+ * Whether a command is the plugin's own AppContainer launcher wrapper.
+ * Informational only — the payload is still decoded and judged on its merits.
+ */
+export declare function isOwnLauncher(text: string): boolean;
+/** Variants strict enough to feed a deterministic deny: the payload actually runs. */
+export declare function executableVariants(variants: readonly NormalizedText[]): string[];
+/** All decoded variants, for the additive-only keyword/tier scans. */
+export declare function allVariants(variants: readonly NormalizedText[]): string[];

package/lib/command-normalize.js

@@ -0,0 +1,246 @@
+/**
+ * Command normalization — decode the layers a call hides behind, as a scan signal.
+ *
+ * Why this exists: every deterministic layer reads the command *as written*.
+ * `deny-defaults` is a word list, the parsers switch on `baseName`, and
+ * `isCleanupSafe` matches path segments. All three are blind to
+ * `powershell -EncodedCommand UgBlAG0A...`, to `R="-rf"; rm $R /`, and to a
+ * function wrapper around a wipe. Measured on the eval set, the encoded cases are
+ * exactly where a graded model ships an unrecoverable act past the gate
+ * (`adv_013` decodes to `Remove-Item -Recurse -Force C:\`, `adv_032` to
+ * `DROP DATABASE orders_prod`).
+ *
+ * Two rules keep this from becoming its own vulnerability:
+ *
+ * 1. **Additive only.** The caller feeds these strings to *stricter* scans
+ *    (deny-keyword, P0 wipe detection, tier grading). Nothing here can widen a
+ *    decision, and no result is written back to `exec.arguments` or the event
+ *    log, so fingerprints, grants and audit text stay about the call as received.
+ * 2. **Bounded.** Length caps, depth cap, variant cap and a printable-ratio gate,
+ *    because decoding is attacker-controlled input on the decision path. Oversized
+ *    or undecodable input yields nothing, which leaves the call
+ *    `targetResolvable=false` — opaque, never optimistically safe.
+ *
+ * On the plugin's own `--exec-b64` launcher wrapper: it is decoded like anything
+ * else rather than exempted. An exemption would hand the agent a disguise
+ * (`ac-launcher --config x --exec-b64 <rm -rf ...>`), while decoding it can only
+ * ever escalate — so the cost is at most a second confirmation, never a block
+ * that could not have been reached honestly.
+ */
+const DEFAULTS = {
+    maxInputChars: 4096,
+    maxDepth: 3,
+    minBlobChars: 16,
+    maxOutputChars: 2048,
+    maxVariants: 8,
+    maxMs: 25,
+    now: Date.now,
+};
+/** Primitives that run a following encoded string / blob as code. */
+const EXEC_PRIMITIVE = /(?:-EncodedCommand|FromBase64String|Invoke-Expression|\biex\b|\beval\b|bash\s+-c|sh\s+-c|pwsh\s+-c|powershell\s+-c|xxd\s+-r|--decode\b)/i;
+/** base64 blobs long enough to be a real payload, quoted or bare. */
+const B64_RE = /["']?([A-Za-z0-9+/]{16,}={0,2})["']?/g;
+/** `\x72\x6d` escapes, or a spaced hex dump. */
+const HEX_ESCAPE_RE = /\\x([0-9a-fA-F]{2})/g;
+const HEX_PAIR_RE = /[0-9a-fA-F]{2}/g;
+/**
+ * Simple assignments we can substitute textually: `X="v"`, `$X='v'`, `${X}: v`.
+ *
+ * The value is matched lazily without escape handling, because a Windows path is
+ * the common case and ends in a backslash right before the closing quote
+ * (`$t="C:\"`): an escape-aware pattern cannot find that terminator and silently
+ * yields nothing, which is the exact blind spot this folding exists to close.
+ * Truncating a value that contains a literal quote is acceptable here — variants
+ * only ever feed stricter scans.
+ */
+const ASSIGN_RE = /\$?\{?([A-Za-z_][A-Za-z0-9_]*)\}?\s*=\s*(["'])(.*?)\2/g;
+/** Share of decoded bytes that must be printable before we trust it as a command. */
+const PRINTABLE_MIN = 0.85;
+function printableRatio(text) {
+    if (text === '')
+        return 0;
+    let ok = 0;
+    for (const ch of text) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (code === 0x09 || code === 0x0a || code === 0x0d || (code >= 0x20 && code !== 0x7f))
+            ok += 1;
+    }
+    return ok / text.length;
+}
+function clip(text, max) {
+    return text.length <= max ? text : text.slice(0, max);
+}
+/** Decoded text is only useful if it plausibly is a command, not binary noise. */
+function looksLikeText(text, minPrintable = PRINTABLE_MIN) {
+    return text !== '' && printableRatio(text) >= minPrintable && /[A-Za-z]{3}/.test(text);
+}
+/** Decode a blob as one encoding; '' when it is not valid base64 at all. */
+function decodeB64(blob, encoding) {
+    try {
+        return Buffer.from(blob, 'base64').toString(encoding);
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Decode one base64 blob, or undefined when it is not decodable text.
+ *
+ * Two readings are attempted because they look identical from outside and both
+ * are common:
+ * - **utf16le** — `powershell/pwsh -EncodedCommand` and
+ *   `[Convert]::ToBase64String([Text.Encoding]::Unicode…)` carry UTF-16LE. Read
+ *   as UTF-8 the result is `R\0e\0m\0o\0v\0e…`, which a printable check alone
+ *   rejects: a silent false negative on exactly the highest-value case, caught
+ *   only once the test asserted the decoded text.
+ * - **utf8** — POSIX `base64 -d` and generic payloads.
+ */
+function tryB64(blob, opts) {
+    if (blob.length < opts.minBlobChars)
+        return undefined;
+    const utf8 = decodeB64(blob, 'utf8');
+    const interleavedNull = /\x00/.test(utf8);
+    if (!interleavedNull && looksLikeText(utf8))
+        return clip(utf8, opts.maxOutputChars);
+    const utf16 = decodeB64(blob, 'utf16le');
+    if (looksLikeText(utf16))
+        return clip(utf16, opts.maxOutputChars);
+    if (looksLikeText(utf8))
+        return clip(utf8, opts.maxOutputChars);
+    return undefined;
+}
+/** Decode `\x72\x6d` escapes or a spaced hex dump into text. */
+function tryHex(blob, opts) {
+    const escaped = [];
+    HEX_ESCAPE_RE.lastIndex = 0;
+    let e = HEX_ESCAPE_RE.exec(blob);
+    while (e !== null) {
+        escaped.push(parseInt(e[1] ?? '0', 16));
+        e = HEX_ESCAPE_RE.exec(blob);
+    }
+    const bytes = escaped.length > 0 ? escaped : [];
+    if (bytes.length === 0) {
+        const compact = blob.replace(/\s+/g, '');
+        if (compact.length % 2 !== 0)
+            return undefined;
+        HEX_PAIR_RE.lastIndex = 0;
+        let m = HEX_PAIR_RE.exec(compact);
+        while (m !== null) {
+            bytes.push(parseInt(m[0], 16));
+            m = HEX_PAIR_RE.exec(compact);
+        }
+    }
+    if (bytes.length === 0)
+        return undefined;
+    let hex;
+    try {
+        hex = Buffer.from(bytes).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    if (!looksLikeText(hex))
+        return undefined;
+    return clip(hex, opts.maxOutputChars);
+}
+/**
+ * Substitute `X="rm -rf"` / `$X` pairs so `rm $X /` becomes visible as one
+ * string. Only literal assignments are folded; nothing is evaluated.
+ */
+function expandVars(text, opts) {
+    const table = new Map();
+    ASSIGN_RE.lastIndex = 0;
+    let m = ASSIGN_RE.exec(text);
+    while (m !== null) {
+        const name = m[1];
+        const value = m[3] ?? '';
+        if (name !== undefined && value !== '')
+            table.set(name, value);
+        m = ASSIGN_RE.exec(text);
+    }
+    if (table.size === 0)
+        return undefined;
+    let out = text;
+    for (const [name, value] of table) {
+        // Skip the assignment's own left-hand side (`$t=` …), which would otherwise
+        // be rewritten into noise like `C:\="C:\"`; only uses are folded.
+        const use = new RegExp(`\\$\\{?${name}\\}?(?!\\s*=)`, 'g');
+        out = out.replace(use, () => value);
+    }
+    return out === text ? undefined : clip(out, opts.maxOutputChars);
+}
+/**
+ * Peel encoding layers off one command and return every readable variant.
+ *
+ * Never throws: any failure yields whatever decoded fine, and an empty result
+ * simply means the call stays opaque to the deterministic layers. Exceeding the
+ * time budget returns **nothing** rather than the partial set (see `maxMs`).
+ */
+export function normalizeCommandText(text, options = {}) {
+    const opts = { ...DEFAULTS, ...options };
+    if (typeof text !== 'string' || text.trim() === '' || text.length > opts.maxInputChars)
+        return [];
+    const startedAt = opts.now();
+    const spent = () => opts.now() - startedAt;
+    const seen = new Set();
+    const out = [];
+    const push = (variant) => {
+        const trimmed = variant.text.trim();
+        if (trimmed === '' || seen.has(trimmed))
+            return;
+        seen.add(trimmed);
+        out.push({ ...variant, text: trimmed });
+    };
+    let frontier = [{ text, executed: false }];
+    for (let depth = 0; depth < opts.maxDepth && frontier.length > 0 && out.length < opts.maxVariants; depth += 1) {
+        if (spent() > opts.maxMs)
+            return [];
+        const next = [];
+        for (const item of frontier) {
+            const runsCode = item.executed || EXEC_PRIMITIVE.test(item.text);
+            B64_RE.lastIndex = 0;
+            let b = B64_RE.exec(item.text);
+            while (b !== null) {
+                const decoded = tryB64(b[1] ?? '', opts);
+                if (decoded !== undefined) {
+                    push({ text: decoded, via: 'base64', executed: runsCode });
+                    next.push({ text: decoded, executed: runsCode });
+                }
+                b = B64_RE.exec(item.text);
+            }
+            if (/\\x[0-9a-fA-F]{2}/.test(item.text) || /(?:\b[0-9a-fA-F]{2}\b){6,}/.test(item.text)) {
+                const decoded = tryHex(item.text, opts);
+                if (decoded !== undefined) {
+                    push({ text: decoded, via: 'hex', executed: runsCode });
+                    next.push({ text: decoded, executed: runsCode });
+                }
+            }
+            const expanded = expandVars(item.text, opts);
+            if (expanded !== undefined) {
+                // A folded variable is the same command the shell will run, not a hidden
+                // payload, so it always counts as executed.
+                push({ text: expanded, via: 'varsub', executed: true });
+                next.push({ text: expanded, executed: true });
+            }
+            if (out.length >= opts.maxVariants)
+                break;
+        }
+        frontier = next;
+    }
+    return out.slice(0, opts.maxVariants);
+}
+/**
+ * Whether a command is the plugin's own AppContainer launcher wrapper.
+ * Informational only — the payload is still decoded and judged on its merits.
+ */
+export function isOwnLauncher(text) {
+    return /--exec-b64\s+[A-Za-z0-9+/=]{8,}/.test(text) && /--config\s+/.test(text);
+}
+/** Variants strict enough to feed a deterministic deny: the payload actually runs. */
+export function executableVariants(variants) {
+    return variants.filter((v) => v.executed).map((v) => v.text);
+}
+/** All decoded variants, for the additive-only keyword/tier scans. */
+export function allVariants(variants) {
+    return variants.map((v) => v.text);
+}

package/lib/engine.js

@@ -9,57 +9,15 @@
  * Strictly fail-closed: P0 wins over every later stage.
  */
 import { isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
-// SHELL_TOOLS 是**值的导入**：这份名单必须与 evaluate.ts / runtime.ts 共用同一个
-// 事实源。此处曾经自带一份 `/(?:bash|pwsh|sh|cmd)$/` 正则，漏掉了 `shell` /
-// `terminal` / `powershell`——于是 P0 的 shell 检查对 DSH 的**主 shell 工具**
-// 完全失效（实测：同一句 `echo x > /etc/passwd`，bash 被拦截，shell 放行）。
-// 同名事实的第二份副本必然腐烂，这里不再保留副本。
-import { SHELL_TOOLS } from './evaluate.js';
-import { isForceDeletion, isRecursiveDeletion, decomposeShellCommand } from './shell.js';
+import { commandIrreversibleReason, irreversibleReason } from './irreversible.js';
+import { executableVariants, normalizeCommandText } from './command-normalize.js';
+// 工具名名单归 `tool-names.ts` 所有（不得在此处再抄一份）。P0 **不看工具名白名单**：
+// 它看 `executableCommandOf`——已知非执行器（read/write/内部工具）的 `command` 参数是数据，
+// 其余任何带命令串的调用都按命令对待，所以工具叫什么（包括模型打错的 `pash`）都不是绕过面。
+import { INTERNAL_TOOLS, READ_TOOLS, executableCommandOf } from './tool-names.js';
+import { decomposeShellCommand } from './shell.js';
 import { dispatchCommand } from './command-dispatcher.js';
 const DESTRUCTIVE_TOOL = /(?:^|[_-])(?:delete|remove|rm|destroy|erase|purge|wipe|unlink|rmdir|reset)(?:$|[_-]|recursive)/i;
-/**
- * Read-only tools that can never modify the workspace or execute anything. P0
- * still protects sensitive path reads outside the workspace root, and the
- * deny-keyword layer still runs first, so a search whose query contains a
- * blacklisted phrase is still vetoed.
- */
-const READ_TOOLS = new Set([
-    'read', 'read_image', 'grep', 'glob', 'ls', 'lsp',
-    // Search / lookup: every one of these only READS. `web_search` and
-    // `modlens_read_image` also reach the network, but through DSH's own client
-    // rather than a subprocess — see the network note below.
-    'web_search', 'modlens_read_image',
-    'advanced_search', 'platform_search', 'free_search_test',
-    // Session-scoped reads: they disclose already-recorded state, never mutate.
-    'context_compression_retrieve', 'memory_search_graph', 'memory_expand_graph_node',
-]);
-/** DSH internal coordination / management tools — not workspace-modifying. */
-const INTERNAL_TOOLS = new Set([
-    // AgentTeams coordination
-    'agent_teams_create', 'agent_teams_add_member', 'agent_teams_remove_member',
-    'agent_teams_delete', 'agent_teams_edit_plan', 'agent_teams_reassign_task',
-    'agent_teams_claim_task', 'agent_teams_create_task', 'agent_teams_send_message',
-    'agent_teams_approve', 'agent_teams_resume',
-    // AgentTeams status reads
-    'agent_teams_status', 'agent_teams_update_task',
-    // DSH session/memory/goal/taskboard management. The memory store is the
-    // agent's own state, not the workspace: writing it is not a workspace write.
-    'conversation_search',
-    'memory_add', 'memory_delete', 'memory_read_scene', 'memory_search',
-    'memory_import', 'memory_ruminate', 'memory_ruminate_cancel', 'memory_ruminate_status',
-    'get_goal', 'update_goal', 'create_goal',
-    'taskboard_get', 'taskboard_list', 'taskboard_claim', 'taskboard_block',
-    'taskboard_comment', 'taskboard_release_claim', 'taskboard_submit_review',
-    'taskboard_relate',
-    // Job/agent management
-    'job_list', 'job_output', 'job_kill',
-    'list_agents', 'interrupt_agent', 'send_message',
-    // Session-local UI / plan / todo state (no workspace write, no execution)
-    'todo_write', 'render_ui', 'validate_dsh_ui', 'ask_user_question', 'exit_plan_mode',
-    // Background / planning delegation (the delegated work is gated separately)
-    'subagent', 'subagent_fork', 'ralph', 'workflow', 'skill',
-]);
 /** No user-configured extra auto-allow names. */
 const NO_EXTRA_AUTO_ALLOW = new Set();
 /** The built-in read-only / internal classification, for diagnostics and docs. */
@@ -102,9 +60,41 @@ function operationText(args, depth = 0) {
     }
     return parts.join(' ');
 }
+/**
+ * Credential or private-key material a call carries.
+ *
+ * Two clauses were removed on purpose, both because this predicate reads one flat
+ * string and therefore cannot tell *using* a secret from *moving* one — and P0 is
+ * the layer nobody can appeal:
+ *
+ * - `Bearer <token>`: putting a token in its own `Authorization` header is how every
+ *   API is called. The benign-encoding corpus measured it as a false hard-deny
+ *   (`curl -H "Authorization: Bearer …" https://api.internal/v1/me`); a command that
+ *   cannot be shown to anyone is also a command that never reaches the popup.
+ * - a read-only look at a key file: `Test-Path ~/.ssh/id_rsa` moves nothing. The
+ *   plan's own grading rule says so ("reading a local credential is not itself the
+ *   act"), and the deny layer must not contradict the prompt it hands the model.
+ *
+ * What is left is the theft shape: a secret *artifact* plus a channel out, or any
+ * non-readonly verb touching one. That pairing lives in `irreversible.ts`, so both
+ * layers agree.
+ */
+const CREDENTIAL_MATERIAL = /(?:BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i;
+/** Verbs that only look. A call made of nothing else cannot have leaked anything. */
+const READ_ONLY_HEAD = /^(?:test-path|test|ls|dir|get-childitem|get-content|get-item|cat|type|more|head|tail|stat|file|select-string|where|which|exists)$/i;
+/** Whether every segment of this command text is a read-only look. */
+function readonlyProbe(text) {
+    const segments = text.split(/[;&|\n]+/).map((s) => s.trim()).filter((s) => s !== '');
+    if (segments.length === 0)
+        return false;
+    return segments.every((seg) => {
+        const head = (seg.replace(/^["'`]+/, '').split(/[\s/]+/)[0] ?? '').toLowerCase();
+        return READ_ONLY_HEAD.test(head);
+    });
+}
 function containsCredentialMaterial(args) {
-    return /(?:BEGIN (?:RSA |OPENSSH )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|Bearer\s+[A-Za-z0-9._~+\/-]{8,}|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i
-        .test(operationText(args));
+    const text = operationText(args);
+    return CREDENTIAL_MATERIAL.test(text) && !readonlyProbe(text);
 }
 function pathArgument(args) {
     for (const key of ['file_path', 'path', 'cwd', 'workdir']) {
@@ -116,6 +106,14 @@ function pathArgument(args) {
 }
 /** 廉价前缀过滤：绝大多数 shell 调用不是 push，先过一遍正则再动用解析器。 */
 const GIT_PUSH_TEXT = /\bgit\s+push\b/;
+/**
+ * Irreversibility itself is **not** defined here: it lives in `irreversible.ts`,
+ * shared with the tier grading in `ask-context.ts`. Two copies of that fact drift,
+ * and the drift was observed — `Optimize-VHD` was known to no rule while no graded
+ * model hard-denied it either. P0 consumes the shared judgement, and only ever
+ * turns it into a deny for the command as received plus the decoded variants the
+ * original will actually execute.
+ */
 /**
  * 远端历史改写：`git push` 强制覆盖或删除**保护分支**。
  *
@@ -158,23 +156,45 @@ export function hardDenyReason(ctx) {
     const args = ctx.args;
     if (containsCredentialMaterial(args))
         return 'call contains credential or private-key material';
-    if (SHELL_TOOLS.has(ctx.tool) && typeof args.command === 'string') {
+    // **Shape, not a name whitelist** (see tool-names.ts): a call that carries a
+    // command string and is not a known non-executor is a command call whatever the
+    // tool is called, or an unfamiliar name would skip P0 with `diskpart /s x.txt`
+    // sitting right there in `args`.
+    const commandText = executableCommandOf(ctx.tool, args);
+    if (commandText !== undefined) {
+        // Encoded layers are resolved **first**: `-EncodedCommand` hides the act from
+        // every word-boundary rule below, and the visible shell form can itself be
+        // undecodable to the parser (unbalanced quotes), whose early exit must not
+        // also skip this check. Only variants the original hands to an execution
+        // primitive are trusted, and they can only ever add a deny — nothing here
+        // widens, and no decoded text is written back to the call or the log.
+        let decodedReason;
+        for (const variant of executableVariants(normalizeCommandText(commandText))) {
+            const hidden = irreversibleReason(variant);
+            if (hidden !== undefined) {
+                decodedReason = `${hidden} (decoded from an encoded layer)`;
+                break;
+            }
+        }
         let commands = [];
         try {
-            commands = decomposeShellCommand(args.command).commands;
+            commands = decomposeShellCommand(commandText).commands;
         }
         catch {
-            return undefined; // undecidable syntax -> route to ask (P4), never allow
+            // Undecidable syntax routes to ask (P4), never allow — unless a decode
+            // already proved an irreversible act.
+            return decodedReason;
         }
         for (const cmd of commands) {
-            if (cmd.command === 'rm' && (isRecursiveDeletion(cmd) || isForceDeletion(cmd))) {
-                // Guarded further by path rules; root-level deletion denied below only
-                // when the explicit target is a protected root.
-            }
             const redir = cmd.redirects.find((r) => isProtectedDestructiveTarget(r, ctx.dshHome));
             if (redir !== undefined)
                 return `shell redirect targets protected path: ${redir}`;
+            const wipe = commandIrreversibleReason(cmd);
+            if (wipe !== undefined)
+                return wipe;
         }
+        if (decodedReason !== undefined)
+            return decodedReason;
         const rewrite = gitRemoteRewriteReason(commands);
         if (rewrite !== undefined)
             return rewrite;

package/lib/evaluate.d.ts

@@ -32,6 +32,11 @@ export interface Decision {
  * command-content inspection below for the primary tool — every `git push`,
  * `chmod`, redirect and `tee` would fall through to `defaultAction`.
  */
+/**
+ * Executor names, re-exported for the rule layer's `tools` dimension and for
+ * learning/appcontainer consumers. The list itself lives in `tool-names.ts` so the
+ * "is this an executed command?" question has one answer in the codebase.
+ */
 export declare const SHELL_TOOLS: Set<string>;
 /** Whether one compiled rule matches the given call context. */
 export declare function ruleMatches(rule: CompiledRuleEntry, ctx: ToolCallContext, commands: readonly SimpleCommand[], pathCands: readonly string[], urlCands: readonly string[]): boolean;

package/lib/evaluate.js

@@ -8,6 +8,7 @@ import { extractPathCandidates, extractUrlCandidates, } from './rule.js';
 import { commandArgv, decomposeShellCommand, isForceDeletion, isRecursiveDeletion } from './shell.js';
 import { compileCidr, compilePortSpec, compileDomainPattern } from './compiler.js';
 import { dispatchCommand } from './command-dispatcher.js';
+import { SHELL_TOOLS as IMPORTED_SHELL_TOOLS, WRITE_TOOLS as IMPORTED_WRITE_TOOLS, executableCommandOf, } from './tool-names.js';
 /**
  * Tool names that execute a shell command string. `shell` and `terminal` are
  * DSH's own names (the shipped tool roster uses `shell`; `terminal` is the
@@ -16,7 +17,12 @@ import { dispatchCommand } from './command-dispatcher.js';
  * command-content inspection below for the primary tool — every `git push`,
  * `chmod`, redirect and `tee` would fall through to `defaultAction`.
  */
-export const SHELL_TOOLS = new Set(['shell', 'terminal', 'bash', 'pwsh', 'sh', 'cmd', 'powershell']);
+/**
+ * Executor names, re-exported for the rule layer's `tools` dimension and for
+ * learning/appcontainer consumers. The list itself lives in `tool-names.ts` so the
+ * "is this an executed command?" question has one answer in the codebase.
+ */
+export const SHELL_TOOLS = IMPORTED_SHELL_TOOLS;
 /** Whether one compiled rule matches the given call context. */
 export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     if (!rule.enabled)
@@ -118,7 +124,7 @@ export function ruleMatches(rule, ctx, commands, pathCands, urlCands) {
     }
     return true;
 }
-const WRITE_TOOLS = new Set(['write', 'edit']);
+const WRITE_TOOLS = IMPORTED_WRITE_TOOLS;
 /**
  * Shell write/execution patterns. When NONE of these match, the command is
  * treated as read-only and follows the defaultAction (typically `allow`).
@@ -172,11 +178,9 @@ function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
         return defaultAction;
     }
     // shell/pwsh/terminal: command-content-aware (write pattern → ask)
-    if (SHELL_TOOLS.has(ctx.tool)) {
-        const commandText = commandTextOf(ctx);
-        if (commandText !== undefined && isWriteCommand(commandText))
-            return 'ask';
-    }
+    const commandText = commandTextOf(ctx);
+    if (commandText !== undefined && isWriteCommand(commandText))
+        return 'ask';
     return defaultAction;
 }
 /**
@@ -189,12 +193,14 @@ function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
 function commandTextOf(ctx) {
     if (typeof ctx.commandText === 'string')
         return ctx.commandText;
-    const raw = ctx.args?.['command'];
-    return typeof raw === 'string' ? raw : undefined;
+    return executableCommandOf(ctx.tool, ctx.args);
 }
 /** Compute the deterministic first-match decision (P2 chain). */
 export function decideRules(ruleset, ctx) {
-    const shellText = SHELL_TOOLS.has(ctx.tool) ? commandTextOf(ctx) : undefined;
+    // Command-bearing calls are decomposed by **shape**, not by whether the tool's
+    // name is in SHELL_TOOLS: an unfamiliar executor name must not make the command
+    // dimensions of every rule silently stop matching.
+    const shellText = commandTextOf(ctx);
     const commands = shellText !== undefined ? decomposeSafe(shellText) : [];
     const pathCands = extractPathCandidates(ctx.args);
     const urlCands = extractUrlCandidates(ctx.args);
@@ -213,7 +219,7 @@ export function decideRules(ruleset, ctx) {
     // shell/pwsh/terminal tools check the command for write patterns.
     // Outside safety checks → ask; inside or read-only → defaultAction.
     let action = ruleset.defaultAction;
-    if (WRITE_TOOLS.has(ctx.tool) || SHELL_TOOLS.has(ctx.tool)) {
+    if (WRITE_TOOLS.has(ctx.tool) || shellText !== undefined) {
         action = pathAndCommandDefault(ctx, pathCands, action);
     }
     if (action === 'allow' || action === 'ask') {

package/lib/events.d.ts

@@ -32,6 +32,27 @@ export interface GateEvent {
     readonly learningCount?: number;
     /** Confirmations required before that key auto-allows (manual-approve events). */
     readonly threshold?: number;
+    /**
+     * Salted digest of the redacted input behind this decision.
+     *
+     * Lives as its own field rather than riding in `reason`, because `reason` is
+     * truncated to REASON_MAX on write — attribution data must not be the part
+     * that gets cut. Raw arguments are never stored.
+     */
+    readonly inputDigest?: string;
+    /** Which grading prompt produced this verdict, so wording changes are traceable. */
+    readonly promptVersion?: string;
+    /** Machine keys of "why this asked", so the panel can localize them later. */
+    readonly doubtKinds?: readonly string[];
+    /**
+     * The card the human actually decided from (why it asks / what it touches / what
+     * each button costs). Stored because a review list that shows only the audit
+     * `reason` cannot be read back: the person sees `no rule matched` where they
+     * once read a full explanation.
+     */
+    readonly humanBrief?: string;
+    /** The redacted command, stored apart from the prose so a list can render it as code. */
+    readonly humanCommand?: string;
 }
 export interface GateEventInput {
     readonly sessionId?: string;
@@ -46,6 +67,11 @@ export interface GateEventInput {
     readonly files?: readonly string[];
     readonly learningCount?: number;
     readonly threshold?: number;
+    readonly inputDigest?: string;
+    readonly promptVersion?: string;
+    readonly doubtKinds?: readonly string[];
+    readonly humanBrief?: string;
+    readonly humanCommand?: string;
     /** Session working directory, used to resolve relative snapshot paths. */
     readonly baseDir?: string;
 }

package/lib/events.js

@@ -264,6 +264,13 @@ export class EventLog {
                 ...(files === undefined ? {} : { files }),
                 ...(input.learningCount === undefined ? {} : { learningCount: input.learningCount }),
                 ...(input.threshold === undefined ? {} : { threshold: input.threshold }),
+                ...(input.inputDigest === undefined ? {} : { inputDigest: input.inputDigest }),
+                ...(input.promptVersion === undefined ? {} : { promptVersion: input.promptVersion }),
+                ...(input.doubtKinds === undefined || input.doubtKinds.length === 0 ? {} : { doubtKinds: input.doubtKinds.slice(0, 4) }),
+                // Bounded: this is a card, not a transcript, and the event file is read back
+                // into a UI list where a long entry pushes the rest off screen.
+                ...(input.humanBrief === undefined ? {} : { humanBrief: String(input.humanBrief).slice(0, 600) }),
+                ...(input.humanCommand === undefined || input.humanCommand === '' ? {} : { humanCommand: String(input.humanCommand).slice(0, 400) }),
             };
             mkdirSync(dirname(this.filePath), { recursive: true });
             appendFileSync(this.filePath, JSON.stringify(ev) + '\n', 'utf8');