dsh-perm-gate 5.1.2 → 5.3.0

package/lib/runtime.js

@@ -9,18 +9,21 @@
  * live harness.
  */
 import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
 import { makeEntry, MemoryAuditMirror } from './audit.js';
 import { resolvePermissiveStrategies } from './config.js';
 import { appendAllowCommand, listAllowCommands, listAllowFromRulesDoc, replaceAllowCommands } from './allowlist.js';
-import { decide, CONTENT_ARG_KEYS } from './engine.js';
+import { decide } from './engine.js';
+import { keywordScanText } from './scan-text.js';
 import { EventLog, saveEventSnapshots } from './events.js';
 import { decideRules } from './evaluate.js';
 import { canonicalizeCall, GrantRegistry } from './grant.js';
 import { learnKey, operationFingerprint, RiskLearning } from './learning.js';
 import { ArtifactRegistry } from './path.js';
-import { classifyRisk, classifyRiskWith, RISK_SYSTEM_PROMPT_VERSION } from './risk.js';
-import { askDoubtKinds, buildAskContext, humanBrief, humanCardLine, humanCommand, toEventFields } from './ask-context.js';
+import { classifyRisk, classifyRiskWith, graderNote, RISK_SYSTEM_PROMPT_VERSION } from './risk.js';
+import { askDoubtKinds, buildAskContext, humanBrief, humanCardLine, humanCommand, toEventFields, toGraderPayload } from './ask-context.js';
+import { readScriptContents, scriptRefs, scriptsFullyCovered } from './script-review.js';
 import { redactCommandText } from './redact.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 import { completeViaHost, DEFAULT_HOST_MODEL } from './host-llm.js';
@@ -31,6 +34,7 @@ import { extractAgentCandidates } from './agent-identity.js';
 import { resolveRuleChain } from './rule-chain.js';
 import { DEFAULT_DENY_KEYWORDS } from './deny-defaults.js';
 import { permissionPresetOf, presetInScope } from './preset.js';
+import { resolveTierMode } from './unattended.js';
 import { resolveGatePresets } from './config.js';
 /** Locate a rule by its chain-wide index (deny entries first, then allow, then ask). */
 function findRuleByIndex(ruleset, index) {
@@ -399,8 +403,14 @@ export class PermGateRuntime {
             // `decideRules` uses this to determine whether a write/edit target is
             // inside the workspace or outside it.
             home: cwdOf(exec),
+            // The real user directory — distinct from `home` above, which is the workspace
+            // root. A declared credential path is written `~/.myco/vault.token`, and expanding
+            // that against the workspace would silently protect nothing.
+            userHome: homedir(),
             caseInsensitive: this.options.caseInsensitivePaths ?? true,
             dshHome: this.options.dshHome,
+            credentialPaths: this.liveCredentialPaths(),
+            scanKeys: this.liveScanKeys(),
             agentCandidates: extractAgentCandidates(exec),
         };
     }
@@ -646,6 +656,71 @@ export class PermGateRuntime {
             ? this.options.readPermissive()
             : { enabled: this.permissiveEnabled, strategies: this.strategies };
     }
+    /** Whether YOLO mode is live (never human-confirm). */
+    isYolo() {
+        return this.options.readYolo !== undefined ? this.options.readYolo() : (this.options.yolo ?? false);
+    }
+    /** Whether degraded review is live (no reviewer ⇒ rule-only gate). */
+    isRulesFallback() {
+        return this.options.readRulesFallback !== undefined
+            ? this.options.readRulesFallback()
+            : (this.options.rulesFallback ?? false);
+    }
+    /** Whether script-body review is live (default on). */
+    isScriptReview() {
+        return this.options.readScriptReview !== undefined
+            ? this.options.readScriptReview()
+            : (this.options.scriptReview ?? true);
+    }
+    /**
+     * The scripts one call will run, read for review.
+     *
+     * `bash ./clean-home.sh` names a file; the operation is inside it. So the body is
+     * fetched (bounded, never executing anything) and handed to the same three reviewers
+     * the rest of the call is: the deterministic nets judge it (an irreversible body is
+     * `I` no model may clear), the grader is shown it (`script_contents`), and the human
+     * card says it was attached. When *every* named script was read, the call is no longer
+     * an unreadable payload — that is what lifts a workspace-outside script run out of the
+     * `U` tier instead of parking it as unknowable.
+     *
+     * Best-effort by construction: any read problem yields "nothing attached", which the
+     * tier machinery already treats as opaque. It must never throw into the decision path.
+     */
+    scriptReviewFor(exec, workspace) {
+        if (!this.isScriptReview())
+            return {};
+        try {
+            const args = (exec.arguments ?? {});
+            const text = typeof exec.commandText === 'string' && exec.commandText !== ''
+                ? exec.commandText
+                : (typeof args.command === 'string' ? args.command : (typeof args.cmd === 'string' ? args.cmd : ''));
+            if (text === '')
+                return {};
+            const refs = scriptRefs(text);
+            if (refs.length === 0)
+                return {};
+            const contents = readScriptContents(refs, workspace ?? process.cwd());
+            if (contents.length === 0)
+                return {};
+            return { scriptContents: contents, scriptsCovered: scriptsFullyCovered(refs, contents) };
+        }
+        catch {
+            return {};
+        }
+    }
+    /**
+     * Whether a risk grader is reachable: an injected hook, the host `llm` service in
+     * host mode, or a configured custom endpoint. When false, YOLO decides purely on the
+     * deterministic danger signal (fail-open for a non-dangerous ask).
+     */
+    classifierUsable() {
+        if (this.options.riskHook !== undefined)
+            return true;
+        if (this.liveClassifySource() === 'host' && this.options.hostLlm !== undefined)
+            return true;
+        const cfg = this.options.readClassifyConfig?.();
+        return cfg?.endpoint !== undefined && cfg?.endpoint !== '' && cfg?.model !== undefined && cfg?.model !== '';
+    }
     /**
      * The session's selected permission preset, folded from its event log. The
      * fold is cached on the log's length plus the identity of its last event: a
@@ -732,7 +807,38 @@ export class PermGateRuntime {
     liveDenyKeywords() {
         const read = this.options.readDenyKeywords;
         const override = read !== undefined ? read() : undefined;
-        return Array.isArray(override) && override.length > 0 ? override : DEFAULT_DENY_KEYWORDS;
+        const base = Array.isArray(override) && override.length > 0 ? override : DEFAULT_DENY_KEYWORDS;
+        // Extras append, never replace, and the result is de-duplicated: listing the same
+        // word twice should not read as two distinct protections in the audit.
+        const extraRead = this.options.readDenyKeywordsExtra;
+        const extra = extraRead !== undefined ? extraRead() : (this.options.denyKeywordsExtra ?? []);
+        if (!Array.isArray(extra) || extra.length === 0)
+            return base;
+        const appended = extra.map((k) => String(k).trim()).filter((k) => k !== '');
+        return appended.length === 0 ? base : [...new Set([...base, ...appended])];
+    }
+    /** The user-declared credential paths, as configured (may be empty). */
+    liveCredentialPaths() {
+        const read = this.options.readCredentialPaths;
+        const list = read !== undefined ? read() : (this.options.credentialPaths ?? []);
+        return Array.isArray(list) ? list : [];
+    }
+    /**
+     * The configured additions to the two argument-key sets, or `undefined` when nothing was
+     * configured so `scan-text` keeps its built-in pair without rebuilding anything.
+     *
+     * Read per call: both settings are volatile, and a scan rule that only applies after a
+     * reload is a scan rule nobody can reason about while debugging a false positive.
+     */
+    liveScanKeys() {
+        const readContent = this.options.readExtraContentArgKeys;
+        const readOperation = this.options.readExtraOperationArgKeys;
+        const content = readContent !== undefined ? readContent() : (this.options.extraContentArgKeys ?? []);
+        const operation = readOperation !== undefined ? readOperation() : (this.options.extraOperationArgKeys ?? []);
+        const clean = (list) => Array.isArray(list) && list.length > 0 ? list : undefined;
+        const c = clean(content);
+        const o = clean(operation);
+        return c === undefined && o === undefined ? undefined : { ...(c === undefined ? {} : { content: c }), ...(o === undefined ? {} : { operation: o }) };
     }
     /**
      * The preset deny-keyword layer (inherited from dsh-approval-gate): a keyword
@@ -752,7 +858,7 @@ export class PermGateRuntime {
         const keywords = this.liveDenyKeywords();
         if (keywords.length === 0)
             return undefined;
-        const text = denyScanText(exec);
+        const text = keywordScanText(exec.name, exec.arguments ?? {}, exec.commandText, this.liveScanKeys());
         if (text === '')
             return undefined;
         const haystacks = [text];
@@ -1008,7 +1114,7 @@ export class PermGateRuntime {
         // untouched and every later stage stays behind this veto.
         const keyword = this.denyKeywordHit(exec);
         if (keyword !== undefined) {
-            const reason = `deny-keyword: matches preset blacklist entry "${keyword}"`;
+            const reason = `deny-keyword: matches blacklist entry "${keyword}"`;
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'deny', source: 'deny-keyword', reason, at: Date.now() }));
             this.recordEvent(exec, 'deny', reason, { verdict: 'deny-keyword' });
             return { kind: 'deny', reason };
@@ -1068,7 +1174,12 @@ export class PermGateRuntime {
         // user's terminal answer comes back through tools/result anyway.
         if (outcome !== 'ask') {
             this.audit.append(makeEntry({ callId, tool: exec.name, outcome, source, reason: decision.reason, at: Date.now() }));
-            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: source });
+            // Preset deny-table entries tag their reason with `[deny-rule:<id>]`
+            // (see preset-rules.ts): surface the tag as the verdict so the audit,
+            // the feed and per-rule revocation attribute the exact entry instead of
+            // the whole `rule` partition.
+            const ruleTag = decision.stage === 'rule' ? /\[deny-rule:[a-z0-9._-]+\]/.exec(decision.reason)?.[0] : undefined;
+            this.recordEvent(exec, outcome === 'allow' ? 'auto' : outcome === 'deny' ? 'deny' : 'ask', decision.reason, { verdict: ruleTag ?? source });
         }
         if (decision.action === 'deny')
             return { kind: 'deny', reason: decision.reason };
@@ -1110,7 +1221,7 @@ export class PermGateRuntime {
         if (keyword !== undefined) {
             return {
                 action: 'deny',
-                reason: `deny-keyword: matches preset blacklist entry "${keyword}"`,
+                reason: `deny-keyword: matches blacklist entry "${keyword}"`,
                 source: 'deny-keyword',
             };
         }
@@ -1226,17 +1337,26 @@ export class PermGateRuntime {
             this.clearCall(exec, reason, 'cleanup-safe', 'classifier');
             return undefined;
         }
+        // The `permissive-snet` tier grades without a model. The mechanical screen has already
+        // run (its doubts ride along in the ask context) and the deterministic screens above
+        // still apply, but from here the ask goes to a person as-is — that tier exists for runs
+        // with no reviewer LLM, or where the tokens are not worth spending and a human answer is
+        // preferred over an auto-decision.
+        if (this.isSafetyNetAsk(exec))
+            return decision;
         if (!permissive.strategies.llmAssist)
             return decision;
         // One live read of the classifier setup. Without a usable receiver (a
         // configured custom endpoint, or the host llm service in host mode) the
         // ask goes straight to the human seam (fail-closed) — unless a risk hook
-        // is injected (tests / direct embedding replace the grader entirely).
+        // is injected (tests / direct embedding replace the grader entirely). With
+        // degraded review on (`rulesFallback`), there is no human to wait for either,
+        // so the deterministic nets decide it: 无模型时劣化成规则闸门.
         const cfg = this.options.readClassifyConfig?.();
         const useHost = this.liveClassifySource() === 'host' && this.options.hostLlm !== undefined;
         if (this.options.riskHook === undefined && !useHost
             && (cfg?.endpoint === undefined || cfg?.endpoint === '' || cfg?.model === undefined || cfg?.model === '')) {
-            return decision;
+            return this.isRulesFallback() ? this.resolveRulesDegrade(exec, decision) : decision;
         }
         // One frozen view of this call, then the grader's projection of it: bounded,
         // redacted downstream, and carrying the scope anchor its own prompt assumes
@@ -1254,6 +1374,7 @@ export class PermGateRuntime {
             ruleReason: decision.reason,
             callId: exec.callId,
             knobs: { permissionPreset: this.presetOf(exec) },
+            ...this.scriptReviewFor(exec, workspace),
             // Salted per session: a bare digest of a short command is trivially
             // dictionary-reversible and would let one event be joined to another
             // session's. Raw args never reach the log either.
@@ -1261,12 +1382,17 @@ export class PermGateRuntime {
             hash: (text) => createHash('sha256').update(text).digest('hex').slice(0, 16),
         });
         const eventFields = toEventFields(askCtx);
+        // The grader's own projection is the single source of the attached script bodies, so
+        // what leaves the host is exactly what was redacted and bounded (and exactly what
+        // the human card says was attached).
+        const grader = toGraderPayload(askCtx);
         const req = {
             tool: askCtx.tool,
             args: askCtx.args ?? {},
             reason: decision.reason,
             workspaceRoot: askCtx.workspaceRoot,
             targetResolvable: askCtx.targetResolvable,
+            ...(grader.script_contents === undefined ? {} : { scriptContents: grader.script_contents }),
         };
         let risk;
         if (this.options.riskHook !== undefined) {
@@ -1279,6 +1405,11 @@ export class PermGateRuntime {
         else {
             risk = await classifyRisk(cfg ?? {}, req);
         }
+        // The grader's own sentence, sanitized for a human card and an audit line (issue #3):
+        // a confirmation prompt that only says "a rule asked" hides the one thing the person
+        // wants to read, and the model already produced it.
+        const note = graderNote(risk);
+        const noteClause = note === undefined ? '' : ` · model: ${note}`;
         // Opaque payload: the grader may not clear what it cannot see. Checked here,
         // ahead of the `safe` branch, as a deterministic veto over the model rather
         // than a category it is asked to pick — an over-confident `safe` must not
@@ -1301,9 +1432,9 @@ export class PermGateRuntime {
                     : askCtx.reversibility === 'I'
                         ? 'irreversible by rule → ask'
                         : 'payload=opaque → ask';
-                const vetoReason = `${decision.reason} [${why}, grader said ${risk.kind}] · ${humanCardLine(askCtx)}`;
+                const vetoReason = `${decision.reason} [${why}, grader said ${risk.kind}]${noteClause} · ${humanCardLine(askCtx)}`;
                 this.trackAsk(exec, vetoReason, undefined, askCtx);
-                return this.askDecision(askCtx, vetoReason);
+                return this.askDecision(askCtx, vetoReason, false, note);
             }
         }
         if (risk.kind === 'safe') {
@@ -1330,9 +1461,9 @@ export class PermGateRuntime {
                 // Hard categories stay distinct from `neutral` in one way that matters:
                 // they are NEVER learnable, so repeated confirmations cannot sediment
                 // them into an auto-allow.
-                const hardReason = `${decision.reason} [llm-assist risky:${risk.category} → ask] · ${humanCardLine(askCtx)}`;
+                const hardReason = `${decision.reason} [llm-assist risky:${risk.category} → ask]${noteClause} · ${humanCardLine(askCtx)}`;
                 this.trackAsk(exec, hardReason, undefined, askCtx);
-                return this.askDecision(askCtx, hardReason, true);
+                return this.askDecision(askCtx, hardReason, true, note);
             }
             const learning = this.liveRiskLearning();
             const fp = operationFingerprint(exec.name, exec.arguments ?? {}, exec.commandText);
@@ -1353,21 +1484,296 @@ export class PermGateRuntime {
                 }
                 this.pending.set(canonicalizeCall(exec.name, exec.arguments ?? {}), { key, fp, ctx: decision.reason });
             }
-            const neutralReason = `${decision.reason} [llm-assist risky:neutral] · ${humanCardLine(askCtx)}`;
+            const neutralReason = `${decision.reason} [llm-assist risky:neutral]${noteClause} · ${humanCardLine(askCtx)}`;
             // The refined reason supersedes the raw ask, and the candidate key lets the
             // terminal event report the post-approval learning progress.
             this.trackAsk(exec, neutralReason, learning.enabled ? key : undefined, askCtx);
-            return this.askDecision(askCtx, neutralReason, true);
+            return this.askDecision(askCtx, neutralReason, true, note);
         }
         // unresolved: keep the ask, learn nothing — and label it. Without a marker
         // here, "the grader timed out" and "the grader called this risky" reach the
         // human as the same sentence, so an outage silently impersonates a
         // security judgement. Tagged via `reason` rather than a new event `kind`,
         // because `presentation()` maps an unknown kind to a green ALLOW.
+        //
+        // An outage is exactly the case degraded review exists for: the reviewer was
+        // configured but produced nothing, so the call goes to the deterministic nets
+        // rather than a popup nobody will answer.
+        if (this.isRulesFallback())
+            return this.resolveRulesDegrade(exec, decision, askCtx);
         const unresolvedReason = `${decision.reason} [llm-assist unresolved → ask] · ${humanCardLine(askCtx)}`;
         this.trackAsk(exec, unresolvedReason, undefined, askCtx);
         return this.askDecision(askCtx, unresolvedReason);
     }
+    /**
+     * YOLO resolution of an `ask`: never raise a human. A **dangerous** ask — an
+     * irreversible / unlearnable / opaque call (deterministic), or an `llmAssist`
+     * hard-risk verdict when a grader is reachable — is **blocked** (`deny`), and the
+     * caller feeds the reason back to the main LLM as a user message. Every other ask
+     * is **allowed** (returns `undefined` → passthrough), so ordinary work keeps moving
+     * without a human. This is the mirror of `askAnswerable`'s never-passthrough (which
+     * blanket-allows under `approval: never`): YOLO allows the benign but actively
+     * intercepts the dangerous — "尽力自动拦截所有危险命令".
+     */
+    async resolveYolo(exec, decision) {
+        const callId = randomId();
+        const askCtx = this.unattendedContextFor(exec, decision);
+        const judged = this.mechanicalJudge(askCtx);
+        let riskCategory;
+        // Whether the reviewer actually spoke. YOLO advertises "the model answers in the
+        // person's place"; when there is no grader, or it gave up, the tier still refuses to ask
+        // a human and settles on the mechanical screen — but the audit and the approvals history
+        // must say so, or the two human-free tiers silently become one.
+        let reviewerAnswered = true;
+        // The grader's sentence, kept for the block note: in YOLO there is no popup, so this
+        // text plus the feedback opinion is the only explanation the main LLM ever gets.
+        let modelNote;
+        // The shared mechanical floor runs first, and its verdict stands: these are the
+        // signals a model can never clear, and asking costs a call for nothing. Only what it
+        // cannot name goes to the grader — and there only to ESCALATE to a block. safe /
+        // neutral / unresolved / no grader adds no danger signal (the yolo "keep moving"
+        // contract; an absent grader falls through to the mechanical conclusion).
+        if (judged === null) {
+            const graded = await this.modelJudge(askCtx, decision.reason);
+            reviewerAnswered = graded.answered;
+            if (graded.risky) {
+                riskCategory = graded.category;
+                modelNote = graded.note;
+            }
+        }
+        const danger = judged !== null || riskCategory !== undefined;
+        if (!danger) {
+            const reason = reviewerAnswered
+                ? `yolo: allow (no danger signal) — ${decision.reason}`
+                : `yolo: allow (no reviewer answered; mechanical screen found nothing) — ${decision.reason}`;
+            this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'classifier', reason, at: Date.now() }));
+            this.recordEvent(exec, 'auto', reason, { verdict: reviewerAnswered ? 'yolo-allow' : 'yolo-allow-no-reviewer', risk: 'safe' });
+            this.untrackAsk(exec);
+            return undefined;
+        }
+        const why = riskCategory !== undefined
+            ? `风险模型判定 ${riskCategory}${modelNote === undefined ? '' : `：${modelNote}`}`
+            : judged.why;
+        // Which danger signal fired, as a tag the feedback layer can name to the main LLM
+        // (`[yolo-danger:…]` → 依据 in 工具审核意见) and classify on: an opaque payload must
+        // read as *manual_only*, everything else as a hard stop rather than "narrow it".
+        const dangerTag = `[yolo-danger:${riskCategory !== undefined
+            ? `model-risk.${riskCategory}`.toLowerCase().replace(/[^a-z0-9._-]/g, '-')
+            : judged.signal}]`;
+        const cmd = humanCommand(askCtx) || askCtx.tool;
+        const reason = `yolo: block ${dangerTag} — ${decision.reason}${modelNote === undefined ? '' : ` · model: ${modelNote}`}`;
+        this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'deny', source: 'classifier', reason, at: Date.now() }));
+        this.recordEvent(exec, 'deny', reason, { verdict: 'yolo-block', ...(riskCategory !== undefined ? { category: riskCategory } : {}) });
+        this.untrackAsk(exec);
+        return {
+            kind: 'deny',
+            reason,
+            displayReason: {
+                en: `Blocked dangerous command: ${cmd}. Reason: ${riskCategory ?? 'irreversible/opaque'}. Use a safer, reversible approach or re-request with justification.`,
+                zh: `已拦截危险命令：${cmd}。原因：${why}。请换用更安全、可逆的方式，或在说明理由后重新发起。`,
+            },
+        };
+    }
+    /**
+     * The review model's pass over one ask, shared by every tier that lets a model
+     * speak for the human. `answered: false` means no reviewer is configured or it was
+     * unreachable — what that *means* is the one thing the tiers disagree about, so the
+     * caller decides (YOLO falls back to the mechanical conclusion, the human tiers keep
+     * the popup, the mechanical tier never gets here).
+     */
+    async modelJudge(askCtx, reason) {
+        if (!this.classifierUsable())
+            return { answered: false, risky: false };
+        const req = {
+            tool: askCtx.tool,
+            args: askCtx.args ?? {},
+            reason,
+            workspaceRoot: askCtx.workspaceRoot,
+            targetResolvable: askCtx.targetResolvable,
+            // Same bodies the human would have been shown: in a human-free tier there is no
+            // popup, but a script run is graded on its code either way.
+            ...(toGraderPayload(askCtx).script_contents === undefined ? {} : { scriptContents: toGraderPayload(askCtx).script_contents }),
+        };
+        const cfg = this.options.readClassifyConfig?.();
+        const useHost = this.liveClassifySource() === 'host' && this.options.hostLlm !== undefined;
+        let risk;
+        if (this.options.riskHook !== undefined) {
+            risk = await this.options.riskHook(req);
+        }
+        else if (useHost) {
+            const selection = this.hostModel() ?? DEFAULT_HOST_MODEL;
+            risk = await classifyRiskWith((system, user) => completeViaHost(this.options.hostLlm, selection, system, user, cfg?.timeoutMs ?? 20_000), req);
+        }
+        else {
+            risk = await classifyRisk(cfg ?? {}, req);
+        }
+        // `neutral` is the grader declining to characterize the call, not a risk signal, and
+        // `unresolved` means it never got an answer at all. Only the first counts as "the
+        // reviewer spoke": a tier that advertises a model must not report one when it got
+        // nothing, which is why `answered` is what the caller labels the outcome with.
+        if (risk.kind === 'risky' && risk.category !== 'neutral') {
+            return { answered: true, risky: true, category: risk.category, note: graderNote(risk) };
+        }
+        return { answered: risk.kind !== 'unresolved', risky: false };
+    }
+    /**
+     * Which implementation, if any, owns this call's permission preset.
+     *
+     * One preset, one switch: `permissive-mech` is the mechanical takeover of asks,
+     * `permissive-snet` the model-free ask, `permissive-yolo` the model-backed human-free
+     * tier. Any other preset — including one whose switch is off — returns `null` and runs the
+     * ordinary flow, because a tier with no implementation behind it must not start behaving
+     * like some other tier.
+     */
+    unattendedModeOf(exec) {
+        return resolveTierMode(this.presetOf(exec), {
+            yolo: this.isYolo(),
+            safenetPass: this.options.readSafenetPass?.() ?? (this.options.safenetPass ?? false),
+            safenetAsk: this.options.readSafenetAsk?.() ?? (this.options.safenetAsk ?? false),
+        });
+    }
+    /** The mechanical human-free tier for this call (`permissive-mech`, switch on). */
+    isSafetyNet(exec) {
+        return this.unattendedModeOf(exec) === 'safety-net-passthrough';
+    }
+    /**
+     * The model-free ask tier for this call (`permissive-snet`, switch on): the mechanical
+     * screen still runs and its doubts ride along with the ask, but no grader is consulted
+     * and the decision stays with a person.
+     */
+    isSafetyNetAsk(exec) {
+        return this.unattendedModeOf(exec) === 'safety-net-ask';
+    }
+    /**
+     * One frozen view of a call for the human-free tiers: the same context the popup
+     * would have shown (script bodies included), plus the salted digest fields the
+     * grader path expects.
+     */
+    unattendedContextFor(exec, decision) {
+        const workspace = cwdOf(exec);
+        return buildAskContext({
+            tool: exec.name,
+            args: exec.arguments ?? {},
+            commandText: exec.commandText,
+            cwd: workspace,
+            workspaceRoot: workspace,
+            files: eventFiles(exec),
+            ruleReason: decision.reason,
+            callId: exec.callId,
+            knobs: { permissionPreset: this.presetOf(exec) },
+            ...this.scriptReviewFor(exec, workspace),
+            salt: sessionIdOf(exec),
+            hash: (text) => createHash('sha256').update(text).digest('hex').slice(0, 16),
+        });
+    }
+    /**
+     * The mechanical floor — what the deterministic nets can NAME about an ask, or `null`
+     * when nothing is nameable. Every tier classifies with this one judge; the tiers differ
+     * only in what they then do with the answer:
+     *
+     * | tier | 机械点名了危险 | 机械没点名 |
+     * | --- | --- | --- |
+     * | 人工确认（`permissive` / `permissive-full`） | 仍然问人，把信号作为疑点列出 | 问人（`llmAssist` 开着时模型可先精化） |
+     * | `safenetAsk`（`permissive-snet`） | 问人，列疑点 | 问人，**一次模型都不叫** |
+     * | `safenetPass`（`permissive-mech`） | 直接拦 + 回喂 | 直接放行，一次模型都不叫 |
+     * | `yolo`（`permissive-yolo`） | 直接拦（模型无法洗白，也不花这次调用） | 问模型；模型不在则按机械结论处置并标注 |
+     *
+     * The human tier not auto-blocking on a hit is deliberate: the same net that reads
+     * `rm -rf` of a home directory as irreversible also reads a project's own aggressive
+     * cleanup that way, and a person can tell those apart. Nobody is watching in the two
+     * human-free tiers, so there the cost of a false positive is accepted.
+     */
+    mechanicalJudge(askCtx) {
+        if (!askCtx.targetResolvable) {
+            return { signal: 'opaque-payload', why: '载荷不可读（编码/工作区外脚本/未见内容）', english: 'unreadable payload' };
+        }
+        if (askCtx.unlearnable) {
+            return { signal: 'data-destruction', why: '不可逆数据销毁', english: 'irreversible data destruction' };
+        }
+        if (askCtx.reversibility === 'I') {
+            return { signal: 'irreversible-op', why: '不可逆操作', english: 'irreversible operation' };
+        }
+        return null;
+    }
+    /**
+     * The mechanical tier (`permissive-mech`, behind the `safenetPass` switch) — a
+     * human-free ask settled by the deterministic nets ALONE, with **no model call at all**.
+     * Two equivalent ways to name it: the reviewed form of `approval: never` (that preset
+     * passes every ask with nothing judging it; this one passes only what the nets cannot
+     * condemn), and YOLO with the model taken away — which is also what YOLO itself falls
+     * back to when no reviewer answers.
+     *
+     * It shares {@link mechanicalJudge} with every other tier's first pass: an opaque
+     * payload, irreversible act, or unlearnable destruction is blocked and the reason fed
+     * back to the main LLM. Everything the nets cannot name simply runs. It never softens a
+     * deterministic deny — those arrive already denied — and it never raises a human prompt.
+     */
+    resolveSafetyNet(exec, decision) {
+        const callId = randomId();
+        const askCtx = this.unattendedContextFor(exec, decision);
+        const judge = this.mechanicalJudge(askCtx);
+        if (judge === null) {
+            const reason = `safety-net-passthrough: allow (no deterministic danger) — ${decision.reason}`;
+            this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'rule', reason, at: Date.now() }));
+            this.recordEvent(exec, 'auto', reason, { verdict: 'safety-net-passthrough-allow', risk: 'safe' });
+            this.untrackAsk(exec);
+            this.clearCall(exec, reason, 'safety-net-passthrough-allow', 'rule');
+            return undefined;
+        }
+        const cmd = humanCommand(askCtx) || askCtx.tool;
+        const reason = `safety-net-passthrough: block [safety-net-danger:${judge.signal}] — ${decision.reason}`;
+        this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'deny', source: 'rule', reason, at: Date.now() }));
+        this.recordEvent(exec, 'deny', reason, { verdict: 'safety-net-passthrough-block' });
+        this.untrackAsk(exec);
+        return {
+            kind: 'deny',
+            reason,
+            displayReason: {
+                en: `Unattended mechanical review blocked ${cmd} (${judge.english}). Run it yourself, or use a safer, reversible approach.`,
+                zh: `无人值守机械审查已拦截：${cmd}（${judge.why}）。请自行手动执行，或改用更安全、可逆的方式。`,
+            },
+        };
+    }
+    /**
+     * Degraded resolution of an `ask` when **no reviewer answered it** — either none is
+     * configured or the configured one could not reach a verdict. Instead of leaving the
+     * call on a human seam nobody is watching, it decides on the deterministic nets alone,
+     * the way a static policy gate does: an irreversible (`I`-tier) / unlearnable /
+     * opaque call is **blocked** (the caller feeds the reason back to the main LLM), and
+     * everything else runs. Unlike {@link resolveYolo} no model is consulted at all — this
+     * is what automatic review becomes when the model is missing, not a mode the operator
+     * picks while one is working. Never softens a deterministic deny: those arrive here
+     * already denied, and a rule-only `ask` is by construction something the rules could
+     * not condemn.
+     */
+    resolveRulesDegrade(exec, decision, ctx) {
+        const callId = randomId();
+        const askCtx = ctx ?? this.contextFor(exec, decision.reason);
+        const judge = this.mechanicalJudge(askCtx);
+        // Tag names the signal so the feedback layer can classify it: an opaque payload is
+        // *manual_only* (nobody read it, a human should run it), the rest is a hard stop.
+        if (judge === null) {
+            const reason = `rules-fallback: allow (no reviewer, no deterministic danger) — ${decision.reason}`;
+            this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'allow', source: 'rule', reason, at: Date.now() }));
+            this.recordEvent(exec, 'auto', reason, { verdict: 'rules-fallback-allow', risk: 'safe' });
+            this.untrackAsk(exec);
+            this.clearCall(exec, reason, 'rules-fallback-allow', 'rule');
+            return undefined;
+        }
+        const cmd = humanCommand(askCtx) || askCtx.tool;
+        const reason = `rules-fallback: block [rules-fallback-danger:${judge.signal}] — ${decision.reason}`;
+        this.audit.append(makeEntry({ callId, tool: exec.name, outcome: 'deny', source: 'rule', reason, at: Date.now() }));
+        this.recordEvent(exec, 'deny', reason, { verdict: 'rules-fallback-block' });
+        this.untrackAsk(exec);
+        return {
+            kind: 'deny',
+            reason,
+            displayReason: {
+                en: `No risk reviewer available, so the rule gate decided this call: blocked ${cmd} (${judge.signal === 'opaque-payload' ? 'unreadable payload' : 'irreversible'}). Run it yourself, or use a safer, reversible approach.`,
+                zh: `无可用审查模型，已按规则闸门处置：拦截 ${cmd}（${judge.why}）。请自行手动执行，或改用更安全、可逆的方式。`,
+            },
+        };
+    }
     /**
      * One frozen view of a call, built the same way for every ask path so the
      * popup cannot disagree with what the grader was shown.
@@ -1384,6 +1790,7 @@ export class PermGateRuntime {
             ruleReason: reason,
             callId: exec.callId,
             knobs: { permissionPreset: this.presetOf(exec) },
+            ...this.scriptReviewFor(exec, workspace),
         });
     }
     /**
@@ -1399,17 +1806,20 @@ export class PermGateRuntime {
      * each button costs. Without the command line a person is asked to approve an
      * operation they cannot read, which is the complaint this task exists to fix.
      */
-    askDecision(askCtx, reason, modelFlagged = false) {
+    askDecision(askCtx, reason, modelFlagged = false, modelNote) {
         // `reason` stays the audit string: short, English, machine-tokened. Everything a
         // person reads goes into `displayReason`, which the host resolves by UI locale
         // (`zh` here; the other seven fall back to `en`) and never persists.
         const kinds = askDoubtKinds(askCtx, { modelFlagged });
+        // The grader's own words ride along when there are any (issue #3) — marked as what
+        // they are, an opinion from a second model, never a rule finding.
+        const tail = (word) => (modelNote === undefined || modelNote === '' ? '' : `  ·  ${word}${modelNote}`);
         return {
             kind: 'ask',
             reason,
             displayReason: {
-                zh: humanBrief(askCtx, 'zh', kinds),
-                en: humanBrief(askCtx, 'en', kinds),
+                zh: `${humanBrief(askCtx, 'zh', kinds)}${tail('模型审查意见：')}`,
+                en: `${humanBrief(askCtx, 'en', kinds)}${tail('risk model says: ')}`,
             },
         };
     }
@@ -1755,42 +2165,6 @@ function keywordMatcher(keyword) {
     keywordMatchers.set(keyword, re);
     return re;
 }
-/**
- * The text a blacklist keyword may match: the shell command plus the call's
- * scalar arguments, excluding document-body fields. Whitespace is collapsed so
- * a command written with extra spaces still reads as the command it is.
- */
-function denyScanText(exec) {
-    const parts = [];
-    const walk = (node, depth) => {
-        if (depth > 6)
-            return;
-        if (Array.isArray(node)) {
-            for (const item of node) {
-                if (typeof item === 'string')
-                    parts.push(item);
-                else
-                    walk(item, depth + 1);
-            }
-            return;
-        }
-        if (typeof node !== 'object' || node === null)
-            return;
-        for (const [key, value] of Object.entries(node)) {
-            if (typeof value === 'string') {
-                if (!CONTENT_ARG_KEYS.has(key))
-                    parts.push(value);
-            }
-            else {
-                walk(value, depth + 1);
-            }
-        }
-    };
-    walk(exec.arguments ?? {}, 0);
-    if (typeof exec.commandText === 'string' && exec.commandText !== '')
-        parts.unshift(exec.commandText);
-    return parts.join(' ').replace(/\s+/g, ' ');
-}
 function randomId() {
     return Math.random().toString(36).slice(2, 10) + Date.now().toString(36);
 }