dsh-perm-gate 5.2.0 → 5.3.0

package/lib/config.d.ts

@@ -66,6 +66,75 @@ export interface PermGateConfig {
      * widens decision before the human/LLM seam.
      */
     readonly permissive?: boolean;
+    /**
+     * YOLO — the switch behind the `permissive-yolo` tier, the model-backed human-free
+     * implementation. It never raises a human confirmation: what the mechanical screen names
+     * (irreversible, unlearnable, unreadable payload) is blocked and fed back to the main LLM
+     * as a `工具审核意见` user message, and the residual goes to the review model, which
+     * answers in the person's place — risky blocks, anything else runs.
+     *
+     * This is a per-tier switch, not a session-wide flow: it governs the `permissive-yolo`
+     * preset and nothing else, so turning it off changes no other tier's behaviour. The tier
+     * is the model-backed one by definition; with no reviewer in seat it still refuses to ask
+     * a person (that is the promise), settles on the mechanical screen alone, and records that
+     * the model never answered instead of letting the tier quietly become a different one.
+     */
+    readonly yolo?: boolean;
+    /**
+     * `safenet-pass` — the switch behind the `permissive-mech` tier: the deterministic
+     * mechanical screen plus the preset opinions take over the ask. Named danger is blocked
+     * and fed back to the main LLM, everything the nets cannot condemn runs. No human prompt
+     * and **no model call at all** — the reviewed form of `approval: never`, and the tier for
+     * a run with no reviewer LLM or where the tokens are not worth spending.
+     */
+    readonly safenetPass?: boolean;
+    /**
+     * `safenet-ask` — the switch behind the `permissive-snet` tier: the mechanical screen
+     * still filters and lists its doubts, but the ask stays with a **person** and no grader is
+     * consulted. The shape the gate takes when no reviewer LLM is connected and you would
+     * rather answer than auto-run. Uncommon by design.
+     */
+    readonly safenetAsk?: boolean;
+    /**
+     * Degraded review — fall back to a **rule-only gate when there is no reviewer**.
+     *
+     * With `permissiveStrategies.llmAssist` on, an `ask` is normally graded by the
+     * configured model, and every path that cannot grade it (no endpoint/model set up,
+     * host `llm` absent, transport failure → `unresolved`) is fail-closed to a *human*
+     * confirmation. In a headless or unattended run that is a stall: nobody answers.
+     * This switch degrades those two no-reviewer paths to the deterministic nets only —
+     * a cc-safety-net-class gate: danger the rules can name (irreversible / unlearnable /
+     * opaque payload) is **blocked** and the reason is fed back to the main LLM, anything
+     * else runs. It changes nothing while a reviewer *is* answering, and never softens a
+     * deterministic deny. It applies to the ordinary 自动审查 tiers (`permissive`,
+     * `permissive-full`); the three tiers that own an implementation (`yolo`, `safenetPass`,
+     * `safenetAsk`) already say who answers and are not degraded by this switch.
+     */
+    readonly rulesFallback?: boolean;
+    /**
+     * **Retired** (2026-10-17) — the per-preset mode table (`<preset id>=<mode>`) that briefly
+     * decided who answers an ask. Each human-free implementation now owns exactly one preset
+     * and exactly one switch (`yolo` → `permissive-yolo`, `safenetPass` → `permissive-mech`,
+     * `safenetAsk` → `permissive-snet`), which is what the table could not guarantee: entries
+     * could name a preset outside the gate's scope, and a stored list could claim to steer
+     * presets it never actually reached. The key stays in the schema **only** so a
+     * profile written by those builds still parses; nothing reads it, and the settings card no
+     * longer writes it. The replacement semantics live in `src/unattended.ts`.
+     */
+    readonly unattendedTiers?: string[];
+    /**
+     * Script review (default **on**) — when a call runs a script file (`bash x.sh`,
+     * `pwsh -File x.ps1`, `python x.py`, `./deploy.sh`), read the file and attach its
+     * body to the review: the risk grader and the human both judge the code that will
+     * execute instead of a filename, and the deterministic nets grade the body too (a
+     * script that wipes `$HOME` is irreversible whatever the command line says).
+     *
+     * Bounded (a few files, a fixed per-file budget) and redacted on the way out like
+     * every other egress text. Turn it off to keep file contents off the configured
+     * endpoint: the cost is that out-of-workspace and unreadable script runs go back to
+     * being graded as unknowable (the `U` tier).
+     */
+    readonly scriptReview?: boolean;
     /** Backend approval strategies; combinable. Front-end exposes only `permissive` itself. */
     readonly permissiveStrategies?: Partial<PermissiveStrategies>;
     /**
@@ -95,6 +164,50 @@ export interface PermGateConfig {
      * (possibly empty) replaces it. Editable from the settings card as a list.
      */
     readonly denyKeywords?: string[];
+    /**
+     * Keywords **appended** to whichever blacklist is live (`denyKeywords` when set, the
+     * preset otherwise) instead of replacing it. This is what to use to protect a
+     * long-tail secret of your own — a company token prefix, a vault CLI subcommand —
+     * without having to copy fifty preset entries into your profile and keep them current.
+     */
+    readonly denyKeywordsExtra?: string[];
+    /**
+     * Credential paths beyond the built-in store list (`.ssh`, `.aws`, `.npmrc`,
+     * `credentials.yaml`, …), which P0 refuses to read from outside the workspace and
+     * refuses to mutate through a file tool.
+     *
+     * Entries are path globs matched on the normalized path: `**` crosses directories, `*`
+     * and `?` stay inside one; a plain entry is a path fragment (`vault/prod.env`,
+     * `.myco_token`), and a `~/` prefix expands to the real home. Relative patterns also
+     * match at any depth, so `secrets/*.env` covers `a/b/secrets/prod.env`.
+     *
+     * Why a setting and not a rule in `rules.yml`: a `read`/`grep` call is auto-allowed a
+     * stage before the rule chain runs (the only layer that sees it first is P0), and the
+     * tier of an entry must not be the author's choice — a declared secret gets what
+     * `.ssh` gets, never a confirmation a model can talk its way out of.
+     */
+    readonly credentialPaths?: string[];
+    /**
+     * Argument keys to treat as **document bodies** in addition to the built-in list
+     * (`content`, `text`, `plan`…): their values never enter the flattened text the
+     * deny-keyword blacklist and the P0 credential pre-screen read.
+     *
+     * The point is the long tail of host tools whose prose keys nobody shipped a rule for
+     * (`steps`, `notes`, `rationale`) — the shape of GitHub issue #2, where an unlisted
+     * document key made a plan get refused for describing `rm -rf`. Additive only: the
+     * built-in list cannot be replaced, because an omission would re-create that bug.
+     */
+    readonly extraContentArgKeys?: string[];
+    /**
+     * Argument keys to treat as **operations** even when the tool class says otherwise: the
+     * field's text is read by the blacklist and the credential pre-screen, and this list
+     * wins over `extraContentArgKeys` when both name the same key.
+     *
+     * For a workflow/skill-style tool whose body *is* executed code. Cost, stated: naming a
+     * genuine document key here re-exposes the issue #2 failure — a plan or note that merely
+     * mentions a destructive command will be refused for mentioning it.
+     */
+    readonly extraOperationArgKeys?: string[];
     /**
      * One-shot marker for the preset deny-table seed (`preset-rules.ts`, ported
      * from cc-safety-net): set once the `[deny-rule:*]` entries have been merged
@@ -356,6 +469,21 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantTtlMs: z<number, number, "defined">;
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
+    yolo: z<boolean, boolean, "defined">;
+    rulesFallback: z<boolean, boolean, "defined">;
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: z<string[], string[], "defined">;
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: z<boolean, boolean, "defined">;
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: z<boolean, boolean, "defined">;
+    scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
     permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
@@ -370,6 +498,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     }>>, "plain">;
     allowlist: z<string[], string[], "plain">;
     denyKeywords: z<string[], string[], "plain">;
+    denyKeywordsExtra: z<string[], string[], "defined">;
+    credentialPaths: z<string[], string[], "defined">;
+    extraContentArgKeys: z<string[], string[], "defined">;
+    extraOperationArgKeys: z<string[], string[], "defined">;
     presetRulesSeeded: z<boolean, boolean, "defined">;
     autoAllowTools: z<string[], string[], "plain">;
     sessionSweep: z<boolean, boolean, "defined">;
@@ -416,6 +548,21 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     grantTtlMs: z<number, number, "defined">;
     grantMaxUses: z<number, number, "defined">;
     permissive: z<boolean, boolean, "defined">;
+    yolo: z<boolean, boolean, "defined">;
+    rulesFallback: z<boolean, boolean, "defined">;
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: z<string[], string[], "defined">;
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: z<boolean, boolean, "defined">;
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: z<boolean, boolean, "defined">;
+    scriptReview: z<boolean, boolean, "defined">;
     gatePresets: z<string[], string[], "plain">;
     permissiveStrategies: z<Schemastery.ObjectS<NoInfer<{
         trustAutoAllow: z<boolean, boolean, "defined">;
@@ -430,6 +577,10 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     }>>, "plain">;
     allowlist: z<string[], string[], "plain">;
     denyKeywords: z<string[], string[], "plain">;
+    denyKeywordsExtra: z<string[], string[], "defined">;
+    credentialPaths: z<string[], string[], "defined">;
+    extraContentArgKeys: z<string[], string[], "defined">;
+    extraOperationArgKeys: z<string[], string[], "defined">;
     presetRulesSeeded: z<boolean, boolean, "defined">;
     autoAllowTools: z<string[], string[], "plain">;
     sessionSweep: z<boolean, boolean, "defined">;
@@ -460,7 +611,7 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 /** Live reference the 0.1.7 loader hands `apply` for `.volatile()` config fields. */
 export type VolatileRef<T> = Volatile<T>;
 /** The config fields marked `.volatile()` — live refs inside `apply`'s config. */
-export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "permissiveStrategies", "allowlist", "denyKeywords", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
+export declare const VOLATILE_CONFIG_KEYS: readonly ["defaultAction", "caseInsensitivePaths", "classifierEnabled", "classifierEndpoint", "classifierModel", "classifierApiKey", "riskTimeoutMs", "riskLearning", "riskSediment", "classifierSource", "classifierProvider", "riskThreshold", "grantTtlMs", "grantMaxUses", "permissive", "yolo", "rulesFallback", "unattendedTiers", "safenetPass", "safenetAsk", "scriptReview", "permissiveStrategies", "allowlist", "denyKeywords", "denyKeywordsExtra", "credentialPaths", "extraContentArgKeys", "extraOperationArgKeys", "presetRulesSeeded", "autoAllowTools", "sessionSweep", "searchUp", "badFilePolicy", "maxChainLength", "networkEnabled", "networkMode", "networkUnlisted", "networkUnattributed", "networkLoopback", "networkBind", "networkPort", "networkNoProxy", "networkInjectEnv", "networkAskTimeoutMs", "networkGrantTtlMs", "rules", "sandboxEnabled", "sandboxMode", "sandboxProxy", "sandboxLoopback"];
 /** Resolve one possibly-volatile field: a live ref on 0.1.7+, a plain value otherwise. */
 export declare function readVolatileValue<T>(value: T | Volatile<T> | undefined): VolatileSnapshot<T> | undefined;
 /** Shallow-resolve every volatile field into a plain snapshot (one per read). */

package/lib/config.js

@@ -193,6 +193,21 @@ export const Config = z.object({
     grantTtlMs: vol(z.number().min(1).default(5 * 60_000)),
     grantMaxUses: vol(z.number().min(1).default(1)),
     permissive: vol(z.boolean().default(false)),
+    yolo: vol(z.boolean().default(false)),
+    rulesFallback: vol(z.boolean().default(false)),
+    /**
+     * Retired (2026-10-17): the per-preset mode table that briefly mapped
+     * `<preset id>=<mode>`. Each human-free implementation now owns exactly one preset and
+     * exactly one switch (`yolo` / `safenetPass` / `safenetAsk`), so presets never cross and a
+     * switch means what it says — whether that implementation exists. The key is kept in the
+     * schema only so an older profile that stored it still parses.
+     */
+    unattendedTiers: vol(z.array(z.string()).default([])),
+    /** Switch: the `permissive-mech` implementation exists (mechanical takeover of asks). */
+    safenetPass: vol(z.boolean().default(true)),
+    /** Switch: the `permissive-snet` implementation exists (mechanical screen, still asks). */
+    safenetAsk: vol(z.boolean().default(false)),
+    scriptReview: vol(z.boolean().default(true)),
     gatePresets: z.array(z.string()),
     permissiveStrategies: vol(z.object({
         trustAutoAllow: z.boolean().default(true),
@@ -202,6 +217,10 @@ export const Config = z.object({
     })),
     allowlist: vol(z.array(z.string())),
     denyKeywords: vol(z.array(z.string())),
+    denyKeywordsExtra: vol(z.array(z.string()).default([])),
+    credentialPaths: vol(z.array(z.string()).default([])),
+    extraContentArgKeys: vol(z.array(z.string()).default([])),
+    extraOperationArgKeys: vol(z.array(z.string()).default([])),
     presetRulesSeeded: vol(z.boolean().default(false)),
     autoAllowTools: vol(z.array(z.string())),
     sessionSweep: vol(z.boolean().default(true)),
@@ -241,7 +260,7 @@ export const VOLATILE_CONFIG_KEYS = [
     'defaultAction', 'caseInsensitivePaths', 'classifierEnabled', 'classifierEndpoint',
     'classifierModel', 'classifierApiKey', 'riskTimeoutMs', 'riskLearning', 'riskSediment',
     'classifierSource', 'classifierProvider', 'riskThreshold', 'grantTtlMs', 'grantMaxUses',
-    'permissive', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'presetRulesSeeded', 'autoAllowTools',
+    'permissive', 'yolo', 'rulesFallback', 'unattendedTiers', 'safenetPass', 'safenetAsk', 'scriptReview', 'permissiveStrategies', 'allowlist', 'denyKeywords', 'denyKeywordsExtra', 'credentialPaths', 'extraContentArgKeys', 'extraOperationArgKeys', 'presetRulesSeeded', 'autoAllowTools',
     'sessionSweep', 'searchUp', 'badFilePolicy', 'maxChainLength',
     'networkEnabled', 'networkMode', 'networkUnlisted', 'networkUnattributed', 'networkLoopback',
     'networkBind', 'networkPort', 'networkNoProxy', 'networkInjectEnv', 'networkAskTimeoutMs',

package/lib/credential-paths.d.ts

@@ -0,0 +1,35 @@
+/**
+ * User-declared credential paths — the long tail the built-in list cannot know.
+ *
+ * The built-in credential set (`.ssh`, `.aws`, `.npmrc`, `credentials.yaml`, …) ships in
+ * `path.ts` because the layer that needs it is P0: a `read`/`grep` call is auto-allowed
+ * one stage before the rule chain runs, and mutating a file tool never reaches a model
+ * that could be talked out of it. That is also why this cannot simply be "add a rule to
+ * `rules.yml`" for the read side — see the note in `runtime.ts` about why the auto-allow
+ * does not consult the ruleset (preset entries and hand-written entries live in one
+ * document with no provenance, so `.dsh/**` would start blocking legitimate memory
+ * reads).
+ *
+ * So the *list* is what a user extends, through the `credentialPaths` setting, and the
+ * *tier* stays where it has to be: a listed path gets the same treatment as the
+ * built-ins — reading it outside the workspace is refused, writing it is refused.
+ *
+ * Matching is pure string work: no filesystem access, no resolution, no execution. A
+ * pattern that cannot be understood is dropped rather than guessed at — an unreadable
+ * entry must not silently become "protects everything".
+ */
+/**
+ * Compile the configured credential paths into one predicate.
+ *
+ * Returns a matcher that answers `false` for an empty or unusable list, so callers can
+ * pass the raw setting straight through. `home` expands a leading `~/` the way a shell
+ * would, because the setting is written in home-relative form (`~/.myco/vault.token`)
+ * while the paths being judged are absolute. **Without `home`** the `~/` is stripped and
+ * the rest matched as a path fragment — a declared secret must not silently stop
+ * protecting because one caller did not know the user directory; the widened tail match
+ * only ever denies more, never less.
+ */
+export declare function compileCredentialPaths(entries: readonly string[] | undefined, opts?: {
+    readonly caseInsensitive?: boolean;
+    readonly home?: string;
+}): (path: string) => boolean;

package/lib/credential-paths.js

@@ -0,0 +1,119 @@
+/**
+ * User-declared credential paths — the long tail the built-in list cannot know.
+ *
+ * The built-in credential set (`.ssh`, `.aws`, `.npmrc`, `credentials.yaml`, …) ships in
+ * `path.ts` because the layer that needs it is P0: a `read`/`grep` call is auto-allowed
+ * one stage before the rule chain runs, and mutating a file tool never reaches a model
+ * that could be talked out of it. That is also why this cannot simply be "add a rule to
+ * `rules.yml`" for the read side — see the note in `runtime.ts` about why the auto-allow
+ * does not consult the ruleset (preset entries and hand-written entries live in one
+ * document with no provenance, so `.dsh/**` would start blocking legitimate memory
+ * reads).
+ *
+ * So the *list* is what a user extends, through the `credentialPaths` setting, and the
+ * *tier* stays where it has to be: a listed path gets the same treatment as the
+ * built-ins — reading it outside the workspace is refused, writing it is refused.
+ *
+ * Matching is pure string work: no filesystem access, no resolution, no execution. A
+ * pattern that cannot be understood is dropped rather than guessed at — an unreadable
+ * entry must not silently become "protects everything".
+ */
+/** Normalized, lowercase-able comparison form for a path or pattern. */
+function norm(p, caseInsensitive) {
+    const slashed = p.trim().replace(/[\\/]+/g, '/');
+    const stripped = slashed.length > 1 ? slashed.replace(/\/+$/, '') : slashed;
+    return caseInsensitive ? stripped.toLowerCase() : stripped;
+}
+/** Escape regex metacharacters that carry no meaning in a path glob. */
+function escapeRe(s) {
+    return s.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Translate a path glob into a regex source.
+ *
+ * `**` is translated through a placeholder so it can be restored *after* the
+ * single-`*` rule ran — replacing them in the naive order turns `**` into `[^/]*[^/]*`,
+ * which silently stops crossing directories, i.e. `secrets/**` would match nothing.
+ */
+function globSource(glob) {
+    const CROSS = '\u0000';
+    return escapeRe(glob)
+        .replace(/\*\*/g, CROSS)
+        .replace(/\*/g, '[^/]*')
+        .replace(/\?/g, '[^/]')
+        .split(CROSS)
+        .join('.*');
+}
+/**
+ * Compile one entry into a matcher over an already-normalized path.
+ *
+ * - contains `*` or `?` → glob: a double star crosses directories, a single star and
+ *   a question mark stay inside one. A pattern that is not absolute (no leading slash,
+ *   no drive letter) and does not already start with a crossing star is additionally
+ *   allowed to match at any depth (`secrets/STAR.env` covers `a/b/secrets/x.env`),
+ *   because that is what people mean when they write a relative glob.
+ * - no wildcard → path fragment: matches the path itself, or a whole leading/inner
+ *   segment run (`myco/token`, `.myco_token`, `vault/prod.env`).
+ */
+function compileEntry(raw, caseInsensitive) {
+    const entry = norm(raw, caseInsensitive);
+    if (entry === '' || entry === '/' || entry === '*')
+        return undefined;
+    const anchored = entry.startsWith('/') || /^[a-z]:/i.test(entry);
+    if (/[*?]/.test(entry)) {
+        const body = globSource(entry);
+        const source = anchored ? `^${body}$` : `(?:^|.*/)${body}$`;
+        let re;
+        try {
+            re = new RegExp(source, caseInsensitive ? 'i' : '');
+        }
+        catch {
+            return undefined;
+        }
+        return (path) => re.test(path);
+    }
+    // A plain entry is a path fragment, matched on segment boundaries only: `token` must
+    // not protect nothing while `.env` silently matches `ambient.txt`.
+    const withLead = entry.startsWith('.') || entry.includes('/') ? entry : `/${entry}`;
+    return (path) => path === entry || path.endsWith(withLead) || path.includes(`${withLead}/`) || (anchored && path.startsWith(entry));
+}
+/**
+ * Compile the configured credential paths into one predicate.
+ *
+ * Returns a matcher that answers `false` for an empty or unusable list, so callers can
+ * pass the raw setting straight through. `home` expands a leading `~/` the way a shell
+ * would, because the setting is written in home-relative form (`~/.myco/vault.token`)
+ * while the paths being judged are absolute. **Without `home`** the `~/` is stripped and
+ * the rest matched as a path fragment — a declared secret must not silently stop
+ * protecting because one caller did not know the user directory; the widened tail match
+ * only ever denies more, never less.
+ */
+export function compileCredentialPaths(entries, opts = {}) {
+    const caseInsensitive = opts.caseInsensitive ?? true;
+    const home = opts.home;
+    const matchers = [];
+    for (const raw of entries ?? []) {
+        if (typeof raw !== 'string')
+            continue;
+        let text = raw.trim();
+        if (text === '')
+            continue;
+        if (text === '~' || text.startsWith('~/') || text.startsWith('~\\')) {
+            const rest = text.slice(1).replace(/^[\\/]/, '');
+            text = home !== undefined && home !== ''
+                ? `${home.replace(/[\\/]+$/, '')}/${rest}`
+                // No home known: keep the tail. `~/.myco/vault.token` becomes `.myco/vault.token`,
+                // which still matches any user directory's copy of it.
+                : rest;
+        }
+        const m = compileEntry(text, caseInsensitive);
+        if (m !== undefined)
+            matchers.push(m);
+    }
+    if (matchers.length === 0)
+        return () => false;
+    return (path) => {
+        const p = norm(path, caseInsensitive);
+        return p !== '' && matchers.some((m) => m(p));
+    };
+}

package/lib/engine.d.ts

@@ -3,13 +3,11 @@ export type EngineStage = 'hard-deny' | 'grant' | 'rule' | 'default' | 'ask' | '
 /** The built-in read-only / internal classification, for diagnostics and docs. */
 export declare const AUTO_ALLOW_TOOLS: ReadonlySet<string>;
 /**
- * Argument keys that carry a document body rather than the operation itself.
- * A file's text is not the operation: writing a document that *mentions* a
- * token, a private key, or `credentials.yaml` must not hard-deny the write, and
- * the deny-keyword layer already skips these keys. The path/command arguments
- * that actually describe the operation are still scanned.
+ * The document-body keys the screens skip live in `scan-text.ts`, shared with the
+ * deny-keyword layer so the two cannot drift. Re-exported here because this was their
+ * published home.
  */
-export declare const CONTENT_ARG_KEYS: ReadonlySet<string>;
+export { CONTENT_ARG_KEYS } from './scan-text.js';
 /**
  * Deterministic P0 hard-deny reason, or undefined when the call may proceed to
  * later stages.

package/lib/engine.js

@@ -8,7 +8,8 @@
  *   P4 ask            official approval seam
  * Strictly fail-closed: P0 wins over every later stage.
  */
-import { isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
+import { isProtectedCredentialPath, isProtectedDestructiveTarget, isSensitivePath, isWithin } from './path.js';
+import { compileCredentialPaths } from './credential-paths.js';
 import { commandIrreversibleReason, irreversibleReason } from './irreversible.js';
 import { executableVariants, normalizeCommandText } from './command-normalize.js';
 // 工具名名单归 `tool-names.ts` 所有（不得在此处再抄一份）。P0 **不看工具名白名单**：
@@ -23,46 +24,20 @@ const NO_EXTRA_AUTO_ALLOW = new Set();
 /** The built-in read-only / internal classification, for diagnostics and docs. */
 export const AUTO_ALLOW_TOOLS = new Set([...READ_TOOLS, ...INTERNAL_TOOLS]);
 /**
- * Argument keys that carry a document body rather than the operation itself.
- * A file's text is not the operation: writing a document that *mentions* a
- * token, a private key, or `credentials.yaml` must not hard-deny the write, and
- * the deny-keyword layer already skips these keys. The path/command arguments
- * that actually describe the operation are still scanned.
+ * The document-body keys the screens skip live in `scan-text.ts`, shared with the
+ * deny-keyword layer so the two cannot drift. Re-exported here because this was their
+ * published home.
  */
-export const CONTENT_ARG_KEYS = new Set([
-    'content', 'contents', 'text', 'body', 'message', 'prompt',
-    'new_string', 'old_string', 'newText', 'oldText', 'file_text', 'fileText',
-    'diff', 'patch', 'replacement', 'snippet',
-]);
-/** The call's non-body text: the operation, not any document it carries. */
-function operationText(args, depth = 0) {
-    if (depth > 6)
-        return '';
-    const parts = [];
-    for (const [key, value] of Object.entries(args)) {
-        if (typeof value === 'string') {
-            if (!CONTENT_ARG_KEYS.has(key))
-                parts.push(value);
-            continue;
-        }
-        if (Array.isArray(value)) {
-            for (const item of value) {
-                if (typeof item === 'string')
-                    parts.push(item);
-                else if (item !== null && typeof item === 'object')
-                    parts.push(operationText(item, depth + 1));
-            }
-            continue;
-        }
-        if (value !== null && typeof value === 'object') {
-            parts.push(operationText(value, depth + 1));
-        }
-    }
-    return parts.join(' ');
-}
+export { CONTENT_ARG_KEYS } from './scan-text.js';
+import { operationText } from './scan-text.js';
 /**
  * Credential or private-key material a call carries.
  *
+ * Read through `scan-text.operationText`, so a document tool's prose is no longer fed
+ * to this screen at all (issue #2): refusing `exit_plan_mode` because the plan *names*
+ * a step it intends to ask about is a self-contradiction — `decide()` classifies the
+ * same call as needing no approval one layer later.
+ *
  * Two clauses were removed on purpose, both because this predicate reads one flat
  * string and therefore cannot tell *using* a secret from *moving* one — and P0 is
  * the layer nobody can appeal:
@@ -78,8 +53,15 @@ function operationText(args, depth = 0) {
  * What is left is the theft shape: a secret *artifact* plus a channel out, or any
  * non-readonly verb touching one. That pairing lives in `irreversible.ts`, so both
  * layers agree.
+ *
+ * `id_` keeps its `.pub` half out: a public key is the artifact you hand *other*
+ * people, so writing `~/.ssh/id_ed25519.pub` (registering a key, restoring a pair by
+ * hand) was refused at the one layer nobody can appeal for no protective reason. The
+ * private halves stay in, as does `config` — an ssh config's `ProxyCommand` /
+ * `LocalCommand` is code that runs on the next connection, which is an execution
+ * plant, not a preference file.
  */
-const CREDENTIAL_MATERIAL = /(?:BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|\.ssh[\\/](?:id_|config)|credentials\.yaml)/i;
+const CREDENTIAL_MATERIAL = /(?:BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{8,}\b|\.ssh[\\/]id_(?![^\\/]*\.pub(?:$|[\\/]))|\.ssh[\\/]config|credentials\.yaml)/i;
 /** Verbs that only look. A call made of nothing else cannot have leaked anything. */
 const READ_ONLY_HEAD = /^(?:test-path|test|ls|dir|get-childitem|get-content|get-item|cat|type|more|head|tail|stat|file|select-string|where|which|exists)$/i;
 /** Whether every segment of this command text is a read-only look. */
@@ -92,8 +74,13 @@ function readonlyProbe(text) {
         return READ_ONLY_HEAD.test(head);
     });
 }
-function containsCredentialMaterial(args) {
-    const text = operationText(args);
+/**
+ * Credential or private-key material a call carries, read out of the *operation* text
+ * only — which is `scan-text`'s job, and why the key lists are a caller input: a document
+ * body is somebody's prose, not a theft in progress.
+ */
+function containsCredentialMaterial(ctx) {
+    const text = operationText(ctx.args, ctx.tool, ctx.scanKeys);
     return CREDENTIAL_MATERIAL.test(text) && !readonlyProbe(text);
 }
 function pathArgument(args) {
@@ -154,7 +141,7 @@ function gitRemoteRewriteReason(segments) {
  */
 export function hardDenyReason(ctx) {
     const args = ctx.args;
-    if (containsCredentialMaterial(args))
+    if (containsCredentialMaterial(ctx))
         return 'call contains credential or private-key material';
     // **Shape, not a name whitelist** (see tool-names.ts): a call that carries a
     // command string and is not a known non-executor is a command call whatever the
@@ -209,9 +196,33 @@ export function hardDenyReason(ctx) {
         if (isProtectedDestructiveTarget(path, ctx.dshHome))
             return `mutation targets protected path: ${path}`;
     }
+    // Credential-store mutation via a file tool is an access backdoor: dropping an
+    // `authorized_keys` line, `git config credential.helper store`, or rewriting
+    // `.git-credentials`/`.npmrc`/cloud creds grants or leaks authority. The shell
+    // layer already denies deletion of these stores and asks on reading them, but
+    // write/edit reached past the P0 guard because it only screened system roots, so
+    // `write ~/.ssh/authorized_keys` was auto-allowed. Scoped to file-mutation tools
+    // (not bash/pwsh, whose real target is the command string, judged above), and
+    // `.env` is excluded (project-local dev config).
+    //
+    // `credentialPaths` (a setting) is consulted here and in the read branch below: the
+    // long tail of secrets — a company vault file, a deploy key nobody shipped in a
+    // preset — has to be extendable, and this is the only layer that a *read* call cannot
+    // skip past. The tier is not configurable on purpose: a declared path gets exactly
+    // what `.ssh` gets, never a downgradable `ask`.
+    const declared = compileCredentialPaths(ctx.credentialPaths, {
+        caseInsensitive: ctx.caseInsensitive ?? false,
+        // `userHome`, not `home`: the latter is the workspace root. A caller that does not
+        // supply it gets the tail-match fallback in `compileCredentialPaths`, which is
+        // stricter, never looser.
+        ...(ctx.userHome === undefined ? {} : { home: ctx.userHome }),
+    });
+    if (path !== undefined && (ctx.tool === 'write' || ctx.tool === 'edit' || DESTRUCTIVE_TOOL.test(ctx.tool)) && isProtectedCredentialPath(path, declared)) {
+        return `mutation targets a credential store: ${path}`;
+    }
     if (READ_TOOLS.has(ctx.tool) && path !== undefined) {
         const normalized = path.startsWith('/') || /^[A-Za-z]:/.test(path) ? path : path;
-        if (!isWithin(ctx.cwd, normalized) && isSensitivePath(normalized)) {
+        if (!isWithin(ctx.cwd, normalized) && (isSensitivePath(normalized) || declared(path))) {
             return `read of sensitive path outside workspace: ${path}`;
         }
     }

package/lib/evaluate.d.ts

@@ -1,5 +1,6 @@
 import { type CompiledRuleEntry, type CompiledRuleset, type RuleAction } from './rule.js';
 import { type SimpleCommand } from './shell.js';
+import type { ScanKeyPolicy } from './scan-text.js';
 export interface ToolCallContext {
     readonly tool: string;
     readonly args: Record<string, unknown>;
@@ -7,8 +8,27 @@ export interface ToolCallContext {
     readonly cwd: string;
     /** Workspace root; used by the write-path override to decide inside vs outside. */
     readonly home?: string;
+    /**
+     * The real user directory (`os.homedir()`), used to expand a `~/` in a declared
+     * credential path. Deliberately separate from `home`, which is the workspace root —
+     * conflating them would expand `~/.myco/vault.token` into the project and protect
+     * nothing at all.
+     */
+    readonly userHome?: string;
     readonly dshHome?: string;
     readonly caseInsensitive?: boolean;
+    /**
+     * User-declared credential paths (`credentialPaths` setting), raw as configured.
+     * P0 compiles them; they extend the built-in store list for the two checks a read or
+     * write call cannot route around. Absent means the built-ins alone.
+     */
+    readonly credentialPaths?: readonly string[];
+    /**
+     * Additions to the argument-key sets that decide which parameter text a protective
+     * screen may read (`extraContentArgKeys` / `extraOperationArgKeys`). Absent means the
+     * built-in sets, which is what an embedded caller or a dry run gets.
+     */
+    readonly scanKeys?: ScanKeyPolicy;
     /** Agent identity candidates from session context. */
     readonly agentCandidates?: readonly string[];
     /** Network request info (for network dimension matching). */