dsh-perm-gate 5.2.0 → 5.3.0

package/lib/evaluate.js

@@ -142,8 +142,13 @@ const SHELL_WRITE_PATTERNS = [
     /(?:^|\s)(?:mv|cp|install|mkdir|touch|chmod|chown)\b/i,
     // Redirect into a file: `> f`, `>> f`, `>f`. The leading character class
     // excludes the stderr idioms a read-only command uses (`2>&1`, `>&2`,
-    // `2>/dev/null`, `1>&2`), and the trailing class requires an actual target.
-    /(?:^|[^0-9&])>>?\s*[^\s&|]/,
+    // `2>/dev/null`, `1>&2`) AND the two arrow forms that are pure text, not a
+    // redirect: `=>` (JS/Rust/arrow-function syntax, e.g. `node -e "(x)=>x+1"`) and
+    // `->` (prose / C member access, e.g. `Write-Host 'a -> b'`). Without `=`/`-` in
+    // the class, a read-only command merely *containing* an arrow was escalated to
+    // `ask` (GitHub issue #4). A real redirect's `>` is still preceded by a space or
+    // an ordinary word char (`echo x > f`, `ls>f`), so those keep matching.
+    /(?:^|[^0-9&=>-])>>?\s*[^\s&|]/,
     // `tee` always writes its target; `curl`/`wget` only when they write a file.
     /(?:^|\s)tee\b/i,
     /(?:^|\s)(?:curl|wget)\b.*?(?:\s-[oO]\b|>)/i,
@@ -167,26 +172,33 @@ function isWriteCommand(commandText) {
  * - `shell` / `pwsh` / `terminal`: read-only commands (git status, python -c
  *   fetch, curl without redirect, etc.) follow `defaultAction`; commands that
  *   contain a write/execution pattern escalate to `ask` for review.
+ *
+ * The escalation names its own cause (GitHub issue #3). Reporting these as
+ * `no rule matched; default action` tells a reader the ruleset was silent, when in fact
+ * a safety screen just refused to let the default through — and it makes the popup say
+ * "no rule covers this" about a call a rule *did* cover in spirit.
  */
 function pathAndCommandDefault(ctx, pathCandidates, defaultAction) {
     if (defaultAction !== 'allow')
-        return defaultAction;
+        return undefined;
     // write/edit: path-aware (outside workspace → ask)
     if (WRITE_TOOLS.has(ctx.tool)) {
         const home = ctx.home;
         if (home !== undefined && home !== '') {
             for (const candidate of pathCandidates) {
-                if (normalizeWorkspacePath(home, candidate, ctx.caseInsensitive) === '')
-                    return 'ask';
+                if (normalizeWorkspacePath(home, candidate, ctx.caseInsensitive) === '') {
+                    return { action: 'ask', why: `write target outside the workspace (${candidate})` };
+                }
             }
         }
-        return defaultAction;
+        return undefined;
     }
     // shell/pwsh/terminal: command-content-aware (write pattern → ask)
     const commandText = commandTextOf(ctx);
-    if (commandText !== undefined && isWriteCommand(commandText))
-        return 'ask';
-    return defaultAction;
+    if (commandText !== undefined && isWriteCommand(commandText)) {
+        return { action: 'ask', why: 'command carries a file-write or redirect pattern' };
+    }
+    return undefined;
 }
 /**
  * Command text of a shell call: the explicit `commandText` field when set,
@@ -224,8 +236,15 @@ export function decideRules(ruleset, ctx) {
     // shell/pwsh/terminal tools check the command for write patterns.
     // Outside safety checks → ask; inside or read-only → defaultAction.
     let action = ruleset.defaultAction;
+    // Why this layer decided, when it is the one that decided (issue #3): kept separate
+    // from `no rule matched` so an audit line cannot impersonate a ruleset gap.
+    let screenWhy;
     if (WRITE_TOOLS.has(ctx.tool) || shellText !== undefined) {
-        action = pathAndCommandDefault(ctx, pathCands, action);
+        const escalated = pathAndCommandDefault(ctx, pathCands, action);
+        if (escalated !== undefined) {
+            action = escalated.action;
+            screenWhy = escalated.why;
+        }
     }
     if (action === 'allow' || action === 'ask') {
         const allow = scan(ruleset.allow, 'allow');
@@ -235,7 +254,11 @@ export function decideRules(ruleset, ctx) {
         if (ask !== undefined)
             return ask;
     }
-    return { action, reason: `no rule matched; default action`, ruleIndex: undefined };
+    return {
+        action,
+        reason: screenWhy === undefined ? 'no rule matched; default action' : `${screenWhy}; escalated by the default safety screen`,
+        ruleIndex: undefined,
+    };
 }
 function decomposeSafe(text) {
     try {

package/lib/feedback.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Deterministic review opinion for a blocked tool call — no LLM.
+ *
+ * Modeled on cc-safety-net's block message (`BLOCKED + Reason + Rule + intent
+ * instruction`): when the gate refuses a call, the main LLM should get a structured
+ * note telling it *why*, *which rule/layer* fired, and *what to do instead*, so it
+ * stays on task instead of retrying a variant. perm-gate already has the raw
+ * material — every preset entry tags its reason `[deny-rule:<id>]` and states a
+ * safer alternative in prose, and the deterministic layers emit `[hard-deny]`/
+ * `no rule matched` reasons — this module folds that into one classified opinion.
+ *
+ * Kept dependency-free and pure so it can be unit-tested and reused by both the
+ * node decision path and any UI.
+ */
+/** The five dispositions, mirroring cc-safety-net's intent taxonomy. */
+export type ReviewIntent = 'hard_stop' | 'use_alternative' | 'scope_down' | 'manual_only' | 'stop_and_explain';
+/** Per-intent guidance to the agent, zh + en (the opinion is fed to the main LLM). */
+export declare const INTENT_ADVICE: Readonly<Record<ReviewIntent, {
+    readonly zh: string;
+    readonly en: string;
+}>>;
+/** Extract the `[deny-rule:<id>]` tag, a gate-danger tag (YOLO / degraded review /
+ * mechanical passthrough), or P0. */
+export declare function ruleIdOf(reason: string): string | undefined;
+/**
+ * Classify a block reason into an intent. Ordered from the most specific signal to
+ * a conservative default; the phrasing of preset-rule reasons drives the match.
+ */
+export declare function intentForDeny(reason: string): ReviewIntent;
+/**
+ * The structured opinion for one blocked call. `command` must already be redacted by
+ * the caller. Returns the classified intent plus a single line suitable for the
+ * `工具审核意见: "<text>"` wrapper the listener delivers to the session.
+ */
+export declare function composeReviewOpinion(input: {
+    readonly command: string;
+    readonly reason: string;
+    readonly locale?: 'zh' | 'en';
+}): {
+    readonly intent: ReviewIntent;
+    readonly text: string;
+};

package/lib/feedback.js

@@ -0,0 +1,85 @@
+/**
+ * Deterministic review opinion for a blocked tool call — no LLM.
+ *
+ * Modeled on cc-safety-net's block message (`BLOCKED + Reason + Rule + intent
+ * instruction`): when the gate refuses a call, the main LLM should get a structured
+ * note telling it *why*, *which rule/layer* fired, and *what to do instead*, so it
+ * stays on task instead of retrying a variant. perm-gate already has the raw
+ * material — every preset entry tags its reason `[deny-rule:<id>]` and states a
+ * safer alternative in prose, and the deterministic layers emit `[hard-deny]`/
+ * `no rule matched` reasons — this module folds that into one classified opinion.
+ *
+ * Kept dependency-free and pure so it can be unit-tested and reused by both the
+ * node decision path and any UI.
+ */
+/** Per-intent guidance to the agent, zh + en (the opinion is fed to the main LLM). */
+export const INTENT_ADVICE = {
+    hard_stop: {
+        zh: '不得重试或绕过此操作；跳过它，继续任务的其余部分。',
+        en: 'Do not retry or bypass this operation; skip it and continue the rest of the task.',
+    },
+    use_alternative: {
+        zh: '不要重试被拦的形式；按上面给出的更安全替代继续。',
+        en: 'Do not retry the blocked form; continue with the safer alternative named above.',
+    },
+    scope_down: {
+        zh: '请把目标收窄到明确必需的路径再重试；确需大范围操作则上报用户。',
+        en: 'Retry with a narrower, explicitly-needed target; escalate to the user if a broad operation is truly required.',
+    },
+    manual_only: {
+        zh: '此命令无法静态核验，请交由用户手动执行。',
+        en: 'This command cannot be verified statically; ask the user to run it manually.',
+    },
+    stop_and_explain: {
+        zh: '不要暴力尝试变体；简化或重组命令后再试，或上报此拦截。',
+        en: 'Do not brute-force variants; simplify or restate the command, or report this block.',
+    },
+};
+/** Extract the `[deny-rule:<id>]` tag, a gate-danger tag (YOLO / degraded review /
+ * mechanical passthrough), or P0. */
+export function ruleIdOf(reason) {
+    const tag = /\[(deny-rule:[a-z0-9._-]+|(?:yolo|rules-fallback|safety-net)-danger:[a-z0-9._-]+)\]/.exec(reason);
+    if (tag?.[1] !== undefined)
+        return tag[1];
+    if (/\[hard-deny\]|hard-deny/i.test(reason))
+        return 'hard-deny';
+    return undefined;
+}
+/**
+ * Classify a block reason into an intent. Ordered from the most specific signal to
+ * a conservative default; the phrasing of preset-rule reasons drives the match.
+ */
+export function intentForDeny(reason) {
+    const r = reason.toLowerCase();
+    // unverifiable / opaque target, or an act that needs the user's own consent → a human runs it
+    if (/opaque|cannot be (read|verified|analyzed)|unanalyz|encoded|unread|unresolv|non-literal|dynamic|substitution-assembled|verify the variable|explicit consent|needs? (the )?user/.test(r))
+        return 'manual_only';
+    // explicit safer alternative offered → use it
+    if (/\buse\b|\bprefer\b|\bsafer\b|\binstead\b|\bstash\b|dry-?run|\bfirst\b|\bedit specific\b|narrower/.test(r))
+        return 'use_alternative';
+    // broad/target-set concerns → narrow it. A P0 `[hard-deny]` or an unattended block is
+    // never merely "too broad": those carry an irreversibility the agent may not trade
+    // away, so the scope signal must not downgrade them into a retry-with-narrower note.
+    if (/targets? (a )?(directory|many|mass|whole|entire)|broad|everything|scope|wildcard|\.\*|recurse/.test(r) && !/never|unrecoverable|irreversib|hard-deny|yolo: block|rules-fallback: block/.test(r))
+        return 'scope_down';
+    // truly irreversible / protected stores / credential / a graded risk → hard stop
+    if (/\bhard-deny\b|-danger:|irreversib|unrecoverable|cannot be (recovered|regenerated|undone)|wipe|destroy|credential|protected path|credential store|shadow|format|risk|delete shadows|force-overwrite|protected branch/.test(r))
+        return 'hard_stop';
+    return 'stop_and_explain';
+}
+/**
+ * The structured opinion for one blocked call. `command` must already be redacted by
+ * the caller. Returns the classified intent plus a single line suitable for the
+ * `工具审核意见: "<text>"` wrapper the listener delivers to the session.
+ */
+export function composeReviewOpinion(input) {
+    const intent = intentForDeny(input.reason);
+    const rule = ruleIdOf(input.reason);
+    const advice = INTENT_ADVICE[intent];
+    const locale = input.locale ?? 'zh';
+    const cleanReason = input.reason.replace(/\[(?:deny-rule:[a-z0-9._-]+|(?:yolo|rules-fallback|safety-net)-danger:[a-z0-9._-]+|hard-deny)\]\s*/gi, '').replace(/\s*·.*$/, '').trim();
+    const text = locale === 'zh'
+        ? `已拦截。依据：${rule ?? '默认策略'}。原因：${cleanReason}。处置(${intent})：${advice.zh}`
+        : `Blocked. Rule: ${rule ?? 'default policy'}. Reason: ${cleanReason}. Disposition(${intent}): ${advice.en}`;
+    return { intent, text };
+}

package/lib/index.d.ts

@@ -7,7 +7,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { Config } from './config.js';
-import { PermGateRuntime, type ToolExecutionLike } from './runtime.js';
+import { PermGateRuntime, type PreToolDecisionLike, type ToolExecutionLike } from './runtime.js';
 export declare const name = "dsh-perm-gate";
 /**
  * The `tools` service drives `tools/pre-execute`/`tools/result` (dsh-tools).
@@ -53,5 +53,5 @@ export declare function makeApprovalAnswerer(runtime: Pick<PermGateRuntime, 'set
  * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
  * (fail-closed).
  */
-export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'> & Partial<Pick<PermGateRuntime, 'sandboxRewrite'>>): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
+export declare function makePreExecuteListener(runtime: Pick<PermGateRuntime, 'decideExecution' | 'refineAsk' | 'beginShellExecution'> & Partial<Pick<PermGateRuntime, 'sandboxRewrite' | 'unattendedModeOf' | 'resolveYolo' | 'resolveSafetyNet'>>, feedback?: (exec: ToolExecutionLike, decision: PreToolDecisionLike) => void): (exec: ToolExecutionLike, next: () => Promise<unknown>) => Promise<unknown>;
 export declare function apply(ctx: Context, config?: Record<string, unknown>): PermGateRuntime;

package/lib/index.js

@@ -9,9 +9,12 @@ import { registerDryRunRoute, registerEventsRoute, registerHealthRoute, register
 // T12 设置数据桥（describe/mutate；client BridgeDocHandle 消费）
 import { registerSettingsBridgeRoutes } from './bridge.js';
 import { buildReceiverInfo } from './receiver-info.js';
+import { composeReviewOpinion } from './feedback.js';
+import { redactCommandText } from './redact.js';
 import { readRulesView, readRulesViewFromSettings } from './rules-view.js';
 import { PermGateRuntime } from './runtime.js';
 import { classifySessions, sweepSessionData } from './session-sweep.js';
+import { isHumanFree } from './unattended.js';
 import { decideNetworkTarget } from './network.js';
 import { NetworkLifecycle } from './network-lifecycle.js';
 import { RuleWatcher } from './watch.js';
@@ -138,19 +141,13 @@ export function makeApprovalAnswerer(runtime) {
  * `riskTimeoutMs` (default 20 s), and a grader failure keeps the original ask
  * (fail-closed).
  */
-export function makePreExecuteListener(runtime) {
+export function makePreExecuteListener(runtime, feedback) {
     return async (exec, next) => {
         const decision = runtime.decideExecution(exec);
-        // Passthrough (allow / stand-down) and a hard-deny need no grading.
-        if (decision === undefined) {
-            // The call proceeds: register it so a network connection made by its
-            // child process can be attributed back to this session.
+        // The sanctioned "let it run" seam: register for network attribution, apply the
+        // AppContainer rewrite if enabled, then hand to the next waterfall listener.
+        const allowAndRun = async () => {
             runtime.beginShellExecution(exec);
-            // AppContainer sandbox (goal 2): rewrite the allowed shell call into
-            // the launcher invocation, or fail closed. The host executes THIS exec
-            // object after the waterfall resolves, so the in-place arguments swap
-            // is the sanctioned seam; the base64 wrapper keeps every pipe/&&
-            // inside the container (outer shell sees a plain exe call).
             if (typeof runtime.sandboxRewrite === 'function') {
                 const rewrite = await runtime.sandboxRewrite(exec);
                 if (rewrite !== undefined) {
@@ -163,9 +160,49 @@ export function makePreExecuteListener(runtime) {
                 }
             }
             return next();
+        };
+        // Human-free tiers — never a human prompt. A bare allow runs as usual; a
+        // deterministic deny blocks and feeds back; an ask is settled by whoever the tier put
+        // in the human's seat: YOLO hands what the mechanical floor could not name to the
+        // review model (and a grader throw fails open to allow), while the mechanical tier
+        // stops AT the floor and calls no model at all. Both block and feed the opinion back
+        // on a hit. `safety-net-ask` is NOT human-free — it is the explicit keep-the-person
+        // answer (and the one entry that beats a global yolo) — so it falls through to the
+        // ordinary waterfall below. Probed via `?.` so a stub/embedded runtime without the
+        // tier surface behaves as non-unattended.
+        const mode = runtime.unattendedModeOf?.(exec) ?? null;
+        if (mode !== null && isHumanFree(mode)) {
+            if (decision === undefined)
+                return allowAndRun();
+            if (decision.kind === 'deny') {
+                feedback?.(exec, decision);
+                return decision;
+            }
+            let resolved;
+            try {
+                resolved = mode === 'safety-net-passthrough'
+                    ? runtime.resolveSafetyNet?.(exec, decision)
+                    : await runtime.resolveYolo?.(exec, decision);
+            }
+            catch {
+                resolved = undefined; // fail-open: could not grade → allow ("其余放行")
+            }
+            if (resolved === undefined)
+                return allowAndRun();
+            feedback?.(exec, resolved);
+            return resolved;
+        }
+        // Passthrough (allow / stand-down) and a hard-deny need no grading.
+        if (decision === undefined) {
+            return allowAndRun();
+        }
+        if (decision.kind !== 'ask') {
+            // A deterministic deny (P0 hard-deny / deny-keyword / rule) never reaches a
+            // human; feed the structured opinion back so the main LLM stops retrying
+            // variants — the same guidance cc-safety-net attaches to its BLOCKED message.
+            feedback?.(exec, decision);
+            return decision;
         }
-        if (decision.kind !== 'ask')
-            return decision; // deny: it never runs
         // A cancelled call is never worth a model round-trip; the registry rechecks
         // cancellation after this gate settles.
         if (exec.signal?.aborted === true)
@@ -177,14 +214,16 @@ export function makePreExecuteListener(runtime) {
         catch {
             return decision; // fail-closed: keep the human ask
         }
-        if (refined === undefined) {
-            runtime.beginShellExecution(exec);
-            return next();
-        }
+        if (refined === undefined)
+            return allowAndRun();
         // Still an ask: the human decides. Register optimistically so a call they
         // approve is attributable; a rejection is dropped by the abort/settle path.
         if (refined.kind === 'ask')
             runtime.beginShellExecution(exec);
+        // A degraded-review block (`rulesFallback` with no reviewer) is a deny nobody
+        // ever saw a popup for — the same opinion the YOLO path owes the main LLM.
+        if (refined.kind === 'deny')
+            feedback?.(exec, refined);
         return refined;
     };
 }
@@ -445,6 +484,21 @@ export function apply(ctx, config = {}) {
                 strategies: resolvePermissiveStrategies(c.permissiveStrategies),
             };
         },
+        // Read the YOLO switch live so the settings-card toggle takes effect on the next tool
+        // call. It is the switch behind the `permissive-yolo` tier only — never a flow added to
+        // sessions that did not select it.
+        readYolo: () => current().yolo ?? false,
+        // The two `safenet` switches, read live: each controls whether one implementation
+        // exists, and each implementation owns one preset, so presets never cross.
+        readSafenetPass: () => current().safenetPass ?? true,
+        readSafenetAsk: () => current().safenetAsk ?? false,
+        // Degraded review: when no reviewer can grade an ask (none configured, or the
+        // endpoint gave up), the deterministic nets decide instead of a popup nobody
+        // answers — a cc-safety-net-class gate that blocks named danger and runs the rest.
+        readRulesFallback: () => current().rulesFallback ?? false,
+        // Script review (on by default): the body of every script a call runs rides the
+        // review, so neither the grader nor the human is judging a bare filename.
+        readScriptReview: () => current().scriptReview ?? true,
         // Read the llmAssist receiver (endpoint/model/secret/timeout) live from the
         // same namespace, so editing the settings card applies to the next tool call.
         readClassifyConfig: () => {
@@ -469,6 +523,28 @@ export function apply(ctx, config = {}) {
             const c = current();
             return Array.isArray(c.denyKeywords) ? c.denyKeywords : undefined;
         },
+        // Appended blacklist entries (long-tail secrets of the user's own) and the declared
+        // credential paths: both read live, so an edit in the settings card applies to the
+        // next tool call without a reload.
+        readDenyKeywordsExtra: () => {
+            const c = current();
+            return Array.isArray(c.denyKeywordsExtra) ? c.denyKeywordsExtra : [];
+        },
+        readCredentialPaths: () => {
+            const c = current();
+            return Array.isArray(c.credentialPaths) ? c.credentialPaths : [];
+        },
+        // Which argument fields count as prose is a per-deployment fact (every host ships new
+        // document keys); read both lists live so an edit in the settings card applies to the
+        // next call rather than to the next restart.
+        readExtraContentArgKeys: () => {
+            const c = current();
+            return Array.isArray(c.extraContentArgKeys) ? c.extraContentArgKeys : [];
+        },
+        readExtraOperationArgKeys: () => {
+            const c = current();
+            return Array.isArray(c.extraOperationArgKeys) ? c.extraOperationArgKeys : [];
+        },
         // Learning sedimentation: threshold-reached samples become deterministic allows.
         readRiskSediment: () => current().riskSediment ?? true,
         // llmAssist receiver source: custom OpenAI-compatible endpoint or the host llm service.
@@ -742,7 +818,33 @@ export function apply(ctx, config = {}) {
     catch {
         // webServer unavailable: the feed remains disk-only, sediment is view-only in files
     }
-    const listener = makePreExecuteListener(runtime);
+    // YOLO feedback: when a call is blocked (YOLO block **or** a deterministic deny in
+    // any mode), append a user-role "工具审核意见" message to the owning session so the
+    // main LLM sees why + which rule + a disposition and self-corrects — modeled on
+    // cc-safety-net's BLOCKED message. Best-effort; a failed delivery never un-blocks.
+    const yoloSender = buildSessionSender(fallbackGet);
+    const blockedSubject = (exec) => {
+        const args = exec.arguments ?? {};
+        const cmd = (typeof exec.commandText === 'string' && exec.commandText !== ''
+            ? exec.commandText
+            : (typeof args.command === 'string' ? args.command : undefined));
+        if (cmd !== undefined)
+            return redactCommandText(cmd);
+        const p = ['file_path', 'path', 'cwd', 'workdir'].map((k) => args[k]).find((v) => typeof v === 'string');
+        return `${exec.name}${typeof p === 'string' ? ': ' + p : ''}`;
+    };
+    const yoloFeedback = (exec, decision) => {
+        const sessionId = (typeof exec.sessionId === 'string' && exec.sessionId !== ''
+            ? exec.sessionId
+            : (exec.agent?.sessionId ?? exec.agent?.session?.id) ?? '');
+        if (sessionId === '')
+            return;
+        const { text } = composeReviewOpinion({ command: blockedSubject(exec), reason: decision.reason, locale: 'zh' });
+        void yoloSender(sessionId, `工具审核意见: "${text}"`).catch(() => {
+            // no delivery channel — the block still stands, the LLM just gets no note.
+        });
+    };
+    const listener = makePreExecuteListener(runtime, yoloFeedback);
     // `tools/pre-execute` / `tools/result` / `approval/request` are service events,
     // not part of cordis core's typed `Events`, so they are registered through the
     // string overload.

package/lib/irreversible.js

@@ -178,7 +178,87 @@ function isRootish(token) {
     if (t === '--no-preserve-root' || t.endsWith('--no-preserve-root'))
         return true;
     return DRIVE_ROOT.test(t) || FS_ROOT.test(t) || WIN_SYSTEM.test(t) || WIN_USERS.test(t) || NIX_SYSTEM.test(t)
-        || FLAT_DRIVE_ROOT.test(t.replace(/[\\/]+/g, ''));
+        || FLAT_DRIVE_ROOT.test(t.replace(/[\\/]+/g, ''))
+        || isHomeVariableRoot(t);
+}
+/**
+ * The user profile / home expressed as a **variable or glob**, not a literal path.
+ *
+ * `$env:USERPROFILE` (cmd `%USERPROFILE%`), the PowerShell automatic `$HOME` /
+ * `${HOME}`, `$PSHOME`, `$env:HOME`/`$HOMEPATH`/`$env:HOMEPATH`, the bare shell
+ * home `~`, and any dotfile sweep of those (`~/*`, `~/.*`, `~/?*`, `$env:USERPROFILE\.*`)
+ * all resolve at run time to `C:\Users\<name>` — the exact target `WIN_USERS` already
+ * hard-denies in literal form. The incident this closes is the *variable* spelling:
+ * `Remove-Item $home -Recurse -Force` (where `$home=` assignment silently no-ops) or
+ * `Get-ChildItem $env:USERPROFILE -Force | Remove-Item` reach the grader as an
+ * unresolvable token, are not root-shaped, so a probabilistic `safe` cleared them.
+ * Matching the root itself (or an unbounded `*`/`.?` sweep of it) — never a specific
+ * child like `~/.cache` — keeps legitimate scoped cleanup clearable while making the
+ * profile-root delete deterministic, no-model, and immune to an `llmAssist`/YOLO
+ * `safe` downgrade.
+ */
+const HOME_ROOT_VAR = /^(?:\$\{?(?:home|homeroot|userprofile|profile|pshome|env:userprofile|env:home|env:homeroot|env:profile)\}?|%userprofile%)$/i;
+// A home/profile root variable optionally followed by an unbounded sweep (`/.*`,
+// `/?*`, `/*`, or just `.*`). Separators are normalized before this test, so the
+// quoted `"$env:USERPROFILE\.*"` (arrives with a backslash) and the stripped-flat
+// `$env:USERPROFILE.*` both land here — the decomposer removes `\` from unquoted
+// args, so demanding a literal `/` would miss the more common Windows form.
+const HOME_ROOT_PREFIX = /^(?:\$\{?(?:home|homeroot|userprofile|pshome|env:userprofile|env:home|env:homeroot|env:profile)\}?|%userprofile%|~)/i;
+/** Whether one token names the home/profile root (or an unbounded sweep of it). */
+function isHomeVariableRoot(token) {
+    const t = token.trim().replace(/[\\/]+/g, '/').replace(/\/$/, '');
+    if (t === '~')
+        return true;
+    if (HOME_ROOT_VAR.test(t))
+        return true;
+    // `<home-var>/<unbounded glob>` — `~/.*`, `~/*`, `$env:USERPROFILE/.*`.
+    if (HOME_ROOT_PREFIX.test(t)) {
+        const rest = t.slice(t.indexOf('/') + 1);
+        return /^(?:\.?\*|\.\?\*|\.\?\?\*)$/.test(rest);
+    }
+    return false;
+}
+/**
+ * Other common Windows roots an agent reaches for **by environment variable**, which
+ * the literal-path rules (`WIN_SYSTEM` / `WIN_USERS`) cannot see because the token is
+ * a `$env:`/`%VAR%` name, not `C:\Windows`. Deleting one of these recursively destroys
+ * either the whole system (`SystemRoot`/`ProgramFiles`/`ProgramData`) or every app's
+ * configuration and user data (`APPDATA`/`LOCALAPPDATA`/`OneDrive`/`Public`) in one
+ * shot.
+ *
+ * These grade **never-clear** (permanent ask), not P0 deny: unlike `$HOME` (the profile
+ * root itself, already denied), a whole-`LOCALAPPDATA`/`ProgramData` wipe is sometimes
+ * deliberate maintenance the human should still decide on — so no grader `safe` may
+ * clear it and no run of confirmations may sediment it, but appeal stays open.
+ *
+ * Only the **bare root or an unbounded sweep** (`$env:APPDATA`, `"$env:LOCALAPPDATA\.*"`)
+ * qualifies — a named child (`$env:LOCALAPPDATA\Foo\bar`) is normal scoped cleanup and
+ * must stay clearable. `TEMP`/`TMP`/`TMPDIR` are explicitly **excluded**: deleting the
+ * temp root is legitimate. Separators are normalized (`\`→`/`) and matching is
+ * case-insensitive, so `$Env:AppData`, `${env:appdata}`, and `%APPDATA%` all land here.
+ */
+const PROTECTED_ENV_SYSTEM = new Set(['systemroot', 'windir', 'systemdrive', 'programfiles', 'programfiles(x86)', 'programdata']);
+const PROTECTED_ENV_USERDATA = new Set(['appdata', 'localappdata', 'onedrive', 'public', 'homedrive', 'homepath']);
+const EXCLUDED_ENV_ROOTS = new Set(['temp', 'tmp', 'tmpdir', 'tempdir']);
+const ENV_ROOT_TOKEN = /^(?:\$\{?env:([^/}]+)\}?|%([^%/]+)%)(.*)$/i;
+/** Which protected root (if any) one token names — the bare root or an unbounded sweep. */
+function protectedEnvRoot(token) {
+    const t = token.trim().replace(/[\\/]+/g, '/').replace(/\/+$/, '').toLowerCase();
+    const m = ENV_ROOT_TOKEN.exec(t);
+    if (m === null)
+        return undefined;
+    const name = (m[1] ?? m[2] ?? '').trim();
+    if (name === '' || EXCLUDED_ENV_ROOTS.has(name))
+        return undefined;
+    const rest = (m[3] ?? '').replace(/^\/+/, '');
+    // bare root (empty tail) or an unbounded glob sweep; anything else is a named child.
+    if (rest !== '' && !/^(?:\.?\*|\.\?\*|\.\?\?\*)$/.test(rest))
+        return undefined;
+    if (PROTECTED_ENV_SYSTEM.has(name))
+        return 'system';
+    if (PROTECTED_ENV_USERDATA.has(name))
+        return 'userdata';
+    return undefined;
 }
 /**
  * Forced recursive deletion aimed at a root or system tree.
@@ -274,6 +354,20 @@ export function irreversibleReason(text, opts = {}) {
     }
     if (forcedDeleteOfRoot(text, programs))
         return 'forced recursive deletion targets a system root';
+    // Forced/recursive delete aimed at the profile expressed as a home **variable**
+    // or a dotfile sweep of it (`$home`/`$HOME`/`$PSHOME`/`$env:USERPROFILE`/`~`/`~/.*`).
+    // Checked independently of `forcedDeleteOfRoot` because the incident shape nests the
+    // delete inside `if (Test-Path $home) { Remove-Item … }`, where the shell parser
+    // never surfaces `Remove-Item` as a command word, so the program-scanning path is
+    // blind to it. Requiring (recurse AND force AND a home-root token) keeps scoped
+    // cleanup of a named child (`~/.cache`, `$buildDir`) clearable — only the profile
+    // root or an unbounded sweep of it lands here. This makes it irreversible, which
+    // the ask-context grades `I` and `refineAsk` refuses to clear on a grader `safe`.
+    if (/\b(?:remove-item|rmdir|erase|unlink|shred)\b|\brm\b|\bdel\b/i.test(text)
+        && /-(?:recurse|r\b|rf|fr|\w*r\w*)/i.test(text) && /-(?:force|fo|f\b|rf|fr|\w*f\w*)/i.test(text)
+        && text.split(/[\s"',;{}()&|]+/).some(isHomeVariableRoot)) {
+        return 'forced recursive deletion targets the user profile via a home variable or a dotfile sweep of it';
+    }
     // Deleting the gate's own state directory is unrecoverable and disarms the gate:
     // no recurse flag required, because the WAL/journal files are the point.
     if (programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p)) && OWN_STATE_PATH.test(text)) {
@@ -372,5 +466,19 @@ export function neverClearReason(text) {
         return 'keys are swept off this machine and uploaded';
     if (WIPE_IN_BODY.test(text))
         return 'a wipe is hidden behind a function body expanded at runtime';
+    // Forced/recursive delete aimed at a protected Windows root reached **by environment
+    // variable** (`$env:APPDATA`/`%APPDATA%`/`$env:SystemRoot`/`%WINDIR%`/`$env:ProgramFiles`
+    // /`$env:ProgramData`/`$env:LOCALAPPDATA`/`$env:OneDrive`/`$env:Public`/`$env:HOMEDRIVE`
+    // /`$env:HOMEPATH`), or an unbounded sweep of one. Same shape as the home-variable net
+    // (delete verb + loose recurse/force + a root token), but tiered to **never-clear ask**,
+    // not P0: TEMP/TMP and named children (`$env:APPDATA\Foo`) never match, and the human
+    // keeps the appealable decision. Tokenize on whitespace/quotes only, so `${env:x}` and
+    // `$env:x\.*` stay one token. Delete-verb comes from `programs` (command position), so
+    // a commit message merely *mentioning* `rm -rf $env:APPDATA` stays clearable.
+    if (programs.some((p) => /^(?:remove-item|rmdir|rm|del|erase|unlink|shred)$/.test(p))
+        && /(?:-\w*r\w*|(?:^|\s)\/s(?:\s|$))/i.test(text) && /(?:-\w*f\w*|(?:^|\s)\/(?:q|f)(?:\s|$))/i.test(text)
+        && text.split(/[\s"',;]+/).some((tok) => protectedEnvRoot(tok) !== undefined)) {
+        return 'forced recursive deletion targets a protected Windows root via an environment variable — verify the resolved path before proceeding';
+    }
     return undefined;
 }

package/lib/path.d.ts

@@ -16,6 +16,37 @@ export declare function normalizeWorkspacePath(cwd: string, candidate: string, c
 export declare function isWithin(base: string, target: string): boolean;
 /** Sensitive credential-ish path roots that reads/writes should route to review. */
 export declare function isSensitivePath(p: string): boolean;
+/**
+ * Credential / auth stores whose **mutation** grants or destroys access and must
+ * never be silently allowed. Narrower than {@link isSensitivePath}: `.env` is
+ * deliberately excluded — editing a project's own `.env` is normal dev work (a
+ * secret-reading *display* concern, not a mutation backdoor), while dropping a key
+ * into `~/.ssh/authorized_keys`, flipping `git config credential.helper store`, or
+ * rewriting `.git-credentials`/`.npmrc`/cloud cred files *creates or leaks authority*.
+ *
+ * Also excluded on purpose, because a P0 deny cannot be appealed and these are both
+ * routine *and* regenerable: the bare `~/.ssh/` directory (its `config` only holds host
+ * aliases), `known_hosts` (rebuilt with `ssh-keyscan`), and the `*.pub` half of a
+ * keypair — a hand-carried key restore writes `id_ed25519.pub` and `known_hosts` in the
+ * same breath, so blocking them would deny the owner their own credentials. Private key
+ * material itself stays denied: overwriting it destroys access with no way back, and a
+ * deliberate restore can still be done by the human outside the gate.
+ *
+ * Symmetry with the shell layer: `preset-rules` already denies deletion of these
+ * stores and asks on reading them, but the file-mutation tools (write/edit) were
+ * auto-allowed past the credential path because the P0 mutation guard only covered
+ * system roots — this is the set that guard now also checks.
+ */
+export declare function isCredentialStorePath(p: string): boolean;
+/**
+ * Whether one path is a credential worth P0 attention — the built-in store list, plus
+ * whatever the user declared in `credentialPaths` (compiled by `credential-paths.ts`).
+ *
+ * The extension point is a predicate rather than a second list so the *tier* cannot be
+ * chosen by the person adding an entry: a declared long-tail secret gets exactly what
+ * `.ssh` gets, and cannot accidentally land in a downgradable `ask` instead.
+ */
+export declare function isProtectedCredentialPath(p: string, extra?: (path: string) => boolean): boolean;
 /** Root-level / DSH_HOME / home/system paths that must never be mutated. */
 export declare function isProtectedDestructiveTarget(p: string, dshHome?: string): boolean;
 export interface ArtifactRecord {

package/lib/path.js

@@ -54,6 +54,41 @@ export function isWithin(base, target) {
 export function isSensitivePath(p) {
     return /(?:^|[\\/])(?:\.ssh|\.gnupg|\.aws|\.azure|\.kube|\.config[\\/]gh|\.docker)(?:[\\/]|$)|(?:^|[\\/])(?:id_rsa|id_ed25519|credentials\.yaml|config\.json|\.env)(?:$|[.\\/])/i.test(p);
 }
+/**
+ * Credential / auth stores whose **mutation** grants or destroys access and must
+ * never be silently allowed. Narrower than {@link isSensitivePath}: `.env` is
+ * deliberately excluded — editing a project's own `.env` is normal dev work (a
+ * secret-reading *display* concern, not a mutation backdoor), while dropping a key
+ * into `~/.ssh/authorized_keys`, flipping `git config credential.helper store`, or
+ * rewriting `.git-credentials`/`.npmrc`/cloud cred files *creates or leaks authority*.
+ *
+ * Also excluded on purpose, because a P0 deny cannot be appealed and these are both
+ * routine *and* regenerable: the bare `~/.ssh/` directory (its `config` only holds host
+ * aliases), `known_hosts` (rebuilt with `ssh-keyscan`), and the `*.pub` half of a
+ * keypair — a hand-carried key restore writes `id_ed25519.pub` and `known_hosts` in the
+ * same breath, so blocking them would deny the owner their own credentials. Private key
+ * material itself stays denied: overwriting it destroys access with no way back, and a
+ * deliberate restore can still be done by the human outside the gate.
+ *
+ * Symmetry with the shell layer: `preset-rules` already denies deletion of these
+ * stores and asks on reading them, but the file-mutation tools (write/edit) were
+ * auto-allowed past the credential path because the P0 mutation guard only covered
+ * system roots — this is the set that guard now also checks.
+ */
+export function isCredentialStorePath(p) {
+    return /(?:^|[\\/])authorized_keys2?(?:$|[.\\/])|(?:^|[\\/])(?:id_rsa|id_dsa|id_ecdsa|id_ed25519)(?:_sk)?(?!\.pub)(?:$|[.\\/])|(?:^|[\\/])(?:\.gnupg|\.aws|\.azure|\.kube|credentials\.yaml)(?:[\\/]|$)|(?:^|[\\/])(?:\.gitconfig|\.git-credentials|\.npmrc|\.netrc|\.pypirc)(?:$|[.\\/])/i.test(p);
+}
+/**
+ * Whether one path is a credential worth P0 attention — the built-in store list, plus
+ * whatever the user declared in `credentialPaths` (compiled by `credential-paths.ts`).
+ *
+ * The extension point is a predicate rather than a second list so the *tier* cannot be
+ * chosen by the person adding an entry: a declared long-tail secret gets exactly what
+ * `.ssh` gets, and cannot accidentally land in a downgradable `ask` instead.
+ */
+export function isProtectedCredentialPath(p, extra) {
+    return isCredentialStorePath(p) || (extra !== undefined && extra(p));
+}
 /** Root-level / DSH_HOME / home/system paths that must never be mutated. */
 export function isProtectedDestructiveTarget(p, dshHome) {
     const posix = toPosix(p).toLowerCase();