dsh-perm-gate 5.2.0 → 5.3.1

package/README.zh.md

@@ -56,7 +56,7 @@
 严格 fail-closed：P0 永不因 grant / 规则 / 分类器 / 人工而放行。
 
 <!-- host-compat:begin — generated by scripts/sync-hosts.mjs from scripts/hosts.mjs; DO NOT EDIT -->
-- **支持的 DSH 宿主：** `0.1.0-rc.2` `0.1.0-rc.3` `0.1.0-rc.6` `0.1.0-rc.7` `0.1.0-rc.8` `0.1.1-rc.1` `0.1.1-rc.2` `0.1.2-rc.1` `0.1.5-rc.1` `0.1.5-rc.2` `0.1.5-rc.3` `0.1.7-rc.1` `0.1.7-rc.2` `0.2.0-rc.1` `0.2.0-rc.2`（覆盖 0.1.0 / 0.1.1 / 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 六条线共 15 个 rc）
+- **支持的 DSH 宿主：** `0.1.0-rc.2` `0.1.0-rc.3` `0.1.0-rc.6` `0.1.0-rc.7` `0.1.0-rc.8` `0.1.1-rc.1` `0.1.1-rc.2` `0.1.2-rc.1` `0.1.5-rc.1` `0.1.5-rc.2` `0.1.5-rc.3` `0.1.7-rc.1` `0.1.7-rc.2` `0.2.0-rc.1` `0.2.0-rc.2` `0.2.1-rc.1`（覆盖 0.1.0 / 0.1.1 / 0.1.2 / 0.1.5 / 0.1.7 / 0.2.0 / 0.2.1 七条线共 16 个 rc）
 - **运行时已验证：** `0.2.0-rc.2`（证据见 `.compat-results/`）
 <!-- host-compat:end -->
 
@@ -232,7 +232,32 @@ outside the design set get none*。`permissive` 是内置值，所以「自动
       alwaysConfirm: false       # 一律逐次 ask；允许控件附带重复允许/迁白名单按钮
       trustEscalation: true      # 门禁已放行的调用，其自身的沙箱提权免确认
       llmAssist: false           # 先由 LLM 分类裁决；ask/无分类器时回退到人工
+    yolo: false                  # 无人值守：永不问人，危险才拦、其余放行
+    rulesFallback: false         # 无可用审查模型 => 只按确定性规则网裁定
+    scriptReview: true           # 把调用所跑脚本的正文随审查一并附上
+    credentialPaths: []          # 长尾凭据路径，按 `.ssh` 同档保护
+    denyKeywordsExtra: []        # 追加黑名单词（不替换预置表）
+    extraContentArgKeys: []      # 哪些参数是文档而非操作
+    extraOperationArgKeys: []    # 哪些参数确实是会被执行的代码（撞名时本表胜）
+    safenetPass: true            # permissive-mech 档的实现存在（机械接管 ask）
+    safenetAsk: false            # permissive-snet 档的实现存在（机械过滤，仍然问人）
 ```
+三颗开关，每颗只管插件自己贡献给权限下拉的一个预设——所以一颗开关只改它那一档的行为，不会串到
+别的档；把实现关掉，那一档就退回普通人工流，而不是偷偷变成另一个档。
+
+| 开关 | 档 | 谁定 ask | 问人 | 叫模型 |
+| --- | --- | --- | --- | --- |
+| `permissive` | `permissive` / `permissive-full` | 机械先筛 + 模型精化，剩下交给人 | 会 | 由 `llmAssist` 决定 |
+| `safenetAsk` | `permissive-snet` | 交给人，并列出机械疑点 | **会** | **一次都不叫** |
+| `safenetPass` | `permissive-mech` | 机械独判：点名的拦+回喂，其余放行 | 不会 | **一次都不叫** |
+| `yolo` | `permissive-yolo` | 模型替人裁决：risky 拦+回喂，其余放行 | 永不 | 每个残局 |
+
+`safenetPass` 就是 `approval: never` 的「有审查版」（那一档无脑直通、没人判定），也是 yolo 拿掉
+模型后的劣化形态。`yolo` 按定义就是带模型的那一档：模型不在场时它仍然不问人、按机械处置，并把
+记录写成 `yolo-allow-no-reviewer`，好让审批历史不会被误读成"模型答过"。五档都由插件自带 patch
+发布，装好就在下拉里，不需要手改宿主配置。不在 `gatePresets` 里的预设走不到这一步：那里整个门禁
+停用，本来就没有需要回答的确认。
+
 (llmAssist 的真实接收 LLM 在设置页填 `classifierEndpoint` / `classifierModel`，OpenAI 兼容的自定义 API
 均可。设置页可选择接收来源：**自定义 API**（任何 OpenAI 兼容端点，内置小米 MiMo `https://api.xiaomimimo.com/v1` 等预设）或**宿主模型组**（复用 DSH 会话已配置的 `llm` 服务与当前模型组，可用 `classifierProvider` / `classifierModel` 覆盖）；并提供**健康测试**按钮，一键验证接收 LLM 的连通性与延迟。)
 
@@ -243,6 +268,22 @@ outside the design set get none*。`permissive` 是内置值，所以「自动
 接缝——始终 fail-closed。`trustEscalation`（档位开启时默认开）答复门禁已放行的调用在其工具体内
 提出的 `sandbox_permissions` 提权；见下文。`permissive` 关闭时，门禁行为与之前完全一致。
 
+### 无人值守档位，以及如何保护预置表认不出的凭据
+
+三个开关改变“谁来定”，七个键改变“能看见什么”。它们全部 volatile：设置卡改完下一个工具调用即生效，无需重载。
+
+- `yolo`（负责 `permissive-yolo` 那一档）— 永不弹人工确认。危险 ask（不可逆 / 不可沉淀 / 载荷读不懂 / 审查模型报硬风险）被拦截，理由以 `工具审核意见` 消息回喂主模型；其余照常执行。审查模型不在场时它不静默放行：由机械审查器裁定，并把事件记为 `yolo-allow-no-reviewer`——一档既然声称有模型，就不能把没答上的模型报成答过了。
+- `rulesFallback` — 降级审查。仅当**没有审查模型**（未配置，或端点未能给出裁决）时生效：改由确定性规则网裁定，不再把调用挂在没人应答的确认框上。模型正常应答时行为不变。它只作用于普通的自动审查档（`permissive` / `permissive-full`）；那三颗各自拥有一档的开关已经写明由谁回答，不会被它降级。
+- `scriptReview`（默认开）— 调用跑脚本时读取它的正文（有界、绝不执行），同时交给审查模型、人工卡片与规则网：只在 `clean-home.sh` 里看到的删除从此按代码判定。正文全读到就不再是“读不懂的载荷”，从而脱离 U 档。关掉可不让文件内容离开本机，代价是工作区外脚本回到“看不清、问人”。
+
+“什么算凭据”的长尾由你扩展，但每张表**只往内置表上追加**，不提供替换能力——漏写 `content` 或 `plan` 会静默重现本门禁已经修过的那个 bug：
+
+- `credentialPaths` — 路径 glob（双星跨目录、单星与问号限一段；无通配符时按整个路径片段匹配；`~/` 展开为你的 home；相对写法也在任意深度匹配）。列入的路径与 `.ssh` 同档：工作区外读取被拒、被 `write`/`edit` 改写被拒。该档是 P0（不可申诉、审查模型也放行不了），这正是它是配置项而非 `rules.yaml` 规则的原因：只读工具在规则链**之前**就被自动放行了，规则看不见这类调用。
+- `denyKeywordsExtra` — 向当前生效的黑名单（预置或你替换后的表）**追加**词项，为公司 CLI 的吊销子命令或自有令牌前缀加一道确定性拦截，而不必把 50 条预置抄进 profile。
+- `extraContentArgKeys` / `extraOperationArgKeys` — 哪些参数是文档、哪些是操作。前者阻止宿主工具的 `steps`/`notes` 正文被当成操作读（issue #2 就是这么发生的：一份诚实的计划写了 `rm -rf` 反而因“描述”被拒）；后者为 `workflowYaml` 这种“正文真的会被执行”的字段反向开口，且与前者撞名时本表获胜。把真正的文档字段写进来，就等于让“计划里提到 `rm -rf`”重新变成拒绝理由，所以默认关。
+
+把 `command` 或 `file_path` 声明为文档并不能削弱门禁：被执行的命令与被改写的路径由各自的判据路径负责，不走这张表（已有断言测试钉住）。
+
 ### 沙箱提权：为何 `safe` 裁决仍会弹窗
 
 一个工具调用可能触发**两个独立的审批**。门禁负责第一个——它的 `ask`，在 `tools/pre-execute`

package/cordis.patch.yml

@@ -1,7 +1,7 @@
 # dsh-perm-gate profile patch.
 #
 # Two jobs:
-# 1) Add the plugin's own "自动审查" session approval tier to the DSH
+# 1) Add the plugin's own "自动审查" session approval tiers to the DSH
 #    permission picker, and restate the built-in tiers it must not drop.
 # 2) Insert the plugin itself (host half) into the profile.
 #
@@ -77,6 +77,21 @@
         approval: ask
         name: 自动审查（高权限）
         description: 只由本插件的审批门过滤 —— 文件修改与子进程网络访问不再受沙箱限制，审批仍逐次生效，但没有系统沙箱兜底。
+      permissive-snet:
+        sandbox: workspace-write
+        approval: ask
+        name: 自动审查·机械过滤
+        description: 不调用审查模型 —— 确定性机械审查器先筛并列出疑点，剩下的仍然交人工确认。适用于无审查 LLM 可用、或不习惯模型替你拿主意的场景（不常用）。
+      permissive-mech:
+        sandbox: danger-full-access
+        approval: ask
+        name: 自动审查·机械直通
+        description: 无人确认 —— 确定性机械审查器替代人工：命中不可逆 / 不可沉淀 / 读不懂的载荷即拦截，并把理由回喂主模型，其余照常执行。不调用审查模型，零 token。
+      permissive-yolo:
+        sandbox: danger-full-access
+        approval: ask
+        name: 自动审查·YOLO
+        description: 无人确认 —— 审查模型逐条替代人工裁决，报硬风险即拦截并回喂理由；模型未配置或未能给出裁决时退回机械处置。永不升级人工。
       danger-full-access:
         sandbox: danger-full-access
         approval: never

package/dsh.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "dsh-perm-gate",
   "name": "dsh-perm-gate",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "description": {
     "en": "Deterministic-first, fail-closed permission gate for DeepSeek Harness 0.1.2+: a P0 hard-deny -> P1 precise session grant -> P2 static allow/deny rule chain -> P3 optional LLM classifier -> P4 ask pipeline over the tools/pre-execute waterfall, with a standalone CLI dry-run evaluator and an auditable decision log. It only vetoes with deny/ask and always delegates otherwise, and unknown or malformed rules fail loud instead of silently standing the gate down.",
     "zh": "面向 DeepSeek Harness 0.1.2+ 的确定性优先、失败即拒的权限闸门：在 tools/pre-execute 瀑布上串起 P0 硬拒绝 → P1 精确会话授权 → P2 静态 allow/deny 规则链 → P3 可选 LLM 语义分类 → P4 ask，并附带独立 CLI 干跑评估器与可审计的决策日志。只以 deny/ask 否决、其余一律放行，规则未知或非法时直接报错，绝不静默失效。"
@@ -13,7 +13,7 @@
   },
   "license": "MIT",
   "engines": {
-    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2"
+    "dsh": "0.1.0-rc.2 || 0.1.0-rc.3 || 0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8 || 0.1.1-rc.1 || 0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.5-rc.3 || 0.1.7-rc.1 || 0.1.7-rc.2 || 0.2.0-rc.1 || 0.2.0-rc.2 || 0.2.1-rc.1"
   },
   "components": {
     "host": "lib/index.js",

package/lib/ask-context.d.ts

@@ -10,6 +10,17 @@ export type Reversibility =
  | 'R';
 /** What the call is aimed at. */
 export type TargetKind = 'read' | 'write' | 'delete' | 'remote-write' | 'exec-external' | 'unknown';
+/**
+ * One script body handed to the reviewers, as the runtime read it. Structural here so
+ * this module keeps its dependency-free contract (the fs half lives in `script-review.ts`).
+ */
+export interface ScriptContentIn {
+    readonly ref: string;
+    readonly path: string;
+    readonly body: string;
+    readonly truncated: boolean;
+    readonly unreadable?: string;
+}
 /** The session's three tier knobs, folded out of the durable session log. */
 export interface SessionKnobs {
     readonly permissionPreset?: string;
@@ -28,6 +39,18 @@ export interface AskContextSource {
     readonly files?: readonly string[];
     /** The deterministic layer's own conclusion, kept for the human, not the grader. */
     readonly ruleReason?: string;
+    /**
+     * The scripts this call runs, with the body the reviewer is given. Read by the node
+     * runtime (`script-review.ts`) — this module stays filesystem-free, so the text
+     * arrives pre-fetched. Absent means either no script is named or review is off.
+     */
+    readonly scriptContents?: readonly ScriptContentIn[];
+    /**
+     * True when *every* script the call names was read, i.e. what will execute is now
+     * visible. That is what lifts a script run out of the opaque/`U` tier: the reviewer
+     * is no longer judging a filename. One unreadable script keeps the opacity.
+     */
+    readonly scriptsCovered?: boolean;
     /** Correlation key, mixed into the event digest. */
     readonly callId?: string;
     /** Per-session salt so `inputDigest` cannot be dictionary-reversed or joined across sessions. */
@@ -64,7 +87,24 @@ export interface GraderPayload {
     readonly reason: string;
     readonly target_resolvable: boolean;
     readonly workspace_root?: string;
+    /**
+     * The bodies of the scripts this call runs, redacted like any other egress text.
+     * Without them the grader judges a filename and can say `safe` about code it never
+     * saw; with them the answer is about what will execute.
+     */
+    readonly script_contents?: readonly GraderScript[];
 }
+/** One attached script, as it leaves the host. */
+export interface GraderScript {
+    readonly ref: string;
+    readonly path: string;
+    /** Absent when `unreadable` names why there is no body. */
+    readonly body?: string;
+    readonly truncated?: boolean;
+    readonly unreadable?: string;
+}
+/** Budget for one script body on the wire: a real script, one round-trip. */
+export declare const GRADER_SCRIPT_BODY_CHARS = 20000;
 /**
  * Project for egress to the grader. Tier knobs and the rule layer's own verdict
  * are stripped by design — see the module comment.
@@ -136,6 +176,14 @@ export declare const DOUBT_COPY: {
         readonly zh: "会执行工作区之外的代码，本次调用无法静态看清它做什么";
         readonly en: "it runs code from outside the workspace, which this call cannot inspect";
     };
+    readonly 'script-attached': {
+        readonly zh: "它要跑的脚本正文已读出来、随本次审查附上（模型看到的和你看到的是同一份）";
+        readonly en: "the script it runs was read and attached to this review — the model and you see the same text";
+    };
+    readonly 'script-unreadable': {
+        readonly zh: "脚本正文没读到（缺失/过大/二进制），没有人看见真正要执行的代码";
+        readonly en: "a script body could not be read (missing, over budget, or binary) — nobody has seen the code that will run";
+    };
     readonly 'outside-paths': {
         readonly zh: "涉及工作区之外的路径";
         readonly en: "it touches paths outside the workspace";
@@ -171,7 +219,7 @@ export declare function askDoubtKinds(ctx: AskContext, extra?: {
  * The event still carries the command separately (`humanCommand`) because the
  * review list has no host-provided command block next to it.
  */
-export declare function humanBrief(ctx: AskContext, lang: 'zh' | 'en', kinds?: ("write" | "delete" | "remote-write" | "exec-external" | "never-learn" | "no-rule" | "opaque" | "irreversible" | "outside-paths" | "model-flagged")[]): string;
+export declare function humanBrief(ctx: AskContext, lang: 'zh' | 'en', kinds?: ("write" | "delete" | "remote-write" | "exec-external" | "never-learn" | "no-rule" | "opaque" | "irreversible" | "script-attached" | "script-unreadable" | "outside-paths" | "model-flagged")[]): string;
 /** The redacted command alone, for the channels that have nowhere else to show it. */
 export declare function humanCommand(ctx: AskContext): string;
 /** What goes on the durable event, for later attribution. */

package/lib/ask-context.js

@@ -124,6 +124,48 @@ function unseenScript(text, root) {
     }
     return text.match(/(?:^|[\s"'`(])\.\.[\/][^\s"']*\.(?:py|mjs|js|sh)\b/i) !== null;
 }
+/**
+ * The statements a script body actually contains, for the deterministic nets.
+ *
+ * Judging a whole file as one string is too coarse: `irreversible.ts` matches a delete
+ * verb, a force flag and a home-variable *anywhere* in the text, and a 300-line build
+ * script is full of all three in unrelated places (`cd "$HOME"` at the top,
+ * `rm -rf ./node_modules` at the bottom). So the body is cut into statements (newline
+ * and `;` are the shell separators) and each is judged on its own.
+ *
+ * But the incident shape is a **block**, and one line of it says nothing:
+ * `for f in ~/.*; do` / `rm -rf "$f"` / `done`, or `if (Test-Path $home) {` on its own
+ * line. So a line that *ends* in a continuation (`do`, `then`, `{`, `&&`, `;`, a
+ * trailing backslash) is joined with the lines it hands off to, up to a small depth.
+ * Joining is keyed on the continuation, not on a fixed window: an arbitrary two-line
+ * window is exactly the collision the split avoids (`cd "$HOME"` followed by
+ * `rm -rf ./build`).
+ *
+ * The cost of an over-match here is a human ask, never a silent deny: this feeds the
+ * `I` tier, which the model cannot clear.
+ */
+const LINE_CONTINUATION = /(?:&\s*&\s*$|\|\s*\|\s*$|;\s*(?:do|then|fi|else)\s*$|[{}]\s*$|;\s*$|\\\s*$|\b(?:do|then|else|begin)\s*$)/;
+function bodyStatements(bodies) {
+    const out = [];
+    for (const body of bodies) {
+        const lines = body.split('\n');
+        for (let i = 0; i < lines.length; i += 1) {
+            let group = lines[i] ?? '';
+            // A block opener swallows the lines it governs (max 3 more), so a loop or an `if`
+            // wrapping a destructive statement is judged as the one act it is.
+            for (let j = 1; j <= 3 && i + j < lines.length && LINE_CONTINUATION.test(group); j += 1) {
+                group = `${group}\n${lines[i + j] ?? ''}`;
+            }
+            for (const stmt of [group, ...group.split(/[;\n]+/)]) {
+                if (stmt.trim() !== '')
+                    out.push(stmt);
+            }
+            // The individual statements of the swallowed lines are still judged separately on
+            // their own turn, so nothing is *only* seen as part of a block.
+        }
+    }
+    return out;
+}
 /** Classify what the call targets, and whether its payload is inspectable. */
 function inspect(source) {
     const text = (source.commandText ?? '').trim();
@@ -132,10 +174,14 @@ function inspect(source) {
     // hiding `Remove-Item -Recurse -Force C:\` is irreversible even though the
     // visible text is opaque, and the human must see both facts.
     const decoded = executableVariants(normalizeCommandText(text));
-    const irreversible = irreversibleReason(cmd) !== undefined
-        || decoded.some((variant) => irreversibleReason(variant) !== undefined);
-    const unlearnable = neverClearReason(cmd) !== undefined
-        || decoded.some((variant) => neverClearReason(variant) !== undefined);
+    // A script run is judged on the file too: `bash ./clean-home.sh` is a filename, the
+    // *body* is the operation. This is the clause that closes the incident the whole
+    // feature exists for — a script that wipes the profile while the command line says
+    // nothing dangerous, judged deterministically so no grader `safe` can clear it.
+    const read = (source.scriptContents ?? []).filter((c) => c.unreadable === undefined && c.body !== '');
+    const judged = [cmd, ...decoded, ...bodyStatements(read.map((c) => `${c.ref}\n${c.body}`))];
+    const irreversible = judged.some((t) => irreversibleReason(t) !== undefined);
+    const unlearnable = judged.some((t) => neverClearReason(t) !== undefined);
     if (cmd.trim() === '{}') {
         // A tool invoked with no arguments at all: nothing to read, nothing to trust.
         return { kind: 'unknown', resolvable: false, readOnly: false, irreversible, unlearnable };
@@ -156,7 +202,12 @@ function inspect(source) {
     })();
     const first = text.split(/\s/)[0] ?? '';
     const runner = /\b(?:python|node|pwsh|powershell|bash|sh|zsh|npx|deno|ruby|perl)\b/i.test(cmd);
-    const execExternal = runner && (outsideWorkspace(cmd, source.workspaceRoot) || unseenScript(cmd, source.workspaceRoot));
+    // "Cannot see the script" is what the U tier existed for. Once every script the call
+    // names has been read and attached, the reviewer *can* see it — so the call stops
+    // being unknowable and becomes an ordinary graded call (whose body the nets have just
+    // judged above). One unreadable file keeps the whole call opaque.
+    const covered = source.scriptsCovered === true && read.length > 0;
+    const execExternal = runner && !covered && (outsideWorkspace(cmd, source.workspaceRoot) || unseenScript(cmd, source.workspaceRoot));
     const unnamed = text !== '' && unnamedOperation(text);
     const opaque = OPAQUE.test(cmd) || execExternal;
     if (irreversible)
@@ -216,18 +267,28 @@ export function buildAskContext(source) {
         reversibility: grade(seen),
     };
 }
+/** Budget for one script body on the wire: a real script, one round-trip. */
+export const GRADER_SCRIPT_BODY_CHARS = 20_000;
 /**
  * Project for egress to the grader. Tier knobs and the rule layer's own verdict
  * are stripped by design — see the module comment.
  */
 export function toGraderPayload(ctx) {
     const root = ctx.workspaceRoot;
+    const scripts = (ctx.scriptContents ?? []).map((c) => ({
+        ref: c.ref,
+        path: c.path,
+        ...(c.unreadable === undefined
+            ? { body: redactCommandText(c.body, { maxChars: GRADER_SCRIPT_BODY_CHARS }), truncated: c.truncated }
+            : { unreadable: c.unreadable }),
+    }));
     return {
         tool: ctx.tool,
         args: redactArgs(ctx.args ?? {}),
         reason: ctx.ruleReason ?? '',
         target_resolvable: ctx.targetResolvable,
         ...(root === undefined || root === '' ? {} : { workspace_root: root }),
+        ...(scripts.length === 0 ? {} : { script_contents: scripts }),
     };
 }
 /**
@@ -285,6 +346,11 @@ export function humanCardLine(ctx, maxFiles = 3) {
         bits.push('payload=opaque');
     if (ctx.unlearnable)
         bits.push('never-learn');
+    const scripts = ctx.scriptContents ?? [];
+    if (scripts.length > 0) {
+        const unread = scripts.filter((c) => c.unreadable !== undefined).length;
+        bits.push(unread === 0 ? `scripts=${scripts.length}:body-attached` : `scripts=${scripts.length}:unread=${unread}`);
+    }
     if (card.fileCount > 0) {
         const shown = card.files.length;
         bits.push(shown < card.fileCount ? `files=${shown}/${card.fileCount}` : `files=${card.fileCount}`);
@@ -334,6 +400,14 @@ export const DOUBT_COPY = {
         zh: '会执行工作区之外的代码，本次调用无法静态看清它做什么',
         en: 'it runs code from outside the workspace, which this call cannot inspect',
     },
+    'script-attached': {
+        zh: '它要跑的脚本正文已读出来、随本次审查附上（模型看到的和你看到的是同一份）',
+        en: 'the script it runs was read and attached to this review — the model and you see the same text',
+    },
+    'script-unreadable': {
+        zh: '脚本正文没读到（缺失/过大/二进制），没有人看见真正要执行的代码',
+        en: 'a script body could not be read (missing, over budget, or binary) — nobody has seen the code that will run',
+    },
     'outside-paths': {
         zh: '涉及工作区之外的路径',
         en: 'it touches paths outside the workspace',
@@ -395,6 +469,16 @@ export function askDoubtKinds(ctx, extra = {}) {
     }
     if (extra.modelFlagged === true)
         kinds.push('model-flagged');
+    // Whether the code that will run was actually looked at is a fact the human decides
+    // with, and it is not implied by any other clause: an attached body means the
+    // judgment covered it, an unreadable one means nothing ever will.
+    const scripts = ctx.scriptContents ?? [];
+    if (scripts.length > 0) {
+        if (scripts.some((c) => c.unreadable !== undefined))
+            kinds.push('script-unreadable');
+        else
+            kinds.push('script-attached');
+    }
     if (ctx.ruleReason !== undefined && /no rule matched|default action/i.test(ctx.ruleReason))
         kinds.push('no-rule');
     const root = ctx.workspaceRoot;