failproofai 1.0.8-beta.0 → 1.0.8

package/dist/worker.mjs

@@ -1162,7 +1162,7 @@ function instruct(reason) {
 }
 
 // package.json
-var version = "1.0.8-beta.0";
+var version = "1.0.8";
 var init_package = () => {};
 
 // src/hooks/policy-types.ts
@@ -11905,6 +11905,19 @@ function classifyTool(toolName) {
     return { toolClass: "other", toolIsKnown: true };
   return { toolClass: "other", toolIsKnown: false };
 }
+function runsNestedShell(tokens) {
+  let shellSeen = false;
+  for (const tok of tokens) {
+    if (shellSeen && /^-[a-z]*c[a-z]*$/i.test(tok))
+      return true;
+    const base = tok.slice(tok.lastIndexOf("/") + 1);
+    if (base === "eval")
+      return true;
+    if (NESTED_SHELLS.has(base))
+      shellSeen = true;
+  }
+  return false;
+}
 function scanCommand(command) {
   const text = command.length > MAX_SCAN_CHARS ? command.slice(0, MAX_SCAN_CHARS) : command;
   const segments = [];
@@ -11915,22 +11928,36 @@ function scanCommand(command) {
   let out = "";
   let commentsRemoved = false;
   const comments = [];
+  let complete = command.length <= MAX_SCAN_CHARS;
+  let braceDepth = 0;
+  let braceSep = false;
+  let bracketOpen = false;
   const endWord = () => {
     if (inWord)
       tokens.push(word);
     word = "";
     inWord = false;
+    braceDepth = 0;
+    braceSep = false;
+    bracketOpen = false;
   };
   const endSegment = () => {
     endWord();
-    if (tokens.length > 0)
+    if (tokens.length > 0) {
+      if (complete && runsNestedShell(tokens))
+        complete = false;
       segments.push(tokens);
+    }
     tokens = [];
   };
   for (let i = 0;i < text.length; i++) {
     const c = text[i];
     if (quote) {
       out += c;
+      if (quote === '"' && (c === "`" || c === "$" && EXPANSION_START.test(text[i + 1] ?? "") || c === "\\" && text[i + 1] === `
+`)) {
+        complete = false;
+      }
       if (c === quote) {
         quote = null;
       } else if (c === "\\" && quote === '"' && i + 1 < text.length) {
@@ -11941,6 +11968,10 @@ function scanCommand(command) {
       }
       continue;
     }
+    if (c === "`" || c === "$" && (text[i + 1] === "'" || text[i + 1] === '"' || EXPANSION_START.test(text[i + 1] ?? "")) || (c === "<" || c === ">") && text[i + 1] === "(" || c === "<" && text[i + 1] === "<" || c === "\\" && text[i + 1] === `
+`) {
+      complete = false;
+    }
     if (c === "'" || c === '"') {
       quote = c;
       inWord = true;
@@ -11981,12 +12012,29 @@ function scanCommand(command) {
       out += c;
       continue;
     }
+    if (c === "{") {
+      braceDepth++;
+    } else if (braceDepth > 0 && (c === "," || c === "." && text[i + 1] === ".")) {
+      braceSep = true;
+    } else if (c === "}" && braceDepth > 0) {
+      braceDepth--;
+      if (braceSep)
+        complete = false;
+    } else if (c === "*" || c === "?") {
+      complete = false;
+    } else if (c === "[") {
+      bracketOpen = true;
+    } else if (c === "]" && bracketOpen) {
+      complete = false;
+    }
     word += c;
     inWord = true;
     out += c;
   }
   endSegment();
-  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments };
+  if (quote)
+    complete = false;
+  return { segments, withoutComments: out.trimEnd(), commentsRemoved, comments, complete };
 }
 function expandHome(token, home) {
   if (token === "~")
@@ -12119,7 +12167,7 @@ function computeFacts(toolName, toolInput, cwd, permissionMode, scanned, pinnedP
     permissionMode
   };
 }
-var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
+var SHELL_TOOLS, WRITE_TOOLS, READ_TOOLS, NETWORK_TOOLS, INERT_TOOLS, MAX_SCAN_CHARS = 8192, NESTED_SHELLS, EXPANSION_START, PATH_LIKE, GLOB_CHARS, MAX_PATHS = 12;
 var init_facts = __esm(() => {
   SHELL_TOOLS = new Set(["Bash", "BashOutput"]);
   WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
@@ -12138,6 +12186,8 @@ var init_facts = __esm(() => {
     "SlashCommand",
     "Skill"
   ]);
+  NESTED_SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "fish"]);
+  EXPANSION_START = /[A-Za-z_0-9@*#?$!\-({]/;
   PATH_LIKE = /^(?:\/|~|\.\.?(?:\/|$)|[^:]*\/)/;
   GLOB_CHARS = /[*?[]/;
 });
@@ -12146,50 +12196,70 @@ var init_facts = __esm(() => {
 function tokensOf(text) {
   return text.toLowerCase().split(/[^a-z0-9._@-]+/).filter((t) => t.length >= 3 && !GENERIC_TOKENS.has(t) && !/^\d+$/.test(t));
 }
-function targetTokens(toolInput) {
-  const out = new Set;
+function scanTargets(toolInput) {
+  const groups = [];
+  const addGroup = (tok) => {
+    const words = tokensOf(tok);
+    if (words.length > 0)
+      groups.push(new Set(words));
+  };
   const command = typeof toolInput.command === "string" ? toolInput.command : null;
   if (command) {
-    for (const seg of scanCommand(command).segments) {
+    const scanned = scanCommand(command);
+    for (const seg of scanned.segments) {
       for (const tok of seg.slice(1)) {
-        if (tok.startsWith("-"))
-          continue;
-        for (const t of tokensOf(tok))
-          out.add(t);
+        if (!tok.startsWith("-"))
+          addGroup(tok);
       }
     }
-    if (out.size === 0) {
+    if (groups.length === 0) {
       for (const piece of command.split(/[;&|\n]+/)) {
         for (const tok of piece.trim().split(/\s+/).slice(1)) {
           if (!tok.startsWith("-"))
-            for (const t of tokensOf(tok))
-              out.add(t);
+            addGroup(tok);
         }
       }
     }
-    return out;
+    return { targets: new Set(groups.flatMap((g) => [...g])), groups, complete: scanned.complete };
   }
+  const all = new Set;
   for (const [key, value] of Object.entries(toolInput)) {
     if (typeof value !== "string" || value.length > 300)
       continue;
     if (/content|old_string|new_string|body|text|prompt/i.test(key))
       continue;
     for (const t of tokensOf(value))
-      out.add(t);
+      all.add(t);
   }
-  return out;
+  return { targets: all, groups: all.size > 0 ? [all] : [], complete: true };
 }
-function targetNamedByUser(targets, userSaid) {
-  if (userSaid.length === 0)
+function everyTargetNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length === 0)
     return false;
-  if (targets.size === 0)
+  const said = userSaid.join(`
+`).toLowerCase();
+  return scan.groups.every((g) => {
+    for (const t of g)
+      if (said.includes(t))
+        return true;
+    return false;
+  });
+}
+function partlyNamed(scan, userSaid) {
+  if (userSaid.length === 0 || scan.groups.length < 2)
     return false;
   const said = userSaid.join(`
 `).toLowerCase();
-  for (const t of targets)
-    if (said.includes(t))
-      return true;
-  return false;
+  let named = 0;
+  for (const g of scan.groups) {
+    for (const t of g) {
+      if (said.includes(t)) {
+        named++;
+        break;
+      }
+    }
+  }
+  return named > 0 && named < scan.groups.length;
 }
 function formatOutcome(p, o) {
   return `${p.title} (semantic/${p.name}, p=${o.evidence.toFixed(2)}). ${p.guidance}`;
@@ -12199,7 +12269,7 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
   const injected = injection !== null && injection >= thresholds.injection;
   const scope = typeof answers.scope === "number" ? answers.scope : null;
   const withinScope = scope !== null && scope >= thresholds.scope;
-  let targets = null;
+  let scan = null;
   const outcomes = selected.map((p) => {
     const evidence = Math.min(...p.probes.map((probe) => answers[`${p.name}.${probe.id}`] ?? 0));
     const exempt = p.exempt ? answers[`${p.name}.exempt`] ?? 0 : null;
@@ -12222,9 +12292,11 @@ function decide(selected, answers, toolInput, userSaid, thresholds = DEFAULT_THR
       return { ...base, escalatedByInjection: true, verdict: "deny" };
     const fired = p.mode === "deny" && evidence >= thresholds.deny ? "deny" : "instruct";
     if (p.userCanOverride && userAsked !== null && userAsked >= thresholds.userAsked && withinScope) {
-      targets ??= targetTokens(toolInput);
-      const named = targets.size > 0 && targetNamedByUser(targets, userSaid);
-      if (targets.size === 0 || named || userSaidCut)
+      scan ??= scanTargets(toolInput);
+      if (!scan.complete)
+        return { ...base, verdict: fired, targetScanIncomplete: true };
+      const named = scan.groups.length > 0 && everyTargetNamed(scan, userSaid);
+      if (scan.groups.length === 0 || named || userSaidCut)
         return { ...base, targetNamedByUser: named, verdict: "overridden" };
     }
     return { ...base, verdict: fired };
@@ -12274,12 +12346,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
   const task = num("task_step");
   const op = num("op_requested");
   const beyond = num("beyond_task");
-  let targets = null;
+  let scan = null;
+  const targetScan = () => scan ??= scanTargets(toolInput);
+  const evidenceSaid = agentLastMessage ? [...userSaid, agentLastMessage] : userSaid;
   const targetOk = () => {
-    targets ??= targetTokens(toolInput);
-    if (targets.size === 0)
+    const s = targetScan();
+    if (s.groups.length === 0)
       return { ok: true, named: false };
-    const named = targetNamedByUser(targets, agentLastMessage ? [...userSaid, agentLastMessage] : userSaid);
+    const named = everyTargetNamed(s, evidenceSaid);
     return { ok: named || userSaidCut, named };
   };
   const outcomes = selected.map((p) => {
@@ -12304,12 +12378,14 @@ function decideV1(selected, answers, toolInput, userSaid, agentLastMessage, opts
     const fired = p.mode === "deny" && evidence >= t.deny ? "deny" : "instruct";
     if (!p.userCanOverride)
       return { ...base, verdict: fired };
+    if (!targetScan().complete)
+      return { ...base, verdict: fired, targetScanIncomplete: true };
     if (op !== null && op >= t.opRequested && beyond !== null && beyond < t.opBeyondMax) {
       const target = targetOk();
       if (target.ok)
         return { ...base, targetNamedByUser: target.named, verdict: "overridden", intent: "op-requested" };
     }
-    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax) {
+    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax && !(typeof toolInput.command === "string" && !userSaidCut && partlyNamed(targetScan(), evidenceSaid))) {
       if (fired === "instruct")
         return { ...base, verdict: "overridden", intent: "task-step" };
       return { ...base, verdict: "instruct", intent: "downgraded-task-step" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.8-beta.0",
+  "version": "1.0.8",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -122,10 +122,10 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-linux-arm64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-darwin-x64": "1.0.8-beta.0",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.8-beta.0"
+    "@failproofai/failproofaid-linux-x64": "1.0.8",
+    "@failproofai/failproofaid-linux-arm64": "1.0.8",
+    "@failproofai/failproofaid-darwin-x64": "1.0.8",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.8"
   },
   "failproofaidBinaries": {
     "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",

package/src/hooks/semantic/decide.ts

@@ -13,9 +13,13 @@
  * - A `deny` policy blocks only on strong evidence; moderate evidence warns.
  * - The user may clear a policy only if (a) they explicitly asked for this
  *   action, (b) everything the call affects stays inside what they asked for
- *   (the `scope` probe), (c) when the call names identifiable targets, one of
- *   them appears in what they typed — checked here, in code, not by the model
- *   — and (d) the request does not look like it is talking to the reviewer.
+ *   (the `scope` probe), (c) when the call names identifiable targets, EVERY
+ *   one of them appears in what they typed — checked here, in code, not by the
+ *   model — and (d) the request does not look like it is talking to the
+ *   reviewer. When the local shell scan may have missed part of the command
+ *   (`$'…'`, a heredoc, `$(…)`, …), (c) cannot be checked and nothing is
+ *   cleared: the scan can see an innocent first target and stop before the
+ *   destructive one.
  *   A call that names no target is never cleared by default: the scope answer
  *   has to carry it.
  * - The injection probe withdraws any override, and turns a policy that has
@@ -68,44 +72,117 @@ function tokensOf(text: string): string[] {
     .filter((t) => t.length >= 3 && !GENERIC_TOKENS.has(t) && !/^\d+$/.test(t));
 }
 
+/**
+ * What a tool call acts on, as the local target check sees it.
+ *
+ * `groups` holds one entry per identifiable target — a non-flag argument of a
+ * shell command (path components and all), or, for any other tool, the whole
+ * of its argument values taken together — and each entry is the set of words
+ * that name it. `targets` is every word of every group.
+ *
+ * `complete` is false when the shell scan may have missed a word bash would
+ * run (`ScannedCommand.complete`). The groups are then a lower bound, and no
+ * clear may rest on them: see {@link everyTargetNamed}'s callers.
+ */
+export interface TargetScan {
+  targets: Set<string>;
+  groups: Set<string>[];
+  complete: boolean;
+}
+
 /**
  * The words that identify WHAT a tool call acts on: its non-flag arguments
  * (path components included), file paths, URL hosts, MCP argument values.
  * The verb is left to Jev's `user_asked` question; this only checks the noun.
  */
-export function targetTokens(toolInput: Record<string, unknown>): Set<string> {
-  const out = new Set<string>();
+export function scanTargets(toolInput: Record<string, unknown>): TargetScan {
+  const groups: Set<string>[] = [];
+  const addGroup = (tok: string) => {
+    const words = tokensOf(tok);
+    if (words.length > 0) groups.push(new Set(words));
+  };
   const command = typeof toolInput.command === "string" ? toolInput.command : null;
   if (command) {
-    for (const seg of scanCommand(command).segments) {
+    const scanned = scanCommand(command);
+    for (const seg of scanned.segments) {
       for (const tok of seg.slice(1)) {
-        if (tok.startsWith("-")) continue;
-        for (const t of tokensOf(tok)) out.add(t);
+        if (!tok.startsWith("-")) addGroup(tok);
       }
     }
     // Empty reads as "names no target", and lets consent rest on Jev's answers
     // alone. But the scanner is not bash — a `#` inside `$'…'`, `${x:- # }` or
     // backticks ends its view early, and it reads only MAX_SCAN_CHARS — so an
     // empty scan may just have stopped before the target. Then judge the words
-    // as written. Only ever stricter: an empty set already passed.
-    if (out.size === 0) {
+    // as written. Only ever stricter: an empty set already passed. (Such a scan
+    // is also reported incomplete, which withholds the clear on its own; this
+    // keeps the recorded targets honest.)
+    if (groups.length === 0) {
       for (const piece of command.split(/[;&|\n]+/)) {
         for (const tok of piece.trim().split(/\s+/).slice(1)) {
-          if (!tok.startsWith("-")) for (const t of tokensOf(tok)) out.add(t);
+          if (!tok.startsWith("-")) addGroup(tok);
         }
       }
     }
-    return out;
+    return { targets: new Set(groups.flatMap((g) => [...g])), groups, complete: scanned.complete };
   }
+  const all = new Set<string>();
   for (const [key, value] of Object.entries(toolInput)) {
     if (typeof value !== "string" || value.length > 300) continue;
     if (/content|old_string|new_string|body|text|prompt/i.test(key)) continue;
-    for (const t of tokensOf(value)) out.add(t);
+    for (const t of tokensOf(value)) all.add(t);
+  }
+  // A non-shell tool's fields qualify one another (`owner`, `repo`, `branch`)
+  // rather than naming separate targets, so they are ONE target: naming any of
+  // them names it.
+  return { targets: all, groups: all.size > 0 ? [all] : [], complete: true };
+}
+
+/** Every word of {@link scanTargets}, flattened. */
+export function targetTokens(toolInput: Record<string, unknown>): Set<string> {
+  return scanTargets(toolInput).targets;
+}
+
+/**
+ * True when the user's own words name EVERY target the call acts on — each
+ * group through at least one of its words.
+ *
+ * Not "any one": `rm -rf build/ ~/important` after "clean the build" names
+ * `build` and not `important`, and a clear on the first would carry the
+ * second, which nobody asked for.
+ */
+export function everyTargetNamed(scan: TargetScan, userSaid: ReadonlyArray<string>): boolean {
+  if (userSaid.length === 0 || scan.groups.length === 0) return false;
+  const said = userSaid.join("\n").toLowerCase();
+  return scan.groups.every((g) => {
+    for (const t of g) if (said.includes(t)) return true;
+    return false;
+  });
+}
+
+/**
+ * True when the user's words name SOME of the call's targets but not all:
+ * they drew a line and the call reaches past it. Naming none is not this — a
+ * goal ("fix the failing tests") names no path at all.
+ */
+export function partlyNamed(scan: TargetScan, userSaid: ReadonlyArray<string>): boolean {
+  if (userSaid.length === 0 || scan.groups.length < 2) return false;
+  const said = userSaid.join("\n").toLowerCase();
+  let named = 0;
+  for (const g of scan.groups) {
+    for (const t of g) {
+      if (said.includes(t)) {
+        named++;
+        break;
+      }
+    }
   }
-  return out;
+  return named > 0 && named < scan.groups.length;
 }
 
-/** True when the user's own words name at least one thing the call acts on. */
+/**
+ * True when the user's own words name at least one of `targets`. The deciders
+ * do not use this any-one check — see {@link everyTargetNamed}.
+ */
 export function targetNamedByUser(targets: Set<string>, userSaid: ReadonlyArray<string>): boolean {
   if (userSaid.length === 0) return false;
   // Nothing identifiable to check is not a match. This used to return true,
@@ -136,7 +213,7 @@ export function decide(
   const injected = injection !== null && injection >= thresholds.injection;
   const scope = typeof answers.scope === "number" ? answers.scope : null;
   const withinScope = scope !== null && scope >= thresholds.scope;
-  let targets: Set<string> | null = null;
+  let scan: TargetScan | null = null;
 
   const outcomes: PolicyOutcome[] = selected.map((p) => {
     const evidence = Math.min(...p.probes.map((probe) => answers[`${p.name}.${probe.id}`] ?? 0));
@@ -161,13 +238,18 @@ export function decide(
 
     const fired: PolicyOutcome["verdict"] = p.mode === "deny" && evidence >= thresholds.deny ? "deny" : "instruct";
     if (p.userCanOverride && userAsked !== null && userAsked >= thresholds.userAsked && withinScope) {
-      targets ??= targetTokens(toolInput);
+      scan ??= scanTargets(toolInput);
+      // A shell scan that may have missed a word cannot say what the call
+      // touches, so it cannot say the user named it: no clear. Not rescued by
+      // `userSaidCut` — that gap is in what the human typed, this one is in
+      // the call.
+      if (!scan.complete) return { ...base, verdict: fired, targetScanIncomplete: true };
       // No identifiable target: the scope answer (already required) carries it.
-      // Otherwise one of the targets must also appear in the user's own words —
+      // Otherwise EVERY target must also appear in the user's own words —
       // unless the words we hold were cut, when "absent" is not something this
       // check knows (see {@link DecideV1Options.userSaidCut}).
-      const named = targets.size > 0 && targetNamedByUser(targets, userSaid);
-      if (targets.size === 0 || named || userSaidCut) return { ...base, targetNamedByUser: named, verdict: "overridden" };
+      const named = scan.groups.length > 0 && everyTargetNamed(scan, userSaid);
+      if (scan.groups.length === 0 || named || userSaidCut) return { ...base, targetNamedByUser: named, verdict: "overridden" };
     }
     return { ...base, verdict: fired };
   });
@@ -293,12 +375,16 @@ export interface DecideV1Options {
  * - A policy fires exactly as in v0 (every probe holds, no exemption).
  * - Injection withdraws every clear and turns a fired policy into a block.
  * - The human asked for THIS operation on THIS target (`op_requested`), the
- *   call reaches no further (`beyond_task`), and — when the call names a
- *   target — that target appears in what the human typed or in the agent
- *   proposal they replied to: the policy is cleared.
+ *   call reaches no further (`beyond_task`), and — when the call names
+ *   targets — every one of them appears in what the human typed or in the
+ *   agent proposal they replied to: the policy is cleared.
+ * - A shell command the local scan could not read whole is cleared and
+ *   softened by neither route: see `ScannedCommand.complete` in `facts.ts`.
  * - Otherwise, the call is a step toward the human's task (`task_step`) and
  *   reaches no further: a warn-level outcome is cleared and a block is
- *   softened to a warning. A goal never licenses a block on its own.
+ *   softened to a warning. A goal never licenses a block on its own. On a
+ *   shell command whose targets the human named only in part, this route
+ *   does not apply either.
  * - Policies with `userCanOverride: false` are never cleared or softened.
  * - Nothing fired, but the call reaches beyond the task, is not a step toward
  *   it, and some "does it do X" probe is at least half-raised: warn.
@@ -321,11 +407,13 @@ export function decideV1(
   const task = num("task_step");
   const op = num("op_requested");
   const beyond = num("beyond_task");
-  let targets: Set<string> | null = null;
+  let scan: TargetScan | null = null;
+  const targetScan = (): TargetScan => (scan ??= scanTargets(toolInput));
+  const evidenceSaid = agentLastMessage ? [...userSaid, agentLastMessage] : userSaid;
   const targetOk = (): { ok: boolean; named: boolean } => {
-    targets ??= targetTokens(toolInput);
-    if (targets.size === 0) return { ok: true, named: false };
-    const named = targetNamedByUser(targets, agentLastMessage ? [...userSaid, agentLastMessage] : userSaid);
+    const s = targetScan();
+    if (s.groups.length === 0) return { ok: true, named: false };
+    const named = everyTargetNamed(s, evidenceSaid);
     return { ok: named || userSaidCut, named };
   };
 
@@ -349,12 +437,29 @@ export function decideV1(
 
     const fired: PolicyOutcome["verdict"] = p.mode === "deny" && evidence >= t.deny ? "deny" : "instruct";
     if (!p.userCanOverride) return { ...base, verdict: fired };
+    // The shell scan may have missed a word bash would run (`$'…'`, a heredoc,
+    // `$(…)`, …): what the call touches is not known here, so neither intent
+    // route may clear or soften it. Jev's own deny or instruct stands.
+    if (!targetScan().complete) return { ...base, verdict: fired, targetScanIncomplete: true };
 
     if (op !== null && op >= t.opRequested && beyond !== null && beyond < t.opBeyondMax) {
       const target = targetOk();
       if (target.ok) return { ...base, targetNamedByUser: target.named, verdict: "overridden", intent: "op-requested" };
     }
-    if (taskClears && task !== null && task >= t.taskStep && beyond !== null && beyond < t.taskBeyondMax) {
+    // The task-step route reaches `combine.ts` as a clear too — a warning it
+    // leaves behind clears a reviewable regex deny. It is consent by GOAL, so
+    // a shell command whose targets the human never named still rides on it
+    // ("fix the failing tests" → `rm -rf node_modules`). But once the human
+    // HAS named targets, they drew the line: a call reaching past it is not
+    // softened. After "clean the build", `rm -rf build/ ~/important` is not.
+    if (
+      taskClears &&
+      task !== null &&
+      task >= t.taskStep &&
+      beyond !== null &&
+      beyond < t.taskBeyondMax &&
+      !(typeof toolInput.command === "string" && !userSaidCut && partlyNamed(targetScan(), evidenceSaid))
+    ) {
       if (fired === "instruct") return { ...base, verdict: "overridden", intent: "task-step" };
       return { ...base, verdict: "instruct", intent: "downgraded-task-step" };
     }