muonroi-cli 1.7.2 → 1.8.0

package/dist/src/usage/estimator.js

@@ -13,6 +13,28 @@ import { lookupPricing } from "../providers/pricing.js";
 export function estimateTokensFromChars(chars) {
     return Math.ceil(chars / 4);
 }
+/**
+ * Sanitize an actual input-token count by comparing it to the estimated
+ * (chars/4) count. Some providers (SiliconFlow, possibly others) return
+ * implausibly low `prompt_tokens` (e.g. 10) regardless of actual prompt size,
+ * which under-reports cost and inflates apparent cache-hit ratios.
+ *
+ * Rules:
+ *   - When `actual === undefined`: return `estimated` (no data = use estimate).
+ *   - When `actual === 0`: return 0 (preserve mock / failed-call semantics).
+ *   - When `estimated > 0` and `actual < estimated * 0.1`: the value is likely
+ *     bogus — return `estimated` so cost projections stay accurate.
+ *   - Otherwise: return `actual` as-is.
+ */
+export function sanitizeInputTokens(actual, estimated) {
+    if (actual === undefined)
+        return estimated;
+    if (actual === 0)
+        return 0;
+    if (estimated > 0 && actual < estimated * 0.1)
+        return estimated;
+    return actual;
+}
 /**
  * Project the USD cost of a request given token estimates and the static pricing table.
  * Returns 0 for unknown provider/model -- caller decides how to handle (ledger treats as 0 risk).

package/dist/src/utils/__tests__/compaction-caps.test.d.ts

@@ -0,0 +1,21 @@
+/**
+ * src/utils/__tests__/compaction-caps.test.ts
+ *
+ * G4 regression guard for the token-thrift compaction caps.
+ *
+ * The compaction caps themselves are wired correctly (cost-leak-b3/b4 specs
+ * cover the algorithm; the *-tui specs cover the live wiring). The hole this
+ * file closes is DRIFT: nothing pinned the PRODUCTION DEFAULT knob values, and
+ * the fast cost-leak specs drive `compactSubAgentMessages` with HARDCODED
+ * options (thresholdChars: 60_000, keepLastTurns: 1) that are decoupled from
+ * the real getters. So a regression that widens a default (e.g. reverting the
+ * Phase C5 40_000 back to 200_000, or fat-fingering a clamp range) would sail
+ * past the entire fast suite and only be caught by the slow ~30-120s TUI specs.
+ *
+ * Part 1 pins each getter's documented contract (default / clamp / honor).
+ * Part 2 feeds the REAL getter outputs into the compactor over a synthetic
+ * load sized BETWEEN the default threshold and a plausible widened drift, so a
+ * default-value regression fails behaviourally too — not just at the value
+ * assertion.
+ */
+export {};

package/dist/src/utils/__tests__/compaction-caps.test.js

@@ -0,0 +1,187 @@
+/**
+ * src/utils/__tests__/compaction-caps.test.ts
+ *
+ * G4 regression guard for the token-thrift compaction caps.
+ *
+ * The compaction caps themselves are wired correctly (cost-leak-b3/b4 specs
+ * cover the algorithm; the *-tui specs cover the live wiring). The hole this
+ * file closes is DRIFT: nothing pinned the PRODUCTION DEFAULT knob values, and
+ * the fast cost-leak specs drive `compactSubAgentMessages` with HARDCODED
+ * options (thresholdChars: 60_000, keepLastTurns: 1) that are decoupled from
+ * the real getters. So a regression that widens a default (e.g. reverting the
+ * Phase C5 40_000 back to 200_000, or fat-fingering a clamp range) would sail
+ * past the entire fast suite and only be caught by the slow ~30-120s TUI specs.
+ *
+ * Part 1 pins each getter's documented contract (default / clamp / honor).
+ * Part 2 feeds the REAL getter outputs into the compactor over a synthetic
+ * load sized BETWEEN the default threshold and a plausible widened drift, so a
+ * default-value regression fails behaviourally too — not just at the value
+ * assertion.
+ */
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { compactSubAgentMessages, cumulativeMessageChars } from "../../orchestrator/subagent-compactor.js";
+import { getSubAgentBudgetChars, getSubAgentCompactKeepLast, getSubAgentCompactThresholdChars, getTopLevelCompactKeepLast, getTopLevelCompactThresholdChars, getTopLevelToolBudgetChars, loadUserSettings, } from "../settings.js";
+const ENV_KEYS = [
+    "MUONROI_SUB_AGENT_BUDGET_CHARS",
+    "MUONROI_SUBAGENT_COMPACT_THRESHOLD_CHARS",
+    "MUONROI_SUBAGENT_COMPACT_KEEP_LAST",
+    "MUONROI_TOP_LEVEL_COMPACT_THRESHOLD_CHARS",
+    "MUONROI_TOP_LEVEL_COMPACT_KEEP_LAST",
+    "MUONROI_TOP_LEVEL_TOOL_BUDGET_CHARS",
+];
+const saved = {};
+beforeEach(() => {
+    for (const k of ENV_KEYS) {
+        saved[k] = process.env[k];
+        delete process.env[k];
+    }
+});
+afterEach(() => {
+    for (const k of ENV_KEYS) {
+        if (saved[k] === undefined)
+            delete process.env[k];
+        else
+            process.env[k] = saved[k];
+    }
+});
+describe("compaction cap getters — production contract (G4 drift guard)", () => {
+    describe("compact thresholds & keepLast (Phase C5 defaults — no user-settings layer)", () => {
+        it("return the documented defaults when env is unset", () => {
+            expect(getSubAgentCompactThresholdChars()).toBe(40_000);
+            expect(getSubAgentCompactKeepLast()).toBe(3);
+            expect(getTopLevelCompactThresholdChars()).toBe(100_000);
+            expect(getTopLevelCompactKeepLast()).toBe(5);
+        });
+        it("clamp out-of-range env back to the default", () => {
+            process.env.MUONROI_SUBAGENT_COMPACT_THRESHOLD_CHARS = "999999999"; // > 500_000
+            expect(getSubAgentCompactThresholdChars()).toBe(40_000);
+            process.env.MUONROI_SUBAGENT_COMPACT_THRESHOLD_CHARS = "1000"; // < 20_000
+            expect(getSubAgentCompactThresholdChars()).toBe(40_000);
+            process.env.MUONROI_SUBAGENT_COMPACT_KEEP_LAST = "0"; // < 1
+            expect(getSubAgentCompactKeepLast()).toBe(3);
+            process.env.MUONROI_SUBAGENT_COMPACT_KEEP_LAST = "99"; // > 20
+            expect(getSubAgentCompactKeepLast()).toBe(3);
+            process.env.MUONROI_TOP_LEVEL_COMPACT_THRESHOLD_CHARS = "10000"; // < 50_000
+            expect(getTopLevelCompactThresholdChars()).toBe(100_000);
+            process.env.MUONROI_TOP_LEVEL_COMPACT_KEEP_LAST = "99"; // > 30
+            expect(getTopLevelCompactKeepLast()).toBe(5);
+        });
+        it("honor valid in-range env overrides", () => {
+            process.env.MUONROI_SUBAGENT_COMPACT_THRESHOLD_CHARS = "60000";
+            expect(getSubAgentCompactThresholdChars()).toBe(60_000);
+            process.env.MUONROI_SUBAGENT_COMPACT_KEEP_LAST = "5";
+            expect(getSubAgentCompactKeepLast()).toBe(5);
+            process.env.MUONROI_TOP_LEVEL_COMPACT_THRESHOLD_CHARS = "250000";
+            expect(getTopLevelCompactThresholdChars()).toBe(250_000);
+            process.env.MUONROI_TOP_LEVEL_COMPACT_KEEP_LAST = "8";
+            expect(getTopLevelCompactKeepLast()).toBe(8);
+        });
+    });
+    describe("budget getters (env override → user-settings → default)", () => {
+        it("getSubAgentBudgetChars: default 120_000 when env unset and no user override", () => {
+            // Deterministic on a clean checkout / CI (no user-settings.json). When a
+            // dev machine HAS an explicit override the getter must honor it instead —
+            // the default-drift case is what CI guards.
+            const override = loadUserSettings().subAgentBudgetChars;
+            if (typeof override === "number" && override >= 20_000 && override <= 600_000) {
+                expect(getSubAgentBudgetChars()).toBe(Math.floor(override));
+            }
+            else {
+                expect(getSubAgentBudgetChars()).toBe(120_000);
+            }
+        });
+        it("getTopLevelToolBudgetChars: default 200_000 when env unset and no user override", () => {
+            const override = loadUserSettings().topLevelToolBudgetChars;
+            if (typeof override === "number" && override >= 50_000 && override <= 1_500_000) {
+                expect(getTopLevelToolBudgetChars()).toBe(Math.floor(override));
+            }
+            else {
+                expect(getTopLevelToolBudgetChars()).toBe(200_000);
+            }
+        });
+        it("honor valid in-range env overrides (env short-circuits user-settings)", () => {
+            process.env.MUONROI_SUB_AGENT_BUDGET_CHARS = "300000";
+            expect(getSubAgentBudgetChars()).toBe(300_000);
+            process.env.MUONROI_TOP_LEVEL_TOOL_BUDGET_CHARS = "800000";
+            expect(getTopLevelToolBudgetChars()).toBe(800_000);
+        });
+        it("reject out-of-range env (result stays within the documented range)", () => {
+            process.env.MUONROI_SUB_AGENT_BUDGET_CHARS = "999999999"; // > 600_000
+            const sub = getSubAgentBudgetChars();
+            expect(sub).not.toBe(999_999_999);
+            expect(sub).toBeGreaterThanOrEqual(20_000);
+            expect(sub).toBeLessThanOrEqual(600_000);
+            process.env.MUONROI_TOP_LEVEL_TOOL_BUDGET_CHARS = "1000"; // < 50_000
+            const top = getTopLevelToolBudgetChars();
+            expect(top).not.toBe(1000);
+            expect(top).toBeGreaterThanOrEqual(50_000);
+            expect(top).toBeLessThanOrEqual(1_500_000);
+        });
+    });
+});
+/**
+ * Build N tool turns (assistant tool-call + tool result), each result
+ * `resultChars` long, using a tool name that is NOT high-value (so the
+ * compactor is allowed to elide it). Mirrors the cost-leak-b3 message shape.
+ */
+function buildToolTurns(n, resultChars) {
+    const msgs = [
+        { role: "system", content: "You are the Explore sub-agent." },
+        { role: "user", content: "trace auth wiring" },
+    ];
+    for (let i = 0; i < n; i++) {
+        const id = `c${i}`;
+        msgs.push({
+            role: "assistant",
+            content: [{ type: "tool-call", toolCallId: id, toolName: "fake_read", input: { path: `/tmp/${id}.txt` } }],
+        });
+        msgs.push({
+            role: "tool",
+            content: [
+                {
+                    type: "tool-result",
+                    toolCallId: id,
+                    toolName: "fake_read",
+                    output: { type: "text", value: "x".repeat(resultChars) },
+                },
+            ],
+        });
+    }
+    return msgs;
+}
+describe("compaction fires with the REAL default getter values (G4 behavioural guard)", () => {
+    // Load sized BETWEEN the default thresholds (40K sub / 100K top) and a
+    // plausible widened drift (200K). So: with the real defaults it compacts;
+    // if a default were reverted to 200_000 the load would fall below threshold
+    // and these assertions would fail — catching drift behaviourally.
+    it("sub-agent: default threshold (40K) elides older tool results on a ~120K load", () => {
+        const messages = buildToolTurns(6, 20_000); // ~120K cumulative, 6 tool turns
+        const cumulative = cumulativeMessageChars(messages);
+        expect(cumulative).toBeGreaterThan(40_000);
+        expect(cumulative).toBeLessThan(200_000);
+        const compacted = compactSubAgentMessages(messages, {
+            thresholdChars: getSubAgentCompactThresholdChars(),
+            keepLastTurns: getSubAgentCompactKeepLast(),
+        });
+        expect(compacted).not.toBe(messages); // identity differs → compaction happened
+        const before = JSON.stringify(messages).length;
+        const after = JSON.stringify(compacted).length;
+        expect(after).toBeLessThan(before);
+        expect(JSON.stringify(compacted)).toContain("elided by sub-agent compactor");
+    });
+    it("top-level: default threshold (100K) elides older tool results on a ~160K load", () => {
+        const messages = buildToolTurns(8, 20_000); // ~160K cumulative, 8 tool turns
+        const cumulative = cumulativeMessageChars(messages);
+        expect(cumulative).toBeGreaterThan(100_000);
+        expect(cumulative).toBeLessThan(200_000);
+        const compacted = compactSubAgentMessages(messages, {
+            thresholdChars: getTopLevelCompactThresholdChars(),
+            keepLastTurns: getTopLevelCompactKeepLast(),
+            label: "top-level",
+        });
+        expect(compacted).not.toBe(messages);
+        expect(JSON.stringify(compacted).length).toBeLessThan(JSON.stringify(messages).length);
+        expect(JSON.stringify(compacted)).toContain("elided by top-level compactor");
+    });
+});
+//# sourceMappingURL=compaction-caps.test.js.map

package/dist/src/utils/__tests__/llm-deadline-abort.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/utils/__tests__/llm-deadline-abort.test.js

@@ -0,0 +1,33 @@
+/**
+ * withDeadlineRace abort-grace: a provider that ignores its abortSignal mid-call
+ * must not keep the caller blocked until the (minutes-long) wall-clock deadline.
+ * When the user-abort signal fires, the race rejects within a short grace window.
+ */
+import { describe, expect, it } from "vitest";
+import { withDeadlineRace } from "../llm-deadline.js";
+describe("withDeadlineRace — abort grace", () => {
+    it("rejects shortly after abort even when fn() never settles", async () => {
+        const ac = new AbortController();
+        const neverSettles = () => new Promise(() => { }); // simulates a stalled provider
+        const start = Date.now();
+        setTimeout(() => ac.abort(new Error("user pressed Esc")), 40);
+        await expect(withDeadlineRace(neverSettles, 60_000, "test", ac.signal, 80)).rejects.toThrow(/aborted by user/);
+        // Must unblock far before the 60s deadline.
+        expect(Date.now() - start).toBeLessThan(2_000);
+    });
+    it("rejects immediately when the signal is already aborted", async () => {
+        const ac = new AbortController();
+        ac.abort(new Error("already cancelled"));
+        const neverSettles = () => new Promise(() => { });
+        await expect(withDeadlineRace(neverSettles, 60_000, "test", ac.signal, 50)).rejects.toThrow(/aborted by user/);
+    });
+    it("returns the fn() result when it settles before any abort", async () => {
+        const ac = new AbortController();
+        await expect(withDeadlineRace(() => Promise.resolve("ok"), 60_000, "test", ac.signal, 80)).resolves.toBe("ok");
+    });
+    it("still enforces the wall-clock deadline when no signal is passed (back-compat)", async () => {
+        const neverSettles = () => new Promise(() => { });
+        await expect(withDeadlineRace(neverSettles, 60, "test")).rejects.toThrow(/deadline/);
+    });
+});
+//# sourceMappingURL=llm-deadline-abort.test.js.map

package/dist/src/utils/clipboard-image.js

@@ -25,24 +25,24 @@ function readWin32() {
     try {
         const escaped = tmpFile.replace(/\\/g, "\\\\");
         // Run in STA thread with retry — clipboard can be locked by other processes
-        const ps = `
-      Add-Type -AssemblyName System.Windows.Forms
-      Add-Type -AssemblyName System.Drawing
-      $maxRetries = 3
-      $img = $null
-      for ($i = 0; $i -lt $maxRetries; $i++) {
-        try {
-          $img = [System.Windows.Forms.Clipboard]::GetImage()
-          if ($img -ne $null) { break }
-        } catch {
-          # clipboard locked — wait and retry
-        }
-        Start-Sleep -Milliseconds 100
-      }
-      if ($img -ne $null) {
-        $img.Save('${escaped}', [System.Drawing.Imaging.ImageFormat]::Png)
-        $img.Dispose()
-      }
+        const ps = `
+      Add-Type -AssemblyName System.Windows.Forms
+      Add-Type -AssemblyName System.Drawing
+      $maxRetries = 3
+      $img = $null
+      for ($i = 0; $i -lt $maxRetries; $i++) {
+        try {
+          $img = [System.Windows.Forms.Clipboard]::GetImage()
+          if ($img -ne $null) { break }
+        } catch {
+          # clipboard locked — wait and retry
+        }
+        Start-Sleep -Milliseconds 100
+      }
+      if ($img -ne $null) {
+        $img.Save('${escaped}', [System.Drawing.Imaging.ImageFormat]::Png)
+        $img.Dispose()
+      }
     `;
         const result = spawnSync("powershell", ["-NoProfile", "-STA", "-Command", ps], { timeout: 8000 });
         if (result.error || result.status !== 0)
@@ -81,11 +81,11 @@ function readDarwin() {
         const pngpaste = spawnSync("pngpaste", [tmpFile], { timeout: 5000 });
         if (pngpaste.status !== 0) {
             spawnSync("screencapture", ["-c", "-x"]);
-            const osascript = `
-        set imgData to the clipboard as «class PNGf»
-        set f to open for access POSIX file "${tmpFile}" with write permission
-        write imgData to f
-        close access f
+            const osascript = `
+        set imgData to the clipboard as «class PNGf»
+        set f to open for access POSIX file "${tmpFile}" with write permission
+        write imgData to f
+        close access f
       `;
             spawnSync("osascript", ["-e", osascript], { timeout: 5000 });
         }

package/dist/src/utils/llm-deadline.d.ts

@@ -41,4 +41,12 @@ export declare function withTimeoutSignal(parent: AbortSignal | undefined, timeo
  * still be aborted via `withTimeoutSignal` for cleanup; this layer just ensures
  * the caller is never blocked past the deadline.
  */
-export declare function withDeadlineRace<T>(fn: () => Promise<T>, deadlineMs: number, label: string): Promise<T>;
+export declare function withDeadlineRace<T>(fn: () => Promise<T>, deadlineMs: number, label: string, 
+/**
+ * User-abort signal. When it fires, the race rejects within `abortGraceMs`
+ * even if `fn()` hasn't settled — so a provider that ignores its abortSignal
+ * mid-call (observed with DeepSeek/grok socket stalls) can't keep the caller
+ * (and, for council, the locked composer) blocked until the full `deadlineMs`.
+ * The short grace lets the normal fetch-level abort win first when it's quick.
+ */
+abortSignal?: AbortSignal, abortGraceMs?: number): Promise<T>;

package/dist/src/utils/llm-deadline.js

@@ -62,19 +62,48 @@ export function withTimeoutSignal(parent, timeoutMs) {
  * still be aborted via `withTimeoutSignal` for cleanup; this layer just ensures
  * the caller is never blocked past the deadline.
  */
-export async function withDeadlineRace(fn, deadlineMs, label) {
+export async function withDeadlineRace(fn, deadlineMs, label, 
+/**
+ * User-abort signal. When it fires, the race rejects within `abortGraceMs`
+ * even if `fn()` hasn't settled — so a provider that ignores its abortSignal
+ * mid-call (observed with DeepSeek/grok socket stalls) can't keep the caller
+ * (and, for council, the locked composer) blocked until the full `deadlineMs`.
+ * The short grace lets the normal fetch-level abort win first when it's quick.
+ */
+abortSignal, abortGraceMs = 1500) {
     let timer = null;
+    let abortTimer = null;
+    let abortListener = null;
     const deadline = new Promise((_, reject) => {
         timer = setTimeout(() => {
             reject(new Error(`${label} exceeded ${deadlineMs}ms deadline (timeout)`));
         }, deadlineMs);
     });
+    const racers = [fn(), deadline];
+    if (abortSignal) {
+        const abortRace = new Promise((_, reject) => {
+            const arm = () => {
+                abortTimer = setTimeout(() => reject(new Error(`${label} aborted by user`)), abortGraceMs);
+            };
+            if (abortSignal.aborted)
+                arm();
+            else {
+                abortListener = arm;
+                abortSignal.addEventListener("abort", arm, { once: true });
+            }
+        });
+        racers.push(abortRace);
+    }
     try {
-        return await Promise.race([fn(), deadline]);
+        return await Promise.race(racers);
     }
     finally {
         if (timer)
             clearTimeout(timer);
+        if (abortTimer)
+            clearTimeout(abortTimer);
+        if (abortListener && abortSignal)
+            abortSignal.removeEventListener("abort", abortListener);
     }
 }
 //# sourceMappingURL=llm-deadline.js.map

package/dist/src/utils/permission-mode.d.ts

@@ -5,6 +5,39 @@ export type PermissionMode = "safe" | "auto-edit" | "yolo";
  * without manual confirmation when the user has opted into auto-edit mode.
  */
 export declare const AUTO_EDIT_ALLOWED: ReadonlySet<string>;
+/**
+ * Structured block result returned by safety checks.
+ * `null` means the command is safe to proceed.
+ */
+export interface SafetyBlockResult {
+    /** Machine-readable kind for routing to the right askcard layout. */
+    kind: "catastrophic" | "dangerous" | "git-safety" | "empty-bash";
+    /** Human-readable reason explaining why it was blocked. */
+    reason: string;
+    /** The original command text that was blocked. */
+    command: string;
+}
+/**
+ * Returns a SafetyBlockResult if `command` matches a catastrophic
+ * pattern, or `null` if the command is safe to proceed.
+ *
+ * This is checked at the tool layer (BashTool.prepareCommand) and is
+ * independent of the UI-layer permission approval system — it applies even
+ * in yolo mode.
+ */
+export declare function checkCatastrophicCommand(command: string): SafetyBlockResult | null;
+/**
+ * Check a command against the "dangerous" patterns used by `toolNeedsApproval`.
+ * These are less severe than catastrophic but should still prompt for approval
+ * in safe / auto-edit modes.
+ *
+ * Returns a SafetyBlockResult or null if safe.
+ */
+export declare function checkDangerousCommand(command: string): SafetyBlockResult | null;
+/**
+ * Check if a command is a safety-blocked git operation (push-on-red, broad staging).
+ */
+export declare function checkGitSafetyCommand(command: string, gitSafetyKey: string): SafetyBlockResult | null;
 /**
  * Returns true if the given tool call requires manual user approval
  * under the specified permission mode.

package/dist/src/utils/permission-mode.js

@@ -19,6 +19,159 @@ export const AUTO_EDIT_ALLOWED = new Set([
     "grep",
     "list_directory",
 ]);
+/**
+ * Catastrophic commands: unrecoverable operations that are ALWAYS hard-blocked
+ * at the tool layer regardless of permission mode (safe/auto-edit/yolo).
+ *
+ * These are patterns where the potential for irreversible damage to the host
+ * system is high enough that no user approval dialog is sufficient — they must
+ * never execute. This list intentionally errs on the side of caution.
+ *
+ * Override: set MUONROI_ALLOW_CATASTROPHIC=1 to bypass (not recommended;
+ * intended only for explicit test harness scenarios).
+ */
+const CATASTROPHIC_PATTERNS = [
+    // Disk / filesystem destruction
+    {
+        pattern: /\bdd\b[^|&;\n]*\bof=\/dev\//i,
+        reason: "dd writing to a raw device can destroy disk contents irreversibly.",
+    },
+    {
+        pattern: /\bmkfs\b/i,
+        reason: "mkfs formats a filesystem, destroying all data on the target device.",
+    },
+    // Fork bomb — classic bash pattern: :(){ :|:& };:
+    // Match the defining signature: a function named `:` that calls itself recursively.
+    // This is tight enough to avoid false positives on URLs containing `:/`.
+    {
+        pattern: /:\s*\(\s*\)\s*\{[^}]*:\s*\|\s*:/,
+        reason: "Fork bomb pattern detected — would exhaust host process table.",
+    },
+    // Remote code execution via piped shell
+    {
+        pattern: /\bcurl\b[^|&;\n]*\|\s*(?:ba)?sh\b/i,
+        reason: "curl piped to a shell executes arbitrary remote code without inspection.",
+    },
+    {
+        pattern: /\bwget\b[^|&;\n]*\|\s*(?:ba)?sh\b/i,
+        reason: "wget piped to a shell executes arbitrary remote code without inspection.",
+    },
+    // Privilege escalation
+    {
+        pattern: /\bsudo\s+/i,
+        reason: "sudo privilege escalation is not permitted from the agent shell.",
+    },
+    {
+        pattern: /\bsu\s+-\s*/i,
+        reason: "su to root is not permitted from the agent shell.",
+    },
+    // Persistence mechanisms — block crontab edits/writes; allow only -l (list, read-only)
+    // crontab <file>, crontab -, crontab -e all create/modify the crontab.
+    {
+        pattern: /\bcrontab\b(?!\s+-l\b)/i,
+        reason: "crontab write/edit commands create persistent execution outside the session.",
+    },
+    {
+        pattern: /\/etc\/(?:rc\.d|init\.d|systemd|cron)/i,
+        reason: "Writing to system init or cron directories would create persistence.",
+    },
+    // Reverse shells
+    {
+        pattern: /\bnc\b[^|&;\n]*(?:-e|-c)\s+/i,
+        reason: "nc with -e/-c flag can open a reverse shell.",
+    },
+    {
+        pattern: /\bsocat\b[^|&;\n]*(?:EXEC|SYSTEM):/i,
+        reason: "socat with EXEC/SYSTEM can open a reverse shell.",
+    },
+    {
+        pattern: /\/dev\/tcp\//i,
+        reason: "Bash /dev/tcp redirect can open a covert reverse shell connection.",
+    },
+    // Exfiltration of credentials / secrets directories
+    {
+        pattern: /(?:tar|zip|gzip|rsync|scp|sftp|ftp)\b[^|&;\n]*\.(?:muonroi-cli|ssh|gnupg|aws|kube)/i,
+        reason: "Archiving or uploading credential directories is not permitted.",
+    },
+];
+/**
+ * Returns a SafetyBlockResult if `command` matches a catastrophic
+ * pattern, or `null` if the command is safe to proceed.
+ *
+ * This is checked at the tool layer (BashTool.prepareCommand) and is
+ * independent of the UI-layer permission approval system — it applies even
+ * in yolo mode.
+ */
+export function checkCatastrophicCommand(command) {
+    if (process.env.MUONROI_ALLOW_CATASTROPHIC === "1")
+        return null;
+    for (const { pattern, reason } of CATASTROPHIC_PATTERNS) {
+        if (pattern.test(command)) {
+            return { kind: "catastrophic", reason, command };
+        }
+    }
+    return null;
+}
+/**
+ * Check a command against the "dangerous" patterns used by `toolNeedsApproval`.
+ * These are less severe than catastrophic but should still prompt for approval
+ * in safe / auto-edit modes.
+ *
+ * Returns a SafetyBlockResult or null if safe.
+ */
+export function checkDangerousCommand(command) {
+    const dangerousPatterns = [
+        // Filesystem destruction
+        /rm\s+-rf?\s+\/(?!tmp|var\/tmp)/i,
+        // Unrestricted chmod
+        /chmod\s+(?:777|a\+[rwx])/i,
+        // Code injection
+        /eval\s*\(/i,
+        /exec\s*\(/i,
+        // External network fetches (non-local)
+        /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+        /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+        // Process substitution with external commands
+        /\$\([^)]*(?:curl|wget|nc|socat)[^)]*\)/i,
+        // Writing to /etc (besides allowed subdirs)
+        /\bchown\s+root/i,
+    ];
+    for (const pattern of dangerousPatterns) {
+        if (pattern.test(command)) {
+            return {
+                kind: "dangerous",
+                reason: `Command matched dangerous pattern: ${pattern.source}`,
+                command,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Check if a command is a safety-blocked git operation (push-on-red, broad staging).
+ */
+export function checkGitSafetyCommand(command, gitSafetyKey) {
+    // Lazy import to avoid circular deps at module level
+    const { analyzeGitCommand, checkPushGate, checkSensitiveStaging } = require_inline_safety_deps();
+    const gt = analyzeGitCommand(command);
+    if (gt.isPush) {
+        const gate = checkPushGate(gitSafetyKey);
+        if (gate.blocked) {
+            return {
+                kind: "git-safety",
+                reason: `git push blocked: ${gate.failed.join(", ")}`,
+                command,
+            };
+        }
+    }
+    return null;
+}
+// Inline require to avoid circular dependency at module load.
+function require_inline_safety_deps() {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const mod = require("../tools/git-safety.js");
+    return mod;
+}
 /**
  * Returns true if the given tool call requires manual user approval
  * under the specified permission mode.
@@ -34,12 +187,20 @@ export function toolNeedsApproval(toolName, mode, context) {
         if (!cmd)
             return false;
         const patterns = [
+            // Filesystem destruction
             /rm\s+-rf?\s+\/(?!tmp|var\/tmp)/i,
-            /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-            /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
-            /chmod\s+777/i,
+            // Unrestricted chmod
+            /chmod\s+(?:777|a\+[rwx])/i,
+            // Code injection
             /eval\s*\(/i,
             /exec\s*\(/i,
+            // External network fetches (non-local)
+            /curl\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+            /wget\s+https?:\/\/(?!127\.0\.0\.1|localhost)/i,
+            // Process substitution with external commands
+            /\$\([^)]*(?:curl|wget|nc|socat)[^)]*\)/i,
+            // Writing to /etc (besides allowed subdirs)
+            /\bchown\s+root/i,
         ];
         return patterns.some((p) => p.test(cmd));
     };