one-code-extension 0.1.3 → 0.3.0

package/extensions/auto-mode/shell-analysis.ts

@@ -30,6 +30,7 @@
  * denylist — see `sensitive.ts`), F1 (git global flags).
  */
 
+import { isProtectedPath } from "../permissions/protected-paths.ts";
 import { isExecutionPrimitivePath, isSensitivePath } from "./sensitive.ts";
 import { isWithin, resolveForContainment, toAbsolute } from "./paths.ts";
 
@@ -47,8 +48,46 @@ export interface ShellEvidence {
 	sensitivePaths: string[];
 	/** In-project paths whose contents execute later (`.git/hooks/*`, `.vscode/*.json`). */
 	executionPrimitives: string[];
+	/**
+	 * Tooling/agent-configuration paths (`permissions/protected-paths.ts`: `.cargo/`,
+	 * `.claude/`, hook configs, shell rc files, …) this command writes. The
+	 * `write`/`edit` tools route these to the classifier; a shell redirect or
+	 * `rm`/`mv` onto the same path must not be "safe" merely for being in-project.
+	 */
+	protectedPaths: string[];
 	/** Network-capable commands present (curl, ssh, …) — an egress signal for the classifier. */
 	network: string[];
+	/**
+	 * Paths a read-only command reads from OUTSIDE the working directory
+	 * (original tokens). Claude Code asks for every read outside it; here the
+	 * read escalates so the classifier at least sees it — until 2026-09-05
+	 * `cat ~/.onecode/agent/auth.json` fast-pathed as "safe"
+	 * (PERMISSIONS-REVIEW-2026-09-05 H2).
+	 */
+	outsideReads: string[];
+	/**
+	 * True when the ONLY reason this escalated is one or more outside-cwd reads:
+	 * no write, mutation, network, unknown command or unmodelled syntax. Plan
+	 * mode uses it to put such a command to the user as a read instead of
+	 * refusing it as a mutation. Never true for a "safe" verdict.
+	 */
+	readOnlyOutside: boolean;
+	/**
+	 * True when the ONLY reason this escalated is an in-project filesystem
+	 * mutation/deletion — every path is inside the working directory and resolved,
+	 * nothing touches the network, no credential/execution-primitive path, no
+	 * unknown command, interpreter, glob, xargs, `cd`, or unmodelled syntax. The
+	 * containment gate uses this to decide whether a git-recoverability check may
+	 * clear the command (see auto-mode/recoverability.ts). Never true when the
+	 * verdict is "safe" (nothing escalated) — it only qualifies an escalation.
+	 */
+	containedNonNetwork: boolean;
+	/**
+	 * True for a whole-working-tree destructive git op (`git reset --hard`), whose
+	 * recoverability is judged against the whole tree's cleanliness rather than
+	 * named paths.
+	 */
+	wholeTree: boolean;
 }
 
 /** Commands that read and do not write, and are safe to fast-path. */
@@ -77,7 +116,9 @@ const READ_ONLY_COMMANDS = new Set([
 	"nl",
 	"od",
 	"paste",
-	"printenv",
+	// `printenv` and a bare `env` are NOT read-only for this purpose: they dump
+	// the process environment, provider keys included (Claude Code removed both
+	// from its read-only list for the same reason).
 	"printf",
 	"pwd",
 	"readlink",
@@ -101,6 +142,29 @@ const READ_ONLY_COMMANDS = new Set([
 	"yes",
 ]);
 
+/**
+ * Read-only commands that take no file operands, so a path-looking positional
+ * (`echo a/b`, `which node`) is not a read of that path and is not checked for
+ * working-directory containment.
+ */
+const NO_FILE_OPERANDS = new Set([
+	"basename",
+	"date",
+	"dirname",
+	"echo",
+	"false",
+	"hostname",
+	"id",
+	"printf",
+	"pwd",
+	"tr",
+	"true",
+	"uname",
+	"which",
+	"whoami",
+	"yes",
+]);
+
 /**
  * `grep` and friends take a pattern before their paths, so the first positional
  * is not a path token. Tracked separately to avoid classifying a regex as a file.
@@ -160,6 +224,46 @@ const MUTATION_COMMANDS = new Set([
 	"zip",
 ]);
 
+/**
+ * The delete/truncate commands whose blast radius is exactly their (in-project,
+ * resolved, concrete) path arguments, so an in-project use may be cleared by the
+ * containment + git-recoverability gate rather than always reaching the
+ * classifier. This is an *allowlist* for the "provably contained" conclusion —
+ * omission is safe (the command still escalates to the classifier via the generic
+ * mutation path). Overwrite/copy tools (cp, mv, dd, tee) are deliberately left
+ * out for now: their destination semantics are subtler, so they keep classifying.
+ * Membership here does not clear anything on its own: every target must resolve
+ * inside the working directory and the recoverability check must pass.
+ */
+const DELETE_COMMANDS = new Set(["rm", "rmdir", "shred", "truncate"]);
+
+/** Glob/other shell metacharacters we cannot enumerate, so a target carrying one is not "concrete". */
+function hasGlob(token: string): boolean {
+	return /[*?\[\]]/.test(token);
+}
+
+/** `git reset --hard [ref]` — a whole-working-tree discard of uncommitted changes. */
+function isWholeTreeGitReset(args: Token[]): boolean {
+	const positionals = args.filter((token) => !token.value.startsWith("-"));
+	return positionals[0]?.value === "reset" && args.some((token) => token.value === "--hard");
+}
+
+/**
+ * Whether git is being pointed at another repository or tree (`-C dir`,
+ * `--git-dir[=]…`, `--work-tree[=]…`, `--namespace`, `--exec-path`). A
+ * whole-tree op carrying one of these acts on THAT tree, so judging it against
+ * the working directory would clear a reset of some other checkout.
+ */
+function hasGitRetargetFlag(args: Token[]): boolean {
+	return args.some((token) => {
+		const value = token.value;
+		if (!value.startsWith("-")) return false;
+		if (GIT_GLOBAL_VALUE_FLAGS.has(value)) return true;
+		const eq = value.indexOf("=");
+		return eq > 0 && GIT_GLOBAL_VALUE_FLAGS.has(value.slice(0, eq));
+	});
+}
+
 /**
  * Interpreters whose *scripts* can write files the token-level pass never sees
  * (review finding N8: `awk 'BEGIN{print > "f"}'`). Their programs are not
@@ -236,14 +340,14 @@ const GIT_READ_ONLY_SUBCOMMANDS = new Set([
  */
 const GIT_GLOBAL_VALUE_FLAGS = new Set(["-C", "--git-dir", "--work-tree", "--namespace", "--exec-path"]);
 
-interface Token {
+export interface Token {
 	/** The token with quotes removed and `$'…'` decoded. */
 	value: string;
 	/** True when the token was written with any quoting or expansion syntax. */
 	hadExpansion: boolean;
 }
 
-interface Segment {
+export interface Segment {
 	tokens: Token[];
 	/** Redirection targets found in this segment, in written order. */
 	redirects: string[];
@@ -282,27 +386,40 @@ function decodeAnsiC(body: string): string {
 	});
 }
 
+/**
+ * Syntax through which a command can run something other than what its
+ * visible words say. The permission matcher refuses to let a prefix/wildcard
+ * allow rule cover a command carrying any of it (the user approved `npm test
+ * …`, not whatever `$(…)` evaluates to), and the pre-gate escalates on it.
+ */
+export function hasInjectionSyntax(command: string): string | undefined {
+	if (/\$\(/.test(command)) return "uses command substitution $( )";
+	if (/(^|[^\\])`/.test(command)) return "uses backtick command substitution";
+	if (/[<>]\(/.test(command)) return "uses process substitution";
+	if (/\beval\b|\bexec\b/.test(command)) return "uses eval/exec";
+	if (/\|\s*(bash|sh|zsh|python|perl|node|ruby)\b/.test(command)) return "pipes into an interpreter";
+	if (/base64\s+(-d|--decode)/.test(command)) return "decodes base64, which can hide the real command";
+	return undefined;
+}
+
 /** Syntax we do not model at all; its presence alone forces escalation. */
 export function hasUnmodelledSyntax(command: string): string | undefined {
 	if (command.includes("\n")) return "spans multiple lines";
-	if (/\$\(/.test(command)) return "uses command substitution $( )";
-	if (/(^|[^\\])`/.test(command)) return "uses backtick command substitution";
+	const injection = hasInjectionSyntax(command);
+	if (injection) return injection;
 	if (/<<</.test(command)) return "uses a here-string";
 	if (/<</.test(command)) return "uses a heredoc";
-	if (/[<>]\(/.test(command)) return "uses process substitution";
 	// Brace expansion resolves to paths we cannot enumerate (review finding N3).
 	if (/\{[^{}]*,[^{}]*\}/.test(command)) return "uses brace expansion, whose expanded paths cannot be checked";
 	if (/\$\{?[A-Za-z_]/.test(command)) return "references environment variables, whose values are unknown here";
-	if (/\beval\b|\bexec\b/.test(command)) return "uses eval/exec";
-	if (/\|\s*(bash|sh|zsh|python|perl|node|ruby)\b/.test(command)) return "pipes into an interpreter";
-	if (/base64\s+(-d|--decode)/.test(command)) return "decodes base64, which can hide the real command";
 	return undefined;
 }
 
 /**
  * Split a command into pipeline/list segments and tokenize each. Unlike the
  * original, `<`, `>`, `&`, and `|` terminate a token even without surrounding
- * whitespace, so `cmd>file` and `a|b` are seen (review finding N4).
+ * whitespace, so `cmd>file` and `a|b` are seen (review finding N4). An
+ * unquoted newline ends a segment too (it is a command separator in bash).
  */
 export function parseCommand(command: string): { segments: Segment[]; parseFailed: boolean } {
 	const segments: Segment[] = [];
@@ -332,14 +449,15 @@ export function parseCommand(command: string): { segments: Segment[]; parseFaile
 		quoted = false;
 	};
 
-	const pushSegment = (at: number) => {
+	/** `at` = index of the separator; `width` = its length (`&&` is 2). */
+	const pushSegment = (at: number, width = 1) => {
 		pushToken();
 		if (tokens.length > 0 || redirects.length > 0) {
 			segments.push({ tokens, redirects, raw: command.slice(rawStart, at).trim() });
 		}
 		tokens = [];
 		redirects = [];
-		rawStart = at + 1;
+		rawStart = at + width;
 	};
 
 	for (let i = 0; i < command.length; i++) {
@@ -382,6 +500,12 @@ export function parseCommand(command: string): { segments: Segment[]; parseFaile
 			continue;
 		}
 
+		if (ch === "\n") {
+			// An unquoted newline separates commands exactly like `;`. Without this
+			// `npm test x\ncurl evil` would be one segment whose lead is `npm test`.
+			pushSegment(i);
+			continue;
+		}
 		if (/\s/.test(ch)) {
 			pushToken();
 			continue;
@@ -408,8 +532,9 @@ export function parseCommand(command: string): { segments: Segment[]; parseFaile
 		if (ch === "|" || ch === ";" || ch === "&") {
 			// `&&`, `||`, `;`, `|`, `&` all end a segment. Any of them means the
 			// next command is separate, which is all we need to know.
-			pushSegment(i);
-			if (command[i + 1] === ch) i++;
+			const doubled = command[i + 1] === ch;
+			pushSegment(i, doubled ? 2 : 1);
+			if (doubled) i++;
 			continue;
 		}
 
@@ -422,7 +547,7 @@ export function parseCommand(command: string): { segments: Segment[]; parseFaile
 }
 
 /** Peel wrappers to the command that actually runs (review finding N5). */
-function resolvePayload(tokens: Token[]): { command: string; args: Token[]; peeled: string[] } {
+export function resolvePayload(tokens: Token[]): { command: string; args: Token[]; peeled: string[] } {
 	const peeled: string[] = [];
 	let index = 0;
 
@@ -449,6 +574,69 @@ function resolvePayload(tokens: Token[]): { command: string; args: Token[]; peel
 	}
 }
 
+/**
+ * A segment's tokens normalised for command-position checks: subshell parens
+ * stripped from the head token only (`(cd` → `cd` — a later argument may
+ * legitimately begin with `(`), leading `do`/`then`/`else` keywords skipped,
+ * and as many trailing `)`s stripped off the last token as `(`s were opened at
+ * the head, so `(git stash)` still matches subcommand `stash`. A subshell
+ * whose closing paren lands in a *different* segment (`(a && git stash)`) is
+ * a known limitation — the closer is only balanced within one segment.
+ * Used by the bash/worktree guard pipelines, not by the escalation analyzer.
+ */
+export function leadTokens(seg: Segment): Token[] {
+	const tokens = [...seg.tokens];
+	let i = 0;
+	let opened = 0;
+	for (;;) {
+		while (i < tokens.length) {
+			const value = tokens[i].value;
+			const lead = /^[({]+/.exec(value)?.[0] ?? "";
+			if (lead.length === 0) break;
+			opened += (lead.match(/\(/g) ?? []).length;
+			const stripped = value.slice(lead.length);
+			if (stripped.length === 0) {
+				i++;
+				continue;
+			}
+			tokens[i] = { ...tokens[i], value: stripped };
+			break;
+		}
+		if (i < tokens.length && ["do", "then", "else"].includes(tokens[i].value)) {
+			i++;
+			continue;
+		}
+		break;
+	}
+	if (opened > 0 && tokens.length > i) {
+		const last = tokens.length - 1;
+		const trailing = /\)+$/.exec(tokens[last].value)?.[0];
+		if (trailing) {
+			const strip = Math.min(trailing.length, opened);
+			tokens[last] = { ...tokens[last], value: tokens[last].value.slice(0, tokens[last].value.length - strip) };
+		}
+	}
+	return tokens.slice(i);
+}
+
+/**
+ * Superset of GIT_GLOBAL_VALUE_FLAGS for *locating* the subcommand, not for
+ * judging safety: `-c`/`--config-env` are included here because they do take a
+ * value, while the escalation analyzer above deliberately refuses to skip them.
+ */
+const GIT_LOCATOR_VALUE_FLAGS = new Set([...GIT_GLOBAL_VALUE_FLAGS, "-c", "--config-env"]);
+
+/** The git subcommand and the tokens after it, global flags skipped. */
+export function gitSubcommand(args: Token[]): { sub?: string; rest: Token[] } {
+	let i = 0;
+	while (i < args.length) {
+		const value = args[i].value;
+		if (!value.startsWith("-")) return { sub: value, rest: args.slice(i + 1) };
+		i += GIT_LOCATOR_VALUE_FLAGS.has(value) ? 2 : 1;
+	}
+	return { rest: [] };
+}
+
 /** Basename of a command token, `.exe` stripped, lowercased. */
 function commandName(token: string): string {
 	const withForwardSlashes = token.trim().toLowerCase().replace(/\\/g, "/");
@@ -501,16 +689,19 @@ function gitEscalationReason(args: Token[], isDirOutsideCwd: (dir: string) => bo
 		if (token === "-c" || token.startsWith("-c=") || token === "--config-env") {
 			return "passes git -c/--config-env, which can turn a read into code execution";
 		}
-		if (GIT_GLOBAL_VALUE_FLAGS.has(token)) {
-			const value = args[index + 1]?.value;
+		// `--git-dir=/x` spells the same flag as `--git-dir /x`; normalise both.
+		const eq = token.indexOf("=");
+		const flag = eq > 0 ? token.slice(0, eq) : token;
+		if (GIT_GLOBAL_VALUE_FLAGS.has(flag)) {
+			const value = eq > 0 ? token.slice(eq + 1) : args[index + 1]?.value;
 			// `-C`/`--git-dir`/`--work-tree` retarget git at another directory. If that
 			// directory escapes the working directory the operation is no longer
 			// provably in-project, so escalate rather than skipping the flag blindly
 			// (was review gap: `git -C /etc status` classified safe).
-			if ((token === "-C" || token === "--git-dir" || token === "--work-tree") && value && isDirOutsideCwd(value)) {
-				return `runs git ${token} ${value}, which points outside the working directory`;
+			if ((flag === "-C" || flag === "--git-dir" || flag === "--work-tree") && value && isDirOutsideCwd(value)) {
+				return `runs git ${flag} ${value}, which points outside the working directory`;
 			}
-			index += 2;
+			index += eq > 0 ? 1 : 2;
 			continue;
 		}
 		index++;
@@ -525,12 +716,18 @@ export interface AnalyzeInput {
 	command: string;
 	cwd: string;
 	home: string;
+	/**
+	 * Directories protected at runtime beyond protected-paths.ts's static list
+	 * (pi's own agent dir — permissions/matcher.ts `DecideInput.protectedDirs`).
+	 * A redirect landing inside one escalates like a write to `.git/hooks`.
+	 */
+	protectedDirs?: string[];
 }
 
 /**
  * Classify a shell command. Never denies — see the module contract above.
  */
-export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): ShellEvidence {
+export function analyzeShellCommand({ command, cwd, home, protectedDirs = [] }: AnalyzeInput): ShellEvidence {
 	const evidence: ShellEvidence = {
 		verdict: "safe",
 		notes: [],
@@ -538,10 +735,26 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 		writes: [],
 		sensitivePaths: [],
 		executionPrimitives: [],
+		protectedPaths: [],
 		network: [],
+		outsideReads: [],
+		readOnlyOutside: false,
+		containedNonNetwork: false,
+		wholeTree: false,
 	};
-	const escalate = (note: string) => {
+	/**
+	 * Set by any escalation reason that is NOT a bare in-project mutation — i.e.
+	 * anything meaning the command reaches outside the project or cannot be fully
+	 * accounted for. When it stays false through an escalation, the only blocker
+	 * was in-project mutation, and the containment gate may consult recoverability.
+	 */
+	let uncontained = false;
+	/** Set by any escalation that is not an outside-cwd read (see readOnlyOutside). */
+	let escalatedBeyondReads = false;
+	const escalate = (note: string, opts?: { contained?: boolean; outsideRead?: boolean }) => {
 		evidence.verdict = "escalate";
+		if (!opts?.contained) uncontained = true;
+		if (!opts?.outsideRead) escalatedBeyondReads = true;
 		if (!evidence.notes.includes(note)) evidence.notes.push(note);
 	};
 
@@ -594,6 +807,18 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 			evidence.executionPrimitives.push(token);
 			escalate(`writes to ${token}, whose contents execute later without further approval`);
 		}
+		// Same list the write/edit tools are gated on: an in-project redirect onto
+		// `.cargo/config.toml`, `.claude/agents/x.md`, or `lefthook.yml` reconfigures
+		// the toolchain or the agent itself, so containment says nothing about it.
+		const protectedTarget = [absolute, resolved].some(
+			(candidate) =>
+				candidate !== undefined &&
+				(isProtectedPath(candidate, effectiveCwd) || protectedDirs.some((dir) => isWithin(dir, candidate))),
+		);
+		if (protectedTarget && !evidence.protectedPaths.includes(token)) {
+			evidence.protectedPaths.push(token);
+			escalate(`writes to ${token}, a protected tooling or agent configuration path`);
+		}
 	};
 
 	for (const segment of segments) {
@@ -605,10 +830,27 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 		for (const token of segment.redirects) checkWriteTarget(token);
 
 		const { command: name, args, peeled } = resolvePayload(segment.tokens);
-		if (!name) continue;
+		if (!name) {
+			// A wrapper with nothing to wrap is a command of its own: a bare `env`
+			// (or `env -i`, `nice`) prints the whole process environment / state.
+			// Until 2026-09-05 this fell through as "safe" (H2).
+			if (peeled.length > 0) {
+				escalate(
+					peeled.includes("env")
+						? "runs env with no command, which prints the whole process environment"
+						: `runs ${peeled.join(" → ")} with no command to wrap`,
+				);
+			}
+			continue;
+		}
 		evidence.commands.push(name);
 		if (peeled.length > 0) {
-			escalate(`wraps the real command in ${peeled.join(" → ")}, so ${name} is what actually runs`);
+			// A transparent wrapper (timeout, env, nice) leaves the payload's own
+			// arguments visible, so an in-project payload stays contained; xargs is
+			// the exception — its targets come from stdin, unknown to this check.
+			escalate(`wraps the real command in ${peeled.join(" → ")}, so ${name} is what actually runs`, {
+				contained: !peeled.includes("xargs"),
+			});
 		}
 
 		if (NETWORK_COMMANDS.has(name)) {
@@ -643,6 +885,22 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 		}
 
 		if (name === "git") {
+			// `git reset --hard` is an in-project whole-tree discard: escalate, but
+			// mark it contained so the recoverability gate can clear it when the tree
+			// is clean. Any other non-read-only git subcommand is uncontained.
+			if (isWholeTreeGitReset(args)) {
+				if (hasGitRetargetFlag(args)) {
+					// The reset acts on whatever -C/--git-dir/--work-tree names, not on
+					// the working directory the recoverability judge would inspect.
+					escalate("runs git reset --hard against another tree (-C/--git-dir/--work-tree), which cannot be judged here");
+					continue;
+				}
+				evidence.wholeTree = true;
+				escalate("runs git reset --hard, which discards uncommitted changes in the working tree", {
+					contained: true,
+				});
+				continue;
+			}
 			const reason = gitEscalationReason(args, (dir) => {
 				const resolved = resolveForContainment(toAbsolute(effectiveCwd, dir, home));
 				return resolved === undefined || !isWithin(containmentRoot, resolved);
@@ -660,16 +918,58 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 		}
 
 		const isMutation = MUTATION_COMMANDS.has(name);
-		if (isMutation) escalate(`runs ${name}, which modifies the filesystem`);
+		const isDelete = DELETE_COMMANDS.has(name);
+		// A delete confined to in-project paths is what the containment gate exists
+		// to clear (subject to recoverability); any other mutation (cp/mv/tar/…)
+		// stays uncontained and reaches the classifier as before.
+		if (isMutation) escalate(`runs ${name}, which modifies the filesystem`, { contained: isDelete });
 
 		if (!isMutation && !READ_ONLY_COMMANDS.has(name) && !PATTERN_FIRST_COMMANDS.has(name) && name !== "find") {
 			escalate(`runs ${name}, which is not on the read-only allowlist`);
 		}
 
+		// A read-only command's path operands are read: one that resolves outside
+		// the working directory escalates (Claude Code asks for every read outside
+		// it — filesystem.ts — and removed env/printenv from its read-only list).
+		// Bare names (`cat notes.txt`) resolve inside the cwd and stay fast-pathed;
+		// a pattern-first command's first positional is its pattern, not a path.
+		if (!isMutation && !NO_FILE_OPERANDS.has(name)) {
+			const positionals = args.filter((token) => !token.value.startsWith("-")).map((token) => token.value);
+			// The first positional is the pattern only when no flag supplies it:
+			// with `-e PAT` / `-f FILE` (`--regexp`, `--file`) every positional is a
+			// path, and `-f`'s value is itself a file read.
+			const patternByFlag = args.some(({ value }) => /^(-[a-zA-Z]*[ef][a-zA-Z]*|--regexp(=.*)?|--file(=.*)?)$/.test(value));
+			if (PATTERN_FIRST_COMMANDS.has(name) && !patternByFlag) positionals.shift();
+			// `--file=FILE` carries its read inside the flag token.
+			for (const { value } of args) {
+				if (value.startsWith("--file=")) positionals.push(value.slice("--file=".length));
+			}
+			for (const value of positionals) {
+				if (!looksLikePath(value)) continue;
+				const resolved = resolveForContainment(toAbsolute(effectiveCwd, value, home));
+				if (resolved !== undefined && isWithin(containmentRoot, resolved)) continue;
+				if (!evidence.outsideReads.includes(value)) evidence.outsideReads.push(value);
+				escalate(`reads ${value}, which is outside the working directory`, { outsideRead: true });
+			}
+		}
+
 		// The positional destinations of writing commands are the paths that get
 		// written. (Redirections were already handled at the top of the loop.)
 		const writeTokens: string[] = [];
-		if (isMutation) {
+		if (isDelete) {
+			// A delete's targets are every non-flag positional, bare names included
+			// (`rm notes.txt` has no slash but is still a real target the
+			// recoverability gate must see). A glob target cannot be enumerated, so
+			// it drops out of containment — the command then reaches the classifier.
+			for (const token of args) {
+				if (token.value.startsWith("-")) continue;
+				if (hasGlob(token.value)) {
+					escalate(`targets ${token.value}, a glob whose expansion cannot be checked`);
+					continue;
+				}
+				writeTokens.push(token.value);
+			}
+		} else if (isMutation) {
 			const positionals = args.filter((token) => !token.value.startsWith("-") && looksLikePath(token.value));
 			// For cp/mv/rsync/ln the destination is last; for the rest every
 			// positional is a candidate target.
@@ -698,5 +998,11 @@ export function analyzeShellCommand({ command, cwd, home }: AnalyzeInput): Shell
 		for (const token of writeTokens) checkWriteTarget(token);
 	}
 
+	// The command escalated, but every reason was an in-project delete/whole-tree
+	// reset — nothing reached outside the project, the network, or the unknown. The
+	// containment gate may now consult git-recoverability (auto-mode/recoverability).
+	evidence.containedNonNetwork = evidence.verdict === "escalate" && !uncontained;
+	evidence.readOnlyOutside = evidence.verdict === "escalate" && !escalatedBeyondReads;
+
 	return evidence;
 }

package/extensions/auto-mode/transcript.ts

@@ -0,0 +1,102 @@
+/**
+ * The `<transcript>` block the classifier reads (pure).
+ *
+ * Claude Code hands its classifier a compact JSONL transcript of the session —
+ * user messages and tool-call *inputs only*, with tool RESULTS stripped so
+ * hostile content the agent read cannot reach the classifier as if it were
+ * context. Tool names are CC's PascalCase (`Bash`, `Edit`, …). We mirror that
+ * shape exactly (see docs/decisions/auto-mode.md, P5).
+ *
+ * The last entry is always the action under review — permissions/index.ts appends
+ * the call being judged before rendering. Results are never appended here; only
+ * user messages and tool inputs enter, which is the isolation boundary.
+ */
+
+// Native (snake_case) tool name → Claude Code's PascalCase spelling, reused from
+// the hooks matcher (its `ccToolName` is the correct-direction, mcp-passthrough
+// map; permissions/matcher.ts's is lower-cased and cannot recover casing).
+import { ccToolName } from "../hooks/matcher.ts";
+
+export { ccToolName };
+
+/**
+ * One line of the transcript: a user message, a tool call's input, or a call the
+ * permission rules refused. A `denied` line is harness-generated, never tool
+ * output, so it does not weaken the results-stripped isolation boundary — and
+ * without it the classifier could not see that the rules had already refused
+ * this class of action, so it cleared an equivalent-effect retry on the user's
+ * original intent (WEAK-MODEL-REVIEW-2026-09-06 H2).
+ */
+export type TranscriptEntry =
+	| { kind: "user"; text: string }
+	| { kind: "tool"; tool: string; input: Record<string, unknown> }
+	| { kind: "denied"; tool: string; subject: string; rule: string };
+
+/** Truncate one field so a single huge argument cannot dominate the transcript. */
+export function clip(value: string, max: number): string {
+	return value.length <= max ? value : `${value.slice(0, max)}… [truncated, ${value.length} chars]`;
+}
+
+/** Clip every string leaf of a tool input, leaving structure intact. */
+function clipInput(input: Record<string, unknown>, max: number): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const [key, value] of Object.entries(input)) {
+		out[key] = typeof value === "string" ? clip(value, max) : value;
+	}
+	return out;
+}
+
+/**
+ * Render one entry as its compact JSON line. Bash renders as `{"Bash":"<command>"}`
+ * (the command string, as Claude Code does); every other tool renders as
+ * `{"<Tool>":{…input…}}` with string fields clipped.
+ */
+function renderEntry(entry: TranscriptEntry, maxField: number): string {
+	if (entry.kind === "user") return JSON.stringify({ user: clip(entry.text, maxField) });
+	if (entry.kind === "denied") {
+		return JSON.stringify({
+			denied_by_permission_rule: { tool: ccToolName(entry.tool), attempted: clip(entry.subject, maxField), rule: entry.rule },
+		});
+	}
+	const name = ccToolName(entry.tool);
+	const command = entry.input.command;
+	if (entry.tool === "bash" && typeof command === "string") {
+		return JSON.stringify({ [name]: clip(command, maxField) });
+	}
+	return JSON.stringify({ [name]: clipInput(entry.input, maxField) });
+}
+
+export interface RenderOptions {
+	/** Max chars per string field. */
+	maxField?: number;
+	/** Max chars for the whole rendered transcript; oldest entries drop first. */
+	maxChars?: number;
+}
+
+/**
+ * Render the ordered entries into a `<transcript>…</transcript>` block. When the
+ * rendered lines exceed `maxChars`, the oldest are dropped and a marker records
+ * it — the action under review (the last entry) is always kept. The full user
+ * messages are carried separately for intent verification, so dropping old lines
+ * here never weakens that check.
+ */
+export function renderTranscript(entries: TranscriptEntry[], options: RenderOptions = {}): string {
+	const maxField = options.maxField ?? 2000;
+	const maxChars = options.maxChars ?? 60_000;
+	const lines = entries.map((entry) => renderEntry(entry, maxField));
+
+	// Keep the newest lines that fit the budget, walking from the end in one pass
+	// (the last line — the action under review — is always kept). +1 per line for
+	// the joining "\n".
+	let firstKept = lines.length;
+	let running = 0;
+	for (let i = lines.length - 1; i >= 0; i--) {
+		running += lines[i].length + 1;
+		if (i < lines.length - 1 && running > maxChars) break;
+		firstKept = i;
+	}
+	const kept = lines.slice(firstKept);
+	const dropped = firstKept;
+	const body = dropped > 0 ? [`{"note":"${dropped} earlier transcript entr${dropped === 1 ? "y" : "ies"} omitted for length"}`, ...kept] : kept;
+	return `<transcript>\n${body.join("\n")}\n</transcript>`;
+}