one-code-extension 0.1.4 → 0.3.0

package/extensions/auto-mode/recoverability.ts

@@ -0,0 +1,229 @@
+/**
+ * Git-recoverability check for the containment pre-gate (pure core + thin git
+ * runner).
+ *
+ * ## Why this exists
+ *
+ * Claude Code's auto mode trusts the whole project directory as the agent's
+ * sandbox: an in-project `rm` or `git reset --hard` is auto-approved with no
+ * classifier call, even when it destroys uncommitted or untracked work git can
+ * never restore (confirmed live — see docs/decisions/auto-mode.md). One Code
+ * keeps the cheap in-project fast path but refuses that specific risk: an
+ * in-project destructive action is auto-approved **only when git can put the
+ * bytes back** — the target is tracked and clean (whole-tree ops: the entire
+ * tree is clean). Anything else — untracked, dirty, not a git repo, or a git
+ * query we could not run — is `unknown`/`unrecoverable`, and the pre-gate
+ * escalates it to the classifier rather than destroying it silently.
+ *
+ * ## Contract
+ *
+ * Like the shell pre-gate, this may only ever *widen* what is provably safe.
+ * `recoverable` is returned only on positive proof (git says tracked+clean);
+ * every ambiguity — an error, a path git does not know, a non-repo — resolves to
+ * `unknown`, which the caller treats exactly like `unrecoverable`: classify.
+ * Being wrong toward `unknown` costs a classifier call; being wrong toward
+ * `recoverable` destroys the user's work, so uncertainty never lands there.
+ */
+
+import { execFileSync } from "node:child_process";
+import { existsSync, lstatSync, readdirSync } from "node:fs";
+import { basename, join, sep } from "node:path";
+
+export type Recoverability = "recoverable" | "unrecoverable" | "unknown";
+
+export interface RecoverabilityResult {
+	verdict: Recoverability;
+	/** One line naming why, for the decision log — never echoes file contents. */
+	reason: string;
+}
+
+/** What git reports about one destruction target. */
+export interface TargetState {
+	/** Original token, for the reason string (never an expanded value). */
+	token: string;
+	/** `git ls-files` matched it — git has a committed/indexed copy to restore from. */
+	tracked: boolean;
+	/** `git status --porcelain --ignored` reported anything for it — uncommitted, untracked, or ignored content that a restore would not bring back. */
+	dirty: boolean;
+	/** True when the target is a directory (its reason names the content git would not restore). */
+	directory?: boolean;
+}
+
+/**
+ * Judge a set of explicit destruction targets (`rm a b`, `truncate f`). Every
+ * target must be independently recoverable; the first that is not decides the
+ * whole action, since one command destroys them all.
+ */
+export function judgeTargets(targets: TargetState[]): RecoverabilityResult {
+	if (targets.length === 0) return { verdict: "unknown", reason: "no destruction target could be identified" };
+	for (const target of targets) {
+		if (!target.tracked) {
+			return { verdict: "unrecoverable", reason: `${target.token} is not tracked by git, so deleting it is not reversible` };
+		}
+		if (target.dirty) {
+			return {
+				verdict: "unrecoverable",
+				reason: target.directory
+					? `${target.token} is a directory holding uncommitted, untracked, or ignored files that a git restore would not bring back`
+					: `${target.token} has uncommitted changes that a git restore would not bring back`,
+			};
+		}
+	}
+	return { verdict: "recoverable", reason: "every target is tracked by git and clean, so git can restore it" };
+}
+
+/**
+ * Judge a whole-tree destructive op. Recoverable only when the entire working
+ * tree is clean: a clean tree's state is committed (reachable again via
+ * reflog/checkout), while any modified, staged, or untracked entry is content the
+ * op would erase for good. This judge is generic over any tree-wide reset, but at
+ * present only `git reset --hard` is routed here — `git clean -fd` / `git checkout
+ * .` are escalated directly by shell-analysis (isWholeTreeGitReset), so they reach
+ * the classifier rather than this fast path.
+ */
+export function judgeWholeTree(isRepo: boolean, statusPorcelain: string): RecoverabilityResult {
+	if (!isRepo) return { verdict: "unrecoverable", reason: "not a git repository, so a tree-wide reset cannot be undone" };
+	return statusPorcelain.trim().length === 0
+		? { verdict: "recoverable", reason: "the working tree is clean, so git can restore it" }
+		: { verdict: "unrecoverable", reason: "the working tree has uncommitted or untracked changes a reset would destroy" };
+}
+
+/** Combine several sub-verdicts: the whole action is only as recoverable as its least-recoverable part. */
+export function combine(results: RecoverabilityResult[]): RecoverabilityResult {
+	if (results.length === 0) return { verdict: "unknown", reason: "nothing to check" };
+	const worst = results.find((r) => r.verdict === "unrecoverable") ?? results.find((r) => r.verdict === "unknown");
+	return worst ?? results[0];
+}
+
+/** The path is `.git`, sits inside a `.git`, or is a directory with a `.git` entry (repo root, nested repo, worktree). */
+function isOrHoldsGitDir(path: string): boolean {
+	if (basename(path) === ".git") return true;
+	if (path.split(sep).includes(".git")) return true;
+	try {
+		return lstatSync(path).isDirectory() && existsSync(join(path, ".git"));
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Whether any entry named `.git` exists anywhere under `dir`. Bounded by
+ * `budget` directory entries; returns undefined when the budget runs out (the
+ * caller escalates). Symlinks are not followed.
+ */
+function holdsNestedGitDir(dir: string, budget: number): boolean | undefined {
+	const stack = [dir];
+	let seen = 0;
+	while (stack.length > 0) {
+		const current = stack.pop() as string;
+		let entries;
+		try {
+			entries = readdirSync(current, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			if (++seen > budget) return undefined;
+			if (entry.name === ".git") return true;
+			if (entry.isDirectory()) stack.push(join(current, entry.name));
+		}
+	}
+	return false;
+}
+
+/** A thin, defensive git call: any failure (not a repo, git missing, timeout) becomes `undefined`. */
+function git(cwd: string, args: string[]): { ok: boolean; stdout: string } | undefined {
+	try {
+		const stdout = execFileSync("git", args, { cwd, encoding: "utf8", timeout: 5_000, stdio: ["ignore", "pipe", "ignore"] });
+		return { ok: true, stdout };
+	} catch (error) {
+		// A non-zero exit still carries stdout (e.g. ls-files --error-unmatch), which
+		// the caller may want; distinguish "ran and said no" from "could not run".
+		const status = (error as { status?: number }).status;
+		if (typeof status === "number") return { ok: false, stdout: String((error as { stdout?: unknown }).stdout ?? "") };
+		return undefined; // git not found / timed out / killed — genuinely unknown
+	}
+}
+
+export interface Destruction {
+	/** Resolved absolute paths the command destroys (already proven in-project by the pre-gate). */
+	targets: string[];
+	/** True for reset --hard / clean / checkout . — the target is the whole working tree, not named paths. */
+	wholeTree: boolean;
+}
+
+/**
+ * Run the git queries and judge. `cwd` is the command's effective directory.
+ * Returns `unknown` on any git failure so the caller escalates rather than
+ * trusting an answer we could not compute.
+ */
+export function checkRecoverability(cwd: string, destruction: Destruction): RecoverabilityResult {
+	const repoProbe = git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+	const isRepo = repoProbe?.ok === true && repoProbe.stdout.trim() === "true";
+
+	if (destruction.wholeTree) {
+		if (!isRepo) return judgeWholeTree(false, "");
+		const status = git(cwd, ["status", "--porcelain"]);
+		if (!status) return { verdict: "unknown", reason: "could not read git status to judge a tree-wide reset" };
+		return judgeWholeTree(true, status.stdout);
+	}
+
+	if (destruction.targets.length === 0) return { verdict: "unknown", reason: "no destruction target could be identified" };
+	if (!isRepo) return { verdict: "unrecoverable", reason: "not a git repository, so deletion is not reversible" };
+
+	const states: TargetState[] = [];
+	for (const path of destruction.targets) {
+		// A target that does not exist has nothing to lose: deleting it is a no-op,
+		// truncating it creates a fresh empty file. Either way there is no
+		// pre-existing content a restore would need to bring back. Use lstat, not
+		// existsSync: existsSync follows a symlink to its target, so a tracked-but-
+		// dirty *broken* symlink (its target missing) would read as "nothing to
+		// lose" and be wrongly cleared as recoverable — the link entry itself is
+		// real, uncommitted content, so it must be queried against git.
+		let entryExists = true;
+		try {
+			lstatSync(path);
+		} catch {
+			entryExists = false;
+		}
+		if (!entryExists) continue;
+		// The repository itself is never recoverable from itself: `rm -rf .` at the
+		// root passes every tracked/clean test (git ls-files matches any dir with
+		// tracked files) yet deletes `.git`. Same for a path inside `.git` and for a
+		// directory holding a nested repository or worktree link.
+		if (isOrHoldsGitDir(path)) {
+			return { verdict: "unrecoverable", reason: `${path} is or contains a .git directory, so deleting it destroys the history that would restore it` };
+		}
+		const isDirectory = (() => {
+			try {
+				return lstatSync(path).isDirectory();
+			} catch {
+				return false;
+			}
+		})();
+		// `--ignored`: porcelain omits ignored files by default, so a directory of
+		// build output or a `.env` read as "clean" while `rm -rf` erased it for good.
+		const tracked = git(cwd, ["ls-files", "--error-unmatch", "--", path]);
+		const status = git(cwd, ["status", "--porcelain", "--ignored", "--", path]);
+		if (tracked === undefined || status === undefined) {
+			return { verdict: "unknown", reason: "could not query git for a deletion target" };
+		}
+		const dirty = status.stdout.trim().length > 0;
+		// A clean, tracked directory can still hold a nested repository deeper down
+		// (git status never lists a `.git`, so it reads as clean). Only scanned once
+		// the cheap checks passed; a huge tree exhausts the budget and stays unknown.
+		if (isDirectory && tracked.ok && !dirty) {
+			const nested = holdsNestedGitDir(path, 5_000);
+			if (nested === undefined) {
+				return { verdict: "unknown", reason: `${path} is too large to scan for nested repositories` };
+			}
+			if (nested) {
+				return { verdict: "unrecoverable", reason: `${path} contains a nested .git directory whose history git cannot restore` };
+			}
+		}
+		states.push({ token: path, tracked: tracked.ok, dirty, directory: isDirectory });
+	}
+	// Every target was a non-existent path (pure creation / no-op) — nothing to lose.
+	if (states.length === 0) return { verdict: "recoverable", reason: "no existing content would be destroyed" };
+	return judgeTargets(states);
+}

package/extensions/auto-mode/rules.ts

@@ -1,96 +1,113 @@
 /**
- * Rule indexing and verdict grounding (pure).
+ * Grounding the stage-2 verdict against CC's rule names (pure).
  *
- * The classifier used to return a free-text reason, and a model required to
- * justify a decision it has no grounds for produces the most plausible-sounding
- * justification instead of a true one: a `.claude/notes.md` write came back
- * blocked "because it is outside the working directory", which was false. That
- * reason is what the user reads in `/permissions`, what the model is told to act
- * on, and — via the tier — what decides whether the user even gets a prompt.
+ * Claude Code's stage-2 classifier emits `<category>Exact BLOCK Rule Name</category>`
+ * when an action matches a BLOCK rule. CC itself discards that and shows a fixed
+ * "Blocked by classifier"; we instead validate the category against an index of
+ * the rule names actually present in the embedded ruleset, and derive the tier
+ * (hard vs soft) from which section the name was found in — never from a field
+ * the model chose freely.
  *
- * So rules are numbered here, the classifier cites an id, and the id is
- * validated against this index. What the user sees is the *rule's own text*, not
- * the model's paraphrase of it, and the tier comes from the cited id's prefix
- * rather than from a field the model was free to invent. The model's own wording
- * is kept, but as commentary that is never mistaken for fact.
- *
- * Claude Code went further and stopped showing a reason at all (v2.1.208 shows a
- * fixed "Blocked by classifier"), having shipped written explanations first and
- * moved off them. Keeping the explanation is worth it — it is how a user knows
- * which rule or environment entry to change — but only if it cannot assert
- * things that are not so.
+ * A block citing a category that does not exist is still a block, but tagged
+ * `unmatched`, so a hallucinated name cannot borrow a real HARD rule's authority.
+ * The rule's own name is what the user sees; the model's wording is kept as
+ * commentary that is never mistaken for fact. This is decision 1 in
+ * docs/decisions/auto-mode.md, re-expressed against CC's category scheme in
+ * place of our old H1/S4/A2 ids.
  */
 
-import type { AutoModeConfig } from "./config.ts";
-
-export type RuleTier = "hard_deny" | "soft_deny" | "allow";
+export type BlockTier = "hard_deny" | "soft_deny";
 
 export interface IndexedRule {
-	/** `H1`, `S4`, `A2` — what the classifier cites. */
-	id: string;
-	tier: RuleTier;
-	/** The rule's full text, as configured. */
-	text: string;
-	/** Short human-readable name, for a one-line denial listing. */
-	label: string;
+	/** The rule's exact name as it appears in the ruleset (e.g. "Git Destructive"). */
+	name: string;
+	tier: BlockTier;
 }
 
-const TIER_PREFIX: Record<RuleTier, string> = { hard_deny: "H", soft_deny: "S", allow: "A" };
+export interface RuleIndex {
+	rules: IndexedRule[];
+	/** Keyed by normalized name, for case/whitespace-insensitive lookup. */
+	byName: Map<string, IndexedRule>;
+}
 
-/**
- * Grounds for a block that are real but are not numbered rules. Without these
- * the classifier would have to force such a decision onto whichever rule looked
- * closest, which is the misattribution this module exists to stop.
- */
-export const RESERVED_BLOCK_IDS: Record<string, { reason: string; tier: "soft_deny" }> = {
-	boundary: {
-		reason: "The user stated a boundary in this conversation that this action would cross.",
-		tier: "soft_deny",
-	},
-	instructions: {
-		reason: "The project's own instruction file forbids this.",
-		tier: "soft_deny",
-	},
-	unclear: {
-		reason: "What this action would do could not be determined from the call, so it was not allowed.",
-		tier: "soft_deny",
-	},
-};
+/** Section headings in CC's ruleset that bound the block-rule lists. */
+const HARD_HEADING = "## HARD BLOCK";
+const SOFT_HEADING = "## SOFT BLOCK";
+const ALLOW_HEADING = "## ALLOW (exceptions)";
+
+/** Compare names ignoring case, surrounding punctuation, and whitespace runs. */
+export function normalizeName(value: string): string {
+	return value
+		.trim()
+		.toLowerCase()
+		.replace(/\s+/g, " ")
+		.replace(/[.,:;]+$/, "");
+}
 
 /**
- * A rule's display name: the part before the first colon, with any
- * `[must name …]` qualifier stripped. Falls back to a clipped prefix for a
- * user-written rule with no such structure.
+ * The rule name at the head of a top-level bullet line, or undefined if the line
+ * is not a rule entry. A rule line looks like `- Name [named+specifics …]: text`
+ * or `- Name: text`; the name is what precedes the first ` [` qualifier or `:`.
+ * Indented lines (sub-bullets) and non-bullet prose are ignored.
  */
-export function ruleLabel(text: string): string {
-	const head = text.split(":")[0] ?? text;
-	const stripped = head.replace(/\[[^\]]*\]/g, "").trim();
-	const candidate = stripped || head.trim();
-	if (candidate.length > 0 && candidate.length <= 60 && candidate.length < text.length) return candidate;
-	return `${text.slice(0, 57).trim()}…`;
+function ruleNameFromLine(line: string): string | undefined {
+	if (!line.startsWith("- ")) return undefined; // top-level bullets only
+	const body = line.slice(2);
+	// Cut at the first " [" (the [named+specifics …] qualifier) or the first ":".
+	const bracket = body.indexOf(" [");
+	const colon = body.indexOf(":");
+	let end = body.length;
+	if (bracket >= 0) end = Math.min(end, bracket);
+	if (colon >= 0) end = Math.min(end, colon);
+	const name = body.slice(0, end).replace(/\*/g, "").trim();
+	return name.length > 0 ? name : undefined;
 }
 
-export interface RuleIndex {
-	rules: IndexedRule[];
-	byId: Map<string, IndexedRule>;
+/** The text between two markers (exclusive), or "" if the bounds are missing. */
+function sliceSection(text: string, from: string, to: string): string {
+	const start = text.indexOf(from);
+	if (start < 0) return "";
+	const end = text.indexOf(to, start + from.length);
+	return text.slice(start + from.length, end < 0 ? text.length : end);
 }
 
-/** Number every rule so a verdict can point at one. */
-export function indexRules(config: AutoModeConfig): RuleIndex {
-	const rules: IndexedRule[] = [];
-	const tiers: RuleTier[] = ["hard_deny", "soft_deny", "allow"];
-	for (const tier of tiers) {
-		const entries = config[tier];
-		for (const [position, text] of entries.entries()) {
-			rules.push({ id: `${TIER_PREFIX[tier]}${position + 1}`, tier, text, label: ruleLabel(text) });
-		}
+function collectRules(section: string, tier: BlockTier, out: IndexedRule[], byName: Map<string, IndexedRule>): void {
+	for (const line of section.split("\n")) {
+		const name = ruleNameFromLine(line);
+		if (!name) continue;
+		const nameKey = normalizeName(name);
+		if (byName.has(nameKey)) continue; // a name appearing in two sections keeps its first (HARD) tier
+		const rule: IndexedRule = { name, tier };
+		out.push(rule);
+		byName.set(nameKey, rule);
+		// Also key the FULL line text (when it differs), so a verdict quoting the
+		// whole rule line still grounds. Built-in and user-appended lines get this
+		// uniformly — user extras especially need it, since they have no short
+		// `Name:` head and may contain `*`s that the derived name strips.
+		const fullKey = normalizeName(line.slice(2));
+		if (fullKey && fullKey !== nameKey && !byName.has(fullKey)) byName.set(fullKey, rule);
 	}
-	return { rules, byId: new Map(rules.map((rule) => [rule.id, rule])) };
 }
 
-/** Render one tier for the prompt, with ids the classifier can cite. */
-export function renderTier(index: RuleIndex, tier: RuleTier): string {
-	const entries = index.rules.filter((rule) => rule.tier === tier);
-	if (entries.length === 0) return "";
-	return `<${tier}>\n${entries.map((rule) => `${rule.id}. ${rule.text}`).join("\n")}\n</${tier}>`;
+/**
+ * Parse the block-rule names out of the embedded ruleset (user rule extras
+ * included — buildRuleset has already appended them into these sections, so
+ * they are indexed by the same scan as the built-ins). HARD BLOCK names win a
+ * tie over SOFT (a HARD rule must never be downgraded by a same-named soft
+ * one). ALLOW names are not block categories; they are intentionally not
+ * indexed, so a block citing an allow name lands as `unmatched` rather than a
+ * real block.
+ */
+export function buildCategoryIndex(ruleset: string): RuleIndex {
+	const rules: IndexedRule[] = [];
+	const byName = new Map<string, IndexedRule>();
+	collectRules(sliceSection(ruleset, HARD_HEADING, SOFT_HEADING), "hard_deny", rules, byName);
+	collectRules(sliceSection(ruleset, SOFT_HEADING, ALLOW_HEADING), "soft_deny", rules, byName);
+	return { rules, byName };
+}
+
+/** Look up a category the classifier emitted. undefined ⇒ not a known BLOCK rule. */
+export function groundCategory(index: RuleIndex, category: string | undefined): IndexedRule | undefined {
+	if (!category) return undefined;
+	return index.byName.get(normalizeName(category));
 }

package/extensions/auto-mode/safety-floor.ts

@@ -22,9 +22,10 @@
  * fires on routine work teaches the user to approve without reading.
  */
 
-import { join } from "node:path";
 import { analyzeShellCommand } from "./shell-analysis.ts";
 import { autoModeSettingsPaths } from "./config.ts";
+import { oneCodeProjectSettingsPath } from "../lib/one-code-settings.ts";
+import { claudeJsonPath } from "../lib/paths.ts";
 import { isWritingTool, resolveForContainment, toAbsolute } from "./paths.ts";
 
 /** Case-fold the same way resolveForContainment's output is folded. */
@@ -41,22 +42,43 @@ function fold(path: string): string {
  */
 const SETTINGS_TAIL = /\/\.claude\/settings(\.local)?\.json$/;
 
-function safetyControlFiles(home: string): string[] {
+/**
+ * One Code's own settings files — the global `~/.onecode/settings.json` and the
+ * per-repo `~/.onecode/projects/<slug>/settings.json`, wherever `.onecode`
+ * lives. Both now carry `permissions.allow` rules that `loadPermissionSettings`
+ * reads and that bypass the classifier, so a write to either is a gate-control
+ * write and must hit this floor rather than the auto-mode classifier (the global
+ * file is also reached via `autoModeSettingsPaths`; this covers the per-repo one,
+ * which that list never includes, and both under any checkout).
+ */
+const ONECODE_SETTINGS_TAIL = /\/\.onecode\/(projects\/[^/]+\/)?settings\.json$/;
+
+function safetyControlFiles(home: string, oneCodeProjectSettings?: string): string[] {
 	return [
-		// autoMode + user permission rules, and the managed-settings paths.
+		// autoMode + user permission rules, and the managed-settings paths (the
+		// global ~/.onecode/settings.json here honours ONECODE_STATE_DIR).
 		...autoModeSettingsPaths(home),
-		// Claude Code's global state file also carries permission configuration.
-		join(home, ".claude.json"),
+		// Claude Code's global state file also carries permission configuration;
+		// claudeJsonPath honours CLAUDE_CONFIG_DIR so a relocated file is still caught.
+		claudeJsonPath(home),
+		// The per-repo One Code settings file also carries permission rules. The
+		// tail regex catches it under a literal `.onecode`; this catches it when
+		// ONECODE_STATE_DIR relocated the state root (review L2).
+		...(oneCodeProjectSettings ? [oneCodeProjectSettings] : []),
 	];
 }
 
-/** Whether a *resolved* path (resolveForContainment output) is a gate control. */
-export function isSafetyControlTarget(resolved: string, home: string): boolean {
+/**
+ * Whether a *resolved* path (resolveForContainment output) is a gate control.
+ * `oneCodeProjectSettings` is the current repo's One Code settings file, resolved
+ * by the caller (once per session) so this need not re-walk for the project root.
+ */
+export function isSafetyControlTarget(resolved: string, home: string, oneCodeProjectSettings?: string): boolean {
 	const target = fold(resolved);
-	if (SETTINGS_TAIL.test(target)) return true;
+	if (SETTINGS_TAIL.test(target) || ONECODE_SETTINGS_TAIL.test(target)) return true;
 	// The control files go through the same resolution as the write target, or
 	// the two sides can disagree about the same file (macOS /var → /private/var).
-	return safetyControlFiles(home).some((file) => {
+	return safetyControlFiles(home, oneCodeProjectSettings).some((file) => {
 		const control = resolveForContainment(file) ?? fold(file);
 		return control === target || fold(file) === target;
 	});
@@ -68,6 +90,13 @@ export interface FloorInput {
 	input: Record<string, unknown>;
 	cwd: string;
 	home: string;
+	/**
+	 * The current repo's One Code settings file, resolved once per session by the
+	 * caller. When omitted it is derived from `cwd` (a filesystem walk) — fine for
+	 * tests, but the per-tool-call permission path passes it to avoid the walk
+	 * (distribution review 2026-09-09, L2 / efficiency pass).
+	 */
+	oneCodeProjectSettings?: string;
 }
 
 const REASON = (token: string) =>
@@ -79,12 +108,14 @@ const REASON = (token: string) =>
  * files included), so linking a settings file elsewhere and writing the link
  * does not slip past.
  */
-export function safetyControlWrite({ toolName, input, cwd, home }: FloorInput): string | undefined {
+export function safetyControlWrite({ toolName, input, cwd, home, oneCodeProjectSettings }: FloorInput): string | undefined {
+	const perRepoSettings = oneCodeProjectSettings ?? oneCodeProjectSettingsPath(cwd, home);
+
 	if (isWritingTool(toolName)) {
 		const raw = input.path ?? input.file_path ?? input.notebook_path;
 		if (typeof raw !== "string" || raw.length === 0) return undefined;
 		const resolved = resolveForContainment(toAbsolute(cwd, raw, home));
-		return resolved && isSafetyControlTarget(resolved, home) ? REASON(raw) : undefined;
+		return resolved && isSafetyControlTarget(resolved, home, perRepoSettings) ? REASON(raw) : undefined;
 	}
 
 	if (toolName === "bash") {
@@ -92,7 +123,7 @@ export function safetyControlWrite({ toolName, input, cwd, home }: FloorInput):
 		if (!command) return undefined;
 		const evidence = analyzeShellCommand({ command, cwd, home });
 		for (const write of evidence.writes) {
-			if (write.resolved && isSafetyControlTarget(write.resolved, home)) return REASON(write.token);
+			if (write.resolved && isSafetyControlTarget(write.resolved, home, perRepoSettings)) return REASON(write.token);
 		}
 	}
 

package/extensions/auto-mode/sensitive.ts

@@ -36,9 +36,20 @@ const SENSITIVE_DIR_PAIRS = [
 	[".config", "gcloud"],
 	[".config", "gh"],
 	[".local", "share"],
+	[".huggingface", "token"],
+	["library", "keychains"], // macOS keychain databases
 ] as const;
 
 const SENSITIVE_BASENAMES = new Set([
+	// The harness's own credential stores: pi's / One Code's `agent/auth.json`
+	// and Claude Code's `~/.claude/.credentials.json` (PERMISSIONS-REVIEW-2026-09-05
+	// H2 — the classifier's own API key was readable unclassified).
+	"auth.json",
+	".credentials.json",
+	"credentials.json",
+	"credentials.toml", // cargo
+	".vault-token",
+	".gitconfig", // credential helpers, embedded tokens
 	".bash_history",
 	".bash_profile",
 	".bashrc",