one-code-extension 0.4.1 → 0.6.0

package/extensions/permissions/powershell-tree.ts

@@ -0,0 +1,557 @@
+/**
+ * The PowerShell pre-gate's verdicts, judged from PowerShell's own parse
+ * (lib/powershell-parser.ts; decisions/windows.md "The PowerShell pre-gate
+ * reads PowerShell's own parse"). Pure apart from the filesystem reads the
+ * path checks make.
+ *
+ * Two verdicts, each positive proof only:
+ *
+ * - {@link powershellTreeReadOnly}: every statement is a pipeline of the read
+ *   cmdlets in `powershell-cmdlets.ts`, called with parameters their tables
+ *   clear, reading paths inside the working directory or a readable root.
+ * - {@link powershellTreeContainedEdits}: every statement is one of Claude
+ *   Code's acceptEdits cmdlets (`Set-Content`, `Add-Content`, `Remove-Item`,
+ *   `Clear-Content`), optionally piped into an output tail, writing inside the
+ *   working space. The caller offers it only where Claude Code's fast paths
+ *   apply (frontier and workhorse models, acceptEdits and auto mode).
+ *
+ * Fail closed by construction: each check approves the nodes it has judged,
+ * and a line with any node left unapproved (a syntax shape no check models) is
+ * not cleared. The command names and parameters are PowerShell's resolution,
+ * not ours: aliases are the running PowerShell's own (on macOS and Linux `ls`
+ * is `/bin/ls`, not `Get-ChildItem`), and parameters are the static binder's
+ * canonical names with positionals already placed.
+ */
+
+import { readdirSync } from "node:fs";
+import { delimiter, isAbsolute, join } from "node:path";
+import { isSensitivePath } from "../auto-mode/sensitive.ts";
+import { isWithin, resolveForContainment, touchesGuardedPath } from "../auto-mode/paths.ts";
+import { isGuardedWritePath, removalLoses } from "../auto-mode/shell-analysis.ts";
+import type { PowerShellAstNode, PowerShellParse } from "../lib/powershell-parser.ts";
+import {
+	applicationArgument,
+	type CmdletSpec,
+	isSwitchSpelling,
+	parameterKind,
+	READ_APPLICATIONS,
+	READ_CMDLETS,
+	SELECT_STRING_SOURCES,
+	TRUSTED_MODULES,
+	WRITE_CMDLETS,
+	WRITE_TAILS,
+} from "./powershell-cmdlets.ts";
+import { hasPowerShellWildcard, powershellPathAbsolute, powershellPathProblem, powershellUnescaped } from "./powershell-paths.ts";
+import { comparablePath, system32Path } from "../lib/paths.ts";
+
+export interface PowerShellTreeOptions {
+	/** The working directory the command runs in. */
+	cwd: string;
+	home: string;
+	/** REALPATH-resolved directories a read may point into besides the working directory (matcher.ts `sessionReadableRoots`). */
+	readableRoots?: string[];
+	/** REALPATH-resolved directories a write may land in besides the working directory (workspace directories). */
+	writableRoots?: string[];
+	/** Directories no write may touch (permissions/protected-paths.ts, the harness's own). */
+	protectedDirs?: string[];
+}
+
+export interface PowerShellTreeVerdict {
+	ok: boolean;
+	/** Why not, for the decision log. */
+	reason?: string;
+}
+
+/** The tree with each node's children, and the set of nodes a check has approved. */
+interface Tree {
+	nodes: PowerShellAstNode[];
+	children: number[][];
+	approved: Set<number>;
+}
+
+class Refusal extends Error {}
+
+function refuse(reason: string): never {
+	throw new Refusal(reason);
+}
+
+function buildTree(parse: PowerShellParse): Tree {
+	const children: number[][] = parse.nodes.map(() => []);
+	parse.nodes.forEach((node, i) => {
+		if (node.parent >= 0 && node.parent < i) children[node.parent].push(i);
+	});
+	return { nodes: parse.nodes, children, approved: new Set() };
+}
+
+/** The top-level pipelines of the line, each as its CommandAst node indices in order. Refuses anything that is not a plain pipeline or chain of them. */
+function pipelines(tree: Tree): number[][] {
+	const { nodes, children } = tree;
+	if (nodes[0]?.type !== "ScriptBlockAst") refuse("the line did not parse as a script");
+	tree.approved.add(0);
+	const blocks = children[0];
+	if (blocks.length !== 1 || nodes[blocks[0]].type !== "NamedBlockAst") refuse("a param block, using statement or named block");
+	tree.approved.add(blocks[0]);
+	const result: number[][] = [];
+	const statement = (i: number) => {
+		const node = nodes[i];
+		if (node.type === "PipelineChainAst") {
+			if (node.background) refuse("a background job (`&`)");
+			tree.approved.add(i);
+			for (const side of children[i]) statement(side);
+			return;
+		}
+		if (node.type !== "PipelineAst") refuse(`${aNode(node.type)} statement`);
+		if (node.background) refuse("a background job (`&`)");
+		tree.approved.add(i);
+		const elements = children[i];
+		for (const element of elements) {
+			if (nodes[element].type !== "CommandAst") refuse("an expression as a pipeline source, whose value this check cannot see");
+		}
+		result.push(elements);
+	};
+	for (const i of children[blocks[0]]) statement(i);
+	if (result.length === 0) refuse("empty command");
+	return result;
+}
+
+/** A node type as words: `InvokeMemberExpressionAst` is "invoke member expression". */
+function statementName(type: string): string {
+	return type.replace(/(Statement)?Ast$/, "").replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase();
+}
+
+/** "a" or "an" before a node type's words. */
+function aNode(type: string): string {
+	const words = statementName(type);
+	return `${/^[aeiou]/.test(words) ? "an" : "a"} ${words}`;
+}
+
+/** The constant strings a value node holds, approving it, or undefined when it is not a constant. */
+function constantValues(tree: Tree, i: number): string[] | undefined {
+	const node = tree.nodes[i];
+	if (node.type === "StringConstantExpressionAst" || node.type === "ConstantExpressionAst") {
+		if (tree.children[i].length > 0) return undefined;
+		tree.approved.add(i);
+		return [node.value ?? ""];
+	}
+	if (node.type === "ArrayLiteralAst") {
+		const values: string[] = [];
+		for (const child of tree.children[i]) {
+			const inner = constantValues(tree, child);
+			if (inner === undefined) return undefined;
+			values.push(...inner);
+		}
+		tree.approved.add(i);
+		return values;
+	}
+	return undefined;
+}
+
+const SAFE_VARIABLES = new Set(["_", "psitem", "true", "false", "null"]);
+
+/** Binary operators a checked script block may use: comparison, logic, arithmetic and string operators. No range (`..`), `-as` or `-is` (types). */
+const SAFE_BINARY = new Set(
+	[
+		...["eq", "ne", "ge", "gt", "lt", "le", "like", "notlike", "match", "notmatch", "replace", "contains", "notcontains", "in", "notin", "split"].flatMap((op) => [`I${op}`, `C${op}`]),
+		"And",
+		"Or",
+		"Xor",
+		"Join",
+		"Plus",
+		"Minus",
+		"Multiply",
+		"Divide",
+		"Rem",
+		"Format",
+	].map((op) => op.toLowerCase()),
+);
+const SAFE_UNARY = new Set(["not", "exclaim", "minus", "plus"]);
+
+/**
+ * A script block that only reads `$_` and compares: `{ $_.Length -gt 1kb }`,
+ * `{ $_.Name }`. No command, method call, assignment, variable other than
+ * `$_`, type or dynamic member name.
+ */
+function checkScriptBlock(tree: Tree, i: number): void {
+	const { nodes, children } = tree;
+	if (nodes[i].type !== "ScriptBlockExpressionAst") refuse("a script block this check cannot read");
+	const block = children[i];
+	if (block.length !== 1 || nodes[block[0]].type !== "ScriptBlockAst") refuse("a script block this check cannot read");
+	const named = children[block[0]];
+	if (named.length !== 1 || nodes[named[0]].type !== "NamedBlockAst") refuse("a script block with a param or named block");
+	tree.approved.add(i).add(block[0]).add(named[0]);
+	for (const statement of children[named[0]]) checkExpressionStatement(tree, statement);
+}
+
+/** A pipeline of exactly one expression, the only statement a checked script block or parenthesis may hold. */
+function checkExpressionStatement(tree: Tree, i: number): void {
+	const { nodes, children } = tree;
+	if (nodes[i].type !== "PipelineAst" || children[i].length !== 1 || nodes[children[i][0]].type !== "CommandExpressionAst") {
+		refuse("a script block that runs a command");
+	}
+	// `{ $_ & }` starts a background job per input object, the job the top-level check refuses.
+	if (nodes[i].background) refuse("a background job (`&`) inside a script block");
+	const expression = children[i][0];
+	if (children[expression].length !== 1) refuse("a redirection inside a script block");
+	tree.approved.add(i).add(expression);
+	checkExpression(tree, children[expression][0]);
+}
+
+function checkExpression(tree: Tree, i: number): void {
+	const { nodes, children } = tree;
+	const node = nodes[i];
+	switch (node.type) {
+		case "StringConstantExpressionAst":
+		case "ConstantExpressionAst":
+			if (children[i].length === 0) {
+				tree.approved.add(i);
+				return;
+			}
+			break;
+		case "VariableExpressionAst":
+			if (!node.splatted && SAFE_VARIABLES.has((node.name ?? "").toLowerCase())) {
+				tree.approved.add(i);
+				return;
+			}
+			refuse("a variable other than $_ in a script block");
+			break;
+		case "MemberExpressionAst": {
+			const [target, member] = children[i];
+			if (node.static || nodes[member]?.type !== "StringConstantExpressionAst") refuse("a static or computed member access");
+			tree.approved.add(i).add(member);
+			checkExpression(tree, target);
+			return;
+		}
+		case "BinaryExpressionAst":
+			if (!SAFE_BINARY.has((node.operator ?? "").toLowerCase())) refuse(`the -${node.operator} operator in a script block`);
+			tree.approved.add(i);
+			for (const child of children[i]) checkExpression(tree, child);
+			return;
+		case "UnaryExpressionAst":
+			if (!SAFE_UNARY.has((node.operator ?? "").toLowerCase())) refuse(`the ${node.operator} operator in a script block`);
+			tree.approved.add(i);
+			for (const child of children[i]) checkExpression(tree, child);
+			return;
+		case "ParenExpressionAst":
+			if (children[i].length !== 1) break;
+			tree.approved.add(i);
+			checkExpressionStatement(tree, children[i][0]);
+			return;
+		case "ArrayLiteralAst":
+			tree.approved.add(i);
+			for (const child of children[i]) checkExpression(tree, child);
+			return;
+	}
+	refuse(`${aNode(node.type)} in a script block`);
+}
+
+/** One command whose name, bindings and elements are checked; returns its lowercase canonical name and the path values it binds. */
+interface CheckedCommand {
+	name: string;
+	/** The values of its path parameters. */
+	paths: string[];
+	/** The canonical names of every parameter it binds. */
+	bound: Set<string>;
+}
+
+type SpecFor = (name: string) => CmdletSpec | undefined;
+
+/**
+ * Check one CommandAst: a static name that resolves to a PowerShell cmdlet in
+ * `specFor`'s table (or a read-only application, when `applications` is set),
+ * called with parameters the table clears, holding constant values, with no
+ * redirection except to `$null` or a stream merge.
+ */
+function checkCommand(tree: Tree, i: number, specFor: SpecFor, applications: boolean): CheckedCommand {
+	const { nodes, children } = tree;
+	const node = nodes[i];
+	if (node.operator && node.operator !== "Unknown") refuse("the call (&) or dot-source operator");
+	if (!node.name) refuse("a command name computed at run time");
+	const elements = children[i];
+	const nameElement = elements[0];
+	if (nameElement === undefined || nodes[nameElement].type !== "StringConstantExpressionAst") refuse("a command name computed at run time");
+	tree.approved.add(i).add(nameElement);
+	const shown = node.name;
+
+	for (const element of elements.slice(1)) checkRedirection(tree, element);
+
+	if (node.commandType === "Application" && applications && READ_APPLICATIONS[shown.toLowerCase()]) {
+		// The program PowerShell will run, not the name typed: a `findstr.exe`
+		// earlier on PATH than Windows' own is some other program.
+		const expected = system32Path(shown.toLowerCase().endsWith(".exe") ? shown : `${shown}.exe`);
+		if (!node.resolvedName || comparablePath(node.resolvedName) !== comparablePath(expected)) refuse(`\`${shown}\` resolves to ${node.resolvedName ?? "no program"}, not Windows' own`);
+		// The parse server resolved the name in its own directory; a relative
+		// PATH entry (`.`, `bin`) resolves against the call's, where it can name
+		// another program.
+		if (pathHasRelativeEntry(process.env)) refuse(`PATH has a relative entry, so \`${shown}\` may resolve to another program where it runs`);
+		const paths: string[] = [];
+		for (const element of elements.slice(1)) {
+			if (nodes[element].type.endsWith("RedirectionAst")) continue;
+			const values = constantValues(tree, element);
+			if (values === undefined) refuse(`an argument to ${shown} this check cannot read`);
+			for (const value of values) {
+				const kind = applicationArgument(shown, value);
+				if (kind === "refused") refuse(`${value} is not a switch this check clears for ${shown}`);
+				if (kind === "path") paths.push(value);
+			}
+		}
+		return { name: shown.toLowerCase(), paths, bound: new Set() };
+	}
+	if (node.commandType !== "Cmdlet" || !TRUSTED_MODULES.has((node.module ?? "").toLowerCase()) || !node.resolvedName) {
+		refuse(node.commandType ? `\`${shown}\` is not a read-only cmdlet` : `\`${shown}\` is not a command this PowerShell knows`);
+	}
+	const name = node.resolvedName.toLowerCase();
+	const spec = specFor(name);
+	if (!spec) refuse(`\`${node.resolvedName}\` is not a cmdlet this check clears here`);
+	if (node.bindingUnavailable) refuse("PowerShell's parameter binder is not available");
+	if ((node.bindingErrors ?? []).length > 0) refuse(`an argument PowerShell cannot bind to ${node.resolvedName}`);
+
+	const paths: string[] = [];
+	const bound = new Set<string>();
+	for (const binding of node.bindings ?? []) {
+		const kind = parameterKind(spec, binding.parameter);
+		if (!kind) refuse(`-${binding.parameter} is not a parameter this check clears for ${node.resolvedName}`);
+		bound.add(binding.parameter.toLowerCase());
+		if (binding.value === -1) {
+			if (kind !== "switch") refuse(`-${binding.parameter} without a value`);
+			continue;
+		}
+		if (kind === "switch") {
+			const value = nodes[binding.value];
+			if (value?.type !== "VariableExpressionAst" || !["true", "false"].includes((value.name ?? "").toLowerCase())) refuse(`-${binding.parameter} given a value that is not $true or $false`);
+			tree.approved.add(binding.value);
+			continue;
+		}
+		if (kind === "scriptBlock" && nodes[binding.value]?.type === "ScriptBlockExpressionAst") {
+			checkScriptBlock(tree, binding.value);
+			continue;
+		}
+		const values = binding.value === -2 ? collectedValues(tree, binding.elements) : constantValues(tree, binding.value);
+		if (values === undefined) refuse(`-${binding.parameter} given a value computed at run time`);
+		if (kind === "path") paths.push(...values);
+	}
+	// A switch given `$false` binds nothing (the binder drops it, as
+	// PowerShell does: the switch is off), so its name was never checked
+	// against the table; it must still spell one of the cmdlet's switches.
+	for (const element of elements.slice(1)) {
+		if (nodes[element].type !== "CommandParameterAst") continue;
+		tree.approved.add(element);
+		for (const argument of children[element]) {
+			const value = nodes[argument];
+			if (tree.approved.has(argument) || value.type !== "VariableExpressionAst" || (value.name ?? "").toLowerCase() !== "false") continue;
+			if (!isSwitchSpelling(spec, nodes[element].name ?? "")) refuse(`-${nodes[element].name}:$false is not a switch this check clears for ${node.resolvedName}`);
+			tree.approved.add(argument);
+		}
+	}
+	return { name, paths, bound };
+}
+
+/** The constants a remaining-arguments parameter collected, each an argument of the command. */
+function collectedValues(tree: Tree, elements: number[] | undefined): string[] | undefined {
+	if (!elements || elements.length === 0 || elements.some((i) => i < 0)) return undefined;
+	const values: string[] = [];
+	for (const element of elements) {
+		const inner = constantValues(tree, element);
+		if (inner === undefined) return undefined;
+		values.push(...inner);
+	}
+	return values;
+}
+
+/** Whether any PATH entry is relative, so a command name resolves differently in another directory. */
+function pathHasRelativeEntry(env: NodeJS.ProcessEnv): boolean {
+	const key = Object.keys(env).find((name) => name.toLowerCase() === "path") ?? "PATH";
+	return (env[key] ?? "").split(delimiter).some((entry) => entry.trim() !== "" && !isAbsolute(entry.trim()));
+}
+
+/** A stream merge (`2>&1`) and a redirection to `$null` write no file; any other redirection is not cleared. */
+function checkRedirection(tree: Tree, i: number): void {
+	const { nodes, children } = tree;
+	const node = nodes[i];
+	if (node.type === "MergingRedirectionAst") {
+		tree.approved.add(i);
+		return;
+	}
+	if (node.type !== "FileRedirectionAst") return;
+	const [location] = children[i];
+	if (children[i].length === 1 && nodes[location].type === "VariableExpressionAst" && (nodes[location].name ?? "").toLowerCase() === "null") {
+		tree.approved.add(i).add(location);
+		return;
+	}
+	refuse("a redirection that writes a file");
+}
+
+function readRoots(opts: PowerShellTreeOptions): string[] {
+	return [resolveForContainment(opts.cwd) ?? opts.cwd, ...(opts.readableRoots ?? [])];
+}
+
+/** Every node must have been approved by a check; the first one left over names what was not modelled. */
+function requireAllApproved(tree: Tree): void {
+	for (let i = 0; i < tree.nodes.length; i++) {
+		if (!tree.approved.has(i)) refuse(`${aNode(tree.nodes[i].type)} this check does not model`);
+	}
+}
+
+/**
+ * Verdicts already reached for a parse. One tool call asks the same question
+ * of its parse several times (decide() runs up to three times, then the
+ * classifier's pre-gate), and each answer costs a tree walk and filesystem
+ * reads; a parse lives for one call, so the answers cannot go stale.
+ */
+const judged = new WeakMap<PowerShellParse, Map<string, PowerShellTreeVerdict>>();
+
+function verdict(parse: PowerShellParse, kind: "read" | "edit", opts: PowerShellTreeOptions, judge: () => void): PowerShellTreeVerdict {
+	const key = JSON.stringify([kind, opts.cwd, opts.home, opts.readableRoots, opts.writableRoots, opts.protectedDirs]);
+	let answers = judged.get(parse);
+	if (!answers) judged.set(parse, (answers = new Map()));
+	const known = answers.get(key);
+	if (known) return known;
+	let answer: PowerShellTreeVerdict;
+	try {
+		judge();
+		answer = { ok: true };
+	} catch (error) {
+		if (!(error instanceof Refusal)) throw error;
+		answer = { ok: false, reason: error.message };
+	}
+	answers.set(key, answer);
+	return answer;
+}
+
+/** The most entries a directory may hold for its entries to be checked one by one. */
+const ENTRY_LIMIT = 2_000;
+
+/** Whether every entry of `directory` (not recursing) resolves inside a root and to no credential path. */
+function entriesInside(directory: string, roots: string[]): boolean {
+	let entries: string[];
+	try {
+		entries = readdirSync(directory);
+	} catch {
+		return true; // nothing to read through
+	}
+	if (entries.length > ENTRY_LIMIT) return false;
+	for (const entry of entries) {
+		const resolved = resolveForContainment(join(directory, entry));
+		if (resolved === undefined || !roots.some((root) => isWithin(root, resolved)) || isSensitivePath(resolved)) return false;
+	}
+	return true;
+}
+
+/**
+ * Whether the tree under `directory` holds a symbolic link or junction, or
+ * is too large to walk. Windows PowerShell 5.1's recursive `Get-ChildItem`
+ * and `Remove-Item` follow them (PowerShell 7's do not), so a link deep in
+ * the tree lists or deletes what it points at, which the target's own
+ * containment check never sees.
+ */
+function linkInTree(directory: string): boolean {
+	return touchesGuardedPath(directory, directory, (_path, entry) => entry.isSymbolicLink());
+}
+
+/**
+ * Whether every statement of the line only reads inside the working directory
+ * and the readable roots. See the module header.
+ */
+export function powershellTreeReadOnly(parse: PowerShellParse, opts: PowerShellTreeOptions): PowerShellTreeVerdict {
+	return verdict(parse, "read", opts, () => {
+		if (parse.errors.length > 0) refuse("PowerShell could not parse the line");
+		const tree = buildTree(parse);
+		const roots = readRoots(opts);
+		for (const pipeline of pipelines(tree)) {
+			const checked: CheckedCommand[] = [];
+			pipeline.forEach((command, position) => {
+				const current = checkCommand(tree, command, (name) => READ_CMDLETS[name], true);
+				const spec = READ_CMDLETS[current.name];
+				if (position > 0 && spec && !spec.tail) refuse(`\`${tree.nodes[command].resolvedName}\` after a pipe reads the paths its input names`);
+				if (position > 0 && current.name === "select-string") checkSelectStringSources(checked, opts, roots);
+				if (current.name === "get-childitem" && (current.bound.has("recurse") || current.bound.has("depth"))) {
+					for (const directory of current.paths.length > 0 ? current.paths : ["."]) {
+						const absolute = hasPowerShellWildcard(directory) ? undefined : powershellPathAbsolute(directory, opts);
+						const resolved = absolute === undefined ? undefined : resolveForContainment(absolute);
+						if (resolved === undefined || linkInTree(resolved)) refuse("a recursive Get-ChildItem over a tree with a link in it, which Windows PowerShell 5.1 follows");
+					}
+				}
+				for (const path of current.paths) {
+					const problem = powershellPathProblem(path, opts, roots);
+					if (problem) refuse(problem);
+				}
+				checked.push(current);
+			});
+		}
+		requireAllApproved(tree);
+	});
+}
+
+/**
+ * `Select-String` after a pipe reads the file behind each `FileInfo` it
+ * receives. Its sources must be cmdlets whose output is text or a real
+ * file object; a `Get-ChildItem` among them must not recurse (a link deep in
+ * the tree is never seen), and every entry it lists must resolve inside.
+ */
+function checkSelectStringSources(upstream: CheckedCommand[], opts: PowerShellTreeOptions, roots: string[]): void {
+	for (const source of upstream) {
+		if (!SELECT_STRING_SOURCES.has(source.name)) refuse(`Select-String after \`${source.name}\`, whose output can name any file`);
+		if (source.name !== "get-childitem") continue;
+		if (source.bound.has("recurse") || source.bound.has("depth")) {
+			refuse("Select-String over a recursive Get-ChildItem, which reads through links inside the tree");
+		}
+		const directories = source.paths.length > 0 ? source.paths : ["."];
+		for (const directory of directories) {
+			// A wildcard lists its matches, each judged as a path already, but
+			// `-LiteralPath 'sub[1]'` and `-Path 'sub`[1`]'` list the directory
+			// `sub[1]` itself: judge the entries of both spellings, whichever exists.
+			const absolute = powershellPathAbsolute(directory, opts);
+			if (absolute === undefined) refuse(`Select-String over ${directory}, a directory this check cannot resolve`);
+			for (const spelling of new Set([absolute, powershellUnescaped(absolute)])) {
+				const resolved = resolveForContainment(spelling);
+				if (resolved === undefined || !entriesInside(resolved, roots)) refuse("Select-String over a directory with an entry outside the working directory");
+			}
+		}
+	}
+}
+
+/**
+ * Whether every statement of the line is one of Claude Code's acceptEdits
+ * cmdlets writing inside the working space, optionally piped into an output
+ * tail. See the module header.
+ */
+export function powershellTreeContainedEdits(parse: PowerShellParse, opts: PowerShellTreeOptions): PowerShellTreeVerdict {
+	return verdict(parse, "edit", opts, () => {
+		if (parse.errors.length > 0) refuse("PowerShell could not parse the line");
+		const tree = buildTree(parse);
+		const root = resolveForContainment(opts.cwd) ?? opts.cwd;
+		const writable = [root, ...(opts.writableRoots ?? [])];
+		for (const pipeline of pipelines(tree)) {
+			pipeline.forEach((command, position) => {
+				const current = checkCommand(tree, command, (name) => (position === 0 ? WRITE_CMDLETS[name] : WRITE_TAILS.has(name) ? READ_CMDLETS[name] : undefined), false);
+				if (position > 0) return;
+				if (current.paths.length === 0) refuse(`${tree.nodes[command].resolvedName} without a path`);
+				const removes = current.name === "remove-item";
+				for (const path of current.paths) checkWriteTarget(path, removes, removes && current.bound.has("recurse"), opts, writable);
+			});
+		}
+		requireAllApproved(tree);
+	});
+}
+
+/**
+ * The bash gate's write-target check (shell-analysis.ts `checkWriteTarget`),
+ * for a PowerShell path: resolved inside the working space, and not a
+ * credential, execution-primitive or protected path. A removal must not take
+ * a working root, a `.git`, or a directory holding one or a guarded path,
+ * and a recursive removal must not reach a link.
+ */
+function checkWriteTarget(value: string, removes: boolean, recurses: boolean, opts: PowerShellTreeOptions, writable: string[]): void {
+	if (hasPowerShellWildcard(value)) refuse(`writes to ${value}, a wildcard whose matches this check does not judge`);
+	// `-Path` drops a backtick escape (`a``b` writes `a`b`) and `-LiteralPath` keeps it.
+	if (value.includes("`")) refuse(`writes to ${value}, whose backtick escapes this check does not judge`);
+	const absolute = powershellPathAbsolute(value, opts);
+	if (absolute === undefined) refuse(`writes to ${value}, a path this check cannot resolve`);
+	const resolved = resolveForContainment(absolute);
+	if (resolved === undefined || !writable.some((dir) => isWithin(dir, resolved))) refuse(`writes to ${value}, which is outside the working directory`);
+	if ([absolute, resolved].some((path) => isGuardedWritePath(path, opts.cwd, opts.protectedDirs))) refuse(`writes to ${value}, a credential, execution-primitive or protected path`);
+	if (!removes) return;
+	if (removalLoses(absolute, resolved, writable, opts.cwd, opts.protectedDirs)) {
+		refuse(`removes ${value}, which is a working root, or is or holds a git repository or a protected, credential or execution-primitive path`);
+	}
+	if (recurses && linkInTree(resolved)) refuse(`removes ${value} recursively, and a link inside it would be followed by Windows PowerShell 5.1`);
+}

package/extensions/permissions/project-trust.ts

@@ -18,8 +18,8 @@
 
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { oneCodeStateDir } from "../lib/paths.ts";
+import { dirname } from "node:path";
+import { consentStorePath } from "../lib/consent-stores.ts";
 
 interface ApprovalStore {
 	version: 1;
@@ -27,7 +27,7 @@ interface ApprovalStore {
 }
 
 export function projectAllowStorePath(): string {
-	return join(oneCodeStateDir(), "permissions", "project-allow-approvals.json");
+	return consentStorePath("projectAllow");
 }
 
 /** Order-insensitive: the same rules in another order are one consent. */
@@ -66,16 +66,32 @@ export function persistProjectAllowApproval(projectRoot: string, rules: readonly
 	}
 }
 
-/** The consent dialog's text: what the repository wants pre-approved, and which rule fired now. */
-export function describeProjectAllow(rules: readonly string[], firing: string): { title: string; message: string } {
-	const shown = rules.slice(0, 8);
-	const more = rules.length > shown.length ? `\n… and ${rules.length - shown.length} more` : "";
+/**
+ * The consent dialog's text: what the repository wants pre-approved (allow
+ * rules, and workspace directories whose files it wants readable), and what
+ * the current call would use: the rule it matches, or the directory it reads
+ * inside.
+ */
+export type TrustFiring = { rule: string } | { dir: string };
+
+export function describeProjectAllow(rules: readonly string[], firing: TrustFiring, dirs: readonly string[] = []): { title: string; message: string } {
+	const list = (items: readonly string[]) => {
+		const shown = items.slice(0, 8);
+		return `${shown.join("\n")}${items.length > shown.length ? `\n… and ${items.length - shown.length} more` : ""}`;
+	};
+	const parts = [
+		...(rules.length > 0 ? [`pre-approve ${rules.length} permission rule(s):\n${list(rules)}`] : []),
+		...(dirs.length > 0 ? [`add ${dirs.length} workspace director${dirs.length === 1 ? "y" : "ies"}, whose files would be read without a prompt and, in accept-edits mode, edited without one:\n${list(dirs)}`] : []),
+	];
 	return {
-		title: "Trust this repository's allow rules?",
+		title: dirs.length > 0 ? "Trust this repository's permission settings?" : "Trust this repository's allow rules?",
 		message:
-			`This repository's .claude settings pre-approve ${rules.length} permission rule(s):\n${shown.join("\n")}${more}\n\n` +
-			`The current call matches "${firing}" and would run without a prompt` +
+			`This repository's .claude settings ${parts.join("\n\nand ")}\n\n` +
+			`The current call ${"dir" in firing ? `reads inside the workspace directory ${firing.dir}` : `matches "${firing.rule}"`} and would run without a prompt` +
 			" (in auto mode, without the classifier). Whoever committed the file granted this, not you." +
-			" Approval is remembered until the rules change; declining keeps them off for this session.",
+			" Approval is remembered until these settings change; declining keeps them off for this session.",
 	};
 }
+
+/** How a repository's workspace directory enters the consent list: distinct from any rule, and hashed with them. */
+export const projectDirectoryConsentEntry = (raw: string): string => `additionalDirectories: ${raw}`;

package/extensions/permissions/protected-paths.ts

@@ -37,16 +37,28 @@ const PROTECTED_DIRS = [
 	"library/launchagents",
 	".config/fish",
 	".local/bin",
+	// SSH keys, config and authorized_keys: a write there adds a login or a
+	// ProxyCommand that runs on the next connection. Sensitive for reads too
+	// (auto-mode/sensitive.ts).
+	".ssh",
 ];
 
 /**
- * `.claude/worktrees` is where the agent keeps its own git worktrees, and
+ * `.claude/worktrees` is where the agent keeps its own git worktrees
+ * (`.onecode/worktrees` in independent mode, lib/config-mode.ts), and
  * `.onecode/plans` holds plan-mode documents (rendered to the user, never
  * executed) — ordinary working space rather than configuration.
  */
-const PROTECTED_DIR_EXCEPTIONS = [".claude/worktrees", ".onecode/plans"];
+const PROTECTED_DIR_EXCEPTIONS = [".claude/worktrees", ".onecode/worktrees", ".onecode/plans"];
 
 const PROTECTED_FILES = new Set([
+	// A `.git` FILE is a gitlink (`gitdir: <path>`): written into a subdirectory
+	// it points an in-project `git -C sub …` at any repository, and that
+	// repository's config (SECURITY-REVIEW-2026-09-23 H2). The `.git` directory
+	// is covered by PROTECTED_DIRS; this covers the file form. Checked before
+	// PROTECTED_DIR_EXCEPTIONS on purpose: a worktree's own gitlink under
+	// `.claude/worktrees` is git metadata, not working space (git writes it).
+	".git",
 	".gitconfig",
 	".gitmodules",
 	".bashrc",

package/extensions/permissions/session-grant.ts

@@ -78,6 +78,12 @@ export function sessionGrant(input: SessionGrantInput): SessionGrant | undefined
 				return mint(`${tool}(${absoluteDirPattern(cwd)})`, `Yes, and allow ${tool} anywhere in the working directory this session`);
 			}
 			const dir = dirname(absolute);
+			// A file directly in the home directory (or higher) grants itself
+			// only: its directory holds every dot-directory of the user's, so a
+			// grant for `~/.zshrc` would cover `~/.ssh/config` too.
+			if (isAtOrInsideDir(home, dir, cwd)) {
+				return mint(`${tool}(/${escapeLiteral(toPosixPath(resolve(absolute)))})`, `Yes, and allow ${tool} of ${tildify(absolute, home)} this session`);
+			}
 			return mint(`${tool}(${absoluteDirPattern(dir)})`, `Yes, and allow ${tool} under ${tildify(dir, home)} this session`);
 		}
 		case "url": {