session-orchestrator 5.1.0 → 5.3.0

package/scripts/lib/command-blocker.mjs

@@ -743,6 +743,31 @@ export { splitSegments as splitChainSegments };
 
 const ENV_ASSIGN_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
 
+/**
+ * Verbs that name a WRITE TARGET as a bare operand — no redirect operator, no
+ * wrapper flag (#1366). A sibling of WRAPPER_UNWRAP's `fileArgFlags`: that table
+ * answers "does this WRAPPER flag's operand name a file the wrapper writes?",
+ * this one "does this VERB's operand name a file the verb writes?".
+ *
+ * Spec fields:
+ *   - prefix:   the operand's literal prefix (`of=`), matched on a token AFTER
+ *               the resolved verb.
+ *   - mode:     the default redirect mode the write is equivalent to.
+ *   - appendRe: operands that turn the write into an APPEND. `dd` truncates by
+ *               default (`conv=notrunc` / `oflag=append` do not), so reporting
+ *               `truncate` unconditionally would over-report a rule class that
+ *               deliberately permits `>>`.
+ *
+ * Deliberately narrow — one entry, measured. `tee`/`sponge` and in-process
+ * writers (`node -e fs.writeFileSync`) are NOT here: they are not redirect-shaped
+ * and belong to a different rule class (see the `redirect-harness-memory`
+ * rationale in .orchestrator/policy/blocked-commands.json). REVISIT TRIGGER: a
+ * second `<verb> <prefix>file` writer showing up in a transcript census.
+ */
+const VERB_FILE_OPERANDS = new Map([
+  ['dd', { prefix: 'of=', mode: 'truncate', appendRe: /^(?:conv=.*\bnotrunc\b|oflag=.*\bappend\b)/ }],
+]);
+
 /**
  * Transparent process-wrapper table for verb resolution (#982), keyed by
  * basename. Each spec describes how to skip a wrapper's own options so the
@@ -946,15 +971,37 @@ function resolveCore(segment, unknownFlagsTakeValue) {
       if (spec.splitString
           && (text === '-S' || text === '--split-string'
             || text.startsWith('--split-string=') || text.startsWith('-S'))) {
+        // env(1) APPENDS the remaining argv to the split string: `env -S bash
+        // -c '…'` runs `bash -c '…'`, not `bash` (#1366). Collecting only the
+        // operand made the trailing `-c '…'` execute unseen — the segment then
+        // resolved to `verb: 'echo x > CLAUDE.md'` (the quoted payload read as
+        // the verb) and neither the match surface nor the redirect surface ever
+        // saw it. So the payload is the operand PLUS every remaining token, and
+        // the wrapper CONSUMES the segment: nothing is left to resolve as a
+        // verb, which is why this now yields `verb: null, index: -1`.
+        let operand = null;
         if (text.startsWith('--split-string=')) {
-          payloads.push(text.slice('--split-string='.length));
+          operand = text.slice('--split-string='.length);
+          i++;
         } else if (text !== '-S' && text !== '--split-string') {
-          payloads.push(text.slice(2)); // attached form: -S'string'
-        } else if (i + 1 < segment.length) {
-          payloads.push(segment[i + 1].text);
+          operand = text.slice(2); // attached form: -S'string'
           i++;
+        } else if (i + 1 < segment.length) {
+          operand = segment[i + 1].text;
+          i += 2;
+        } else {
+          i++; // `env -S` with no operand at all — nothing to collect
+        }
+        if (operand !== null) {
+          // Raw token texts, joined by one space. Quoting is NOT re-applied:
+          // the tokenizer already stripped it, and re-inventing it would be a
+          // second quoting grammar. The direction of that loss is safe — an
+          // over-wide payload can only make MORE text visible to the matcher
+          // (fail-closed), never hide a redirect operator.
+          const rest = segment.slice(i).map((t) => t.text);
+          payloads.push(rest.length > 0 ? [operand, ...rest].join(' ') : operand);
+          i = segment.length;
         }
-        i++;
         continue;
       }
       if (spec.shellFlags && spec.shellFlags.has(text)) { sawShellFlag = true; i++; continue; }
@@ -1189,15 +1236,65 @@ function dedupedSegmentPayloads(segment, resolved) {
   if (resolved.verb && DASH_C_SHELLS.has(resolved.verb)) {
     for (const p of dashCPayloads(segment, resolved.index)) payloadSet.add(p);
   }
+  addArgJoinedPayload(segment, resolved.verb, resolved.index, payloadSet);
   if (resolved.alt) {
     for (const p of resolved.alt.payloads) payloadSet.add(p);
     if (resolved.alt.verb && DASH_C_SHELLS.has(resolved.alt.verb)) {
       for (const p of dashCPayloads(segment, resolved.alt.index)) payloadSet.add(p);
     }
+    addArgJoinedPayload(segment, resolved.alt.verb, resolved.alt.index, payloadSet);
   }
   return [...payloadSet];
 }
 
+/**
+ * Interpreters that JOIN their remaining arguments with a space and execute the
+ * result — no `-c` flag, no wrapper option to key on (#1366).
+ *
+ * `eval` is the whole set today. It was already in SHELL_EXEC_INTERPRETERS, but
+ * that set only powers the QUOTED-TOKEN match in matchSegments — it never fed
+ * the payload traversal, so `eval 'echo x > CLAUDE.md'` carried a redirect no
+ * redirect rule ever saw (`resolveSegmentVerb` reports `payloads: []` for it).
+ *
+ * NAMED CEILING (BV-004): only a LITERAL payload is reachable. `eval "$CMD"` and
+ * `eval $(…)` do not exist as command text at hook time and stay in the existing
+ * `unresolved` class (#641). REVISIT TRIGGER: a second arg-joining interpreter
+ * showing up in a transcript census — extend the set, never special-case `eval`.
+ */
+const ARG_JOINING_INTERPRETERS = new Set(['eval']);
+
+/**
+ * Add the joined post-verb argument text as a recursion payload when `verb` is
+ * an arg-joining interpreter. No-op otherwise — every other caller shape keeps
+ * the pre-#1366 payload set byte-identical.
+ *
+ * Quoting is not re-applied for the same reason as the `env -S` tail (see
+ * resolveCore): the tokenizer stripped it, and a wider payload can only make
+ * more text visible to the matcher, never hide an operator.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @param {string|null} verb
+ * @param {number} index — the verb's token index (`-1` when unresolved)
+ * @param {Set<string>} payloadSet — mutated in place
+ */
+function addArgJoinedPayload(segment, verb, index, payloadSet) {
+  if (!verb || index < 0 || !ARG_JOINING_INTERPRETERS.has(verb)) return;
+  const words = [];
+  for (let i = index + 1; i < segment.length; i++) {
+    if (segment[i].redirect) {
+      // A redirect belongs to the SEGMENT (`eval 'x' > f` redirects eval's own
+      // stdout), never to the joined argv — the segment scan already reported
+      // it, and re-reporting it through the payload would duplicate the entry.
+      const end = redirectSpanEnd(segment, i);
+      if (end > i) i = end;
+      continue;
+    }
+    words.push(segment[i].text);
+  }
+  const joined = words.join(' ').trim();
+  if (joined.length > 0) payloadSet.add(joined);
+}
+
 /**
  * Match a blocked-pattern regex against tokenized chain segments — the shared
  * core of commandMatchesBlocked, recursion-capable for `-c` payloads (#982).
@@ -1347,6 +1444,37 @@ function collectRedirectTargets(segments, out, depth, budget) {
       out.push({ target: wa.value, mode: 'truncate', fd: null });
     }
 
+    // A VERB can name its write target as a bare operand, with no redirect
+    // operator and no wrapper flag: `dd of=CLAUDE.md` truncates CLAUDE.md while
+    // `> CLAUDE.md` is denied (measured ALLOW pre-#1366 against the real
+    // policy). Keyed on the RESOLVED verb, so `sudo dd of=X` is reached through
+    // the existing wrapper unwrap; both readings contribute, as above.
+    const seenVerbOperands = new Set();
+    for (const reading of resolved.alt ? [resolved, resolved.alt] : [resolved]) {
+      const spec = reading.verb ? VERB_FILE_OPERANDS.get(reading.verb) : null;
+      if (!spec || reading.index < 0) continue;
+      let operand = null;
+      let append = false;
+      for (let k = reading.index + 1; k < segment.length; k++) {
+        const text = segment[k].text;
+        if (segment[k].redirect) continue;
+        if (text.startsWith(spec.prefix)) operand = text.slice(spec.prefix.length);
+        else if (spec.appendRe?.test(text)) append = true;
+      }
+      if (operand === null || operand.length === 0) continue;
+      const mode = append ? 'append' : spec.mode;
+      const key = `${operand}:${mode}`;
+      if (seenVerbOperands.has(key)) continue;
+      seenVerbOperands.add(key);
+      if (/[$`]/.test(operand)) {
+        // Same fail-visible rule as a redirect operand (#983) — never guess at a
+        // variable or a command substitution, never silently drop it either.
+        out.push({ target: null, mode, fd: null, unresolved: true });
+        continue;
+      }
+      out.push({ target: operand, mode, fd: null });
+    }
+
     // Both readings of an ambiguous unknown flag contribute payloads (#1000),
     // UNIONED and de-duped (HIGH-2). Walking parse A only let
     // `env -Q x bash -c 'echo pwned > CLAUDE.md'` — which resolves to the
@@ -1684,6 +1812,32 @@ export function redirectRuleMatches(rule, command, opts = {}) {
   // an existing repo-relative rule, and a repo-relative entry still cannot
   // escape the root. An unexpandable `~` (no usable `home`) matches NOTHING —
   // fail-closed for the new class, since an unexpanded `~` names no file.
+  const compiled = compileTargetDenylist(denylist, home);
+  if (compiled.relRegexes.length === 0 && compiled.absRegexes.length === 0) return false;
+
+  for (const entry of extractRedirectTargets(command)) {
+    if (entry.unresolved) continue;
+    if (!modes.has(entry.mode)) continue;
+    if (targetMatchesDenylist(entry.target, compiled, repoRoot, home)) return true;
+  }
+  return false;
+}
+
+/**
+ * Compile a rule's `target-denylist` into the two glob classes described in
+ * `redirectRuleMatches` (#1362): repo-relative entries and home-anchored (`~/…`)
+ * entries. Extracted so a SECOND rule class can reuse the exact same compilation
+ * instead of growing a third copy of the glob logic (#1401) — the file already
+ * carries that warning at `findMatchedRedirectEntry` in the consuming hook.
+ *
+ * An unexpandable `~` (no usable `home`) contributes NOTHING — fail-closed for
+ * the home-anchored class, since an unexpanded `~` names no file.
+ *
+ * @param {string[]} denylist
+ * @param {string|undefined} home
+ * @returns {{ relRegexes: RegExp[], absRegexes: RegExp[] }}
+ */
+function compileTargetDenylist(denylist, home) {
   const relRegexes = [];
   const absRegexes = [];
   for (const pattern of denylist) {
@@ -1696,38 +1850,48 @@ export function redirectRuleMatches(rule, command, opts = {}) {
       relRegexes.push(redirectGlobToRegExp(text));
     }
   }
-  if (relRegexes.length === 0 && absRegexes.length === 0) return false;
-
-  for (const entry of extractRedirectTargets(command)) {
-    if (entry.unresolved) continue;
-    if (!modes.has(entry.mode)) continue;
+  return { relRegexes, absRegexes };
+}
 
-    if (absRegexes.length > 0) {
-      // A RELATIVE target is repo-root-relative here, exactly as the repo-relative
-      // class already treats it (#994 R1) — otherwise `> ../../.claude/projects/
-      // <enc>/memory/MEMORY.md` from the repo root names the very file the `~`
-      // spelling blocks, and only the spelling would be denied (measured
-      // 2026-09-13: relative `>`/`>>` ALLOW vs tilde/absolute BLOCK on one and
-      // the same resolved path). This resolves TARGETS, never ENTRIES: a
-      // repo-relative denylist entry keeps going through
-      // `repoRelativeRedirectTarget` below and still cannot reach out of the root.
-      const expandedTarget = expandLeadingHome(entry.target, home);
-      const absTarget = path.isAbsolute(expandedTarget)
-        ? expandedTarget
-        : repoRoot && path.isAbsolute(repoRoot)
-          ? path.resolve(repoRoot, expandedTarget)
-          : null;
-      if (absTarget !== null) {
-        const folded = foldAbsoluteTarget(absTarget);
-        if (absRegexes.some((re) => re.test(folded))) return true;
-      }
+/**
+ * Test ONE resolved target text against a compiled denylist.
+ *
+ * A RELATIVE target is repo-root-relative in BOTH classes, exactly as the
+ * repo-relative class already treats it (#994 R1) — otherwise
+ * `../../.claude/projects/<enc>/memory/MEMORY.md` from the repo root names the
+ * very file the `~` spelling blocks, and only the spelling would be denied
+ * (measured 2026-09-13: relative `>`/`>>` ALLOW vs tilde/absolute BLOCK on one
+ * and the same resolved path). This resolves TARGETS, never ENTRIES: a
+ * repo-relative denylist entry still goes through `repoRelativeRedirectTarget`
+ * and still cannot reach out of the root.
+ *
+ * @param {string} rawTarget — resolved target text (quotes already stripped)
+ * @param {{ relRegexes: RegExp[], absRegexes: RegExp[] }} compiled
+ * @param {string|null} repoRoot
+ * @param {string|undefined} home
+ * @returns {boolean}
+ */
+function targetMatchesDenylist(rawTarget, compiled, repoRoot, home) {
+  const { relRegexes, absRegexes } = compiled;
+
+  if (absRegexes.length > 0) {
+    const expandedTarget = expandLeadingHome(rawTarget, home);
+    const absTarget = path.isAbsolute(expandedTarget)
+      ? expandedTarget
+      : repoRoot && path.isAbsolute(repoRoot)
+        ? path.resolve(repoRoot, expandedTarget)
+        : null;
+    if (absTarget !== null) {
+      const folded = foldAbsoluteTarget(absTarget);
+      if (absRegexes.some((re) => re.test(folded))) return true;
     }
+  }
 
-    if (relRegexes.length > 0) {
-      const target = repoRelativeRedirectTarget(entry.target, repoRoot, home);
-      if (target !== null && relRegexes.some((re) => re.test(target))) return true;
-    }
+  if (relRegexes.length > 0) {
+    const target = repoRelativeRedirectTarget(rawTarget, repoRoot, home);
+    if (target !== null && relRegexes.some((re) => re.test(target))) return true;
   }
+
   return false;
 }
 
@@ -1747,6 +1911,217 @@ function foldAbsoluteTarget(abs) {
   );
 }
 
+/**
+ * Verbs that REMOVE or RELOCATE a file named as a bare operand (#1401).
+ *
+ * `mv` is here for BOTH of its operand roles: the SOURCE disappears from its
+ * path, and the DESTINATION is overwritten when it already exists — either one
+ * loses the file that was there. So every operand of these verbs is a candidate,
+ * with no source/destination distinction to get wrong.
+ *
+ * NAMED CEILING (BV-004) — measured 2026-09-19 against `splitChainSegments` +
+ * `resolveSegmentVerb`. COVERED, because the verb resolves through the existing
+ * machinery: bare `rm`/`mv`/`unlink`; `env X=1 rm …`, `sudo rm …`, `timeout 5 rm
+ * …`, `nohup`/`nice`/`stdbuf`/`command`/`exec` (WRAPPER_UNWRAP); every chain
+ * position (`;`, `&&`, `||`, `|`, `&`, newline) and compound-statement head
+ * (`do rm …`, `{ rm …; }` — COMMAND_POSITION_KEYWORDS); and the literal payload
+ * of `bash -c '…'` / `env -S '…'` / `eval '…'` via the shared payload recursion.
+ *
+ * NOT covered, deliberately, because the deleted path is not lexically an
+ * operand of a resolvable verb:
+ *   - `find … -delete` / `find … -exec rm {} \;` — the verb is `find`; its path
+ *     operand is a SEARCH ROOT, and treating a search root as a delete target
+ *     would also flag a pure `find … -print` over the same directory.
+ *   - `… | xargs rm` — the targets arrive on stdin and do not exist as command
+ *     text at hook time. `xargs` is deliberately NOT in WRAPPER_UNWRAP (see
+ *     there: unwrapping it could only LOOSEN the guard).
+ *   - `git rm <path>` — the verb is `git`; a git-subverb grammar is a separate
+ *     table. PSA-007 already bans `git rm` for dispatched subagents.
+ *   - in-process deletion (`node -e 'fs.unlinkSync(…)'`) — not redirect- or
+ *     operand-shaped; same class boundary the `redirect-harness-memory`
+ *     rationale draws for `tee -a` and `fs.appendFileSync`.
+ * REVISIT TRIGGER: any of those four shapes showing up in a real deletion
+ * incident or a transcript census — extend this set or add the sibling grammar,
+ * never special-case one command.
+ */
+const PATH_DESTRUCTIVE_VERBS = new Set(['rm', 'mv', 'unlink']);
+
+/**
+ * Recursive collector behind {@link extractDeleteTargets}. Mirrors
+ * collectRedirectTargets' structure — same segment walk, same dual-reading
+ * union, same depth/budget caps and the same fail-VISIBLE cut-off markers.
+ *
+ * @param {Array<Array<{ text: string, quoted: boolean, redirect?: object }>>} segments
+ * @param {Array<object>} out — accumulator
+ * @param {number} depth
+ * @param {{ remaining: number }} budget
+ */
+function collectDeleteTargets(segments, out, depth, budget) {
+  for (const segment of segments) {
+    const resolved = resolveSegmentVerb(segment);
+
+    // BOTH readings of an ambiguous unknown WRAPPER flag contribute (#1000),
+    // unioned and never replaced: `env -Q x rm .orchestrator/metrics/events.jsonl`
+    // resolves to the non-destructive verb `x` in parse A and to `rm` in parse B,
+    // while `sudo -n rm <file>` is the mirror case (parse B swallows `rm` as
+    // `-n`'s operand). Picking either reading alone drops one of the two.
+    const readings = resolved.alt ? [resolved, resolved.alt] : [resolved];
+    const seen = new Set();
+
+    for (const reading of readings) {
+      if (!reading.verb || reading.index < 0) continue;
+      if (!PATH_DESTRUCTIVE_VERBS.has(reading.verb)) continue;
+      // A verb that only exists inside a quoted token is inert literal text for
+      // this segment — same rule commandHasRecursiveForceRm applies. An
+      // interpreter's quoted payload is reached through the recursion below
+      // instead, where it is re-tokenized as the command it really is.
+      if (segment[reading.index].quoted) continue;
+
+      let seenDashDash = false;
+      for (let i = reading.index + 1; i < segment.length; i++) {
+        const tok = segment[i];
+        // A redirect operand is a filename the SHELL consumes, not an operand of
+        // the verb — `rm -f x > out.log` deletes `x`, it does not delete
+        // `out.log` (the redirect surface judges that one).
+        if (tok.redirect) { i = redirectSpanEnd(segment, i); continue; }
+        if (!seenDashDash && tok.text === '--') { seenDashDash = true; continue; }
+        // FLAG SKIPPING, and why this is the UNION of both flag readings rather
+        // than a pick (#1000 applied to the VERB's own options): an option table
+        // cannot enumerate every flag `rm`/`mv` may grow, and the two possible
+        // readings of an unknown one are "boolean" (the next word is an operand)
+        // and "value-taking" (the next word is the flag's value). The
+        // value-taking reading is a strict SUBSET of the boolean one here — it
+        // can only HIDE a word, never reveal one — so collecting under the
+        // boolean reading yields exactly the union of both. That is also the
+        // fail-closed direction: `mv -t .orchestrator/metrics/ x` reports the
+        // `-t` operand as a candidate (it IS a destination that can overwrite),
+        // where a value-taking reading would have swallowed it silently.
+        if (!seenDashDash && !tok.quoted && tok.text.startsWith('-') && tok.text !== '-') continue;
+
+        const key = `${reading.verb}\u0000${tok.text}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+
+        if (/[$`]/.test(tok.text)) {
+          // Variable indirection (`rm -f "$LEDGER"`) or command substitution:
+          // fail-visible, never guess (#983 rule, same direction).
+          out.push({
+            target: null, verb: reading.verb, unresolved: true, reason: 'variable/substitution',
+          });
+          continue;
+        }
+        out.push({ target: tok.text, verb: reading.verb });
+      }
+    }
+
+    // Literal `-c` / `env -S` / `eval` payload recursion — the same deduped
+    // union helper and the same shared budget the match and redirect surfaces
+    // use, so this traversal cannot be starved any differently than those.
+    const payloads = dedupedSegmentPayloads(segment, resolved);
+    if (payloads.length === 0) continue;
+
+    // A cap that drops payloads SILENTLY is a bypass, not a cap (#988 T2) —
+    // emit a marker so the consuming hook can surface it.
+    if (depth >= MAX_PAYLOAD_DEPTH) {
+      out.push({ target: null, verb: null, unresolved: true, reason: 'depth-exceeded' });
+      continue;
+    }
+    for (const payload of payloads) {
+      if (budget.remaining <= 0) {
+        out.push({ target: null, verb: null, unresolved: true, reason: 'budget-exhausted' });
+        break;
+      }
+      budget.remaining -= 1;
+      const subTokens = tokenizeCommand(
+        normalizeShellWhitespaceExpansions(payload, { expandSingleQuoted: true }),
+      );
+      collectDeleteTargets(splitSegments(subTokens), out, depth + 1, budget);
+    }
+  }
+}
+
+/**
+ * Extract every path a command names as an operand of a file-destroying verb
+ * (`rm`, `mv`, `unlink` — see {@link PATH_DESTRUCTIVE_VERBS} for the covered and
+ * uncovered shapes), across all chain segments and literal shell payloads (#1401).
+ *
+ * This is the DELETE/RENAME sibling of `extractRedirectTargets`: that one answers
+ * "which file does this command WRITE", this one "which file does it REMOVE or
+ * MOVE". They are separate surfaces because a redirect target and a verb operand
+ * are different grammar positions — `rm -f x > out.log` names one of each, and
+ * the guard's 53,896-line telemetry loss (#1401) happened because only the write
+ * surface was ever consulted.
+ *
+ * Entry shapes:
+ *   - `{ target: string, verb: 'rm'|'mv'|'unlink' }` — resolved operand, quotes
+ *     stripped by the tokenizer.
+ *   - `{ target: null, verb, unresolved: true, reason: 'variable/substitution' }`
+ *     — the operand carries a variable or a command substitution. Reported
+ *     fail-visible; never a match candidate (#641 FP class).
+ *   - `{ target: null, verb: null, unresolved: true,
+ *      reason: 'budget-exhausted'|'depth-exceeded' }` — a payload subtree was NOT
+ *     traversed because a recursion cap cut it off (#988 T2).
+ *
+ * @param {string} command
+ * @returns {Array<{ target: string|null, verb: string|null, unresolved?: boolean, reason?: string }>}
+ */
+export function extractDeleteTargets(command) {
+  if (typeof command !== 'string' || command.length === 0) return [];
+  const out = [];
+  const segments = splitSegments(tokenizeCommand(normalizeShellWhitespaceExpansions(command)));
+  collectDeleteTargets(segments, out, 0, { remaining: MAX_PAYLOAD_EVALUATIONS });
+  return out;
+}
+
+/**
+ * Return the FIRST collected delete/rename target a `path-delete` policy rule's
+ * `target-denylist` matches, or `null` when none does (#1401).
+ *
+ * Returns the ENTRY, not a boolean, so the consuming hook can name the verb and
+ * the target in its deny reason without re-probing through a boolean matcher —
+ * the workaround `findMatchedRedirectEntry` needs, and which its own docblock
+ * flags as one copy too many.
+ *
+ * Takes pre-collected `entries` rather than the raw command so the hook
+ * tokenizes ONCE (it needs the same array for the unresolved-marker notices).
+ *
+ * PER-TARGET, never per-command: every entry is judged on its own, so a sibling
+ * operand that is NOT on the denylist can never lift the verdict for one that
+ * is. `rm -f .orchestrator/tmp/ok .orchestrator/metrics/events.jsonl` matches on
+ * the second operand — the exemption is the ABSENCE of a denylist entry for
+ * `.orchestrator/tmp/**`, never a whole-command escape clause. That shape is the
+ * #1106 hole (`guard-design.md` § "Widening a matcher without narrowing its
+ * bypass"), where an appended exempt statement lifted the verdict for the whole
+ * command; it is structurally unreachable here.
+ *
+ * Denylist semantics (globs, the two classes, `~` handling, case-folding,
+ * repo-root relativization) are IDENTICAL to `redirectRuleMatches` — both call
+ * `compileTargetDenylist` / `targetMatchesDenylist`, so the two rule classes can
+ * never drift apart on what a pattern means.
+ *
+ * @param {{ 'target-denylist'?: string[] }} rule
+ * @param {Array<{ target: string|null, verb: string|null, unresolved?: boolean }>} entries
+ * @param {{ repoRoot?: string|null, home?: string|undefined }} [opts]
+ * @returns {{ target: string, verb: string }|null}
+ */
+export function firstDeniedDeleteTarget(rule, entries, opts = {}) {
+  const { repoRoot = null, home = process.env.HOME } = opts;
+  if (!rule || !Array.isArray(entries) || entries.length === 0) return null;
+  const denylist = Array.isArray(rule['target-denylist']) ? rule['target-denylist'] : [];
+  if (denylist.length === 0) return null;
+
+  const compiled = compileTargetDenylist(denylist, home);
+  if (compiled.relRegexes.length === 0 && compiled.absRegexes.length === 0) return null;
+
+  for (const entry of entries) {
+    if (entry.unresolved || typeof entry.target !== 'string') continue;
+    if (targetMatchesDenylist(entry.target, compiled, repoRoot, home)) {
+      return { target: entry.target, verb: entry.verb };
+    }
+  }
+  return null;
+}
+
 /**
  * Test whether a command string contains a blocked pattern with shell-aware
  * boundaries AND a quoted-payload guard (#641).

package/scripts/lib/config/dialectic.mjs

@@ -14,6 +14,15 @@ import { preprocessBlockLines } from './block-preprocess.mjs';
 
 const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
 
+/**
+ * Default `dialectic.budget-tokens` — the INPUT ceiling of one derivation call
+ * (SSOT; `scripts/dialectic-deriver.mjs` `DEFAULT_BUDGET.input` imports it).
+ * It is an upper bound the pre-dispatch estimate aborts on, not a spend: card
+ * bodies + steering alone estimated ~12k tokens here and ~30k in a consumer
+ * repo, so the former default of 8000 aborted real runs (#1380).
+ */
+export const DEFAULT_BUDGET_TOKENS = 32000;
+
 /**
  * Parse the top-level `dialectic:` YAML block from markdown content.
  * Independent of the `## Session Config` section boundary.
@@ -21,7 +30,7 @@ const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
  * Defaults:
  *   cadence:       5 (integer ≥ 0 — session count between auto-runs; 0 = disabled)
  *   model:         'haiku'
- *   budget-tokens: 8000 (integer ≥ 0)
+ *   budget-tokens: DEFAULT_BUDGET_TOKENS (32000, integer ≥ 0)
  *
  * Throws if `model` is present but not one of haiku|sonnet|opus.
  *
@@ -29,7 +38,7 @@ const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
  * @returns {{ cadence: number, model: string, "budget-tokens": number }}
  */
 export function _parseDialectic(content) {
-  const defaults = { cadence: 5, model: 'haiku', 'budget-tokens': 8000 };
+  const defaults = { cadence: 5, model: 'haiku', 'budget-tokens': DEFAULT_BUDGET_TOKENS };
 
   const lines = preprocessBlockLines(content);
   let inBlock = false;
@@ -49,7 +58,7 @@ export function _parseDialectic(content) {
 
   let cadence = 5;
   let model = 'haiku';
-  let budgetTokens = 8000;
+  let budgetTokens = DEFAULT_BUDGET_TOKENS;
 
   for (const rawLine of blockLines) {
     const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');

package/scripts/lib/config/drift-check.mjs

@@ -5,6 +5,25 @@ import { preprocessBlockLines } from './block-preprocess.mjs';
  * drift-check.mjs — Parser for the top-level `drift-check:` YAML block.
  *
  * Ported from config-yaml-parser.sh (v2).
+ *
+ * SCOPE NOTE — this file parses FLAGS ONLY; it implements no check. The
+ * `check-command-count` flag below toggles the `command-count` surface in
+ * `skills/claude-md-drift-check/checker.mjs`, which is where the counting lives.
+ *
+ * `command-count` STAYS on `ls commands/*.md | wc -l` on purpose. The checker is
+ * GENERIC over any consumer repo, where a slash command still IS a
+ * `commands/*.md` file. The 2026-09-16 command→skill fold (#1370) is a fact
+ * about THIS plugin — 24 command files folded into their same-named
+ * `skills/<name>/SKILL.md` behind an explicit `user-invocable: true` — so
+ * teaching the shared checker that union would mis-measure every repo that never
+ * folded. `scripts/site-numbers.mjs` `countCommands()` carries the union for this
+ * plugin's own tile, and names the divergence in its docblock.
+ *
+ * CONSEQUENCE for THIS repo, left deliberately visible rather than papered over:
+ * a prose claim of the shape "N commands" / "N slash commands" in a
+ * drift-check-scanned doc is compared against the `commands/` listing (2 after
+ * the fold), so such a claim must either be dropped or reworded off the
+ * `\b(\d+)\s+(?:\/)?commands?\b` pattern the checker matches.
  */
 
 /**

package/scripts/lib/config/gate.mjs

@@ -0,0 +1,74 @@
+import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
+
+/**
+ * gate.mjs — Parser for the top-level `gate:` YAML block
+ * (PRD `docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md` §4 A3,
+ * Epic #1425 / issue #1432).
+ *
+ * Holds the wall-clock ceiling for GATE PATH B — the
+ * `scripts/run-quality-gate.mjs` → `scripts/lib/gates/gate-*.mjs` route, which
+ * had NO timeout at all before #1425 A3. Path A (`scripts/lib/quality-gate.mjs`)
+ * keeps its own `SO_GATE_TIMEOUT_MS` operator override; this block sets the
+ * COMMITTED default for path B so both paths may run equally long.
+ *
+ * Precedence in `run-quality-gate.mjs`: `SO_GATE_TIMEOUT_MS` (operator, wins) >
+ * this committed value > `DEFAULT_GATE_TIMEOUT_MS` (900 000).
+ *
+ * Tolerant parser: malformed values silently fall back to the default.
+ *
+ * Returns `{ 'timeout-path-b-ms': number }`.
+ */
+
+/** 900 000 ms (15 min) — same ceiling as `GATE_TIMEOUT_MS` on path A (PRD §4). */
+const DEFAULT_TIMEOUT_PATH_B_MS = 900_000;
+
+/**
+ * Parse the top-level `gate:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * @param {string} content — full file contents
+ * @returns {{'timeout-path-b-ms': number}}
+ */
+export function _parseGate(content) {
+  let timeoutPathBMs = DEFAULT_TIMEOUT_PATH_B_MS;
+
+  const lines = preprocessBlockLines(content);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'gate')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    if (k === 'timeout-path-b-ms') {
+      // A zero or negative ceiling would kill every command instantly — the
+      // failure mode is worse than the uncapped state this key exists to fix,
+      // so it falls back to the default rather than being honoured.
+      if (/^-?\d+$/.test(v)) {
+        const n = Number.parseInt(v, 10);
+        if (Number.isFinite(n) && n > 0) timeoutPathBMs = n;
+      }
+    }
+  }
+
+  return { 'timeout-path-b-ms': timeoutPathBMs };
+}