agentwire-dev 1.81.1__tar.gz → 1.82.0__tar.gz

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentwire-dev
-Version: 1.81.1
+Version: 1.82.0
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev
@@ -228,7 +228,7 @@ Requires-Dist: aiohttp-jinja2>=1.6
 Requires-Dist: aiohttp>=3.13.4
 Requires-Dist: av>=12.0.0
 Requires-Dist: certifi>=2026.10.23
-Requires-Dist: damage-control-dev<0.5,>=0.4.1
+Requires-Dist: damage-control-dev<0.6,>=0.5.1
 Requires-Dist: fastapi>=0.104.0
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: kokoro-onnx>=0.4.9; python_version < '3.14'

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/RELEASING.md

@@ -6,7 +6,7 @@ Every release does **both** a PyPI publish and a GitHub release. The **GitHub re
 
 ## The engine is a separate project (single source)
 
-The damage-control engine has exactly one source: the `damage-control-dev` repo (<https://github.com/dotdevdotdev/damage-control-dev>), published on PyPI. `agentwire-dev` only *consumes* it through the range in `pyproject.toml` (currently `damage-control-dev>=0.4.1,<0.5`); a checkout and a PyPI install both resolve it from PyPI. There is no copy of the engine in this repo and nothing to release from here. `tests/unit/test_damage_control_pin.py` checks that the declared floor/ceiling parse and that the installed engine satisfies them.
+The damage-control engine has exactly one source: the `damage-control-dev` repo (<https://github.com/dotdevdotdev/damage-control-dev>), published on PyPI. `agentwire-dev` only *consumes* it through the range in `pyproject.toml` (currently `damage-control-dev>=0.5.1,<0.6`); a checkout and a PyPI install both resolve it from PyPI. There is no copy of the engine in this repo and nothing to release from here. `tests/unit/test_damage_control_pin.py` checks that the declared floor/ceiling parse and that the installed engine satisfies them.
 
 To ship an engine change:
 

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.81.1"
+__version__ = "1.82.0"

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/corpus/cases/relative_paths.yaml

@@ -191,11 +191,11 @@
   context:
     cwd: /golden/elsewhere
   expect:
-    decision: allow
+    decision: ask
     protected: false
   class: relative-path-operand
   tags:
-  - stays-allowed
+  - settings-write-ask
   source: tests/unit/test_relative_path_operands.py::CASES
 - id: relative-path-operand-018
   tool: Bash
@@ -227,11 +227,11 @@
   context:
     cwd: /golden/elsewhere
   expect:
-    decision: allow
+    decision: ask
     protected: false
   class: relative-path-operand
   tags:
-  - stays-allowed
+  - settings-write-ask
   source: tests/unit/test_relative_path_operands.py::CASES
 - id: relative-path-operand-021
   tool: Bash
@@ -239,11 +239,11 @@
   context:
     cwd: /golden/home
   expect:
-    decision: allow
+    decision: ask
     protected: false
   class: relative-path-operand
   tags:
-  - stays-allowed
+  - settings-write-ask
   source: tests/unit/test_relative_path_operands.py::CASES
 - id: relative-path-operand-022
   tool: Bash

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/corpus/golden/effective_rules.json

@@ -43,6 +43,10 @@
   "{\"anchored\": true, \"ask\": true, \"id\": \"agentwire.tmux-kill-session-a-kills-all-except-current\", \"pattern\": \"\\\\btmux\\\\s+kill-session\\\\s+.*-a\\\\b\"}",
   "{\"anchored\": true, \"ask\": true, \"id\": \"container.docker-push\", \"pattern\": \"\\\\bdocker\\\\s+(compose\\\\s+)?push\\\\b\"}",
   "{\"anchored\": true, \"ask\": true, \"id\": \"container.kubectl-delete\", \"pattern\": \"\\\\bkubectl\\\\s+delete\\\\b\"}",
+  "{\"anchored\": true, \"ask\": true, \"id\": \"control-plane.claude-nested-config-dir\", \"pattern\": \"\\\\bclaude\\\\s+--dc:config-dir\\\\b\"}",
+  "{\"anchored\": true, \"ask\": true, \"id\": \"control-plane.claude-nested-partial-sources\", \"pattern\": \"\\\\bclaude\\\\s+--dc:partial-sources\\\\b\"}",
+  "{\"anchored\": true, \"ask\": true, \"id\": \"control-plane.claude-nested-plugin-dir\", \"pattern\": \"\\\\bclaude\\\\s+--dc:plugin-dir\\\\b\"}",
+  "{\"anchored\": true, \"ask\": true, \"id\": \"control-plane.claude-nested-settings-file\", \"pattern\": \"\\\\bclaude\\\\s+--dc:settings-file\\\\b\"}",
   "{\"anchored\": true, \"ask\": true, \"id\": \"core.crontab-install\", \"pattern\": \"(?<![\\\\w.-])(?<!\\\\./)crontab(?=[\\\\s;&|)`]|$)(?![^;&|]*\\\\s(?:-[A-Za-z]*l[A-Za-z]*|--list|-V|--version)(?=[\\\\s;&|)`]|$))\"}",
   "{\"anchored\": true, \"ask\": true, \"id\": \"core.kill-sigkill\", \"pattern\": \"\\\\bkill\\\\s+(?:(?!--(?:\\\\s|$))[^\\\\s;&|]+\\\\s+)*?(?:-(?:9|KILL|SIGKILL)|-s\\\\s*(?:9|KILL|SIGKILL)|-n\\\\s+9|--signal[=\\\\s]\\\\s*(?:9|KILL|SIGKILL))(?=[\\\\s;&|)`]|$)\", \"pattern_src\": \"\\\\bkill\\\\s+{ARGS}(?:-(?:9|KILL|SIGKILL)|-s\\\\s*(?:9|KILL|SIGKILL)|-n\\\\s+9|--signal[=\\\\s]\\\\s*(?:9|KILL|SIGKILL))(?=[\\\\s;&|)`]|$)\"}",
   "{\"anchored\": true, \"ask\": true, \"id\": \"core.rsync-delete\", \"pattern\": \"\\\\brsync\\\\s+(?:(?!--(?:\\\\s|$))[^\\\\s;&|]+\\\\s+)*?--(?:del|delete[a-z-]*|remove-(?:source|sent)-files)(?=[\\\\s=;&|)`]|$)\", \"pattern_src\": \"\\\\brsync\\\\s+{ARGS}--(?:del|delete[a-z-]*|remove-(?:source|sent)-files)(?=[\\\\s=;&|)`]|$)\"}",
@@ -232,6 +236,10 @@
   "{\"anchored\": true, \"id\": \"containers.kubectl-delete-across-all-namespaces\", \"pattern\": \"\\\\bkubectl\\\\s+delete\\\\s+.*--all\\\\s+--all-namespaces\"}",
   "{\"anchored\": true, \"id\": \"containers.kubectl-delete-all-all\", \"pattern\": \"\\\\bkubectl\\\\s+delete\\\\s+(?=(?:[^;&|]*\\\\s)?--all(?=[\\\\s;&|)`]|$))(?=(?:[^;&|]*\\\\s)?all(?=[\\\\s;&|)`]|$))\", \"pattern_src\": \"\\\\bkubectl\\\\s+delete\\\\s+(?=(?:[^;&|]*\\\\s)?--all(?=[\\\\s;&|)`]|$))(?=(?:[^;&|]*\\\\s)?all(?=[\\\\s;&|)`]|$))\"}",
   "{\"anchored\": true, \"id\": \"containers.kubectl-delete-namespace\", \"pattern\": \"\\\\bkubectl\\\\s+delete\\\\s+namespace\\\\b\"}",
+  "{\"anchored\": true, \"id\": \"control-plane.claude-nested-bare\", \"pattern\": \"\\\\bclaude\\\\s+--dc:bare\\\\b\"}",
+  "{\"anchored\": true, \"id\": \"control-plane.claude-nested-disable-all-hooks\", \"pattern\": \"\\\\bclaude\\\\s+--dc:disable-all-hooks\\\\b\"}",
+  "{\"anchored\": true, \"id\": \"control-plane.claude-nested-no-user-scope\", \"pattern\": \"\\\\bclaude\\\\s+--dc:no-user-scope\\\\b\"}",
+  "{\"anchored\": true, \"id\": \"control-plane.claude-nested-safe-mode\", \"pattern\": \"\\\\bclaude\\\\s+--dc:safe-mode\\\\b\"}",
   "{\"anchored\": true, \"id\": \"core.chmod-777-world-writable\", \"pattern\": \"\\\\bchmod\\\\s+(?:-[^\\\\s;&|]*\\\\s+)*(?:--\\\\s+)?0?777\\\\b\"}",
   "{\"anchored\": true, \"id\": \"core.clearing-shell-history\", \"pattern\": \"\\\\bhistory\\\\s+-c\\\\b\"}",
   "{\"anchored\": true, \"id\": \"core.dd-writing-to-device\", \"pattern\": \"\\\\bdd\\\\s+.*of=/dev/\"}",

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/corpus/golden/rule_ids.json

@@ -43,6 +43,14 @@
  "containers.kubectl-delete-across-all-namespaces",
  "containers.kubectl-delete-all-all",
  "containers.kubectl-delete-namespace",
+ "control-plane.claude-nested-bare",
+ "control-plane.claude-nested-config-dir",
+ "control-plane.claude-nested-disable-all-hooks",
+ "control-plane.claude-nested-no-user-scope",
+ "control-plane.claude-nested-partial-sources",
+ "control-plane.claude-nested-plugin-dir",
+ "control-plane.claude-nested-safe-mode",
+ "control-plane.claude-nested-settings-file",
  "core.chmod-777-world-writable",
  "core.clearing-shell-history",
  "core.crontab-install",

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/corpus/golden/snapshot.json

@@ -135,7 +135,7 @@
   "audit": 8,
   "engine": 1830,
   "engine_by_platform": 8,
-  "hooks": 1019,
+  "hooks": 1025,
   "hooks_by_platform": 6
  },
  "engine": {
@@ -3356,10 +3356,10 @@
    "unverifiable": false
   },
   "[\"Bash\", \"cd /golden/elsewhere && echo x > .claude/settings.json\", \"/golden/home\", \"default\", \"/golden/home\"]": {
-   "decision": "allow",
+   "decision": "ask",
    "protected": false,
-   "rule_id": null,
-   "unverifiable": false
+   "rule_id": "core.settings-write",
+   "unverifiable": true
   },
   "[\"Bash\", \"cd /golden/elsewhere && echo x > .claude/settings.json\", \"/golden/home\", \"kill-switch-off\", \"/golden/home\"]": {
    "decision": "allow",
@@ -6368,10 +6368,10 @@
    "unverifiable": false
   },
   "[\"Bash\", \"echo x > .claude/settings.json  # ask: because\", \"/golden/home\", \"default\", \"/golden/elsewhere\"]": {
-   "decision": "allow",
+   "decision": "ask",
    "protected": false,
-   "rule_id": null,
-   "unverifiable": false
+   "rule_id": "core.settings-write",
+   "unverifiable": true
   },
   "[\"Bash\", \"echo x > .claude/settings.json  # ask: because\", \"/golden/home\", \"default\", \"/golden/home\"]": {
    "decision": "block",
@@ -6392,10 +6392,10 @@
    "unverifiable": false
   },
   "[\"Bash\", \"echo x > .claude/settings.json\", \"/golden/home\", \"default\", \"/golden/elsewhere\"]": {
-   "decision": "allow",
+   "decision": "ask",
    "protected": false,
-   "rule_id": null,
-   "unverifiable": false
+   "rule_id": "core.settings-write",
+   "unverifiable": true
   },
   "[\"Bash\", \"echo x > .claude/settings.json\", \"/golden/home\", \"default\", \"/golden/home\"]": {
    "decision": "block",
@@ -12723,12 +12723,24 @@
    "exit": 2,
    "rule_id": "core.zero-access-path"
   },
+  "[\"Bash\", \"cd /golden/elsewhere && echo x > .claude/settings.json\", \"/golden/home\", \"bypass\", \"/golden/home\"]": {
+   "audit": "asked",
+   "decision": "ask",
+   "exit": 0,
+   "rule_id": null
+  },
   "[\"Bash\", \"cd /golden/elsewhere && echo x > .claude/settings.json\", \"/golden/home\", \"interactive\", \"/golden/home\"]": {
-   "audit": "allowed",
-   "decision": "allow",
+   "audit": "asked",
+   "decision": "ask",
    "exit": 0,
    "rule_id": null
   },
+  "[\"Bash\", \"cd /golden/elsewhere && echo x > .claude/settings.json\", \"/golden/home\", \"unattended\", \"/golden/home\"]": {
+   "audit": "blocked",
+   "decision": "block",
+   "exit": 2,
+   "rule_id": "core.settings-write"
+  },
   "[\"Bash\", \"cd /tmp && echo hi\", \"/golden/home\", \"interactive\"]": {
    "audit": "allowed",
    "decision": "allow",
@@ -14265,9 +14277,15 @@
    "exit": 2,
    "rule_id": "core.protected-control-plane"
   },
+  "[\"Bash\", \"echo x > .claude/settings.json  # ask: because\", \"/golden/home\", \"bypass\", \"/golden/elsewhere\"]": {
+   "audit": "asked",
+   "decision": "ask",
+   "exit": 0,
+   "rule_id": null
+  },
   "[\"Bash\", \"echo x > .claude/settings.json  # ask: because\", \"/golden/home\", \"interactive\", \"/golden/elsewhere\"]": {
-   "audit": "allowed",
-   "decision": "allow",
+   "audit": "asked",
+   "decision": "ask",
    "exit": 0,
    "rule_id": null
   },
@@ -14277,9 +14295,21 @@
    "exit": 2,
    "rule_id": "core.protected-control-plane"
   },
+  "[\"Bash\", \"echo x > .claude/settings.json  # ask: because\", \"/golden/home\", \"unattended\", \"/golden/elsewhere\"]": {
+   "audit": "blocked",
+   "decision": "block",
+   "exit": 2,
+   "rule_id": "core.settings-write"
+  },
+  "[\"Bash\", \"echo x > .claude/settings.json\", \"/golden/home\", \"bypass\", \"/golden/elsewhere\"]": {
+   "audit": "asked",
+   "decision": "ask",
+   "exit": 0,
+   "rule_id": null
+  },
   "[\"Bash\", \"echo x > .claude/settings.json\", \"/golden/home\", \"interactive\", \"/golden/elsewhere\"]": {
-   "audit": "allowed",
-   "decision": "allow",
+   "audit": "asked",
+   "decision": "ask",
    "exit": 0,
    "rule_id": null
   },
@@ -14289,6 +14319,12 @@
    "exit": 2,
    "rule_id": "core.protected-control-plane"
   },
+  "[\"Bash\", \"echo x > .claude/settings.json\", \"/golden/home\", \"unattended\", \"/golden/elsewhere\"]": {
+   "audit": "blocked",
+   "decision": "block",
+   "exit": 2,
+   "rule_id": "core.settings-write"
+  },
   "[\"Bash\", \"echo x > .config/gh/hosts.yml\", \"/golden/home\", \"interactive\", \"/golden/home\"]": {
    "audit": "blocked",
    "decision": "block",

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/pyproject.toml

@@ -29,7 +29,7 @@ dependencies = [
     # PyPI. Engine changes land there, release there, then raise this floor.
     # tests/unit/test_damage_control_pin.py checks the range and the installed engine.
     # Hooks run `python -I -m damage_control.hook`.
-    "damage-control-dev>=0.4.1,<0.5",
+    "damage-control-dev>=0.5.1,<0.6",
     "aiohttp>=3.13.4",  # >=3.13.4 clears CVE-2026-34515 + CVE-2026-34513 (portal-facing)
     "aiohttp-jinja2>=1.6",
     "jinja2>=3.1.0",

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/tests/unit/test_policy_ladder.py

@@ -41,6 +41,7 @@ def make_engine(finding=None, grants=(), profile=GENERIC, **overrides):
         check_read_path=lambda path, config: (False, ""),
         check_path=lambda path, config: (False, ""),
         check_protected_path=lambda path, allowed: (False, ""),
+        _path_forms=lambda path: [path],
         check_mcp_tool=lambda name, config: {"decision": "allow", "reason": "", "id": None, "mutates": None},
         ScanBudgetExceeded=type("ScanBudgetExceeded", (BaseException,), {}),
     )

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/tests/unit/test_powershell_matcher.py

@@ -10,7 +10,7 @@ def test_the_bash_hook_judges_a_powershell_call_exactly_like_a_bash_call(run_hoo
 
     got = {
         (tool, cmd): verdict(tool, cmd)
-        for tool in ("Bash", "PowerShell")
+        for tool in ("Bash", "PowerShell", "Monitor")
         for cmd in ("rm -rf /agentwire-selftest", "echo hi")
     }
     assert got == {
@@ -18,9 +18,11 @@ def test_the_bash_hook_judges_a_powershell_call_exactly_like_a_bash_call(run_hoo
         ("PowerShell", "rm -rf /agentwire-selftest"): 2,
         ("Bash", "echo hi"): 0,
         ("PowerShell", "echo hi"): 0,
+        ("Monitor", "rm -rf /agentwire-selftest"): 2,
+        ("Monitor", "echo hi"): 0,
     }
     # a tool the hook does not gate is still ignored
-    assert verdict("Monitor", "rm -rf /agentwire-selftest") == 0
+    assert verdict("NotATool", "rm -rf /agentwire-selftest") == 0
 
 
 def test_the_outcome_logger_matches_the_powershell_tool_too():

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/tests/unit/test_relative_path_operands.py

@@ -49,10 +49,10 @@ CASES = [
     (FAKE_HOME, "echo x >> .bash_history", "block"),
     (ELSEWHERE, "cd ~ && cat .ssh/id_rsa", "block"),
     # what a relative name means depends on where it runs
-    (ELSEWHERE, "echo x > .claude/settings.json", "allow"),
+    (ELSEWHERE, "echo x > .claude/settings.json", "ask"),
     (ELSEWHERE, "cat .ssh/id_rsa", "allow"),
     (ELSEWHERE, "rm .claude/notes.txt", "allow"),
-    (FAKE_HOME, "cd " + ELSEWHERE + " && echo x > .claude/settings.json", "allow"),
+    (FAKE_HOME, "cd " + ELSEWHERE + " && echo x > .claude/settings.json", "ask"),
 ]
 
 

{agentwire_dev-1.81.1 → agentwire_dev-1.82.0}/tests/unit/test_safety_packs.py

@@ -4,6 +4,7 @@ The hooks read ``packs:`` / ``disabled_groups:`` from the policy file on every c
 enabling or disabling takes effect on the next tool call and touches no file on disk.
 """
 
+import hashlib
 import shutil
 from types import SimpleNamespace
 
@@ -46,15 +47,22 @@ def decisions():
 
 
 def install_old_layout():
-    """What every pre-package machine looks like: ALL bundled files copied into the overlay, no `packs:` key."""
+    """What every pre-package machine looks like: every bundled file copied into the overlay, no `packs:` key.
+
+    Only content a pre-package release could have shipped (a hash in the frozen baselines): the engine
+    keeps adding rule content (0.5.0's nested-claude rules), and no old machine holds a copy of that.
+    """
+    shipped = safety_migrate.load_baselines()
     sources = {
         safety_commands.RULES_DIR: [p for d in engine.bundled_rule_sources() for p in d.glob("*.yaml")],
         safety_commands.TOOLDEFS_DIR: list(engine.bundled_tooldefs_dir().glob("*.yaml")),
     }
     for target, files in sources.items():
         target.mkdir(parents=True, exist_ok=True)
+        section = "rules" if target == safety_commands.RULES_DIR else "tooldefs"
         for path in files:
-            shutil.copy(path, target / path.name)
+            if hashlib.sha256(path.read_bytes()).hexdigest() in shipped[section].get(path.name, []):
+                shutil.copy(path, target / path.name)
     safety_commands.DAMAGECONTROL_FILE.write_text("enabled: true\n")