4 people 1ac7817ff3 fix(shellsafe): unify command effect classification / 统一命令效果分类并修复只读误判 (#8417) ...

* refactor(shellsafe): classify durable command effects

Problem: Boolean read-only tables could not distinguish observational and mutating forms of the same command family, so policy and permission consumers drifted.

Root cause: Argument-sensitive checks lived in individual consumers and unknown commands collapsed into one mutation bit.

Fix: Add a shared fail-closed CommandEffect model with parameter-aware Git, date, Go, npm, and Cargo rules, and migrate Bash permission reads to it.

Verification: go test ./internal/shellsafe ./internal/permission

* refactor(evidence): separate durable tool effects

Problem: One mutation boolean simultaneously drove TaskPolicy, workspace serialization, batch recovery, and delivery content debt.

Root cause: Repository metadata writes and content writes were indistinguishable, while evidence duplicated shell argument checks.

Fix: Add ToolEffects projections, derive Bash effects from shellsafe, keep conventional verifiers non-mutating, and make receipts track content mutation only.

Verification: go test ./internal/evidence ./internal/recovery

* refactor(runtime): consume shared tool effects

Problem:
Runtime policy boundaries overloaded schema read-only and mutation booleans, so repository metadata, workspace content, and host state could receive contradictory treatment.

Root cause:
Permission, TaskPolicy, Auto Guard, delivery evidence, workspace leases, proxy resolution, and desktop invalidation projected different semantics from the same call.

Fix:
Carry ToolEffects through the resolved tool plan, reclassify proxy targets before commit or execution, separate state/workspace/content/repository consumers, and promote observed file changes before recording evidence.

Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent ./internal/recovery ./internal/checkpoint

* fix(agent): make mutation barriers effect-aware

Problem:
A failed reader could be treated like a failed mutation, while dependency messages hid which safe write domain caused the batch to stop.

Root cause:
Batch preclassification and post-execution failure handling mixed schema read-only, a coarse mutation fallback, and a bare atomic boolean.

Fix:
Store an immutable sanitized barrier cause, classify static and resolved calls through ToolEffects, keep readers running, and skip only later state writers or verifiers with structured not-run metadata.

Verification:
go test ./internal/agent -run 'TestBatchDependencyBarrier|TestDependentMutationSkippedAfterFailedWriterInBatch|TestToolBeforeFailedWriterReplacementOpensDependencyBarrier'

* test(shellsafe): share command effect matrix

Problem:
Dual-mode command regressions could recur when shellsafe, permission, evidence, and agent tests encoded separate expectations.

Root cause:
There was no shared cross-boundary corpus for certainty, write domains, permission readers, content evidence, TaskPolicy, and batch barriers.

Fix:
Add one testdata matrix consumed across all four boundaries, cover representative read/write/unknown compositions, and make legacy read-only tables private behind compatibility adapters.

Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent -run 'SharedCommandEffectMatrix|ConsumesSharedCommandEffectMatrix|ClassifyBashCommandEffects'

* refactor(runtime): isolate effect projections

Problem:
The complete command-effect change pushed several historically large files beyond the repository's no-growth lint budgets and duplicated focused tests inside an oversized ledger test file.

Root cause:
New effect projection, checkpoint comparison, and tool-plan state lived beside unrelated legacy responsibilities.

Fix:
Extract those responsibilities into focused files, compact internal helpers, and keep legacy adapters as thin documented projections without changing behavior.

Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/checkpoint ./internal/agent ./internal/recovery
make lint

* fix(runtime): absorb related command-effect PR mechanisms

Problem:
The rebased shell-effect work still missed sibling PR mechanisms and the
git config editor hole.

Root cause:
Fail-closed lifecycle cases, env-prefixed verifiers, and question-keyed
read novelty lived on other branches. classifyGitConfig treated --edit as
a reader.

Fix:
Absorb #7760 matrix rows, #8012 env-prefix verification via ParseStaticCommand,
and #8407 noteQuestion scoring. Keep git config --edit as a writer. Leave
#8614 ExecutionEnv and #8404 runway out of this PR.

Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/checkpoint ./internal/recovery ./internal/agent
go test -race ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent

Co-authored-by: Wooseong Kim <[email protected]>
Co-authored-by: lbx13 <[email protected]>
Co-authored-by: yhh <[email protected]>

* test(evidence): keep command-effect cases out of the oversized ledger test

Problem:
CI lint failed because three command-effect cases were added to
internal/evidence/evidence_test.go, which is already over the test-file-size
ratchet.

Root cause:
The new ToolCallMutates rows lived in the historical ledger test file instead
of the focused effect projection tests.

Fix:
Move the env-prefixed verifier case into effects_test.go. Branch listing and
pure-commit contracts were already covered there.

Verification:
go test ./internal/evidence -run 'TestToolCallMutatesForDeliveryProfile|TestClassifyToolCallSeparatesMutationDomains|TestEnvPrefixVerification|TestReceiptMutationTracksContentNotRepositoryCement'
go run ./tools/repolint

---------

Co-authored-by: Wooseong Kim <[email protected]>
Co-authored-by: lbx13 <[email protected]>
Co-authored-by: yhh <[email protected]>

2026-08-13 04:10:05 +08:00

..

command_effects.json

fix(shellsafe): unify command effect classification / 统一命令效果分类并修复只读误判 (#8417)

2026-08-13 04:10:05 +08:00