feat: skills - add auto-tmux safety preflight

skills/auto-tmux/scripts/AGENTS.md

@@ -13,6 +13,7 @@ scripts/
 ├── swarm-brief.sh  # 只读生成蜂群交接报告
 ├── swarm-watch.sh  # 有限轮次只读巡检和状态采样
 ├── swarm-archive.sh # 打包 brief、snapshot 和 swarm state
+├── safety-check.sh # 发送/粘贴/分发前的 payload 安全预检
 ├── render-swarm-prompt.sh # commander/worker/reviewer 提示词渲染
 ├── swarm-dispatch.sh # 渲染并可选下发蜂群提示词
 ├── auto-tmux-smoke-test.sh # 临时 tmux 会话端到端自测
@@ -31,6 +32,7 @@ scripts/
 - 交接报告脚本只读调用 doctor/topology/scan/report，不直接发送按键。
 - 巡检脚本必须是有限轮次，不允许默认无限循环。
 - 归档脚本只复制状态和只读证据，不修改 tmux pane 或 swarm state。
+- 安全预检脚本只能读取文本或文件，不控制 tmux，不写状态目录。
 - 状态脚本只能写入显式状态目录，不保存密钥、Token、密码或私密项目内容。
 - 自测脚本必须创建独立临时 tmux session，并在退出时清理。
 - 专属校验脚本必须覆盖脚本权限、语法、help 输出、关键索引、strict 校验和 smoke test。

skills/auto-tmux/scripts/README.md

@@ -9,6 +9,7 @@
 - [`swarm-brief.sh`](./swarm-brief.sh) - 只读生成蜂群交接报告，汇总 doctor、topology、pane 输出和状态报告。
 - [`swarm-watch.sh`](./swarm-watch.sh) - 有限轮次巡检蜂群 pane 输出和状态报告，形成连续证据。
 - [`swarm-archive.sh`](./swarm-archive.sh) - 打包 brief、snapshot 和 swarm state，生成可交接归档。
+- [`safety-check.sh`](./safety-check.sh) - 发送、粘贴或分发前检查危险命令、敏感信息和过大 payload。
 - [`render-swarm-prompt.sh`](./render-swarm-prompt.sh) - commander、worker、reviewer 提示词渲染。
 - [`swarm-dispatch.sh`](./swarm-dispatch.sh) - 渲染提示词并可选发送到指定 pane，默认只写文件。
 - [`auto-tmux-smoke-test.sh`](./auto-tmux-smoke-test.sh) - 创建临时 tmux 会话，端到端验证脚本能力。
@@ -34,7 +35,9 @@ skills/auto-tmux/scripts/auto-tmux.sh inspect -t "$target" -n 40
 skills/auto-tmux/scripts/auto-tmux.sh capture -t "$target" -n 80
 
 # 发送命令并回车
+skills/auto-tmux/scripts/safety-check.sh --text "make test"
 skills/auto-tmux/scripts/auto-tmux.sh send -t "$target" --text "make test" --enter
+skills/auto-tmux/scripts/safety-check.sh --file /tmp/prompt.md --strict
 skills/auto-tmux/scripts/auto-tmux.sh paste -t "$target" --file /tmp/prompt.md --enter --dry-run
 
 # 扫描某个 session 的错误
@@ -89,6 +92,7 @@ skills/auto-tmux/scripts/swarm-dispatch.sh --role worker --target "$target" --ta
 - 默认对捕获输出做密钥脱敏。
 - `send` 会先打印目标 pane 最近上下文，再发送按键。
 - 危险命令默认拒绝，必须显式 `--force`。
+- 长 prompt、文件粘贴和 prompt 下发前先运行 `safety-check.sh`。
 - 批量操作必须使用明确的 session/window/pane 目标。
 - 批量广播必须先 `--dry-run`，确认目标列表后再真实发送。
 - 多 worker 协作时用 `swarm-state.sh lock-acquire` 声明文件、目录或服务锁。

skills/auto-tmux/scripts/auto-tmux-smoke-test.sh

@@ -9,6 +9,7 @@ RENDER_PROMPT="$SCRIPT_DIR/render-swarm-prompt.sh"
 SWARM_BRIEF="$SCRIPT_DIR/swarm-brief.sh"
 SWARM_WATCH="$SCRIPT_DIR/swarm-watch.sh"
 SWARM_ARCHIVE="$SCRIPT_DIR/swarm-archive.sh"
+SAFETY_CHECK="$SCRIPT_DIR/safety-check.sh"
 SWARM_DISPATCH="$SCRIPT_DIR/swarm-dispatch.sh"
 SESSION="auto-tmux-smoke-$$"
 SWARM_DIR="/tmp/auto-tmux-smoke-swarm-$$"
@@ -38,6 +39,7 @@ bash -n "$RENDER_PROMPT"
 bash -n "$SWARM_BRIEF"
 bash -n "$SWARM_WATCH"
 bash -n "$SWARM_ARCHIVE"
+bash -n "$SAFETY_CHECK"
 bash -n "$SWARM_DISPATCH"
 
 "$AUTO_TMUX" hub --session "$SESSION" --workers 1 --cmd bash
@@ -52,6 +54,12 @@ worker_target="$(tmux list-panes -t "$SESSION:worker1" -F '#S:#I.#P' | head -n 1
 "$AUTO_TMUX" inspect -t "$commander_target" -n 10 >/tmp/auto-tmux-smoke-inspect.txt
 grep -q 'pane inspect' /tmp/auto-tmux-smoke-inspect.txt
 printf '%s\n' 'echo AUTO_TMUX_PASTE_OK' > "$PASTE_FILE"
+"$SAFETY_CHECK" --text "make test" >/tmp/auto-tmux-smoke-safety-clean.txt
+if "$SAFETY_CHECK" --text "rm -rf /tmp/example" >/tmp/auto-tmux-smoke-safety-danger.txt 2>&1; then
+  echo "expected safety-check to reject dangerous text" >&2
+  exit 1
+fi
+"$SAFETY_CHECK" --file "$PASTE_FILE" --strict >/tmp/auto-tmux-smoke-safety-file.txt
 "$AUTO_TMUX" paste -t "$worker_target" --file "$PASTE_FILE" --enter --dry-run >/tmp/auto-tmux-smoke-paste-dry-run.txt
 "$AUTO_TMUX" broadcast --session "$SESSION" --text "pwd" --enter --dry-run >/tmp/auto-tmux-smoke-broadcast.txt
 "$AUTO_TMUX" send -t "$worker_target" --text "echo AUTO_TMUX_SMOKE_OK" --enter

skills/auto-tmux/scripts/auto-tmux.sh

@@ -153,7 +153,7 @@ cmd_doctor() {
     status_line "WARN" "tmux server has no reachable session yet"
   fi
 
-  for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do
+  for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh safety-check.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do
     if [[ -x "$script_dir/$script" ]]; then
       status_line "OK" "script executable: $script"
     else

skills/auto-tmux/scripts/safety-check.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# safety-check: inspect text/file payloads before tmux send, paste or dispatch.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+safety-check: inspect an auto-tmux payload before sending it to a pane
+
+Usage:
+  safety-check.sh --text TEXT [--strict]
+  safety-check.sh --file FILE [--strict]
+  safety-check.sh --stdin [--strict]
+
+Checks:
+  - dangerous shell/database/tmux commands that require explicit review
+  - common secret patterns that should not be pasted into shared panes
+  - oversized payloads that should use paste/archive instead of send
+
+Exit codes:
+  0: no issue found
+  1: warning found
+  2: blocking issue found
+EOF
+}
+
+die() {
+  printf 'error: %s\n' "$*" >&2
+  exit 2
+}
+
+input=""
+label=""
+strict="0"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --text)
+      input="${2:-}"
+      label="<text>"
+      shift 2
+      ;;
+    --file)
+      [[ -f "${2:-}" ]] || die "file not found: ${2:-}"
+      input="$(cat "$2")"
+      label="$2"
+      shift 2
+      ;;
+    --stdin)
+      input="$(cat)"
+      label="<stdin>"
+      shift
+      ;;
+    --strict)
+      strict="1"
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+[[ -n "$label" ]] || die "one input source is required: --text, --file or --stdin"
+
+dangerous_pattern='(^|[[:space:];|&])(rm[[:space:]]+-rf|mkfs|dd[[:space:]]+if=|shutdown|reboot|halt|poweroff|tmux[[:space:]]+kill-server|git[[:space:]]+reset[[:space:]]+--hard|git[[:space:]]+clean[[:space:]]+-fd|DROP[[:space:]]+(DATABASE|TABLE))'
+secret_pattern='(OPENAI_API_KEY|ANTHROPIC_API_KEY|GITHUB_TOKEN|GH_TOKEN|API_KEY|TOKEN|PASSWORD|SECRET)=|Bearer[[:space:]]+[A-Za-z0-9._~+/=-]+|sk-[A-Za-z0-9_-]{12,}'
+
+failures=0
+warnings=0
+
+if printf '%s\n' "$input" | grep -Eiq "$dangerous_pattern"; then
+  printf '[FAIL] dangerous command pattern detected in %s\n' "$label" >&2
+  failures=$((failures + 1))
+fi
+
+if printf '%s\n' "$input" | grep -Eiq "$secret_pattern"; then
+  if [[ "$strict" == "1" ]]; then
+    printf '[FAIL] possible secret detected in %s\n' "$label" >&2
+    failures=$((failures + 1))
+  else
+    printf '[WARN] possible secret detected in %s\n' "$label" >&2
+    warnings=$((warnings + 1))
+  fi
+fi
+
+byte_count="$(printf '%s' "$input" | wc -c | tr -d ' ')"
+line_count="$(printf '%s\n' "$input" | wc -l | tr -d ' ')"
+if (( byte_count > 8192 )); then
+  printf '[WARN] payload is large: %s bytes; prefer paste-buffer or archive handoff\n' "$byte_count" >&2
+  warnings=$((warnings + 1))
+fi
+
+printf 'safety-check target=%s bytes=%s lines=%s strict=%s\n' "$label" "$byte_count" "$line_count" "$strict"
+
+if (( failures > 0 )); then
+  exit 2
+fi
+if (( warnings > 0 )); then
+  exit 1
+fi
+printf '[OK] no safety issue found\n'

skills/auto-tmux/scripts/validate-auto-tmux.sh

@@ -82,6 +82,7 @@ scripts=(
   "$script_dir/swarm-brief.sh"
   "$script_dir/swarm-watch.sh"
   "$script_dir/swarm-archive.sh"
+  "$script_dir/safety-check.sh"
   "$script_dir/render-swarm-prompt.sh"
   "$script_dir/swarm-dispatch.sh"
   "$script_dir/auto-tmux-smoke-test.sh"
@@ -97,6 +98,13 @@ run_gate "swarm-state help" "$script_dir/swarm-state.sh" help
 run_gate "swarm-brief help" "$script_dir/swarm-brief.sh" --help
 run_gate "swarm-watch help" "$script_dir/swarm-watch.sh" --help
 run_gate "swarm-archive help" "$script_dir/swarm-archive.sh" --help
+run_gate "safety-check help" "$script_dir/safety-check.sh" --help
+run_gate "safety-check clean text" "$script_dir/safety-check.sh" --text "make test"
+if "$script_dir/safety-check.sh" --text "rm -rf /tmp/example" >/tmp/auto-tmux-validate-gate.log 2>&1; then
+  fail "safety-check should reject dangerous text"
+else
+  pass "safety-check rejects dangerous text"
+fi
 run_gate "render-swarm-prompt help" "$script_dir/render-swarm-prompt.sh" --help
 run_gate "swarm-dispatch help" "$script_dir/swarm-dispatch.sh" --help
 
@@ -104,17 +112,22 @@ require_contains "$skill_dir/SKILL.md" "scripts/validate-auto-tmux.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/swarm-brief.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/swarm-watch.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/swarm-archive.sh"
+require_contains "$skill_dir/SKILL.md" "scripts/safety-check.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/swarm-dispatch.sh"
 require_contains "$skill_dir/references/index.md" "automation.md"
+require_contains "$skill_dir/references/index.md" "safety-policy.md"
 require_contains "$skill_dir/references/README.md" "swarm-state.md"
+require_contains "$skill_dir/references/README.md" "safety-policy.md"
 require_contains "$script_dir/README.md" "validate-auto-tmux.sh"
 require_contains "$script_dir/README.md" "swarm-dispatch.sh"
 require_contains "$script_dir/README.md" "swarm-watch.sh"
 require_contains "$script_dir/README.md" "swarm-archive.sh"
+require_contains "$script_dir/README.md" "safety-check.sh"
 require_contains "$script_dir/AGENTS.md" "validate-auto-tmux.sh"
 require_contains "$script_dir/AGENTS.md" "swarm-dispatch.sh"
 require_contains "$script_dir/AGENTS.md" "swarm-watch.sh"
 require_contains "$script_dir/AGENTS.md" "swarm-archive.sh"
+require_contains "$script_dir/AGENTS.md" "safety-check.sh"
 
 if [[ -x "$repo_root/skills/auto-skill/scripts/validate-skill.sh" ]]; then
   run_gate "auto-skill strict validation" "$repo_root/skills/auto-skill/scripts/validate-skill.sh" "$skill_dir" --strict