feat(security): 敏感清单补齐 design/11 §4 的 7 类（写数据/对外发消息/访问密钥/改配置，结构化判据）

internal/capability/restrict/sensitive_test.go

@@ -19,6 +19,9 @@ func TestSensitiveCall(t *testing.T) {
 		{name: "terminal", args: map[string]any{"command": "rm -rf /tmp/x"}, wantOp: SensitiveExecCommand, wantIn: "rm -rf /tmp/x", sensitive: true},
 		{name: "terminal", args: nil, wantOp: SensitiveExecCommand, wantIn: "terminal", sensitive: true},
 		{name: "file", args: map[string]any{"action": "write", "path": "/data/a.md"}, wantOp: SensitiveWriteFile, wantIn: "/data/a.md", sensitive: true},
+		{name: "file", args: map[string]any{"action": "write", "path": "/data/models.json"}, wantOp: SensitiveConfigChange, wantIn: "models.json", sensitive: true},
+		{name: "file", args: map[string]any{"action": "write", "path": "/data/cyrene.db"}, wantOp: SensitiveWriteData, wantIn: "cyrene.db", sensitive: true},
+		{name: "file", args: map[string]any{"action": "read", "path": "/data/.env"}, wantOp: SensitiveSecretAccess, wantIn: "/data/.env", sensitive: true},
 		{name: "file", args: map[string]any{"action": "read", "path": "/data/a.md"}},
 		{name: "file", args: map[string]any{"action": "list"}},
 		{name: "file", args: map[string]any{"action": "search", "query": "x"}},
@@ -32,6 +35,9 @@ func TestSensitiveCall(t *testing.T) {
 		{name: "web-fetch", args: map[string]any{"url": "https://example.com"}},
 		{name: "session_read", args: map[string]any{"sessionId": "web"}},
 		{name: "calculator", args: map[string]any{"expression": "1+1"}},
+		// 纯计算工具的参数里也出现写动作词（text 的 operation=replace），
+		// 判据必须只看**工具名**，绝不能被参数里的动词带跑。
+		{name: "text", args: map[string]any{"operation": "replace", "old": "a", "new": "b"}},
 		{name: "mcp:some-server/tool", args: map[string]any{"anything": true}},
 		{name: "unknown-tool", args: nil},
 	}