@agenttrail/guardrails 0.2.0 → 0.2.2

package/dist/guardrails.cjs

@@ -205,7 +205,7 @@ var acInstructionFileEdit = {
   severity: "high",
   defaultAction: "require_approval",
   title: "The agent editing its standing instructions",
-  description: "Holds a file tool opening the instructions a coding agent loads at the start of every session: `CLAUDE.md`, `CLAUDE.local.md` and `.claude/rules/`; `AGENTS.md` and `AGENTS.override.md`, which Codex, Cursor, Windsurf, Copilot and Cline all read; `GEMINI.md`; `.cursorrules`; Windsurf's `.windsurfrules`, `.windsurf/rules/` and `.devin/rules/`; Cline's `.clinerules` file or directory and its global `Cline/Rules/` folder; Copilot's `.github/copilot-instructions.md` and `.github/instructions/**/*.instructions.md`; and `.aider.conf.yml`, which sets the files Aider reads on every launch. A line written into one of these is followed in every later session. Matched in any directory and in any letter case. File tools carry a path and no content, so it cannot see what was written, and it does not tell reading apart from editing. Does not cover `.cursor/rules/`, which `fs.agent-self-config` holds. Misses a context file renamed through Gemini's `context.fileName` or Codex's `project_doc_fallback_filenames`, Aider's `CONVENTIONS.md`, which Aider loads only when asked and which is too common a name to match, and any of these files written by a shell command instead of a file tool.",
+  description: "Holds a file tool opening the instructions a coding agent loads at the start of every session: `CLAUDE.md`, `CLAUDE.local.md` and `.claude/rules/`; `AGENTS.md` and `AGENTS.override.md`, which Codex, Cursor, Windsurf, Copilot and Cline all read; `GEMINI.md`; `.cursorrules`; Windsurf's `.windsurfrules`, `.windsurf/rules/` and `.devin/rules/`; Cline's `.clinerules` file or directory and its global `Cline/Rules/` folder; Copilot's `.github/copilot-instructions.md` and `.github/instructions/**/*.instructions.md`; and `.aider.conf.yml`, which sets the files Aider reads on every launch. A line written into one of these is followed in every later session. Matched in any directory and in any letter case. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so an agent opening its instructions to read them is not held; every other file tool is, including one this corpus does not know. File tools carry a path and no content, so it still cannot see what was written. Does not cover `.cursor/rules/`, which `fs.agent-self-config` holds. Misses a context file renamed through Gemini's `context.fileName` or Codex's `project_doc_fallback_filenames`, Aider's `CONVENTIONS.md`, which Aider loads only when asked and which is too common a name to match, and any of these files written by a shell command instead of a file tool.",
   match: {
     any_of: [
       {
@@ -221,6 +221,11 @@ var acInstructionFileEdit = {
       { kind: "execute_tool", file_glob: "**/.github/copilot-instructions.md" },
       { kind: "execute_tool", file_glob: "**/.github/instructions/**/*.instructions.md" },
       { kind: "execute_tool", file_glob: "**/.aider.conf.yml" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -255,7 +260,9 @@ var acInstructionFileEdit = {
       file(".github/workflows/ci.yml"),
       file(".cursor/rules/style.mdc"),
       file(".claude/settings.json"),
-      file(".aider.chat.history.md")
+      file(".aider.chat.history.md"),
+      file("CLAUDE.md", "Read"),
+      file(".github/copilot-instructions.md", "Grep")
     ]
   }
 };
@@ -269,7 +276,7 @@ var acMcpServerAdd = {
   severity: "high",
   defaultAction: "require_approval",
   title: "Adding an MCP server to an agent",
-  description: "Holds the commands that register an MCP server with a coding agent \u2014 `claude mcp add`, `claude mcp add-json`, `claude mcp add-from-claude-desktop`, `codex mcp add` and `gemini mcp add` \u2014 and `claude --mcp-config`, which attaches servers to a single session. Each gives an agent a new set of tools, often a program fetched and started on the spot, with nobody reviewing the change. Deliberately NOT matched: listing or removing servers (`claude mcp list`, `claude mcp remove`), and the MCP Inspector (`npx @modelcontextprotocol/inspector`), which is a debugging tool rather than a registration. Cursor has no command for this, so its `.cursor/mcp.json`, in a project or the home directory, is matched as a file instead; a project's `.mcp.json` is held by `fs.agent-self-config`. Misses servers written into `~/.claude.json` or Gemini's `settings.json` with a file tool, and a global flag whose value is quoted when it sits before `mcp`. A quoted MENTION is not a use: a search, a `git commit -m` message, an `echo` or a `curl --data` body that only names this command is left alone, as long as every shell metacharacter stays inside the quotes.",
+  description: "Holds the commands that register an MCP server with a coding agent \u2014 `claude mcp add`, `claude mcp add-json`, `claude mcp add-from-claude-desktop`, `codex mcp add` and `gemini mcp add` \u2014 and `claude --mcp-config`, which attaches servers to a single session. Each gives an agent a new set of tools, often a program fetched and started on the spot, with nobody reviewing the change. Deliberately NOT matched: listing or removing servers (`claude mcp list`, `claude mcp remove`), and the MCP Inspector (`npx @modelcontextprotocol/inspector`), which is a debugging tool rather than a registration. Cursor has no command for this, so its `.cursor/mcp.json`, in a project or the home directory, is matched as a file instead \u2014 written, not read: the `Read` and `Grep` tools never match it, and every other file tool does, including one this corpus does not know; a project's `.mcp.json` is held by `fs.agent-self-config`. Misses servers written into `~/.claude.json` or Gemini's `settings.json` with a file tool, and a global flag whose value is quoted when it sits before `mcp`. A quoted MENTION is not a use: a search, a `git commit -m` message, an `echo` or a `curl --data` body that only names this command is left alone, as long as every shell metacharacter stays inside the quotes.",
   match: {
     any_of: [
       {
@@ -284,7 +291,14 @@ var acMcpServerAdd = {
       // Cursor has no `mcp add` command; its servers are added by editing this file.
       { kind: "execute_tool", file_glob: "**/.cursor/mcp.json" }
     ],
-    none_of: [...QUOTED_MENTION]
+    none_of: [
+      // A read is not an addition. This covers the `.cursor/mcp.json` arm — the
+      // shell arm already pins its own tool family. Named as a deny-list rather
+      // than an `any_of` over the write tools, so an unknown file tool on that
+      // path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" },
+      ...QUOTED_MENTION
+    ]
   },
   fixtures: {
     block: [
@@ -309,7 +323,9 @@ var acMcpServerAdd = {
       bash("npx @modelcontextprotocol/inspector"),
       file("config/mcp.json"),
       file(".cursor/rules/style.mdc"),
-      bash("pnpm run test")
+      bash("pnpm run test"),
+      file(".cursor/mcp.json", "Read"),
+      file("/Users/dev/.cursor/mcp.json", "Grep")
     ]
   }
 };
@@ -321,7 +337,7 @@ var acMemoryStoreEdit = {
   severity: "high",
   defaultAction: "require_approval",
   title: "The agent editing its own memory",
-  description: "Holds a file tool opening the memory a coding agent carries between sessions: Claude Code's auto memory under `.claude/projects/<project>/memory/`, and its sub-agent memory in `.claude/agent-memory/` and `.claude/agent-memory-local/`; Codex's `.codex/memories/`; Gemini's private `.gemini/tmp/<project>/memory/`; Windsurf's `.codeium/windsurf/memories/`, including `global_rules.md`; and `.cursor/memory/`. A false fact saved here is recalled as true in every later session. A `MEMORY.md` outside those directories deliberately does NOT match, and neither does a project's own `docs/memory/` folder: the name alone is not an agent's memory. File tools carry a path and no content, so it cannot see what was written, and it does not tell reading apart from editing, so an agent recalling a memory by reading its file is asked too. Misses a memory directory moved with Claude Code's `autoMemoryDirectory` setting, and Cursor memories kept anywhere other than `.cursor/memory/`, since Cursor does not document where it stores them. Gemini memories saved into `GEMINI.md` are held by `ac.instruction-file-edit` instead.",
+  description: "Holds a file tool opening the memory a coding agent carries between sessions: Claude Code's auto memory under `.claude/projects/<project>/memory/`, and its sub-agent memory in `.claude/agent-memory/` and `.claude/agent-memory-local/`; Codex's `.codex/memories/`; Gemini's private `.gemini/tmp/<project>/memory/`; Windsurf's `.codeium/windsurf/memories/`, including `global_rules.md`; and `.cursor/memory/`. A false fact saved here is recalled as true in every later session. A `MEMORY.md` outside those directories deliberately does NOT match, and neither does a project's own `docs/memory/` folder: the name alone is not an agent's memory. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so an agent recalling a memory by reading its file is not asked; every other file tool is, including one this corpus does not know. File tools carry a path and no content, so it still cannot see what was written. Misses a memory directory moved with Claude Code's `autoMemoryDirectory` setting, and Cursor memories kept anywhere other than `.cursor/memory/`, since Cursor does not document where it stores them. Gemini memories saved into `GEMINI.md` are held by `ac.instruction-file-edit` instead.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/.claude/projects/*/memory/**" },
@@ -330,6 +346,11 @@ var acMemoryStoreEdit = {
       { kind: "execute_tool", file_glob: "**/.gemini/tmp/*/memory/**" },
       { kind: "execute_tool", file_glob: "**/.codeium/windsurf/memories/**" },
       { kind: "execute_tool", file_glob: "**/.cursor/memory/**" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -353,7 +374,9 @@ var acMemoryStoreEdit = {
       file("packages/memory-store/src/index.ts"),
       file("/Users/dev/.claude/projects/-Users-dev-shop/transcript.jsonl"),
       file("/home/dev/.gemini/settings.json"),
-      file(".claude/settings.json")
+      file(".claude/settings.json"),
+      file(".claude/agent-memory/reviewer/MEMORY.md", "Read"),
+      file("/home/dev/.codex/memories/project.md", "Grep")
     ]
   }
 };
@@ -423,7 +446,7 @@ var acSkillInstall = {
   severity: "high",
   defaultAction: "require_approval",
   title: "The agent installing a skill, command or sub-agent",
-  description: "Holds a file tool opening a skill, slash command, sub-agent or output style that a coding agent loads by name: Claude Code's `.claude/skills/`, `.claude/commands/`, `.claude/agents/` and `.claude/output-styles/`; the shared `.agents/skills/`; Codex's `.codex/skills/`, `.codex/prompts/` and `.codex/agents/`; Gemini's `.gemini/commands/`, `.gemini/skills/` and `.gemini/agents/`; Cursor's `.cursor/skills/`, `.cursor/agents/` and `.cursor/commands/`; Windsurf's `.windsurf/workflows/` and `.windsurf/skills/` and their global copies under `.codeium/windsurf/`; Cline's `.cline/skills/`; and a `SKILL.md` anywhere, which is how a plugin ships a skill. Each becomes a reusable instruction the agent may follow later, often with a script beside it that the agent runs. Matched at project or home level and in any letter case. File tools carry a path and no content, so it cannot see what was written, and it does not tell reading apart from editing. Deliberately NOT matched: an ordinary `skills/`, `commands/` or `agents/` folder in a project's source, and `.clinerules/skills/`, which `ac.instruction-file-edit` holds. Misses a skill copied into one of these folders by a shell command such as `cp` or `git clone`, and the managed system-wide workflow folders.",
+  description: "Holds a file tool opening a skill, slash command, sub-agent or output style that a coding agent loads by name: Claude Code's `.claude/skills/`, `.claude/commands/`, `.claude/agents/` and `.claude/output-styles/`; the shared `.agents/skills/`; Codex's `.codex/skills/`, `.codex/prompts/` and `.codex/agents/`; Gemini's `.gemini/commands/`, `.gemini/skills/` and `.gemini/agents/`; Cursor's `.cursor/skills/`, `.cursor/agents/` and `.cursor/commands/`; Windsurf's `.windsurf/workflows/` and `.windsurf/skills/` and their global copies under `.codeium/windsurf/`; Cline's `.cline/skills/`; and a `SKILL.md` anywhere, which is how a plugin ships a skill. Each becomes a reusable instruction the agent may follow later, often with a script beside it that the agent runs. Matched at project or home level and in any letter case. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so an agent opening an installed skill to read it is not held; every other file tool is, including one this corpus does not know. File tools carry a path and no content, so it still cannot see what was written. Deliberately NOT matched: an ordinary `skills/`, `commands/` or `agents/` folder in a project's source, and `.clinerules/skills/`, which `ac.instruction-file-edit` holds. Misses a skill copied into one of these folders by a shell command such as `cp` or `git clone`, and the managed system-wide workflow folders.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/.claude/{skills,commands,agents,output-styles}/**" },
@@ -435,6 +458,11 @@ var acSkillInstall = {
       { kind: "execute_tool", file_glob: "**/.codeium/windsurf/{skills,global_workflows}/**" },
       { kind: "execute_tool", file_glob: "**/.cline/skills/**" },
       { kind: "execute_tool", file_glob: "**/SKILL.md" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -464,7 +492,9 @@ var acSkillInstall = {
       file(".claude/settings.json"),
       file(".github/workflows/release.yml"),
       file("scripts/release.sh"),
-      file(".gemini/settings.json")
+      file(".gemini/settings.json"),
+      file(".claude/skills/deploy/SKILL.md", "Read"),
+      file(".claude/commands/deploy.md", "Grep")
     ]
   }
 };
@@ -1056,7 +1086,7 @@ var fsAgentSelfConfig = {
   severity: "high",
   defaultAction: "require_approval",
   title: "The agent editing its own configuration",
-  description: "Holds a file tool opening the files that define what the agent itself is allowed to do \u2014 Claude Code settings and hooks, an MCP server list, a plugin manifest, Cursor rules, a Codex config, and the guard's own config.json and guardrails.json. An agent that can edit these can widen its own reach with nobody reviewing the change. Does NOT match ordinary project files, or `.claude/commands/*.md`, which are prompts rather than permissions. Bounded to WELL-KNOWN paths: no working directory or project root reaches the guard, so it can only match names it already knows.",
+  description: "Holds a file tool opening the files that define what the agent itself is allowed to do \u2014 Claude Code settings and hooks, an MCP server list, a plugin manifest, Cursor rules, a Codex config, and the guard's own config.json and guardrails.json. An agent that can edit these can widen its own reach with nobody reviewing the change. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so opening one of these files to read it is not held; every other file tool is, including one this corpus does not know. Does NOT match ordinary project files, or `.claude/commands/*.md`, which are prompts rather than permissions. Bounded to WELL-KNOWN paths: no working directory or project root reaches the guard, so it can only match names it already knows.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/.claude/settings*.json" },
@@ -1067,6 +1097,11 @@ var fsAgentSelfConfig = {
       { kind: "execute_tool", file_glob: "**/.codex/config.toml" },
       { kind: "execute_tool", file_glob: "**/.agenttrail/guard/config.json" },
       { kind: "execute_tool", file_glob: "**/.agenttrail/guard/guardrails.json" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -1080,7 +1115,9 @@ var fsAgentSelfConfig = {
       file(".claude/commands/deploy.md"),
       file("src/index.ts"),
       file("package.json"),
-      file("README.md")
+      file("README.md"),
+      file(".claude/settings.json", "Read"),
+      file(".mcp.json", "Grep")
     ]
   }
 };
@@ -1092,7 +1129,7 @@ var fsCiDefinition = {
   severity: "medium",
   defaultAction: "require_approval",
   title: "Editing the CI pipeline definition",
-  description: "Holds a file tool opening a CI definition \u2014 GitHub Actions workflows and composite actions, .gitlab-ci.yml, a Jenkinsfile, CircleCI, Azure Pipelines, Buildkite or Bitbucket pipelines. This is where the checks that gate every merge are written down, and where a new step would run with the repository's secrets; both edits look like an ordinary diff. Does NOT match other files under .github/ (CODEOWNERS, issue templates), which gate nothing. It MISSES a CI system whose definition lives outside the repository.",
+  description: "Holds a file tool opening a CI definition \u2014 GitHub Actions workflows and composite actions, .gitlab-ci.yml, a Jenkinsfile, CircleCI, Azure Pipelines, Buildkite or Bitbucket pipelines. This is where the checks that gate every merge are written down, and where a new step would run with the repository's secrets; both edits look like an ordinary diff. Reading is excluded \u2014 the Read and Grep tools never match \u2014 so opening a CI definition to read it is not held; every other file tool is, including one this corpus does not know. Does NOT match other files under .github/ (CODEOWNERS, issue templates), which gate nothing. It MISSES a CI system whose definition lives outside the repository.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/.github/workflows/**" },
@@ -1103,6 +1140,11 @@ var fsCiDefinition = {
       { kind: "execute_tool", file_glob: "**/azure-pipelines.yml" },
       { kind: "execute_tool", file_glob: "**/.buildkite/**" },
       { kind: "execute_tool", file_glob: "**/bitbucket-pipelines.yml" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -1116,7 +1158,9 @@ var fsCiDefinition = {
       file(".github/CODEOWNERS"),
       file(".github/PULL_REQUEST_TEMPLATE.md"),
       file("package.json"),
-      file("README.md")
+      file("README.md"),
+      file(".github/workflows/ci.yml", "Read"),
+      file(".gitlab-ci.yml", "Grep")
     ]
   }
 };
@@ -1128,7 +1172,7 @@ var fsSystemPaths = {
   severity: "high",
   defaultAction: "require_approval",
   title: "Writing to a system directory",
-  description: "Holds a file tool opening a path under a system directory \u2014 /etc, /bin, /sbin, /usr/bin, /usr/local/bin, /boot, /System, /Library/LaunchDaemons, or Windows/System32. HONEST CEILING: this is a list of well-known ABSOLUTE paths and it cannot be anything else. No working directory and no project root reaches the guard, so the rule you would actually want \u2014 'the agent wrote outside the project' \u2014 is inexpressible, and would match everything or nothing. It therefore MISSES a write anywhere else outside your repository, including another project on the same machine.",
+  description: "Holds a file tool writing to a path under a system directory \u2014 /etc, /bin, /sbin, /usr/bin, /usr/local/bin, /boot, /System, /Library/LaunchDaemons, or Windows/System32. Reading is excluded \u2014 the Read and Grep tools never match \u2014 so reading /etc/hosts is not held; every other file tool is, including one this corpus does not know. HONEST CEILING: this is a list of well-known ABSOLUTE paths and it cannot be anything else. No working directory and no project root reaches the guard, so the rule you would actually want \u2014 'the agent wrote outside the project' \u2014 is inexpressible, and would match everything or nothing. It therefore MISSES a write anywhere else outside your repository, including another project on the same machine.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "/etc/**" },
@@ -1140,6 +1184,11 @@ var fsSystemPaths = {
       { kind: "execute_tool", file_glob: "/System/**" },
       { kind: "execute_tool", file_glob: "/Library/LaunchDaemons/**" },
       { kind: "execute_tool", file_glob: "**/Windows/System32/**" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -1153,7 +1202,9 @@ var fsSystemPaths = {
       file("src/index.ts"),
       file("/home/dev/project/src/main.rs"),
       file("/tmp/scratch.txt", "Write"),
-      file("docs/etc-notes.md")
+      file("docs/etc-notes.md"),
+      file("/etc/hosts", "Read"),
+      file("/usr/local/bin/app", "Grep")
     ]
   }
 };
@@ -1165,7 +1216,7 @@ var fsVcsInternals = {
   severity: "high",
   defaultAction: "require_approval",
   title: "Editing git's internals directly",
-  description: "Holds a file tool opening git's own bookkeeping \u2014 .git/config, .git/hooks/, .git/refs/, .git/HEAD, .git/info/exclude \u2014 where a change alters what future git commands do rather than what the repository contains. Deliberately NARROW: all of .git/** would include COMMIT_EDITMSG and the index, which change during every ordinary commit, so the rule would fire constantly and be switched off. It does NOT match .gitignore, .gitattributes or anything under .github/, which are tracked project files.",
+  description: "Holds a file tool opening git's own bookkeeping \u2014 .git/config, .git/hooks/, .git/refs/, .git/HEAD, .git/info/exclude \u2014 where a change alters what future git commands do rather than what the repository contains. Deliberately NARROW: all of .git/** would include COMMIT_EDITMSG and the index, which change during every ordinary commit, so the rule would fire constantly and be switched off. Reading is excluded \u2014 the Read and Grep tools never match \u2014 so opening .git/config to read it is not held; every other file tool is, including one this corpus does not know. It does NOT match .gitignore, .gitattributes or anything under .github/, which are tracked project files.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/.git/config" },
@@ -1173,6 +1224,11 @@ var fsVcsInternals = {
       { kind: "execute_tool", file_glob: "**/.git/refs/**" },
       { kind: "execute_tool", file_glob: "**/.git/HEAD" },
       { kind: "execute_tool", file_glob: "**/.git/info/exclude" }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -1186,7 +1242,9 @@ var fsVcsInternals = {
       file(".gitignore"),
       file(".gitattributes"),
       file(".github/CODEOWNERS"),
-      file("src/index.ts")
+      file("src/index.ts"),
+      file(".git/config", "Read"),
+      file(".git/hooks/pre-commit", "Grep")
     ]
   }
 };
@@ -1497,7 +1555,7 @@ var blockProdConfigEdit = {
   severity: "high",
   defaultAction: "require_approval",
   title: "Approve production config edits",
-  description: "Routes edits to production configuration files to human approval. Matched by path: `*.prod.*` and `*.production.*`, the bare `prod.*` / `production.*` spellings, and any file under a `prod/` or `production/` directory. Prose is excluded \u2014 `.md`, `.mdx` and `.txt` never match \u2014 so writing a runbook under `docs/production/` does not ask for approval to change production. It matches the PATH only: it cannot tell a real production config from a file that merely spells prod in its name, and it MISSES a production config named something else entirely, such as `values-live.yaml`.",
+  description: "Routes edits to production configuration files to human approval. Matched by path: `*.prod.*` and `*.production.*`, the bare `prod.*` / `production.*` spellings, and any file under a `prod/` or `production/` directory. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so opening a production config to look at it does not ask for approval; every other file tool does, including one this corpus does not know. Prose is excluded too \u2014 `.md`, `.mdx` and `.txt` never match \u2014 so writing a runbook under `docs/production/` does not ask for approval to change production. It matches the PATH only: it cannot tell a real production config from a file that merely spells prod in its name, and it MISSES a production config named something else entirely, such as `values-live.yaml`.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/*.prod.*" },
@@ -1508,6 +1566,9 @@ var blockProdConfigEdit = {
       { kind: "execute_tool", file_glob: "**/production/**" }
     ],
     none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" },
       { kind: "execute_tool", file_glob: "**/*.md" },
       { kind: "execute_tool", file_glob: "**/*.mdx" },
       { kind: "execute_tool", file_glob: "**/*.txt" }
@@ -1525,7 +1586,9 @@ var blockProdConfigEdit = {
       file("docs/production/README.md"),
       file("config/database.dev.yml"),
       file("src/index.ts"),
-      file("package.json")
+      file("package.json"),
+      file("config/database.prod.yml", "Read"),
+      file("k8s/production/deployment.yaml", "Grep")
     ]
   }
 };
@@ -2498,7 +2561,7 @@ var requireAuthOnPiiEndpoints = {
   severity: "medium",
   defaultAction: "require_approval",
   title: "Review API endpoint changes for auth",
-  description: "Routes edits to API route/handler SOURCE files to human approval so a reviewer can confirm authentication is present on new or changed endpoints. Matched by path: a source file under routes/, handlers/ or controllers/; an api/ directory nested inside a source tree (src/api/, app/api/, pages/api/); Next's route.ts convention; and the <name>.controller.* / <name>.routes.* spellings. HEURISTIC: a path signal only \u2014 it cannot inspect the edit for a missing auth check or exposed PII, so treat a match as confirm auth on this endpoint, not as a finding. It deliberately does NOT match every file in a package merely NAMED api, nor a client-side router table such as routes.tsx, which defines no endpoint; and it MISSES endpoints declared inline in a server file or by a framework convention not listed above.",
+  description: "Routes edits to API route/handler SOURCE files to human approval so a reviewer can confirm authentication is present on new or changed endpoints. Matched by path: a source file under routes/, handlers/ or controllers/; an api/ directory nested inside a source tree (src/api/, app/api/, pages/api/); Next's route.ts convention; and the <name>.controller.* / <name>.routes.* spellings. Reading is excluded \u2014 the Read and Grep tools never match \u2014 so opening an endpoint's source to read it does not ask for approval; every other file tool does, including one this corpus does not know. HEURISTIC: a path signal only \u2014 it cannot inspect the edit for a missing auth check or exposed PII, so treat a match as confirm auth on this endpoint, not as a finding. It deliberately does NOT match every file in a package merely NAMED api, nor a client-side router table such as routes.tsx, which defines no endpoint; and it MISSES endpoints declared inline in a server file or by a framework convention not listed above.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: `**/routes/**/*.${SOURCE}` },
@@ -2510,6 +2573,11 @@ var requireAuthOnPiiEndpoints = {
       { kind: "execute_tool", file_glob: `**/route.${SOURCE}` },
       { kind: "execute_tool", file_glob: `**/*.controller.${SOURCE}` },
       { kind: "execute_tool", file_glob: `**/*.routes.${SOURCE}` }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -2523,7 +2591,9 @@ var requireAuthOnPiiEndpoints = {
       file("apps/api/README.md"),
       file("apps/api/package.json"),
       file("apps/api/src/lib/logger.ts"),
-      file("apps/web/src/app/routes.tsx")
+      file("apps/web/src/app/routes.tsx"),
+      file("src/api/users.ts", "Read"),
+      file("src/controllers/payments.ts", "Grep")
     ]
   }
 };
@@ -3080,7 +3150,7 @@ var tiTestConfigEdit = {
   severity: "medium",
   defaultAction: "require_approval",
   title: "Editing a test runner or coverage configuration",
-  description: "Holds a file tool opening a test runner's or coverage tool's own configuration: Jest's `jest.config.*`, Vitest's `vitest.config.*` and legacy `vitest.workspace.*`, `pytest.ini`, `pytest.toml` and their dotted forms, `tox.ini`, Mocha's `.mocharc.*`, PHPUnit's `phpunit.xml`, `phpunit.xml.dist` and `phpunit.dist.xml`, `codecov.yml`, nyc's `.nycrc*` and `nyc.config.*`, `.c8rc`, coverage.py's `.coveragerc`, `karma.conf.*`, and the Playwright and Cypress configs. One line in any of these can exclude a failing file, lower a coverage threshold or retry a flaky test until it passes. File tools carry a path and no content, so it cannot tell a harmless edit from a weakening one, and it does not tell reading apart from editing. Deliberately NOT matched: general files that can also hold test settings \u2014 `pyproject.toml`, `setup.cfg`, `package.json`, `vite.config.*` \u2014 and test files themselves, since editing a test is how a test gets fixed. Misses test settings kept in those general files, and a config at a path passed with `--config`.",
+  description: "Holds a file tool opening a test runner's or coverage tool's own configuration: Jest's `jest.config.*`, Vitest's `vitest.config.*` and legacy `vitest.workspace.*`, `pytest.ini`, `pytest.toml` and their dotted forms, `tox.ini`, Mocha's `.mocharc.*`, PHPUnit's `phpunit.xml`, `phpunit.xml.dist` and `phpunit.dist.xml`, `codecov.yml`, nyc's `.nycrc*` and `nyc.config.*`, `.c8rc`, coverage.py's `.coveragerc`, `karma.conf.*`, and the Playwright and Cypress configs. One line in any of these can exclude a failing file, lower a coverage threshold or retry a flaky test until it passes. Reading is excluded \u2014 the `Read` and `Grep` tools never match \u2014 so opening one of these configs to read it is not held; every other file tool is, including one this corpus does not know. File tools carry a path and no content, so it still cannot tell a harmless edit from a weakening one. Deliberately NOT matched: general files that can also hold test settings \u2014 `pyproject.toml`, `setup.cfg`, `package.json`, `vite.config.*` \u2014 and test files themselves, since editing a test is how a test gets fixed. Misses test settings kept in those general files, and a config at a path passed with `--config`.",
   match: {
     any_of: [
       { kind: "execute_tool", file_glob: "**/jest.config.{js,ts,mjs,mts,cjs,cts,json}" },
@@ -3105,6 +3175,11 @@ var tiTestConfigEdit = {
         kind: "execute_tool",
         file_glob: "**/{playwright,cypress}.config.{js,ts,mjs,mts,cjs,cts}"
       }
+    ],
+    none_of: [
+      // A read is not an edit. Named as a deny-list rather than an `any_of` over
+      // the write tools, so an unknown file tool on a matched path still holds.
+      { kind: "execute_tool", label: "{Read,Grep}" }
     ]
   },
   fixtures: {
@@ -3137,7 +3212,9 @@ var tiTestConfigEdit = {
       file("jest.setup.js"),
       file(".env.test"),
       file("docs/testing.md"),
-      file("biome.json")
+      file("biome.json"),
+      file("vitest.config.ts", "Read"),
+      file("jest.config.js", "Grep")
     ]
   }
 };
@@ -3623,8 +3700,8 @@ function isPack(value) {
 }
 
 // src/stamp.ts
-var CATALOG_VERSION = "0.2.0";
-var CATALOG_PUBLISHED_AT = "2026-09-18T13:00:33Z";
+var CATALOG_VERSION = "0.2.2";
+var CATALOG_PUBLISHED_AT = "2026-10-06T13:41:00Z";
 
 // src/rules.ts
 var RULES_BY_PACK = {