@event4u/agent-config 14.18.0 → 14.20.0

package/src/scripts/hooks/category_a.ts

@@ -0,0 +1,291 @@
+/**
+ * category_a — which `pre_tool_use` calls this package is willing to hand the
+ * host an explicit `permissionDecision: allow` for.
+ *
+ * WHY THIS EXISTS. `host_semantics` built exactly one envelope shape, so a
+ * call this package does not gate at all still cost the user a host
+ * confirmation. `permissionDecision` is offered by the host contract and was
+ * never emitted, so the prompt is ours to remove — but only for calls where
+ * "we do not gate this" is a fact about the call rather than about our
+ * coverage. That is what category A names: reads, navigation, build, test and
+ * lint inside the working tree with no consequence operation attached.
+ *
+ * THE CLASSIFIER IS AN ALLOWLIST AND MUST STAY ONE. A denylist answers "is
+ * this one of the bad shapes I thought of", so every shape nobody thought of
+ * would be auto-allowed. Everything below answers the opposite question, and an
+ * unrecognised call is not category A. The failure direction of a bug here is
+ * then a prompt that did not go away, never a confirmation that was skipped.
+ *
+ * WHAT AN ALLOW DOES NOT DO. It never overrides a verdict from this package:
+ * composition lives in `host_semantics.composePermissionDecision`, where one
+ * `ask` or `deny` beats every `allow`, and the dispatcher reaches the allow
+ * path only when the reduced severity is already `allow`. It is also not a
+ * grant — the host's own strings record `permissionDecision=allow ignored: a
+ * confined session takes grants only from its command line`.
+ */
+import * as path from "node:path";
+
+/** A JSON-ish tool input as it arrives in the dispatcher envelope. */
+export type ToolInput = Record<string, unknown>;
+
+/**
+ * Tools whose every documented effect is a read. `WebFetch` and `WebSearch`
+ * are deliberately absent — they reach the network, which is the egress leg of
+ * the lethal trifecta and not something to auto-allow.
+ */
+const READ_ONLY_TOOLS: ReadonlySet<string> = new Set([
+    "Read",
+    "Glob",
+    "Grep",
+    "NotebookRead",
+    "LS",
+    "TodoRead",
+]);
+
+/** Per-tool input keys that carry a filesystem path needing confinement. */
+const PATH_KEYS: readonly string[] = [
+    "file_path",
+    "notebook_path",
+    "path",
+    "directory",
+];
+
+/**
+ * Any of these in a Bash command string disqualifies it before the argv is
+ * looked at. Chaining, substitution, redirection and backgrounding all let a
+ * safe head token carry an arbitrary second command, and a classifier that
+ * tries to parse past them is a shell parser with a security boundary attached.
+ * Refusing the whole shape is both smaller and correct.
+ */
+const SHELL_METACHARACTERS = /[;&|`$><\n\r(){}\\]/;
+
+/**
+ * Words naming a consequence operation, matched as whole tokens anywhere in
+ * the command. Defence in depth: the metacharacter rule already prevents a
+ * second command, so a hit here means the FIRST command is consequential.
+ */
+const CONSEQUENCE_WORDS: ReadonlySet<string> = new Set([
+    "push", "publish", "deploy", "release", "merge", "rebase", "reset",
+    "revert", "restore", "checkout", "commit", "tag", "fetch", "pull", "clone",
+    "rm", "rmdir", "unlink", "mv", "cp", "chmod", "chown", "kill", "sudo",
+    "curl", "wget", "ssh", "scp", "rsync", "nc", "telnet",
+    "drop", "truncate", "delete", "insert", "migrate", "seed", "restore-db",
+    "install", "uninstall", "upgrade", "prune", "clean", "apply", "destroy",
+    "terraform", "kubectl", "helm", "aws", "gcloud", "az", "docker", "podman",
+    "systemctl", "launchctl", "crontab", "mail", "sendmail",
+]);
+
+/** Read-only `git` subcommands; every consequential one is absent by design. */
+const GIT_READ_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "status", "log", "diff", "show", "branch", "blame", "describe",
+    "shortlog", "rev-parse", "ls-files", "ls-tree", "cat-file", "whatchanged",
+]);
+
+/**
+ * Head tokens that cannot write outside their arguments and whose named
+ * operation is a read, a navigation, a build, a test or a lint.
+ *
+ * `node`, `python`, `ruby`, `php` and `sh` are deliberately absent: their named
+ * operation is "run this program", which establishes nothing about what the
+ * program does. A test runner is admitted by name because the name IS the
+ * operation.
+ */
+const SAFE_HEADS: ReadonlySet<string> = new Set([
+    "ls", "pwd", "cat", "head", "tail", "wc", "file", "stat", "find",
+    "grep", "rg", "tree", "du", "df", "which", "basename", "dirname",
+    "realpath", "sort", "uniq", "cut", "diff", "cmp", "date", "echo",
+    "tsc", "eslint", "prettier", "biome", "stylelint",
+    "vitest", "jest", "mocha", "pytest", "mypy", "ruff", "flake8", "black",
+    "phpstan", "phpunit", "psalm", "pest", "rspec", "rubocop",
+    "golangci-lint", "shellcheck", "markdownlint", "hadolint",
+]);
+
+/**
+ * Multi-purpose runners: the head token decides nothing, so the subcommand
+ * must be declared. `npm run <script>` executes whatever the manifest says,
+ * which is why the script name is checked separately below.
+ */
+const RUNNER_SUBCOMMANDS: Readonly<Record<string, ReadonlySet<string>>> = {
+    npm: new Set(["test", "run", "ls", "list", "why", "outdated", "view"]),
+    pnpm: new Set(["test", "run", "ls", "list", "why", "outdated"]),
+    yarn: new Set(["test", "run", "list", "why", "info"]),
+    npx: new Set(["tsc", "eslint", "prettier", "vitest", "jest"]),
+    composer: new Set(["test", "run-script", "show", "validate", "diagnose"]),
+    cargo: new Set(["test", "build", "check", "clippy", "fmt", "tree"]),
+    go: new Set(["test", "build", "vet", "list", "version"]),
+    make: new Set(["test", "build", "lint", "check", "typecheck"]),
+    task: new Set(["test", "build", "lint", "check", "typecheck", "--list"]),
+    just: new Set(["test", "build", "lint", "check"]),
+    bundle: new Set(["exec"]),
+    dotnet: new Set(["test", "build"]),
+    mvn: new Set(["test", "compile", "verify"]),
+    gradle: new Set(["test", "build", "check"]),
+};
+
+/** Script names a `run`-style subcommand may name and stay category A. */
+const SAFE_SCRIPT_NAMES: ReadonlySet<string> = new Set([
+    "test", "tests", "lint", "typecheck", "types", "build", "check",
+    "format", "fmt", "unit", "e2e", "coverage", "compile",
+]);
+
+/** Subcommands that take a script name rather than acting themselves. */
+const SCRIPT_TAKING_SUBCOMMANDS: ReadonlySet<string> = new Set([
+    "run", "run-script", "exec",
+]);
+
+/**
+ * Is `candidate` inside `root`?
+ *
+ * Pure `path` arithmetic, no `fs`: the classifier must be decidable from the
+ * envelope alone, and a stat call would make it depend on what happens to
+ * exist on the machine that runs the hook.
+ */
+export function isInsideWorkingTree(candidate: string, root: string): boolean {
+    if (!candidate.trim() || !root.trim()) return false;
+    const abs = path.resolve(root, candidate);
+    const rel = path.relative(path.resolve(root), abs);
+    if (rel === "") return true;
+    return !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+/** Split a command on whitespace; the caller has already refused metacharacters. */
+function _argv(command: string): string[] {
+    return command.trim().split(/\s+/).filter((t) => t.length > 0);
+}
+
+/** Strip a leading `-`/`--` so a flag is never mistaken for a subcommand. */
+function _isFlag(token: string): boolean {
+    return token.startsWith("-");
+}
+
+/** First non-flag token after the head, or `""`. */
+function _firstSubcommand(argv: readonly string[]): string {
+    for (const token of argv.slice(1)) {
+        if (!_isFlag(token)) return token;
+    }
+    return "";
+}
+
+/**
+ * `git` global options that consume the NEXT token as their value.
+ *
+ * Without this, `git -C sub status` resolves its subcommand to `sub` and the
+ * whole directory-flag form — the shape the canon now teaches in place of
+ * `cd X && …` — falls out of category A. That defect was found by the friction
+ * corpus on its first run, which is the reason the corpus counts confirmations
+ * rather than gates: a gate count would have looked identical.
+ *
+ * The `--flag=value` spelling consumes no extra token and needs no entry.
+ */
+const GIT_VALUE_FLAGS: ReadonlySet<string> = new Set([
+    "-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path",
+]);
+
+/**
+ * The `git` subcommand, with global options skipped.
+ *
+ * Returns `""` when a global option's VALUE escapes the working tree — an
+ * absolute path or a `..` traversal. The check is textual rather than resolved
+ * against a root because this function is pure and receives no root; what it
+ * can decide is exactly the property that matters, and a relative path with no
+ * `..` cannot escape.
+ */
+function _gitSubcommand(argv: readonly string[]): string {
+    for (let i = 1; i < argv.length; i++) {
+        const token = argv[i] as string;
+        if (!_isFlag(token)) return token;
+        const [flag, inlineValue] = token.includes("=")
+            ? [token.slice(0, token.indexOf("=")), token.slice(token.indexOf("=") + 1)]
+            : [token, null];
+        const value = inlineValue ?? (GIT_VALUE_FLAGS.has(flag) ? argv[++i] : undefined);
+        if (value !== undefined && (path.isAbsolute(value) || value.split("/").includes(".."))) {
+            return "";
+        }
+    }
+    return "";
+}
+
+/** Non-flag token after the subcommand, or `""`. */
+function _secondSubcommand(argv: readonly string[]): string {
+    const nonFlags = argv.slice(1).filter((t) => !_isFlag(t));
+    return nonFlags[1] ?? "";
+}
+
+/**
+ * Does any token in the command name a consequence operation?
+ *
+ * Tokenised rather than substring-matched: a substring test would refuse
+ * `git log --format=…` for containing `mat`, and a classifier that refuses
+ * everything is indistinguishable from one that was never wired.
+ */
+export function namesConsequenceOperation(command: string): boolean {
+    for (const raw of _argv(command)) {
+        const token = raw.replace(/^-+/, "").toLowerCase();
+        if (CONSEQUENCE_WORDS.has(token)) return true;
+        // `npm:publish`, `db:seed`, `deploy:prod` — a namespaced script name
+        // hides the consequential half behind a separator.
+        for (const part of token.split(/[:/=,]/)) {
+            if (part && CONSEQUENCE_WORDS.has(part)) return true;
+        }
+    }
+    return false;
+}
+
+/** Is this Bash command string category A? */
+export function isCategoryABashCommand(command: string): boolean {
+    if (typeof command !== "string" || !command.trim()) return false;
+    if (SHELL_METACHARACTERS.test(command)) return false;
+    if (namesConsequenceOperation(command)) return false;
+
+    const argv = _argv(command);
+    const head = (argv[0] ?? "").toLowerCase();
+    if (!head) return false;
+
+    if (SAFE_HEADS.has(head)) return true;
+
+    if (head === "git") {
+        return GIT_READ_SUBCOMMANDS.has(_gitSubcommand(argv));
+    }
+
+    const allowed = RUNNER_SUBCOMMANDS[head];
+    if (!allowed) return false;
+    const sub = _firstSubcommand(argv);
+    if (!sub || !allowed.has(sub)) return false;
+    if (SCRIPT_TAKING_SUBCOMMANDS.has(sub)) {
+        const script = _secondSubcommand(argv);
+        return script !== "" && SAFE_SCRIPT_NAMES.has(script.toLowerCase());
+    }
+    return true;
+}
+
+/**
+ * Is this tool call category A?
+ *
+ * `workingTree` is the root every path argument must resolve inside. An empty
+ * root means the dispatcher could not establish one, and an unestablished
+ * boundary is not a boundary — the call is not category A.
+ */
+export function isCategoryA(
+    toolName: string,
+    toolInput: ToolInput,
+    workingTree: string,
+): boolean {
+    if (!workingTree.trim()) return false;
+    if (typeof toolName !== "string" || !toolName) return false;
+
+    if (READ_ONLY_TOOLS.has(toolName)) {
+        for (const key of PATH_KEYS) {
+            const value = toolInput?.[key];
+            if (typeof value !== "string") continue;
+            if (!isInsideWorkingTree(value, workingTree)) return false;
+        }
+        return true;
+    }
+
+    if (toolName === "Bash") {
+        const command = toolInput?.["command"];
+        return typeof command === "string" && isCategoryABashCommand(command);
+    }
+
+    return false;
+}

package/src/scripts/hooks/cline-dispatcher.sh

@@ -4,7 +4,7 @@
 # Routes user-scope `~/Documents/Cline/Hooks/<HookName>` events into
 # the active workspace's `./agent-config dispatch:hook`. Project-scope
 # `.clinerules/hooks/<HookName>` does NOT need this trampoline —
-# install.py `ensure_cline_bridge()` writes per-event scripts there
+# the installer's `ensure_cline_bridge()` writes per-event scripts there
 # that dispatch directly because Cline fires project hooks with the
 # workspace as cwd.
 #

package/src/scripts/hooks/cursor-dispatcher.sh

@@ -3,7 +3,7 @@
 #
 # Routes user-scope `~/.cursor/hooks.json` events into the active
 # workspace's `./agent-config dispatch:hook`. Project-scope
-# `.cursor/hooks.json` does NOT need this trampoline — install.py
+# `.cursor/hooks.json` does NOT need this trampoline — the installer
 # `ensure_cursor_bridge()` writes direct dispatch:hook commands there
 # because the project hooks fire with the workspace as cwd.
 #
@@ -20,10 +20,16 @@
 #   - Re-pipe the original JSON into
 #       ./agent-config dispatch:hook --platform cursor \
 #           --event $1 --native-event $2
-#   - Always exit 0 — Cursor's pre-hooks can block via exit code, but
-#     none of our concerns block; chat-history / roadmap-progress /
-#     context-hygiene are observe-only and onboarding-gate writes
-#     state without denying sessionStart.
+#   - Always exit 0 — Cursor's pre-hooks can block via exit code. The
+#     manifest declares 7 concerns at `severity: blocking`, and this host
+#     binds none of them: cursor's platform row carries session_start,
+#     session_end, stop, user_prompt_submit and post_tool_use, and every
+#     blocking concern sits in a slot or platform row outside that set.
+#     The count is a YAML parse of the concerns map, never `grep -c
+#     'severity: blocking'`, which returns 8 by also counting the prose
+#     line that quotes the key. What IS bound here — chat-history /
+#     roadmap-progress / context-hygiene — is observe-only, and
+#     onboarding-gate writes state without denying sessionStart.
 
 set -u
 

package/src/scripts/hooks/dispatch_hook.ts

@@ -9,12 +9,10 @@
  * stdout/stderr split, and exit codes. Helper names keep snake_case for
  * fidelity (concern authors rely on the documented surface).
  *
- * Per `docs/contracts/hook-architecture-v1.md`. Reads the manifest at
- * `scripts/hook_manifest.yaml`, resolves which concerns fire on the given
- * (platform, event) tuple, and runs each concern sequentially with the
- * stdin envelope contract. Reduces concern exit codes per the spec
- * (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is
- * fail_closed).
+ * Per `docs/contracts/hook-architecture-v1.md`. Reads `src/scripts/hook_manifest.yaml`,
+ * resolves which concerns fire on the given (platform, event) tuple, and runs each
+ * sequentially with the stdin envelope contract. Reduces concern exit codes per the
+ * spec (0=allow, 1=block, 2=warn, ≥3=error → fail-open unless concern is fail_closed).
  *
  * Invocation:
  *
@@ -50,13 +48,16 @@ import {
   setHookStdinOverride,
   clearHookStdinOverride,
 } from "./hook_stdin.js";
-import { emitFor, type Severity } from "./host_semantics.js";
+import { emitFor, type PermissionDecision, type Severity } from "./host_semantics.js";
+import { _concern_permission_verdict, _payload_tool_name, _permission_for } from "./permission_gate.js";
+export { _concern_permission_verdict, _payload_tool_input, _payload_tool_name, _permission_for, _working_tree_root } from "./permission_gate.js";
 import { _concern_body_classes, planPayloadShapes } from "./payload_stub.js";
 import { resolveSessionRole, type SessionRole } from "../_lib/session_role.js";
 import { stdinReadFailure, denyOnStdinFailure } from './stdin_failure_policy.js';
 export { stdinReadFailure, denyOnStdinFailure, _is_fail_closed_blocking } from './stdin_failure_policy.js';
 import { _py_json_dumps } from './py_json_dumps.js';
 import { _fallback_yaml } from './fallback_yaml.js';
+import { detectSurface } from '../_lib/surface.js';
 import { recordCapture, recordOpportunity } from "../_lib/collector_denominator.js";
 export { _fallback_yaml } from './fallback_yaml.js';
 
@@ -255,20 +256,6 @@ interface ConcernDef extends JsonObject {
   name: string;
 }
 
-/**
- * The tool name the host reported for this event, or `""`.
- *
- * Only tool events carry one. Read defensively: the payload is host-shaped and
- * a missing / non-string field must degrade to "unknown tool", never throw.
- */
-export function _payload_tool_name(envelope: JsonObject): string {
-  const payload = envelope["payload"];
-  if (!_isObject(payload)) {
-    return "";
-  }
-  const raw = payload["tool_name"];
-  return typeof raw === "string" ? raw : "";
-}
 
 /**
  * Per-concern tool filter — the `tools:` key.
@@ -290,7 +277,7 @@ export function _payload_tool_name(envelope: JsonObject): string {
  * - A host matcher would only help the two hosts that support one (Claude,
  *   Gemini). The in-process skip helps all eight platforms in the manifest.
  *
- * ## What this does NOT claim
+ * What this does NOT claim:
  *
  * It does not claim a latency win. The measured hook cost that was fixed was
  * the *invocation path* (~370 of ~450–500 ms was eager CLI imports); nothing in
@@ -509,6 +496,7 @@ export function _build_envelope(args: Args, payload_text: string): JsonObject {
       process.env["AGENT_SESSION_ID"] ||
       "",
     workspace_root: process.cwd(),
+    surface: detectSurface(payloadObj),
     payload: payloadObj,
     settings: {},
   };
@@ -1280,6 +1268,11 @@ export function main(argv?: string[]): number {
   // fixed-field schema (PII-exclusion-by-construction), and a concern's raw
   // stderr is free-form content. This array is in-memory only.
   const concern_messages: ConcernMessage[] = [];
+  // Per-concern permission verdicts for the host's `permissionDecision` field.
+  // Separate from `rcs` because the two ladders are not the same: an advisory
+  // concern can ask for a confirmation without blocking, and a reduced `allow`
+  // must not become a grant when one of them did.
+  const permission_verdicts: PermissionDecision[] = [];
   // Per-concern `tools:` filter (see _concern_matches_tool). Applied here so it
   // is one place, after the envelope exists and before any concern is spawned.
   const tool_name = _payload_tool_name(envelope);
@@ -1339,6 +1332,7 @@ export function main(argv?: string[]): number {
     }
     rcs.push(rc);
     const reply = _parse_concern_stdout(stdout_text);
+    permission_verdicts.push(_concern_permission_verdict(rc, reply));
     // A concern states its reason either as JSON {"reason": …} on stdout
     // (advisory concerns) or as a formatted stderr line (the block guards, e.g.
     // `block-no-verify: BLOCKED — …`). Both are captured here so the emission
@@ -1423,6 +1417,7 @@ export function main(argv?: string[]): number {
     _severity_for(final_rc) as Severity,
     decidingReasons,
     final_rc,
+    _permission_for(args.event, envelope, final_rc, permission_verdicts),
   );
   if (emission.stdout) {
     process.stdout.write(emission.stdout);

package/src/scripts/hooks/git_command_classifier.ts

@@ -116,6 +116,22 @@ export const BLOCK_OPS: ReadonlySet<GitOp> = new Set<GitOp>([
   "worktree-remove",
   /** `-x` is the flag that takes `.env` and local certificates. */
   "clean-ignored",
+
+  // ── The consequence vocabulary, added 2026-09-06. Every one is already
+  // never-autonomous in the `non-destructive-by-default` prose.
+  //
+  // MEMBERSHIP HERE IS A COUNTING DECISION, NOT A REFUSAL. The set's name
+  // predates ADR-254, which deleted the reader that blocked: the one consumer
+  // that acts on it now is `conformance_scan`'s after-the-fact tally, so
+  // "blocked" describes what the Hard Floor requires of the model, never what
+  // this package does at tool-call time.
+  "prod-deploy",
+  "prod-data-destroy",
+  "prod-infra-change",
+  "external-send",
+  "money-movement",
+  "trunk-force-push",
+  "out-of-scope-destruction",
 ]);
 
 /** Recoverable operations — warned without a this-turn authorization. */
@@ -154,6 +170,17 @@ const G = "(?:-[A-Za-z-]+(?:=\\S+)?(?:\\s+\\S+)?\\s+)*";
 /** Optional absolute/relative path in front of the tool word: `/usr/bin/npm`. */
 const P = "^(?:\\S*\\/)?";
 
+/**
+ * Tool words the consequence rows classify, as a head anchor.
+ *
+ * Kept as one constant rather than folded into each row: `commandOp` filters
+ * segments by head BEFORE consulting the table, so a row whose tool word is
+ * missing here never runs — a silent no-op that looks exactly like a pattern
+ * that did not match.
+ */
+const CONSEQUENCE_TOOL_HEAD =
+  /^(?:\S*\/)?(terraform|pulumi|kubectl|helm|aws|gcloud|az|vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku|cap|psql|mysql|mariadb|sqlite3|mongosh|mongo|redis-cli|sendmail|msmtp|mail|mailx|curl|stripe|braintree|paypal|rm)\b/i;
+
 /**
  * A `gh api` call that WRITES. Read-only `gh api` is the standard way to inspect
  * GitHub state and must never be refused.
@@ -267,6 +294,13 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   // Above `push`, and both spellings: `--force` and `--force-with-lease`. The
   // "safe force" is in the same class here because what it is safe against is a
   // stale local view, not a collaborator who pushed after your fetch.
+  {
+    op: "trunk-force-push",
+    re: new RegExp(
+      `${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)[^\\n;|&]*\\b(main|master|trunk|production|prod)\\b`,
+      "i",
+    ),
+  },
   {
     op: "force-push",
     re: new RegExp(`${P}git\\s+${G}push\\b[^\\n;|&]*(--force\\b|--force-with-lease\\b|\\s-f\\b)`, "i"),
@@ -296,6 +330,73 @@ const COMMAND_OPS: ReadonlyArray<{ op: GitOp; re: RegExp }> = [
   },
   { op: "close", re: new RegExp(`${P}gh\\s+(pr|issue)\\s+close\\b`, "i") },
 
+  // ── Consequence operations, added 2026-09-06
+  // (`road-to-authorization-that-reaches-further` 2.1).
+  //
+  // ORDER: above the generic `push`/`commit` fallbacks, because
+  // `trunk-force-push` is a `git push` and the most specific pattern must win —
+  // the rule this table states at its head.
+  //
+  // These classify commands the count could not see before. They add NOTHING to
+  // any refusal path: `commandOp` and `BLOCK_OPS` have exactly one consumer
+  // that acts on them, the after-the-fact tally in `conformance_scan`, and this
+  // change does not add a second.
+  {
+    op: "prod-data-destroy",
+    re: new RegExp(
+      `${P}(psql|mysql|mariadb|sqlite3|mongosh?)\\b[^\\n]*\\b(drop\\s+(table|database|schema)|truncate|delete\\s+from)\\b` +
+        `|${P}aws\\s+s3\\s+(rm|rb)\\b` +
+        `|${P}aws\\s+(dynamodb|rds)\\s+delete-\\S+` +
+        `|${P}redis-cli\\b[^\\n]*\\bflush(all|db)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-infra-change",
+    re: new RegExp(
+      `${P}terraform\\s+(apply|destroy)\\b` +
+        `|${P}pulumi\\s+(up|destroy)\\b` +
+        `|${P}kubectl\\s+(apply|delete|scale|drain)\\b` +
+        `|${P}helm\\s+(install|upgrade|uninstall|rollback)\\b` +
+        `|${P}aws\\s+(iam|ec2|route53|elbv2)\\s+(create|delete|put|update|modify|attach|detach)-\\S+` +
+        `|${P}(gcloud|az)\\s+\\S+\\s+(create|delete|update)\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "prod-deploy",
+    re: new RegExp(
+      `${P}(vercel|netlify|flyctl|fly|wrangler|serverless|sls|eb|heroku)\\s+${G}deploy\\b` +
+        `|${P}(vercel|netlify)\\b[^\\n]*--prod\\b` +
+        `|${P}(npm|pnpm|yarn)\\s+run\\s+deploy\\b` +
+        `|${P}cap\\s+production\\s+deploy\\b`,
+      "i",
+    ),
+  },
+  {
+    op: "external-send",
+    re: new RegExp(
+      `${P}(sendmail|msmtp|mailx?)\\b` +
+        `|${P}curl\\b(?=[^\\n]*(?:-X|--request)\\s+(?:POST|PUT|PATCH)\\b)(?=[^\\n]*https?:\\/\\/)`,
+      "i",
+    ),
+  },
+  {
+    op: "money-movement",
+    re: new RegExp(
+      `${P}(stripe|braintree|paypal)\\s+\\S*(charge|refund|payout|transfer|payment)\\S*\\b`,
+      "i",
+    ),
+  },
+  {
+    // `rm -rf` on an ABSOLUTE path or a home-relative one. Deliberately not
+    // "outside the working tree" — this function receives a command string and
+    // no cwd, so that reading is not decidable here and a classifier that
+    // guesses is worse than one that under-reports.
+    op: "out-of-scope-destruction",
+    re: new RegExp(`${P}rm\\s+(-\\S+\\s+)*-\\S*[rR]\\S*\\s+(-\\S+\\s+)*(~|/)\\S*`, "i"),
+  },
+
   { op: "push", re: new RegExp(`${P}git\\s+${G}push\\b`, "i") },
   { op: "commit", re: new RegExp(`${P}git\\s+${G}commit\\b`, "i") },
   { op: "branch", re: new RegExp(`${P}git\\s+${G}(checkout\\s+-b|switch\\s+-c)\\b`, "i") },
@@ -592,7 +693,14 @@ export function commandOp(command: string): GitOp | null {
   // unchecked once `publish` was authorized.
   let found: GitOp | null = null;
   for (const seg of invokedSegments(command)) {
-    if (!/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg)) {
+    // Widened 2026-09-06 for the consequence vocabulary. Before this the gate
+    // admitted five tool words, so `terraform apply` and `aws s3 rm` were not
+    // merely unclassified — they could not reach the table at all, and the
+    // count read them as nothing rather than as unmeasured.
+    if (
+      !/^(?:\S*\/)?(git|gh|npm|pnpm|yarn)\b/.test(seg) &&
+      !CONSEQUENCE_TOOL_HEAD.test(seg)
+    ) {
       continue;
     }
     for (const { op, re } of COMMAND_OPS) {
@@ -634,6 +742,53 @@ export function mergeTargetOf(command: string): number | null {
   return api ? _boundedTarget(api[1] as string) : null;
 }
 
+/**
+ * The object a consequence command acts on, or `null` when the command does not
+ * name one.
+ *
+ * The sibling of `mergeTargetOf`, generalised past pull-request numbers, and it
+ * inherits that function's fail-closed stance verbatim: a command that names no
+ * object matches no record, so the caller reports nothing rather than guessing.
+ * Under-reporting is the safe direction for a measurement; a guessed object
+ * would manufacture a violation out of a parse failure.
+ *
+ * Normalised to lower case with quotes stripped, so it compares against the
+ * prose side's `extractObjects` without either end re-deriving the rule.
+ */
+export function commandObject(op: GitOp, command: string): string | null {
+  const patterns = COMMAND_OBJECTS[op];
+  if (!patterns) return null;
+  for (const re of patterns) {
+    const m = new RegExp(re.source, re.flags.replace("g", "")).exec(command);
+    const raw = m?.[1];
+    if (raw) {
+      const value = raw.trim().replace(/^["'`]+|["'`]+$/g, "").replace(/[.,;:]+$/, "").toLowerCase();
+      if (value) return value;
+    }
+  }
+  return null;
+}
+
+/** Per-operation object patterns on the COMMAND side. */
+const COMMAND_OBJECTS: Readonly<Record<string, readonly RegExp[]>> = {
+  "prod-data-destroy": [
+    /\bdrop\s+(?:table|database|schema|collection)\s+(?:if\s+exists\s+)?["'`]?([\w.$-]+)/i,
+    /\btruncate\s+(?:table\s+)?["'`]?([\w.$-]+)/i,
+    /\bdelete\s+from\s+["'`]?([\w.$-]+)/i,
+    /\bs3:\/\/([\w.-]+)/i,
+    /--table-name[= ]["'`]?([\w.-]+)/i,
+  ],
+  "external-send": [
+    /\bhttps?:\/\/([^\s/"'`]+)/i,
+    /([A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})/,
+  ],
+  "money-movement": [
+    /--customer[= ]["'`]?([\w.-]+)/i,
+    /--amount[= ]["'`]?([\d.,]+)/i,
+    /\b(\d[\d.,]*)\s*(?:eur|usd)\b/i,
+  ],
+};
+
 /** A target only counts inside the API's own range; anything else is no target. */
 function _boundedTarget(digits: string): number | null {
   const n = Number.parseInt(digits, 10);