@fusengine/harness 0.1.78 → 0.1.79

package/dist/cli/bin.mjs

@@ -293,6 +293,624 @@ function runSecurityScan(dir) {
 	};
 }
 //#endregion
+//#region src/codex-rules/rules/rm-variants.ts
+/**
+* `rm` prefix rules — hand-mapped from `security.ts`'s two `rm -rf`-family
+* CRITICAL_PATTERNS labels. Both source regexes accept `-rf`/`-fr` combined
+* or `-r -f`/`-f -r` split flags, so each label needs 3 prefix_rule variants
+* (combined flag + 2 split-flag orders) to avoid a flag-order gap.
+*/
+const RM_VARIANT_RULES = [
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of / or ~",
+		pattern: [
+			"rm",
+			["-rf", "-fr"],
+			["/", "~"]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of the filesystem root or home directory.",
+		match: ["rm -rf /", "rm -fr ~"],
+		notMatch: ["rm -rf /tmp/build"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of / or ~",
+		pattern: [
+			"rm",
+			"-r",
+			"-f",
+			["/", "~"]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of the filesystem root or home directory (split flags).",
+		match: ["rm -r -f /", "rm -r -f ~"],
+		notMatch: ["rm -r -f /tmp/build"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of / or ~",
+		pattern: [
+			"rm",
+			"-f",
+			"-r",
+			["/", "~"]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of the filesystem root or home directory (split flags, reversed).",
+		match: ["rm -f -r /", "rm -f -r ~"],
+		notMatch: ["rm -f -r /tmp/build"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of a system directory",
+		pattern: [
+			"rm",
+			["-rf", "-fr"],
+			[
+				"/etc",
+				"/usr",
+				"/var",
+				"/bin",
+				"/sbin",
+				"/boot",
+				"/lib"
+			]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of a core system directory.",
+		match: ["rm -rf /etc", "rm -fr /usr"],
+		notMatch: ["rm -rf /home/user/project"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of a system directory",
+		pattern: [
+			"rm",
+			"-r",
+			"-f",
+			[
+				"/etc",
+				"/usr",
+				"/var",
+				"/bin",
+				"/sbin",
+				"/boot",
+				"/lib"
+			]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of a core system directory (split flags).",
+		match: ["rm -r -f /var", "rm -r -f /bin"],
+		notMatch: ["rm -r -f /home/user"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive delete of a system directory",
+		pattern: [
+			"rm",
+			"-f",
+			"-r",
+			[
+				"/etc",
+				"/usr",
+				"/var",
+				"/bin",
+				"/sbin",
+				"/boot",
+				"/lib"
+			]
+		],
+		decision: "forbidden",
+		justification: "Recursive force-delete of a core system directory (split flags, reversed).",
+		match: ["rm -f -r /sbin", "rm -f -r /lib"],
+		notMatch: ["rm -f -r /tmp"]
+	}
+];
+//#endregion
+//#region src/codex-rules/rules/mkfs.ts
+/**
+* `mkfs` filesystem-formatting variants — hand-mapped from `security.ts`'s
+* `\bmkfs(?:\.[a-z0-9]+)?\b` CRITICAL_PATTERNS label. The source regex
+* accepts ANY `.suffix`; `prefix_rule` cannot express an open-ended suffix,
+* so every real-world `mkfs.*` filesystem type is enumerated explicitly as
+* an alternation at position 0 (exhaustive, not a mechanical derivation).
+*/
+const MKFS_RULES = [{
+	sourceLabel: "CRITICAL: Detected dangerous command 'mkfs'",
+	pattern: [[
+		"mkfs",
+		"mkfs.ext2",
+		"mkfs.ext3",
+		"mkfs.ext4",
+		"mkfs.xfs",
+		"mkfs.btrfs",
+		"mkfs.exfat",
+		"mkfs.vfat",
+		"mkfs.fat",
+		"mkfs.ntfs",
+		"mkfs.f2fs",
+		"mkfs.hfsplus",
+		"mkfs.apfs",
+		"mkfs.msdos",
+		"mkfs.minix",
+		"mkfs.jfs",
+		"mkfs.reiserfs",
+		"mkfs.udf",
+		"mkfs.bfs",
+		"mkfs.cramfs"
+	]],
+	decision: "forbidden",
+	justification: "Formats a block device, destroying its contents (exhaustive mkfs.* variant enumeration).",
+	match: [
+		"mkfs.exfat /dev/sda1",
+		"mkfs.f2fs /dev/sdb1",
+		"mkfs /dev/sdb1",
+		"mkfs.ext4 /dev/sda1"
+	],
+	notMatch: ["ls /dev"]
+}];
+//#endregion
+//#region src/codex-rules/rules/diskutil.ts
+/**
+* `diskutil` erase/partition variants — hand-mapped from `security.ts`'s
+* case-insensitive `\bdiskutil\s+(?:erase|partitionDisk)\b/i` CRITICAL
+* label. `prefix_rule` has no case-insensitive matching, so every real
+* casing macOS users actually type (camelCase, all-lowercase, all-caps) is
+* enumerated explicitly as an alternation at position 1.
+*/
+const DISKUTIL_RULES = [{
+	sourceLabel: "CRITICAL: Detected dangerous command 'diskutil erase'",
+	pattern: ["diskutil", [
+		"erase",
+		"eraseDisk",
+		"erasedisk",
+		"ERASEDISK",
+		"eraseVolume",
+		"erasevolume",
+		"ERASEVOLUME",
+		"partitionDisk",
+		"partitiondisk",
+		"PARTITIONDISK"
+	]],
+	decision: "forbidden",
+	justification: "Erases or repartitions a macOS disk/volume (case-variant enumeration; execpolicy has no case-insensitive match).",
+	match: [
+		"diskutil eraseDisk /dev/disk2",
+		"diskutil ERASEDISK /dev/disk2",
+		"diskutil erase /dev/disk2"
+	],
+	notMatch: ["diskutil list"]
+}];
+//#endregion
+//#region src/codex-rules/rules/dd.ts
+/**
+* `dd` — hand-mapped from `security.ts`'s `CRITICAL: Detected dangerous
+* command 'dd if='` label (source regex only fires on `of=/dev/...`).
+* Owner decision: DOWNGRADE forbidden -> prompt. `prefix_rule` cannot
+* glob-match a `key=value` argv token against a raw-device path, so a
+* literal forbidden translation would silently block legitimate
+* `dd if=a.img of=b.img` usage — prompting on every `dd` invocation instead
+* never lets a raw-disk write through silently, without blocking safe use.
+*/
+const DD_RULES = [{
+	sourceLabel: "CRITICAL: Detected dangerous command 'dd if='",
+	pattern: ["dd"],
+	decision: "prompt",
+	justification: "dd can overwrite a raw block device via of=/dev/...; prompts on every dd invocation (broader than security.ts, which only fires on of=/dev/*) because execpolicy cannot glob-match that argv token — owner decision: do not block legitimate dd usage.",
+	match: ["dd if=/dev/zero of=/dev/sda", "dd if=a.img of=b.img"]
+}];
+//#endregion
+//#region src/codex-rules/rules/single-commands.ts
+/**
+* Single-purpose destructive binaries — hand-mapped 1:1 from `security.ts`'s
+* `chmod 777 on /`, `shred`, `fdisk` CRITICAL_PATTERNS labels. `mkfs`,
+* `dd`, and `diskutil erase` live in their own files (`mkfs.ts`, `dd.ts`,
+* `diskutil.ts`) — each needed a wider case/variant enumeration than fits
+* this file's SRP scope. The root-chmod rule needs the same flag-order
+* alternation as `chmod-ask.ts` — source security.ts accepts flags before
+* `777` for the root case too (`chmod -R 777 /` is still CRITICAL there).
+*/
+const SINGLE_COMMAND_RULES = [
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777 on /",
+		pattern: [
+			"chmod",
+			"777",
+			"/"
+		],
+		decision: "forbidden",
+		justification: "World-writable permissions on the filesystem root.",
+		match: ["chmod 777 /"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777 on /",
+		pattern: [
+			"chmod",
+			"-R",
+			"777",
+			"/"
+		],
+		decision: "forbidden",
+		justification: "World-writable permissions on the filesystem root, recursive.",
+		match: ["chmod -R 777 /"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777 on /",
+		pattern: [
+			"chmod",
+			"-r",
+			"777",
+			"/"
+		],
+		decision: "forbidden",
+		justification: "World-writable permissions on the filesystem root, recursive (lowercase flag).",
+		match: ["chmod -r 777 /"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777 on /",
+		pattern: [
+			"chmod",
+			"-v",
+			"777",
+			"/"
+		],
+		decision: "forbidden",
+		justification: "World-writable permissions on the filesystem root, verbose flag.",
+		match: ["chmod -v 777 /"]
+	},
+	{
+		sourceLabel: "CRITICAL: Detected dangerous command 'shred'",
+		pattern: ["shred"],
+		decision: "forbidden",
+		justification: "Irreversibly overwrites file contents.",
+		match: ["shred -u secrets.txt"],
+		notMatch: ["cat secrets.txt"]
+	},
+	{
+		sourceLabel: "CRITICAL: Detected dangerous command 'fdisk'",
+		pattern: ["fdisk"],
+		decision: "forbidden",
+		justification: "Edits disk partition tables.",
+		match: ["fdisk /dev/sda"],
+		notMatch: ["cat /proc/partitions"]
+	}
+];
+//#endregion
+//#region src/codex-rules/rules/privilege.ts
+/**
+* Privilege-escalation binaries — hand-mapped 1:1 from `security.ts`'s
+* `sudo`/`su`/`doas`/`passwd`/`del` CRITICAL_PATTERNS labels (parity
+* `security_rules.PRIVILEGE_COMMANDS`).
+*/
+const PRIVILEGE_RULES = [
+	{
+		sourceLabel: "PRIVILEGE ESCALATION: sudo",
+		pattern: ["sudo"],
+		decision: "forbidden",
+		justification: "Runs a command with elevated privileges.",
+		match: ["sudo rm -rf /tmp"],
+		notMatch: ["echo sudo"]
+	},
+	{
+		sourceLabel: "PRIVILEGE ESCALATION: su",
+		pattern: ["su"],
+		decision: "forbidden",
+		justification: "Switches to another user, typically root.",
+		match: ["su -", "su root"],
+		notMatch: ["sudo ls"]
+	},
+	{
+		sourceLabel: "PRIVILEGE ESCALATION: doas",
+		pattern: ["doas"],
+		decision: "forbidden",
+		justification: "BSD-style sudo alternative for elevated privileges.",
+		match: ["doas reboot"],
+		notMatch: ["ls"]
+	},
+	{
+		sourceLabel: "PRIVILEGE ESCALATION: passwd",
+		pattern: ["passwd"],
+		decision: "forbidden",
+		justification: "Changes a user's password.",
+		match: ["passwd root"],
+		notMatch: ["cat /etc/passwd"]
+	},
+	{
+		sourceLabel: "CRITICAL: Detected dangerous command 'del'",
+		pattern: ["del"],
+		decision: "forbidden",
+		justification: "Windows-style file deletion (parity security_rules.CRITICAL_COMMANDS).",
+		match: ["del file.txt"],
+		notMatch: ["delete.sh"]
+	}
+];
+//#endregion
+//#region src/codex-rules/rules/ask.ts
+/**
+* `prompt`-decision rules — hand-mapped 1:1 from `security.ts`'s
+* ASK_PATTERNS. `DANGEROUS PATTERN: chmod 777` lives in `chmod-ask.ts`
+* (needed multiple flag-order variants). `DANGEROUS PATTERN: write to /etc`
+* is intentionally absent here: it fires on shell redirection
+* (`> /etc/...`), which is not a single argv invocation — see
+* `../skip-list.ts`.
+*/
+const ASK_RULES$1 = [
+	{
+		sourceLabel: "DANGEROUS PATTERN: recursive chown",
+		pattern: ["chown", "-R"],
+		decision: "prompt",
+		justification: "Recursive ownership change; confirm scope.",
+		match: ["chown -R user:user /srv/app"],
+		notMatch: ["chown user file.txt"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: eval",
+		pattern: ["eval"],
+		decision: "prompt",
+		justification: "Evaluates arbitrary shell input.",
+		match: ["eval $(cat script.sh)"],
+		notMatch: ["node eval.js"]
+	},
+	{
+		sourceLabel: "DELETE: 'rm' permanently deletes - confirmation required",
+		pattern: ["rm"],
+		decision: "prompt",
+		justification: "rm permanently deletes; confirm before running.",
+		match: ["rm file.txt"],
+		notMatch: ["rmdir empty"]
+	},
+	{
+		sourceLabel: "DELETE: 'unlink' command detected - confirmation required",
+		pattern: ["unlink"],
+		decision: "prompt",
+		justification: "unlink permanently removes a file; confirm before running.",
+		match: ["unlink file.txt"],
+		notMatch: ["ln -s a b"]
+	}
+];
+//#endregion
+//#region src/codex-rules/rules/chmod-ask.ts
+/**
+* `chmod 777` `prompt`-decision variants — hand-mapped from `security.ts`'s
+* `DANGEROUS PATTERN: chmod 777` ASK_PATTERNS label. The source regex
+* accepts any chain of `-[a-zA-Z]+` flags before `777`; `prefix_rule` needs
+* one literal-token variant per common flag order, so every frequent
+* ordering is enumerated. Always `prompt`: `prefix_rule` cannot distinguish
+* an absolute-path target from a relative one, so both are prompted rather
+* than letting an absolute-path `chmod 777` fall through silently.
+*/
+const CHMOD_ASK_RULES = [
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: ["chmod", "777"],
+		decision: "prompt",
+		justification: "World-writable permissions; confirm the target is intended.",
+		match: ["chmod 777 file.txt", "chmod 777 /tmp/file"],
+		notMatch: ["chmod 755 file.txt"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: [
+			"chmod",
+			"-R",
+			"777"
+		],
+		decision: "prompt",
+		justification: "World-writable permissions, recursive; confirm the target is intended.",
+		match: ["chmod -R 777 dir"],
+		notMatch: ["chmod -R 755 dir"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: [
+			"chmod",
+			"-r",
+			"777"
+		],
+		decision: "prompt",
+		justification: "World-writable permissions, recursive (lowercase flag); confirm the target is intended.",
+		match: ["chmod -r 777 dir"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: [
+			"chmod",
+			"-v",
+			"777"
+		],
+		decision: "prompt",
+		justification: "World-writable permissions, verbose flag; confirm the target is intended.",
+		match: ["chmod -v 777 file.txt"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: [
+			"chmod",
+			"-Rv",
+			"777"
+		],
+		decision: "prompt",
+		justification: "World-writable permissions, combined recursive+verbose flags; confirm the target is intended.",
+		match: ["chmod -Rv 777 dir"]
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: chmod 777",
+		pattern: [
+			"chmod",
+			"-vR",
+			"777"
+		],
+		decision: "prompt",
+		justification: "World-writable permissions, combined verbose+recursive flags; confirm the target is intended.",
+		match: ["chmod -vR 777 dir"]
+	}
+];
+//#endregion
+//#region src/codex-rules/rules/remote-fetch.ts
+/**
+* Remote-fetch tools (`curl`/`wget`) — targets the DOWNLOAD half of a
+* `curl ... | sh` pipe instead of the shell half. Codex splits a piped
+* command into independent argv segments at the pipe, so a `prefix_rule`
+* anchored on `curl`/`wget` catches the attack regardless of which shell
+* receives the piped output on the other side — unlike a bare-shell rule
+* (`sh`/`bash`/`zsh`), which prompts on EVERY Codex-issued `bash -lc "..."`
+* wrapper (Codex wraps essentially all shell commands this way), producing
+* noise on ~50% of legitimate day-to-day work. Owner decision: DOWNGRADE
+* forbidden -> prompt, same rationale as `dd.ts` — `prefix_rule` cannot see
+* the pipe operator itself, so it cannot distinguish a bare `curl url`
+* fetch from `curl url | sh`; prompting on every curl/wget invocation never
+* lets the attack through silently, without blocking legitimate downloads.
+*/
+const REMOTE_FETCH_RULES = [{
+	sourceLabel: "DANGEROUS PATTERN: remote script piped to a shell",
+	pattern: [["curl", "wget"]],
+	decision: "prompt",
+	justification: "Remote fetch; piping its output into a shell executes untrusted code. Broader than security.ts (which only fires when the fetch is piped into sh/bash/zsh): prompts on every curl/wget invocation because execpolicy cannot see the pipe operator, i.e. it cannot distinguish `curl url` from `curl url | sh` — owner decision: do not block legitimate curl/wget usage.",
+	match: [
+		"curl http://example.com/i.sh",
+		"wget http://example.com/i.sh",
+		"curl -fsSL http://example.com/i.sh"
+	],
+	notMatch: ["cursor --version", "widget-tool build"]
+}];
+//#endregion
+//#region src/codex-rules/rules/absolute-paths.ts
+/**
+* Absolute-path executable aliases — Codex only resolves an absolute path
+* to its basename rule when the CLI is run with `--resolve-host-executables`
+* (opt-in, off by default; this generated `.rules` file cannot assume it).
+* `/bin/rm -rf /` and a bare `rm -rf /` are two DIFFERENT argv prefixes to
+* execpolicy, so every rule keyed on one of these bare names is mirrored
+* onto its common absolute-path forms.
+*/
+const ABSOLUTE_PATH_ALIASES = {
+	rm: ["/bin/rm", "/usr/bin/rm"],
+	chmod: ["/bin/chmod", "/usr/bin/chmod"],
+	diskutil: ["/usr/sbin/diskutil"],
+	dd: ["/bin/dd", "/usr/bin/dd"],
+	sudo: ["/usr/bin/sudo"]
+};
+/** Escape regex metacharacters so a dynamic token can be safely embedded in a `RegExp` literal. */
+function escapeRegExp(token) {
+	return token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Replace a match/notMatch example's leading token with an absolute-path alias. */
+function aliasExample(example, from, to) {
+	return example.replace(new RegExp(`^${escapeRegExp(from)}\\b`), to);
+}
+/**
+* Clone every rule in `rules` whose first pattern token has a known
+* absolute-path alias, producing one variant per alias (same decision,
+* same sourceLabel — traced back to the same `security.ts` label).
+*/
+function withAbsolutePathAliases(rules) {
+	const out = [];
+	for (const rule of rules) {
+		const first = rule.pattern[0];
+		if (typeof first !== "string") continue;
+		const aliases = ABSOLUTE_PATH_ALIASES[first];
+		if (!aliases) continue;
+		for (const alias of aliases) out.push({
+			...rule,
+			pattern: [alias, ...rule.pattern.slice(1)],
+			match: rule.match.map((m) => aliasExample(m, first, alias)),
+			notMatch: rule.notMatch?.map((m) => aliasExample(m, first, alias)),
+			justification: `${rule.justification} (absolute-path form; Codex does not resolve executable basenames by default).`
+		});
+	}
+	return out;
+}
+//#endregion
+//#region src/codex-rules/skip-list.ts
+/**
+* `security.ts` labels with NO argv-prefix equivalent. Every entry here is
+* shell syntax (pipes, redirection, function-definition syntax) that never
+* appears as a plain argv token when a command is exec'd without a shell —
+* Codex execpolicy's `prefix_rule` cannot express them. Covered instead by
+* `sandbox_mode`/`approval_policy`. Never drop a label silently: it is
+* either a prefix_rule (see `rules/`) or an entry here.
+*/
+const SKIP_LIST = [
+	{
+		sourceLabel: "DANGEROUS PATTERN: fork bomb",
+		reason: "Shell function-definition syntax `:(){ :|:& };:` is not a single argv invocation — no prefix_rule can express it."
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: redirect to a raw disk device",
+		reason: "`>`/`>>` redirection to /dev/sda is shell syntax, invisible to argv-prefix matching."
+	},
+	{
+		sourceLabel: "DANGEROUS PATTERN: write to /etc",
+		reason: "`>`/`>>` redirection into /etc/* is shell syntax, invisible to argv-prefix matching."
+	}
+];
+//#endregion
+//#region src/codex-rules/mapping.ts
+/** Every `decision = "forbidden"` rule, hand-mapped from CRITICAL_PATTERNS. */
+const CRITICAL_BASE = [
+	...RM_VARIANT_RULES,
+	...MKFS_RULES,
+	...DISKUTIL_RULES,
+	...SINGLE_COMMAND_RULES,
+	...PRIVILEGE_RULES
+];
+/** Every `decision = "prompt"` rule, hand-mapped from ASK_PATTERNS (+ dd, downgraded). */
+const ASK_BASE = [
+	...ASK_RULES$1,
+	...CHMOD_ASK_RULES,
+	...DD_RULES,
+	...REMOTE_FETCH_RULES
+];
+/** Absolute-path mirrors of the bare-name rules above (see `rules/absolute-paths.ts`). */
+const ABSOLUTE_ALIASES = withAbsolutePathAliases([...CRITICAL_BASE, ...ASK_BASE]);
+const CRITICAL_RULES = [...CRITICAL_BASE, ...ABSOLUTE_ALIASES.filter((r) => r.decision === "forbidden")];
+const ASK_RULES = [...ASK_BASE, ...ABSOLUTE_ALIASES.filter((r) => r.decision === "prompt")];
+/** Every generated `prefix_rule`, critical (`forbidden`) + ask (`prompt`). */
+const ALL_RULES = [...CRITICAL_RULES, ...ASK_RULES];
+//#endregion
+//#region src/codex-rules/starlark.ts
+/**
+* Neutralize characters that would break out of a Starlark `#` line comment
+* (a bare `\n`/`\r` in an interpolated label/reason would start a new line
+* no longer prefixed by `#`, corrupting the generated file).
+*/
+function sanitizeComment(text) {
+	return text.replace(/[\r\n]+/g, " ");
+}
+/** Render a string array as a Starlark list literal (double-quoted strings). */
+function starlarkList(values) {
+	return `[${values.map((v) => JSON.stringify(v)).join(", ")}]`;
+}
+/** Render one pattern element: a bare token, or a `[...]` alternation. */
+function starlarkPatternElement(el) {
+	return Array.isArray(el) ? starlarkList(el) : JSON.stringify(el);
+}
+/**
+* Render a single `CodexPrefixRule` as a Starlark `prefix_rule(...)` call,
+* prefixed by a traceability comment pointing back at its `security.ts` label.
+*/
+function renderPrefixRule(rule) {
+	const pattern = `[${rule.pattern.map(starlarkPatternElement).join(", ")}]`;
+	const lines = [
+		`# source: security.ts label "${sanitizeComment(rule.sourceLabel)}"`,
+		"prefix_rule(",
+		`    pattern = ${pattern},`,
+		`    decision = "${rule.decision}",`,
+		`    justification = ${JSON.stringify(rule.justification)},`,
+		`    match = ${starlarkList(rule.match)},`
+	];
+	if (rule.notMatch && rule.notMatch.length > 0) lines.push(`    not_match = ${starlarkList(rule.notMatch)},`);
+	lines.push(")");
+	return lines.join("\n");
+}
+/** Render a list of rules, each block separated by a blank line. */
+function renderPrefixRules(rules) {
+	return rules.map(renderPrefixRule).join("\n\n");
+}
+//#endregion
+//#region src/codex-rules/build.ts
+const HEADER = "# Codex execpolicy rules — generated from @fusengine/harness src/policy/guards/security.ts\n# DO NOT hand-edit: regenerate via `harness codex-rules`.\n#\n# security.ts is the source of truth for dangerous-command detection; every\n# CRITICAL_PATTERNS label maps to decision = \"forbidden\", every ASK_PATTERNS\n# label maps to decision = \"prompt\". Strictest decision wins across matches.\n# The harness remains the AUTHORITATIVE enforcement layer — this file is a\n# complementary defense layer on the Codex side, not a replacement.\n#\n# IRREDUCIBLE gaps (shell syntax, invisible to argv-prefix matching, no\n# prefix_rule can express them) — compensated by sandbox_mode +\n# approval_policy.granular.sandbox_approval, not by this file:\n#   - fork bomb: `:(){ :|:& };:`\n#   - redirect to a raw disk device: `> /dev/sda`\n#   - write to /etc via redirection: `> /etc/...`\n#\n# ASSUMED over-width (intentionally broader than security.ts, chosen to\n# avoid a silent gap rather than an exact-but-brittle translation):\n#   - dd: prompts on every dd invocation; security.ts only fires on of=/dev/*\n#   - rm: prompts even on paths security.ts exempts via a 'trash' substring\n#   - rm/eval/unlink: prompts even on a bare token with no trailing argument;\n#     security.ts requires a space (i.e. an argument) after the command\n#   - chmod 777: prompts on relative paths too, not only absolute ones\n#   - sudo (/usr/bin/sudo alias): forbids the absolute-path form too;\n#     security.ts's word-boundary regex does not match a preceding '/'\n#   - curl/wget: prompts on EVERY curl/wget invocation, not only when piped\n#     into a shell; security.ts's \"remote script piped to a shell\" label\n#     only fires on `curl|wget ... | sh`. A simple plain-word pipe IS split\n#     by Codex into separate argv commands (a bare-shell rule would also\n#     catch that case), but this rule additionally targets the download\n#     half for compound chains and non-shell payload execution where\n#     sh/bash never appears as argv[0] (curl -o x && chmod +x x && ./x,\n#     curl ... | python3); it replaces a former bare sh/bash/zsh heuristic\n#     that prompted on ~50% of Codex's own `bash -lc \"...\"` command\n#     wrapping and rarely caught the actual download\n#\n# NOT covered (out of scope, not an over-width — a purely local pipe with no\n# network fetch is invisible to this rule AND to security.ts, which only\n# matches curl/wget as the left-hand side of the pipe):\n#   - `cat file | sh`: local pipe, no curl/wget involved\n#   - quoted-variable/redirection installer one-liners, e.g.\n#     `curl -fsSL \"$URL\" | sh`: variable substitution disables Codex's\n#     pipe-splitting, collapsing the whole invocation to a single\n#     ['bash', '-lc', '<script>'] where curl is not argv[0] — this exact\n#     form was covered by the removed bare sh/bash heuristic and is no\n#     longer covered by any rule here\n#\n# The following labels have NO argv-prefix equivalent at all (shell syntax\n# not visible to execpolicy's argv matching) and are intentionally NOT\n# expressed as prefix_rule() below — covered instead by sandbox_mode/approval_policy:";
+/** Render the full Codex execpolicy `.rules` Starlark file as a string. */
+function buildCodexRules() {
+	return `${HEADER}\n${SKIP_LIST.map((s) => `#   - ${sanitizeComment(s.sourceLabel)}: ${sanitizeComment(s.reason)}`).join("\n")}\n\n${renderPrefixRules(ALL_RULES)}\n`;
+}
+//#endregion
 //#region src/refs/discover.ts
 /** Immediate subdirectory names of `p`, or `[]` when it is missing/inaccessible. */
 function subdirs(p) {
@@ -412,6 +1030,7 @@ function maybePlaySound(argv) {
 *   harness init [id]      write the wiring file for a harness (defaults to the detected one)
 *   harness hook <id>      runtime: read a hook payload on stdin, route to the adapter, print the response
 *   harness changelog      fetch + diff the Claude Code changelog, print a JSON summary (changelog-watcher)
+*   harness codex-rules    generate a Codex execpolicy .rules (Starlark) file from security.ts; stdout or --out <path>
 */
 const hookDebug = process.env.FUSE_HARNESS_DEBUG === "1";
 function traceHook(label, data) {
@@ -503,6 +1122,15 @@ else if (cmd === "scan") {
 	const dir = process.argv[3] ?? process.cwd();
 	process.stdout.write(JSON.stringify(runSecurityScan(dir), null, 2) + "\n");
 	process.exit(0);
+} else if (cmd === "codex-rules") {
+	const outIdx = process.argv.indexOf("--out");
+	const outPath = outIdx !== -1 ? process.argv[outIdx + 1] : void 0;
+	const rules = buildCodexRules();
+	if (outPath) {
+		writeFileSync(outPath, rules);
+		process.stderr.write(`harness: wrote Codex execpolicy rules -> ${outPath}\n`);
+	} else process.stdout.write(rules);
+	process.exit(0);
 } else {
 	const files = stagedFiles();
 	if (files.length === 0) process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.78",
+  "version": "0.1.79",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",