@fusengine/harness 0.1.90 → 0.1.92

package/src/cli/json-primitive-scanner.ts

@@ -0,0 +1,83 @@
+type NumberState = "minus" | "zero" | "integer" | "dot" | "fraction" | "exponentMark" | "exponentSign" | "exponent";
+
+/** Validate one JSON literal or number incrementally with constant state. */
+export class JsonPrimitiveScanner {
+  private literal: "true" | "false" | "null" | undefined;
+  private literalIndex = 0;
+  private number: NumberState | undefined;
+  private valid = true;
+
+  constructor(firstByte: number) {
+    if (firstByte === 0x74) { this.literal = "true"; this.literalIndex = 1; }
+    else if (firstByte === 0x66) { this.literal = "false"; this.literalIndex = 1; }
+    else if (firstByte === 0x6e) { this.literal = "null"; this.literalIndex = 1; }
+    else if (firstByte === 0x2d) this.number = "minus";
+    else if (firstByte === 0x30) this.number = "zero";
+    else if (isOneToNine(firstByte)) this.number = "integer";
+    else this.valid = false;
+  }
+
+  /** Consume one non-delimiter byte and report whether the prefix stays valid. */
+  write(byte: number): boolean {
+    if (!this.valid) return false;
+    if (this.literal) {
+      this.valid = this.literal.charCodeAt(this.literalIndex) === byte;
+      this.literalIndex += 1;
+      return this.valid && this.literalIndex <= this.literal.length;
+    }
+    this.valid = this.writeNumber(byte);
+    return this.valid;
+  }
+
+  /** Return whether the accumulated primitive is complete JSON grammar. */
+  finish(): boolean {
+    if (!this.valid) return false;
+    if (this.literal) return this.literalIndex === this.literal.length;
+    return this.number === "zero" || this.number === "integer" || this.number === "fraction" || this.number === "exponent";
+  }
+
+  private writeNumber(byte: number): boolean {
+    if (this.number === "minus") return this.digitAfter(byte, "zero", "integer");
+    if (this.number === "zero") return this.afterInteger(byte, false);
+    if (this.number === "integer") {
+      if (isDigit(byte)) return true;
+      return this.afterInteger(byte, true);
+    }
+    if (this.number === "dot") {
+      if (!isDigit(byte)) return false;
+      this.number = "fraction";
+      return true;
+    }
+    if (this.number === "fraction") {
+      if (isDigit(byte)) return true;
+      return this.startExponent(byte);
+    }
+    if (this.number === "exponentMark") {
+      if (byte === 0x2b || byte === 0x2d) { this.number = "exponentSign"; return true; }
+      return this.digitAfter(byte, "exponent", "exponent");
+    }
+    if (this.number === "exponentSign") return this.digitAfter(byte, "exponent", "exponent");
+    return this.number === "exponent" && isDigit(byte);
+  }
+
+  private afterInteger(byte: number, digitAllowed: boolean): boolean {
+    if (digitAllowed && isDigit(byte)) return true;
+    if (byte === 0x2e) { this.number = "dot"; return true; }
+    return this.startExponent(byte);
+  }
+
+  private startExponent(byte: number): boolean {
+    if (byte !== 0x65 && byte !== 0x45) return false;
+    this.number = "exponentMark";
+    return true;
+  }
+
+  private digitAfter(byte: number, zero: NumberState, nonzero: NumberState): boolean {
+    if (byte === 0x30) { this.number = zero; return true; }
+    if (isOneToNine(byte)) { this.number = nonzero; return true; }
+    return false;
+  }
+}
+
+function isDigit(byte: number): boolean { return byte >= 0x30 && byte <= 0x39; }
+function isOneToNine(byte: number): boolean { return byte >= 0x31 && byte <= 0x39; }

package/src/cli/run.ts

@@ -0,0 +1,36 @@
+import { execFileSync } from "node:child_process";
+import { evaluate } from "../policy/evaluate";
+import { formatPrompt } from "../prompt/types";
+import { isCodeFile } from "../util/project-root";
+
+/** Staged files (Added/Copied/Modified/Renamed). Uses `node:child_process` (Bun shell can hang on `git show`). */
+export function stagedFiles(): string[] {
+  const out = execFileSync("git", ["diff", "--cached", "--name-only", "--diff-filter=ACMR"], {
+    encoding: "utf8",
+  });
+  return out.trim().split("\n").filter(Boolean);
+}
+
+/**
+ * Read a file's staged (index) content — not the working-tree version.
+ * Uses `execFileSync` with an argv array (never a shell), so a staged
+ * filename containing shell metacharacters (backticks, `$(...)`, quotes)
+ * reaches `git show` as a single literal argument — see issue #87.
+ */
+export function stagedContent(path: string): string {
+  return execFileSync("git", ["show", `:${path}`], { encoding: "utf8" });
+}
+
+/**
+ * Evaluate staged code files against the policy core; return violation blocks.
+ * `read` is injected (the real impl is {@link stagedContent}) so this is pure + testable.
+ */
+export function checkStaged(files: string[], read: (path: string) => string): string[] {
+  const violations: string[] = [];
+  for (const file of files) {
+    if (!isCodeFile(file)) continue;
+    const r = evaluate({ tool: "Write", filePath: file, content: read(file) });
+    if (r.decision === "deny" && r.prompt) violations.push(`${file}\n${formatPrompt(r.prompt)}`);
+  }
+  return violations;
+}

package/src/cli/scope.ts

@@ -0,0 +1,31 @@
+/**
+ * CLI scope argument parsing for `harness hook <id> [scope]`. The scope set is
+ * closed (plugin-scoped lifecycle behaviors); an unknown value historically
+ * fell back to `"core"` SILENTLY, which made a typo'd plugin name apply the
+ * core guards with no sign of the mistake. The fallback stays (wiring
+ * compatibility) but now warns on stderr — harnesses never parse stderr, so
+ * the wire contract is untouched.
+ */
+import type { PluginScope } from "../runtime/lifecycle";
+
+/** Closed set of plugin scopes accepted after `harness hook <id>`. */
+const VALID_SCOPES = new Set<string>([
+  "solid", "rules", "carto", "security", "changelog",
+  "aipilot", "lessons", "seo", "memory", "tailwindcss",
+]);
+
+/**
+ * Parse the optional scope argument.
+ * @param scopeArg - `process.argv[4]`, when present.
+ * @param err - Warning sink (defaults to stderr; injectable for tests).
+ * @returns The valid scope, or `"core"` (with a warning) otherwise.
+ */
+export function parseScope(
+  scopeArg: string | undefined,
+  err: (msg: string) => void = (m) => process.stderr.write(m),
+): PluginScope {
+  if (scopeArg !== undefined && scopeArg !== "core" && !VALID_SCOPES.has(scopeArg)) {
+    err(`harness: unknown scope "${scopeArg}", falling back to "core"\n`);
+  }
+  return scopeArg !== undefined && VALID_SCOPES.has(scopeArg) ? (scopeArg as PluginScope) : "core";
+}

package/src/codex-rules/build.ts

@@ -0,0 +1,63 @@
+import { ALL_RULES, SKIP_LIST } from "./mapping";
+import { renderPrefixRules, sanitizeComment } from "./starlark";
+
+const HEADER =
+  '# Codex execpolicy rules — generated from @fusengine/harness src/policy/guards/security.ts\n' +
+  "# DO NOT hand-edit: regenerate via `harness codex-rules`.\n" +
+  "#\n" +
+  "# security.ts is the source of truth for dangerous-command detection; every\n" +
+  '# CRITICAL_PATTERNS label maps to decision = "forbidden", every ASK_PATTERNS\n' +
+  '# label maps to decision = "prompt". Strictest decision wins across matches.\n' +
+  "# The harness remains the AUTHORITATIVE enforcement layer — this file is a\n" +
+  "# complementary defense layer on the Codex side, not a replacement.\n" +
+  "#\n" +
+  "# IRREDUCIBLE gaps (shell syntax, invisible to argv-prefix matching, no\n" +
+  "# prefix_rule can express them) — compensated by sandbox_mode +\n" +
+  "# approval_policy.granular.sandbox_approval, not by this file:\n" +
+  "#   - fork bomb: `:(){ :|:& };:`\n" +
+  "#   - redirect to a raw disk device: `> /dev/sda`\n" +
+  "#   - write to /etc via redirection: `> /etc/...`\n" +
+  "#\n" +
+  "# ASSUMED over-width (intentionally broader than security.ts, chosen to\n" +
+  "# avoid a silent gap rather than an exact-but-brittle translation):\n" +
+  "#   - dd: prompts on every dd invocation; security.ts only fires on of=/dev/*\n" +
+  "#   - rm: prompts even on paths security.ts exempts via a 'trash' substring\n" +
+  "#   - rm/eval/unlink: prompts even on a bare token with no trailing argument;\n" +
+  "#     security.ts requires a space (i.e. an argument) after the command\n" +
+  "#   - chmod 777: prompts on relative paths too, not only absolute ones\n" +
+  "#   - sudo (/usr/bin/sudo alias): forbids the absolute-path form too;\n" +
+  "#     security.ts's word-boundary regex does not match a preceding '/'\n" +
+  "#   - curl/wget: prompts on EVERY curl/wget invocation, not only when piped\n" +
+  '#     into a shell; security.ts\'s "remote script piped to a shell" label\n' +
+  "#     only fires on `curl|wget ... | sh`. A simple plain-word pipe IS split\n" +
+  "#     by Codex into separate argv commands (a bare-shell rule would also\n" +
+  "#     catch that case), but this rule additionally targets the download\n" +
+  "#     half for compound chains and non-shell payload execution where\n" +
+  "#     sh/bash never appears as argv[0] (curl -o x && chmod +x x && ./x,\n" +
+  "#     curl ... | python3); it replaces a former bare sh/bash/zsh heuristic\n" +
+  '#     that prompted on ~50% of Codex\'s own `bash -lc "..."` command\n' +
+  "#     wrapping and rarely caught the actual download\n" +
+  "#\n" +
+  "# NOT covered (out of scope, not an over-width — a purely local pipe with no\n" +
+  "# network fetch is invisible to this rule AND to security.ts, which only\n" +
+  "# matches curl/wget as the left-hand side of the pipe):\n" +
+  "#   - `cat file | sh`: local pipe, no curl/wget involved\n" +
+  "#   - quoted-variable/redirection installer one-liners, e.g.\n" +
+  '#     `curl -fsSL "$URL" | sh`: variable substitution disables Codex\'s\n' +
+  "#     pipe-splitting, collapsing the whole invocation to a single\n" +
+  "#     ['bash', '-lc', '<script>'] where curl is not argv[0] — this exact\n" +
+  "#     form was covered by the removed bare sh/bash heuristic and is no\n" +
+  "#     longer covered by any rule here\n" +
+  "#\n" +
+  "# The following labels have NO argv-prefix equivalent at all (shell syntax\n" +
+  "# not visible to execpolicy's argv matching) and are intentionally NOT\n" +
+  "# expressed as prefix_rule() below — covered instead by sandbox_mode/approval_policy:";
+
+/** Render the full Codex execpolicy `.rules` Starlark file as a string. */
+export function buildCodexRules(): string {
+  const skipComment: string = SKIP_LIST.map(
+    (s) => `#   - ${sanitizeComment(s.sourceLabel)}: ${sanitizeComment(s.reason)}`,
+  ).join("\n");
+  const body: string = renderPrefixRules(ALL_RULES);
+  return `${HEADER}\n${skipComment}\n\n${body}\n`;
+}

package/src/codex-rules/index.ts

@@ -0,0 +1,8 @@
+/**
+ * Codex execpolicy `.rules` (Starlark) generator, derived from the harness's
+ * own `security.ts` dangerous-command patterns. Pure, no I/O — see
+ * `../cli/bin.ts`'s `codex-rules` subcommand for stdout/`--out` wiring.
+ */
+export { buildCodexRules } from "./build";
+export { ALL_RULES, CRITICAL_RULES, ASK_RULES, SKIP_LIST } from "./mapping";
+export type { CodexDecision, CodexPrefixRule, CodexSkipEntry } from "./types";

package/src/codex-rules/mapping.ts

@@ -0,0 +1,42 @@
+import type { CodexPrefixRule } from "./types";
+import { RM_VARIANT_RULES } from "./rules/rm-variants";
+import { MKFS_RULES } from "./rules/mkfs";
+import { DISKUTIL_RULES } from "./rules/diskutil";
+import { DD_RULES } from "./rules/dd";
+import { SINGLE_COMMAND_RULES } from "./rules/single-commands";
+import { PRIVILEGE_RULES } from "./rules/privilege";
+import { ASK_RULES as BASE_ASK_RULES } from "./rules/ask";
+import { CHMOD_ASK_RULES } from "./rules/chmod-ask";
+import { REMOTE_FETCH_RULES } from "./rules/remote-fetch";
+import { withAbsolutePathAliases } from "./rules/absolute-paths";
+import { SKIP_LIST } from "./skip-list";
+
+/** Every `decision = "forbidden"` rule, hand-mapped from CRITICAL_PATTERNS. */
+const CRITICAL_BASE: CodexPrefixRule[] = [
+  ...RM_VARIANT_RULES,
+  ...MKFS_RULES,
+  ...DISKUTIL_RULES,
+  ...SINGLE_COMMAND_RULES,
+  ...PRIVILEGE_RULES,
+];
+
+/** Every `decision = "prompt"` rule, hand-mapped from ASK_PATTERNS (+ dd, downgraded). */
+const ASK_BASE: CodexPrefixRule[] = [...BASE_ASK_RULES, ...CHMOD_ASK_RULES, ...DD_RULES, ...REMOTE_FETCH_RULES];
+
+/** Absolute-path mirrors of the bare-name rules above (see `rules/absolute-paths.ts`). */
+const ABSOLUTE_ALIASES: CodexPrefixRule[] = withAbsolutePathAliases([...CRITICAL_BASE, ...ASK_BASE]);
+
+export const CRITICAL_RULES: CodexPrefixRule[] = [
+  ...CRITICAL_BASE,
+  ...ABSOLUTE_ALIASES.filter((r) => r.decision === "forbidden"),
+];
+
+export const ASK_RULES: CodexPrefixRule[] = [
+  ...ASK_BASE,
+  ...ABSOLUTE_ALIASES.filter((r) => r.decision === "prompt"),
+];
+
+export { SKIP_LIST };
+
+/** Every generated `prefix_rule`, critical (`forbidden`) + ask (`prompt`). */
+export const ALL_RULES: CodexPrefixRule[] = [...CRITICAL_RULES, ...ASK_RULES];

package/src/codex-rules/rules/absolute-paths.ts

@@ -0,0 +1,52 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * Absolute-path executable aliases — Codex only resolves an absolute path
+ * to its basename rule when the CLI is run with `--resolve-host-executables`
+ * (opt-in, off by default; this generated `.rules` file cannot assume it).
+ * `/bin/rm -rf /` and a bare `rm -rf /` are two DIFFERENT argv prefixes to
+ * execpolicy, so every rule keyed on one of these bare names is mirrored
+ * onto its common absolute-path forms.
+ */
+const ABSOLUTE_PATH_ALIASES: Record<string, string[]> = {
+  rm: ["/bin/rm", "/usr/bin/rm"],
+  chmod: ["/bin/chmod", "/usr/bin/chmod"],
+  diskutil: ["/usr/sbin/diskutil"],
+  dd: ["/bin/dd", "/usr/bin/dd"],
+  sudo: ["/usr/bin/sudo"],
+};
+
+/** Escape regex metacharacters so a dynamic token can be safely embedded in a `RegExp` literal. */
+function escapeRegExp(token: string): string {
+  return token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** Replace a match/notMatch example's leading token with an absolute-path alias. */
+function aliasExample(example: string, from: string, to: string): string {
+  return example.replace(new RegExp(`^${escapeRegExp(from)}\\b`), to);
+}
+
+/**
+ * Clone every rule in `rules` whose first pattern token has a known
+ * absolute-path alias, producing one variant per alias (same decision,
+ * same sourceLabel — traced back to the same `security.ts` label).
+ */
+export function withAbsolutePathAliases(rules: CodexPrefixRule[]): CodexPrefixRule[] {
+  const out: CodexPrefixRule[] = [];
+  for (const rule of rules) {
+    const first = rule.pattern[0];
+    if (typeof first !== "string") continue;
+    const aliases = ABSOLUTE_PATH_ALIASES[first];
+    if (!aliases) continue;
+    for (const alias of aliases) {
+      out.push({
+        ...rule,
+        pattern: [alias, ...rule.pattern.slice(1)],
+        match: rule.match.map((m) => aliasExample(m, first, alias)),
+        notMatch: rule.notMatch?.map((m) => aliasExample(m, first, alias)),
+        justification: `${rule.justification} (absolute-path form; Codex does not resolve executable basenames by default).`,
+      });
+    }
+  }
+  return out;
+}

package/src/codex-rules/rules/ask.ts

@@ -0,0 +1,44 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * `prompt`-decision rules — hand-mapped 1:1 from `security.ts`'s
+ * ASK_PATTERNS. `DANGEROUS PATTERN: chmod 777` lives in `chmod-ask.ts`
+ * (needed multiple flag-order variants). `DANGEROUS PATTERN: write to /etc`
+ * is intentionally absent here: it fires on shell redirection
+ * (`> /etc/...`), which is not a single argv invocation — see
+ * `../skip-list.ts`.
+ */
+export const ASK_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "DANGEROUS PATTERN: recursive chown",
+    pattern: ["chown", "-R"],
+    decision: "prompt",
+    justification: "Recursive ownership change; confirm scope.",
+    match: ["chown -R user:user /srv/app"],
+    notMatch: ["chown user file.txt"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: eval",
+    pattern: ["eval"],
+    decision: "prompt",
+    justification: "Evaluates arbitrary shell input.",
+    match: ["eval $(cat script.sh)"],
+    notMatch: ["node eval.js"],
+  },
+  {
+    sourceLabel: "DELETE: 'rm' permanently deletes - confirmation required",
+    pattern: ["rm"],
+    decision: "prompt",
+    justification: "rm permanently deletes; confirm before running.",
+    match: ["rm file.txt"],
+    notMatch: ["rmdir empty"],
+  },
+  {
+    sourceLabel: "DELETE: 'unlink' command detected - confirmation required",
+    pattern: ["unlink"],
+    decision: "prompt",
+    justification: "unlink permanently removes a file; confirm before running.",
+    match: ["unlink file.txt"],
+    notMatch: ["ln -s a b"],
+  },
+];

package/src/codex-rules/rules/chmod-ask.ts

@@ -0,0 +1,57 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * `chmod 777` `prompt`-decision variants — hand-mapped from `security.ts`'s
+ * `DANGEROUS PATTERN: chmod 777` ASK_PATTERNS label. The source regex
+ * accepts any chain of `-[a-zA-Z]+` flags before `777`; `prefix_rule` needs
+ * one literal-token variant per common flag order, so every frequent
+ * ordering is enumerated. Always `prompt`: `prefix_rule` cannot distinguish
+ * an absolute-path target from a relative one, so both are prompted rather
+ * than letting an absolute-path `chmod 777` fall through silently.
+ */
+export const CHMOD_ASK_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions; confirm the target is intended.",
+    match: ["chmod 777 file.txt", "chmod 777 /tmp/file"],
+    notMatch: ["chmod 755 file.txt"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "-R", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions, recursive; confirm the target is intended.",
+    match: ["chmod -R 777 dir"],
+    notMatch: ["chmod -R 755 dir"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "-r", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions, recursive (lowercase flag); confirm the target is intended.",
+    match: ["chmod -r 777 dir"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "-v", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions, verbose flag; confirm the target is intended.",
+    match: ["chmod -v 777 file.txt"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "-Rv", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions, combined recursive+verbose flags; confirm the target is intended.",
+    match: ["chmod -Rv 777 dir"],
+  },
+  {
+    sourceLabel: "DANGEROUS PATTERN: chmod 777",
+    pattern: ["chmod", "-vR", "777"],
+    decision: "prompt",
+    justification: "World-writable permissions, combined verbose+recursive flags; confirm the target is intended.",
+    match: ["chmod -vR 777 dir"],
+  },
+];

package/src/codex-rules/rules/dd.ts

@@ -0,0 +1,23 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * `dd` — hand-mapped from `security.ts`'s `CRITICAL: Detected dangerous
+ * command 'dd if='` label (source regex only fires on `of=/dev/...`).
+ * Owner decision: DOWNGRADE forbidden -> prompt. `prefix_rule` cannot
+ * glob-match a `key=value` argv token against a raw-device path, so a
+ * literal forbidden translation would silently block legitimate
+ * `dd if=a.img of=b.img` usage — prompting on every `dd` invocation instead
+ * never lets a raw-disk write through silently, without blocking safe use.
+ */
+export const DD_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "CRITICAL: Detected dangerous command 'dd if='",
+    pattern: ["dd"],
+    decision: "prompt",
+    justification:
+      "dd can overwrite a raw block device via of=/dev/...; prompts on every dd invocation " +
+      "(broader than security.ts, which only fires on of=/dev/*) because execpolicy cannot " +
+      "glob-match that argv token — owner decision: do not block legitimate dd usage.",
+    match: ["dd if=/dev/zero of=/dev/sda", "dd if=a.img of=b.img"],
+  },
+];

package/src/codex-rules/rules/diskutil.ts

@@ -0,0 +1,33 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * `diskutil` erase/partition variants — hand-mapped from `security.ts`'s
+ * case-insensitive `\bdiskutil\s+(?:erase|partitionDisk)\b/i` CRITICAL
+ * label. `prefix_rule` has no case-insensitive matching, so every real
+ * casing macOS users actually type (camelCase, all-lowercase, all-caps) is
+ * enumerated explicitly as an alternation at position 1.
+ */
+export const DISKUTIL_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "CRITICAL: Detected dangerous command 'diskutil erase'",
+    pattern: [
+      "diskutil",
+      [
+        "erase",
+        "eraseDisk",
+        "erasedisk",
+        "ERASEDISK",
+        "eraseVolume",
+        "erasevolume",
+        "ERASEVOLUME",
+        "partitionDisk",
+        "partitiondisk",
+        "PARTITIONDISK",
+      ],
+    ],
+    decision: "forbidden",
+    justification: "Erases or repartitions a macOS disk/volume (case-variant enumeration; execpolicy has no case-insensitive match).",
+    match: ["diskutil eraseDisk /dev/disk2", "diskutil ERASEDISK /dev/disk2", "diskutil erase /dev/disk2"],
+    notMatch: ["diskutil list"],
+  },
+];

package/src/codex-rules/rules/mkfs.ts

@@ -0,0 +1,42 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * `mkfs` filesystem-formatting variants — hand-mapped from `security.ts`'s
+ * `\bmkfs(?:\.[a-z0-9]+)?\b` CRITICAL_PATTERNS label. The source regex
+ * accepts ANY `.suffix`; `prefix_rule` cannot express an open-ended suffix,
+ * so every real-world `mkfs.*` filesystem type is enumerated explicitly as
+ * an alternation at position 0 (exhaustive, not a mechanical derivation).
+ */
+export const MKFS_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "CRITICAL: Detected dangerous command 'mkfs'",
+    pattern: [
+      [
+        "mkfs",
+        "mkfs.ext2",
+        "mkfs.ext3",
+        "mkfs.ext4",
+        "mkfs.xfs",
+        "mkfs.btrfs",
+        "mkfs.exfat",
+        "mkfs.vfat",
+        "mkfs.fat",
+        "mkfs.ntfs",
+        "mkfs.f2fs",
+        "mkfs.hfsplus",
+        "mkfs.apfs",
+        "mkfs.msdos",
+        "mkfs.minix",
+        "mkfs.jfs",
+        "mkfs.reiserfs",
+        "mkfs.udf",
+        "mkfs.bfs",
+        "mkfs.cramfs",
+      ],
+    ],
+    decision: "forbidden",
+    justification: "Formats a block device, destroying its contents (exhaustive mkfs.* variant enumeration).",
+    match: ["mkfs.exfat /dev/sda1", "mkfs.f2fs /dev/sdb1", "mkfs /dev/sdb1", "mkfs.ext4 /dev/sda1"],
+    notMatch: ["ls /dev"],
+  },
+];

package/src/codex-rules/rules/privilege.ts

@@ -0,0 +1,49 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * Privilege-escalation binaries — hand-mapped 1:1 from `security.ts`'s
+ * `sudo`/`su`/`doas`/`passwd`/`del` CRITICAL_PATTERNS labels (parity
+ * `security_rules.PRIVILEGE_COMMANDS`).
+ */
+export const PRIVILEGE_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "PRIVILEGE ESCALATION: sudo",
+    pattern: ["sudo"],
+    decision: "forbidden",
+    justification: "Runs a command with elevated privileges.",
+    match: ["sudo rm -rf /tmp"],
+    notMatch: ["echo sudo"],
+  },
+  {
+    sourceLabel: "PRIVILEGE ESCALATION: su",
+    pattern: ["su"],
+    decision: "forbidden",
+    justification: "Switches to another user, typically root.",
+    match: ["su -", "su root"],
+    notMatch: ["sudo ls"],
+  },
+  {
+    sourceLabel: "PRIVILEGE ESCALATION: doas",
+    pattern: ["doas"],
+    decision: "forbidden",
+    justification: "BSD-style sudo alternative for elevated privileges.",
+    match: ["doas reboot"],
+    notMatch: ["ls"],
+  },
+  {
+    sourceLabel: "PRIVILEGE ESCALATION: passwd",
+    pattern: ["passwd"],
+    decision: "forbidden",
+    justification: "Changes a user's password.",
+    match: ["passwd root"],
+    notMatch: ["cat /etc/passwd"],
+  },
+  {
+    sourceLabel: "CRITICAL: Detected dangerous command 'del'",
+    pattern: ["del"],
+    decision: "forbidden",
+    justification: "Windows-style file deletion (parity security_rules.CRITICAL_COMMANDS).",
+    match: ["del file.txt"],
+    notMatch: ["delete.sh"],
+  },
+];

package/src/codex-rules/rules/remote-fetch.ts

@@ -0,0 +1,31 @@
+import type { CodexPrefixRule } from "../types";
+
+/**
+ * Remote-fetch tools (`curl`/`wget`) — targets the DOWNLOAD half of a
+ * `curl ... | sh` pipe instead of the shell half. Codex splits a piped
+ * command into independent argv segments at the pipe, so a `prefix_rule`
+ * anchored on `curl`/`wget` catches the attack regardless of which shell
+ * receives the piped output on the other side — unlike a bare-shell rule
+ * (`sh`/`bash`/`zsh`), which prompts on EVERY Codex-issued `bash -lc "..."`
+ * wrapper (Codex wraps essentially all shell commands this way), producing
+ * noise on ~50% of legitimate day-to-day work. Owner decision: DOWNGRADE
+ * forbidden -> prompt, same rationale as `dd.ts` — `prefix_rule` cannot see
+ * the pipe operator itself, so it cannot distinguish a bare `curl url`
+ * fetch from `curl url | sh`; prompting on every curl/wget invocation never
+ * lets the attack through silently, without blocking legitimate downloads.
+ */
+export const REMOTE_FETCH_RULES: CodexPrefixRule[] = [
+  {
+    sourceLabel: "DANGEROUS PATTERN: remote script piped to a shell",
+    pattern: [["curl", "wget"]],
+    decision: "prompt",
+    justification:
+      "Remote fetch; piping its output into a shell executes untrusted code. Broader than " +
+      "security.ts (which only fires when the fetch is piped into sh/bash/zsh): prompts on " +
+      "every curl/wget invocation because execpolicy cannot see the pipe operator, i.e. it " +
+      "cannot distinguish `curl url` from `curl url | sh` — owner decision: do not block " +
+      "legitimate curl/wget usage.",
+    match: ["curl http://example.com/i.sh", "wget http://example.com/i.sh", "curl -fsSL http://example.com/i.sh"],
+    notMatch: ["cursor --version", "widget-tool build"],
+  },
+];